Re: how to block ICMP tunneling?

["Steven M. Bellovin" <smb () research att com>]

In message <3988F0001E0BD31192180090274077D0702CC0 () sj-msg01 altera com>, Kyle S
tarkey writes:
> I was under the impression that ICMP should be blocked coming from the
> outside.  I can't think of any reason you would want some one from the
> outside PINGing, TRACRTing or otherwise Probing your internal network for
> active hosts.  IMHO you should simply block the entire proctocol from the
> outside.

If you do, you break Path MTU, which can disrupt communications to many
sites.