North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Re: [nsp] known networks for broadcast ping attacks
At 7:56 PM +0100 7/30/97, Alex.Bligh wrote: >> Here's a list of KNOWN NETWORKS that are being used to ping >> flood other networks. If one of your networks is in here, FILTER >> BROADCAST PINGS NOW FROM ENTERING YOUR NETWORK. YOUR NETWORK IS BEING >> USED TO ATTACK OTHER NETWORKS. > >> "204.71.177.255", "255.255.255.255", "207.137.200.255", >>"192.41.177.255", > >Urm, 192.41.177.255 is the MAE-East LAN ?! Are you saying attacks are >being mounted from here or people are attacking this LAN (not >sure which is more worrying) The LAN is being used indirectly to attack another network. Pings are spoofed as originating from the machine that is being attacked and sent to the broadcast address on another network. This causes every machine on the receiving network to send an ECHO_RESPONSE to the machine being attacked, esentially creating a huge multiplying effect on a ping flood attack. Apparently, the MAE-East LAN is one of the networks that attackers are using to flood other hosts. Jordyn |----------------------------------------------------------------| |Jordyn A. Buchanan mailto:[email protected] | |Bestweb Corporation http://www.bestweb.net | |Senior System Administrator +1.914.271.4500 | |----------------------------------------------------------------|
|