Abreviation of Internet Control Message Protocol. The protocol allows for the return propagation of error messages related to IP packets. ICMP is critical to basic network tools like ping and traceroute.

learn more… | top users | synonyms

46
votes
2answers
28k views

Is it a bad idea for a firewall to block ICMP?

This question was inspired by this answer which states in part: The generic firewall manifest file finishes off by dropping everything I didn't otherwise allow (besides ICMP. Don't turn off ICMP). ...
18
votes
5answers
16k views

Security risk of PING?

I have been told that PING presents a security risk, and it's a good idea to disable/block it on production web servers. Some research tells me that there are indeed security risks. Is it common ...
6
votes
3answers
2k views

Computer sending unstopped ICMP echo request to an IP

I noticed while hanging in Microsoft Network Monitor that my computer is sending ICMP echo request to an arbitrary IP address 202.39.253.11. I looked for the owner of this IP and I found it is owned ...
4
votes
3answers
2k views

Is there any risk in allowing ping packets *out* through a firewall

The company I'm currently doing work for does not allow ping requests out through their firewall, for "security reasons" and I'm baffled as to why this is a concern. Before you point me to (e.g.) ...
3
votes
2answers
780 views

ICMP redirects and source routing in the wild?

Theoretically, ICMP redirect messages (IPv4 and IPv6) and source routing (IPv4) / routing headers (IPv6) are very dangerous. However, I'm curious as to if attacks using these features really work in ...
1
vote
1answer
314 views

Disabling Ping/ICMP Requests [duplicate]

Are there any benefits from disabling Ping/ICMP requests on servers? I've read where people say to do it but I can't seem to find any real benefits with it. Only more likely to cause more problems. ...
1
vote
1answer
450 views

Block Packets in snort

In rules Configuration of snort , this is allowed: alert tcp any any -> any any (msg:"HTTP Connection"; react:block;) however when i write this is allowed: alert icmp any any -> any any (msg:"HTTP ...
1
vote
1answer
152 views

Why is ICMP timestamping disabled on OS X?

It would seem like ICMP timestamping is quite a useful feature for troubleshooting networks with asymmetric paths. Replies to icmp(4) timestamp requests are generated by the kernel: On OpenBSD, the ...
1
vote
1answer
366 views

how to handle error reply messages?

For security reasons, many organizations do not allow error reply messages to leave their internal Internets. How, specifically, could hackers use information in echo reply messages to learn about the ...
1
vote
2answers
178 views

IP attack by reading/writing data?

If I remember correctly there is an ICMP attack whereby you can embed malicious code and it gets read/executed, causing the problem (similar to SQL injection). Are there any further/more dangerous ...
1
vote
0answers
213 views

AD authentication with high amount of ICMP traffic [closed]

We have an IPS in place and it's constantly triggering ICMP / Ping flood signatures between workstations and AD server; or AD to workstation. I understand that ICMP is used for AD authentication. ...
0
votes
1answer
35 views

For what is an ICMP tunnel useful and how does ist work?

For what is it usefull? I (client) send an echo-request (with http data) to the proxy server. Then the proxy has to send me the echo-reply. But my question now is: 2.1 The proxy first needs to send ...
0
votes
1answer
22 views

Security risk of allowing ICMP “destination unreachable” packets on AWS

If I configure an Amazon AWS VPC, should I explicitly allow ICMP "destination unreachable" packets outbound? I am wanting the VPC firewall to block everything by default, however does this mean this ...
0
votes
1answer
2k views

Wireshark Gratuitous ARP

I'm playing around with scapy and wireshark and I have sent a packet to a destination that does not exist (10.0.2.14). Wireshark shows an ARP attempt to resolve the address but as its not there the ...
0
votes
1answer
256 views

Differentiate normal flow and broadcast attacks

How do you identify whether a broadcast traffic is normal or is considered an attack such as a DoS attack?, There is some information that the plot or the source that allows me to differentiate ...
0
votes
0answers
20 views

Smurf attack with Echo Protocol(RFC 862)

The Echo Protocol provides a feature like the ICMP-echo feauture. It's just a little bit different. The server sends an exact copy of the data it received. So my idea is, you could use this for an ...
0
votes
0answers
15 views

outbound ICMP allow or not [duplicate]

What is you opionion to allow outbound ICMP from the networks?? I saw many opionios on this.. on one hand is usefull troubleshooting tool on other hand many DOS attacks are based on ICMP not speaking ...