Re: ICMP Covert channels question

[Paul Schmehl <pauls () utdallas edu>]

--On Friday, January 28, 2005 11:45:00 PM +0100 cyberpixl 
<cyberpixl () gmail com> wrote:
> Assume there is a local machine (our target) with ip 192.168.0.2 that
> is connected to the internet using a router 192.168.0.1/88.88.88.88
> (that is not blocking icmp packets) and my machine is say,
> 33.33.33.33. If i then send an icmp packet to the 88.88.88.88 router
> with source ip set to 192.168.0.2, would it forward that packet to the
> host in its local network, or will it discard it? Is there any way to
> deliver my packet to that local machine?

No, because non-routeable addresses are...well....non-routeable.  The only 
exception to this is *if* the target machine already had a session going 
with 33.33.33.33 (and it would obviously be nat'd/pat'd) there is a snort 
time frame within with your icmp packet would be delivered because the 
firewall is still translating the address/port for that session.

Of course you have to know in advance all those variables, so, since you're 
sitting right there, just pound the dern thing with a hammer and be done 
with it.  :-)

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html