Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am setting up firewall with iptables on my host. I want to disable timestamp ICMP request, but it's wired, I only allows type 8 (echo-request) comes into host, but event still, I can get timestamp from my host

64 bytes from xxxxxxxxx: icmp_seq=2 ttl=61 time=2.56 ms
TS:     36654775 absolute
        -6423
        3
        1
        -4
        0
        4
        0
        -2
Unrecorded hops: 1

I try to allow type 8 only, but it doesn't work, it appears that all I can do is to let all ICMP requests pass, or deny all of them, following is the configuration script I'm using.

iptables -F
iptables -X
iptables -Z
iptables -P INPUT   DROP
iptables -P OUTPUT  ACCEPT
iptables -P FORWARD ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED -j ACCEPT

# allow the icmp
iptables -I INPUT -p icmp --icmp-type 8 -j ACCEPT

# services
iptables -A INPUT -p TCP --dport 22 -j ACCEPT # SSH
iptables -A INPUT -p UDP --sport 53 -j ACCEPT # DNS
iptables -A INPUT -p TCP --sport 53 -j ACCEPT # DNS
iptables -A INPUT -p TCP --dport 80 -j ACCEPT # HTTP
iptables -A INPUT -p TCP --dport 443  -j ACCEPT   # HTTPS

# allow the replay from outgoing established connection
iptables -A INPUT -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT

The version of Linux kernel is 2.6.18, and the version of iptables is v1.3.5. What's wrong with that? How to block time stamp requests?

share|improve this question
1  
What you are doing (blocking ICMP TS) is a rare practice. You might elaborate more on what you are doing, and why. This could be interesting. –  JeffG Mar 5 '11 at 14:52
    
For security reason, the report of security scanning shows that the timestamp might be a weakness. –  Victor Lin Mar 7 '11 at 5:04

1 Answer 1

I tried the timestamp option of ping, and it looks like the ICMP type remains at 8 and that the timestamp request is apart of the IP options. This is probably why you are not filtering the requests since they look just like regular echo requests to iptables.

There is a match extension called ipv4options you might want to explore for blocking the timestamps.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.