[Freeswitch-users] ICMP... and MTU

[Claus Andersen]

On Wed, 19 Feb 2014, Cesar Bermudez wrote:

> Sorry to ask, but ..

There are no stupid questions - only stupid answers.

> If you dont recommend to block the ping, what do you recommend?
> and what issue cause the icmp block?

You are most probably talking about ping and traceroute. But ICMP is a lot 
more than just that. The 3 types of ICMP you use for ping and traceroute 
are Echo Reply (type 0), Echo Request (type 8) and Time Exceeded (type 
11).

But there are many more such as Source Qunech and Destination unreachable.

The question you should ask yourself: Why am I blocking this and what do I 
want to achieve?

Many poeple are scared of ping of death but that has been patched many 
years ago and is not an issue as such. But if your thinking is that you 
would rather avoid any risk and can do without that very handy diagnostic 
tool then please do block for it. But that does still not mean that you 
should block for all ICMP.

ICMP is Internet Control Message Protocol. Some very important stuff 
sometimes happens via ICMP. Like any other traffic you need to understand 
why/why not you want to block it. Yes - there may be errors in the 
implementation which makes your host blow up (vulnerable like Ping of 
death) but on the other hand the where create for a purpose. If you 
naively close for everything you must expect breakage as well.

A good read is as usual wikipedia which shows you more uses for ICMP:
http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol

Security is never absolute. It is a question of convenience, usability 
and the amount of risk. If you can accept no risk the Internet is not for 
you.

Kind Regards,
Claus Andersen