[ale] How to test your public internet connection for open ports

[Michael H. Warfield]

On Fri, 2011-02-11 at 12:01 -0500, Drifter wrote: 
> On Friday, February 11, 2011 11:46:41 am Michael H. Warfield wrote:
> > Try this one instead.
> > 
> > telnet 130.205.32.5
> 
> 
> I tried. Got this:

> $ telnet 130.205.32.5
> Trying 130.205.32.5...
> telnet: connect to address 130.205.32.5: No route to host

> Interesting.

Ah!  Got I got it right this time.  Sigh.

That is correct and it even tells you the correct error.  You got an
ICMP packet type: UREACH subtype: HOST_UNREACH.  That's the correct
error code and it did come in on ICMP.

QED

If you had hit that other address with a UDP packet (using netcat or
something) instead of a TCP connection, you would have received an ICMP
UNREACH PORT_UNREACH.  TCP defaults to RESETs which is a tcp specific
error.  That was definitely my bad.

In order for PMTU discovery to work, you need ICMP UNREACH
WOULD_FRAGMENT (a different subtype) to pass.  So you don't run into
that problem simply because you are not blocking all ICMP.

You may have said ping or ICMP ECHO before but I saw just ICMP
referenced several times in this thread (maybe that was just the rest of
us, the thread has gotten rather long) and I know I saw at least one
other person mention the problems with PMTU discovery (Path MTU
discovery).

> Sean

Regards,
Mike
-- 
Michael H. Warfield (AI4NB) | (770) 985-6132 |  mhw at WittsEnd.com
   /\/\|=mhw=|\/\/          | (678) 463-0932 |  http://www.wittsend.com/mhw/
   NIC whois: MHW9          | An optimist believes we live in the best of all
 PGP Key: 0x674627FF        | possible worlds.  A pessimist is sure of it!
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 482 bytes
Desc: This is a digitally signed message part
Url : http://mail.ale.org/pipermail/ale/attachments/20110211/57d53c8b/attachment.bin