On Mon, Dec 20, 1999 at 11:52:19PM -0800, Matthew Sanderson wrote:
> Isn't this an Evil Thing To Do? What ICMP traffic is safe to block, an
> what isn't?
> 'ping' says it only uses ICMP's 'echo' and 'echo response' datagrams, so
> maybe just block these. I read somewhere that blocking ICMP 'fragmentation
> needed' datagrams breaks linux's path MTU discovery.
Yes, so don't block that one.
> Is it safe to block the ICMP 'time exceeded' message in order to stop
> 'traceroute' finding you?
If your host is the end of the line, like a typical home dialup,
blocking time exceeded messages won't do anything, the only time
blocking time exceeded messages might make a difference is on
routers that forward traffic. When a router forwards traffic it
decrements the ttl, if the ttl expires it sends back the time
exceeded message.
If you were really paranoid you would have to block the default
range of udp ports that traceroute uses, but traceroute can be
told to use other ports, so you would have to block all udp ports
to be safe. I prefer to just log incoming udp and icmp packets.
--
chesty
--
SLUG - Sydney Linux Users Group Mailing List - http://www.slug.org.au
To unsubscribe send email to [EMAIL PROTECTED] with
unsubscribe in the text
