Understanding Linux Network Internals

Tuning via /proc Filesystem

There are no compile-time kernel options for the ICMP protocol; all the tuning parameters are defined in net/ipv4/sysctl_net_ipv4.c and are exported via the /proc filesystem in the directory /proc/sys/net/ipv4:

icmp_echo_ignore_all

This flag is used by icmp_echo, the handler for incoming ICMP_ECHO ICMP messages, to decide whether to reply. This kind of filtering is usually done for security reasons by firewalls; however, the ICMP subsystem provides the capability, too.

icmp_echo_ignore_broadcasts

When this flag is set, ICMP_ECHO messages sent to broadcast addresses are ignored. See the section "Directed Broadcasts" in Chapter 30 for an example. The value of this field is checked in icmp_rcv.

icmp_ignore_bogus_error_responses

When this flag is clear, ICMP error message types with a broadcast destination IP address are ignored. icmp_unreach handles the flag.

icmp_errors_use_inbound_ifaddr

This flag is used to change how the source IP address is chosen when the local host transmits an ICMP error message. When the flag is not set, Linux selects the source IP address from the interface that is going to be used to transmit the ICMP message (see Part VII). When the flag is set, Linux selects the source IP address from the interface that received the IP packet that triggered the transmission of the ICMP message.

In most cases, the two interfaces match, but they could differ, for example, when two hosts are reachable with asymmetric routes (see the section "Essential ...