I'm not sure of the specific reasons in this case. I think it was to do with possible internal host discovery. (I'm not sure how that would work in practice. Ye

I'm not sure of the specific reasons in this case. I think it was to do with possible internal host discovery. (I'm not sure how that would work in practice. Yes you can use traceroute, but I'm not sure how that would work behind nat, without forcing a client to open up a port first) Possibly its to do with worry about smurf attacks, but then most firewalls > 2004 should deal with that gracefully.(old company though...) Have a look here, its an easy read and has a nice list: http://resources.infosecinstitute.com/icmp-attacks/ http://resources.infosecinstitute.com/icmp-attacks/