[20083] in North American Network Operators' Group
Re: Milk attack
daemon@ATHENA.MIT.EDU (Craig A. Huegen)
Fri Oct 2 00:57:32 1998
Date: Thu, 1 Oct 1998 21:43:57 -0700
From: "Craig A. Huegen" <chuegen@quadrunner.com>
To: Steve Nash <snash@lightning.net>, nanog@merit.edu
In-Reply-To: <3613F3A1.6BA4091E@lightning.net>; from Steve Nash on Thu, Oct 01, 1998 at 05:26:57PM -0400
On Thu, Oct 01, 1998 at 05:26:57PM -0400, Steve Nash wrote:
==>SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts B/Pk
==>Active
==>Fa0/0 208.10.5.2 Local X.X.X.X 11 0498 0017
==>164K1028 985.3
==>
==>except from 10 to 15 hosts all nailing us at the same time. The
==>protocol as you see is "11" which
==>I have been unable to find information about. There was no way to
==>filter it and access-lists denying
==>protocol "11" showed 0 matches. Anyone have any ideas?
Protocol 0x11 is 17 in decimal.
#define IPPROTO_UDP 17 /* user datagram protocol */
Simple UDP flood.
/cah
