We are currently seeing a smurf attack larger than any one we've ever seen
before... it looks like it's causing us over 200Mb/s of incoming
echo-reply traffic to 207.69.200.132 (our IRC server, imagine that).
Please check your networks and see if you can help us trace this attack to
the perpetrator, we'd love to prosecute if we can find them.
Brandon Ross Network Engineering 404-815-0770 800-719-4664
Director, Network Engineering, MindSpring Ent., Inc. info@mindspring.com
ICQ: 2269442
Stop Smurf attacks! Configure your router interfaces to block directed
broadcasts. See http://www.quadrunner.com/~chuegen/smurf.cgi for details.
This attack has now stopped. I managed to collect over 100,000 addresses
that we being used as amplifiers in this attack. If anyone would like a
copy, please let me know.
Brandon Ross Network Engineering 404-815-0770 800-719-4664
Director, Network Engineering, MindSpring Ent., Inc. info@mindspring.com
ICQ: 2269442
Stop Smurf attacks! Configure your router interfaces to block directed
broadcasts. See http://www.quadrunner.com/~chuegen/smurf.cgi for details.
Since a couple folks have asked for it, and I think the list is a bit
large to send to the entire list, I've put the list up for anonymous ftp
at:
ftp://www.mindspring.net/users/bross/smurfsources
They've been sort | uniq 'ed.
Brandon Ross Network Engineering 404-815-0770 800-719-4664
Director, Network Engineering, MindSpring Ent., Inc. info@mindspring.com
ICQ: 2269442
Stop Smurf attacks! Configure your router interfaces to block directed
broadcasts. See http://www.quadrunner.com/~chuegen/smurf.cgi for details.