Ping O' Death and iptables

Question

Is there a simple rule that can be written to stop a ping o' death with iptables?

Answer 1

Most modern operating systems are immune to the "ping-of-death" attack. From the IPCHAINS HOWTO (http://www.linux.org/docs/ldp/howto/IPCHAINS-HOWTO-5.html):

5.3 Filtering out Ping of Death

Linux boxes are now immune to the famous Ping of Death, which involves sending an illegally-large ICMP packet which overflows buffers in the TCP stack on the receiver and causes havoc.

If you are protecting boxes which might be vulnerable, you could simply block ICMP fragments. Normal ICMP packets aren't large enough to require fragmentation, so you won't break anything except big pings. I have heard (unconfirmed) reports that some systems required only the last fragment of an oversize ICMP packet to corrupt them, so blocking only the first fragment is not recommended.

You could drop icmp fragments with something like this:

iptables -A FORWARD -p icmp -f -j DROP

But again, unless you're trying to protect some really old equipment, this is all probably unnecessary.

Answer 2

AFAIK "ping of death" is an old attack and does affect new systems. Have a look at this link (last section).