Redirect Host: Getting ICMP responses that aren't from the address I pinged?

Hardware Hub Networking
1

First let me say this is not something I did, I’m not in control of the network in question in any way shape or form. I’m just trying to learn from this.

I help run a broadcasting/media/production program at my school, and we leverage a BlackMagic ATEM with a Linux server to handle streaming via multicast, that’s why I’ve got a server on a network that’s not mine.

Preface: Over the summer, our IT department (see linked photo) replaced our switches with new ones from Adtran. We really didn’t need the upgrade, literally their only excuse was that they didn’t know how to configure the HP switches we had. So…that’s really all you need to know about them.

So I go to the Linux server, which was all set up and working perfect at the beginning of the summer, and hasn’t been touched since. My immediate first instinct is “I bet they messed up the MAC filtering again” because they love to do that. So I log in and type ping 8.8.8.8, hoping and praying it works.

Instead of getting a response from 8.8.8.8, I get a response from 10.4.0.10, which I happen to know is the gateway for this subnet. My face at this point:

Then I read a little more and discover not only is this the wrong IP responding, but I’m getting this little message:

PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
From 10.4.0.10: icmp_seq=1 Redirect Host (New nexthop: 10.4.0.10)
64 bytes from 10.4.0.10: icmp_seq=1 ttl=43 time=12.6ms

and so on…it keeps getting responses back from 10.4.0.10 until you CTRL+C your way out of it.

So I guess what I’m asking is:

  1. What on earth does this mean?
  2. Is there any reason this would be done on purpose?
  3. How the heck do you even do this in the first place? I had no idea this was possible, so I’m honestly just curious at this point.

What’s weird is the thing still has internet. I checked by wgeting a file, which worked fine, and I also sudo apt-get upgraded the server’s packages, and that worked as normal too. So what’s going on?

Networking masters like @DeusQain @wendell @Dexter_Kane and others, your insight would be greatly appreciated.

2

Have you tried pinging something else? Could be that they’re redirecting dns server requests to their own dns server (this is a school so it makes sense for filtering purposes) but it does seem weird to do that at an ip level rather than just for the dns port.

Otherwise it could be some sort of NAT issue or a proxy of some kind.

3

I thought about the DNS thing, and that would make sense, except upon further testing I discovered it doesn’t happen on Windows computers (that or maybe Windows’ ping utility just ignores it or doesn’t tell you). I also tried pinging my public IP (which should not be on any kind of a list, as I just have a residential internet connection, nothing special) and it still gets replies from 10.4.0.10 . Also, AFAIK, this router isn’t the DNS server. On everything I’ve set up for them it’s been 10.50.0.219, which is why it didn’t make sense that the router would be the one its redirected to.

Edit: according to nslookup on the Linux box in question, 10.50.0.219 is the name server. I checked on a Windows machine, though, and it’s saying the name server is 10.4.0.2. IIRC, 10.4.0.2 is the slave domain controller that’s physically at our school, so it makes sense for that to be the DNS server, but everything goes out the 10.50.0.0 subnet so I suspect 10.4.0.2 just forwarding upstream to 10.50.0.219. I could be wrong though, I will do further testing on that later.

They are a little too NAT-happy though, we have like 6 layers of NAT just to get to an internet-facing L3 switch…lol…and we have had routing loops on multiple occasions as well, so it’s probably a router config issue.

4

Sounds like it. You could try doing a trace route and see what that tells you.

5

if you dig a domain, which server does respond? Do you get valid DNS queries from the servers 8.8.8.8 gets redirected from?

7

you’re pinging 8.8.8.8, which is google DNS

Do you really think Google has ONE DNS server? fuck no,

That’s most likely a load balancer for the hundreds of dns servers they have. your ping packet is going to the load balancer which also forwards ICMP along with requests on port 53, then getting sent to a dns server, and the dns server is replying.

My best guess without looking into it at all

8

if one pings 8.8.8.8 it responds to it.. of course 8.8.8.8 is a cluster, but as far as I know its load balanced with BGP so the closes server gets to respond…

And even if it would redirect, it would not redirect to a private IP.

1 Like
9

Instead of getting a response from 8.8.8.8, I get a response from 10.4.0.10, which I happen to know is the gateway for this subnet.

10

Didn’t read, My b

11

1 Like
12

First of all, it is not a DNS issue, since you aren’t resolving any DN’s. There’s some confusion about this from the responses in this thread; if you just type in an IP address you don’t need any resolution.

The reason for ICMP Redirect can be found in the ICMP Documentation from IETF.

[quote] The gateway sends a redirect message to a host in the following
situation. A gateway, G1, receives an internet datagram from a
host on a network to which the gateway is attached. The gateway,
G1, checks its routing table and obtains the address of the next
gateway, G2, on the route to the datagram’s internet destination
network, X. If G2 and the host identified by the internet source
address of the datagram are on the same network, a redirect
message is sent to the host. The redirect message advises the
host to send its traffic for network X directly to gateway G2 as
this is a shorter path to the destination. The gateway forwards
the original datagram’s data to its internet destination.[/quote]

So, your packet isn’t getting dropped, it’s being forwarded. The issue is probably happening because your network architecture (apparently) includes multiple non-redundant gateways and there is no dynamic routing protocol in place to figure it out.

If I were you, I would just disable ICMP redirects on every unit in your network that has a NIC, just in case. ICMP Redirects are bad. Having ICMP redirects enabled damages security as well as causing latency issues.

1 Like
13

Assuming it can also cause ICMP storm and given the routing , port control setup or lack of that could be bad and bring the network to it’s knees.

On Cisco stuff you enable used to enable broadcast storm flood control on the ports.

14

ICMP Redirects have been used for DDOS attacks, malicious route injection, targeted host DOS attacks, and other malicious ends.

15

Yes…they’re fun.

“I’m not redoing the subnets, I’m just changing the IP ranges.” -Actual thing I was told

16

Well I read more about it, and the idea of an ICMP redirect makes sense to me. I just don’t understand how the router can send an ICMP redirect that changes the next hop to the previous hop. Literally I have to go through 10.4.0.10 in order to get to anything else, but 10.4.0.10 seems to be saying “Don’t use 10.4.0.10, use 10.4.0.10” and that’s the part that doesn’t make sense.

Could this be considered a routing loop? I don’t like to try to do their jobs for them but if it’s a legit routing loop I’ll shoot them an email real quick. I just don’t want to look like an idiot so I wanted to make sure I understood what this meant…

17

Try to do some troubleshooting setting up a static uplink route, and if you can’t resolve the issue, I report gather all relevant information and send it along to your network administrator. No harm can come of asking questions.

18

I thought that was what was happening, but it doesn’t make sense why I don’t get a response from 8.8.8.8 . Is the response from 10.4.0.10 just the router “relaying” the response, or is it just the router being dumb?

AFAIK, there’s not multiple non-redundant gateways on this network. I can’t tell you anything “for sure” because it’s not my network, I only control one Linux server and that’s not even “mine”, so I’m sort of limited in my ability to figure out what’s going on…lol

Thanks for the help everybody! I am going to send an email to the folks in charge within the next couple days and basically say “hey I figured out this is happening and I’m not sure why, could you enlighten me if you did this on purpose?”

Anybody know if Windows even responds to ICMP redirects by default? I know it’s possible to have a host ignore them, and most of the computers (if not all, unfortunately, including the servers) are running Windows on this network so that may be why this (potential) problem has gone unfixed.