Heh. I've found the best solution is to neither let ICMP in or out of
your network. It works wonders.
Works wonders for breaking PMTUD, etc, too.
Simon
Not to mention annoying dialup, DSL and dedicated customers when they can't do their own traceroutes, etc.
Well, we're a totally wireless ISP, and we have a small dialup pool for
our wireless customers to use. We get random complaints as far as not
being able to do traceroutes, but they're few and far between. The
complaints usually come from a local computer company helping out one of
our customers, where instead of connecting to port 25 of their mailserver
to see if it's listening, they try and do a traceroute, heh.
/nick