Shared publicly  - 
Ping response insider joke: "Thank you, your ping request will be processed and considered returned by next Tuesday."

Idly dons her pocket protector and thick-rimmed glasses~
Kent Morrison's profile photoMaya Posch's profile photoDerric Atzrott's profile photoDiane Bruce's profile photo
Your request got lost in the office somewhere. I heard one of the couriers dropped it.
I'm sorry, but since the advent of incessant cold sales calls, our external interface is set to refuse ICMP traffic.
Please send us a hand written note, closed with sealing wax, if you'd like a response.
I'm pretty sure that dropping ICMP traffic is standard procedure these days, even for SOHO routers. They all seem to drop it on the NAT/firewall side at least.
I prefer to let it through my router ACLs personally, but I definitely have it dropped when it hits a firewall or NATing device.

ICMP is very useful, so unless it needs to be dropped for security reasons, I prefer to let it do its thing.
PMTU is Path MTU discovery, you break it if you block all ICMP. Please, please please do not do that.

"By blocking all ICMPs the administrator himself interferes withservice on and from his own network. Unless he also turns off path MTU discovery on his network's servers, he makes his servers unusable by users with reduced-MTU links in their paths. Because service is affected only in relatively unusual cases, it can be difficult to convince the administrator that a problem exists. The prevalence of such "unusual" cases is growing rapidly though."

Don't do this. I've seen it happen numerous times.
Well, with everyone turning ICMP I guess brokenness is the norm, then :)
I feel like I've seen those sorts of unusual cases before....

I block ICMP between my wired and wireless networks at the office.
+Derric Atzrott You can choose to block ICMP echo and echo reply instead of blocking all ICMP. But you should not be blocking all ICMP.

pass in quick on $ExtIf inet proto icmp all icmp-type 3 code 4 keep state
Add a comment...