First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
0

What does a ping result of "Destination unreachable" and "Host unreachable" mean?

hey everyone,

I am new here, and I am not an wireshark expert, I met this problem, our site became inreachable, when I ping I got this message using wireshark.

Internet Protocol Version 4, **Src: SITE IP**, **Dst: MY LAPTOP**

Internet Control Message Protocol
Type: 3 (Destination unreachable)
Code: 1 (Host unreachable)
Checksum: 0x7513 [correct]
[Checksum Status: Good]
Unused: 00000000
Internet Protocol Version 4, **Src: MY LAPTOP, Dst: SITE IP**
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes (5)
    Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
        0000 00.. = Differentiated Services Codepoint: Default (0)
        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    Total Length: 60
    Identification: 0x8e7f (36479)
    000. .... = Flags: 0x0
    ...0 0000 0000 0000 = Fragment Offset: 0
    Time to Live: 110
    Protocol: ICMP (1)
    Header Checksum: 0x16b6 [validation disabled]
    [Header checksum status: Unverified]
    Source Address: MY LAPTOP
    Destination Address: SITE IP
Internet Control Message Protocol

THANKS

Victrix's avatar
1
Victrix
asked 2023-09-14 17:52:11 +0000
Guy Harris's avatar
19.9k
Guy Harris
updated 2023-09-14 19:28:19 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

2 Answers

0

RFC 1812 provides an explanation.

1 = Host Unreachable - generated by a router if a forwarding path (route) to the destination host on a directly connected network is not available (does not respond to ARP);

RFC 1812 PAGE 81

BigFatCat's avatar
31
BigFatCat
answered 2023-09-15 06:28:33 +0000
edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments
0

ICMP type 3, code 1 messages (Host Unreachable) are usually sent by the router that has an interface in the subnet of the host you are trying to reach when that host does not respond to the ARP request sent by that router. This means the host is not available on the subnet. I.e. it is unreachable.

If the source IP address of the ICMP host unreachable message is the same as the destination of the initial packet (both are listed as "SITE IP" in your output), then maybe there is a loadbalancer involved that chooses to send the unreachable this way, but it might also have other reasons.

SYN-bit's avatar
18.5k
SYN-bit
answered 2023-09-15 06:43:09 +0000
edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer