Ralf G. R. Bergs wrote:
> > > > Personally I suggest allowing the following ICMP types:
> > > > 0 Echo Reply
> > > > 3 Destination Unreachable
> > > > 11 Time Exceeded
> > > > 12 Parameter Problem
> >
> > 0 is optional but useful, 11 can be used for certain kinds of DoS attack
> > against some hosts.
>
> Does that mean you would suggest to drop 11? Or would I break things (apart
> from DoS attacks, of course ;-) if I'de filter 11?
If you drop 11:
a) outbound traceroute won't work (if you don't use traceroute, then
you probably should drop type 11), and
b) routing loops could go unreported; this shouldn't really matter
unless your network is sufficiently complex that routing loops are a
realistic possibility.
--
Glynn Clements <[EMAIL PROTECTED]>
-
To unsubscribe from this list: send the line "unsubscribe linux-net" in
the body of a message to [EMAIL PROTECTED]
