Re: big ICMP size

[Darren Reed <darrenr () reed wattle id au>]

In some email I received from bugiu, sie wrote:
> Hi admins ,
>
> I have a distributed source attack with ICMP type 8 pack, size =1500 and
> flag don't fragment set (DF) from a number of  8-10 sites.
> The default policy discards this requests, but before contacting the
> admins of this sites, do you know any similar reports or modified binary
> that generates this type of traffic ?
> here is a log extract of this activity :
>
> -----------------------////////
> Sep 21 11:00:20 iplist kernel: Packet log: input DENY eth0 PROTO=1
> SS.SS.SS.SS:8 193.230.133.6:0 L=1500 S=0x00 I=36059 F=0x4000 T=233
> -------------------------///////
>
> 11:38:03.748034 212.206.88.45 > bamse.osim.ro: icmp: echo request (DF)
> (ttl 234, id 3266)
>                          4500 05dc 0cc2 4000 ea01 0a76 SSSS SSSS
>                          c1e6 8506 0800 f7ff 0000 0000 0000 0000
>                          0000 0000 0000 0000 0000 0000 0000 0000
>                          0000 0000 0000

That looks unlike ping because the data bytes are all 0's rather than
a pattern...but depending on your version of ping:

ping -s 1500 bamse.osim.ro
ping bamse.osim.ro 1500

i.e. the standard ping program can and will generate large ICMP ECHO
packets if asked.

Darren

_______________________________________________
Firewall-wizards mailing list
Firewall-wizards () nfr net
http://www.nfr.net/mailman/listinfo/firewall-wizards