Windows 8.1 - Disabling Ping

Hello everyone,
I am was reading about how DNS on local machines can actually help malware. So I wanted to disable DNS on my local machine completely. That is to say when I execute from cmd.exe I should get the message could not resolve. How do I do this ? Now obviously I don't want to disable the "Request Timed Out" Message. Since I was reading that it leads to problems in the network. I want to disable DNS from ping completely without any unwanted side-effects to my network. How do I that ?

DNS can only be enabled or disabled on a global basis. You cannot choose to have DNS enabled but not allow ping to use it. DNS is an essential service for any computer that has Internet access.

Or have I misunderstood your question?

LMiller7 said:

DNS can only be enabled or disabled on a global basis. You cannot choose to have DNS enabled but not allow ping to use it. DNS is an essential service for any computer that has Internet access.

Or have I misunderstood your question?

Click to expand...

Are you saying that if I disable DNS I will lose Internet access ? I have seen PCs where you cant run ping but have access to the Internet. Isn't DNS done by the DNS servers I specify in my Internet configuration ? Why is there specific services for DNS in Windows then ?

Are you saying that if I disable DNS I will lose Internet access ?

Click to expand...

For all practical purposes, yes.

But DNS and ping are 2 VERY different things.
I believe you can disable ping in the Windows firewall but unsure as to how. Is that what you are wanting to do?

sreyan32 said:

Hello everyone,
I am was reading about how DNS on local machines can actually help malware. So I wanted to disable DNS on my local machine completely. That is to say when I execute

Code:

ping www.google.com

from cmd.exe I should get the message could not resolve. How do I do this ? Now obviously I don't want to disable the "Request Timed Out" Message. Since I was reading that it leads to problems in the network. I want to disable DNS from ping completely without any unwanted side-effects to my network. How do I that ?

Click to expand...

If you cannot resolve a DNS name, you will never be able to use the Internet again as your computer wouldn't be able to determine what www.eightforums.com would resolve to. There is no benefit to what you think you want to do.

Advanced Settings > Inbound Rules > New Rule > Custom > All Programs > Protocol Type : ICMPv4 + Customize > Specific > Echo Request > OK
Next > Any Ip or select appropriate ones > Block Connection > Apply to whatever domain you want > FinishRepeat this procedure with ICMPv6 if you're using it too.

If you have a hardware router this can usually be done via its settings too. On mine it takes a few clicks, much easier than Windows Firewall.

Ping can be used to check if your system is there basically. It can be used by malicious users of course, but as it is, it's only a harmless tool. Kind of like a thief calling your house to see if you're home. Not really a good reason to get rid of phones, is it ? (Yes I have Ping disabled on my own PCs, but I'm paranoid and I've accepted that)

oneeyed said:

Advanced Settings > Inbound Rules > New Rule > Custom > All Programs > Protocol Type : ICMPv4 + Customize > Specific > Echo Request > OK
Next > Any Ip or select appropriate ones > Block Connection > Apply to whatever domain you want > FinishRepeat this procedure with ICMPv6 if you're using it too.

Click to expand...

Is the following rule that you have given here used for blocking someone who pings my computer from within my network ? Because After applying the rule I can still use ping to ping google.com and my local DNS. Also does blocking ping cause any adverse effects in the network ?

oneeyed said:

Ping can be used to check if your system is there basically. It can be used by malicious users of course, but as it is, it's only a harmless tool. Kind of like a thief calling your house to see if you're home. Not really a good reason to get rid of phones, is it ? (Yes I have Ping disabled on my own PCs, but I'm paranoid and I've accepted that)

Click to expand...

You can never be too careful these days. Tell me something, in your opinion does blocking ping actually help ? I mean what are the types of malicious attacks can be done with the help of ping and how does blocking the inbound ping request stop them ?

Typically the firewall would not effect internal network activities. I believe that Windows firewall will normally only block incoming pings, not outgoing. Ping is a relatively minor security risk. Most systems have more serious problems.

Ping is a non essential function and can be disabled with no adverse effects. Many websites (including most operated by Microsoft) block incoming pings as a security measure. But security on a well known and highly used website and security on a home network are very different things.

sreyan32 said:

You can never be too careful these days. Tell me something, in your opinion does blocking ping actually help ? I mean what are the types of malicious attacks can be done with the help of ping and how does blocking the inbound ping request stop them ?

Click to expand...

Ping is not a vulnerability in itself, but a response to a ping lets a potential attacker know that you are there and he can then bring all guns to bear on your IP address and let you have it with his arsenal of attacks.

sreyan32 said:

I am was reading about how DNS on local machines can actually help malware.

Click to expand...

Was not that related to DNS caching? You can disable DNS Cache service safely, just set DNS manually.
I have disabled so much, that Windows thinks, that there is no network, Windows Update or ping fail too.

But disabling ping locally does not do anything, if you are online, you are traceable, but I would not worry about it, as long as you have ports closed, there is not much a hacker can do. Closed by a router or stealthed by a firewall, it is all the same. Actually, if you fail to respond a ping with destination unreachable, it will send a clear message, I am here, but I am hiding, it will draw an attention, so it is kind of counterproductive.