12

To configure Linux to ignore ICMP broadcasts (to protect from SMURF attacks), I have added the following line to /etc/sysctl.conf:

net.ipv4.icmp_echo_ignore_broadcasts = 1

Anyone knows what are the drawbacks of ignoring ICMP broadcasts? In other words what is ICMP broadcasting good for?

  • If you are speaking specifically of ICMP broadcast then turning it off should be OK. The only exception might be if your box is also a router. Most (all?) of the RFC's recommend that most(all?) ICMP broadcast traffic be silently discarded. – dbasnett Jul 4 '11 at 16:28
12

The sysctl option you referenced, net.ipv4.icmp_echo_ignore_broadcasts, only deals with IPv4 ICMP echo broadcasts. ICMP echo messages are the messages used by the "ping" command-line tool. By ignoring broadcast ICMP echo requests, your machine won't respond when someone tries to ping a broadcast address (such as 255.255.255.255, or, say, 192.168.1.255 on a 192.168.1.0/24 subnet) to find all the hosts on the network or subnet at the same time.

This particular sysctl option shouldn't have any effect on being able respond to unicast pings sent directly to the unicast IP address of your machine. Also, this option is only for ICMP echo broadcasts, so it shouldn't have any effect on all the other uses of ICMP besides echoes.

| improve this answer | |
1

ICMP echo is more commonly known as ping, the simplest way to determine whether a networked system is responsive.

By ignoring ICMP broadcasts, your system(s) will not respond to ping requests and at first glance will appear down or unavailable to anyone who didn't know otherwise.

It is one way of hiding your system, but the next logical step for a determined intruder would be to perform a port scan.

| improve this answer | |
  • Thanks for the explanation. Is there another effect of blocking broadcasts, other than ignoring ping requests? – brahima Jul 4 '11 at 13:14
  • Not that I'm aware of - any issues you encounter will probably be because of software or devices requiring this functionality being available. Personally I wouldn't block pings, I haven't heard of smurf attacks for a long time now. – Ruairi Fullam Jul 4 '11 at 13:20
  • Sorry but this is absolutely wrong. Ignoring broadcasts does not ignore ping requests. The keyword is broadcast. And ignoring ICMP ECHO_REQUESTs is really annoying and not a security enhancement. Unless of course your idea of 'security' is breaking an entire protocol meant for reporting errors etc. Your comment however is correct. Maybe reword the answer? Just a thought. I think you mean that it would ignore ping requests to the broadcast address but that's not what it says. – Pryftan Dec 24 '19 at 13:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.