North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: SMURF amplifier block list

  • From: jlixfeld
  • Date: Mon Apr 20 11:57:20 1998

You could always "deny icmp any aaa.bbb.ccc.ddd www.ccc.nnn.mmm log" on
your cores.  Deny ICMP from critical portions of your network.  Create a
little script which tail -fs the log, parses it, sorts it and counts it.
If the script counts more then xxx hits on a certain IP or a certain
number of IPs on your network from the same source or a multiple sources
on the same network, you have your upstream.  Once you have them, you can
call them and ask them to do the same until you find the real source.

This will not protect against someone smurfing your dialup users and they
can do just as much damamge as the former, but they are more likely to
bitch if they can't ping so it's a toss up.

On Sat, 18 Apr 1998, Dean Anderson wrote:

:At 3:21 PM -0400 4/18/98, Alex P. Rudnev wrote:
:>> During an in progress attack, you probably have to take extreme measures,
:>Do you remember - it's not attack against you or attack by some of your
:>customer's networks used as amplifier, but the attack initiated from your
:>own network. You never note such thing withouth some permanent
:>It's why we saw this 100% helpless against the SMURF's.
:But to protect your own network, all you need is the access rule I gave.
:You know your own broadcast address and netmask, and can put in a rule to
:You just can't block the presumed broadcast address used by other peoples
:Logging attempted attacks which are blocked can't really be done with a
:cisco.  You need something to monitor the line coming in.
:		--Dean
:           Plain Aviation, Inc                  [email protected]
:           We Make IT Fly!                (617)242-3091 x246


Jason A. Lixfeld             [email protected]
iDirect Network Operations   [email protected]

TUCOWS Interactive Ltd. o/a  | "A Different Kind of Internet Company"
Internet Direct Canada Inc.  | "FREE BANDWIDTH for Toronto Area IAPs"
5415 Dundas Street West      |
Suite 301, Toronto Ontario   | (416) 236-5806	     (T)
M9B-1B5 CANADA               | (416) 236-5804        (F)