Great Circle Associates Firewalls
(November 1996)
 

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: Re: Killer Pings: sanity check
From: peter . maersk-moller @ jrc . it (Peter Maersk-Moller)
Date: Fri, 15 Nov 1996 09:46:00 +0100
To: firewalls @ greatcircle . com, uhaas @ tsg-usa . com

Hi Urban !

> Just performing a sanity check. The "Killer Ping", "Ping o' Death" whatever
> is only a concern from hosts on the SAME network, right? Once the packet
> goes through a router it gets fragmented and re-assembled, right? Does re-
> assembly still cause the machine to crash?

Yes, it will crash. It is not the individual packet which is the problem.
It is all packets which together form a deadly ICMP. However its not
only the ICMP which gives you this problem, but probably most protocols.

The only fix possible is to get it right at the kernel level for
the TCP/IP.

No simple device (like a gateway) can remove the problem by doing sanity
check. To do that it would have to keep track of all packets in all
connections. This is not feasable without using a lot of both RAM
and processing power. Worst of all, it will introduce unacceptable latency.

Regards

Peter Maersk-Moller

<PRE>
--- Any opinion or statements below will be of my own and not the JRC ---

Peter Maersk-Moller
Network Manager
                                 ---
TP441					Email : peter .
 maersk-moller @
 jrc .
 it
Space Applications Institute		Phone : +39 (0)332 785820
Joint Research Center                   Fax   : +39 (0)332 785461
I-21020 Ispra (VA)                      Priv. : +39 (0)332 647256
Italy                                   DK    : +45 38882869
                                        NICHDL: PMM2-RIPE, PM13-RIPE
                                 \|||/  CoolTalk : pmm @
 ceo0912 .
 jrc .
 it
                                 (. .)
+-----------------------------ooO-(_)-Ooo--------------------------------+
|   __   _                                                               |
|  / /  (_)__  __ ____  __                                               |
| / /__/ / _ \/ // /\ \/ /  . . .  t h e   c h o i c e   o f   a         |
|/____/_/_//_/\___/ /_/\_\              G N U   g e n e r a t i o n . . .|
|                                                                        |
+------------------------------------------------------------------------+
                                 || ||
                                ooO Ooo
</PRE>


Indexed By Date Previous: Re: InfoSec organization
From: Dave Kinchlea <security @ kinch . ark . com>
Next: PC Death
From: peter . maersk-moller @ jrc . it (Peter Maersk-Moller)
Indexed By Thread Previous: Re: Killer Pings: sanity check
From: Geoff Mulligan <geoff @ mulligan . com>
Next: Re: Killer Pings: sanity check
From: Frank Willoughby <frankw @ in . net>

Google
 
Search Internet Search www.greatcircle.com