Re: SMURF AMPLIFIER BLOCK LIST -- VERY LARGE!!!!!!!!!!!!!!!
Date: Thu, 30 Apr 1998 22:31:28 -0500 (CDT) From: tim@alpha.net Subject: Re: SMURF AMPLIFIER BLOCK LIST -- VERY LARGE!!!!!!!!!!!!!!! To: nanog@merit.edu
It'd be nice if there were a more organized effort to collect these addresses, but for the time being, here's my list. I've actually got a bunch more, but these are hand-picked for having a large amplification factor and also for not appearing on the mcs.net page.
194.47.135 194.47.136 164.156.26 204.30.35 204.199.101
It would be interesting to see if the use of these networks as smurf aplifiers increases once they are published on nanog. (Are we doing all the hard work for the smurfers, namely creating a consolidated list of all of the known smurf amplifiers?) -tjs
On Fri, May 01, 1998 at 11:47:19AM -0500, Tim Salo wrote:
Date: Thu, 30 Apr 1998 22:31:28 -0500 (CDT) From: tim@alpha.net Subject: Re: SMURF AMPLIFIER BLOCK LIST -- VERY LARGE!!!!!!!!!!!!!!! To: nanog@merit.edu
It'd be nice if there were a more organized effort to collect these addresses, but for the time being, here's my list. I've actually got a bunch more, but these are hand-picked for having a large amplification factor and also for not appearing on the mcs.net page.
194.47.135 194.47.136 164.156.26 204.30.35 204.199.101
It would be interesting to see if the use of these networks as smurf aplifiers increases once they are published on nanog.
(Are we doing all the hard work for the smurfers, namely creating a consolidated list of all of the known smurf amplifiers?)
-tjs
It doesn't do 'em a damn bit of good if we all also block 'em at our entrances. -- -- Karl Denninger (karl@MCS.Net)| MCSNet - Serving Chicagoland and Wisconsin http://www.mcs.net/ | T1's from $600 monthly / All Lines K56Flex/DOV | NEW! Corporate ISDN Prices dropped by up to 50%! Voice: [+1 312 803-MCS1 x219]| EXCLUSIVE NEW FEATURE ON ALL PERSONAL ACCOUNTS Fax: [+1 312 803-4929] | *SPAMBLOCK* Technology now included at no cost
Here is an overview of my situation and I felt that someone here may be able to help out. I work for an ISP and also run a cottagenet. One of the cottagenets in the area was interested in running a t-1to my location. We would then act as a peering of sorts. I could send traffic through him while he sends through me. We are both on different backbones so I felt it could be beneficial. I know BGP would have to be run, but I am curious what other sort of thing I will have to read up on before this is possible.
(Are we doing all the hard work for the smurfers, namely creating a consolidated list of all of the known smurf amplifiers?)
Of course. But that's the fastest way to bring this to an end. Dirk On Fri, May 01, 1998 at 12:18:08PM -0500, Karl Denninger wrote:
On Fri, May 01, 1998 at 11:47:19AM -0500, Tim Salo wrote:
Date: Thu, 30 Apr 1998 22:31:28 -0500 (CDT) From: tim@alpha.net Subject: Re: SMURF AMPLIFIER BLOCK LIST -- VERY LARGE!!!!!!!!!!!!!!! To: nanog@merit.edu
It'd be nice if there were a more organized effort to collect these addresses, but for the time being, here's my list. I've actually got a bunch more, but these are hand-picked for having a large amplification factor and also for not appearing on the mcs.net page.
194.47.135 194.47.136 164.156.26 204.30.35 204.199.101
It would be interesting to see if the use of these networks as smurf aplifiers increases once they are published on nanog.
(Are we doing all the hard work for the smurfers, namely creating a consolidated list of all of the known smurf amplifiers?)
-tjs
It doesn't do 'em a damn bit of good if we all also block 'em at our entrances.
-- -- Karl Denninger (karl@MCS.Net)| MCSNet - Serving Chicagoland and Wisconsin http://www.mcs.net/ | T1's from $600 monthly / All Lines K56Flex/DOV | NEW! Corporate ISDN Prices dropped by up to 50%! Voice: [+1 312 803-MCS1 x219]| EXCLUSIVE NEW FEATURE ON ALL PERSONAL ACCOUNTS Fax: [+1 312 803-4929] | *SPAMBLOCK* Technology now included at no cost
On Fri, May 01, 1998 at 11:47:19AM -0500, Tim Salo wrote:
It would be interesting to see if the use of these networks as smurf aplifiers increases once they are published on nanog.
I agree. It would be interesting to see.
(Are we doing all the hard work for the smurfers, namely creating a consolidated list of all of the known smurf amplifiers?)
It actually increases the likeleyhood that they will get filtered, noticed, and fixed by the owner of the ip space. If a few of us filter them, and they start to get used as amplifiers, they will start to notice a bit more (hopefully) that their connectivity is starting to suck, by sending out all these icmp replies, and track it down. - Jared -- Work: jared@qual.net - We Make The Internet Work for Your Business 9-5pm(ET) 800 637 4424x2634 - 24x7 NOC - 800 424 3223 pgp key available via finger from jared@puck.nether.net
Tim Salo wrote:
It would be interesting to see if the use of these networks as smurf aplifiers increases once they are published on nanog.
Yes they do -- we had one , customer flinders.edu.au, on Karl's list and our logs show significantly more activity for that client than other sites that were not protected but not on Karl's list. Personally, though, I'm growing less and less fond of Karl's list. The procedures on his web page don't work for people outside the US (Karl's NOC is not 24hr) and direct e-mail doesn't seem to work either. It's annoying to have fixed a problem promptly but still be getting bad press about it. Cheers, glen -- glen.turner@itd.adelaide.edu.au Network Support Specialist Tel: (08) 8303 3936 Information Technology Division Fax: (08) 8303 4400 University of Adelaide SA 5005
On Mon, May 04, 1998 at 10:08:04AM +0930, Glen Turner wrote:
Tim Salo wrote:
It would be interesting to see if the use of these networks as smurf aplifiers increases once they are published on nanog.
Yes they do -- we had one , customer flinders.edu.au, on Karl's list and our logs show significantly more activity for that client than other sites that were not protected but not on Karl's list.
Personally, though, I'm growing less and less fond of Karl's list. The procedures on his web page don't work for people outside the US (Karl's NOC is not 24hr) and direct e-mail doesn't seem to work either.
It's annoying to have fixed a problem promptly but still be getting bad press about it.
Cheers, glen
-- glen.turner@itd.adelaide.edu.au Network Support Specialist Tel: (08) 8303 3936 Information Technology Division Fax: (08) 8303 4400 University of Adelaide SA 5005
Let's see... There are eight hours during which the NOC is not directly open. So you're saying that you're open (and able to call us) for less than 8 hours? And I see that you also don't identify the network involved above. Oh well. Guess there's nothing we can do if you won't tell us what's going on. -- -- Karl Denninger (karl@MCS.Net)| MCSNet - Serving Chicagoland and Wisconsin http://www.mcs.net/ | T1's from $600 monthly / All Lines K56Flex/DOV | NEW! Corporate ISDN Prices dropped by up to 50%! Voice: [+1 312 803-MCS1 x219]| EXCLUSIVE NEW FEATURE ON ALL PERSONAL ACCOUNTS Fax: [+1 312 803-4929] | *SPAMBLOCK* Technology now included at no cost
participants (6)
-
dirk＠power.net -
Glen Turner -
Jared Mauch -
john＠shutter.net -
Karl Denninger -
Tim Salo