To add to this, it's very simple to identify smurf amplifiers. All you
need to do is sequentially ping possible broadcast addresses within a
netblock. If you wrote a threaded application, you could probably have a
complete list in a day or two on a modem connection. If you think of how
many of these fools have a colo box on someone's network, you'd realize
that it would be fairly easy to compile such a list once a month, without
anyone noticing the traffic (assume 16 hosts/sec, 3 pings per second @
56 bytes, plus 8 bytes or ICMP header = 3072 bytes/sec)...there are very
few providers who are set up to track ICMP traffic density, and 3k of
traffic per second is not going to create a noticable bump on a 45-155 meg
interface. The occasional amplifier that is hit will only create
increased traffic for the 3 pings recieved, which would easily be logged,
but would be too short to even produce a spike on most traffic graphs, or
trigger a traffic alarm.
just my $.02.
-Taz