3 ms·
Someone needs to write "ICMP the good bits", because the traditional response of disable all ICMP isn't great.
by raggi 3y ago
Someone needs to write "ICMP the good bits", because the traditional response of disable all ICMP isn't great.
- cyberax 3y agoBasically, you need: "destination unreachable", "packet too big", "time exceeded", "echo request/reply". Everything else is pretty much useless and/or harmful.
- NoZebra120vClip 3y agoWhy do you "need" echo request and reply, if you can basically get this functionality in a dozen different ways? Disabling pings is more or less security theater, when every pentester knows how to work around it and find live hosts.
- cyberax 3y agoBecause they are useful for _you_. Ping utility is present everywhere (even on Windows), while nmap requires installation.
- stefan_ 3y agoWell thats kinda what happened in IPv6 we were all supposed to move to long ago.
- janci 3y agoFrom the linked paper: > As a result, our attacks can be easily extended to IPv6 net- works to manipulate a victim originator’s network traffic.