Re: ICMP destination unreachable messages

["Steven M. Bellovin" <smb () research att com>]

In message <c643615a7427fb3b0dfc9eef1ff89c5f3e9c52d1 () watchguard com>, "Max Ende
rs" writes:
> Hello,
>
> I'm curious to know how firewalls handle duplicate ICMP destination unreachabl
> e messages. How should replayed packets be denied? It seems like the two best 
> options are rate limiting and inspecting the IPID. Any information is apprecia
> ted.

How duplicate are they?  Remember that you have to let in the 
"fragmentation needed" messages, or you'll end up with black holes.

                --Steve Bellovin, http://www.research.att.com/~smb (me)
                http://www.wilyhacker.com (2nd edition of "Firewalls" book)


_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards