Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

multiple users on one machine , or any icmp requests to host creates false positives #6

Open
dbillor opened this issue Feb 14, 2020 · 1 comment

Comments

@dbillor
Copy link

dbillor commented Feb 14, 2020

Repro:
run ping to any host,

dbillor@netdev2-westus2:~$ ping bn6-0100-0002-01sw
PING bn6-0100-0002-01sw.aznet.gbl (25.184.112.234) 56(84) bytes of data.
64 bytes from BN6-0100-0002-01SW.aznet.gbl (25.184.112.234): icmp_seq=1 ttl=48 time=62.2 ms
64 bytes from BN6-0100-0002-01SW.aznet.gbl (25.184.112.234): icmp_seq=2 ttl=48 time=62.2 ms
64 bytes from BN6-0100-0002-01SW.aznet.gbl (25.184.112.234): icmp_seq=3 ttl=48 time=62.2 ms
64 bytes from BN6-0100-0002-01SW.aznet.gbl (25.184.112.234): icmp_seq=4 ttl=48 time=62.2 ms

while ping is going run traceroute to any other host you will see entries of icmp requests from the ping to the initial host.

traceroute to ibr02.mwh01 (25.184.240.242), 65 hops max, 52 byte packets
1   MWH03-0101-0304-04T0-lo.aznet.gbl. (25.101.225.21)  550.236µs
2   MWH03-0101-0304-15T1-lo.aznet.gbl. (25.101.224.224)  562.237µs
3   MWH03-0101-0100-01T2-lo.aznet.gbl. (25.101.224.0)  551.736µs
4   MWH01-0100-0200-08RHW-lo.aznet.gbl. (10.244.23.41)  498.233µs
5   MWH01-0100-0100-02RA-lo.aznet.gbl. (10.244.23.1)  464.931µs
6   25.75.128.68 (25.75.128.68)  770.45µs
7   be-142-0.ibr03.mwh01.ntwk.msn.net. (104.44.21.163)  1.565803ms
8   ae141-0.icr01.mwh01.ntwk.msn.net. (104.44.21.156)  6.031596ms
9   MWH01-0100-0100-02MA.aznet.gbl. (25.75.131.15)  773.851µs
10  MWH01-0100-0103-01M1.aznet.gbl. (25.75.131.7)  1.212879ms
11  25.184.240.207 (25.184.240.207)  1.016467ms
12  BN6-0100-0002-01SW.aznet.gbl. (25.184.112.234)  308.874275ms
13  25.184.240.207 (25.184.240.207)  1.021867ms
14  25.184.240.207 (25.184.240.207)  1.163577ms
15  BN6-0100-0002-01SW.aznet.gbl. (25.184.112.234)  35.935159ms

This is due to just blindly looking at icmp requests in the receive socket.

@dbillor dbillor changed the title multiple users on one machine , or any icmp requests to host creates false negatives multiple users on one machine , or any icmp requests to host creates false positives Feb 14, 2020
@niltooth
Copy link

@dbillor did you ever find a resolution to this?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants