News for hackers. Stuff that matters.

A comment on Dealing with IPv6 fragmentation in the DNS. Parent comment

Re:Dealing with IPv6 fragmentation in the DNS by feld on Tuesday August 22, 2017 @01:35PM (#15074639)
> I'd say it has a few main facets: - ICMP is dangerous, and needs to be blocked. This is partly true, as there is historically information leakage with ICMP under certain codes. So blocking all of it is easier than trying to figure out what should be allowed and what should not.

It's actually quite easy to identify which should be allowed and which should not.

ICMP: 0,3,8,11 (echo reply, destination unreachable, echo, time exceeded)

ICMP6: 1,2,3,4,128,129,135,136 (unreachable, packet too big, time exceeded, parameter problem, echo request, echo reply, neighbor solicitation, neighbor advertisement)

See, that wasn't hard. These are the base requirements for you to have a reasonably functional IPv4 network, and the absolute minimum requirements for IPv6 to work properly.

[ Parent | on HN ]
Re:Dealing with IPv6 fragmentation in the DNS by verri on Tuesday August 22, 2017 @01:49PM (#15074792)
But why filter ICMP at all? I can understand that ICMP allows for covert tunnelling, but by that logic any IP protocol number should be blocked.
[ Parent | on HN ]
Re:Dealing with IPv6 fragmentation in the DNS by mgsouth on Tuesday August 22, 2017 @09:11PM (#15077729)
I think it's more the incoming ICMP that is troublesome, particularly redirect, and to a lesser extent destination unreachable (DOS).
[ Parent | on HN ]
Re:Dealing with IPv6 fragmentation in the DNS by rasz on Wednesday August 23, 2017 @12:14AM (#15078484)
Under windows you cant whitelist applications allowed to use ICMP, all ICMP traffic originates from deep down ring 0 NT Kernel process.
[ Parent | on HN ]
Re:Dealing with IPv6 fragmentation in the DNS by feld on Thursday August 24, 2017 @10:11AM (#15090227)
because some ICMP types are actually dangerous and can be abused
[ Parent | on HN ]
Re:Dealing with IPv6 fragmentation in the DNS by kevin_nisbet on Tuesday August 22, 2017 @05:34PM (#15076587)
Agreed.

It's just the argument that gets made for filtering, is we'd rather just filter it all instead of trying to understand what should and should not be filtered.

[ Parent | on HN ]