News for hackers. Stuff that matters.

A comment on Blacknurse – Low bandwidth ICMP firewall attack. Parent comment

Re:Blacknurse – Low bandwidth ICMP firewall attack by Karlozkiller on Monday November 14, 2016 @11:46AM (#12951049)
Run the commands from the article?

hping3 -1 -C 3 -K 3 -i u20 <target ip>

ofc that assumes you have access to hping/hping3. I plan to check my own server as soon as I can.

[ Parent | on HN ]
Re:Blacknurse – Low bandwidth ICMP firewall attack by virtualwhys on Monday November 14, 2016 @01:13PM (#12951900)
Looks like ASA >= 9.2.4 ships with `icmp unreachable rate-limit 1 burst-size 1`, which is I believe the workaround Cisco suggests:

We recommend that you grant permission for the ICMP unreachable message type (type 3). Denying ICMP unreachable messages disables ICMP Path MTU discovery, which can halt IPsec and PPTP traffic. See RFC 1195 and RFC 1435 for details about Path MTU Discovery

[ Parent | on HN ]