enabled : If an IP packet could not be delivered/forwarded to destination due to routing errors (e.g. no matching route exists, interface down/blocked), the packet is discarded and the system sends an ICMP 'Destination-Unreachable/Host' message back to the originator of the packet. This is the default behavior of the system. (see ipIcmpDestUnreachHostTcp also) disabled: If an IP packet could not be delivered/forwarded to destination due to routing errors (e.g. no matching route exists, interface down/blocked), the packet is silently discarded. ICMP 'Destination-Unreachable/Host' messages should be disabled with care (only if really necessary). The functionality of the virtual REFUSE-Interface is NOT affected by this parameter - the system will continue to send ICMP 'Dest-Unreachable/Host' messages for all packets explicity routed to this Interface (ifIndex 0). The functionality of ipExtIfNatSilentDeny=disabled is NOT affected by this parameter - the system will continue to send ICMP 'Dest-Unreachable/Host' messages for incoming IP-Packets that does not pass the NAT barrier of NAT-enabled Interfaces.