Subject: Problem of blocking ICMP packets

From: Rajat <[email-masked]>
Date: Fri, 7 May 2004 04:49:52 -0700 (PDT)

Dear All,
I am in process of implementing Path MTU detection technique. So for that I have to send ICMP ECHO request packets to destination host, and process the received ICMP ECHO reply packets.
I read that the ICMP server is embedded in the kernel of OS itself, so there is no need to write server code at all. So for sending and receiving of ICMP packets we will use raw sockets without specifying any port number.
But in between the network, some routers have some firewall configuration so that they will simply drop any incomming ICMP packet without sending any response to the sender. Hence originating host will not be aware of the status of destination host.
These firewall settings are due to some attacks like Ping of deth, Denial of request etc.
Can any one provide me any solution to overcome this problem. 
 
Thanks in advance.

---------------------------------
Do you Yahoo!?
Win a $20,000 Career Makeover at Yahoo! HotJobs

---

From: "Christian Huitema" <[email-masked]>
Date: Fri, 7 May 2004 12:51:56 -0700

> But in between the network, some routers have some firewall 
> configuration so that they will simply drop any incomming ICMP 
> packet without sending any response to the sender. 

Not just routers. Many "host firewalls" will by default drop all
unsolicited ICMP packets. The rational is a variant of security by
obscurity: a host is more secure if its presence cannot be trivially
detected.

The old assumption used to be that if a host has an IP address, it can
receive pretty much any packet sent to that address. The practical
situation we have today is that if two hosts communicate over a given
protocol and port, they can receive packets from the same "five tuple"
but are not guaranteed to receive other packets. This has an important
consequence for many IETF designed protocols, including indeed path MTU
discovery.

-- Christian Huitema

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf