Source Monitoring Point appears to be behind a firewall

Single-ended paths diagnostics are performed using ICMP, but on dual-ended paths, UDP and ICMP might be used. This might result in lower capacity measurements.

Detailed explanation

In the outbound direction, source to target, ICMP is used on mid-path routers but UDP is used for the final hop, i.e., the target. In the inbound direction however, the source might be behind a firewall. When this is the case, the diagnostic uses ICMP both mid-path and on the last reachable hop, the firewall.

Not being able to reach the target is important for two reasons. One, you're only getting partial diagnostics: a network condition between the firewall and the source might be to blame for poor end-to-end performance. Two, firewalls and routers, i.e., networking equipment that distinguishes between control-plane and data-plane, are not good targets: your capacity measurements might be significantly lower, in which case the diagnostic might also return message 56.

Related topics