Its entirely possible to leak addresses at layer 3, ICMP. Redirect and Type 3 unreachables intentionally encode additional IP headers inside the data segment. A

Its entirely possible to leak addresses at layer 3, ICMP. Redirect and Type 3 unreachables intentionally encode additional IP headers inside the data segment. Additionally ICMP processing goes up to the control plane, not just a data/routing/forwarding plane. Its incredibly common to get back valid ICMP responses sources from RFC1918/3330 space on the internet. The router (or whatever) responds with the "private" management address as the source. I would not be surpised in the least to have a box leak "private" or unintential data via ICMP.