Re: Tool for automatically educating smurf amplifiers ...

["Richard Thomas" <buglord () ex-pressnet com>]

-----Original Message-----
From: Doug McLaren <dougmc () feeding frenzy com>
To: nanog () merit edu <nanog () merit edu>
Date: Monday, July 06, 1998 3:06 PM
Subject: Tool for automatically educating smurf amplifiers ...


> Lately one of our machines has been the target of several smurf
> attacks (no idea why, probably some user kicked off an IRCer from
> their channel or something equally silly) and so I set out to email
> each of the sites used as smurf amplifiers ...
>
> I couldn't find any sort of tool to do this for me, so I wrote one.
>
> It's certainly still needs some work, but I think it'll be useful in
> it's current condition to anybody else who's tried to do this.
>
> If we can notify the smurf amplifiers that they're being abused and
> let them know what they need to do to fix it, maybe we can make smurf
> attacks a thing of the past (or at least less effective, as the
> smurfers will have to look harder to find good amplifiers.)
>
> In any event, you can get my program at :
>
>   http://www.frenzy.com/~dougmc/smurf-complain.pl
>
> There's lots of room for improvements, so if you have some changes, by
> all means send them to me.
>
> It uses `ipw' to get contact information.  If you don't have `ipw',
> get it from :
>
>   http://www.e-scrub.com/ipw
>
> Also, while you may wish to use `tcpdump' or look at your router's
> logs to see where the ICMP echo reply packets were coming from, I was
> using icmpinfo, which you can get from :
>
>   http://hplyot.obspm.fr/~dl/icmpinfo.html
>
> So far, after running the program once and sending out about 50
> emails, I've gotten about 17 bounces and about 15 emails saying
> they'll fix or have fixed their routers, and two or three emails
> asking for details or a more clear explanation ... fairly promising.

Not to toot my own horn but you might wanna try using a little proggy I
wrote called SmurfLog, available at http://www.sy.net/security. It only
records echo replies from unique /24's, preventing the few gig logfiles that
you can get from icmpinfo.