Qfyilyi

Due to MITM attack, ICMP redirect message should be blocked. However, original purpose of ICMP redirect message is to inform host better router(or gateway).

Then, Is there a speed issue by disabling ICMP redirect message in host? or negligible?

ICMP re-directs are most often seen when you have a host or router A in the same subnet with two other routers B & C and connectivity to both. Consider the following network:

   |__192.168.1.0/24__|

   | |                |

     |

     |   |___192.168.8.0/24__|

     |   | |                 |

     B     C

|____|_____|____|

|       |       |

        A

A will have a route (most likely a default) pointing to B, and B will have a more specific route to a 192.168.8.0/24 pointing to C.

Without ICMP redirects, all traffic from A to 192.168.8.0/24 will be routed A->B->C

With ICMP re-direct enabled, B will inform A that C is a better next-hop and subsequent traffic will be routed A->C.

Obviously B is an extra hop and depending on what kind of box it is, it may introduce extra latency.

Disabling ICMP-Redirects and redesigning the network to avoid this situation entirely would be the preferred solution eg:

   |__192.168.1.0/24__|

   | |                |

     |

     |   |___192.168.8.0/24__|

     |   | |                 |

     B-----C

|____|__________|

|       |       |

        A

(or remove C entirely and hang 192.168.8.0/24 directly off B).