7 ms·
That's why you discard ICMP errors.
by apstls 8mo ago
That's why you discard ICMP errors.
- eqvinox 8mo agoIf anything, that's why you discard ICMP port unreachable, which I assume you meant. If you're blanket dropping all ICMP errors, you're breaking PMTUD. There's a special place reserved in hell for that. (And if you're firewalling your ICMP, why aren't you firewalling TCP?)