Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

8.5.1 - Null Payload Echo Request

I'm having a serious problem since upgrading to Orion 8.5.1 from 8.5. It seems that any nodes that are behind Checkpoint firewalls are showing a status of "Down/Red". SNMP Polls work perfectly fine but ICMP from Orion to these nodes is failing. A closer look at the firewall logs reveals the reason, "Null payload ICMP packet detected".

Is there any reason why ICMP changed from 8.5 to 8.5.1? What is the probability of getting a hotfix for this issue quickly? Alternatively I'll need instructions for reverting back to 8.5 since this is a major issue for us.

Find more posts tagged with

Accepted answers

jtimes

Well while you wait for an exact answer to your question... Did you check the Network Tab under Settings and put some text in there so Orion is not just sending a 2k empty ICMP packet? Here is a shot of mine and it seems to work for me, but i'm not going thru Checkpoints

Network Settings.JPG

All comments

jtimes

Network Settings.JPG

aLTeReGo

That was genius, nice find. Has that always been there? Any idea why this worked in all previous version of Orion but suddenly changed in 8.5.1?

Works great. Thanks a lot John!

jtimes

Glad to help. Well if I remember correctly, way back in the pre-Orion days of NPM, working on a similar issue when that payload value was set to Zero by default to keep the administrative load at a minimal and that didn't "fly" with any firewalls and it also it looked like a DOS attack on IPS/IDS units(yikes!!!) Just be careful not to add to many bytes in the payload or you can blow a small CIR on a circuit, not to mention the entire circuit and potentially make your customers very unhappy... But I'm not speaking from personal experience at all... ;-)

I've also used this neat little trick to train aspiring Network Engineers to read packet captures by send messages embedded in the pings...

jtimes

Hey I just read Denny's notes on v8.5.1 (look near the bottom)...

"The data portion of ICMP packets is now empty by default." DANGER WILL ROBINSON!!!

FormerMember

Prior to 8.5.1 this was already populated with text.

dedwards

Prior to 8.5.1 this was already populated with text.

Anybody know what it was previously populated with? Forgot to take a note before upgrade... DOH!