Re: SMURF amplifier block list

[jlixfeld () idirect ca]

You could always "deny icmp any aaa.bbb.ccc.ddd www.ccc.nnn.mmm log" on
your cores.  Deny ICMP from critical portions of your network.  Create a
little script which tail -fs the log, parses it, sorts it and counts it.
If the script counts more then xxx hits on a certain IP or a certain
number of IPs on your network from the same source or a multiple sources
on the same network, you have your upstream.  Once you have them, you can
call them and ask them to do the same until you find the real source.

This will not protect against someone smurfing your dialup users and they
can do just as much damamge as the former, but they are more likely to
bitch if they can't ping so it's a toss up.


On Sat, 18 Apr 1998, Dean Anderson wrote:

:At 3:21 PM -0400 4/18/98, Alex P. Rudnev wrote:
:>> During an in progress attack, you probably have to take extreme measures,
:>Do you remember - it's not attack against you or attack by some of your
:>customer's networks used as amplifier, but the attack initiated from your
:>own network. You never note such thing withouth some permanent
:>measurement.
:>
:>It's why we saw this 100% helpless against the SMURF's.
:
:But to protect your own network, all you need is the access rule I gave.
:You know your own broadcast address and netmask, and can put in a rule to
:block.
:
:You just can't block the presumed broadcast address used by other peoples
:networks.
:
:Logging attempted attacks which are blocked can't really be done with a
:cisco.  You need something to monitor the line coming in.
:
:               --Dean
:
:
:++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:           Plain Aviation, Inc                  dean () av8 com
:           LAN/WAN/UNIX/NT/TCPIP/DCE      http://www.av8.com
:           We Make IT Fly!                (617)242-3091 x246
:++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
:
:

--
Regards,  

Jason A. Lixfeld             jlixfeld () idirect ca
iDirect Network Operations   jlixfeld () torontointernetxchange net

---------------------------------------------------------------------
TUCOWS Interactive Ltd. o/a  | "A Different Kind of Internet Company"
Internet Direct Canada Inc.  | "FREE BANDWIDTH for Toronto Area IAPs"
5415 Dundas Street West      | http://www.torontointernetxchange.net
Suite 301, Toronto Ontario   | (416) 236-5806        (T)
M9B-1B5 CANADA               | (416) 236-5804        (F)
---------------------------------------------------------------------