No stealthing - Walker's Rule

downquark1 · 30-04-2004, 16:06

What do the techs here think about this?
http://homepage.ntlworld.com/robin.d...y.html#stealth

Should I set my router to block WAN or not?

Quote:

Note the MUST rather than SHOULD. This means that any internet user, or ISP server, has a right to expect that all live PCs connected to the internet will respond to ICMP ping requests with an ICMP reply. If a firewall user chooses to stealth ICMP requests so that no response is sent, they have only themselves to blame if they start experiencing problems, because they are in breach of RFC 1122.

Stuartbe · 30-04-2004, 16:11

TBH.. In the old days of the net when IP addys were valuable things to have I would have said yes...

Now I would say no. If you have a correctly configured firewall then allowing icmp will cause no problems as long as someone does not decide to DOS you using icmp. Most decent firewalls will allow a reply and not let a DOS attack saturate the connection by dropping the packets.

Every website you visit will know your IP address anyway as they will not be able to send packets back to you without it.

Swings and roundabouts m8.... I dont bother to block icmp from my ip personaly.

Chris W · 30-04-2004, 16:16

I agree with what RDHW has written, i do not block wan because i don't see much point in it; apply the little knowledge that i have about hacking means that the chances that it makes any difference to being the victim of am attack are very very slim. as far as i know, hackers don't make any use of icmp echo replies.

Stuartbe · 30-04-2004, 16:27

Quote:

Originally Posted by monkeybreath

I agree with what RDHW has written, i do not block wan because i don't see much point in it; apply the little knowledge that i have about hacking means that the chances that it makes any difference to being the victim of am attack are very very slim. as far as i know, hackers don't make any use of icmp echo replies.

Correct... Using ICMP to probe a system is a bit like pulling up to a house you are about to burgle with the car stereo on full blast

Not that I know anything about hacking or cracking of course

downquark1 · 30-04-2004, 16:58

I have a linksys BEFSR41 with firmware 1.45.7 connected via STB

I have no firewall software on the PC's - what's the point with a NAT router.

I enabled WAN requests and did a port probe - my ports were 'closed' instead of 'stealthed' - do these ports refer to the router or my pc?? I presume the router

Stuartbe · 30-04-2004, 17:01

Quote:

Originally Posted by downquark1

I have a linksys BEFSR41 with firmware 1.45.7 connected via STB

I have no firewall software on the PC's - what's the point with a NAT router.

I enabled WAN requests and did a port probe - my ports were 'closed' instead of 'stealthed' - do these ports refer to the router or my pc?? I presume the router

It would be the router - as far as the internet is concerned your pc's dont exist. The router is the only (pc) connected to the internet.

Matth · 01-05-2004, 00:02

Welchia pinged like hell - and your average 5kr1pt k1dd1e is not exactly subtle.

I'm NO PING, and I've never noticed any problem (other than some bandwidth test sites, where the ping time is one of the measurements) - and I reported one NTL address for repeated pings - maybe a Welchia worm that doesn't know the date!

Matth · 03-05-2004, 20:53

Speak of the devil.....
http://isc.sans.org/index.php
Flash Update (May 3rd 09:30 AM): We did receive some initial reports about a significant rise in ICMP traffic, which may point to a new worm with Nachi style ICMP component

I'm seeing a ping storm, less severe than Nachi/Welchia - from 80.x.x.x
I'd say there is DEFINITELY a new worm out there, and I'd rather NOT know what it does on a successful ping.

**Paul** · 03-05-2004, 21:18

Quote:

Originally Posted by Matth

Speak of the devil.....
http://isc.sans.org/index.php
Flash Update (May 3rd 09:30 AM): We did receive some initial reports about a significant rise in ICMP traffic, which may point to a new worm with Nachi style ICMP component

I'm seeing a ping storm, less severe than Nachi/Welchia - from 80.x.x.x
I'd say there is DEFINITELY a new worm out there, and I'd rather NOT know what it does on a successful ping.

Not seen any increase here yet.