ICMP: an Attack Vector against IPsec Gateways - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Preprints, Working Papers, ... Year : 2013

ICMP: an Attack Vector against IPsec Gateways


In this work we show that the Internet Control Message Protocol (ICMP) can be used as an attack vector against IPsec gateways. The main contribution of this work is to demonstrate that an attacker having eavesdropping and traffic injection capabilities in the black untrusted network (he only sees ciphered packets), can force a gateway to reduce the Path MTU of an IPsec tunnel to a minimum, which in turn creates serious issues for devices on the trusted network behind this gateway: depending on the Path MTU discovery algorithm, it either prevents any new TCP connection (Denial of Service), or it creates major performance penalties (more than 6 seconds of delay in TCP connection establishment and ridiculously small TCP segment sizes). After detailing the attack and the behavior of the various nodes, we discuss some counter measures, with the goal to find a balance between ICMP benefits and the associated risks.


Fichier principal
Vignette du fichier
paper.pdf (178.76 Ko) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-00879997 , version 1 (05-11-2013)


  • HAL Id : hal-00879997 , version 1


Ludovic Jacquin, Vincent Roca, Jean-Louis Roch. ICMP: an Attack Vector against IPsec Gateways. 2013. ⟨hal-00879997⟩
422 View
1417 Download


Gmail Facebook X LinkedIn More