News for hackers. Stuff that matters.

A comment on IP traffic over ICMP tunneling. Parent comment

Re:IP traffic over ICMP tunneling by scurvy on Wednesday November 11, 2015 @12:16PM (#10547712)
Out of curiosity, why would you drop echo requests or replies? I know the normal thought is "So no one will know if the IP is in use or not," but that argument doesn't hold water. Scanning toolkits have been fast enough for the past decade to skip ICMP altogether. They know you're home even with ICMP blocked.

Edited for spelling

[ Parent | on HN ]
Re:IP traffic over ICMP tunneling by burkaman on Wednesday November 11, 2015 @02:34PM (#10548688)
They said they only allow echo and reply, not drop them.
[ Parent | on HN ]
Re:IP traffic over ICMP tunneling by scurvy on Thursday November 12, 2015 @11:52AM (#10554297)
That's even worse. PMTU detection is OK but not perfect. Fragmentation needed but DF bit set ICMP messages are important.
[ Parent | on HN ]