Linux Forbidden Ping

Today, with NMAP scanning the LAN host, found several hosts open a lot of dangerous ports, do Linux, Have a little knowledge of these safety knowledge. The use of Nmap to scan their host if there is an available port. Discover that every time Nmap can successfully detect my host is alive state. Nmap is powerful, as a small personal host, There is nothing we can do to prohibit nmap from discovering the host. But we could forbid ping. The host is not found by the people who are not high.

1. First of all, Linux does not prohibit ping in the case of the ability to ping their own host:

1localhost:~$Ping 8.8.8.22Ping8.8.8.1(8.8.8.2) About( -) bytes of data.3  -Bytes from8.8.8.2: icmp_seq=1Ttl= -  Time=0.079Ms4  -Bytes from8.8.8.2: icmp_seq=2Ttl= -  Time=0.080Ms

localhost:~$sudoTcpdump-i any-nn ICMP with tcpdump detection effect tcpdump:verbose output suppressed, use-V OR-VV forFull protocol decodelistening on any, link-type linux_sll (LINUX cooked), capture size262144bytes One: -:43.651510Ip8.8.8.2>8.8.8.2: ICMPEchoRequestID 8389,seq  the, length - One: -:43.651535Ip8.8.8.2>8.8.8.2: ICMPEchoReplyID 8389,seq  the, length - One: -:44.675532Ip8.8.8.2>8.8.8.2: ICMPEchoRequestID 8389,seq  the, length - One: -:44.675557Ip8.8.8.2>8.8.8.2: ICMPEchoReplyID 8389,seq  the, length - One: -:45.703558Ip8.8.8.2>8.8.8.2: ICMPEchoRequestID 8389,seq  -, length - One: -:45.703581Ip8.8.8.2>8.8.8.2: ICMPEchoReplyID 8389,seq  -, length - One: -:46.723521Ip8.8.8.2>8.8.8.2: ICMPEchoRequestID 8389,seq  in, length - One: -:46.723552Ip8.8.8.2>8.8.8.2: ICMPEchoReplyID 8389,seq  in, length - One: -:47.747520Ip8.8.8.2>8.8.8.2: ICMPEchoRequestID 8389,seq  the, length - One: -:47.747551Ip8.8.8.2>8.8.8.2: ICMPEchoReplyID 8389,seq  the, length - One: -:48.771511Ip8.8.8.2>8.8.8.2: ICMPEchoRequestID 8389,seq  the, length - One: -:48.771538Ip8.8.8.2>8.8.8.2: ICMPEchoReplyID 8389,seq  the, length -

2.linux system running up, with parameters to control whether the host receives the ICMP protocol (ping through the ICMP protocol for host discovery), these parameters loaded into memory, the Linux system/proc directory is the memory of the image, can be from the/PROC system through the search/proc/ Sys/net/ipv4/icmp_echo_ignore_all to see if the current host is disabling the ICMP protocol, 0 means it is not disabled, that is, when the other host pings the current host, the current host responds. 1 Disables Ping, The current host does not respond when other hosts ping the current host.

1 cat /proc/sys/net/ipv4/20

3. After that, modify the/etc/sysctl.conf file with root permission to add a row

1localhost:$sudo VI/etc/sysctl.conf2 .......3 ......4Net.ipv4.icmp_echo_ignore_all =1 #添加该行5 6 7 : Wq #保存退出8 9localhost:~$sudoSysctl-p #执行着一条命令 to make the amendment take effectTenNet.ipv4.icmp_echo_ignore_all =1 #sysctl The configuration that is in effect in the. conf file One  A  -localhost:~$Cat/proc/sys/net/ipv4/Icmp_echo_ignore_all #再次查看该配置, the ICMP protocol reply ping has now been disabled - 1

4. Ping your console to see that you cannot reply to the ping.

1localhost:~$Ping 8.8.8.22Ping8.8.8.2(8.8.8.2) About( -) bytes of data.3^C4---8.8.8.2 PingStatistics---5 3Packets Transmitted,0Received -% packet loss, Time2047ms

1localhost:~$sudoTcpdump-i any-nn ICMP #可以看到只有request, no replay.2Tcpdump:verbose output suppressed, use-v OR-VV forFull protocol decode3Listening on any, link-type linux_sll (LINUX cooked), capture size262144bytes4  One: to:32.054412Ip8.8.8.2>8.8.8.2: ICMPEchoRequestID 8605,seq 1, length -5  One: to:33.059607Ip8.8.8.2>8.8.8.2: ICMPEchoRequestID 8605,seq 2, length -6  One: to:34.083520Ip8.8.8.2>8.8.8.2: ICMPEchoRequestID 8605,seq 3, length -7  One: to:35.107526Ip8.8.8.2>8.8.8.2: ICMPEchoRequestID 8605,seq 4, length -8  One: to:36.131524Ip8.8.8.2>8.8.8.2: ICMPEchoRequestID 8605,seq 5, length -9  One: to:37.155536Ip8.8.8.2>8.8.8.2: ICMPEchoRequestID 8605,seq 6, length -Ten  One: to:38.179573Ip8.8.8.2>8.8.8.2: ICMPEchoRequestID 8605,seq 7, length - One  One: to:39.203568Ip8.8.8.2>8.8.8.2: ICMPEchoRequestID 8605,seq 8, length - A  One: to:40.227618Ip8.8.8.2>8.8.8.2: ICMPEchoRequestID 8605,seq 9, length -

Linux Forbidden Ping