North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: [NANOG] Limiting ICMP

  • From: Kameron Gasso
  • Date: Sun May 18 01:14:59 2008

Drew Weaver wrote:
> (do people still DDoS with ICMP these days? I see a lot of what looks like udp.pl and hardly any ICMP attack traffic anymore)

We saw a small attempted attack using ICMP a few weeks ago, but as 
you've mentioned I've mostly been seeing UDP floods (and the occasional 
TCP SYNflood still).

I do feel the need to comment that more and more lately I've been 
running into extremely frustrating situations where useful ICMP and UDP 
traffic was being filtered bidirectionally, not just rate-limited.  I 
think my favorite incident so far of this was a host that returned an 
ICMP UNREACHABLE (with a "filtered" code) in response to an ECHO REQUEST 
to itself.

Cheers,

--Kameron

_______________________________________________
NANOG mailing list
[email protected]
http://mailman.nanog.org/mailman/listinfo/nanog