[NANOG] Limiting ICMP

[kgasso-lists at visp.net (Kameron Gasso)]

Drew Weaver wrote:
> (do people still DDoS with ICMP these days? I see a lot of what looks like udp.pl and hardly any ICMP attack traffic anymore)

We saw a small attempted attack using ICMP a few weeks ago, but as 
you've mentioned I've mostly been seeing UDP floods (and the occasional 
TCP SYNflood still).

I do feel the need to comment that more and more lately I've been 
running into extremely frustrating situations where useful ICMP and UDP 
traffic was being filtered bidirectionally, not just rate-limited.  I 
think my favorite incident so far of this was a host that returned an 
ICMP UNREACHABLE (with a "filtered" code) in response to an ECHO REQUEST 
to itself.

Cheers,

--Kameron