Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Linux system which has a number of services disabled (for example, telnet). When a telnet client attempts a connection, the system responds with an ICMP "Destination Unreachable". Is there a way, short of modifying the Linux network stack, to disable this behavior?

share|improve this question

closed as not constructive by Mircea Vutcovici, MDMarra, Shane Madden, Ward, Jenny D May 31 '13 at 7:42

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

10  
Do not do this. –  Zoredache May 31 '13 at 0:37
    
If it is from @Zoredache, then you should consider it helpful. –  Mircea Vutcovici May 31 '13 at 1:08
3  
@Dave The faq states that you should ask questions about problems that you are facing. What problem is disabling this ICMP reply going to solve for you? What benefit is it going to bring? If it's "just to see what will happen" you're on the wrong site. If there's a real problem you think it will solve, you should tell us so that we can evaluate the problem as a whole and possibly provide an alternative solution. Rarely is "drop ICMP" the right answer. –  MDMarra May 31 '13 at 1:31
2  
You still haven't answered the question of "what problem are you trying to solve by doing this?" But, if you must be difficult and evasive, try Super User or Unix & Linux. Just make sure to read their faq first. –  MDMarra May 31 '13 at 1:36
1  
@Zoredache Why not? I not on cisco devices you can turn this on and off. It is supposed to be for increased security as in it's harder to get information about your network? I need to implement the ability to turn this on and off on a switch atm. –  Paul Jun 4 '13 at 10:24

1 Answer 1

The destination unreachable ICMP packet is a standard Internet control message which indicates that there is no service available on that port. There's generally no reason to disable it (and you didn't give one).

But if you really want to disable it, you can just change your firewall rules to drop packets rather than rejecting them. (Wait, you are firewalled, right?)

share|improve this answer
2  
You can do either, but it's most common to drop inbound traffic which you don't intend to explicitly allow. –  Michael Hampton May 31 '13 at 1:02
3  
Again, you really should not do this without an especially good reason. –  Michael Hampton May 31 '13 at 1:05
1  
Using a deprecated buggy version of a 10 year old OS is generally not a compelling argument. –  Joel E Salas May 31 '13 at 1:17
1  
Probably because no one wants to give you a lecture on the purpose of ICMP and how dropping it doesn't make anything more secure. It's a long lecture to give, after all, and the IETF have it all published in RFCs anyway. –  MDMarra May 31 '13 at 1:18
2  
Then what do you have to gain? Why are you doing it? –  MDMarra May 31 '13 at 1:19

Not the answer you're looking for? Browse other questions tagged or ask your own question.