Re: ICMP Ping and Group Policy Update

From: Andy Dustman (adustman_at_TERRY.UGA.EDU)
Date: 10/01/03

  • Next message: Randal, Phil: "MS03-040 documentation woes" 
    Date:         Wed, 1 Oct 2003 16:35:01 -0400
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

    On Wed, 2003-10-01 at 10:13, Paul Robichaux wrote:
    > Block ICMP packets with length 92 and you're golden. Blocking all ICMP
    > causes other problems, as you note; it's equivalent to blocking all, say,
    > TCP trafffic in that it improves your security while degrading your
    > functionality.

    What you should be blocking is the ICMP echo-request (type 8), and then
    only ones originating from outside your network. There's no guarantee
    that they will be length 92. It does seem that Windows boxes (ones which
    I believe are infected with Blaster or Nachi; this may not be true in
    general) are generating 92-byte packet with a payload of all 0xAA, Linux
    ping (for example) generates an 84-byte packet with a shifting
    bit-pattern in the payload, probably for diagnostic purposes.

    Dropping ICMP echo-requests that are internal to your network may cause
    problems for certain applications (DHCP comes to mind), but YMMV.
    Blaster will only try to infect hosts that it can ping.

    Worry more about laptops than VPNs... 

    --
Andy Dustman <adustman@terry.uga.edu>
Office of Information Technology, Terry College of Business, UGA
-----
Wondering as to whether the list is running? The NTBugtraq archives are
updated first before messages are emailed to subscribers. Check the
archives first to see if you have missed any messages;
http://www.ntbugtraq.com/archives
-----
  • Next message: Randal, Phil: "MS03-040 documentation woes"

    Relevant Pages

    • Re: unexpected ICMP host unreachable - no worries?
      ... an attack?". ... You observed ICMP backscatter traffic. ... I'm guessing this packet is remote controlling command to distributed ... easily relate that outgoing scan or outbound flood packets after detect ...
      (comp.os.linux.security)
    • Re: Linux equivalent for ioctlsocket(FIONREAD) on datagram sockets
      ... blocking and non-blocking UDP sends are essentially the same. ... UDP is defined us unreliable. ... achieves packet error rate of ~1E-7 but hits the wall when we try to ... shouldn't want:(to receive UDP datagrams at low error rate. ...
      (comp.os.linux.development.apps)
    • Re: Why some hosts in Internet not prefer to be traceroute-d ?
      ... i.e. not to send a TTL exceeded ICMP packet back to the host. ... This block may be not generating ICMP type 11 (most ... exceeded" reply associated with a UDP packet, ...
      (comp.os.linux.networking)
    • Re: Interesting fw log: "ICMP type 3 not embeddable"
      ... I've seen ICMP type 3 embedded TCP or UDP datagram but never seen ICMP ... REJECT incoming ICMP 3 packet) or is using ICMP mis-implementation OS ... is running BSD code based some router. ...
      (comp.os.linux.security)
    • Re: Interesting fw log: "ICMP type 3 not embeddable"
      ... I've seen ICMP type 3 embedded TCP or UDP datagram but never seen ICMP ... REJECT incoming ICMP 3 packet) or is using ICMP mis-implementation OS ... is running BSD code based some router. ...
      (comp.os.linux.security)