|
North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Re: SMURF amplifier block list
What's the difference? If you do echo-reply, whoever initiated the ping will never see a response because it is filtered by the echo-reply in the first place. Or am I missing something with the echo-reply?! (it's late, forgive my ignorance) =) On Mon, 20 Apr 1998, Pete Ashdown wrote: :[email protected] said once upon a time: :> :>You could always "deny icmp any aaa.bbb.ccc.ddd www.ccc.nnn.mmm log" on :>your cores. Deny ICMP from critical portions of your network. Create a :>little script which tail -fs the log, parses it, sorts it and counts it. :>If the script counts more then xxx hits on a certain IP or a certain :>number of IPs on your network from the same source or a multiple sources :>on the same network, you have your upstream. Once you have them, you can :>call them and ask them to do the same until you find the real source. : :You might want to stick in an "echo-reply" before the log. This will :specifically block the smurf, but won't affect any of the other ICMP which :does have a useful purpose. This of course will stop any of the blocked :addresses from doing outside pings or traceroutes as well. : -- Regards, Jason A. Lixfeld [email protected] iDirect Network Operations [email protected] --------------------------------------------------------------------- TUCOWS Interactive Ltd. o/a | "A Different Kind of Internet Company" Internet Direct Canada Inc. | "FREE BANDWIDTH for Toronto Area IAPs" 5415 Dundas Street West | http://www.torontointernetxchange.net Suite 301, Toronto Ontario | (416) 236-5806 (T) M9B-1B5 CANADA | (416) 236-5804 (F) ---------------------------------------------------------------------
|