[AusNOG] icmp best practise

[Mark Smith]

On 23 Nov 2015 6:26 PM, "Jeremy Visser" <jeremy.visser at gmail.com> wrote:
>
> On Mon, Nov 23, 2015 at 2:15 PM, David Hughes <david at hughes.com.au> wrote:
> > Team Cymru could be a good first point of reference.
> > https://www.cymru.com/Documents/icmp-messages.html
>
> Ouch. That page doesn't suggest allowing ICMP "Packet Too Big" which
> is a recipe for tarpitting TCP should you use IPv6 on a <1500 MTU
> network and don't hack your TCP MSS.
>

The better you look, the more you see.

IPv6 version:

"Recommendations for Filtering ICMPv6 Messages in Firewalls"
https://tools.ietf.org/html/rfc4890

Toot!

http://www.slideshare.net/mobile/MarkSmith214/wysrrfcsandids
_______________________________________________
> AusNOG mailing list
> AusNOG at lists.ausnog.net
> http://lists.ausnog.net/mailman/listinfo/ausnog
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ausnog.net/pipermail/ausnog/attachments/20151123/cb3b49cc/attachment.html>