[prev in list] [next in list] [prev in thread] [next in thread]
List: nanog
Subject: Re: Smurfing
From: "Craig A. Huegen" <chuegen () quadrunner ! com>
Date: 1998-02-14 6:57:30
[Download RAW message or body]
On Sat, 14 Feb 1998, William Allen Simpson wrote:
==>Wow, I was glad to see that all these wonderful folks are reading the
==>router requirements (RFC-1812, June 1995). Good, good.
==>
==>What I'd like to understand is how smurf attacks can work, even with
==>directed broadcast on? Isn't there a requirement (RFC-1122) from ages
==>past (October 1989) that ICMP not respond to broadcast or multicast
==>[page 38 et seq]?
Nope. RFC 1122[1] says (also in my paper =):
---
An ICMP Echo Request destined to an IP broadcast or IP
multicast address MAY be silently discarded.
DISCUSSION:
This neutral provision results from a passionate debate
between those who feel that ICMP Echo to a broadcast
address provides a valuable diagnostic capability and
those who feel that misuse of this feature can too
easily create packet storms.
---
Most stack implementors have chosen to respond to it because of its
troubleshooting value; then again, the date of the RFC shows why many
folks would tend to believe the threat of the attack wouldn't be very
large.
/cah
[1] RFC-1122, "Requirements for Internet Hosts - Communication Layers";
R.T. Braden; October 1989.
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic