Ralf G. R. Bergs wrote: > > > > Personally I suggest allowing the following ICMP types: > > > > 0 Echo Reply > > > > 3 Destination Unreachable > > > > 11 Time Exceeded > > > > 12 Parameter Problem > > > > 0 is optional but useful, 11 can be used for certain kinds of DoS attack > > against some hosts. > > Does that mean you would suggest to drop 11? Or would I break things (apart > from DoS attacks, of course ;-) if I'de filter 11? If you drop 11: a) outbound traceroute won't work (if you don't use traceroute, then you probably should drop type 11), and b) routing loops could go unreported; this shouldn't really matter unless your network is sufficiently complex that routing loops are a realistic possibility. -- Glynn Clements <glynn@sensei.co.uk> - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.rutgers.edu
