This isn't really so surprising, because 0 used to be the broadcast address before being changed to 255. (~1986 or so, I think, right around the time 4.3 BSD came out if I remember correctly.) Many systems still respond to 0 as a broadcast address. Older Sun systems still default the broadcast address to 0. It's an anachronism that could be dropped. But it is interesting that the person would have thought to use it in a smurf attack... If they know that much, they really should have known better than to smurf. I hope they throw the whole bookcase at them... --Dean At 3:02 PM -0400 4/20/98, Brandon Ross wrote:
On Sun, 19 Apr 1998, Jeremiah Kristal wrote:
On Sat, 18 Apr 1998, Alex P. Rudnev wrote: >
I know that this week there was a smurf attack that was tracked to the source. I'm not sure what will happen to him. Hopefully someone from the NOC that caught him will let us know.
That was us, and we do plan on prosecuting. We're in the process of collecting information now.
Something that happened during this attack should be a great concern to all of us. In addition to the usual broadcast addresses being used as amplifiers for this smurf attack, the attacker also used network addresses. It seems that many stacks and routers will respond to a packet with a network address in the same way as a broadcast address.
Luckily Cisco's "no ip directed-broadcast" already took that into account and blocks those packets, however, if you don't have a Cisco and are having to configure manual filters to avoid being an amplifier site, you _must_ filter out network addresses as well as broadcast addresses.
Please, spread the word.
P.S. I'd like to publicly thank Icon, Digex, and BBN as well as the EPA (yes folks, the Environmental Protection Agency, they were being used as an amplifier in this attack) for their help in tracing this attack to the source.
Brandon Ross Network Engineering 404-815-0770 800-719-4664 Director, Network Engineering, MindSpring Ent., Inc. info@mindspring.com Mosher's Law of Software Engineering: Don't worry if it doesn't work right. If everything did, you'd be out of a job.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean@av8.com LAN/WAN/UNIX/NT/TCPIP/DCE http://www.av8.com We Make IT Fly! (617)242-3091 x246 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++