Improving Web Application Security: Threats and - CGISecurity

410 Part IV: Securing Your Network, Host, and ApplicationProtocolsDenial of service attacks often take advantage of protocol-level vulnerabilities, forexample, by flooding the network. To counter this type of attack, you should:●●Use ingress and egress filtering.Screen ICMP traffic from the internal network.Use Ingress and Egress FilteringSpoofed packets are representative of probes, attacks, and a knowledgeable attacker.Incoming packets with an internal address can indicate an intrusion attempt or probeand should be denied entry to the perimeter network. Likewise, set up your routerto route outgoing packets only if they have a valid internal IP address. Verifyingoutgoing packets does not protect you from a denial of service attack, but it doeskeep such attacks from originating from your network.This type of filtering also enables the originator to be easily traced to its true sourcesince the attacker would have to use a valid — and legitimately reachable — sourceaddress. For more information, see “Network Ingress Filtering: DefeatingDenial of Service Attacks Which Employ IP Source Address Spoofing”at http://www.rfc-editor.org/rfc/rfc2267.txt.Screen ICMP Traffic from the Internal NetworkICMP is a stateless protocol that sits on top of IP and allows host availabilityinformation to be verified from one host to another. Commonly used ICMP messagesare shown in Table 15.1.Table 15.1 Commonly Used ICMP MessagesMessageDescriptionEcho requestDetermines whether an IP node (a host or a router) is available on thenetworkEcho replyDestination unreachableSource quenchRedirectTime exceededReplies to an ICMP echo requestInforms the host that a datagram cannot be deliveredInforms the host to lower the rate at which it sends datagrams becauseof congestionInforms the host of a preferred routeIndicates that the time to live (TTL) of an IP datagram has expired