Jeroen Massar wrote: In my experience many platforms handle ICMP differently than user traffic. For instance, the Cisco 7600 handles typical user traffic on hardware ASICs, usually right on the line card where the packet is handled. Routing protocols, SSH, SNMP, ICMP, etc. get moved to the CPU on the supervisor card for processing. Whenever you see a really big device with hundreds of ports you should look into it; it's probably not a traditional router but a carrier-grade Layer-3 switch. The ASICs are what give it the huge horsepower across a huge number of ports. But ASICs generally do not handle ICMP. For a more traditional router you can take a Cisco 7206VXR with the NPE-G2 processor. It is true, user and mgmt and ctrl-plane traffic are all handled by the CPU. But, user traffic is generally handled in one cycle of the interrupt controller, which Cisco calls CEF. If the packet needs something special done to it the packet may be "punted" to the CPU where it is scheduled with all the other housekeeping tasks on the router. Modern platforms have QoS for punted packets so OSPF neighbor messages will have a better chance of being processed than ICMP. This QoS on the control plane helps, but it proves the point; CPU time is a finite resource and needs to be rationed. I made the statement that ICMP could be used as part of an exploit. Unless you would like to argue that there is absolutely no way ICMP could be exploited, than my statement stands. Security is not just about "there is a finite list of all known exploits, let's protect against all of them." Reducing your attack surface, even in areas where there is no known exploit, is sometimes the best defense. I've provided my experience and background. I was the senior engineer for some of the ten years I spent at an ISP. My work involved physical topology, BGP/OSPF, security, etc. If your network Kung Fu is stronger than mine and you would like to provide examples, maybe we could address the issue of uninformed (which I admit is a relative term!)