ICMP: an Attack Vector against IPsec Gateways
type: Dataset
description: In this work we show that the Internet Control Message Protocol (ICMP) can be used as an attack vector against IPsec gateways. The main contribution of this work is to demonstrate that an attacker having eavesdropping and traffic injection capabilities in the black untrusted network (he only sees ciphered packets), can force a gateway to reduce the Path MTU of an IPsec tunnel to a minimum, which in turn creates serious issues for devices on the trusted network behind this gateway: depending on the Path MTU discovery algorithm, it either prevents any new TCP connection (Denial of Service), or it creates major performance penalties (more than 6 seconds of delay in TCP connection establishment and ridiculously small TCP segment sizes). After detailing the attack and the behavior of the various nodes, we discuss some counter measures, with the goal to find a balance between ICMP benefits and the associated risks.
issued: 2026-05-09T03:40:53.124369
language: en
modified: 2026-05-09T03:40:53.124373
contact point: Organization
  fn: CCSD
keyword: icmp
keyword: infoeu-reposemanticspreprint
keyword: infoinfo-nicomputer-science-csnetworking-and-internet-architecture-csni
keyword: ipsec
keyword: network
keyword: preprints-working-papers-
keyword: security
landing page: https://inria.hal.science/hal-00879997

ICMP: an Attack Vector against IPsec Gateways
type: Distribution
format: HTML
issued: 2026-05-09T03:40:53.126422
modified: 2026-05-09T03:40:53.114896
access URL: https://inria.hal.science/hal-00879997

test_moissonnage_selune
type: Agent