On Tue, 04 Jul 2000 09:45:14 +0100 (BST), Glynn Clements wrote:
>Ralf G. R. Bergs wrote:
>
>> > > > Personally I suggest allowing the following ICMP types:
>> > > > 0 Echo Reply
>> > > > 3 Destination Unreachable
>> > > > 11 Time Exceeded
>> > > > 12 Parameter Problem
>> >
>> > 0 is optional but useful, 11 can be used for certain kinds of DoS
attack
>> > against some hosts.
>>
>> Does that mean you would suggest to drop 11? Or would I break things
(apart
>> from DoS attacks, of course ;-) if I'de filter 11?
>
>If you drop 11:
>
>a) outbound traceroute won't work (if you don't use traceroute, then
>you probably should drop type 11), and
I *do* need traceroute, therefore I can't drop it. But thanks for
enlightening me.
>b) routing loops could go unreported; this shouldn't really matter
>unless your network is sufficiently complex that routing loops are a
>realistic possibility.
This isn't realistic for my little home network. :-)
Thanks,
Ralf
--
Sign the EU petition against SPAM: L I N U X .~.
http://www.politik-digital.de/spam/ The Choice /V\
of a GNU /( )\
Generation ^^-^^
-
To unsubscribe from this list: send the line "unsubscribe linux-net" in
the body of a message to [EMAIL PROTECTED]
