Snort Forums Archive

Archive Home » Rules » How2 Block icmp requests

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

How2 Block icmp requests

Posted by havelino on March 16, 2005 05:22:13

Hi,

I’m trying to block all icmp requests (ping) so I wrote this rule:

Alert icmp $EXTERNAL_NET any <> $HOME_NET any (msg:’Ping activity’; itype:8; icode:0; sid:2000010;)

You can see it coming, it doesn’t detect anything when I ping the snort box.
Are the values of itype and icode good? Or am I forgetting something?

Hugo

Posted by nigel on March 17, 2005 04:11:47

First I have to say that ICMP is not a bad thing. It is normal and very useful in tracking down network issues. I do not recommend trying to stop ICMP requests and replies.

Now, here are the ICMP types and codes:

http://www.iana.org/assignments/icmp-parameters

Next, you really only need itype:8 for an echo request. There are plenty of icmp related rules, you should look at them and perhaps just use those rules if you really want to.

As I said before, blocking icmp is not that great an idea but if you really want to do it, use a firewall.

--
Nigel