Blacknurse – Low bandwidth ICMP firewall attack

Re:Blacknurse – Low bandwidth ICMP firewall attack by esseti on Monday November 14, 2016 @11:43AM (#12951023)

how can i test some of the server i use?

[ Parent | on HN ]

Re:Blacknurse – Low bandwidth ICMP firewall attack by Karlozkiller on Monday November 14, 2016 @11:46AM (#12951049)

Run the commands from the article?

hping3 -1 -C 3 -K 3 -i u20 <target ip>

ofc that assumes you have access to hping/hping3. I plan to check my own server as soon as I can.

[ Parent | on HN ]

Re:Blacknurse – Low bandwidth ICMP firewall attack by virtualwhys on Monday November 14, 2016 @01:13PM (#12951900)

Looks like ASA >= 9.2.4 ships with `icmp unreachable rate-limit 1 burst-size 1`, which is I believe the workaround Cisco suggests:

We recommend that you grant permission for the ICMP unreachable message type (type 3). Denying ICMP unreachable messages disables ICMP Path MTU discovery, which can halt IPsec and PPTP traffic. See RFC 1195 and RFC 1435 for details about Path MTU Discovery

[ Parent | on HN ]

Re:Blacknurse – Low bandwidth ICMP firewall attack by jedisct1 on Tuesday November 15, 2016 @04:08AM (#12956643)

https://github.com/jedisct1/blacknurse

[ Parent | on HN ]