What are you talking about? If they have NETFLOW switching and NETFLOW accounting, it's easy to search for the router originated for the SMURF/initialised packets (this packets can be searched by the such list, or by the simular search pattern): xxx permit ip any 0.0.0.255 255.255.255.0 log And then it takes 5 minutes to look for the originating interface. On Sat, 27 Dec 1997, Phil Howard wrote:
Date: Sat, 27 Dec 1997 16:08:05 -0600 (CST) From: Phil Howard <phil@charon.milepost.com> To: nanog@merit.edu Subject: Re: smurf, the MCI-developed tracing tools (was Re: Bogus announcement)
Hello Karl & All, Where or at what price are these tools available. Tia, JimL PS: In a further responce Karl was heard to say :
The bottom line is that MONTHS after these were made available your NOC crew
I never heard nor was made aware that these tools were available, even though I am an MCI Customer . :-(
Same here. Are they free or do they cost money?
People want the tools.
-- Phil Howard | w7x4y4z5@noplace2.net end5ads8@dumbads8.com suck1it7@dumbads7.edu phil | end6ads8@no52ads1.edu no2spam7@dumb7ads.net crash291@spammer6.org at | no1spam9@no57ads7.net crash075@spammer8.edu eat9this@spam1mer.edu milepost | stop5it8@spammer5.edu no53ads9@lame7ads.org no8way17@s3p3a9m9.com dot | eat0this@dumbads9.edu no5spam6@anyplace.com stop7865@no40ads3.edu com | a1b6c7d7@dumb8ads.edu no1spam5@lame8ads.edu no1way93@dumbads1.com
Aleksei Roudnev, Network Operations Center, Relcom, Moscow (+7 095) 194-19-95 (Network Operations Center Hot Line),(+7 095) 239-10-10, N 13729 (pager) (+7 095) 196-72-12 (Support), (+7 095) 194-33-28 (Fax)