Block bad ICMP messages to Prevent ICMP attacks

Takeaway: The ICMP protocol facilitates the use of important administrator utilities such as ping and traceroute, but it can also be manipulated by hackers to get a snapshot of your network. Learn what ICMP traffic to filter and what to allow.
This article originally appeared in the Security Solutions e-newsletter.

Although most network administrators do a fairly good job of filtering TCP and UDP traffic, many forget to filter ICMP traffic. ICMP traffic is necessary for troubleshooting TCP/IP and for managing its flow and proper function. However, ICMP is also dangerous. Hackers can use it to map and attack networks, so it needs to be restricted.

Like TCP and UDP, ICMP is a protocol within TCP/IP that runs over IP. Unlike TCP and UDP, ICMP is a Network Layer protocol and not a Transport Layer protocol. For more information on ICMP, see its request for comments (RFC) on the IETF’s Web site.

Bad ICMP
Some ICMP message types are necessary for network administration. Unfortunately, hackers have found a way to turn a good network tool into an attack. The most common types of ICMP attacks are:

• ICMP packet magnification (or ICMP Smurf): An attacker sends forged ICMP echo packets to vulnerable networks’ broadcast addresses. All the systems on those networks send ICMP echo replies to the victim, consuming the target system’s available bandwidth and creating a denial of service (DoS) to legitimate traffic.
• Ping of death: An attacker sends an ICMP echo request packet that’s larger than the maximum IP packet size. Since the received ICMP echo request packet is larger than the normal IP packet size, it’s fragmented. The target can’t reassemble the packets, so the OS crashes or reboots.
• ICMP flood attack: A broadcast storm of pings overwhelms the target system so it can’t respond to legitimate traffic.
• ICMP nuke attack: Nukes send a packet of information that the target OS can’t handle, which causes the system to crash.

Good ICMP
Several common tools that use ICMP are necessary for normal administration, management, and troubleshooting on your network. These tools include ping, traceroute, and path Maximum Transmit Unit (MTU) discovery.

Ping
When you ping a destination network address, you’re sending an ICMP packet with message type 8 (Echo) code 0 (Echo–Request) to that address. The ICMP reply packet has a message type 0 (Echo) code 0 (Echo–Reply).

Traceroute
When you run a traceroute to a target network address, you send a UDP packet with one time to live (TTL) to the target address. The first router this packet hits decreases the TTL to 0 and rejects the packet. Now the TTL for the packet is expired. The router sends back an ICMP message type 11 (Exceeded) code 0 (TTL–Exceeded) packet to your system with a source address. Your system displays the round-trip time for that first hop and sends out the next UDP packet with a TTL of 2.

This process continues until you receive an ICMP message type 3 (Unreachable) code 3 (Port–Unreachable) from the destination system. Traceroute is completed when your machine receives a Port-Unreachable message.

If you receive a message with three asterisks [* * *] during the traceroute, a router in the path doesn’t return ICMP messages. Traceroute will continue to send UDP packets until the destination is reached or the maximum number of hops is exceeded.

Path MTU discovery
When you begin a TCP/IP session between two machines, TCP/IP tries to negotiate the size of packets that can be sent during the session. This is called path MTU discovery. The machine that initiates the connection will send the largest packet it can with the Don’t Fragment (DF) bit set.

If any router in the path has a smaller MTU, it will drop the packet with the DF bit set. That router will send an ICMP message type 3 (Unreachable) code 4 (Fragmentation–DF–Set) back to the initiating system. On the initiating system, TCP/IP will decrease the packet size and resend the packet.

The bottom line
Without getting into vendor specifics, disable IP-directed broadcasts to all of your routers to keep your network healthy. Letting traceroute, ping, or any of the other ICMP messages into and through your network from the Internet is an invitation for network mapping, and it could lead to an attack.

You can protect your network from attack by implementing three simple network rules:

• Allow ping—CMP Echo-Request outbound and Echo-Reply messages inbound.
• Allow traceroute—TTL-Exceeded and Port-Unreachable messages inbound.
• Allow path MTU—ICMP Fragmentation-DF-Set messages inbound.

Don’t let poor configuration lead to hacker probing and attacks that are easily blocked. Applying these three rules and blocking other types of ICMP traffic can provide a lot of network security with minimal effort.