On Friday 28 July 2006 06:15, User Freebsd wrote: > Two part question here ... > > first part ... is there a way of just disabling icmp by setting a sysctl, > so that a server just doesn't respond to them?
No. You can do this using the firewall of your choice ipfw example ipfw add deny icmp from any to any ipfw add allow ip from any to any (not much intelligence in these rules, but this is what you asked for) keep in my mind that ipfw blocks everything by default (**you will be locked out of the box**) so do this locally or follow the instructions in the manual on how to load the ipfw kernel module. There are some things you can do with sysctls and ICMP: [EMAIL PROTECTED]:0:~# sysctl -d net.inet.icmp net.inet.icmp: ICMP net.inet.icmp.maskrepl: Reply to ICMP Address Mask Request packets. net.inet.icmp.stats: net.inet.icmp.icmplim: Maximum number of ICMP responses per second net.inet.icmp.maskfake: Fake reply to ICMP Address Mask Request packets. net.inet.icmp.drop_redirect: Ignore ICMP redirects net.inet.icmp.log_redirect: Log ICMP redirects to the console net.inet.icmp.icmplim_output: Enable rate limiting of ICMP responses net.inet.icmp.reply_src: icmp reply source for non-local packets. net.inet.icmp.reply_from_interface: ICMP reply from incoming interface for non-local packets net.inet.icmp.quotelen: Number of bytes from original packet to quote in ICMP reply net.inet.icmp.bmcastecho: _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
