[16546] in North American Network Operators' Group
Re: More amplifier blocks
daemon@ATHENA.MIT.EDU (ken emery)
Fri May 1 14:18:58 1998
Date: Fri, 1 May 1998 10:57:45 -0700 (PDT)
From: ken emery <ken@cnet.com>
To: chris <chris@org.org>
cc: nanog@merit.edu
In-Reply-To: <19980501122720.03995@org>
On Fri, 1 May 1998, chris wrote:
> Here's a small subset of a packet log received from a rather large
> attack Friday. The second field is the number of packets received
> from the /24s in the time the log spans.
>
> Some of the addresses are interesting; for example, the handful of
> 10.* blocks; however, I did receive icmp echo_reply traffic from them.
<SNIP>
> 204.162.80 11
This was behind a 56K frame link, it is now fixed.
> 204.162.81 494
What the #$%^& is this? This is a class C which is divided into
a /25 and two /26's. One of the /26's was open (not any more). If
the number at the end is the quantity of hosts the program collecting
data needs to be checked. If this number is something else please
specify.
> 204.162.84 18
One of my compatriots had a /27 which was open. It should be closed
now.
> 204.162.86 19
Behind a 56K but now fixed.
I have turned off ip directed broadcasts on all links in our network
so the 204.162.80.0/21 netblock should be clean.
Is Karl adding these to his list? If so do we need to go through the
normal contact procedure (call MCS's NOC) to be removed?
bye,
ken emery
