Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

That's why you discard ICMP errors.


If anything, that's why you discard ICMP port unreachable, which I assume you meant.

If you're blanket dropping all ICMP errors, you're breaking PMTUD. There's a special place reserved in hell for that.

(And if you're firewalling your ICMP, why aren't you firewalling TCP?)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: