After a firewall rule was added that drops every ICMP packet arriving at a gateway, small requests over a VPN tunnel still work but large HTTP downloads through the tunnel hang after a few kilobytes. Which ICMP message is the firewall swallowing?

LPIC-1 Exam 102-500, objective 109. Networking fundamentals hard

Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.

Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.

How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.

The options

Not correct Echo request (type 8)

Wrong. Echo request is what ping sends. Losing it breaks reachability tests, but it has no bearing on whether a bulk TCP transfer can get through.

Correct Destination unreachable, code 'fragmentation needed and DF set' (type 3, code 4)

Correct. When a full-size packet with the Don't Fragment bit set meets the tunnel's smaller MTU, the router replies with type 3 code 4 carrying the MTU it can take. Dropping that reply leaves the sender retransmitting the same oversized segments forever, which is exactly the pattern of a stalled bulk transfer.

Not correct Time exceeded (type 11)

Wrong. Time exceeded is emitted when the TTL reaches zero; it is what makes traceroute work. Blocking it hides the intermediate hops from traceroute but does not stall a transfer.

Not correct Redirect (type 5)

Wrong. A redirect tells a host that a better first-hop router exists for a destination. Many hosts ignore redirects for security reasons, and their absence never breaks an established TCP flow.

Why

ICMP is not merely a diagnostic toy; path MTU discovery depends on it. A sender that sets the Don't Fragment bit learns the true path MTU only from ICMP type 3 code 4 messages, so a blanket 'drop all ICMP' rule produces the classic black-hole symptom of working handshakes and hanging bulk transfers. The rule to carry away is to filter ICMP by type rather than wholesale, keeping destination-unreachable and time-exceeded even when echo is blocked.

Where this comes from

Cited
manual page icmp(7)

Practise this

Reading one question is not practice. The trainer will draw a short set from objective 109 and space the ones you get wrong.

Practise LPIC-1 Exam 102-500

More questions on this objective

All questions on Networking fundamentals

Practise LPIC-1 Exam 102-500