Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

To configure Linux to ignore ICMP broadcasts (to protect from SMURF attacks), I have added the following line to /etc/sysctl.conf:

net.ipv4.icmp_echo_ignore_broadcasts = 1

Anyone knows what are the drawbacks of ignoring ICMP broadcasts? In other words what is ICMP broadcasting good for?

share|improve this question
    
If you are speaking specifically of ICMP broadcast then turning it off should be OK. The only exception might be if your box is also a router. Most (all?) of the RFC's recommend that most(all?) ICMP broadcast traffic be silently discarded. –  dbasnett Jul 4 '11 at 16:28
add comment

2 Answers

up vote 9 down vote accepted

The sysctl option you referenced, net.ipv4.icmp_echo_ignore_broadcasts, only deals with IPv4 ICMP echo broadcasts. ICMP echo messages are the messages used by the "ping" command-line tool. By ignoring broadcast ICMP echo requests, your machine won't respond when someone tries to ping a broadcast address (such as 255.255.255.255, or, say, 192.168.1.255 on a 192.168.1.0/24 subnet) to find all the hosts on the network or subnet at the same time.

This particular sysctl option shouldn't have any effect on being able respond to unicast pings sent directly to the unicast IP address of your machine. Also, this option is only for ICMP echo broadcasts, so it shouldn't have any effect on all the other uses of ICMP besides echoes.

share|improve this answer
add comment

ICMP echo is more commonly known as ping, the simplest way to determine whether a networked system is responsive.

By ignoring ICMP broadcasts, your system(s) will not respond to ping requests and at first glance will appear down or unavailable to anyone who didn't know otherwise.

It is one way of hiding your system, but the next logical step for a determined intruder would be to perform a port scan.

share|improve this answer
    
Thanks for the explanation. Is there another effect of blocking broadcasts, other than ignoring ping requests? –  brahima Jul 4 '11 at 13:14
    
Not that I'm aware of - any issues you encounter will probably be because of software or devices requiring this functionality being available. Personally I wouldn't block pings, I haven't heard of smurf attacks for a long time now. –  Ruairi Fullam Jul 4 '11 at 13:20
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.