Which ICMP message type should be stopped inbound?

Question

BlackTom AI · Accepted Answer

ICMP echo (ICMP type 8) is the ping request and should be blocked inbound.

1) Relevant knowledge points and concepts
- ICMP message types: echo request (type 8), echo reply (type 0), destination unreachable (type 3), source quench (type 4).
- Firewall direction: "inbound" means packets initiated from external hosts toward internal hosts.
- Security best practice: block unsolicited probes from the internet (e.g., ping requests) to reduce reconnaissance and DoS risk; allow return traffic for connections you initiated.

2) Step-by-step reasoning
- An inbound ICMP echo is an external host sending a ping request to an internal host.
- If allowed, the internal host will respond with an echo-reply, revealing presence and allowing network scans (ping sweeps) and enabling some DDoS/ping-flood attacks.
- Blocking inbound echo requests prevents outsiders from easily discovering and probing internal hosts.
- If an internal host initiates a ping to the outside, the corresponding echo-reply inbound should be allowed (or stateful firewall will permit it) so legitimate diagnoses work.

3) Intermediate points (no numeric calculations required)
- ICMP echo = ping request (type 8).
- Echo-reply = response (type 0) and is normally permitted inbound only as a reply to an outbound request.
- Destination unreachable provides useful diagnostic information (path/host reachability).
- Source quench is deprecated and should not be relied on, but it is not the primary inbound risk compared to echo requests.

4) Why the correct answer is correct
- Stopping inbound ICMP echo (ping requests) directly prevents external reconnaissance and reduces exposure to ping-based attacks while preserving necessary outbound troubleshooting and stateful replies. Therefore, the ICMP type to stop inbound is echo (type 8).

5) Why other options are incorrect
- Source quench: deprecated; not the main inbound threat and modern systems ignore it.
- Echo-reply: blocking inbound replies would break legitimate responses to pings you initiated; you usually allow replies or rely on stateful tracking.
- Unreachable: used for network diagnostics and path/MTU discovery; blocking it can cause connectivity and troubleshooting problems.

6) Conclusion
Blocking ICMP echo (ping request) inbound is the correct action. This matches the provided answer: "echo".

Which ICMP message type should be stopped inbound?单项选择题

类似问题

Traceroute: Use the file icmp-ethereal-trace-2.pcap to answer the questions Examine the ICMP echo packet, is this different from the ICMP ping query packets in the icmp-ethereal-trace-1.pcap? [ Select ] No Yes The ICMP echo packet has the same fields as the ping query packets. [ Select ] True False

Is the following statement true or false? In the products of methylation-hydrolysis, every -OH group corresponds to the position of a glycosidic bond in the starting polysaccharide.

Which of the follwoing structures represents amylopectin?

Which of the following is true about an aldopentose?I. It is a monosaccharide.II. It contains a CHO groupIII. It is a disaccharide.IV. It is an oligosaccharide.

For stock A, we have 𝛽 𝑖 = 0.70. Suppose the expected market risk premium next year is 9% and the risk-free rate is 3%. What is the expected return of this stock based on the CAPM? (Please answer in % and round to 2 decimal places. If the answer is 8.057%, then in the box, write 8.06)

更多留学生实用工具

智能学习助手

风格化写作助手

论文查重助手

文献引用助手

课堂转译助手

课堂笔记助手

Quiz搜索助手

学校历年真题

智能刷题助手

智能匹配练习

希望你的学习变得更简单