<story><title>Blacknurse – Low bandwidth ICMP firewall attack</title><url>http://blacknurse.dk/</url></story><parent_chain></parent_chain><comment><author>uiri</author><text>This is really old news. These kinds of attacks have been well documented for over a decade.[1] An ICMP type 3 code 3 or type 3 code 2 packet MUST be treated the same as a TCP Reset packet (per RFCs). You can also do blind performance degradation attacks with ICMP type 4 or type 3 code 4 packets. Thankfully, ICMP type 4 has been deprecated for a while now so those packets can be safely ignored.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.gont.com.ar&amp;#x2F;drafts&amp;#x2F;icmp-attacks-against-tcp.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.gont.com.ar&amp;#x2F;drafts&amp;#x2F;icmp-attacks-against-tcp.html&lt;/a&gt;</text></comment>
<story><title>Blacknurse – Low bandwidth ICMP firewall attack</title><url>http://blacknurse.dk/</url></story><parent_chain></parent_chain><comment><author>andy_ppp</author><text>To be honest I&amp;#x27;ve always been pretty amazed that the web doesn&amp;#x27;t fall apart much more easily than it actually does.&lt;p&gt;The fact is that most sites work only with some kind of caching in front of them at any scale; my guess would be on a site by site basis there will be a slow performing piece of code somewhere that can be exploited with low resources on the part of the attacker.&lt;p&gt;In a lot of cases, simply creating a session a couple of 100000 in a short enough space of time, would be enough to overload the majority of sites...</text></comment>