Blacknurse – Low bandwidth ICMP firewall attack

Re:Blacknurse – Low bandwidth ICMP firewall attack by uiri on Monday November 14, 2016 @01:07PM (#12951856)

This is really old news. These kinds of attacks have been well documented for over a decade.[1] An ICMP type 3 code 3 or type 3 code 2 packet MUST be treated the same as a TCP Reset packet (per RFCs). You can also do blind performance degradation attacks with ICMP type 4 or type 3 code 4 packets. Thankfully, ICMP type 4 has been deprecated for a while now so those packets can be safely ignored.

[1] https://www.gont.com.ar/drafts/icmp-attacks-against-tcp.html

[ Parent | on HN ]

Re:Blacknurse – Low bandwidth ICMP firewall attack by cmdrfred on Monday November 14, 2016 @03:15PM (#12952907)

I guess Cisco never got the memo as per usual. Must of gotten buried under all the SmartNet spam.

[ Parent | on HN ]

Re:Blacknurse – Low bandwidth ICMP firewall attack by rasz_pl on Monday November 14, 2016 @05:25PM (#12953917)

the fact some models crawl even after you explicitly block ICMP makes me think clever backdoor?

[ Parent | on HN ]