From: David G. Andersen (dandersecs.utah.edu)
Date: Mon Oct 27 2003 - 10:32:47 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Brett Glass just mooed:
> At 03:17 AM 10/27/2003, Jarkko Santala wrote:
>
> >Blocking
> >all ping packets to improve security is nothing more than security through
> >obscurity. It may hide your system against the simplest ping probes, but
> >it does nothing to improve security as such.
>
> In our case, there's a more compelling reason.
>
> Some of our customers' system administrators have utilities
> which ping their servers from their home Internet connections
> to make sure everything's working. If I were to block pings,
> all of these guys' (and gals') pagers and cell phones would go
> off at once. I'd be beseiged with demands to remove the block
> immediately.

  Rate-limit them with dummynet on somewhat selective per-subnet
basis. It's not perfect, and increases the latency perceived by
customers running ping, but it helps a lot compared to doing
nothing.

  -dave

--
work: dgalcs.mit.edu me: dgapobox.com
      MIT Laboratory for Computer Science http://www.angio.net/
      I do not accept unsolicited commercial email. Do not spam me.
_______________________________________________
freebsd-securityfreebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribefreebsd.org"

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]