OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: stefmitstarband.net
Date: Thu Oct 04 2001 - 12:03:28 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    That's not "Microsoft type" - ICMP has type and codes, depending on
    what the message is (RFC 792 and the likes), like yours would be:

    ECHOREPLY --> type 0, code 0
    ECHO [you probably meant REQUEST] --> type 8, code 0
    TIME_EXCEEDED --> type 11, code 0 (TTL=0 during transit)
                                                    or
                                                    type 11, code 1 (TTL=o during re-assembly)

    Stef

    On 3 Oct 2001, at 15:28, Paul Heinlein wrote:

    >
    > On Wed, 3 Oct 2001, Kevin Kaminski wrote:
    >
    > > What is a safe ICMP configuration in the real world that will not
    > > affect client connectivity? Or maybe I should leave it more open as to
    > > what is your policy on ICMP with Win2K and why?
    >
    > I don't use Windows for ICMP filtering (and hence don't know the type
    > numbering used by Microsoft), but I typically allow only
    >
    > ECHOREPLY
    > ECHO
    > TIME_EXCEEDED
    >
    > on inbound connections unrelated to any established outbound
    > connections. I haven't experienced any troubles with that configuration.
    >
    > -- Paul Heinlein <heinleinmeasurecast.com>
    >