Re: Sudden increase in scans.

[Jose Nazario <jose () BIOCSERVER BIOC CWRU EDU>]

On Mon, 24 Jul 2000, Alexander Schreiber wrote:

> But you could stop the kiddies from using ICMP to map out your network
> by blocking:
>  - incoming ICMP echo-request (ping)
>  - outgoing ICMP echo-reply (pong)

you may also want to block ICMP-PORT-UNREACHABLEs to break firewalk. see
the paper at packetfactory.net for the situation.

blocking all ICMP is just plain wrong. it's vital to the proper function
of IP.

jose nazario                                    jose () biochemistry cwru edu
PGP fingerprint: 89 B0 81 DA 5B FD 7E 00  99 C3 B2 CD 48 A0 07 80
Public key available at http://biocserver.cwru.edu/~jose/pgp-key.asc