IP has a companion protocol that we haven't talked about yet. This is
the Internet Control Message Protocol (ICMP),
used by the kernel networking code to communicate error messages to
other hosts. For instance, assume that you are on erdos again and want to
telnet to port 12345 on quark, but there's no process listening
on that port. When the first TCP packet for this port arrives on
quark, the networking layer
will recognize this arrival and immediately return an ICMP message to
erdos stating “Port
Unreachable.”
The ICMP protocol provides several different messages, many of which
deal with error conditions. However, there is one very interesting
message called the Redirect message. It is generated by the routing
module when it detects that another host is using it as a gateway,
even though a much shorter route exists. For example, after booting, the
routing table of sophus may be
incomplete. It might contain the routes to the Mathematics network, to the
FDDI backbone, and the default route pointing at the Groucho Computing
Center's gateway ( gcc1). Thus, packets for quark would be sent
to gcc1 rather than to
niels, the gateway to the Physics
department. When receiving such a datagram,
gcc1 will notice that this is a poor
choice of route and will forward the packet to
niels, meanwhile returning an
ICMP Redirect message to sophus telling it of the superior route.
This seems to be a very clever way to avoid manually setting up any
but the most basic routes. However, be warned that relying on dynamic
routing schemes, be it RIP or ICMP Redirect messages, is not always a
good idea. ICMP Redirect and RIP offer you little or no choice in
verifying that some routing information is indeed authentic. This
situation allows malicious good-for-nothings to disrupt your entire
network traffic, or even worse. Consequently, the Linux networking
code treats Network Redirect messages as if they were Host Redirects.
This minimizes the damage of an attack by restricting it to just one
host, rather than the whole network. On the flip side, it means that a
little more traffic is generated in the event of a legitimate
condition, as each host causes the generation of an ICMP Redirect
message. It is generally considered bad practice to rely on ICMP
redirects for anything these days.
