Re: ICMP (Ping)

From: Luca Falavigna (fala83_at_libero.it)
Date: 09/04/03

  • Next message: Aditya: "RE: Remotely manage Zone Alarm" 
    Date: Thu, 04 Sep 2003 14:56:42 +0200
To: Security Basics <security-basics@securityfocus.com>

    ICMP ECHO (or PING) is a common type of packet sent through the net to
    verify if a remote host is available and the medium lags to reach it.
    Its data is formed by a sequence of letter (abcdef...) according to the
    numer of bytes. As you can see the payload doesn't include malicious
    code. Anyway it is possible to perform an attack. The most known
    techniques are Ping of death (packet size is greater than 64Kb) and Ping
    flooding (an enormous mass of packet sent in a small period of time).
    If your users need to use ping to verify your server is online, then set
    a specific firewall rule like the following to filter all packets except
    your users'ones.

    iptables -P INPUT DROP
    iptables -A INPUT -p ICMP --icmp-type ping -s trust.host -d
    your.firewall -j ACCEPT
    iptables -A INPUT -p ICMP -j DROP

    Luca

    Paul Kurczaba wrote:
    > Are there any security issues for allowing a firewall/router to respond to
    > Ping from the internet?
    >
    > -Paul Kurczaba

    ---------------------------------------------------------------------------
    Attend Black Hat Briefings & Training Federal, September 29-30 (Training),
    October 1-2 (Briefings) in Tysons Corner, VA; the world's premier
    technical IT security event. Modeled after the famous Black Hat event in
    Las Vegas! 6 tracks, 12 training sessions, top speakers and sponsors.
    Symantec is the Diamond sponsor. Early-bird registration ends September 6.Visit us: www.blackhat.com
    ----------------------------------------------------------------------------

  • Next message: Aditya: "RE: Remotely manage Zone Alarm"

    Relevant Pages

    • Re: Ping & Physics
      ... As I'm sure you know ping retuns the time taken for the packet ... be determined from ping latency values, ... considering only the bit rate is 1.5 ms for a round trip. ...
      (comp.unix.questions)
    • Re: failed shields up test
      ... Try to ping one - you'll probably get a response, ... Now, plug the cable back in, and fire up that packet sniffer on "this" ... protocols that can be found in an IP packet (see figure 3.1 in RFC0791 ...
      (alt.os.linux.suse)
    • Re: Connecting to Exchange...
      ... The truth is that ping packets are a basic troubleshooting tool and a router *shouldn't* be monkeying with them. ... And changing a packet intended to to troubleshoot a connectivity issue defeauts the purpose of sending the packet in the first place...as the destination suddenly becomes ambiguous. ... The ISP configured the original device and the device actually PROPERLY recreates NAT ping packets and passes them to the servers, but the SBS server was not part of that initial configuration. ...
      (microsoft.public.windows.server.sbs)
    • Re: failed shields up test
      ... Try to ping one - you'll probably get a response, ... Now, plug the cable back in, and fire up that packet sniffer on "this" ... protocols that can be found in an IP packet (see figure 3.1 in RFC0791 ...
      (alt.os.linux.suse)
    • Re: Intermittent problems with LAN transfer speeds
      ... run are to ping with a large packet size to emulate file transfers and not ... If you get 100% Packet Loss then your firewall is in the way. ... I've not found any solution other than rebooting the server. ...
      (freebsd-net)
    Loading