If people can send packets to you, they can DDoS your shitty plastic router CPU regardless of you blocking ICMP or not. And whether your router generates a rep

If people can send packets to you, they can DDoS your shitty plastic router CPU regardless of you blocking ICMP or not. And whether your router generates a reply is really ancillary to the question — so long as that reply isn't notably larger than the triggering packet. (Otherwise you're running a reflection amplifier and some people would like to have words with you.) These days with cheap bandwidth about, the only way to really prevent DDoS is to catch them at the source(s). Hell, I have 25Gbit at home (Init7), I can blow entire small telcos off the internet. Once. Then Init7 terminates my service. And that's really the only thing that can prevent this…