Werk #19254: check_icmp: Prevent false "up" results from ICMP identifier collisions
| Component | Checks & agents | ||||||
| Title | check_icmp: Prevent false "up" results from ICMP identifier collisions | ||||||
| Date | Sep 14, 2026 | ||||||
| Level | Trivial Change | ||||||
| Class | Bug Fix | ||||||
| Compatibility | Compatible - no manual interaction needed | ||||||
| Checkmk versions & editions |
|
Under specific circumstances, check_icmp could report a host that was in fact
down as up, because it counted an ICMP echo reply that actually belonged to a
different host.
Technical background
check_icmp marks its echo requests with an ICMP identifier derived from the
lower 16 bits of its process ID. It then accepts any incoming echo reply
carrying that identifier, without verifying that the reply's source address
matches the host being pinged. On Linux, every process holding a raw ICMP
socket receives a copy of all echo replies arriving at the machine, so a reply
meant for another target could be misattributed.
This became likely on large installations for two reasons. Modern
distributions raise kernel.pid_max above 65536, so the truncated identifier
is no longer unique between concurrently running processes, and two pingers can
share the same identifier. In addition, on Enterprise editions the smart ping
process sends a high volume of echo requests using identifiers in the same
range, greatly increasing the chance of a collision. When such a foreign reply
was accepted for a down host, its packet loss dropped below 100% and the host
was reported as up.
With this Werk, check_icmp additionally checks that the source address of
each echo reply matches the address of the target it was sent to, and discards
replies from any other address. Legitimate replies are unaffected.