ICMP Redirect on Resolvers

[Valdis.Kletnieks at vt.edu (Valdis.Kletnieks at vt.edu)]

On Sat, 06 Apr 2013 10:38:06 -0400, shawn wilson said:

> What would break if u dropped all ICMP packets with redirects on public
> facing boxes?

Presumably nothing, as long as you guaranteed that your IP address, netmask,
and routes actually match the reality of your network configuration.  In that
case, you shouldn't see any valid ICMP redirects.  They're there mostly so
things kind-of-sort-of work even if you botch it (so for instance, even if you
whiff your default route accidentally, you can still ssh in from Tokyo and fix
it).

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 865 bytes
Desc: not available
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20130406/696d1363/attachment.bin>