Re: New IPv4 Allocation to ARIN

[jlewis () lewis org]

On Sun, 18 Jan 2004, Petri Helenius wrote:

> > It's those dang Nachi-sized ICMP echo/echo-replies.  We block those at all 
> > our transit points and dial-up ports.  Nachi was killing our cisco 
                                          ^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > access-servers until we did this to stop the spread.
   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

> I know what they are and how to get around them. I just look down on people
> dropping my packets in their backbones without reason.

I wasn't joking or kidding about the above.  Many others who run dialup 
services saw similar problems (both with cisco and other vendor's gear).  
Blocking these size/type packets, as per suggestions from cisco's web site 
was the easiest way to keep our network up, and prevent additional 
infections both into and out from our customers.

Have others who implemented them dropped their echo/echo-reply 92-byte 
filters?

If tracert defaulted to udp like just about every "unix" traceroute or 
allowed you to vary the packet size or protocol, this wouldn't be as much 
of an issue.
  
----------------------------------------------------------------------
 Jon Lewis *jlewis () lewis org*|  I route
 Senior Network Engineer     |  therefore you are
 Atlantic Net                |  
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________