nanog mailing list archives
Spoofed Packet Tracker (Was Re: SMURF amplifier block list)
From: Jared Mauch <jared () puck nether net>
Date: Mon, 20 Apr 1998 12:15:22 -0400 (EDT)
MCI has a tool to track spoofed packets, which is the orgin of any DoS today. You can get it from ftp.mci.net:/pub/security/dostrack742812.tar That will trace it to the edge of your network, then you need to work with the other providers to track it past that point. If it's within your network, you should filter it either by using ip verify unicast reverse-path on the serial interfaces or via acls. ip verify unicast reverse-path is a feature in the fib images by cisco. Most large nsp's run these images, and they're now mainline, so fire up your cco accounts and grab them. It drops packets that don't have the same return path, which works for most customers that are single homed. - Jared On a dark and stormy night, jlixfeld () idirect ca said:
Cisco has a method of tracing SMuRF, do they not? Anyone know how they do it?! Is it some imbedded thing, or do they call the owners of each network and pray that they have Ciscos?
Current thread:
- Re: SMURF amplifier block list, (continued)
- Re: SMURF amplifier block list Dan Boehlke (Apr 18)
- Re: SMURF amplifier block list Jeremiah Kristal (Apr 19)
- Re: SMURF amplifier block list Brandon Ross (Apr 20)
- Re: SMURF amplifier block list Dean Anderson (Apr 20)
- Re: SMURF amplifier block list Dave Andersen (Apr 20)
- Re: SMURF amplifier block list Jeremy Porter (Apr 20)
- Re: SMURF amplifier block list Brandon Ross (Apr 22)
- Re: SMURF amplifier block list Jason Lixfeld (Apr 24)
- Re: SMURF amplifier block list jlixfeld (Apr 20)
- Re: SMURF amplifier block list Alex P. Rudnev (Apr 20)
- Spoofed Packet Tracker (Was Re: SMURF amplifier block list) Jared Mauch (Apr 20)
- Message not available
- Re: SMURF amplifier block list Jay R. Ashworth (Apr 19)
- Re: SMURF amplifier block list jlixfeld (Apr 20)
- Re: SMURF amplifier block list Dean Anderson (Apr 18)
- Re: SMURF amplifier block list Alex P. Rudnev (Apr 18)
- Re: SMURF amplifier block list Dean Anderson (Apr 18)
- Re: SMURF amplifier block list Alex P. Rudnev (Apr 18)
- Re: SMURF amplifier block list Dean Anderson (Apr 18)
- Re: SMURF amplifier block list jlixfeld (Apr 20)
- Re: SMURF amplifier block list Pete Ashdown (Apr 20)
- Re: SMURF amplifier block list Jason Lixfeld (Apr 24)