ICMP Land Attack

ICMP Land Attack

[Manish Jain]

Hello,

We are experiencing ICMP Land Attach (ICMP packet with [source ip = dest ip]
&& [source mac == dest mac]).

Do we have any standard mechanism to counter this attach using
iptable/ipsets? Or any other suggestion?

Whether it is possible to write iptable rule saying "source ip == dest ip"
instead of specifying hard-coded values? 

Any pointers will be appreciated.

Best Regards,
Manish Jain

Re: ICMP Land Attack

[Cedric Blancher]

Le lundi 09 avril 2007 à 17:23 +0530, Manish Jain a écrit :
> We are experiencing ICMP Land Attach (ICMP packet with [source ip = dest ip]
> && [source mac == dest mac]).
> Do we have any standard mechanism to counter this attach using
> iptable/ipsets? Or any other suggestion?

Activate Reverse Path Filtering that checks if incoming interface is
consistent to routing table, and drops it if not:

for i in /proc/sys/net/ipv4/conf/*/rp_filter; do
	echo 1 > $i;
done

Don't forget to activate martians logging to see them in your logs:

for i in /proc/sys/net/ipv4/conf/*/log_martians; do
	echo 1 > $i;
done


In addition to this, when a packet reaching a Linux box comes from one
of its own IP address and is received on an external interface, it is
silently dropped.


-- 
http://sid.rstack.org/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!

Re: ICMP Land Attack

[Henrik Nordstrom]

[-- Attachment #1: Type: text/plain, Size: 362 bytes --]

mån 2007-04-09 klockan 17:23 +0530 skrev Manish Jain:

> Whether it is possible to write iptable rule saying "source ip == dest ip"
> instead of specifying hard-coded values? 

A quite trivial custom match to write if not supported by any of the
existing matches..

The addrtype match is a reasonable complex template to start from.

Regards
Henrik

[-- Attachment #2: Detta är en digitalt signerad meddelandedel --]
[-- Type: application/pgp-signature, Size: 307 bytes --]

Re: ICMP Land Attack

[Jan Engelhardt]

On Apr 9 2007 17:23, Manish Jain wrote:
>Hello,
>
>We are experiencing ICMP Land Attach (ICMP packet with [source ip = dest ip]
>&& [source mac == dest mac]).

If the source mac == the dest mac, then the evil sender is right at your
network, just one hop away. Kill him.


Jan
--