Re: New Denial of Service Attack on Panix

Tim Bass writes:

Thanks for pointing out that the UNREACHABLE could just be hosts that are turned off. The difficult case, now that you mention it, are the UNREACHABLEs due to a route flap or other intermediate system blip.

A host being down is _not_ necessarily an UNREACHABLE host. In most cases you won't see _anything at all_ if a host on an ethernet is down. A smart router might detect a chronically unresolved ARP and produce an ICMP_UNREACH, but do you know about routers like that?

Tim

Dima