[lug] Odd line in /var/log/messages

[Gary Masters]

On 26 Sep 1999, Justin wrote:

> Hello everone...I was going through my security logs this morning and noticed
> something I hadn't seen before:
> 
> Sep 26 08:05:33 c101**** icmplog: source quench from 216.68.76.2
> 
> What is the source quench all about? Is that some kind of malicous activity? I
> did an nslookup on the ip and it was not found...I've never seen this and
> would like to know what it means. Thanks...
> 

An ICMP source quench is sent by a router along the data path, and is
used as a congestion control measure.  In other words, it's a way for
a router to say, "I'm busy right now, please try again later." 

-- or --

Is used as a DOS attack.  If you get enough ICMP source quench
messages, you won't send any packets.

Are you running icmpinfo?

--
  Gary Masters
  gmasters at devcg.denver.co.us