North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Huge smurf attack

  • From: Jeremiah Kristal
  • Date: Mon Jan 11 12:36:32 1999 
On Mon, 11 Jan 1999, Phil Howard wrote:

<<snip discussion about how clueful operators filter RFC1918 addresses>>

I agree that clueful operators filter RFC1918 addresses at their borders
and that they do not accept advertisements for RFC1918 space, however,
there is a specific network (10.177.180/24) that appears again and again
in smurf logs.  I find it rather interesting that with 65k available /24s
in the 10/8 space, one specific /24 pops up much more often than any
other.  Granted it's not that large an amplifier, but it seems odd that
even an RFC1918 network would be used as an amplifier for this long
without someone finding and securing it.

Jeremiah