Going back to TCPIP basics

A node knows its address and its network. If it tries to connect to a node that is on its network it uses ARP. If it is trying to connect to a node that is not on its network it sends a packet to its default gateway. I don’t see why a node would send an ARP request and thus potentially involve proxy ARP if the target node is not on the source node’s network.

Going way back in my memory I think that it is possible for client nodes to participate in, or at least listen for, routing protocols and use these to determine routes. I used to run a large network that had many triangular paths, ie,

+———B
X |
A + |
Y |
+———C

A, B and C are networks, X and Y are routers.

A node on A can get to a node on C by sending to Y or, if Y is down, by sending to X.

There is a real problem is there is only one “default gateway”. If a node on A must use Y as its default gateway and Y is down then there is no way to “find” X and the alternate path.

We used to do something to PCs so that when the routing protocols determined that Y was unreachable, they would automatically change to using X. I don’t remember what exactly and I don’t have time to dig.

Perhaps your Macs have this functionality enabled by default.

Per the previous comments, I think that ICMP redirects are when a node sends a routing request to its default gateway, if there is a better path to the target node the gateway sends an ICMP Redirect to the client saying “use this router” for further communications which redirects the communications to the new path. I am not sure why this is a problem. If a node does not know about its default gateway then how can that gateway send a redirect to it?

The key functionality is that routers need a way to discover each other and tell each other about state changes and such. These are typically implemented via broadcast protocols so things happen automatically and clients can listen in on these.

Just my guess.

The explanation turned out to be that the host received an “ICMP Redirect” message from another device. Rather than getting into specifics, if you google ICMP Redirect, you might find the answer to what caused your computer to get on the Internet.

Also, you didn’t mention whether you checked to see if your browser was configured to use a proxy server. As you might know, a proxy server works at the application layer and doesn’t need a default route in order to allow you to access the Internet. Perhaps the host was configured with a valid proxy server entry.

Even if this doesn’t help, I hope to hear what the cause turned out to be.

Cheers

1) Try Logging Network activity to File.
netstat -b 5 > NetworkActivity.log

2) Problem sounds like a rootkit Search:
http://www.fantasticfreeware.com/index.php?s=rootkit
McAfee Rootkit Detective
SysProt AntiRootkit
IceSword – Rootkit Detector
Sophos Anti-Rootkit
RootkitRevealer

I read recently that Congress is exploring a more lax definition of fair use to allow for less restrictions on education and not-for-profit use of protected works.

The idea of appropriate use of copyright as relates to technology might be a good podcast topic for the future.

http://www.dummies.com/WileyCDA/DummiesTitle/productCd-0471748986,page-1.html

http://www.cisco.com/warp/public/105/5.html
http://en.wikipedia.org/wiki/Proxy_ARP