Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

An EC2 Instance has ICMP services disabled by default. While it's not totally clear to me why, I think it's because it could be a potential security risk. At the moment I'm enabling Echo Responses only when I'm restarting the server so I can see if it's up and running, but once it came online I'm disabling it again. Is it necessary? What are reasons to disable ICMP in general?

share|improve this question
up vote 10 down vote accepted

ICMP consists of a large collection of commands. Disallowing all of those will break your network in strange ways.

ICMP allows things like "traceroute" and "ping" (ICMP echo request) to work. Thus that part is quite useful for normal diagnostics. It also is used for feedback when you run a DNS server (port unreachable) which, in a modern DNS server, may actually help select a different machine to query faster.

ICMP is used for path MTU discovery. Chances are your OS sets "DF" (do not fragment) on TCP packets it sends. It is expecting to get an ICMP "fragmentation required" packet back if something along the path fails to handle that size of packet. If you block all ICMP, your machine will have to use other fallback mechanisms, which basically use a timeout to detect a PMTU "black hole" and will never optimize correctly.

There are probably a few more good reason to enable most of ICMP.

Now as your question why to disable:

Reasons to disable part of ICMP are:

  • Protection from old style worms which used ICMP echo request (aka ping) to see if a host was alive before trying to attack it. These days a modern worm tries it anyways, making that no longer effective
  • Hiding your infrastructure. If you want to do this than please block it at the edge of your network. Not on every single computer. That will just cause your admin to pull all the hair from his or her head in frustration when something goes wrong and all the normal analyses tools fail. (In this case: Amazon could block it at the edge of the cloud).
  • Denial of service attacks based on ICMP. Handle these the same as other DOS attacks: Rate limit.
  • The only valid one: If your are on an unsafe network you might want to block or disable the router has changed command. Obfix: use your servers on a safe network.

Note that there are 'server hardening' manuals out there who advice to block ICMP. They are wrong (or at least not detailed enough.). They fall in the same category as wireless 'security' via MAC filtering or hiding the SSID.

share|improve this answer
The other answers are good, but this is more extensive! Thanks! – 3k- Mar 27 '13 at 13:12

ICMP blocks are done for a couple reasons, but mostly to hide information from probes attempting to identify and profile your network. There are also several types of attacks on routers and publicly accessible end-systems that use ICMP traffic as part of the exploit.

in your case, you can probably allow echo responses, though that cause you to be noticed by more probes. attacks like ping-based DDOS and smurf attacks are largely mitigated these days.

share|improve this answer

The biggest risk of ICMP on an internet facing server is the increased surface area to Denial of Service (DoS) attack.

share|improve this answer

I would suggest preventing flooding of ICMP requests by using iptables instead of blocking it permanently:

iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/minute --limit-burst 100 -j ACCEPT
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .