North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: SMURF amplifier block list

  • From: Dean Anderson
  • Date: Sun Apr 19 20:05:44 1998

No, because you only want to stop the packets coming into the broadcast
address, not the entire network. (You may want to block the entire network,
say for security reasons, but that's a slightly different issue).

I suspect that you are confused with the wildcarding. The second parameter
is a mask for the first. All ones on the mask mean it matches exactly the
first address. Leaving the last octet of the mask 0 means it matches all ip
addresses that begin with x.y.z, including the broadcast address.


At 6:46 PM -0400 4/19/98, [email protected] wrote:
>Uhmm, would the wildcard not be
>On Sat, 18 Apr 1998, Dean Anderson wrote:
>:Umm, I think this has already been hashed out. This is not the only netmask
>:on the planet, and you don't know what other networks netmasks are under
>:CIDR. Trying to guess the netmask just leads to breakage.
>:All you want to do is stop packets coming in to your broadcast address.
>:For example, for your network x.y.z/n  (n=24) with your broadcast address
>:of x.y.z.255: (I presume everyone can translate between CIDR notation and
>:dotted decimal ;-)
>:deny ip any x.y.z.255
>:no ip directed broadcast basically puts in the same rule, but it does it
>:automatically by looking at the netmasks on the interfaces.

           Plain Aviation, Inc                  [email protected]
           We Make IT Fly!                (617)242-3091 x246