[66603] in North American Network Operators' Group
Nachi (was Re: New IPv4 Allocation to ARIN)
daemon@ATHENA.MIT.EDU (Michael Lewinski)
Fri Jan 16 18:37:03 2004
In-Reply-To: <Pine.LNX.4.44.0401161727500.1212-100000@redhat1.mmaero.com>
From: Michael Lewinski <mike@rockynet.com>
Date: Fri, 16 Jan 2004 16:36:16 -0700
To: nanog@merit.edu
Errors-To: owner-nanog-outgoing@merit.edu
On Jan 16, 2004, at 3:31 PM, jlewis@lewis.org wrote:
> It's those dang Nachi-sized ICMP echo/echo-replies. We block those at
> all
> our transit points and dial-up ports. Nachi was killing our cisco
> access-servers until we did this to stop the spread.
FYI, Nachi is basically dead now from what I can tell. It was timed to
expire in January of this year, and our flowscan graphs bear this out.
Prior to it's self-destruction, Nachi traffic comprised about half of
all our incoming flows. ICMP is back to pre-Nachi levels here now, and
I have heard similiar reports elsewhere.
