On Tue, 04 Jul 2000 09:45:14 +0100 (BST), Glynn Clements wrote: >Ralf G. R. Bergs wrote: > >> > > > Personally I suggest allowing the following ICMP types: >> > > > 0 Echo Reply >> > > > 3 Destination Unreachable >> > > > 11 Time Exceeded >> > > > 12 Parameter Problem >> > >> > 0 is optional but useful, 11 can be used for certain kinds of DoS attack >> > against some hosts. >> >> Does that mean you would suggest to drop 11? Or would I break things (apart >> from DoS attacks, of course ;-) if I'de filter 11? > >If you drop 11: > >a) outbound traceroute won't work (if you don't use traceroute, then >you probably should drop type 11), and I *do* need traceroute, therefore I can't drop it. But thanks for enlightening me. >b) routing loops could go unreported; this shouldn't really matter >unless your network is sufficiently complex that routing loops are a >realistic possibility. This isn't realistic for my little home network. :-) Thanks, Ralf -- Sign the EU petition against SPAM: L I N U X .~. http://www.politik-digital.de/spam/ The Choice /V\ of a GNU /( )\ Generation ^^-^^ - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.rutgers.edu
