I've been getting bombed for 3 days by someone who's using an RFC 1918 address as a source address and firing ICMP ECHO REPLY packets at a few addresses within our network. I've been trying to get some info on who is doing this, but haven't gotten anywhere yet. Seems a lot of folks are not yet doing any ingress filtering on their lines. This kind of stuff is easy to cure at the source, but a real pain at the target end... Please consider adding ingress filters if you don't already use them! Dan Daniel Senie mailto:dts@openroute.com Sr. Staff Engineer http://www.openroute.com/ OpenROUTE Networks, Inc. (a wholly owned subsidiary of Proteon, Inc.)