Make your own free website on Tripod.com

ERIC BRUHN

Network Applications and Network Applications Lab

Chapter Four Notes

 

Other Chapter Notes:

[Chapter One]

[Chapter Two]

[Chapter Three]

[Chapter Four]

[Chapter Five]

[Chapter Six]

[NID Outline]

[Back to Notes]

[Home]

ICMP

  • ICMP Internet Control Message Protocol: Method of reporting error conditions and issuing and responding to simple requests.
  • ICMP Theory
    • Why do you need ICMP?
      • Ping uses it.
      • Provides a simple means of communicating between hosts or a router and a host to alert them to some kind of problem.
    • Where does ICMP fit in?
      • ICMP is in the same laver as IP.
      • ICMP is encapsulated in the IP datagram after the IP header.
    • Understanding ICMP
      • Has no port numbers like in TCP and UDP
      • ICMP is in the internet layer, TCP and UDP are in the transport layer.
      • For more ICMP information, go to www.iana.org/assignments/icmp-parameters.
      • ICMP gives no promise of the delivery of the message.
      • Almost every operating system will respond to ICMP requests, requires no listening ports or services.
      • Host uses ICMP for simple replies and requests and uses it to inform another host of some kind of error condition.
      • Routers also use ICMP to tell host of some kind of problem.
        • Might tell a host the destination host is unreachable.
  • Mapping Techniques
    • Initial step in reconnaissance attempts to discover the live hosts in a network
    • Attacker can then send an attack to a live host
    • If mapping is not done, then an attack can get very noisy and will not be very productive.
    • One of the most common methods of mapping is to issue ICMP echo requests.
      • A host then responds to an ICMP request with an ICMP echo reply that it is alive.
    • Many network administrators block ICMP echo requests.
    • Tireless Mapper
      • IDS usually does not issue alerts for individual ICMP echo requests.
      • Multiple requests from the same host would cause there to be an alert.
    • Clever Mapper

[Home] [Procedures] [Reading Notes] [Back to Top]

Questions or Comments? Click here to email me.