Which ICMP message type should be stopped inbound?

Question

BlackTom AI · Accepted Answer

ICMP echo (ICMP type 8) is the ping request and should be blocked inbound.

1) Relevant knowledge points and concepts
- ICMP message types: echo request (type 8), echo reply (type 0), destination unreachable (type 3), source quench (type 4).
- Firewall direction: "inbound" means packets initiated from external hosts toward internal hosts.
- Security best practice: block unsolicited probes from the internet (e.g., ping requests) to reduce reconnaissance and DoS risk; allow return traffic for connections you initiated.

2) Step-by-step reasoning
- An inbound ICMP echo is an external host sending a ping request to an internal host.
- If allowed, the internal host will respond with an echo-reply, revealing presence and allowing network scans (ping sweeps) and enabling some DDoS/ping-flood attacks.
- Blocking inbound echo requests prevents outsiders from easily discovering and probing internal hosts.
- If an internal host initiates a ping to the outside, the corresponding echo-reply inbound should be allowed (or stateful firewall will permit it) so legitimate diagnoses work.

3) Intermediate points (no numeric calculations required)
- ICMP echo = ping request (type 8).
- Echo-reply = response (type 0) and is normally permitted inbound only as a reply to an outbound request.
- Destination unreachable provides useful diagnostic information (path/host reachability).
- Source quench is deprecated and should not be relied on, but it is not the primary inbound risk compared to echo requests.

4) Why the correct answer is correct
- Stopping inbound ICMP echo (ping requests) directly prevents external reconnaissance and reduces exposure to ping-based attacks while preserving necessary outbound troubleshooting and stateful replies. Therefore, the ICMP type to stop inbound is echo (type 8).

5) Why other options are incorrect
- Source quench: deprecated; not the main inbound threat and modern systems ignore it.
- Echo-reply: blocking inbound replies would break legitimate responses to pings you initiated; you usually allow replies or rely on stateful tracking.
- Unreachable: used for network diagnostics and path/MTU discovery; blocking it can cause connectivity and troubleshooting problems.

6) Conclusion
Blocking ICMP echo (ping request) inbound is the correct action. This matches the provided answer: "echo".

Which ICMP message type should be stopped inbound?单项选择题

类似问题

Traceroute: Use the file icmp-ethereal-trace-2.pcap to answer the questions Examine the ICMP echo packet, is this different from the ICMP ping query packets in the icmp-ethereal-trace-1.pcap? [ Select ] No Yes The ICMP echo packet has the same fields as the ping query packets. [ Select ] True False

What was the world's first widely adopted biodiversity policy?

The aim of the Paris Agreement is to ensure that the earth’s preindustrial temperature is not exceeded by more than º Celsius.

The IPCC's mission is to Blank ______.

Why have most international agreements for environmental protection been based on the honor system?

As was exhibited with the Montreal Protocol and the encouragement of reduced CFC production, trade can be an effective tool to compel compliance with international treaties.

The Stockholm Declaration and UNEP were the result of the Blank ______ first conference on the Human Environment in 1972.

In addition to the direct mission of the Convention on International Trade in Endangered Species (CITES), why was CITES so important?

更多留学生实用工具

智能学习助手

风格化写作助手

论文查重助手

文献引用助手

课堂转译助手

课堂笔记助手

Quiz搜索助手

学校历年真题

智能刷题助手

智能匹配练习

希望你的学习变得更简单