Re: Smurf Amps List

[Jared Mauch <jared () puck nether net>]

        My list is by no means a complete list of smurf blocks, but more
a list to give you the possible netblocks that are not fixed.  It is likeley
that if someone has a /19 /16 /14, etc.. that they use to assign customers
out of, if the beginning of the block is smurfable, it's quite possible
the rest of it is too.
        
        Someone who would like to scan the entire internet is naturally 
more than welcome to attempt it, scanning each possible netmask for the
entire net.  The problem with that is the time it will take.  My list
is a subset of all smurf amplifiers.  I doubt they'll ever all go away,
but I've seen a number of networks get filtered/fixed since the posting
of it, so it's making some progress in helping.

        - Jared
        
On Sat, Jun 13, 1998 at 05:27:06PM -0400, Jon Lewis wrote:
> On Sat, 13 Jun 1998, Jared Mauch wrote:
>
> > On Sat, Jun 13, 1998 at 07:10:41AM -0400, D'Arcy J.M. Cain wrote:
> > > Thus spake Jared Mauch
> > > >         The page can be found at
> > > > http://puck.nether.net/~jared/smurfblocks.html
> > >
> > > Why not list the netmask of the netblock as well?
> >
> >     In most cases you can figure out the netmasks.  These blocks
> > were only checked at the very beginning of their space based on 
> > the bgp announcement as viewed by our network.  You can look at
> > our AS1225 feed at route-views.oregon-ix.net
>
> Checking only the beginning of nets for which you receive BGP
> announcements fails to take into account the vast numbers of single-homed
> networks which are part of large supernets.  i.e. One of FDT's old UUNet
> IP blocks was a /20 in 205.228.0.0/14.  There are only a few dozen
> announcements for:  sh ip ro 205.228.0.0 255.252.0.0 longer