|
North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Re: [nsp] known networks for broadcast ping attacks
Charles Sprickman <[email protected]> wrote: > On Tue, 12 Aug 1997, Jon Lewis wrote: > > > This may be true, but what's to stop the writers of smurf and the other > > programs from distributing version 2 with all new network addresses? > > Fixing the 119 networks used to attack FDT will help, but I doubt it will > > solve the problem. > > > When I type "no ip source route" on a Cisco, what exactly is that doing > for me? Is it just disallowing the router itself to generate > source-routed packets or is it saying sink all source-routed packets? > All this talk of spoofing is getting me a bit confused. What exactly is > the difference between source-routing and spoofing? > > Just trying to understand a bit more, > > Charles It prevents the Cisco from handling packets with source routing header options set, whether locally generated, or switched. It doesn't prevent the router generating or switching packets with invalid source addresses e.g. packets with source addresses from inside the network entering the router via an external interface - you need to apply access lists to the appropriate interfaces (in the appropriate directions) to prevent this. M.
|