Re: SMURF amplifier block list

[Jason Lixfeld <jlixfeld () idirect ca>]

What would be the benefit of doing 3 AND 4?!  They both effectively do the
same thing and you can't do one if the other is being blocked.  Is their a
pro to doing both of them?

:A combination of ...
:
:1.  blocking outbound packets with sources not in your own networks
:
:2.  blocking inbound packets addressed to broadcast addresses you know
:    you have in your subnetting topology
:
:3.  blocking inbound echo_request
:
:4.  blocking outbound echo_reply
:
:... would be a good start.  It breaks things like outsiders pinging your
:network, but many find this an acceptable compromise.  I've done #1, #3
:and #4 for over 4 years.  I plan to add #2 shortly, not only at the main
:gateways, but also for all RADIUS based dialups, whether LAN or not.  I
:already block outbound packets to port 25, except allow them to my mail
:servers, for all but customers who run their own mail servers, via RADIUS,
:for purposes of blocking spam relaying.  Of course that won't stop it all,
:but it does stop most, including the naive.
:
:I have no plans to block outbound packets to addresses ending in .255.
:
:I'd love to be able to:
:
:5.  block inbound packets with sources I have no routes for
:
:6.  block inbound packets with sources that came in over an interface that
:    such a source could not route to if it were a destination
:
:-- 
:Phil Howard | blow2me7 () no4place net a6b5c4d9 () s1p0a0m4 net eat6this () noplace6 com
:  phil      | stop5it8 () spammer6 edu no9way48 () dumbads1 net blow1me9 () s0p0a9m2 edu
:    at      | suck3it2 () anywhere net crash528 () nowhere5 edu end7it11 () lame7ads com
:  milepost  | stop6ads () no1where org no59ads8 () s6p5a1m6 org ads5suck () s8p8a3m8 edu
:    dot     | no9way53 () no37ads3 net eat25me5 () s9p8a1m1 edu die8spam () spammer1 com
:  com       | eat59me0 () spammer5 org stop4181 () dumbads9 net eat2this () spammer6 net
:

--
Regards,  

Jason A. Lixfeld

Network Engineer, iDirect Network Operations

---------------------------------------------------------------------
TUCOWS Interactive Ltd. o/a  | "A Different Kind of Internet Company"
Internet Direct Canada Inc.  | "FREE BANDWIDTH for Toronto Area IAPs"
5415 Dundas Street West      | http://www.torontointernetxchange.net
Suite 301, Toronto Ontario   | (416) 236-5806        (T)
M9B-1B5 CANADA               | (416) 236-5804        (F)
---------------------------------------------------------------------
jlixfeld () idirect ca          | jlixfeld () torontointernetxchange net
---------------------------------------------------------------------