The router must block all inbound traceroutes to prevent network discovery by unauthorized users.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000205-RTR-000094	SRG-NET-000205-RTR-000094	SRG-NET-000205-RTR-000094_rule		Medium

Description
The traceroute tool will display routes and trip times on an IP network. An attacker can use traceroute responses to create a map of the subnets and hosts behind the perimeter router, just as they could do with pings. The traditional traceroute relies on TTL - time exceeded responses from routers along the path and an ICMP port-unreachable message from the target host. In some operating systems such as UNIX, traceroute will use UDP port 33400 and increment ports on each response. Since blocking these UDP ports alone will not block traceroute capabilities without also blocking potentially legitimate traffic on a network, it is unnecessary to block them explicitly. Because trace routes typically rely on an ICMP Type 11 - Time Exceeded message, the time-exceeded message will be the target either implicitly or explicitly blocking outbound traffic from the trusted network.

Description

The traceroute tool will display routes and trip times on an IP network. An attacker can use traceroute responses to create a map of the subnets and hosts behind the perimeter router, just as they could do with pings. The traditional traceroute relies on TTL - time exceeded responses from routers along the path and an ICMP port-unreachable message from the target host. In some operating systems such as UNIX, traceroute will use UDP port 33400 and increment ports on each response. Since blocking these UDP ports alone will not block traceroute capabilities without also blocking potentially legitimate traffic on a network, it is unnecessary to block them explicitly. Because trace routes typically rely on an ICMP Type 11 - Time Exceeded message, the time-exceeded message will be the target either implicitly or explicitly blocking outbound traffic from the trusted network.

STIG	Date
Router Security Requirements Guide	2013-07-30

Details

Check Text ( C-SRG-NET-000205-RTR-000094_chk )
Review the router configuration to determine if ACLs block ICMP Type 11 - Time Exceeded outbound to untrusted networks (e.g., ISP and other non-DoD networks). If ICMP Type 11 - Time Exceeded is not blocked outbound on the router, this is a finding.

Fix Text (F-SRG-NET-000205-RTR-000094_fix)
Configure an ACL on the router to block ICMP Type 11 - Time Exceeded outbound to untrusted networks (e.g., ISP and other non-DoD networks).