# ICMP dest unrch on localhost [SOLVED]

## SerfurJ

i'm trying to figure out how to stop getting "ICMP dest unrch" traffic on localhost every 5 seconds.  

here what iptraf tells me:

```

ICMP dest unrch (host) (180 bytes) from 192.168.0.3 to 192.168.0.3 on lo

ICMP dest unrch (host) (180 bytes) from 192.168.0.3 to 192.168.0.3 on lo

ICMP dest unrch (host) (180 bytes) from 192.168.0.3 to 192.168.0.3 on lo

```

here is what netstat -ltpn tells me:

```

Active Internet connections (only servers)

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name   

tcp        0      0 0.0.0.0:39523           0.0.0.0:*               LISTEN      9185/rpc.statd      

tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      9396/mysqld         

tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      7325/portmap        

tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      9429/python         

tcp        0      0 0.0.0.0:3632            0.0.0.0:*               LISTEN      8640/distccd        

tcp        0      0 0.0.0.0:6000            0.0.0.0:*               LISTEN      7676/X              

tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1589/sshd           

tcp        0      0 0.0.0.0:758             0.0.0.0:*               LISTEN      7363/rpc.mountd     

tcp        0      0 0.0.0.0:631             0.0.0.0:*               LISTEN      6643/cupsd          

tcp        0      0 0.0.0.0:600             0.0.0.0:*               LISTEN      8901/rpc.mountd     

```

i've tried stopping all of the services except sshd and X.  i still get the "ICMP dest unrch" traffic on localhost every 5 seconds.Last edited by SerfurJ on Wed Nov 03, 2004 1:22 am; edited 1 time in total

----------

## adaptr

What does your routing table look like ?

----------

## SerfurJ

```
Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

192.168.0.0     *               255.255.255.0   U     0      0        0 eth0

loopback        localhost       255.0.0.0       UG    0      0        0 lo

default         192.168.0.1     0.0.0.0         UG    0      0        0 eth0

```

----------

## adaptr

There's no reason this traffic has to be generated by a service; it can just as easily be a program.

Try running iptraf or tcpdump to see more closely why this is generated.

I do assume 192.168.0.3 is your own IP ?

----------

## SerfurJ

yes, 192.168.0.3 is the localhost.  

tcpdump helped.  something with the icmp protocol is trying to reach my laptop.  i'm guessing it's the nfs mount that i had to unmount with "umount -l /mnt/laptop" yesterday after i shut down my laptop.  

is there any way to put an end to it?  i tried killing rpc.statd and shutting down nfs and portmap to no avail.

----------

## adaptr

It may have something to do with the unrestricted interface settings somewhere.

If you bind all services to a specifc IP then there should not be ANY traffic to the loopback address.

----------

## SerfurJ

the "umount -l" was the culprit.  to stop the 

```

ICMP dest unrch (host) (180 bytes) from 192.168.0.3 to 192.168.0.3 on lo

```

messages, i turned on my laptop, mounted the nfs mounts, then unmounted the nfs mounts.

----------

