4 ms·
I was thinking you can block ICMP 3/3 if an IP address is used for ingress only (TCP/UDP server)
by omribahumi 10y ago
I was thinking you can block ICMP 3/3 if an IP address is used for ingress only (TCP/UDP server)
- zrm 10y agoBlocking ICMP type 3 breaks path MTU discovery. When the path MTU is less than the server's MTU, the client will typically send a request which is smaller than the path MTU and then the server's response isn't so it's the server that gets the ICMP message. Blocking type 3/3 can also make some other denial of service attacks easier because it takes longer for the server to figure out that the device at that IP doesn't want the packets the server is sending when the request is from a spoofed IP address.
- omribahumi 10y agoOk, then this is definitely a problem with UDP. But what about TCP only? AFAIK, TCP RST is usually used when a packet is received with no connection. The only place I'm aware of that uses ICMP 3/3 is the REJECT iptables target when the defaults are used.