Live data from Hacker News

TCP connection timeout mystery

devnonsense.com

81–83 of 83 posts

Re: TCP connection timeout mystery

#81
post #43

Earlier quoted context omitted.

ICMP (the protocol ping uses) is a totally separate protocol from TCP and UDP. Blocking ICMP can break of lot of things and offers no real benefits outside of a handful of specific edge cases. BTW your assumption "a successful ICMP ping = TCP and UDP work" is an extremely common one that I too had before I was taught otherwise.

> Blocking ICMP can break of lot of things and offers no real benefits outside of a handful of specific edge cases. Are you referring to local networks only? It's very common to not allow ICMP by defaul to workloads in the cloud, e.g. in AWS.

Fragmented packets won't work without ICMP.

Edit: here's a good page about the effects of disabling ICMP: https://www.rimscout.com/why-you-should-not-block-icmp/

Also there's some blackhole detection or how is it called.

However it's OK to block _parts_ of the ICMP protocol for security reasons, like echo and reply.

Re: TCP connection timeout mystery

#83
post #32

Earlier quoted context omitted.

Yeah, this was my immediate thought, someone has made the 169.254 block too large somewhere.

They should go to http://169.150.211.2 and see if that gets blocked. I get a "Welcome to nginx!" page there.

That's weird. I get nothing there.
Post reply on HN