While scanning a remote system that is running a web server with a UDP scan and monitoring the scan with a sniffer, you notice that the target is responding with ICMP Port Unreachable only once a…

The Linux kernel enforces ICMP error rate limiting via the net.ipv4.icmp_ratelimit kernel parameter, which defaults to one ICMP message per second. When a UDP scan hits closed ports on a Linux host, the target generates exactly one ICMP Port Unreachable per second rather than responding to each probe, creating the pattern observed in the sniffer capture. This behavior is a well-documented OS fingerprinting characteristic used by tools like Nmap.

Windows does not apply a strict one-per-second ICMP Port Unreachable rate limit and responds with different throttling characteristics than the pattern described.

OpenBSD implements its own ICMP rate limiting derived from BSD but uses different default thresholds and random drop behavior, not a consistent one-per-second rate.

Mac OS X inherits BSD-style ICMP handling with its own rate limits that differ from Linux's net.ipv4.icmp_ratelimit default, producing a different response pattern.