"broadcast ping" message

[Larry Rosenman]

--On Wednesday, April 16, 2003 10:58:20 -0700 John Polstra 
<jdp at polstra.com> wrote:

> In article <20030416105033.H46401-100000 at moo.sysabend.org>,
> Jamie Bowden  <ragnar at sysabend.org> wrote:
>> On Wed, 16 Apr 2003, John Polstra wrote:
>>
>> > To make a FreeBSD system respond to broadcast pings, you have to set
>> > the sysctl variable net.inet.icmp.bmcastecho to 1.
>>
>> Shouldn't the default be to DTRT and respond unless disabled?  Until now,
>> the only systems on my network that didn't respond to broadcast pings
>> were my windows boxes, but I consider them broken by default.  Why has
>> the default behavior changed, and isn't this a POLA issue?
>
> It was changed for security reasons.  Responding to broadcast pings
> creates several potential denial of service attacks.
It's also against current best practices for ISP's.  Even Cisco changed the 
routers
to NOT respond to directed-broadcast by default.

The RFC was NOT written for today's internet.

Larry Rosenman
Sr. Network Engineer
Dallas, TX

-- 
Larry Rosenman                     http://www.lerctr.org/~ler
Phone: +1 972-414-9812                 E-Mail: ler at lerctr.org
US Mail: 1905 Steamboat Springs Drive, Garland, TX 75044-6749