Route Injection on the LAN: ICMP Redirects, IRDP, and Source Routing

Most Windows hardening guides obsess over identity and endpoint controls and quietly skip the network layer of the TCP/IP stack itself. That is a mistake. Three legacy IPv4 behaviors — ICMP Redirects, ICMP Router Discovery (IRDP), and IPv4 source routing — each let an attacker who is already on your local segment quietly reroute a victim's traffic through a box they control. No credentials, no exploit, no user interaction: just a forged packet the default Windows stack is willing to trust.

They are the network-layer cousins of the name-resolution poisoning attacks (LLMNR, NBT-NS, mDNS, WPAD) that get all the attention. Same threat model — an attacker with a foothold on the LAN — but instead of answering a name lookup, they rewrite where your packets go. This post covers what each one does, why the defaults are unsafe, and the exact registry values to audit and fix.

1. ICMP Redirects: “there's a better next hop”

An ICMP Redirect (Type 5) is a message a router sends to say “for this destination, use this other gateway instead.” It is a 1980s optimization for hosts sitting on a segment with more than one router. The problem: the message carries no authentication. An attacker on the same segment can forge a redirect and inject a bogus host route into the victim's IPv4 routing table, silently pulling that destination's traffic through the attacker for a man-in-the-middle — or pointing it at a black hole.

Windows accepts ICMP redirects by default. The kill switch:

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
  EnableICMPRedirect = 0   (DWORD; 0 = ignore redirects)

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters' -Name EnableICMPRedirect -Value 0

The TCP/IP stack reads this at startup, so a reboot is required for the change to take full effect. This maps to the CIS Windows benchmark item MSS: (EnableICMPRedirect).

2. IRDP: an attacker advertises himself as your gateway

ICMP Router Discovery Protocol (IRDP, RFC 1256) lets a host learn its default gateway from ICMP Router Advertisements instead of being told statically or via DHCP. If IRDP is active, an attacker on the segment simply broadcasts a Router Advertisement with a high preference value, and the victim installs the attacker as its default gateway — routing all off-subnet traffic through them.

The catch that makes this the easiest of the three to miss: the relevant value defaults to 2, which means “perform router discovery when DHCP asks me to.” So an absent or default value still leaves the door open. The only safe state is an explicit 0:

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
  PerformRouterDiscovery = 0   (DWORD; 0 = disabled, 1 = enabled, 2 = DHCP-gated [default])

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters' -Name PerformRouterDiscovery -Value 0

Because 2 and a missing key both leave IRDP reachable, a scanner that only flags 1 gives you a false sense of safety. Audit for the presence of an explicit 0. This maps to MSS: (PerformRouterDiscovery).

3. IPv4 source routing: the sender picks the path

A source-routed IP packet carries its own hop-by-hop path inside an IP option. The sender — not the routers — dictates the route, including the return path of a packet with a spoofed source address. That lets an attacker bypass ingress and anti-spoofing filters and reach hosts that normal routing would never expose, while making the traffic look like it came from somewhere trusted.

Windows does not fully disable source routing by default. There are three levels; only 2 (“highest protection”) turns it off completely:

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
  DisableIPSourceRouting = 2   (DWORD; 0 = allowed, 1 = partial, 2 = fully disabled)

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters' -Name DisableIPSourceRouting -Value 2

Note the inverted semantics: for source routing, higher is safer, and the recommended value is 2, not 0. This maps to MSS: (DisableIPSourceRouting).

Why the defaults are wrong — and quietly stay wrong

All three of these are hygiene items that almost never get set on a fresh Windows install, a golden image, or a machine that has drifted over years of updates. They cause no visible symptoms, so nobody notices them — until a red team on the LAN uses one to pivot. And because two of them (IRDP and source routing) are unsafe when absent, not just when explicitly enabled, a naive “is this key set to the bad value?” check misses them entirely.

The correct audit logic is: fail safe. Treat a missing or unreadable value as exposed, and only pass on an explicit secure value (EnableICMPRedirect=0, PerformRouterDiscovery=0, DisableIPSourceRouting=2).

Auditing it automatically

WinSentinel's Network Posture module checks all three of these as part of a normal audit, alongside the LLMNR / NBT-NS / mDNS / WPAD name-resolution poisoning vectors, SMB signing, RDP NLA, listening-port exposure, and ARP-table anomalies. Each finding fails safe on a missing key and ships a one-line, elevation-ready fix command:

winsentinel --audit --module Network

Every check here is part of the free, single-machine tool — no license required. Run it once on your own workstation and you will almost certainly find at least one of these three sitting at its unsafe default. Fixing them is three registry values and a reboot; leaving them is a standing invitation to anyone who gets onto your network.

Browse all audit modules →