Bugtraq mailing list archives

Re: Simple TCP service can hang a system


From: avalon () COOMBS ANU EDU AU (Darren Reed)
Date: Sun, 22 Jun 1997 23:42:19 +1000


In some mail from Michael H. Warfield, sie said:
[...]
        AFAIK...  You can't use this trick to generate a true "classical"
"broadcast storm" (those of you who remember the bad old days of the food
fight's between VAX's and SunOs 3.2/3.5 [Da NOS from HELL!] know what I'm
talking about here...  :-) ) but you can come damn close.  I don't know of
anyway to perpetuate the broadcast address beyond the first generation.  The
responder always responds with his unicast address so the broadcast storm goes
linear after one generation and settles into a pong game, as you describe,
on steroids.  Unlike a true "broacast storm", where the packets go geometric
after the one trigger, you would need to keep stoking this until the network
is so clogged that the difference between this and a broadcast storm would
be academic at best.

About the closets I've seen anything that could possibly reproduce this was
on an Ascend MAX, about 1.5 years ago.  The MAX would send an ICMP reply
using the destination as the source in the new packet (doh!).  However, you
would have needed at least two on the same subnet to chance reproducing the
storm situation, although, if memory serves me, the reply packet sent back
wasn't an ethernet broadcast.

Darren

p.s. yes, the bug was fixed promptly too :)



Current thread: