North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Nachi (was Re: New IPv4 Allocation to ARIN)

  • From: Michael Lewinski
  • Date: Fri Jan 16 18:39:11 2004 
On Jan 16, 2004, at 3:31 PM, [email protected] wrote:
It's those dang Nachi-sized ICMP echo/echo-replies. We block those at all
our transit points and dial-up ports. Nachi was killing our cisco
access-servers until we did this to stop the spread.

FYI, Nachi is basically dead now from what I can tell. It was timed to expire in January of this year, and our flowscan graphs bear this out. Prior to it's self-destruction, Nachi traffic comprised about half of all our incoming flows. ICMP is back to pre-Nachi levels here now, and I have heard similiar reports elsewhere.