RE: how to block ICMP tunneling?

[Jason Diesel <jdiesel () axent com>]

Unless you have an application based firewall! Where the firewall is
actually scanning the contents of the pay load to check which commands for
that associated application protocol are coming in. If they are unrecognised
for say... DNS, then the firewall will not let them in. The firewall will
then log and alert as necessary.

Jason
-----Original Message-----
...
BO2k is, to me, a demonstration of where firewalls stop being useful.
The attacker gets his back door onto your network, converting a
trusted machine into his base of operations.  You now have a problem
that an 'insider' can start doing nasty stuff inside your firewall.
...