Re: how to block ICMP tunneling?

[Sebastian Krahmer <krahmer () rz uni-potsdam de>]

Hi,

> In some email I received from Razvan Peteanu, sie wrote:
> > BO2K has the ability to use ICMP tunneling for its traffic so I'm interested
> > in what types of ICMP messages should be blocked to prevent this traffic.
You could install some kind of IDS on your system and tell 'em
that a lot more ICMP_ECHO_REPLY than ICMP_ECHO_REQUEST is bad.
a similar tool called IMON is available on www.kalug.lug.net/stealth
where you can detect LOKI sessions. Also a active scan is possible:
An ICMP_ECHO_REQUEST should cause an answer by 1. the kernel and 2nd
the backdoor.

Sebastian