Subject: [OPSEC] Comments on "Recommendations for filtering ICMP messages"

From: "Glen Kent" <[email-masked]>
Date: Fri, 21 Nov 2008 14:25:25 +0530

Hi,

I like the idea behind the draft, but i don't like the way its been
written. Its too verbose and is overly redundant, and actually
discourages you to go ahead.

I think it is fair to assume that a person interested in reading this
draft would have a basic understanding of what ICMP is, and what each
of its errors mean. Even if the reader is not aware of the intricacies
of each error then that information is easily available and I don't
think it needs to be spelled out in this detail here.

To cite an example, consider sections 2.1.1 to 2.1.1.2.4. All you need
is just *one* paragraph explaining the issues that one can expect if
Host and Network Unreachable error messages are filtered and the
threats associated with each message. Now why do you need to explain
in great detail what each one of these error messages mean?

Besides this, why do we need to spend energy on error codes that have
been deprecated (codes 6, 8, 9, 10, etc)? Similarly, do routers these
days even support sending ICMP codes 11 and 12? I am aware of two
major vendors that don't.

I lost steam after a few pages and couldn't even complete the draft. I
would strongly recommend editing this draft so that it becomes more
readable.

Glen
_______________________________________________
OPSEC mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/opsec