4 ms·
> Don't let perfect be the enemy of good. Better: Don't base your decisions on imaginary scenarios that haven't been relevant for decades. There's no "good" i
by dns_snek 2y ago
> Don't let perfect be the enemy of good.
Better: Don't base your decisions on imaginary scenarios that haven't been relevant for decades.
There's no "good" in blocking ICMP packets and especially ping. You won't protect yourself from DDoS attacks but you might summon some obscure, hard to diagnose networking issues.
If you gave me your IP and your consent, I could rent a DDoS-for-hire service for lunch money and take you offline. They don't rely on their victims taking themselves offline with response packets.
- fourfour3 2y agoYep, having been a recent victim, the cheap 'booter' services are still doing NTP & DNS reflection attacks. They're easy to do and require very few resources on the part of the attacker. Flooding a 1G service to the point of total uselessness is trivial and cheap. Sadly there's absolutely nothing you can do on your own firewall/router to block or mitigate them - your connection's downstream just gets flooded with UDP packets and becomes totally useless. The only mitigations/blocking can be done by your ISP and their connectivity partners.