This is a static archive of our old Q&A Site. Please post any new questions and answers at

I’m seeing ICMP traffic that I did not commence


I'm the only one on my local network and I'm seeing ICMP traffic (destination unreachable) on my network....Why is this? I don't believe that any ICMP traffic besides redirect traffic is good especially if you are not the one initiating it. For some odd reason, my default gateway is attempting to ping my client as shown in the screenshot.

alt text

Can anyone tell me why this is occurring?

asked 01 Oct '14, 20:25

Beldum's gravatar image

accept rate: 0%

One Answer:


You (or some application on your Windows System) were trying to send TCP packets to and your gateway didn't know how to get there (Host unreachable: The target host should be adjacent but isn't) If you want to find out who is trying to connect, you might use an elevated netstat -o and figure out which application is trying to connect.

Regards Matthias,
who thinks that most ICMP packets are good and "redirects" are not among those ;-)

answered 01 Oct '14, 22:02

mrEEde's gravatar image

accept rate: 20%

edited 01 Oct '14, 23:01

Hello, How is it that you know from the information provided that something on my Windows System was trying to send TCP packets to Where did you find that information? Thanks for your assistance.

(01 Oct '14, 22:56) Beldum

The ICMP packet contains the original IP packet that triggered this 'error message'. so in the hexadecimal part of the packet you see another 4500 which is the start of the IP packet 001C is the length (28 bytes) 7F06 says it's a TCP packet and the TTL when the packet was seen is 127. With the initial TTL of windows being 128 this means that only 1 router had routed this packet (= decremented the TTL) .

It would have been easier to spot if you had captured the full packets ;-)

(01 Oct '14, 23:04) mrEEde

Gosh I wish I knew how to use this wireshark tool as well as you. Thanks mrEEde!

(02 Oct '14, 12:21) Beldum