Re: smurf

[Henry Linneweh <linneweh () concentric net>]

To make this understood in a more clear context there are Linux users that
have
done exactly that and use ATM switches to lauch attacks from since they are
hard to trace from IP based networks and I see it constantly in my
traceroutes
and some exceeed the 30 hop limit on the web pages offering traceroutes from

the major players on the backbone...

Henry R. Linneweh

Adrian Chadd wrote:

> On Fri, 5 Dec 1997, Wayne Bouchard wrote:
>
> [snip]
>
> > threaten the most disruption of internet services. With ISDN and
> > DSL, users have the bandwidth necessary to generate even more
> > dangerous levels of traffic. If you don't think this issue affects
> > you, it does. If you're not a target, your probably being used
> > as a source.
>
> I agree totally.
> A couple of problems:
>
> * Filtering ALL ICMP is pretty silly, ICMP is there for more than just
>   pings, and some of it is important.
> * If people start doing this, someone with a smidgen of time on their
>   hands will write a ping flooder that uses random TCP or UDP packets
>   with spoofed from addresses.
>
> I'm curious however - can anyone out there running netflow or something
> similar give me a breakdown on what kind of ICMP traffic they're seeing?
>
> Adrian



--
™
¢4i1å