Best way to filter "Nachi pings"?

[David G. Andersen]

Brett Glass just mooed:
> At 03:17 AM 10/27/2003, Jarkko Santala wrote:
> 
> >Blocking
> >all ping packets to improve security is nothing more than security through
> >obscurity. It may hide your system against the simplest ping probes, but
> >it does nothing to improve security as such.
> 
> In our case, there's a more compelling reason.
> 
> Some of our customers' system administrators have utilities
> which ping their servers from their home Internet connections
> to make sure everything's working. If I were to block pings,
> all of these guys' (and gals') pagers and cell phones would go 
> off at once. I'd be beseiged with demands to remove the block 
> immediately.

  Rate-limit them with dummynet on somewhat selective per-subnet
basis.  It's not perfect, and increases the latency perceived by
customers running ping, but it helps a lot compared to doing 
nothing.

  -dave

-- 
work: dga at lcs.mit.edu                          me:  dga at pobox.com
      MIT Laboratory for Computer Science           http://www.angio.net/
      I do not accept unsolicited commercial email.  Do not spam me.