RE: Removing ping/icmp from a network

The simple answer is to limit ICMP. It is not needed by all hosts to all hosts. It is needed for selected purposes.

As such, on a Windows network for instance GPEDIT.MSC may be used to create "IP Security Policies on Local Machine" with IP filters for ICMP. Allow Ping internally and block internet connections. Restrict other ICMP types to selected systems.

See http://www.securityfocus.com/infocus/1559

Regards,
Craig Wright (GSE-Compliance)

-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx [mailto:listbounce@xxxxxxxxxxxxxxxxx] On Behalf Of Ansgar -59cobalt- Wiechers
Sent: Thursday, 27 March 2008 6:08 AM
To: security-basics@xxxxxxxxxxxxxxxxx
Subject: Re: Removing ping/icmp from a network

On 2008-03-26 Jason Thompson wrote:
ICMP is not vital for network operation, though it is convenient. PING
isn't required at all,

Neither is traceroute. Yet I'd hate to be without without either of
them.

ICMP unreachable messages don't do anything other than notify the
receiver to stop trying to connect to a destination as it isn't alive
(the receiver should get a hint of this when his SYN's don't get a SYN
ACK),

Destination unreachable messages do quite a bit more than "notify the
receiver to stop trying to connect", since they code field carries the
information *why* the destination wasn't reached. Maybe that's not so
important for joe.average@home, but it's pretty darn important for any
network admin.

ICMP redirects shouldn't happen if your network is structured
properly, and even if it's not, it just adds an extra hop.

What about "time exceeded"? What about "parameter problem"? What about
"source quench"?

I don't see any ICMP messages that are a MUST for network operation.

No, they're not a MUST. Connections can also just silently fail, leaving
you as a network admin at a total loss as to *why* they're failing.
Brilliant idea, really.

That being said, if network monitoring is being done via SNMPv1 or v2
which isn't secure at all, ICMP is the least of your problems. I agree
with a few here that you allow ICMP from trusted to untrusted, but not
vice versa. And definitely NO ICMP from the Internet.

What the heck is so freakin' scary about inbound echo requests? (to
public IP addresses, that is)

ICMP is not "teh evil(tm)". It's a part of the Internet Protocol suite,
and it's there for a reason.

Regards
Ansgar Wiechers
--
"All vulnerabilities deserve a public fear period prior to patches
becoming available."
--Jason Coombs on Bugtraq

Relevant Pages

  • Re: Removing ping/icmp from a network
    ... (the receiver should get a hint of this when his SYN's don't get a SYN ... Destination unreachable messages do quite a bit more than "notify the ... ICMP is the least of your problems. ... "All vulnerabilities deserve a public fear period prior to patches ...
    (Security-Basics)
  • RE: ICMP (Ping)
    ... Even though it will not solve all your problems, blocking ICMP echo ... replies from leaving the server is a good idea. ... All other kinds of ping should be available for normal operation as ... RFC's were written for a friendly Internet, where hosts would trust each ...
    (Security-Basics)
  • Re: Router generates INVALID icmp packets
    ... > Oscar Andreasson trusts his hosts on output. ... I can't give you a pre-determined list of what ICMP traffic to ... DENY or REJECT in netfilter rules). ... packets sent back to the "other end". ...
    (comp.os.linux.networking)
  • Re: Detecting Connection Attempts
    ... Remote 'stealth' OS fingerprinting can be pretty efficient with ICMP, ... I _do_ think the firewall for most systems (or at least the router before ... hosts to probe addresses _behind_ my firewall with icmp. ... I agree on this beeing obscurity, but not letting evil hackers from Poland ...
    (comp.security.firewalls)
  • Re: Detecting Connection Attempts
    ... Remote 'stealth' OS fingerprinting can be pretty efficient with ICMP, ... I _do_ think the firewall for most systems (or at least the router before ... hosts to probe addresses _behind_ my firewall with icmp. ... I agree on this beeing obscurity, but not letting evil hackers from Poland ...
    (comp.security.firewalls)