K7212: Ping packets sent to FirePass are reported as lost when the -f switch is used

Non-Diagnostic

Original Publication Date: May 2, 2007

Update Date: Jan 25, 2018

Topic

When the ping -f is used from a or system to ping a FirePass controller, the ping command will report significant packet loss, upon termination of the pinging.

The ping utility sends Internet Control Message Protocol (ICMP) Request packets (ICMP =8, code=0) to the target specified, and listens for ICMP Echo Reply packets (ICMP type=0, code=0).

When the ping -f command is run from a Linux or UNIX , the ping utility will flood the target with large numbers of packets per second. The flood continues until terminated by the user.

Note: The ping utility that is bundled with Microsoft Windows operating systems does not offer the flooding feature.

When the target is a FirePass controller, the statistics reported by the ping utility upon termination of the command will show significant packet loss. The FirePass controller will rate-limit ICMP responses as a security measure against types of attacks designed to use an intermediary as an amplifier, or as a means to camouflage the attack's source. After an initial period of responses to every request, the rate limiting causes only one Echo Response packet per .1 second. The remaining Echo Request packets will go unanswered, causing the packet loss statistic. You can observe this behavior in a network packet trace.

For example:

[root@localhost ~]# tcpdump -c 200 icmp tcpdump: listening on eth0 10:56:14.419942 172.30.8.240 > 172.30.8.11: icmp: echo request (DF) 10:56:14.420188 172.30.8.11 > 172.30.8.240: icmp: echo reply 10:56:14.421291 172.30.8.240 > 172.30.8.11: icmp: echo request (DF) 10:56:14.421420 172.30.8.11 > 172.30.8.240: icmp: echo reply 10:56:14.424771 172.30.8.240 > 172.30.8.11: icmp: echo request (DF) 10:56:14.424918 172.30.8.11 > 172.30.8.240: icmp: echo reply 10:56:14.426674 172.30.8.240 > 172.30.8.11: icmp: echo request (DF) 10:56:14.426790 172.30.8.11 > 172.30.8.240: icmp: echo reply 10:56:14.427623 172.30.8.240 > 172.30.8.11: icmp: echo request (DF) 10:56:14.427788 172.30.8.11 > 172.30.8.240: icmp: echo reply 10:56:14.431343 172.30.8.240 > 172.30.8.11: icmp: echo request (DF) 10:56:14.431541 172.30.8.11 > 172.30.8.240: icmp: echo reply 10:56:14.433322 172.30.8.240 > 172.30.8.11: icmp: echo request (DF) 10:56:14.445227 172.30.8.240 > 172.30.8.11: icmp: echo request (DF) 10:56:14.455261 172.30.8.240 > 172.30.8.11: icmp: echo request (DF) 10:56:14.475253 172.30.8.240 > 172.30.8.11: icmp: echo request (DF) 10:56:14.497228 172.30.8.240 > 172.30.8.11: icmp: echo request (DF) 10:56:14.517369 172.30.8.240 > 172.30.8.11: icmp: echo request (DF) 10:56:14.517485 172.30.8.11 > 172.30.8.240: icmp: echo reply 10:56:14.518793 172.30.8.240 > 172.30.8.11: icmp: echo request (DF) 10:56:14.535262 172.30.8.240 > 172.30.8.11: icmp: echo request (DF) 10:56:14.557222 172.30.8.240 > 172.30.8.11: icmp: echo request (DF) 10:56:14.577512 172.30.8.240 > 172.30.8.11: icmp: echo request (DF) 10:56:14.597298 172.30.8.240 > 172.30.8.11: icmp: echo request (DF) 10:56:14.617525 172.30.8.240 > 172.30.8.11: icmp: echo request (DF) 10:56:14.617675 172.30.8.11 > 172.30.8.240: icmp: echo reply 10:56:14.618954 172.30.8.240 > 172.30.8.11: icmp: echo request (DF) 10:56:14.635258 172.30.8.240 > 172.30.8.11: icmp: echo request (DF) 10:56:14.657399 172.30.8.240 > 172.30.8.11: icmp: echo request (DF) 10:56:14.677358 172.30.8.240 > 172.30.8.11: icmp: echo request (DF) 10:56:14.697340 172.30.8.240 > 172.30.8.11: icmp: echo request (DF) 10:56:14.717377 172.30.8.240 > 172.30.8.11: icmp: echo request (DF) 10:56:14.717616 172.30.8.11 > 172.30.8.240: icmp: echo reply

The corresponding statistics from this ping packet show 83 percent packet loss as a result of the rate limiting:

--- 172.30.8.11 ping statistics --- 2603 packets transmitted, 437 received, 83% packet loss, 43186ms rtt min/avg/max/mdev = 0.135/0.207/0.304/0.038 ms, ipg/ewma 16.597/0.194 ms

Note: The network packet does not show all ping packets, due to the large number of packets sent.

Applies to:

Product: Legacy Products, FirePass 6.0.1, 6.0.0