Hot answers tagged

97

They are not the same at all. A ping request is an ICMP packet which just sends by default null data to check if the host is up (You can change around the parameters being sent (read more here).) When you visit a website in the browser you are using the HTTP protocol which requests data and so you have a CLIENT/SERVER setup here (data is served to the ...


82

Compared to other IP protocols ICMP is fairly small, but it does serve a large number of disparate functions. At its core ICMP was designed as the debugging, troubleshooting, and error reporting mechanism for IP. This makes it insanely valuable so a lot of thought needs to into shutting it down. It would be a bit like tacking >/dev/null 2>&1 to the ...


40

The ICMP Echo protocol (usually known as "Ping") is mostly harmless. Its main security-related issues are: In the presence of requests with a fake source address ("spoofing"), they can make a target machine send relatively large packets to another host. Note that a Ping response is not substantially larger than the corresponding request, so there is no ...


25

Is that more or less like visiting the website by typing the hostname into your browser and letting it load? Short answer, no ... it's not even close. When you run whois you are doing a lookup of an IP or Domain's publicly registered information. In many cases the whois request will not even communicate with the target server. Rather whois databases are ...


22

ICMP exists for a reason, and not all of that reason is ping. It's the "meta" protocol that is used to communicate control messages about the network itself. Have a look at ICMP on Wikipedia to get a better idea of what it is and what it's for. Other ICMP messages also include destination host unreachable, fragmentation required, congestion control, TTL ...


18

ICMP has a data component to it. It can be used to build tunnels, and this is not just a theory thing, it's available in the wild. It's been found by several different researchers as parts of malware toolkits. Not to mention there is a prominent howto on this topic, not to mention the wiki, or the hackaday ICMPTX uses the ICMP echo and ICMP reply. ICMP ...


10

Pinging a website and viewing it in a browser are two absolutely different processes which involve different protocols altogether. Ping sends an ICMP request (response won't be malicious) while viewing a webpage sends a request to get the index page (possibly malicious) of the website. In your case, you have nothing to worry about. Firstly, it was a ...


10

You can't ping a web site. You can ping a network interface; this sends ICMP ECHO request packets to that interface (and summarizes the replies received). A web site (in this context) is a server answering HTTP and/or HTTPS requests on one or more TCP ports on the interface (normally port 80 for HTTP and port 443 for HTTPS). A given interface may or may ...


8

It is true that ICMP can be used by attackers to gain information, transport data covertly, etc. It is also true that ICMP is extremely useful, and that disabling it can often cause problems. Traceroute does in fact use ICMP, so disallowing certain ICMP types will break it. The question highlights the classic balance of security and functionality, and it's ...


7

I think that outbound echo reply is more dangerous that inbound echo request because of ICMP amplification (either rate limit or deny this traffic). However, after decades of pondering this topic -- I've concluded that ICMP is more dangerous than useful, and thus it should be blocked in both directions, with logging on potentially spoofed outbound traffic. ...


5

"ICMPTX" is a very, very minor risk in most real-world situations. It's basically a way for two cooperating programs to sneak data past a firewall that's only looking for data exfiltration over traditional protocols (TCP, UDP, etc.). Unless your AWS VPC is infested with malware and your firewall is inspecting packets for attempted data exfiltration, I ...


5

If you're allowing ICMP echo requests (type 8, code 0), then presumably you'll be allowing ICMP echo replies (type 0, code 0) back in. ICMP echo replies can be used for inverse mapping of a target network, even when there's a filtering device (such as a firewall on the perimeter). This is an old attack though and modern firewalls can easily block it (...


4

The theory is that it reduces the amount of information available to attackers. A good traceroute can be most informative. In addition, and in theory, every additional service running on a machine is a possible source of vulnerabilities. The thingumajig that answers ICMP requests is no exception, although they are mostly very old and small thingumajigs ...


4

I had the same problem, constant pings to 202.39.253.11. I have removed ASUS Ai SUITE II and ran the uninstall cleaner and the pings have stopped The cleaner was at http://rog.asus.com/forum/showthread.php?28319-AI-Suite-II-uninstall-cleaner


3

In general, tunneling one protocol under another is done because there are networking devices in between that only can handle or allow specific protocols. If routers or firewalls allow (don't drop) and don't record (don't log) the full ICMP packet, then just looking at the protocol shows pings or something happening. This causes the covert comms channel to ...


3

Snort does not block packets. Snort is an intrusion detection and prevention system. The React rule option is intended to be used with TCP connections. The react keyword, when it matches, will generate multiple reset packets to both end of the connection to shoot it down. Since ICMP is a datagram protocol that operates at the network level, there is no ...


3

Some attackers may use outbound ICMP packets to send data out of victim machine, read more about Covert channel.


3

Some that come to mind: Protecting against attacks (say a basic ICMP DDOS) coming from compromised machines within the company. Preventing compromised machines from easily announcing their presence to C&C As part of a "default deny" policy to only explicitly permit traffic. This gives you a very high security posture, at a high cost to convenience. I'...


3

ICMP redirects have been disabled in many Windows XP and Windows Server 2003 environments since the introduction of the first service packs. You might find it in legacy Windows infrastructures, but I doubt you will find it in Vista-era or later. To detect whether or not ICMP redirects will work on any given network, use the Responder.py tool in "Analyze ...


3

No. I would say running ping or traceroute on a domain is not a security risk. Furthermore, the ping is done by who.is and not by your computer.


2

I don't know of any such attack. That doesn't mean no such attack ever existed -- just that nothing pops to mind at the moment. There are a few others that are related, which you might possibly have been thinking of: Back in the day, the "ping of death" was a malicious ICMP packet that crashed the recipient computer, but it did not allow execution of ...


2

Ping and Traceroute are required to troubleshoot networks. With modern firewalls, and security tools there is very little, and bordering on non-existant chance of either protocol being used successfully in an malicious way. In 1996, sure it was a problem, but it is now 2015 almost 20 years later, and blocking these only leads to dramatically increased ...


2

Instead of answering the primary question of "what are the security risks of ping", I'll answer your sub-question of "Is it a good idea to block/disable on production web servers" I think we can find a balance between security and utility here. Support staff generally find ping useful when checking the latency or availability of a certain node. Security ...


2

ICMP was designed to help determine characteristics of the network. PING is an application of ICMP. ICMP has two modes of operation: Query the network by requesting packets and interpreting the answer Report non-transient error conditions through error messages The errors are produced in special conditions such as: Network is unreachable: this would ...


2

The general "risk" of ping is worrying about someone using the icmp protocol to either exfiltrate data or control malware. I think many times it was disabled as an "I don't know why I need it so I'll disable it mentality". This is why it became the default rule. While these are both real valid concerns if you are still in the "I have a perimeter" mentality ...


2

since they are all echo's... i dont think they are for tunneling BUT! you might be hacked. Some malwares are sending ping-like packets to weird ip addresess or websites. these are mainly bot net malwares... Your PC is saying I AM HERE .... I AM HERE by sending those echo messages and at some point, when there will be an attack, hacker will actually own the ...


2

The ICMP timestamp response contains the remote host's date and time. This information could theoretically be used against some systems to exploit weak time-based random number generators in other services


2

Regarding periodic (1 second interval) ICMP from Ai Suite II, simply disable the "Network iControl" option to stop the pings. No need to completely remove this ASUS service.


2

Is it must for a packet sniffer to enable promiscuous mode?Can packets be sniffed without the NIC being in promiscuous mode? No it is not a must and sniffing can be done in non-promiscuous too. Also when in promiscuous mode the NIC accepts all packets which are not addressed to it's MAC address.Does it also mean that it responds to all packets(it ...


1

Simply put, if not in promiscuous mode, NIC will drop any L2 traffic that is not intended for it. Any and all traffic that is neither directly addressed to the NIC nor a {broad,multi}cast will be dropped before it reaches the OS assuming the NIC behaves normally.



Only top voted, non community-wiki answers of a minimum length are eligible