If you’re not familiar with IP addresses and routers, this article should help you learn something new. When a router receives a data packet destined for an unknown IP address, it will attempt to send an ARP broadcast to resolve it. If a target host responds to this ARP broadcast, the router will forward the data packet to that host.
1. If the router does not receive a response from the target host, it will send ARP requests for the next 4 data packets. If the target host’s MAC address has not been resolved by the time the 6th data packet arrives, by default, the router will drop the 6th and subsequent data packets for the next 20 seconds and return an ICMP Host Unreachable message to the source host.
2. The router sends an ARP query to the network segment, but no computer responds. The router then concludes that the target host does not exist on that network segment, so it returns an ICMP message to the source computer indicating that the destination host is unreachable, notifying the source host of the problem, and simultaneously discards the original data packet. At this point, the issue becomes clear: the ICMP messages recorded by the router are all messages sent from the router to the source address. Analysis of the collected data revealed that these external hosts were primarily looking for three specific fixed internal computers.
3. The target hosts’ ports were fixed between 6881 and 6889. These ports are commonly used by the now-popular BT download protocol. When these hosts were using BT downloads, they left records on the BT server so that other hosts could download resources from them. When these hosts were shut down, the router then informed those external hosts that it could not find them.
4. Because the log service records information at Layer 3 and above, and the data packets received by the router were discarded at Layer 2, these abnormal incoming data packets were not recorded in the logs. To reduce the volume of router logs, use the ip disable icmp-messages destination-unreachables command in configuration mode to disable the forwarding of such messages. Both of these faults were triggered by ICMP, and from a certain perspective, neither was a system configuration issue, but rather caused by external factors. Such faults require some analysis to identify the cause and then appropriate configuration changes to resolve them.
5