No stealthing - Walker's Rule
30-04-2004, 16:06
|
#1
|
|
cf.mega poster
Join Date: Jun 2003
Posts: 4,952
|
No stealthing - Walker's Rule
What do the techs here think about this?
http://homepage.ntlworld.com/robin.d...y.html#stealth
Should I set my router to block WAN or not?
Quote:
|
Note the MUST rather than SHOULD. This means that any internet user, or ISP server, has a right to expect that all live PCs connected to the internet will respond to ICMP ping requests with an ICMP reply. If a firewall user chooses to stealth ICMP requests so that no response is sent, they have only themselves to blame if they start experiencing problems, because they are in breach of RFC 1122.
|
__________________
"Knowledge is Power. Power Corrupts. Study Hard. Be Evil."
|
|
|
|
30-04-2004, 16:11
|
#2
|
|
Inactive
Join Date: Jan 2023
Posts: 4,984
|
Re: No stealthing - Walker's Rule
TBH.. In the old days of the net when IP addys were valuable things to have I would have said yes...
Now I would say no. If you have a correctly configured firewall then allowing icmp will cause no problems as long as someone does not decide to DOS you using icmp. Most decent firewalls will allow a reply and not let a DOS attack saturate the connection by dropping the packets.
Every website you visit will know your IP address anyway as they will not be able to send packets back to you without it.
Swings and roundabouts m8.... I dont bother to block icmp from my ip personaly.
|
|
|
|
|
30-04-2004, 16:16
|
#3
|
|
cf.mega poster
Join Date: Nov 2003
Location: Reading
Age: 42
Services: Virgin Media Broadband Size M
Posts: 6,546
|
Re: No stealthing - Walker's Rule
I agree with what RDHW has written, i do not block wan because i don't see much point in it; apply the little knowledge that i have about hacking means that the chances that it makes any difference to being the victim of am attack are very very slim. as far as i know, hackers don't make any use of icmp echo replies.
|
|
|
|
|
30-04-2004, 16:27
|
#4
|
|
Inactive
Join Date: Jan 2023
Posts: 4,984
|
Re: No stealthing - Walker's Rule
Quote:
|
Originally Posted by monkeybreath
I agree with what RDHW has written, i do not block wan because i don't see much point in it; apply the little knowledge that i have about hacking means that the chances that it makes any difference to being the victim of am attack are very very slim. as far as i know, hackers don't make any use of icmp echo replies.
|
Correct... Using ICMP to probe a system is a bit like pulling up to a house you are about to burgle with the car stereo on full blast 
Not that I know anything about hacking or cracking of course 
|
|
|
|
|
30-04-2004, 16:58
|
#5
|
|
cf.mega poster
Join Date: Jun 2003
Posts: 4,952
|
Re: No stealthing - Walker's Rule
I have a linksys BEFSR41 with firmware 1.45.7 connected via STB
I have no firewall software on the PC's - what's the point with a NAT router.
I enabled WAN requests and did a port probe - my ports were 'closed' instead of 'stealthed' - do these ports refer to the router or my pc?? I presume the router
__________________
"Knowledge is Power. Power Corrupts. Study Hard. Be Evil."
|
|
|
|
|
30-04-2004, 17:01
|
#6
|
|
Inactive
Join Date: Jan 2023
Posts: 4,984
|
Re: No stealthing - Walker's Rule
Quote:
|
Originally Posted by downquark1
I have a linksys BEFSR41 with firmware 1.45.7 connected via STB
I have no firewall software on the PC's - what's the point with a NAT router.
I enabled WAN requests and did a port probe - my ports were 'closed' instead of 'stealthed' - do these ports refer to the router or my pc?? I presume the router
|
It would be the router - as far as the internet is concerned your pc's dont exist. The router is the only (pc) connected to the internet.
|
|
|
|
|
01-05-2004, 00:02
|
#7
|
|
Inactive
Join Date: Mar 2004
Services: BB:M, TV:XL, Phone:M, Loyalty
Posts: 2,516
|
Re: No stealthing - Walker's Rule
Welchia pinged like hell - and your average 5kr1pt k1dd1e is not exactly subtle.
I'm NO PING, and I've never noticed any problem (other than some bandwidth test sites, where the ping time is one of the measurements) - and I reported one NTL address for repeated pings - maybe a Welchia worm that doesn't know the date!
|
|
|
|
|
03-05-2004, 20:53
|
#8
|
|
Inactive
Join Date: Mar 2004
Services: BB:M, TV:XL, Phone:M, Loyalty
Posts: 2,516
|
Re: No stealthing - Walker's Rule
Speak of the devil.....
http://isc.sans.org/index.php
Flash Update (May 3rd 09:30 AM): We did receive some initial reports about a significant rise in ICMP traffic, which may point to a new worm with Nachi style ICMP component
I'm seeing a ping storm, less severe than Nachi/Welchia - from 80.x.x.x
I'd say there is DEFINITELY a new worm out there, and I'd rather NOT know what it does on a successful ping.
|
|
|
|
|
03-05-2004, 21:18
|
#9
|
|
Dr Pepper Addict
Cable Forum Admin
Join Date: Oct 2003
Location: Nottingham
Age: 63
Services: Zen & YouFibre FTTP, Sky Q TV, Sky Mobile, Flextel SIP
Posts: 31,344
|
Re: No stealthing - Walker's Rule
Quote:
|
Originally Posted by Matth
Speak of the devil.....
http://isc.sans.org/index.php
Flash Update (May 3rd 09:30 AM): We did receive some initial reports about a significant rise in ICMP traffic, which may point to a new worm with Nachi style ICMP component
I'm seeing a ping storm, less severe than Nachi/Welchia - from 80.x.x.x
I'd say there is DEFINITELY a new worm out there, and I'd rather NOT know what it does on a successful ping. |
Not seen any increase here yet.
__________________
 Baby, I was born this way.
|
|
|
|
Posting Rules
|
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
HTML code is Off
|
|
|
All times are GMT. The time now is 23:08.
|
Join CF
You are here: 
