An administrator creates a rule to block outgoing ICMP Time Exceeded messages from leaving the network border. What will the effect of this be?

The correct answer is C. External hosts will not be able to traceroute to hosts on your DMZ. How do you defend against this type of network mapping? I'm a fan of filtering incoming ICMP messages on my network, except perhaps a web or FTP server. All other ICMP coming from a hostile network (such as the Internet) can be dropped. Of course, if your ISP wants to ping you as

Reconnaissance, Scanning, and Enumeration

Question

Options

AExternal hosts will not be able to detect hosts in your DMZ
BInternal hosts will be unaware of routing loops created by your router
CExternal hosts will not be able to traceroute to hosts on your DMZ
DInternal hosts will not be able to traceroute to hosts on the Internet

How the community answered

(28 responses)

A
14% (4)
B
4% (1)
C
79% (22)
D
4% (1)

Explanation

How do you defend against this type of network mapping? I'm a fan of filtering incoming ICMP messages on my network, except perhaps a web or FTP server. All other ICMP coming from a hostile network (such as the Internet) can be dropped. Of course, if your ISP wants to ping you as a keepalive signal, you could set up a filter that allows ICMP from its source address/network. You could disable outgoing ICMP Time Exceeded messages, but your users couldn't traceroute all the way to you. That might not be a bad thing. Many sites are starting to block all incoming and outgoing ICMP messages.

Topics

#ICMP time exceeded#traceroute#firewall rules#network reconnaissance

Community Discussion

No community discussion yet for this question.

Full GCIH Practice