nanog mailing list archives
Re: Smurf Amp Nets
From: "Craig A. Huegen" <chuegen () quadrunner com>
Date: Fri, 19 Jun 1998 06:52:49 -0700
On Thu, Jun 18, 1998 at 10:16:38PM -0700, Vern Paxson wrote: ==>> 0.0.0.0 ==>> 10.0.4.0 ==>> 127.0.0.0 ==>> 255.255.255.0 ==> ==>These are pretty cool, I must say. Exactly how does the smurf attacker ==>route their echo requests to them? For 0.0.0.0 and 255.255.255.255 (common responses to the echo requests), it's usually due to some network devices which don't check to see if they have a proper IP address before responding. i.e., someone didn't configure their printer with an IP address but it replies anyway. For 127.0.0.1, I generally see this when a UNIX box is the router which forwards the directed-broadcast--it replies to itself with a packet from 127.0.0.1, which is also broken. 10.0.4.0 is certainly interesting, and probably is due to two IP subnets being run on the same wire. /cah
Current thread:
- Smurf Amp Nets, (continued)
- Smurf Amp Nets Andrew Herdman (Jun 17)
- Re: Smurf Amp Nets Jon Lewis (Jun 17)
- Re: Smurf Amp Nets Oystein Homelien (Jun 18)
- Re: Smurf Amp Nets Jon Lewis (Jun 17)
- Re: Smurf Amp Nets Jon Lewis (Jun 17)
- RE: Smurf Amp Nets Morgan Sarges (Jun 18)
- Smurf Amp Nets Andrew Herdman (Jun 17)
- Re: Smurf Amp Nets Richard Thomas (Jun 17)
- Re: Smurf Amp Nets Jon Lewis (Jun 17)
- Re: Smurf Amp Nets Richard Thomas (Jun 17)
- Re: Smurf Amp Nets Vern Paxson (Jun 18)
- Re: Smurf Amp Nets Karl Denninger (Jun 19)
- Re: Smurf Amp Nets Craig A. Huegen (Jun 19)
- Re: Smurf Amp Nets Richard Thomas (Jun 19)
- RE: Smurf Amp Nets Martin, Christian (Jun 19)