Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IP traffic over ICMP tunneling

github.com

Post reply on HN
Print view View original

31–40 of 86 posts

Re: IP traffic over ICMP tunneling

#31

Post by dogma1138 »

vampire_dk wrote: post #29
vampire_dk wrote: post #24

Earlier quoted context omitted.

With even ICMP you can send/receive large messages. There is no restriction on the maximum payload length.

Normally, an ethernet or wifi restricts an MTU of 1500. I use ping packets accordingly

1500 is the MTU of Ethernet, it's often not sustainable on end to end connection (especially when you add frame overheads) if you are using that high of a payload size you'll get considerably worse performance than say limiting it to around 500 bytes, you are welcomed to try it. Also with how global traffic is managed smaller packets tend to get priority since they can be qued quicker backbone connectivity uses much bigger frames than Ethernet so more often than not generating more smaller packets would increase your overall throughput (to a limit) unless you are on a very controlled network.

Re: IP traffic over ICMP tunneling

#33

Post by vampire_dk »

dogma1138 wrote: post #31
vampire_dk wrote: post #29

Earlier quoted context omitted.

Normally, an ethernet or wifi restricts an MTU of 1500. I use ping packets accordingly

1500 is the MTU of Ethernet, it's often not sustainable on end to end connection (especially when you add frame overheads) if you are using that high of a payload size you'll get considerably worse performance than say limiting it to around 500 bytes, you are welcomed to try it. Also with how global traffic is managed smaller packets tend to get priority since they can be qued quicker backbone connectivity uses much…

Thanks I'll look into this :)

Re: IP traffic over ICMP tunneling

#34

Post by jacquesm »

toast0 wrote: post #30
jacquesm wrote: post #14

Earlier quoted context omitted.

A couple of million small packets in a short timeframe will still eat up your resources. If an application needs ICMP echo to pass transparently through your firewall then you should probably review your need for that application, you're one step away from becoming a partner in someone else's amplification attack.

ICMP echo isn't amplification, as long as you don't respond to multicast/broadcast addresses. It's still 1:1 reflection, so you probably want to rate limit if it's simple (FreeBSD and Linux come out of the box with sane default rate limits).

It is amplification if you allow the packets through transparently because all the hosts behind your firewall will respond if you send an echo request to the broadcast address.

So you're going to have to do a little bit more configuration than just allow a maximum packet size if you're going to allow ICMP to transit at all you should also limit the allowed set of addresses (you should do that regardless, but echo can be used for amplification requests by virtue of the broadcast feature of the IP protocol). Hence the 'one step away'.

This was known as the 'smurf' attack. Fortunately this is now mostly a thing of the past. But poking holes in your firewall for ICMP is a delicate affair.

Re: IP traffic over ICMP tunneling

#35

Post by toast0 »

jacquesm wrote: post #34
toast0 wrote: post #30

Earlier quoted context omitted.

ICMP echo isn't amplification, as long as you don't respond to multicast/broadcast addresses. It's still 1:1 reflection, so you probably want to rate limit if it's simple (FreeBSD and Linux come out of the box with sane default rate limits).

It is amplification if you allow the packets through transparently because all the hosts behind your firewall will respond if you send an echo request to the broadcast address. So you're going to have to do a little bit more configuration than just allow a maximum packet size if you're going to allow ICMP to transit at all you should also limit the allowed set of addresses (you should do that regardless, but echo can…

Sorry, I had lost the context that it was a network firewall (not a host firewall), and missed the 'one step away' as well.

Re: IP traffic over ICMP tunneling

#38

Post by theptip »

dogma1138 wrote: post #31
vampire_dk wrote: post #29

Earlier quoted context omitted.

Normally, an ethernet or wifi restricts an MTU of 1500. I use ping packets accordingly

1500 is the MTU of Ethernet, it's often not sustainable on end to end connection (especially when you add frame overheads) if you are using that high of a payload size you'll get considerably worse performance than say limiting it to around 500 bytes, you are welcomed to try it. Also with how global traffic is managed smaller packets tend to get priority since they can be qued quicker backbone connectivity uses much…

What do you mean by "it's often not sustainable"? Throughput on a server is higher at higher packet size, so if you're doing a download I'd expect the server to send 1500 byte packets. It's pretty easy to saturate a link with 1500 byte packets, and it's much harder to do so at lower packet sizes (from the server's perspective) since the per-packet processing costs start to dominate over the per-byte costs. Admittedly my knowledge of this sort of stuff is mostly intra-DC; is there some other factor that you're referring to that supersedes this on the web?

I'm not aware of prioritizing smaller packets on the backbone, sounds like something that would be targeted at small flows (i.e. first N packets in a flow get a priority bump)? More info on that would be appreciated.

Re: IP traffic over ICMP tunneling

#39

Post by jacquesm »

toast0 wrote: post #35
jacquesm wrote: post #34

Earlier quoted context omitted.

It is amplification if you allow the packets through transparently because all the hosts behind your firewall will respond if you send an echo request to the broadcast address. So you're going to have to do a little bit more configuration than just allow a maximum packet size if you're going to allow ICMP to transit at all you should also limit the allowed set of addresses (you should do that regardless, but echo can…

Sorry, I had lost the context that it was a network firewall (not a host firewall), and missed the 'one step away' as well.

Ah ok. It was only a one line context switch so that was an easy mistake to make.

Re: IP traffic over ICMP tunneling

#40

Post by redwards510 »

NetStrikeForce wrote: post #26

SoftEther, a multi platform and open-source software supports ICMP and DNS tunnelling among other things (SSL, OpenVPN, IPsec, etc) http://www.softether.org

After reading the product page, this product seems too good to be true (OSS, supports every OS and every type of VPN). Is there some kind of catch? How come I've never heard of it until now?
Post reply on HN