ICMP Fragmetation 공격

ICMP Fragmetation 공격

Fragmented ICMP

While they can occur, fragmented ICMP packets are usually not seen, except in conditions which could be labeled as “malicious”. It is advised to drop these packets completely, even before further analysing them using regular access lists.
Example access-lists [back]

Cisco IOS

Access-list 101 (to be applied to the external interface)
access-list 101 deny icmp any any fragments
access-list 101 permit icmp any any echo-reply
access-list 101 permit icmp any any time-exceeded
access-list 101 permit icmp any any packet-too-big
access-list 101 deny icmp any any

Access-list 102 (to be applied to the internal interface)
access-list 102 deny icmp any any fragments
access-list 102 permit icmp any any echo-request
access-list 102 permit icmp any any time-exceeded
access-list 102 permit icmp any any packet-too-big
access-list 102 deny icmp any any

Linux iptables

iptables -A INPUT -p icmp --fragment -j DROP
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT

iptables -A INPUT -p icmp --icmp-type fragmentation-needed -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type time-exceeded -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type fragmentation -needed -j ACCEPT
iptables -A INPUT -p ICMP -j DROP
iptables -A OUTPUT -p ICMP -j DROP

공격 및 방어
http://light99.egloos.com/5220504

https://www.linux.co.kr/security/certcc/IP%20Fragmentation.htm

http://devdev.tistory.com/63