Re: ICMP (Ping)

[Tomas Wolf <tomas () skip cz>]

I think that between you two is a little misunderstanding. One is 
pointing out those who are challenged by the "hidden", while the other 
one is talking about kiddies scanning blindly huge IP ranges (even 
dial-up, dsl & cable), where about those thousands and thousands 
"unreachables" it would be just one IP that is not assigned, or the host 
wasn't up....

So both of you are right... If one is looking to penetrate the site or 
scans small range, this will become a target... While on the other hand 
this site won't become a target (most likely) for a ping-scanning kiddie 
that runs it in 195.X.X.X range.

good luck -- T.


Ansgar Wiechers wrote:

> On 2003-09-04 freeasabird_13 () gmx net wrote:
>  
>
> > > I don't think so. Not responding to ICMP echo-requests won't make you
> > > invisible. Whenever a ping does not return "host unreachable" you
> > > know there *is* something with that address.
> > >      
> > For the record, I never said nor implied that not responding to pings
> > would make one's internet presence "invisible".  I merely said/implied
> > that it would make your presence less obvious, which it simply would.
> >    
>
> I still don't agree. When doing a scan to find potential targets,
> addresses you don't get echo-replies from are screaming out "yes, I am
> here and I don't want you to know" to anyone who has at least a basic
> understanding of how IP works. In fact I would consider those as primary
> targets, since something worth hiding may be something worth getting. I
> fail to see how this would make your presence less obvious. Am I missing
> something?
>
> Regards
> Ansgar Wiechers
>
> ---------------------------------------------------------------------------
> Attend Black Hat Briefings & Training Federal, September 29-30 (Training), 
> October 1-2 (Briefings) in Tysons Corner, VA; the world's premier 
> technical IT security event.  Modeled after the famous Black Hat event in 
> Las Vegas! 6 tracks, 12 training sessions, top speakers and sponsors.  
> Symantec is the Diamond sponsor.  Early-bird registration ends September 6.Visit us: www.blackhat.com
> ----------------------------------------------------------------------------
>
>
>
>  



---------------------------------------------------------------------------
Captus Networks 
Are you prepared for the next Sobig & Blaster? 
- Instantly Stop DoS/DDoS Attacks, Worms & Port Scans 
- Precisely Define and Implement Network Security 
- Automatically Control P2P, IM and Spam Traffic 
FIND OUT NOW -  FREE Vulnerability Assessment Toolkit 
http://www.captusnetworks.com/ads/42.htm
----------------------------------------------------------------------------