To make this understood in a more clear context there are Linux users that have done exactly that and use ATM switches to lauch attacks from since they are hard to trace from IP based networks and I see it constantly in my traceroutes and some exceeed the 30 hop limit on the web pages offering traceroutes from the major players on the backbone... Henry R. Linneweh Adrian Chadd wrote:
On Fri, 5 Dec 1997, Wayne Bouchard wrote:
[snip]
threaten the most disruption of internet services. With ISDN and DSL, users have the bandwidth necessary to generate even more dangerous levels of traffic. If you don't think this issue affects you, it does. If you're not a target, your probably being used as a source.
I agree totally. A couple of problems:
* Filtering ALL ICMP is pretty silly, ICMP is there for more than just pings, and some of it is important. * If people start doing this, someone with a smidgen of time on their hands will write a ping flooder that uses random TCP or UDP packets with spoofed from addresses.
I'm curious however - can anyone out there running netflow or something similar give me a breakdown on what kind of ICMP traffic they're seeing?
Adrian
-- ¢4i1å