IPConfig Blocked by ISP

[CommodoreS]

We are using a new scheme of work which has a unit which asks you to run a TraceRT command, however the results are being blocked by the LEA ISP.

 

We have asked them to allow this so we can run the unit correctly, but they have said they will not do this because of external security threats through their firewall.

 

I have spoken to other people who have told me there is no security risk allowing this. I just wanted some other peoples thoughts on this, whether you think it should be allowed or blocked.

Edited March 18, 2015 by CommodoreS

[glen_j]

ipconfig is run on the local pc to show ip address information, i can't see how the isp is blocking something like that. i could understand them blocking traceroute and ping. what command are they asking you to run? Edited March 18, 2015 by glen_j

[CommodoreS]

My fault - Long day - I meant TraceRT. I can't change the subject now though.

 

They are blocking TraceRT and not IPConfig.

[jamesreedersmith]

so they are blocking IGMP traffic?

[CommodoreS]

I have been told:

 

"In order to allow the return icmp decrements through the firewall this will require a new inspection policy on the firewall that is not a best practice due to external security threats."

[andydis]

I think they really mean internal threat .

 

If you can trace route you can identify every server / router your traffic goes out via including transparent proxies .

[synaesthesia]

As above. I would not want anyone doing a tracert unless it was on a machine directly connected to the internet forgoing any routers, proxies or other internal systems you may not want to be public knowledge. Personally, whoever made that scheme of work (assuming it's for secondary level and not specialist IT) hasn't thought that through very carefully.

I would suggest making a machine available as above, directly connected, where the IT staff can remote in and demonstrate it if that would cover it.