4 ms·
> Sysadmin: I really dont care what you do Dropping ICMP breaks path MTU discovery (PMTU). It's the biggest reason why sites break when accessed (or served) ov
by wahern 1y ago
> Sysadmin: I really dont care what you do
Dropping ICMP breaks path MTU discovery (PMTU). It's the biggest reason why sites break when accessed (or served) over VPNs. This is often mitigated on the server, or in NAT-ing routers, by clamping TCP MSS, but that doesn't really resolve the problem. It doesn't fix it for UDP, nor likely for double VPN scenarios, etc, plus you're just losing bandwidth that way.
Some people make fatalistic arguments that even if they allow ICMP, something downstream may not have, so it's futile. But the networks in the middle rarely if ever block ICMP; those engineers know better. The real issue is on the ends. If you're a sysadmin dropping ICMP, you're half the problem. Fix ICMP on your end, and half the problem goes away. The other half of the problem are those NAT-ing routers, firewalls, and VPNs that don't handle ICMP properly. You can't fix those, but plenty of residential and commercial equipment on the other end, as well as VPN setups, actually do the right thing. Don't make perfect the enemy of better.
- protocolture 1y agoYou are absolutely correct, but also, I am already having to clamp MTU for most business customers anyway, for a hundred reasons. The issue is that sysadmins make this the ISP's issue anyway. They wont do any kind of investigation but simply yell at the telco. Telcos are ready willing and able to clamp. Its as natural as breathing at this point. The only thing that gets me is when the some small business refuses to enable ICMP for troubleshooting when they raise a complaint. You have to come to the table at least that far.
- Avicebron 1y ago> small business refuses to enable ICMP for troubleshooting Depending on your definition of small business, asking someone "hey can you enable ICMP real quick" is like asking them "hey can you build a rocket ship while skydiving?"
- protocolture 1y agoComes from all sides. Mom and Pop running a small store, refuse on the grounds of not wanting to change a setting on their router. Small as in <100 employees. The IT guy doesnt want to change anything, hes been there 20 years and never changed that setting. Or he needs to go through change management which he is also adverse to.
- deleted 1y ago[deleted]
- slt2021 1y agothe problem is ICMP can be abused for attacks like ICMP flood, ICMP smurf, because src.ip can be easily spoofed. its very easy and cheap to saturate a link with flood traffic, but fixing this issue requires large investments in big expensive firewalls that can block these stupid attacks
- citrin_ru 1y agoDNS and SNMP with a spoofed src IP have higher amplification factor and the root of the problem here are ISP which allow they customers to spoof src IP.
- eqvinox 1y ago> ICMP smurf IP stacks haven't responded to broadcast pings for ≥20 years now. If you find one that does, please report it so it can get fixed. > because src.ip can be easily spoofed Operators have been pushing to get BCP38 everywhere for ≥ 20 years now. If you find one that doesn't do it, please report it so I can depeer and shame them on public mailing lists. > ICMP flood So you'll just get flooded with UDP instead (cf. sibling comment).
- yjftsjthsd-h 1y agoAre you blocking UDP, too?