I'm investigating a server that pings throughout the day to random IPs on the internet. I set up IPtables to log and drop (INPUT & OUTPUT) packets but I still see icmp traffic on the network firewall. I can't seem to track the process that is initiating these.
Looked at a lot of questions regarding network traffic with tcp/upd ports but icmp does not use ports.
I've tried iptables, tcpdump, lsof, and netstat. I've probably not used them correctly or quick icmp packets are hard to trace down.
Red Hat Linux 5.x VM and I can't upgrade because it runs legacy web pages
Here is a pastebin link to the IP list
Chain OUTPUT (policy ACCEPT 2129K packets, 1555M bytes)
pkts bytes target prot opt in out source destination
2834 248K LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 8 level 4
2834 248K DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0
Dec 6 14:51:41 xx kernel: IN=eth0 OUT= MAC=00:0c:29 SRC=18.104.22.168 DST=x LEN=96 TOS=0x00 PREC=0x00 TTL=252 ID=29693 PROTO=ICMP TYPE=3 CODE=13 [SRC=x DST=192.168.224.161 LEN=60 TOS=0x00 PREC=0x00 TTL=61 ID=56354 DF PROTO=TCP SPT=53646 DPT=17778 WINDOW=5840 RES=0x00 SYN URGP=0 ]