Home page logo
/

nanog logo nanog mailing list archives

Re: SMURF AMPLIFIER BLOCK LIST -- VERY LARGE!!!!!!!!!!!!!!!
From: Phillip Vandry <vandry () Mlink NET>
Date: Thu, 30 Apr 1998 11:08:43 -0400 (EDT)

Martin, Christian Wrote:
All,

Here is my contribution to the block list.  The script that generated
this will follow.  It is 'public domain', in that it can be modified,
BUT, please give credit where credit is due!

!!!!!NOTE: This script assumes that the offending bounce sites are /24
[...]
205.236.182.0

That is mine.

Every router on there has had directed broadcasts disabled for a long time.
Only that network is a /25, so the broadcast address we are talking about
is 205.236.182.127.

It turns out that not only does 205.236.182.255 unexpectedly function as
an alternate broadcast address for this network, but it is unaffected by
no ip directed-broadcast!!!

This sounds like two bugs in one.

(and I performed a hack to fix this network, but I shouldn't have had to
do this)

-Phil


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault