Hacker News Reader

I mean yeah, but who is letting unfiltered ICMP onto a production network?

What filters do you recommend? ICMP is pretty important and many networks have been broken by setting the wrong filters.

most firewalls limit ICMP across their boundaries, hence why ping doesn't work for a lot of places from the outside in.

This exploit is a unicast packet, which is unsolicited. For NAT, you probably don't need to do much. for ipv6 you'll need to make sure that your firewall doesn't blindly pass on ICMP ie make sure its a stateful firewall.

Reply on news.ycombinator.com