North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: smurf's attack...

  • From: Jordyn A. Buchanan
  • Date: Fri Sep 05 17:17:13 1997

At 3:41 PM +0000 9/5/97, DAVE NORDLUND wrote:
>> Likewise, not all broadcast adresses necessarily end with .255,
>> so filtering .255 won't help anyway in the presence of something
>> like a /25 with a X.X.X.127 broadcast.
>
>Agreed but it is not easy for a hacker to determine CIDR masks.  It
>is my impression that the only thing being sent is classfull broadcasts.

Further, smaller networks (which, theoretically speaking at least, have
fewer hosts) would be less useful in a smurf attack than larger ones, as
there would be less of a multiplying effect.

Jordyn

|----------------------------------------------------------------|
|Jordyn A. Buchanan                    mailto:[email protected] |
|Bestweb Corporation                      http://www.bestweb.net |
|Senior System Administrator                     +1.914.271.4500 |
|----------------------------------------------------------------|