Skip to content

ICMP ping reporting false positives #1186

@Aarush289

Description

@Aarush289

Description:
The current ICMP ping implementation reports success whenever any response is received, and failure otherwise. This logic is incorrect.

Correct ICMP ping handling should consider:

  1. Open/Active target: Only a response with a success code (e.g., ICMP Echo Reply) should indicate that the host is reachable.
  2. Closed target: If a "Port Unreachable" error is received (ICMP type 3), the host is reachable but the port/service is closed.
  3. Filtered/Blocked target: If no response is received, the host or service may be actively blocking ICMP packets.

Current Issue:
The current logic treats any response as a positive detection, which leads to false positives. For example, on my local machine, I tested by blocking ICMP packets using:

sudo sysctl -w net.ipv4.icmp_echo_ignore_all=1

Even with ICMP responses blocked, the scan incorrectly marked the host as detected.

Expected Behavior:

  • Only an ICMP Echo Reply should be considered a successful ping.
  • ICMP "Port Unreachable" responses should indicate closed targets.
  • No response should be classified as filtered or unreachable.

Impact:
This behavior can result in inaccurate scan results, reporting hosts as alive when they are actually unreachable or filtering ICMP.

Suggested Fix:
Update the ICMP handling logic to check the response type/error code rather than just the presence of a response.


Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions