North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Reporting Little Blue Men

  • From: Adrian Bool
  • Date: Tue Jan 20 14:39:17 1998 
On Tue 20 Jan, Eric Wieling wrote:
> Just about every night someone(s) tries to use us as the "innocent
> third party" in smurf attacks.  Of course, we block and log all the
> broadcast packets.
> 
> Is there any point in trying to report these attacks?  Who would we
> report them to?  We don't know what the source is, after all the
> address is spoofed.  It seems kind of pointless to notify the victim
> -- they already know they have been smurfed.
> 
> I want to do my part to try to stop attacks, but I'm baffled on this
> one.

If you can tell which interface it enters your network (and from which router
if at an exchange) notify the next hop towards the source... then if they
follw the same procdure eventually the culprit may be found...

aid


-- 
Adrian J Bool			| mailto:[email protected]
Network Operations		| http://www.noc.u-net.net/
U-NET Ltd, UK			| tel://44.1925.484461/