> Blocking all ICMP has always been a misconfiguration. I agree with everything Doug wrote except this. I may be insisting on usual semantics for "misconfiguration," though. I am generally of the opinion that when someone deliberately configures something in a foolish way, well -- that's folly, not a misconfiguration.