Re: smurf, the MCI-developed tracing tools (was Re: Bogus announcement)

["Alex P. Rudnev" <alex () Relcom EU net>]

What are you talking about? If they have NETFLOW switching and NETFLOW 
accounting, it's easy to search for the router originated for the 
SMURF/initialised packets (this packets can be searched by the such list, 
or by the simular search pattern):

 xxx permit ip any 0.0.0.255 255.255.255.0 log

And then it takes 5 minutes to look for the originating interface.



On Sat, 27 Dec 1997, Phil Howard wrote:

> Date: Sat, 27 Dec 1997 16:08:05 -0600 (CST)
> From: Phil Howard <phil () charon milepost com>
> To: nanog () merit edu
> Subject: Re: smurf, the MCI-developed tracing tools (was Re: Bogus announcement)
>
> >     Hello Karl & All,  Where or at what price are these tools
> >     available.
> >                     Tia, JimL
> > PS: In a further responce Karl was heard to say :
> >
> > > The bottom line is that MONTHS after these were made available your NOC crew
> >
> >     I never heard nor was made aware that these tools were available,
> >     even though I am an MCI Customer . :-(
>
> Same here.  Are they free or do they cost money?
>
> People want the tools.
>
> -- 
> Phil Howard | w7x4y4z5 () noplace2 net end5ads8 () dumbads8 com suck1it7 () dumbads7 edu
>   phil      | end6ads8 () no52ads1 edu no2spam7 () dumb7ads net crash291 () spammer6 org
>     at      | no1spam9 () no57ads7 net crash075 () spammer8 edu eat9this () spam1mer edu
>   milepost  | stop5it8 () spammer5 edu no53ads9 () lame7ads org no8way17 () s3p3a9m9 com
>     dot     | eat0this () dumbads9 edu no5spam6 () anyplace com stop7865 () no40ads3 edu
>   com       | a1b6c7d7 () dumb8ads edu no1spam5 () lame8ads edu no1way93 () dumbads1 com

Aleksei Roudnev, Network Operations Center, Relcom, Moscow
(+7 095) 194-19-95 (Network Operations Center Hot Line),(+7 095) 239-10-10, N 13729 (pager)
(+7 095) 196-72-12 (Support), (+7 095) 194-33-28 (Fax)