Re: Traceroute and "ping" sockets: some questions

David Miller wrote:

quoted

quoted

Why limit?  He can spam with UDP socket just as easily at any rate
he pleases,
       

Yes, but most cases such UDP is "one-way" spam (until services like
"echo 7/udp" are enabled).
For icmp echo, we normally receive icmp replies, hence it is
bidirectional crap. Which was not present before.
     

Well, replace UDP with TCP syn flood.
   

Well.

Why then there is "net/ipv4/ping_group_range" restrictions, with default values (low=1, high=0) which denies this way even for root?


Regards,
Dmitry

From: Dmitry Butskoy <redacted>
Date: Fri, 19 Aug 2011 17:56:26 +0400

Why then there is "net/ipv4/ping_group_range" restrictions, with
default values (low=1, high=0) which denies this way even for root?

While we shake out the bugs and better understand the security
implications of this feature.  One this is resolved we can deprecate
this.