> Source: [sk183350](https://support.checkpoint.com/results/sk/sk183350)

# sk183350 - ICMP probe traffic is discarded in transit with a "Time-to-live exceeded" response

| Property | Value |
|----------|-------|
| Solution ID | sk183350 |
| Date Created | 2025-04-14 |
| Last Modified | 2025-04-17 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * ICMP traffic is used for probing a specific host or server for monitoring purposes.
* A large volume of ICMP probing traffic is generated to monitor servers or hosts passing through the gateway. For example, monitoring tools like PingPlotter and similar applications.

## Cause

When ICMP packets reach the gateway, it performs stateful inspection and management of all traffic, including stateless protocols like ICMP. To achieve this, the firewall tries to track each connection through its connection table entries.  

Typically, gateways handle TCP or UDP traffic, both of which involve source and destination ports. ICMP, however, is stateless and does not use ports.  

To differentiate between ICMP streams, the gateway generates a pseudo-port. Without this mechanism, all ICMP streams would appear identical to the gateway, using the same connection table entry.  

![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1744284841484/ICMP_1202504101656243.png)   

In the case of ICMP requests and replies, the gateway uses the ICMP ID and sequence number fields to create the pseudo-port. However, when the gateway handles ICMP TTL Exceeded packets (whether generated by the gateway or an upstream device), these packets lack the ID and sequence number fields, so the gateway can only rely on the Type and Code fields to form the pseudo-port.  

This approach works well for low volumes of traffic, but when dealing with large volumes of ICMP TTL Exceeded packets, there is no distinction between them. All TTL Exceeded packets from the same source to the same destination appear identical to the gateway, as they share the same Type and Code.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content