Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

To configure Linux to ignore ICMP broadcasts (to protect from SMURF attacks), I have added the following line to /etc/sysctl.conf:

net.ipv4.icmp_echo_ignore_broadcasts = 1

Anyone knows what are the drawbacks of ignoring ICMP broadcasts? In other words what is ICMP broadcasting good for?

share|improve this question
If you are speaking specifically of ICMP broadcast then turning it off should be OK. The only exception might be if your box is also a router. Most (all?) of the RFC's recommend that most(all?) ICMP broadcast traffic be silently discarded. – dbasnett Jul 4 '11 at 16:28
up vote 10 down vote accepted

The sysctl option you referenced, net.ipv4.icmp_echo_ignore_broadcasts, only deals with IPv4 ICMP echo broadcasts. ICMP echo messages are the messages used by the "ping" command-line tool. By ignoring broadcast ICMP echo requests, your machine won't respond when someone tries to ping a broadcast address (such as, or, say, on a subnet) to find all the hosts on the network or subnet at the same time.

This particular sysctl option shouldn't have any effect on being able respond to unicast pings sent directly to the unicast IP address of your machine. Also, this option is only for ICMP echo broadcasts, so it shouldn't have any effect on all the other uses of ICMP besides echoes.

share|improve this answer

ICMP echo is more commonly known as ping, the simplest way to determine whether a networked system is responsive.

By ignoring ICMP broadcasts, your system(s) will not respond to ping requests and at first glance will appear down or unavailable to anyone who didn't know otherwise.

It is one way of hiding your system, but the next logical step for a determined intruder would be to perform a port scan.

share|improve this answer
Thanks for the explanation. Is there another effect of blocking broadcasts, other than ignoring ping requests? – brahima Jul 4 '11 at 13:14
Not that I'm aware of - any issues you encounter will probably be because of software or devices requiring this functionality being available. Personally I wouldn't block pings, I haven't heard of smurf attacks for a long time now. – Ruairi Fullam Jul 4 '11 at 13:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .