The DUP packets resemble WLBS (Windows Load Balancing Service) in action. What platform did you ping it from? A unix host? Windows ping command does not show the extra icmp responses. Just a thought. -----Original Message----- From: Steven M. Bellovin [mailto:smb@research.att.com] Sent: Wednesday, August 01, 2001 8:18 PM To: Tony Rall Cc: nanog@merit.edu Subject: Re: MicroSoft amplification? In message <OF3DD9155A.FA5F9232-ON88256A9B.00804F54@almaden.ibm.com>, "Tony Ral l" writes:

I see it too, on that address and on the second of the 3 addresses mapped to www.microsoft.com (the third address doesn't respond at all).

Most likely this is due to a not very smart load distribution system.

I'm told that that is indeed the case. Well, strike the "not very smart" part -- I wasn't told that -- but I was told that it is indeed because of the load distribution system. --Steve Bellovin, http://www.research.att.com/~smb