How practical is ICMP spoofing?
scenario 1: in a NAT environment, how does NAT keep track of ICMP sessions (not technically sessions since it's not connection-oriented?) For ECHO/ECHO response Windows use the same identifier (0x1) and sequence number with 256 increment for each packet. If two hosts are pinging the same outside server, how does NAT distinguish incoming ICMP packets? If the internal network does not filter source address, how difficult is it to forge an ECHO response? use case: icmp ping used for monitoring, a load balancer may take incorrect/unnecessary actions upon receiving forged ICMP responses (destination unreachable, high latency etc.)
scenario 2: Some IPS device, say the GFW, inspecting packets on the transit path. How practical is it to forge ICMP error messages kill a connection with stealth. Instead of sending TCP RST, it sends out destination port unreachable/packet too large (this might get interesting :)) with forged source ip (the legitimate IP on the other side or some hops further down the path). Keep tracking of the original IP header and first 64 bytes can be expensive but with the computing power available today, is it doable?
Basically either from either inside or outside NAT, how likely is it for forged ICMP to cause damages/confusions? I am not talking about ICMP flood.
BTW can NAT handle anything IP protocols other than TCP/UDP? I am actually not exactly sure how it handles different ICMP types.