For security reasons, many organizations do not allow error reply messages to leave their internal Internets. How, specifically, could hackers use information in echo reply messages to learn about the firm's internal hosts? Does the same thing apply to ping requests?
ICMP was designed to help determine characteristics of the network. PING is an application of ICMP.
ICMP has two modes of operation:
- Query the network by requesting packets and interpreting the answer
- Report non-transient error conditions through error messages
The errors are produced in special conditions such as:
- Network is unreachable: this would help map the network.
- Host is unreachable: would show what hosts are online
- Protocol unreachable: shows what protocols are supported
- Port unreachable: some servers would indicate through this error message that no process is listening on that port
- The datagram is too big: would show what technology is used in the network.
- And many others, for example to differentiate between the Linux kernel and that of the networking device, ICMP Error Quoting size fingerprinting method can be used.
By using ICMP messages and errors it is possible to gather substantial information about the network:
- Host Detection
- Network Topology
- ACL Detection
- Packet Filter Detection
- OS Fingerprinting
ICMP error messages are not typically involved in directly attacking the network but would greatly help an attacker understand more about the network and know how and where to attack. Therefore this information should not leave the network because it should not be available to people outside the network.