Security Incidents mailing list archives
Re: Spoofed ICMP "destination unreachable" - DOS?
From: aussie () AUSSIE MINE NU (Aussie)
Date: Wed, 24 May 2000 23:01:03 +1000
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 22 May 00, at 16:46, Ken Eichman wrote:
In the past week I've seen at least 3 identical ICMP DOS attacks (?) involving 3 different ISPs. I'm not sure if they're attempted attacks, and if so, against my network or the ISP's.
I've been seeing the same packets, typically with a "source" address set to 10.240.x.x, but occasinally with real IP's. They aren't very frequent but still annoying. I've tried getting windump to work so I can get a packet dump of the offending packets, but it's failing with NDIS adapter failures. I have Conseal firewall set up to reject most incoming ICMP packets so these packets stand out a lot, but I haven't been able to see any similarities between incidents. Sometimes there has been no network activity for over 15 mins, so it's definitely not coming from my system. Aussie -----BEGIN PGP SIGNATURE----- Version: PGP 6.0.2 -- QDPGP 2.60 Comment: Please verify this signature. http://www.pgpi.com iQA/AwUBOStF75Zb9oayhFBBEQJcIgCdGfLyCaTwIagzeDyou0jqVlhfuMgAoPjS u6M0ZlYw7xXc+tD9dv2ofTpd =vVM2 -----END PGP SIGNATURE----- PGP Key Block available at: http://aussie.mine.nu/aussie/pgp_key.txt
Current thread:
- Spoofed ICMP "destination unreachable" - DOS? Ken Eichman (May 22)
- Microsoft version.binding us now? Bill Marquette (May 26)
- New DoS attack Jeff Calvert (May 28)
- Re: Microsoft version.binding us now? Erich Meier (May 29)
- Re: Spoofed ICMP Richard Bejtlich (May 27)
- Re: Spoofed ICMP "destination unreachable" - DOS? Steve Reid (May 27)
- <Possible follow-ups>
- Re: Spoofed ICMP "destination unreachable" - DOS? Aussie (May 24)
- ICMP attack in progress? Lic. Rodolfo Gonzalez Gonzalez (May 25)
- Re: ICMP attack in progress? Crist J. Clark (May 25)
- Re: ICMP attack in progress? Jason Storm (May 26)
- afs3 exploit?? elijah wright (May 25)
- Strange Happenings @Home Fred Hirsch (May 30)
- AMDROCKS Jim Williams (May 25)
- Attacks on port 25 Vincent Lim (May 25)
- Re: Attacks on port 25 Ryan Russell (May 26)
- Re: Attacks on port 25 Bill Lavalette (May 28)
- Re: Attacks on port 25 RayW (May 29)
- ICMP attack in progress? Lic. Rodolfo Gonzalez Gonzalez (May 25)
- Microsoft version.binding us now? Bill Marquette (May 26)