| 2.3 |  | Securing the Perimeter Router |
| 2.3.5 |  | Filter ICMP |

| There are several types of ICMP message types that can be used against the network. Programs use some of these messages. Others are automatically generated by the router and used for network management. ICMP echo packets can be used to discover subnets and hosts on the protected network and can also be used to generate DoS floods. ICMP redirect messages can be used to alter host routing tables. Both ICMP echo and redirect messages should be blocked inbound by the router.

The access list shown in Figure blocks all ICMP echo and redirect messages. As an added safety measure, this access list also blocks mask-request messages. All other ICMP messages inbound to the 16.2.1.0/24 network are allowed. The following ICMP messages are required for proper network operation and should be allowed outbound:

- Echo: Allows users to ping external hosts
- Parameter problem: Informs host of packet header problems
- Packet too big: Required for packet MTU discovery
- Source quench: Throttles down traffic when necessary

As a rule, all other ICMP message types outbound should be blocked.

The access list shown in Figure permits all of the required ICMP messages outbound while denying all others.

The traceroute feature utilizes some of the ICMP message types to accomplish its tasks. Traceroute displays the IP addresses of routers a packet encounters along its path, or hops from source to destination. Attackers can utilize responses to the traceroute ICMP messaging to discover subnets and hosts on the protected network. As a rule, all inbound and outbound traceroute UDP messages should be blocked at UDP ports 33400 to 34400 as shown in Figure .