Linked by Eugenia Loli-Queru on Thu 19th Apr 2007 18:13 UTC
Thread beginning with comment 232457
To view parent comment, click here.
To read all comments associated with this story, please click here.
To view parent comment, click here.
To read all comments associated with this story, please click here.





Member since:
2006-07-13
there are a few security reasons not to let all kind of ICMP messages go. However, ICMP8/0 blocking is one of the most overhyped things you can think of.
If you for instance use nmap and you want to find open ports, you will find it, wether you block ICMP8/0 or not. The only problem with blocking is that it will be slow and generally intrusion detection systems will not pick up the scan because of this.
If you allow a quick scan, your IDS will see and log.
Apart from the problems you will have of course for basic network/systsem testing.
Trying to be stealth indeed, is something that shows a "GRC" idea behind it and serous people don't really listen to this guy anyways.
Bottom line: ICMP8/0 allowing is not bad. A good IDS can kill off a flood ping and all the rest works as it should. Much better than a "stealth" system because when in trouble, it will explode in your face.