-
- Notifications
You must be signed in to change notification settings - Fork 950
Open
Description
Description:
The current ICMP ping implementation reports success whenever any response is received, and failure otherwise. This logic is incorrect.
Correct ICMP ping handling should consider:
- Open/Active target: Only a response with a success code (e.g., ICMP Echo Reply) should indicate that the host is reachable.
- Closed target: If a "Port Unreachable" error is received (ICMP type 3), the host is reachable but the port/service is closed.
- Filtered/Blocked target: If no response is received, the host or service may be actively blocking ICMP packets.
Current Issue:
The current logic treats any response as a positive detection, which leads to false positives. For example, on my local machine, I tested by blocking ICMP packets using:
sudo sysctl -w net.ipv4.icmp_echo_ignore_all=1Even with ICMP responses blocked, the scan incorrectly marked the host as detected.
Expected Behavior:
- Only an ICMP Echo Reply should be considered a successful ping.
- ICMP "Port Unreachable" responses should indicate closed targets.
- No response should be classified as filtered or unreachable.
Impact:
This behavior can result in inaccurate scan results, reporting hosts as alive when they are actually unreachable or filtering ICMP.
Suggested Fix:
Update the ICMP handling logic to check the response type/error code rather than just the presence of a response.
coderabbitai
Metadata
Metadata
Assignees
Labels
No labels