ping of death

WRSpithead · 09-25-2006, 02:06 AM

i've read about the "ping of death" where you send an icmp request with 65536 bytes, but is this even possible to do? Don't linux kernels shave it down to something like 65300 bytes anyway?

bulliver · 09-25-2006, 02:44 AM

This was patched in all but the most incompetent of operating systems years ago. Don't believe everything you read, or at least check the date

WRSpithead · 09-25-2006, 03:09 AM

im not talking about it working. i'm talking about the ability to even make the packet.

peter_robb · 09-25-2006, 05:38 AM

There is no real maximum icmp packet size. You could ping with a 2MB packet size.
The packets are fragmented to pass along ethernet routes and the problems occur when they are reassembled beyond the 65535 byte limit in the receiver. The packet can only record a size up to 65535 bytes in it's header.

See http://insecure.org/sploits/ping-o-death.html for more info.

There were many frag-defrag bugs some years ago, but so few now.