Analysis of ICMP policy for edge firewalls using active probing

Abstract

The method of inferring firewall policy, using Active Probing repeats the process of transmitting TCP/UDP/ICMP packets and receiving ICMP response packets. However, if ICMP response packets cannot be received normally, the accuracy of inferring the firewall policy decreases, and it is necessary to verify the feasibility in real conditions. In this paper, we collect Autonomous System (AS) information to investigate the tolerance of ICMP intended for all AS across the world in addition to DNS server information, which is operational within AS. We confirm whether ICMP response packets are received or not by transmitting probing packets to the DNS server. Finally, we propose the AS information that received ICMP packets as the result of the test.