News for hackers. Stuff that matters.

A comment on Blacknurse – Low bandwidth ICMP firewall attack. Parent comment

Re:Blacknurse – Low bandwidth ICMP firewall attack by zrm on Monday November 14, 2016 @12:34PM (#12951535)
Blocking ICMP type 3 breaks path MTU discovery. When the path MTU is less than the server's MTU, the client will typically send a request which is smaller than the path MTU and then the server's response isn't so it's the server that gets the ICMP message.

Blocking type 3/3 can also make some other denial of service attacks easier because it takes longer for the server to figure out that the device at that IP doesn't want the packets the server is sending when the request is from a spoofed IP address.

[ Parent | on HN ]
Re:Blacknurse – Low bandwidth ICMP firewall attack by omribahumi on Monday November 14, 2016 @01:16PM (#12951918)
Ok, then this is definitely a problem with UDP.

But what about TCP only? AFAIK, TCP RST is usually used when a packet is received with no connection. The only place I'm aware of that uses ICMP 3/3 is the REJECT iptables target when the defaults are used.

[ Parent | on HN ]