From lucas@wasteland.org Sun Sep 15 13:03:45 1996 Received: from wrath.netline.net (lucas@srq14.netline.net [205.160.7.74]) by suburbia.net (8.7.4/Proff-950810) with SMTP id NAA32286 for ; Sun, 15 Sep 1996 13:03:37 +1000 Received: from localhost (lucas@localhost) by wrath.netline.net (8.6.12/8.6.9) with SMTP id XAA00174; Sun, 15 Sep 1996 23:03:38 -0400 X-Authentication-Warning: wrath.netline.net: lucas owned process doing -bs Date: Sun, 15 Sep 1996 23:03:38 -0400 (EDT) From: Synthesizer Punk X-Sender: lucas@wrath.netline.net To: Alfy cc: best-of-security@suburbia.net Subject: Re: BoS: ping flood In-Reply-To: <199609150007.CAA07558@worldcom.ch> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII On Sun, 15 Sep 1996, Alfy wrote: :hello do you people know if there's a way for a system admin to prevent ping :floods from faster machines and which may cause a hudge slowdown of the :connection ? :thank you :alfy Ping floods are often a barrage of ICMP Echo packets, requesting the machine recieving them to respond, making the target host participate in killing itself off. Now once they make it into your LAN, they're basically home free. Often times ISPs or other luser-infested networks deny all ICMP packets or excessive amounts of ICMP packets at the router. The flood still occurs, but it stops at the router. If you're on a 64k connection and the attacker is on a T1 or about, your entire network will be deadened. But, these are the chances you take.. I've seen people excessively pingflood networks, they just called their connection provider (UU, Sprintlink, et et) and said "Hey, filter these ICMP packets from this class C" or so. It can be a complicated or simple task. cryptopsychonihilisticanarchaicstraightedgeinformationfreaksynthesizerpunk lucas@wasteland.org, ftp://valkyrie.wasteland.org, irc://irc.wasteland.org http://www.wasteland.org, Information enthusiast. Wasteland Leader.