Some networking protocols, such as ICMP (internet control message protocol) are not TCP based. As a result, these protocols do not show up in nmap or netstat.
ICMP is useful for a few purposes. For example ping relies on ICMP to check the existence of an interface using the “echo” request and reply messages. ICMP is also used by traceroute to figure out all the stops from one node to another. This is done by setting the TTL (time to live) field in consecutive numbers and use the “destination unreachable” response as the TTL runs out.
Although ICMP is a useful protocol, it can also make a system vulnerable. For example, a successful ping reply is a confirmation to a would-be hacker that an IP address is live. Without the confirmation of ping, an automated attack system may decide to skip the IP address because port scanning an IP address takes significantly more time.
Furthermore, ICMP also makes certain exploitations possible. Although a Smurf attack is based on broadcast ICMP ping messages.
To check a Linux machine for ping response, execute the following command:
If the command responds with successful results, the machine is responding to ICMP ping messages. Successful results should look like the following:
You can also check with the traceroute command, execute the following command:
A successful result looks like the following:
To disable a Linux machine from responding to a ping request, append these lines in /etc/sysctl.conf:
Then, as root, execute the following command:
After this, check with the ping command again. It should appear to get stuck for some time. Type “control-C” to stop the program. The previous operation will stop a machine from responding to ICMP ping requests even after a reboot.
Stopping a machine from responding to traceroute requires a little more work. It will require the proper configuration of iptables. That will be discussed in another module. However, for the time being, you can use the following command (assuming eth0 is the network interface):
This change, however, is not persistant. After the system reboots, it will respond to traceroute probes again.