Questions tagged [icmp]
Abreviation of Internet Control Message Protocol. The protocol allows for the return propagation of error messages related to IP packets. ICMP is critical to basic network tools like ping and traceroute.
8
questions with no upvoted or accepted answers
2
votes
2
answers
224
views
In what situations should a node ping/not ping?
I was recently looking at a network in which the client-machines could access a webservice endpoint but could not ping it.
And there are other machines that can ping the webservice endpoint, but which ...
- 1,399
1
vote
1
answer
222
views
ICMP timestamp - firewall configured to drop timestamp request, but vulnerability scanner can send request and get a response
We use an external scanner (Qualys) to scan our external assets. We have a firewall in front of the external assets, but it is configured to whitelist the scanner so that the external assets get ...
- 11
1
vote
0
answers
53
views
Can the ICMP "pad" safely be stripped in most situations for defense?
I'm learning about data exfiltration using ICMP and delivery of a payload is generally done using the -p "pad bytes" in ping -c 1 -p $encoded_payload. Are there often legitimate use for &...
- 3,482
1
vote
0
answers
100
views
Security Best Practice - Monitoring a Site-to-Site VPN Tunnel
if a customer wants to monitor an IPSec-based site-to-site VPN and basically no incoming traffic is needed, would you recommend:
a) setting up a permanent tunnel that can be monitored all the time and ...
- 21
1
vote
1
answer
198
views
Real-world application of network steganography
I recently came across a topic of network steganography, mostly connected with modifying the headers of IP, TCP, ICMP. I was looking for some real-world examples of malware that uses it. I only found ...
- 111
0
votes
0
answers
79
views
NMAP same destination ip, different scanner interface, different result
I am trying to check the port status of a external IP using NMAP, I am getting different result on different interface to same destination (destination is a public IP).
When NMAP tried from the ...
0
votes
1
answer
503
views
Monitor mode not sniffing from other devices on the same network
i'm currently running a 802.11n adapter in monitor mode on a kali linux PC. Monitor mode was enabled using airmon-ng. On the same network as the kali linux PC are 2 raspberry pi devices.
Pinging from ...
0
votes
0
answers
460
views
script for analysis of tcpdump log file
I'm trying to get the following metrics from my tcpdump log file:
(1) one-way delay, (2) request/response delay, (3) packet loss, (4) overall transaction duration and (5) delay variation (jitter).
...
- 266