4 ms·

ICMP (the protocol ping uses) is a totally separate protocol from TCP and UDP. Blocking ICMP can break of lot of things and offers no real benefits outside of a

by xnyan 3y ago

ICMP (the protocol ping uses) is a totally separate protocol from TCP and UDP. Blocking ICMP can break of lot of things and offers no real benefits outside of a handful of specific edge cases. BTW your assumption "a successful ICMP ping = TCP and UDP work" is an extremely common one that I too had before I was taught otherwise.

whirlwin 3y ago
> Blocking ICMP can break of lot of things and offers no real benefits outside of a handful of specific edge cases. Are you referring to local networks only? It's very common to not allow ICMP by defaul to workloads in the cloud, e.g. in AWS.
- pajko 3y ago
  Fragmented packets won't work without ICMP. Edit: here's a good page about the effects of disabling ICMP: https://www.rimscout.com/why-you-should-not-block-icmp/ https://www.rimscout.com/why-you-should-not-block-icmp/ Also there's some blackhole detection or how is it called. However it's OK to block _parts_ of the ICMP protocol for security reasons, like echo and reply.
- fragmede 3y ago
  That's likely to be an implementation detail of how they've implemented TCP routing across a large fabric.
  - Hikikomori 3y ago
    AWS doesn't decide or even care about this, customers configure security group rules for their own services. Nothing is allowed by default, so if you want ICMP you would need to allow it, most font bother because it's not that helpful in a cloud environment (can just monitor the TCP port instead and get similar information).
    - immibis 3y ago
      This explains why some people have problems with IPv6 - if you block IPv6 Control Messages, then it will only work sometimes.
js2 3y ago
> BTW your assumption I did not assume. The comment to which I was responding suggested it was the destination IP that was the problem. Generally (but not always) an IP filter would be applied irrespective of protocol. I also pointed out that the initial SYN and reply SYN/ACK are getting through the hypothesized bogon filter and those are part of TCP. I don't think the bogon filter is a hypothesis that fits the evidence. ETA: but adding connection state tracking + a filter does make sense https://news.ycombinator.com/item?id=39822214 https://news.ycombinator.com/item?id=39822214
- xnyan 3y ago
  > Generally (but not always) an IP filter would be applied irrespective of protocol I've never seen this (all protocols by default) in any environment I've personally worked with, but perhaps I've had a unique experience.

by xnyan 3y ago

whirlwin 3y ago

> Blocking ICMP can break of lot of things and offers no real benefits outside of a handful of specific edge cases. Are you referring to local networks only? It's very common to not allow ICMP by defaul to workloads in the cloud, e.g. in AWS.

pajko 3y ago
Fragmented packets won't work without ICMP. Edit: here's a good page about the effects of disabling ICMP: https://www.rimscout.com/why-you-should-not-block-icmp/ https://www.rimscout.com/why-you-should-not-block-icmp/ Also there's some blackhole detection or how is it called. However it's OK to block _parts_ of the ICMP protocol for security reasons, like echo and reply.
fragmede 3y ago
That's likely to be an implementation detail of how they've implemented TCP routing across a large fabric.
- Hikikomori 3y ago
  AWS doesn't decide or even care about this, customers configure security group rules for their own services. Nothing is allowed by default, so if you want ICMP you would need to allow it, most font bother because it's not that helpful in a cloud environment (can just monitor the TCP port instead and get similar information).
  - immibis 3y ago
    This explains why some people have problems with IPv6 - if you block IPv6 Control Messages, then it will only work sometimes.

js2 3y ago

> BTW your assumption I did not assume. The comment to which I was responding suggested it was the destination IP that was the problem. Generally (but not always) an IP filter would be applied irrespective of protocol. I also pointed out that the initial SYN and reply SYN/ACK are getting through the hypothesized bogon filter and those are part of TCP. I don't think the bogon filter is a hypothesis that fits the evidence. ETA: but adding connection state tracking + a filter does make sense https://news.ycombinator.com/item?id=39822214 https://news.ycombinator.com/item?id=39822214

xnyan 3y ago
> Generally (but not always) an IP filter would be applied irrespective of protocol I've never seen this (all protocols by default) in any environment I've personally worked with, but perhaps I've had a unique experience.