
236 ◾ Network Attacks and Defenses: A Hands-on Approach
This tracking method is about the only way ICMP can enter
into a state table.
For example, after receiving the ICMP echo request packet
shown below,
Packet Source IP
Destination
IP Type Code Identifier
Sequence
number
Packet #1 192.168.1.5 192.168.2.10 8 0 200 1
the stateful firewall creates a new entry in its ICMP session’s
cache as shown below.
ICMP
session Source IP
Destination
IP Type Code Identifier
Sequence
number
Session
State
Session #1 192.168.1.5 192.168.2.10 1200 80 200 1 Request
Therefore, the ICMP echo reply packet that follows will be
accepted by the stateful firewall, as it includes the ...