nanog mailing list archives
Re: Filtering ICMP (Was Re: SMURF amplifier block list)
From: Brandon Ross <bross () mindspring net>
Date: Sun, 26 Apr 1998 16:38:24 -0400 (EDT)
On Fri, 24 Apr 1998, Richard Irving wrote:
Ok. You know how I always ask the obvious... So, here I go again.. This is only slightly off topic.. If you have no amplifiers greater than 2x-4x, is there really a need to turn off ip directed broadcasts?
My feelings there are "why not?". If you are running on a platform (such as Cisco) that makes it easy to turn off directed broadcast you can only help by turning it off. In the attacks that have come our way, the attackers have used almost every size of amplifier. I also suspect that as network managers become more clueful (a slow painful process) that the attackers will eventually have to resort to less efficient means of attack.
And if this is true, doesn't designing your network with minimized amplifier space sort of negate all this ?
In some applications that wouldn't be a hard thing to do, but for most it's nearly impossible. Brandon Ross Network Engineering 404-815-0770 800-719-4664 Director, Network Engineering, MindSpring Ent., Inc. info () mindspring com Mosher's Law of Software Engineering: Don't worry if it doesn't work right. If everything did, you'd be out of a job.
Current thread:
- Re: Filtering ICMP (Was Re: SMURF amplifier block list), (continued)
- Re: Filtering ICMP (Was Re: SMURF amplifier block list) Mark Whitis (Apr 22)
- Re: Filtering ICMP (Was Re: SMURF amplifier block list) Michael Dillon (Apr 20)
- Re: Filtering ICMP (Was Re: SMURF amplifier block list) Michael Shields (Apr 22)
- Re: Filtering ICMP (Was Re: SMURF amplifier block list) Alex P. Rudnev (Apr 21)
- Re: Filtering ICMP (Was Re: SMURF amplifier block list) D'Arcy J.M. Cain (Apr 22)
- Re: Filtering ICMP (Was Re: SMURF amplifier block list) Alex P. Rudnev (Apr 21)
- Message not available
- Re: Filtering ICMP (Was Re: SMURF amplifier block list) Eric Germann (Apr 21)
- Re: Filtering ICMP (Was Re: SMURF amplifier block list) Jason Lixfeld (Apr 24)
- Re: Filtering ICMP (Was Re: SMURF amplifier block list) Pete Ashdown (Apr 24)
- Re: Filtering ICMP (Was Re: SMURF amplifier block list) Richard Irving (Apr 24)
- Re: Filtering ICMP (Was Re: SMURF amplifier block list) Brandon Ross (Apr 26)
- Re: Filtering ICMP (Was Re: SMURF amplifier block list) Michael Dillon (Apr 24)
- Re: Filtering ICMP (Was Re: SMURF amplifier block list) Mark Whitis (Apr 26)
- Re: SMURF amplifier block list Dean Anderson (Apr 18)
- Re: SMURF amplifier block list Phil Howard (Apr 18)
- Message not available
- Re: SMURF amplifier block list Jay R. Ashworth (Apr 19)
- Re: SMURF amplifier block list Alex P. Rudnev (Apr 20)
- Re: SMURF amplifier block list jlixfeld (Apr 20)
- Re: SMURF amplifier block list Dean Anderson (Apr 19)
- Re: SMURF amplifier block list Jason Lixfeld (Apr 24)
- Re: SMURF amplifier block list Dean Anderson (Apr 24)