This ICMP discussion reminded me that we've been logging broadcasts
for a while at ME to see what percentage of traffic they represented
and what it was (the wrong way round to track back thru ICMP DoS
attacks).
If anyone's interested, the results are :
192.41.177.255 (254376 matches)
255.255.255.255 (1694830 matches)
any other dest. (1047899270 matches)
which is 0.18% of the total accounted for by broadcasts. Bad, of
course, but not as bad as I thought. I guess the bigger the provider
the smaller percentage of total (that 1billion is total input on our
FDDI since I applied the list, rather than total packets on the LAN)
I'm assuming that a billion packets is enough to be a representative
sample.
A bit of a breakdown from the logs :
Split of broadcasts is
ICMP 12%
UDP 88%
(actually, there were 5 packets for protocol 9 (private IGP?) but
that's neither here nor there)
Port breakdown (based on a smaller sample to save resources)
ICMP