ICMP Flood attack

[DrJohnZoidberg]

Noticed just now that our office pfSense box was blocking a crapload of traffic, checked the firewall logs and noticed hundreds of ICMP requests. I don't allow ICMP pings to the network so they would have just been rejected but a ton of the IPs were being blocked totally anyway by pfBlocker.

Glad to see pfBlocker works so well:

I'm not such a network guru so is there anything else I should be concerned about?

 

[The_Unbeliever]

Nah. Usually they're trying to DDoS your box with ICMP pings.

If it get any worse, let your ISP know so that they can block the offending IP's on their equipment.

 

[Tinuva]

ICMP flood attacks are useless, it usually get throttled somewhere. A real hacker will use a botnet doing DNS reflection attack on UDP. UDP is best way to flood.

Besides, it is actually a bad thing to block ICMP. ICMP is used to diagnose problems. With IPv6 in fact, if you block it, you will lose connectivity, as it is used to configure the protocol as well.

 

[w1z4rd]

Hundreds or thousands of ICMP packets are not a flood. It is normal network activity.