Re: ICMP blocking

[Joe St Sauver <joe () OREGON UOREGON EDU>]

Russell mentioned:

#Diagnostics work to machines that are visible on the 'Net but you can't
#easily enumerate stuff behind the firewall.
#
#One unintended consequence of the firewall is that udp trace routes are
#blocked unless the the address has a udp port open and you select that
#port to trace route on.

If the concern is network reconnaisance, things like tcptraceroute
(see http://michael.toren.net/code/tcptraceroute/ ) should also be
kept in mind, or host enumeration via passive approaches that may
also yield at least a partial roster (e.g., consider a DNS-based
passive approach)

Regards,

Joe