[40124] in North American Network Operators' Group
RE: MicroSoft amplification?
daemon@ATHENA.MIT.EDU (Rishi Singh)
Wed Aug 1 23:55:08 2001
Message-ID: <4A0CE95CA3F8AE4198E213D807BF0D5B01183851@excnyc001.corp.tradescape.com>
From: Rishi Singh <RSingh@Tradescape.com>
To: "'Steven M. Bellovin'" <smb@research.att.com>,
Tony Rall <trall@almaden.ibm.com>
Cc: nanog@merit.edu
Date: Wed, 1 Aug 2001 23:54:32 -0400
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Errors-To: owner-nanog-outgoing@merit.edu
The DUP packets resemble WLBS (Windows Load Balancing Service) in action.
What platform did you ping it from? A unix host? Windows ping command does
not show the extra icmp responses.
Just a thought.
-----Original Message-----
From: Steven M. Bellovin [mailto:smb@research.att.com]
Sent: Wednesday, August 01, 2001 8:18 PM
To: Tony Rall
Cc: nanog@merit.edu
Subject: Re: MicroSoft amplification?
In message <OF3DD9155A.FA5F9232-ON88256A9B.00804F54@almaden.ibm.com>, "Tony
Ral
l" writes:
>
>I see it too, on that address and on the second of the 3 addresses mapped
>to www.microsoft.com (the third address doesn't respond at all).
>
>Most likely this is due to a not very smart load distribution system.
I'm told that that is indeed the case. Well, strike the "not very
smart" part -- I wasn't told that -- but I was told that it is indeed
because of the load distribution system.
--Steve Bellovin, http://www.research.att.com/~smb
