Re: Compare pf with IPTables

> -----Original Message-----

Our network administrators block ICMP all over the place at my day job. The strut around and claim it is for "security". Fact is when a network problem crops up it takes hours to track them down and even longer for them to diagnose it without the basic tools that ICMP provide. Being able to ping a host is nice and helps find problems fast. ICMP host unreachable is also a much more meaningful answer than silence. Look up the different ICMP packets, what they mean and why you use them and many things will come clear.

We have yet to have a single "security" issue relating to ICMP. Denial of service attacks keep our network people pretty busy with no ICMP involved. All attacks have been against machines that could be found using DNS to locate their IP address. Hey there you go, get rid of DNS, ICMP and maybe ARP and you will have true security. Received on Sun Jan 5 11:17:11 2003