Re: Blocking ping ?

From: Hal Burgiss (hal@burgiss.net)
Date: 02/02/02

  • Next message: Jorey Bump: "Re: ftp & ipchains: using the chains approach this time" 

    From: Hal Burgiss <hal@burgiss.net>
Date: Sat, 02 Feb 2002 20:13:04 GMT

    On Sat, 02 Feb 2002 14:56:30 -0500, Carlos Moreno <moreno_at_mochima_dot_com@m.com> wrote:
    >
    > Hi,
    >
    > I'm just curious as to why I can't seem to be
    > able to refuse ping requests? (i.e., I don't
    > want any machine from the outside world to ping
    > my machine and receive a reply).
    >
    > I'm running a RedHat system, and I run setup,
    > and the system service "echo" is off (am I
    > mistaken in thinking that echo is the service
    > corresponding to the ping facility? -- I don't

    Yes, sadly mistaken.

    > see any icmp listed in the system services).

    That's because ping uses a protocol, ie ICMP, and is not a system
    service. Leave echo service off too, it has no good use for most people.

    man iptables|ipchains is the right way to do it. I would suggest not
    blocking all ICMP, but just the ones like echo-request that might be
    misused. Some (most?) ICMP are your friends and tell you things like
    'network unreachable', etc. 

    -- 
Hal Burgiss

    Relevant Pages

    • Re: [fw-wiz] ECHO Protocol
      ... Yes, I know that there are alternate "ping" programs that will allow you to use TCP, UDP or possibly anything that programmer could think of, but the traditional ping uses ICMP. ... Two of the ICMP types are referred to as echo and echo reply, which are the ICMP types used for ping. ... Ping command in Windows uses ICMP protocol, while others say that Ping uses ...
      (Firewall-Wizards)
    • Re: Blocking ping ?
      ... >want any machine from the outside world to ping ... >and the system service "echo" is off (am I ... >mistaken in thinking that echo is the service ... and it reports that *everything* is closed ...
      (comp.os.linux.security)
    • Re: ssh on ping port?
      ... Ping absolutely *does* use a port. ... Ping is a program which sends ICMP ECHO ...
      (alt.linux)
    • Re: Confused about ping...
      ... Ping works by sending an ICMP "Echo" data packet to the ...
      (Fedora)
    • Re: Removing ping/icmp from a network
      ... A ping sweep isn't the only way to do network exploration. ... ICMP is a protocol, not a service. ... Security by design is always best, but hiding the presence of a device ...
      (Security-Basics)