Index: scan_engine.cc
===================================================================
--- scan_engine.cc	(revision 7362)
+++ scan_engine.cc	(working copy)
@@ -591,6 +591,7 @@
   void boostScanDelay();
   struct send_delay_nfo sdn;
   struct rate_limit_detection_nfo rld;
+  bool ttl_exceeded; /* Prevents flooding of TTL exceeded messages */
 
 private:
   u8 nxtpseq; /* the next scanping sequence number to use */
@@ -1049,6 +1050,7 @@
   rld.max_tryno_sent = 0;
   rld.rld_waiting = false;
   rld.rld_waittime = USI->now;
+  ttl_exceeded = false;
 }
 
 HostScanStats::~HostScanStats() {
@@ -3708,7 +3710,8 @@
 
       icmp = (struct icmp *) ((char *)ip + 4 * ip->ip_hl);
 
-      if (icmp->icmp_type != 3)
+      /* ICMP type 3 and 11 have the same basic structure and can share code */
+      if (icmp->icmp_type != 3 && icmp->icmp_type != 11)
 	continue;
 
       struct ip *ip2 = (struct ip *) (((char *) ip) + 4 * ip->ip_hl + 8);
@@ -3772,6 +3775,7 @@
 	  assert(0);
 	} 
 
+	/* The various network/port/host errors */
 	if (icmp->icmp_type == 3) {
 	  switch(icmp->icmp_code) {
 	  case 0: /* Network unreachable */
@@ -3814,6 +3818,21 @@
 	  if (newstate == PORT_UNKNOWN) break;
 	  goodone = true;
 	}
+	/* The route errors (TTL exceeded for example) */
+	else if (icmp->icmp_type == 11) {
+	  if (hss->ttl_exceeded) break;
+	  switch(icmp->icmp_code) {
+	  case 0: /* Time to live (TTL) exceeded */
+	    if (o.verbose || o.debugging)
+	      error("Got ICMP TTL Exceeded when sending to %s, possible network loop!", hss->target->targetipstr());
+	    hss->ttl_exceeded = true;
+	    break;
+	  case 1: /* Fragment reassembly timeout */
+	  default:
+	    break;
+	  }
+	  break;  /* We're not interested in checking any more probes */
+	}
       }
     } else if (ip->ip_p == IPPROTO_UDP && !USI->prot_scan) {
       if ((unsigned) ip->ip_hl * 4 + 8 > bytes)