Hacker News Reader

> I do have to question disabling ICMP/ping

Ping is a tool I love, but it also allows a bad guy to discover your router with tracert. Disabling icmp/ping responses prevents that.

View on HN

That doesn’t get you anything. The bad guys assume every IP owned by an ISP has a customer router on it.

I recently installed fiber (IPv4 only via this ISP, :/). The moment I connected OPNsense I got all kind of connections on the usual suspect ports. The whole IPv4 address space is scanned within an hour.

This doesn't hold up for IPv6 though. This address space is so large, you can run SSH server on it without it ever getting scanned.

> Ping is a tool I love, but it also allows a bad guy to discover your router with tracert.

And?

So some random IP, which is already known to be in the range of a residential ISP (because of ARIN/RIPE/ASN records), is pingable. So what?

Reply on news.ycombinator.com