IP traffic over ICMP tunneling
github.com
IP traffic over ICMP tunneling
1–10 of 86 posts
Re: IP traffic over ICMP tunneling
#2Now that's pretty amazing!
Re: IP traffic over ICMP tunneling
#3Not the first of its kind, just look-up in Wikipedia: https://en.wikipedia.org/wiki/ICMP_tunnel
Any captive portal these days block also ICMP.
Most firewalls block ICMP these days, because the days of blacklisting are over and ICMP is not the one who is getting white listed. Why?
The only way these days is to misuse DNS. But even that works less and less reliable.
Re: IP traffic over ICMP tunneling
#4Not the first of its kind, just look-up in Wikipedia: https://en.wikipedia.org/wiki/ICMP_tunnel Any captive portal these days block also ICMP. Most firewalls block ICMP these days, because the days of blacklisting are over and ICMP is not the one who is getting white listed. Why? The only way these days is to misuse DNS. But even that works less and less reliable.
I agree that some captive portals/firewalls do block ICMP but still I've seen many in my country which don't.
Re: IP traffic over ICMP tunneling
#5There are DNS tunneling apps which will (usually) get past those captive portals that block ICMP. It's just slower.
Re: IP traffic over ICMP tunneling
#6There are DNS tunneling apps which will (usually) get past those captive portals that block ICMP. It's just slower.
I have tested it. Internet speed difference is negligible. Yup DNS tunneling apps can also be used.
Re: IP traffic over ICMP tunneling
#7I use to restrict ICMP to echo/reply using -m icmp on iptables, but this uses just that kind of packets...
Is there anyway to stop things like this at the corporate firewall?
Re: IP traffic over ICMP tunneling
#8Not the first of its kind, just look-up in Wikipedia: https://en.wikipedia.org/wiki/ICMP_tunnel Any captive portal these days block also ICMP. Most firewalls block ICMP these days, because the days of blacklisting are over and ICMP is not the one who is getting white listed. Why? The only way these days is to misuse DNS. But even that works less and less reliable.
I agree that some captive portals/firewalls do block ICMP but still I've seen many in my country which don't.
Well the question is then what's the point other than a personal exercise?
There is plenty of ICMP / multi protocol tunnels software out there for both linux and windows much of it doesn't require administrative privileges.
Also ptunnel comes standard with some linux distro's these days Ubuntu and so do probably most of it's derivatives, and as far as raw performance goes ptunnel is also the highest performing one capable of achieving about 150kbps which isn't that bad considering the sheer amount of packets and overhead you get.
http://manpages.ubuntu.com/manpages/gutsy/man8/ptunnel.8.htm...
Re: IP traffic over ICMP tunneling
#9For anybody that's tried both - how do these compare to DNS tunnels (e.g. iodine), in terms of speed and reliability?
Re: IP traffic over ICMP tunneling
#10I use to restrict ICMP to echo/reply using -m icmp on iptables, but this uses just that kind of packets... Is there anyway to stop things like this at the corporate firewall?
Yes. In my opinion they should restrict the payload size of an ICMP message. Blocking all echo/reply can have adverse impact on other applications as well.