DROPING ICMP and still getting kernel messages of icmp traffic?‏

Hello,

I recently got a medium size DoS attack against my uplink, I deduce that because the attack was bigger than my uplink then I was effectively DoSed.

The attack nature was ICMP, but i had a ruleset to DROP all incomign ICMP. What confuses me the most is that I saw messages AS IF the kernel was dealing with ICMP traffic selectively. The result I was expecting was to not have any type of syslog ICMP messages regarding ICMP because in theory DROP means DROP silently.

Can anybody explain to me what could have occured?

Feb 27 14:27:11  kernel: Redirect from 125.215.162.43 on eth0 about 125.215.162.46 ignored.
Feb 27 14:27:11  kernel:  Advised path = 4.221.27.8 -> 192.168.11.6
Feb 27 14:27:11  kernel: Redirect from 72.15.39.88 on eth0 about 72.15.39.99 ignored.
Feb 27 14:27:11  kernel:  Advised path = 4.221.27.8 -> 72.15.39.99
Feb 27 14:27:12  kernel: Redirect from 23.128.38.14 on eth0 about 85.20.63.101 ignored.
Feb 27 14:27:12  kernel:  Advised path = 4.221.27.8 -> 85.20.63.101
Feb 27 14:27:13  kernel: Redirect from 89.167.45.143 on eth0 about 89.167.45.118 ignored.
Feb 27 14:27:13  kernel:  Advised path = 4.221.27.8 -> 89.167.45.118
Feb 27 14:27:13  kernel: Redirect from 94.255.230.139 on eth0 about 94.255.231.10 ignored.
Feb 27 14:27:14  kernel:  Advised path = 4.221.27.8 -> 94.255.231.10
Feb 27 14:27:14  kernel: Redirect from 120.192.115.1 on eth0 about 120.192.115.11 ignored.
Feb 27 14:27:14  kernel:  Advised path = 4.221.27.8 -> 120.192.115.11
Feb 27 14:27:15  kernel: Redirect from 183.61.108.1 on eth0 about 183.61.108.112 ignored.
Feb 27 14:27:16  kernel:  Advised path = 4.221.27.8 -> 183.61.108.112
Feb 27 14:27:16  kernel: Redirect from 109.164.253.57 on eth0 about 109.164.253.59 ignored.
Feb 27 14:27:16  kernel:  Advised path = 4.221.27.8 -> 109.164.253.59
Feb 27 14:27:16  kernel: Redirect from 61.92.213.127 on eth0 about 61.92.212.1 ignored.
Feb 27 14:27:16  kernel:  Advised path = 4.221.27.8 -> 119.247.29.11

Finally, is there any difference between DROPing ICMP and using the sysctl variable to ignore all ICMP?

Alex

Hello...

I have not recieved a response, maybe my question was a bit messy if it was I apologize for that..

In concrete anybody know what is the difference in utilizing iptables to DROP all ICMP, vrs using sysctl to ignore all ICMP ?

Does it make sense I was droping all ICMP in iptables but still recieving messages in syslog that ICMP redirect packets where getting ignored every now and then (by that time i had not used sysctl, but i was recommended to do so hence my question)

Thanks guys

Alex