When hosts use a non-optimal or defunct route to a particular destination, an ICMP redirect packet is used by routers to inform the hosts what the correct route should be. If an attacker is able to forge ICMP redirect packets, he or she can alter the routing tables on the host and possibly subvert the security of the host by causing traffic to flow via a path you didn't intend. It's strongly recommended to disable ICMP Redirect Acceptance to protect your server from this hole.
IP unreachable messages can be used to map out the network topology, and they should be disabled on all interfaces.
disable proxy arp: YOUR CHOICE
********************
Pros of leaving it on: devices with incorrect subnet masks and/or
gateways can still function. Those with incorrect subnet masks probably
have a portion of the Internet that's invisible, but are otherwise
functioning.
Pros of turning it off: devices with incorrect subnet masks and/or
gateways will be exposed.
********************
source routing is often abused by malicious users on
the Internet (and elsewhere), and used to make a machine (A), think
it is talking to a different machine (B), when it is really talking to
a third machine (C). This means that C has control over B's ip address
for some purposes. So always disable it.
Main Topics
Browse All Topics
by: donjohnstonPosted on 2009-11-03 at 06:45:58ID: 25729396
They allow someone to discover things about your network that otherwise are only useful for troubleshooting.