Re: Ping flood? Whats the point?

[cdp () PEAKPEAK COM (Chuck Phillips)]

Andy David writes:
> The ip's of course were spoofed, but the only way I was really able to
> tell was after decoding some of the packets my firewall captured (from
> different ip's) I found that the senders MAC address was identical
> throughout the entire attack.

A common MAC address is to be expected if there is a common router between
you and the different IPs, spoofed or not.  MAC addresses are useful for
debugging non-malicious problems on your local network and not a lot more.

Further, if someone r00ts a machine on your local network, even the MAC
address can be spoofed.  Most modern NICs allow this.  This "feature"
allows transparent fail over (no routing/arp changes), but it would be nice
if this feature required a _physical jumper change_ to enable and were
*not* enabled by default.  Oh, well.  Maybe someday the manufacturers will
catch on to this.

        Chuck