Does anyone pipe out ICMP to a null int as opposed to creating just a specific access list to block scans?

Just wondering what is the most preferred method.

__________________
Best Regards

Systems Administrator

Jay

CCNP, CCDA, MCSE
IEEE #41463614


Well informed people know it is impossible to transmit the voice over wires and that were it possible to do so, the thing would be of no practical value.
- Editorial in the Boston Post (1865)

Report this post to a moderator

I can't think of any time where I've used null interfaces to filter traffic instead of an ACL. An ACL is more granular and it's easier for me to do all my filtering in one place rather than send some traffic to null and filter the rest of the stuff I can't catch by rerouting it.
I think you'd have to be pushing a whole lot of packets to ever find an advantage using a null interface, but I've never taken the time to accurately measure.

MadChef

Report this post to a moderator

I was told that using a null int for ICMP could leave the individual with no echo response. <icmp protocol denied>

Therefore someone scans your network and echo's go to the big bit bucket in the sky.
That's the theory anyhow I have not yet tested it out.

__________________
Best Regards

Systems Administrator

Jay

CCNP, CCDA, MCSE
IEEE #41463614


Well informed people know it is impossible to transmit the voice over wires and that were it possible to do so, the thing would be of no practical value.
- Editorial in the Boston Post (1865)

Report this post to a moderator

quote:

---

Originally posted by Cobby

Therefore someone scans your network and echo's go to the big bit bucket in the sky.
That's the theory anyhow I have not yet tested it out.

---

Report this post to a moderator

Actually I was advised to do just that.
When I tried it our proprietary trading software bonked saying the trade server was offline.
Sorry I did not point that out earlier.

__________________
Best Regards

Systems Administrator

Jay

CCNP, CCDA, MCSE
IEEE #41463614


Well informed people know it is impossible to transmit the voice over wires and that were it possible to do so, the thing would be of no practical value.
- Editorial in the Boston Post (1865)

Report this post to a moderator

quote:

---

Originally posted by MadChef


Wouldn't you achieve the same result by not permitting icmp to leave your network?
Seems a lot easier than matching all icmp and setting the next hop as /dev/null.

MC

---

__________________
Silicon ... just fancy sand.

Report this post to a moderator

Yea!
That's the benefit of sending ICMP to null0.
The person scanning your network gets no response.
But I have only heard this in theory and have never tried it.
So I was seeking someone who had and could share their results.

I will implement this on a test router this weekend at work and post the config/acl and result.

I work for a trading company that is unoccupied on the weekend and could make good use of this security implementation.

__________________
Best Regards

Systems Administrator

Jay

CCNP, CCDA, MCSE
IEEE #41463614


Well informed people know it is impossible to transmit the voice over wires and that were it possible to do so, the thing would be of no practical value.
- Editorial in the Boston Post (1865)

Report this post to a moderator

The benefit of the null int is that the packets are dropped and there is no ICMP response.

Report this post to a moderator

quote:

---

Originally posted by doctorcisco


Just an off-the-wall question: If you kill off ICMP with an inbound access list, wouldn't the sender get back an "administratively denied" ICMP message?

---

Yes. And if you denied outbound like I said in my post, they wouldn't.

MC

Report this post to a moderator

Sheeesh its called "Black Hole security" ...it may go in but it can never come back.

__________________
Yeti the Inquisitive

MCNE, MCSE(NT4), MCSE 2000, SCO ACE, LCP, Compaq ASE, CCNA, CCIE Wannabe (part of the Wannabe Boffin Club).

www.yeti-gbr1.co.uk
www.ciscolabs.co.uk

Report this post to a moderator