From owner-freebsd-security Thu Aug 17 7:14:48 2000 Delivered-To: freebsd-security@freebsd.org Received: from gatekeeper.whistle.com (gatekeeper.whistle.com [207.76.204.2]) by hub.freebsd.org (Postfix) with ESMTP id D15F337B66F for ; Thu, 17 Aug 2000 07:14:42 -0700 (PDT) Received: from pau-amma.whistle.com (pau-amma.whistle.com [207.76.205.64]) by gatekeeper.whistle.com (8.9.3/8.9.3) with ESMTP id HAA06078; Thu, 17 Aug 2000 07:14:35 -0700 (PDT) (envelope-from dhw@whistle.com) Received: (from dhw@localhost) by pau-amma.whistle.com (8.9.3/8.9.3) id HAA02662; Thu, 17 Aug 2000 07:14:30 -0700 (PDT) (envelope-from dhw) Date: Thu, 17 Aug 2000 07:14:30 -0700 (PDT) From: David Wolfskill Message-Id: <200008171414.HAA02662@pau-amma.whistle.com> To: achilov@granch.ru, Egon.Rath@lsr-ooe.gv.at Subject: Re: AW: deny incoming icmp Cc: freebsd-security@FreeBSD.ORG In-Reply-To: Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org >From: Egon.Rath@lsr-ooe.gv.at >Date: Thu, 17 Aug 2000 15:48:02 +0200 >|> What type of ICMP messages uses traceroute? I'd like to mask >|> internal network structure from tracing... >Traceroute uses ICMP types 0 (Echo Reply), 8 (Echo request) and 11 (TTL >expired) to determine the route to the host. That didn't seem quite right to me, so I looked (in /usr/src/contrib/traceroute/traceroute.c); there is a rather large comment block near the beginning of the file tagged * -- Van Jacobson (van@ee.lbl.gov) * Tue Dec 20 03:50:13 PST 1988 that explains how & why the program uses high-numbered UDP datagrams for the probes. It does rely on ICMP (time exceeded; ICMP type 11) for receiving notification from a router, though. Cheers, david -- David Wolfskill dhw@whistle.com UNIX System Administrator Desk: 650/577-7158 TIE: 8/499-7158 Cell: 650/759-0823 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message