Questions tagged [icmp]
Abreviation of Internet Control Message Protocol. The protocol allows for the return propagation of error messages related to IP packets. ICMP is critical to basic network tools like ping and traceroute.
44
questions
131
votes
5
answers
198k
views
Is it a bad idea for a firewall to block ICMP?
This question was inspired by this answer which states in part:
The generic firewall manifest file finishes off by dropping everything I didn't otherwise allow (besides ICMP. Don't turn off ICMP).
...
- 2,028
54
votes
7
answers
82k
views
Security risk of PING?
I have been told that PING presents a security risk, and it's a good idea to disable/block it on production web servers. Some research tells me that there are indeed security risks. Is it common ...
- 715
31
votes
6
answers
18k
views
Is pinging a website essentially the same as visiting the website through a browser?
I was looking at the domain information of a website (poaulpos.net) on who.is that Chrome connects to whenever I visit a specific an old Tech Times article about Thunderstrike 2, a Mac firmware attack ...
- 531
10
votes
4
answers
9k
views
Computer sending unstopped ICMP echo request to an IP
I noticed while hanging in Microsoft Network Monitor that my computer is sending ICMP echo request to an arbitrary IP address 202.39.253.11.
I looked for the owner of this IP and I found it is owned ...
- 101
9
votes
1
answer
3k
views
Can ICMP Redirects still be used to redirect traffic in a LAN?
I tried just tried to migrate a MITM attack using hping3 with ICMP Redirects in my testlab.
hping3 -I eth0 -C 5 -K 1 -a 192.168.2.1 --icmp-ipdst 192.168.2.15 --icmp-gw 192.168.2.100 --icmp-ipsrc 192....
- 4,343
6
votes
3
answers
4k
views
Is there any risk in allowing ping packets *out* through a firewall
The company I'm currently doing work for does not allow ping requests out through their firewall, for "security reasons" and I'm baffled as to why this is a concern.
Before you point me to (e.g.) ...
- 407
5
votes
1
answer
490
views
Investigate compromised Linux server
I'm investigating a server that pings throughout the day to random IPs on the internet. I set up IPtables to log and drop (INPUT & OUTPUT) packets but I still see icmp traffic on the network ...
- 51
4
votes
2
answers
803
views
When should I drop a packet with ICMP type 3, code 9 or 10, TCP RST, or TCP ACK?
This answer says there are a few ways of dealing with a blocked packet at a firewall:
At each of these levels a 1st IP packet (and any other protocol
packet as an ESP or AH packet) might receive ...
- 51k
4
votes
2
answers
2k
views
ICMP redirects and source routing in the wild?
Theoretically, ICMP redirect messages (IPv4 and IPv6) and source routing (IPv4) / routing headers (IPv6) are very dangerous. However, I'm curious as to if attacks using these features really work in ...
- 3,020
3
votes
1
answer
5k
views
NMAP discovery scan reporting host offline, pinging the same host gets ICMP responses
I ran an nmap -sn scan on a host, and nmap reported the host as down. I then pinged the same host with ping and got ICMP responses. I'm confused, because I was sure that -sn among other things, did an ...
- 1,447
3
votes
4
answers
6k
views
Security risk of allowing ICMP "destination unreachable" packets on AWS
If I configure an Amazon AWS VPC, should I explicitly allow ICMP "destination unreachable" packets inbound? I am wanting the VPC firewall to block everything by default, however does this mean this (...
- 34.3k
3
votes
1
answer
1k
views
Why is ping special: why do "unprivileged pings" have to be enabled?
Rootless podman, by proxy of the Linux Kernel, has restrictions against ping,
It is most likely necessary to enable unprivileged pings on the host.
Why do unprivileged pings need to be enabled? And ...
- 3,015
3
votes
1
answer
705
views
Is disabling IPv6 an effective workaround for "Bad Neighbor" Vulnerability (CVE-2020-16898)?
CVE-2020-16898 is a remote code execution vulnerability caused by the improper handling of ICMPv6 Router Advertisement packets by Windows TCP/IP stack. Microsoft's recommended workaround is to disable ...
3
votes
1
answer
1k
views
Continuous ping on google's servers
Using Wireshark, I recently discovered that my computer (running on Windows 10) is sending ping requests to Google's servers. According to wireshark, my computer is sending ICMP requests and receive ...
- 31
3
votes
1
answer
2k
views
How to prevent ICMP redirection produced by a man-in-the-middle
How can I prevent my route to be redirected with redirecting ICMP packets from a man-in-the-middle?
I am specifically looking to avoid someone using ettercap with the -M icmp option. From man ...
- 580
2
votes
1
answer
11k
views
What happens when a firewall blocks a traceroute?
I am trying to find out what happens when you try to access a site using traceroute command, but I cannot find any site that is actually blocking me. Anyway, I wanted to ask what happens when a ...
- 21
2
votes
1
answer
499
views
Is ping of death attack specific to ICMP or could it also happen with other transport protocols?
A Ping of Death attack is a denial-of-service (DoS) attack, in which the attacker aims to disrupt a targeted machine by sending a packet larger than the maximum allowable size, causing the target ...
- 21
2
votes
3
answers
6k
views
I can't figure out the abnormal behaviour from this Wireshark capture file
The capture file if needed
There is supposed to be abnormal behaviour here, and I see that there is. But I can't figure out what it is.
There is no response from the ICMP requests. Furthermore some ...
- 21
2
votes
3
answers
2k
views
UDP vs ICMP flood
How can we measure the efficiency of the flood technique? Will it be by the number of bots required for flooding the link? In case of UDP and ICMP, which one would be more efficient and why?
- 121
2
votes
1
answer
1k
views
Disabling Ping/ICMP Requests [duplicate]
Are there any benefits from disabling Ping/ICMP requests on servers?
I've read where people say to do it but I can't seem to find any real benefits with it. Only more likely to cause more problems.
...
- 3,126
2
votes
2
answers
4k
views
Promiscuous mode and packet sniffing
Is it must for a packet sniffer to enable promiscuous mode?Can packets be sniffed without the NIC being in promiscuous mode?
Also when in promiscuous mode the NIC accepts all packets which are not ...
- 339
2
votes
1
answer
7k
views
Block Packets in snort
In rules configuration of snort I have:
alert tcp any any -> any any (msg:"HTTP Connection"; react:block;)
However when I add:
alert icmp any any -> any any (msg:"HTTP Connection"; react:...
- 83
2
votes
1
answer
891
views
Reliability of scanning tools on icmp timestamp responses
A security auditor has done a vulnerability scan of our network and found that one of our server has returned an TCP timestamp response such that the scanner (Nmap) is able to guess the uptime of the ...
- 1,951
2
votes
2
answers
267
views
In what situations should a node ping/not ping?
I was recently looking at a network in which the client-machines could access a webservice endpoint but could not ping it.
And there are other machines that can ping the webservice endpoint, but which ...
- 1,441
1
vote
1
answer
1k
views
Security auditing - disabling IP forwarding and ICMP packets redirects
I've recently started working as a security auditor and my mentor gave me some homework to write an Ubuntu security audit script so that I'll get to learn to use batch scripting and understand ...
user184816
1
vote
2
answers
2k
views
Risks of pinging/resolving malicious sites?
If I do ping malicioussite.com or nslookup malicioussite.com, is there any risk for me? Will the people behind the malicious site know I'm looking them up?
I'd like to make a program to use an IP ...
- 13
1
vote
1
answer
955
views
Why is ICMP timestamping disabled on OS X?
It would seem like ICMP timestamping is quite a useful feature for troubleshooting networks with asymmetric paths.
Replies to icmp(4) timestamp requests are generated by the kernel:
On OpenBSD, the ...
- 1,984
1
vote
1
answer
685
views
how to handle error reply messages?
For security reasons, many organizations do not allow error reply messages to leave their internal Internets. How, specifically, could hackers use information in echo reply messages to learn about the ...
- 11
1
vote
2
answers
273
views
IP attack by reading/writing data?
If I remember correctly there is an ICMP attack whereby you can embed malicious code and it gets read/executed, causing the problem (similar to SQL injection).
Are there any further/more dangerous ...
- 11
1
vote
1
answer
728
views
ICMP timestamp - firewall configured to drop timestamp request, but vulnerability scanner can send request and get a response
We use an external scanner (Qualys) to scan our external assets. We have a firewall in front of the external assets, but it is configured to whitelist the scanner so that the external assets get ...
- 11
1
vote
0
answers
117
views
Can the ICMP "pad" safely be stripped in most situations for defense?
I'm learning about data exfiltration using ICMP and delivery of a payload is generally done using the -p "pad bytes" in ping -c 1 -p $encoded_payload. Are there often legitimate use for &...
- 3,482
1
vote
0
answers
133
views
Security Best Practice - Monitoring a Site-to-Site VPN Tunnel
if a customer wants to monitor an IPSec-based site-to-site VPN and basically no incoming traffic is needed, would you recommend:
a) setting up a permanent tunnel that can be monitored all the time and ...
- 21
1
vote
0
answers
118
views
Spoofing an IP/MAC address to avoid ICMP Destination Unreachable being sent back [duplicate]
As far as I understand UDP flooding the idea is to send UDP packets across all ports from e.g. Alice to Bob, and get Bob's machine to check who listens to certain ports and generate many ICMP ...
- 111
1
vote
1
answer
245
views
Real-world application of network steganography
I recently came across a topic of network steganography, mostly connected with modifying the headers of IP, TCP, ICMP. I was looking for some real-world examples of malware that uses it. I only found ...
- 111
0
votes
1
answer
403
views
For what is an ICMP tunnel useful and how does ist work?
For what is it usefull?
I (client) send an echo-request (with http data) to the proxy server. Then the proxy has to send me the echo-reply. But my question now is:
2.1 The proxy first needs to send ...
- 615
0
votes
1
answer
136
views
icmp smurf attack
I am learning about ICMP smurf attack and for this, I have forged a packet with the following details:
source_mac_address = **??**
destination_mac_address = router mac address
char ...
- 101
0
votes
1
answer
248
views
Smurf Attack confusion
I have a question regarding the Smurf Attack described in the following CISCO article:
http://www.cisco.com/c/en/us/about/security-center/guide-ddos-defense.html#9
In a smurf attack, an attacker ...
- 1,588
0
votes
1
answer
921
views
localhost to localhost ICMP traffic that is suspicious.. any idea of what is creating this?
I keep seen this on my tcpdump output.. is prob something very simple and logical but I can't see to see any process with lsof or netstat doing a ICMP request to it's own 127.0.0.1 every 2-3 secs... ...
- 281
0
votes
1
answer
4k
views
Wireshark Gratuitous ARP
I'm playing around with scapy and wireshark and I have sent a packet to a destination that does not exist (10.0.2.14). Wireshark shows an ARP attempt to resolve the address but as its not there the ...
- 103
0
votes
1
answer
698
views
Differentiate normal flow and broadcast attacks
How do you identify whether a broadcast traffic is normal or is considered an attack such as a DoS attack?, There is some information that the plot or the source that allows me to differentiate ...
- 113
0
votes
1
answer
164
views
Honeyd not responding to TCP
I'm having some issues getting Honeyd to work properly on an external network interface on Ubuntu 20 LTS running on a Proxmox server. I'm fairly sure it's a configuration/setup problem on the VM I'm ...
- 1
0
votes
0
answers
67
views
What security benefit is there in 2020 to block outbound Ping [duplicate]
I've researched this and found the following on StackExchange and ServerFault, but they're very old.
https://serverfault.com/questions/55889/why-block-outbound-icmp
Is it a bad idea for a firewall ...
- 1
0
votes
0
answers
492
views
script for analysis of tcpdump log file
I'm trying to get the following metrics from my tcpdump log file:
(1) one-way delay, (2) request/response delay, (3) packet loss, (4) overall transaction duration and (5) delay variation (jitter).
...
- 266
-1
votes
2
answers
1k
views
Is there any reason that captive portal server can't block the ICMP echo request/reply packet
We can get connected to those public WiFi hotspot without the account but can access to no website but the login page. As I tested, all those login website would respond to my ping even I was an ...
- 11