Home page logo

nanog logo nanog mailing list archives

Re: SMURF amplifier block list
From: "Alex P. Rudnev" <alex () Relcom EU net>
Date: Tue, 14 Apr 1998 13:27:34 +0400 (MSD)

The whole idea was to block attempts to make SMURF atatck originated from 
your network, and this case the black list of addresses to be blocked 
(it's the list of broadcast addresses used to amplify ICMP) joined with 
the logging such attempts is quite usefull.

Date: Mon, 13 Apr 1998 19:46:29 -0600 (MDT)
From: Forrest W. Christian <forrestc () iMach com>
To: Vadim Antonov <avg () pluris com>
Cc: Karl Denninger <karl () mcs net>, Dean Anderson <dean () av8 com>,
    "Jay R. Ashworth" <jra () scfn thpl lib fl us>, nanog () merit edu
Subject: Re: SMURF amplifier block list

On Mon, 13 Apr 1998, Vadim Antonov wrote:

 Uh.  Just modify BGP routes from that feed to have a next hop pointing
 to a black hole.  route-maps are sometimes useful.

Could someone PLEASE explain to me how this is accomplished?

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]