50M : Think Broadband Ping Monitor Results (POST YOURS)

[Kushan]

Originally Posted by qasdfdsaq

No.

Nobody "does" an ICMP flood to you.

For an ICMP flood to occur, your own router has to actively generate it itself.

See http://en.wikipedia.org/wiki/Ping_flood

[qasdfdsaq]

Have you even read that or understand what ICMP means?

The attacker hopes that the victim will respond with ICMP Echo Reply packets

Hopes the victimwill respond, exactly as I said.

See http://en.wikipedia.org/wiki/Interne...ssage_Protocol

[Kushan]

A ping flood is a simple denial-of-service attack where the attacker overwhelms the victim with ICMP Echo Request (ping) packets.

I really don't know why you're trying to make this distinction between pings and pongs.

[qasdfdsaq]

Because the ping is generated by an attacker and the pong is generated by your own router. For an attack to be effective you have to decide to actively generate those pongs. They are not created by the attacker and they don't come out of nowhere. You have complete control over how many pongs you choose to generate and if you choose to disable your own connection by ponging too much that's your own stupidity. An attacker has zero control over this.

Imagine you're shouting at someone until you lose your voice. They may be provoking you but you're the one doing the actual damage to yourself, and nobody is forcing you to do it. You choose to of your own accord. There would be no damage and no attack if you did not choose to shout back yourself.

All a firewall is going to do is cover your mouth when you're shouting. Which is obviously an inferior method of damage prevention than just not shouting as much in the first place.

[Kushan]

Originally Posted by qasdfdsaq

Because the ping is generated by an attacker and the pong is generated by your own router. For an attack to be effective you have to decide to actively generate those pongs. They are not created by the attacker and they don't come out of nowhere. You have complete control over how many pongs you choose to generate and if you choose to disable your own connection by ponging too much that's your own stupidity. An attacker has zero control over this.

Imagine you're shouting at someone until you lose your voice. They may be provoking you but you're the one doing the actual damage to yourself, and nobody is forcing you to do it. You choose to of your own accord. There would be no damage and no attack if you did not choose to shout back yourself.

All a firewall is going to do is cover your mouth when you're shouting. Which is obviously an inferior method of damage prevention than just not shouting as much in the first place.

Is this what it boils down to, because you don't think that some firewalls have flood protection? For a bunch of requests, not just ICMP?

I'm not disagreeing on how an attack is done via ICMP, all we seem to disagree with is what can be used to prevent it. You seem obsessed that only one thing should stop it, when all I'm saying is that there are a number of ways to prevent the Denial of Service, so disabling the feature entirely is really not necessary.

I don't understand why you can't just agree that there's such a thing as having multiple layers of security.

[qasdfdsaq]

I've said this multiple times, there is nothing to prevent. You are attacking yourself. There is nothing to stop.

You seem to be unable to grasp the difference between starting something that is stopped and stopping something that is started.

You want a room to be dark? You don't need a cover to block out the light. Don't turn on the light to begin with. The light doesn't come on automatically by itself.

[Kushan]

Originally Posted by qasdfdsaq

I've said this multiple times, there is nothing to prevent. You are attacking yourself. There is nothing to stop.

You seem to be unable to grasp the difference between starting something that is stopped and stopping something that is started.

You want a room to be dark? You don't need a cover to block out the light. Don't turn on the light to begin with. The light doesn't come on automatically by itself.

I give up with you. I don't know if you're deliberately being obtuse or if you really have missed the point that I was making - that those attacks are a thing, that they exist. There's wiki entries and everything. You're just not willing to listen.

[qasdfdsaq]

You seem to have missed the point. I've explained multiple times yet you refuse to listen yourself.

Once again. You seem to be unable to grasp the difference between starting something that is stopped and stopping something that is started.

It relies on a specific program on your own router deliberately generating enough outbound traffic to cause itself a problem. Nobody is forcing it to do this and a firewall is the wrong place to mitigate this. It relies solely on the router being too stupid to realise it's overloading itself, and any decently programmed router will not be flawed in this way.

As you clearly don't understand the fundamental basis of how a "ping flood" works, I suggest you stop digging yourself into a deeper hole. Maybe go read up on how firewalls and ICMP actually works, and how any well-programmed router incorporates an ICMP responder with a built-in rate limiter by default

[Kushan]

Originally Posted by qasdfdsaq

You seem to have missed the point. I've explained multiple times yet you refuse to listen yourself.

Once again. You seem to be unable to grasp the difference between starting something that is stopped and stopping something that is started.

It relies on a specific program on your own router deliberately generating enough outbound traffic to cause itself a problem. Nobody is forcing it to do this and a firewall is the wrong place to mitigate this. It relies solely on the router being too stupid to realise it's overloading itself, and any decently programmed router will not be flawed in this way.

As you clearly don't understand the fundamental basis of how a "ping flood" works, I suggest you stop digging yourself into a deeper hole. Maybe go read up on how firewalls and ICMP actually works, and how any well-programmed router incorporates an ICMP responder with a built-in rate limiter by default

Yes, therein lies the problem.

[qasdfdsaq]

Just because the Superhub is stupid like this doesn't mean every other router is, or even the majority are... Anything that runs Linux by default has a built-in ICMP rate limit. Most ISP supplied routers in foreign countries are not susceptible to ICMP flood attacks.

A firewall is still the wrong way to deal with the problem.

[Kushan]

I never said it was the right way. I said it was one of many ways.

[kwikbreaks]

Surely if enough bandwidth was used sending requests to your IP the downstream could become overloaded even if you didn't respond at all and there is diddly squat your router could do to stop that happening - it would need blocking somewhere upstream of you.

Anyway just what chance is there that a home IP is going to be the target of any form of DoS? Despite seeing the option to defend against DoS attacks in home router settings I fail to see what they could do other than turn themselves off.

[qasdfdsaq]

Originally Posted by kwikbreaks

Surely if enough bandwidth was used sending requests to your IP the downstream could become overloaded even if you didn't respond at all and there is diddly squat your router could do to stop that happening - it would need blocking somewhere upstream of you.

Yes, but that's not really an ICMP flood, that's a generic traffic-volume Denial of Service attack. Any type of traffic can achieve that (I prefer using UDP) and as you say, there's diddly squat your firewall or router can do about it.

Anyway just what chance is there that a home IP is going to be the target of any form of DoS? Despite seeing the option to defend against DoS attacks in home router settings I fail to see what they could do other than turn themselves off.

Well I've attacked a few hundred home IPs myself. Small fry in the ocean of home IPs but there have been legitimate reasons.

[kwikbreaks]

Jolly good job our government aren't in the business of monitoring UK subjects web activities then

[qasdfdsaq]

Why would the government care, pinging someone isn't illegal :p