[22624] in North American Network Operators' Group
Re: Solution: Re: Huge smurf attack
daemon@ATHENA.MIT.EDU (Brandon Ross)
Wed Jan 13 02:34:42 1999
Date: Wed, 13 Jan 1999 02:20:29 -0500 (EST)
From: Brandon Ross <bross@mindspring.net>
To: nanog@merit.edu
In-Reply-To: <3.0.32.19990112142846.00a77018@odie.av8.com>
On Tue, 12 Jan 1999, Dean Anderson wrote:
> Actually, I think all major providers use automatic provisioning systems
> which generate router configs. They don't need to rely on router vendors to
> set particular defaults. If all major providers made sure their
> provisioning systems turned off directed broadcast, a lot of the problem
> would go away.
>
> So "Router defaults" is a lame excuse for ISP's. Even little ISP's have a
> list of things they have to setup, (eg ip classless, subnet zero, etc)
> which have "legacy" or otherwise inappropriate defaults.
We don't ask our vendors to provide equipment with directed broadcast
turned off by default for our own use or use by any clueful operator. The
reason we require directed broadcast to be turned off by default is so
that when a less-than-clueful operator gets a hold of the same box, they
don't become yet another smurf amplifier that ends up being used to attack
us. If and when I have the leverage with a vendor to get this implemented,
I use it, every single time.
Brandon Ross Network Engineering 404-815-0770 800-719-4664
Director, Network Engineering, MindSpring Ent., Inc. info@mindspring.com
ICQ: 2269442
Stop Smurf attacks! Configure your router interfaces to block directed
broadcasts. See http://www.quadrunner.com/~chuegen/smurf.cgi for details.
