What's the Destination unreachable ICMP packet(ICMP payload the UDP) usage? [closed]

Question

In my Mac(192.168.2.228), it will send ICMP packet to my house's router (192.168.2.1). with the info Destination unreachable (Port unreachable)

and in the Wireshark packet detail panel, there displays the packet structure:

eth:ehtertype:ip:icmp:ip:udp

and more details:

the payload is IP:UDP (from router to mac), and you see the router port is 53, it related to DNS.

and in my macOS, there is no application listening the port:

$ netstat -an | grep 55166 get nothing.

---

What's the protocol use the packet? and what's the intension of the packet?

Answer 1

ICMP is used to signal network layer (IP) or transport layer (TCP, UDP, ...) errors.

In this case, the ICMP sender 192.168.2.228 informs the initial sender 192.168.2.1 that a transport layer port cannot be reached. The ICMP payload contains parts of the problem packet with the network and transport layer headers. In your case that seems to have been a DNS reply.

Note that host configurations and issues are off-topic here, so we can't dive into the actual reason for the rejection.

Answer 2

Your displaying packet is a message sent via ICMP.

the message means from router's DNS response to your mac unreachable.

192.168.2.1:53 -> 192.168.2.228:55166

You can check your firewall on your macOS, or use Wireshark to capture the while process.

set the filter in your Capture filter:

(udp) and (host 192.168.2.1) and (port 53)