I'm interested in a particular ICMP packet which seems to change the client / servers MTU size. The scenario is like this client----------->Router-vpn-vpn-vpn-vpn-vpn-Router --------------->Firewall ------------->Server - Client initiates a connection with the server and starts to transmit data. - Router places its ESP header on the packets coming from the server which brings the MTU over the maximum size - Router sends the following packet back to the server icmp: 172.*.*.* unreachable - need to frag (mtu 1454) - ICMP packet from the router gets blocked by the firewall and the connection is eventually lost as the router cannot handle this MTU size. but If the Firewall permits the ICMP packet from the router through to the server, the server will lower its MTU and continue the connection. So my question is , Can this be used as a denial of service attack to continually send these ICMP packets to a server to confuse it or bring it down. Anybody had any experience with this or know any tools which can generate these ICMP reachable packets ? Regards, Steve Culligan _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp ---------------------------------------------------------------------------- This list is provided by the SecurityFocus Security Intelligence Alert (SIA) Service. For more information on SecurityFocus' SIA service which automatically alerts you to the latest security vulnerabilities please see: https://alerts.securityfocus.com/
This archive was generated by hypermail 2b30 : Fri Oct 26 2001 - 14:23:45 PDT