By default, Ubuntu Linux is configured to be “friendly” on a local network. If another computer on the network (or even a random scanner on the internet) sends an ICMP Echo Request (a “ping”) to your Ubuntu machine’s IP address, your system will automatically reply with an ICMP Echo Reply, confirming that your machine is online, active, and reachable.
While this is useful for diagnosing benign network connectivity issues, it is a significant security liability if you are running a public-facing server. Automated botnets constantly sweep the internet firing off ping requests; if your server replies, the botnet logs your IP address as a live target and will immediately begin probing your system for open ports and vulnerabilities.
You can configure the Ubuntu kernel to completely drop all incoming ping requests, making your system essentially invisible to automated network scanners.
How to Disable ICMP Echo Responses (Ignore Pings)
You must modify the sysctl kernel parameters to ignore ICMP requests.
- Open your terminal application (
Ctrl+Alt+T) or SSH into your server. - Open the
sysctl.conffile in a text editor with root privileges:
sudo nano /etc/sysctl.conf
- Scroll to the very bottom of the file and add the following new line:
net.ipv4.icmp_echo_ignore_all = 1
- Press
Ctrl+O, thenEnterto save the file. - Press
Ctrl+Xto exit the editor. - To apply the kernel changes immediately without rebooting, run the following command:
sudo sysctl -p
Your Ubuntu system is now operating in “stealth mode.” If another machine attempts to ping your IP address, the terminal will simply return “Request timeout.” Your server will completely ignore the packet, refusing to confirm its existence on the network.