Re: [v6ops] ICMP rate-limiting in draft-ietf-v6ops-ipv6rtr-reqs-00

[Simon Hobson <[e-mail]>]

"Alvarez, Pablo" <[e-mail]> wrote:

> Finally, I have a concern about the second bullet in paragraph 5.4. The current draft states:
> 
> o  SHOULD filter ICMP echo and echo response by default, to prevent 
>    the discovery of reachable hosts and topology. 
> 
> 
> This recommendation is quite strong, and is presented without further discussion or justification. I am interested in the justification for this, and its value as compared to the cost to researchers, CDNs, network operators and others who benefit from being able to better understand network topology (and who can provide better service to end users with that understanding). In fact, paragraph 4.2 of the current draft emphasizes the importance of being able to visualize and understand network topology.

It does seem odd, and it's been a bugbear of mine (with my work hat on) that basic troubleshooting should be so hampered by people who think that filtering ICMP Echo endows some sort of security. I liken it to someone removing the house number from the front of the house as though not having it visible somehow protects from burglars.