Network Uptime

You are reading:
Protecting Your Data: A Guide to Windows Firewall

The Windows Firewall Advanced / ICMP Options

ICMP is an extremely useful troubleshooting tool for network administrators, providing the network troubleshooter with availability and subnet mask information. Unfortunately, this information can also be used by the bad guys to gather important information about the local network.

This ICMP information is so sensitive that most organizations will disable all ICMP functions at their primary Internet firewall. Windows Firewall follows this convention, and also disables all ICMP functions through the Advanced tab settings.


Advanced / ICMP / Settings
The ICMP Settings option lists the enabled and disabled ICMP messages. This list is based on the ICMP standard specification and cannot be added, edited, or deleted. The ICMP Settings only allow for enabling or disabling of individual ICMP messages.

The first ICMP setting, "Allow incoming echo request," refers to the "ping" functionality commonly used to check workstation availability. This setting will automatically be enabled (and cannot be disabled) if the "File and Printer Sharing" exception is enabled in the Exceptions tab. If "File and Printer Sharing" is not enabled, then the incoming echo request setting is at the discretion of the user.


ICMP can inadvertently provide critical network and workstation information to a nosy intruder. Don't turn these options on unless they are absolutely required!