ShinCat
asked on
Cisco Pix Firewall Logs
Hey all,
I have a quick question. I am notcing A LOT of ICMP deny request on my external interface on my router.
Should I be concerned?
here is a portion of the log
Deny inbound icmp src outside 63.214.225.229 dst inside 63.x.x.x (type 8, Code 0)
I have a quick question. I am notcing A LOT of ICMP deny request on my external interface on my router.
Should I be concerned?
here is a portion of the log
Deny inbound icmp src outside 63.214.225.229 dst inside 63.x.x.x (type 8, Code 0)
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
surely ur concern, beside a security threat ... such icmp attacks are utilizing your cpu as well as memory resources ... i 'll recommend you to monitor your internal network for the same ...
there are two types of icmp packets ...
- echo: Request ... (ping)
- echo-reply: Response in result of Request ... (ping response)
permit icmp only from recognized sources and for specific destinations destinations ... if necessary ... otherwise block icmp along with other vulnerable ports (i.e. netbios, etc)
worm could be ...
- http://vil.nai.com/vil/content/v_100559.htm
probably the worm could be nachi ... check out more about it ...
- www.sans.org/rr/papers/60/477.pdf
hope this stuff is useful for you ...
Regards,
Sheeraz Ahmed
Type 8 Code 0 Echo Request (ping) - means it sends you a packet, which should be directly replyed by/with a: echo reply
Agree, nothing to worry about unless you start seeing a pattern.
Sheeraz,
Probably the most well known ICMP packets are "echo request" and "echo reply", but there is a lot more than 2 types of ICMP packets.
http://www.iana.org/assignments/icmp-parameters
Sheeraz,
Probably the most well known ICMP packets are "echo request" and "echo reply", but there is a lot more than 2 types of ICMP packets.
http://www.iana.org/assignments/icmp-parameters
thanks for the correction ... yes there are icmp packet types each with its own format ...
like ...
0 - Echo Reply
3 - Destination Unreachable
4 - Source Quench
5 - Redirect (Change Route)
8 - Echo Request
11 - Time Exceeded
12 - Parameter Problem in Datagram
14 - Timestamp Request
shincat you can see the description of 0 and 8 here ... NicBrey, most of the time i have met the same echo attacks ...
ASKER
lrMoore
You are the Cisco Ninja!
Are you a CCIE? I want to thank you for all your past help you have given me. In fact I think all the past help you have given me has been all Cisco help.
If you are anywhere near Atlanta Georgia there is a steak dinner waiting for you.
You are truely a professional above and beyond.
You are the Cisco Ninja!
Are you a CCIE? I want to thank you for all your past help you have given me. In fact I think all the past help you have given me has been all Cisco help.
If you are anywhere near Atlanta Georgia there is a steak dinner waiting for you.
You are truely a professional above and beyond.
ASKER
To all the others who replied I want to thank you also.
All your answers were helpful and it adds value to this thread, but it was lrmoore who responded first in a timely fashion.
Scotty_Cisco you responded at the same time bu lrmoore was faster.
I thank you also. I hope in the future I can award you some points also.
All your answers were helpful and it adds value to this thread, but it was lrmoore who responded first in a timely fashion.
Scotty_Cisco you responded at the same time bu lrmoore was faster.
I thank you also. I hope in the future I can award you some points also.
Not CCIE yet. Passed the written, waiting to take the PE.
I'm not too far from Atlanta, in AL. I go through the ATL airport all the time, though.
There's a saying here: "when you die and go to heaven - you're going through Atlanta"
I'm not too far from Atlanta, in AL. I go through the ATL airport all the time, though.
There's a saying here: "when you die and go to heaven - you're going through Atlanta"
This is pretty normal if you are denying ICMP traffic and given that many people will do a ping sweep of an entire subnet before they run port scans you could see a deny for every attempt accross your address range. I would not worry that much about it unless there are a large number comming from the same source (say 100 or so an hour).
Thanks
Scott