North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Smurfing

  • From: William Allen Simpson
  • Date: Sat Feb 14 11:07:12 1998

Thanks for the excellent reply, although you forgot to mention that
every other ICMP message, including error messages, timestamps, and
such, MUST discard broadcast/multicast.  Echo is the _only_ MAY be

As the discussion notes, there was some controversy.  I vaguely remember
the discussion at the time.  But _all_ the stacks that I've ever worked
on follow the MAY and _do_ the discard.  Maybe I should join a *nix
group.  We need to put pressure on vendors (especially router vendors
and large commercial host vendors) to _discard_ by default.

I am unaware of any troubleshooting value.  After all, should you want
to scan for hosts, use SNMP.  Or increment your ping address.  Lots of
simple harmless ways to do the same thing.  Especially since you need to
know the (now variable) local mask to effectively use a directed
broadcast anyway.

Directed broadcast was a kludge in the first place.  Maybe it's time to
deprecate it entirely.

> From: "Craig A. Huegen" <[email protected]>
> Most stack implementors have chosen to respond to it because of its
> troubleshooting value; then again, the date of the RFC shows why many
> folks would tend to believe the threat of the attack wouldn't be very
> large.
[email protected]
    Key fingerprint =  17 40 5E 67 15 6F 31 26  DD 0D B9 9B 6A 15 2C 32