Re: Encouraging smurf-amp measurements

["Richard Steenbergen" <humble () lightning net>]

> This is encouraging news:
>
> I ran a scan for smurf-amps of /24s in 200/8 through 210/8 in late
> July that yielded 30,083 networks that returned duplicate
> echo-replies. Today, I rescanned those networks, and found that of the
> original 30k, only 21,255 returned duplicates -- that's a 29% drop.
>
> Whether it means that more networks overall are properly configured, or
> that different networks are misconfigured, I know not. Optimistically,
> I'd like to guess that the former is true, but a complete scan would
> be necessary to know.

Its an actual across-the-board drop. If you eliminate the puny bcasts (less
then 10 dupes) the numbers are even better. I've got a project setup to
automatically scan everything in the bgp routing table, grab contact
information for the UPLINK (99.9% of those bcasts remaining are ones with
dud contact info), send out aggregated emails to said uplinks, and maintain
a database of useful statistics. The only thing I'm waiting on is certain
persons coughREIDcough coughSTEVEcough to get off their arses and finish
what they said they would a couple months ago. =)

--
Richard Steenbergen <humble () lightning net> http://www.bitchx.com/~humble
humble@EFnet hkp://keys.pgp.com/humble () lightning net PGP KeyID: 0x21581362
PGP key fingerprint: 7552 6AB2 B9C7 5A1B F1B6  8EA3 DFCF 793D 2158 1362
"I tried sniffing Coke once, but the ice cubes got stuck in my nose!"