said by mziemba :

---

what the heck are you talking about? The guy asked for clarification on what those things did and I obliged with his request. I honestly dunno what you mean by bullheaded and deaf because I have obliged with every request that has been given to me.
As it regards to the internet freezing like it does, we're still in the dark on why it occurs.

---

quote:

---

05/18/2004 23:39:04 xxx.xxx.x.102 login success
05/18/2004 23:24:44 **Smurf** 205.188.7.0, 5190->> xxx.xxx.x.101, 1134 (from PPPoE Inbound)
05/18/2004 23:24:02 **Smurf** 205.188.7.0, 5190->> xxx.xxx.x.101, 1134 (from PPPoE Inbound)
05/18/2004 23:23:38 **Smurf** 205.188.7.0, 5190->> xxx.xxx.x.101, 1134 (from PPPoE Inbound)
05/18/2004 23:23:33 **Smurf** 205.188.7.0, 5190->> xxx.xxx.x.101, 1134 (from PPPoE Inbound)
05/18/2004 23:23:29 **Smurf** 205.188.7.0, 5190->> xxx.xxx.x.101, 1134 (from PPPoE Inbound)

---

said by mziemba :

---

thanks.

Umm is that related to the severe drop in internet speed as well? (read: slower than a 2400 K-baud modem)

---

said by pcscdma :

---

said by mziemba :

---

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = (censored)

---

Well now we all know that you aren't visiting rogue sites. I'm glad we can all sleep better tonight knowing this.

---

said by NewLife :

---

And what is even worse is that his daddy works for an ISP. Which one is it that way we can make sure not to recommend that service to anyone.

---

said by mziemba :

---

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = (censored)

---

said by BurntCricket :

---

ROGUE, that's it! And I thought he was talkin' about sites formatted with a pink background... :D

---

Rogue

said by mcfrisch :

---

said by baked247 :

---

Sounds like someone is jealous. I guess KeiferW doesnt get out from under the dark , musty corner the computer sits in.

---

Wow... and you inferred this from his previous post?:huh:

---

said by KeiferW :

---

said by Dingleberry :

---

...he said something about rouge web sites (I think he meant rogue)...

---

ROGUE, that's it! And I thought he was talkin' about sites formatted with a pink background... :D

said by baked247 :

---

All kids nowadays are taking advantage of their parents and the parents are only hurting the kids by letting them loaf around and watch cartoons.

---

Sooo, it's the parents fault that today's kids can't find their butt with both hands in the dark? Mmm-K... :uhh:

said by baked247 :

---

They have no clue as to what rent and bills are all about. The youth of today are the youth of tomorrow.

---

Yeah, THAT'S making a good case for today's youth... :uhh:

said by SKiTLz :

---

You blokes are all suckers.. You know Shrinks make a damn good hourly rate right.. Yet you sit on a forum counceling for free... Schmucks...

---

I was gonna' bill him, but all he had was $100... ;)

You kid's get off my lawn! :D

---

said by Dingleberry :

---

...he said something about rouge web sites (I think he meant rogue)...

---

said by baked247 :

---

All kids nowadays are taking advantage of their parents and the parents are only hurting the kids by letting them loaf around and watch cartoons.

---

said by baked247 :

---

They have no clue as to what rent and bills are all about. The youth of today are the youth of tomorrow.

---

said by SKiTLz :

---

You blokes are all suckers.. You know Shrinks make a damn good hourly rate right.. Yet you sit on a forum counceling for free... Schmucks...

---

said by baked247 :

---

Sounds like someone is jealous. I guess KeiferW doesnt get out from under the dark , musty corner the computer sits in. All kids nowadays are taking advantage of their parents and the parents are only hurting the kids by letting them loaf around and watch cartoons. They have no clue as to what rent and bills are all about. The youth of today are the youth of tomorrow . Literally.....

---

said by mziemba :

---

I don't need any "family counceling" or anything I am already seeing a shrink and he even agrees with me my father is a complete control freak.

---

said by baked247 :

---

Sounds like someone is jealous. I guess KeiferW doesnt get out from under the dark , musty corner the computer sits in.

---

said by mziemba :

---

ok before anyone says anything, my father and I openly hate each other. I don't need any "family counceling" or anything I am already seeing a shrink and he even agrees with me my father is a complete control freak.

---

said by mziemba :

---

Of cource that is more that he's mad that I'm 20 years old and I still watch cartoons. But that's not the point.

---

said by mziemba :

---

(P.S. I'm willing to bet anyone $100 when I show him this he'll say "See you just gave out more of our information. you told them our router and now they can do more hacking!")

---

said by Dingleberry :

---

> You don't like the heat? Get out of the kitchen you cartoon watchin', comic readin', rouge surfin' little 20 year old slacker.

So now the original poster is pink (or red, depending on the dictionary)?

---

said by mziemba :

---

ok before anyone says anything, my father and I openly hate each other.

---

said by mziemba :

---

I don't need any "family counceling" or anything...

---

said by mziemba :

---

OK tonight we got hit with a smurf attack...If that's not sad enough he think's SMURF is a person.

---

said by mziemba :

---

I'm going to all of these rouge sites. Of cource about 90% of them, are about wrestling, or anime, or comics, or cartoons.

---

said by mziemba :

---

Of cource that is more that he's mad that I'm 20 years old and I still watch cartoons.

---

said by mziemba :

---

Please I need some information to shut him up once and for all on this and how aI can stop these "smurf" attacks from happening to our network.

---

said by mziemba :

---

P.S. I'm willing to bet anyone $100...

---

said by mziemba :

---

Of cource that is more that he's mad that I'm 20 years old and I still watch cartoons. But that's not the point.

---

said by pcscdma :

---

said by Name Game :

---

I have not see a smurf in years..;)

---

I've been smurfed

---

said by Qumahlin :

---

said by mziemba :

---

I'm not really sure what you mean
Do you use IRC or such? I ask because Smurf is not some random attack..If someone is lauching a Smurf attack against you...repeatedly...then you did something to piss them off.

---

Maybe it was your Dad that pissed them off?]]> http://www.dslreports.com/forum/remark,10269624 Tue, 18 May 2004 05:06:14 EDT http://www.dslreports.com/forum/remark,10269037 mziemba : Yeah you have a point.

As it regards to the topic title. I figure if he won't listen to me, he'll listen to people that acctually know what they are talking about.

Again thank you for all the help guys.]]> http://www.dslreports.com/forum/remark,10269037 Tue, 18 May 2004 01:10:40 EDT http://www.dslreports.com/forum/remark,10269006 IGGY : "But when someone else is holding the keys to getting into fixing it and is unwilling to cooperate, it makes things difficult."

There are easy ways around this. But if you haven't paid for any of the gear. Then unfortunately it's not your call. If you did decide to take matters into your own hands - it would seem you should be prepared for the fall out that would come do to that action.
--
Test Your Security Team Z Member Cable Modem Diagnostics]]> http://www.dslreports.com/forum/remark,10269006 Tue, 18 May 2004 01:06:05 EDT http://www.dslreports.com/forum/remark,10268967 mziemba : -I don't have IRC running 24/7.

-My router calls it a smurf attack. I know it's wrong but I don't know what the heck is going on with it, so I'm going by what information I have.

-I'm attempting to get something fixed when the person that should know how to troubleshoot it is unwilling to accept any sort of suggestion on a probable cause and would rather let the network be let open than admit that he is indeed wrong.

-I have the information that I need to attempt to troubleshoot/fix the problem. But when someone else is holding the keys to getting into fixing it and is unwilling to cooperate, it makes things difficult.

-I thank you for the FAQ's,I will be researching them to attempt to fix the router issues.

-Lordsofpain.net/Wrestlingheadlines.com is run though UGO.com. Your thinking of someone else.]]> http://www.dslreports.com/forum/remark,10268967 Tue, 18 May 2004 00:59:40 EDT http://www.dslreports.com/forum/remark,10268910 gaforces : www.lordsofpain.net
I seem to recall these guys, game griefers they prefix thier name with Lord----. They live to mess with people, and they are on irc too. I wouldnt go near thier site ever.

I think your dads right :p
--
Fiber Optics is the future of high-speed internet access. Stop by the BBR Fiber Optic Forum]]> http://www.dslreports.com/forum/remark,10268910 Tue, 18 May 2004 00:49:20 EDT http://www.dslreports.com/forum/remark,10268884 EGeezer : Two lines in logs is not a smurf attack. Two hundred thousand lines would be. Your previous posts indicate you have at least two open ports and you're using IRC, P2P, playing online games, etc. With that the probability is high that you would occasionally get a packet from an unreachable address. You're focused on berating your dad for thinking cookies cause network outages. I recommend you don't go down a similar path believing a couple of ICMPs from unreachable IPs and labeled as "smurf" constitutes an attack.

The title of your post is significant in that you are not looking to solve a network performance problem as much as you're trying to make someone else look bad. Such personal problems get in the way of objective analysis. A good troubleshooter will put aside such things and focus on defining and analyzing the environment and the symptoms and solving the problem. Get off the disparagement trip, show your dad you can analyze the network and its components and arrive at a solution to fix the problem whatever it is and not just try to find some way to place the blame elsewhere. The FAQs I referenced are the result of highly skilled and respected people and are good starting points to make a positive contribution.
--
Eschew obfuscation]]> http://www.dslreports.com/forum/remark,10268884 Tue, 18 May 2004 00:46:21 EDT http://www.dslreports.com/forum/remark,10267346 LaserjetXX : hey dad, it's really pathetic when people think they know everything about computers when they don't. you should listen to your son. he knows way more than you do. ]]> http://www.dslreports.com/forum/remark,10267346 Mon, 17 May 2004 21:41:24 EDT http://www.dslreports.com/forum/remark,10267191 pcscdma :

said by Name Game :

---

I have not see a smurf in years..;)

---

I've been smurfed
--
Be patriotic or I'm reporting you to Ashcroft.]]> http://www.dslreports.com/forum/remark,10267191 Mon, 17 May 2004 21:24:08 EDT http://www.dslreports.com/forum/remark,10267171 mziemba : There are maybe atleast 2 lines that Identify a "SMURF" in the logs.

Spoofed address and all.

some IP attempts to get into my Network IP and it sees it as a smurf.

If I can ever get the logs offa my dad I'll post them here (censored of cource)]]> http://www.dslreports.com/forum/remark,10267171 Mon, 17 May 2004 21:22:07 EDT http://www.dslreports.com/forum/remark,10266534 keith2468 : Roughly how many events in this smurf attack (that is, how many log entries)? 1, 10, 100, 1000, more than 1000?

A lot of log viewers identify attacks one-line-at-a-time.

A smurf attack is a denial of service attack. I think you would see hundreds or thousands of entires in the 5 minutes.

Also, regardless of your surfing activities, sooner or later someone is bound to try to break into your network. So you should follow the steps in the FAQ on securing your system and testing that it is secure.

And good luck. You'll be out and free in a few years, and then you'll have the rest of your life to be free. Don't let things now get you down too much.
--
(Virus&Hijacking FAQ+Submit suspected malware+Security FAQ)]]> http://www.dslreports.com/forum/remark,10266534 Mon, 17 May 2004 20:12:58 EDT http://www.dslreports.com/forum/remark,10266127 Name Game : This smurf attack thingie that people see in there logs is a joke. They are not smurf at all..and that fact you stated that they are causing your system setup to go down sound fishy..but if your dad is the expert..give him a cookie for me :D

SMC7008ABR

»media-server.amazon.com/media/mo···3308.pdf.

A smurf attack consists of forged icmp pings that are sent using a spoofed source address and a broadcast address for the destination. Or even worse spoofed broadcast source and destination addresses. Interesting that your log shows a single IP as the destination as opposed to a broadcast address. And if you were the intended victim you would see icmp pings from more than a single ip address. Generally all systems within the local subnets that are not "stealthing". Here again the source isn't even in a local subnet so my guess is that the source is sending just enough icmp pings to trigger an alert that has a poorly written "definition" in your router's firmware. A couple of the more recent worms initially scan random subnets with ICMP pings so my guess is that this may actually be what you are experiencing.

So have your dad start digging deeper and junk the logs.

Sniffing would be a good idea...along with some good software to really analzye those packet.

I have not see a smurf in years..;)
--
Gladiator Security Forum »www.gladiator-antivirus.com/ Missing Kids »www.missingkids.com/]]> http://www.dslreports.com/forum/remark,10266127 Mon, 17 May 2004 19:27:32 EDT http://www.dslreports.com/forum/remark,10266109 mziemba : I posted what model we have.

And even running the internal firewall we are getting this "SMURF"]]> http://www.dslreports.com/forum/remark,10266109 Mon, 17 May 2004 19:25:41 EDT http://www.dslreports.com/forum/remark,10266068 DaDogs : Gawd.................. This is the Microsoft life?]]> http://www.dslreports.com/forum/remark,10266068 Mon, 17 May 2004 19:21:32 EDT http://www.dslreports.com/forum/remark,10266026 shelf life :

said by mziemba :

---

We're running an SMC router (I an't remember the model)

---

dont know what smc router you have, i see smurf attacks sometimes in my log. (SMC barricade)

"When the SPI (Stateful Packet Inspection) firewall feature is enabled, all packets can be blocked. Stateful Packet Inspection (SPI) allows full support of different application types that are using dynamic port numbers. For the applications checked in the list below, the Barricade will support full operation as initiated from the local LAN.

The Barricade firewall can block common hacker attacks, including IP Spoofing, Land Attack, Ping of Death, IP with zero length, Smurf Attack, UDP port loopback, Snork Attack, TCP null scan, and TCP SYN flooding."]]> http://www.dslreports.com/forum/remark,10266026 Mon, 17 May 2004 19:15:39 EDT http://www.dslreports.com/forum/remark,10265798 BurntCricket :

said by Dingleberry :

---

So are you being attacked by a pink smurf?

Or is it a smurf wearing makeup?

Or is it smurfette? Personally I always thought she was kinda cute....

I'm so confused....

---

I always wondered about Smurfette >> one female among MANY males. Smurfette is kinda HOT in a Smurfy way.
--
The only vote that's wasted is one that isn't cast.
]]> http://www.dslreports.com/forum/remark,10265798 Mon, 17 May 2004 18:48:16 EDT http://www.dslreports.com/forum/remark,10265313 bluezanetti : Following on x539's comment...., have you checked »Barricade's See x.x.x.0 / x.x.x.255 as Broadcast. out? It may be relevant to your problems....

Blue]]> http://www.dslreports.com/forum/remark,10265313 Mon, 17 May 2004 17:49:08 EDT http://www.dslreports.com/forum/remark,10265229 Dingleberry : So are you being attacked by a pink smurf?

Or is it a smurf wearing makeup?

Or is it smurfette? Personally I always thought she was kinda cute....

I'm so confused....]]> http://www.dslreports.com/forum/remark,10265229 Mon, 17 May 2004 17:36:03 EDT http://www.dslreports.com/forum/remark,10265138 IGGY : "And I'm the only one that is running a personal firewall on a PC hooked up to the network (Zone Alarm Pro). The firewall on my PC NEVER goes off when someone is attempting to get into is. I have it set to block any and all incoming information unless I say it's ok, and still have never seen anything."

You shouldn't see anything incoming with the software firewall. If the router is setup properly. It would seem it is - since your not seeing any alerts with the software firewall. You should see alerts when programs want access out for the 1st time etc. The router should be handling anything that is incoming before it has a chance to even reach the software firewall.
--
Test Your Security
Team Z Member
Cable Modem Diagnostics]]> http://www.dslreports.com/forum/remark,10265138 Mon, 17 May 2004 17:26:37 EDT http://www.dslreports.com/forum/remark,10265106 mziemba : Some if not most - This in itself should be a red flag that you may be driving in questionable neighborhoods, so to speak. With that in mind, the ICMPs could be caused by just about anything from connection to game servers to P2P setups, IRC and so on.

I run IRC but I have never never pissed any individual off and keep only 2 ports open (Used by the Invision script I have inconjunction with my firewall).

Like I said most of teh sites are run by professional individuals. www.toonzone.net, www.voltron.info, www.lordsofpain.net, www.puroresupower.com, www.puroresufan.com, and gamefaqs.com are my most visited sites. And about half the time that's about all I do online.

We don't know what security settings, tools, apps, AV/AT/firewall products you are using, let alone how current they are or if you bypass them them to "install this viewer to see the movie" or similar prompt. We don't even know what operating system(s) or how many PCs are involved.

Router is an SMC7008ABR with, as far as I know a default set up (I am not permitted to access anything in the router because I attempted to use the Port Forwarding for BitTorrent.)

I think we're running the standard factory settings Firewall out of that (Like I said, I'm not allowed to check myself, and even with my father present I'm not allowed to look arround without him watching and asking me what I'm doing and belittling me the entire time. And I'm the only one that is running a personal firewall on a PC hooked up to the network (Zone Alarm Pro). The firewall on my PC NEVER goes off when someone is attempting to get into is. I have it set to block any and all incoming information unless I say it's ok, and still have never seen anything.

The Network consists of 2 PC's running Windows 2000, one running ME (mine), one running XP professional, and a Playstation 2 (Which half the time isn't hooked up to the network)

The SMURF's in the logs are from other people, but they are spoofing the IP address. I've had atleast 2 that have come from the University of Nebraska, and yes we've contacted them and they have said there is no one hooked up to the addresses (yes plural) that were SMURFing us.]]> http://www.dslreports.com/forum/remark,10265106 Mon, 17 May 2004 17:22:36 EDT http://www.dslreports.com/forum/remark,10264866 mziemba : It is a SMURF attack.

It says it on the Logs "SMURF" is the one going to my address and flooding it resulting in the network going down for several minutes.

Your also not going to believe this but my Dad works for an ISP.

Yes. He even works in the industry and doesn't know jack about it.]]> http://www.dslreports.com/forum/remark,10264866 Mon, 17 May 2004 16:55:48 EDT http://www.dslreports.com/forum/remark,10264860 IGGY : »www.google.com/search?hl=en&ie=U···+testing

Why not just have your father test your setup for himself. Google has a list of many sites that will allow you to test your setup. To see if in fact it is secure from most exploits.
--
Test Your Security
Team Z Member
Cable Modem Diagnostics]]> http://www.dslreports.com/forum/remark,10264860 Mon, 17 May 2004 16:55:01 EDT http://www.dslreports.com/forum/remark,10263170 BurntCricket : Are you sure its SMURF attack ?? I am leaning more to something on YOUR system since it seems to be the target(source).
--
The only vote that's wasted is one that isn't cast.
]]> http://www.dslreports.com/forum/remark,10263170 Mon, 17 May 2004 13:09:32 EDT http://www.dslreports.com/forum/remark,10263005 dp :

said by Jason Levine :

---

.... With these folks, it's sometimes best just to either nod and then do your own thing. Either that or have some fun with their mis-understanding of technology

---

I find the head nod works best for me :)
--
Write your questions down on the back of a $20 dollar bill and send them to me]]> http://www.dslreports.com/forum/remark,10263005 Mon, 17 May 2004 12:49:53 EDT http://www.dslreports.com/forum/remark,10262868 Jason Levine :

said by mziemba :

---

Now my dad is all pissed off be cause I'm visiting all of these sites that are hacking into me. Yes you read that right. By simply visiting a website I can be hacked because of the cookies. Cookies can do EVERYTHING according to my dad.

---

Let me guess: He probably thinks that sites can also read your e-mail address via cookies and then spam you.

It really is a shame that people overreact so much to cookies. They really aren't much of a threat. The worst that can be done with cookies is that a banner ad network can track which sites you've been to via 3rd party cookies. Disable 3rd party cookies or delete their cookies, and all that information is lost.

As far as hacking "through" cookies goes, cookies are just plain text files. A website (for example, BBR) will store a cookie on your hard drive containing some information (for example, your username/password) that it will need later. This information is stored in plain text and can only be accessed by the website that stored it. (Security holes notwithstanding.)

Any hacker that is trying to gain access to your system won't do it by writing a small text file to your computer. They'll do it by trying to get you to run a program, become infected with a virus/worm, visit a site with malicious ActiveX content, or exploit a security hole that you haven't patched. Cookies are useless for hackers attempting to gain entry. Of course, once a hacker gains access to your system, all bets are off and they might read your cookies to get some personal information that is stored there.

said by mziemba :

---

(P.S. I'm willing to bet anyone $100 when I show him this he'll say "See you just gave out more of our information. you told them our router and now they can do more hacking!")

---

I won't take that bet. I know about controlling fathers who don't know much about technology. (Or rather, know just enough terminology to be dangerous.) ;-)

I agree that any information that you show him will be quickly written off as not proving him wrong. I'm a big proponent for educating users who don't know much, but, unfortunately, there are some people in this world that you just can't reason with. They think they know everything there is to know and any evidence to the contrary must be mistaken. With these folks, it's sometimes best just to either nod and then do your own thing. Either that or have some fun with their mis-understanding of technology. ("Yes, it turns out that the hacker tried to come in through the cookie, but luckily I was able to inject some JavaScript into his system via the TCP port in the nick of time." ;) ;) ;))
--
-Jason Levine
http://www.jasons-toolbox.com/
http://www.PCQandA.com/
http://www.urateit.com/]]> http://www.dslreports.com/forum/remark,10262868 Mon, 17 May 2004 12:30:07 EDT http://www.dslreports.com/forum/remark,10262384 EGeezer :

said by mziemba :

---

Some, if not Most, of the places that I visit are not run by people that would run SMURF.

---

Some if not most - This in itself should be a red flag that you may be driving in questionable neighborhoods, so to speak. With that in mind, the ICMPs could be caused by just about anything from connection to game servers to P2P setups, IRC and so on.

We don't know what security settings, tools, apps, AV/AT/firewall products you are using, let alone how current they are or if you bypass them them to "install this viewer to see the movie" or similar prompt. We don't even know what operating system(s) or how many PCs are involved.

With that in mind, it's hard to determine with any confidence what could cause your problem. It could even be as simple as a bad connection or NIC and the "smurfs" reported in logs could be entirely unrelated.

My recommendation is to review the security FAQs, particularly »Security »How to Secure (and Keep Secure) My (New) Computer(s): A Layered Approach: and »Microsoft Application Tips and Tweaks »Concerning Internet Options Security, what do some of the settings mean if you are using IE.

If you're playing in the street or 'hood, become streetwise or prepare to get run over or ripped off occasionally.
--
Eschew obfuscation]]> http://www.dslreports.com/forum/remark,10262384 Mon, 17 May 2004 11:23:49 EDT http://www.dslreports.com/forum/remark,10262121 x539 : I suspect that what you're seeing is not a "smurf attack" at all. Reason being that this is a very old-school attack, and it's pretty hard to pull it off effectively any more. The reasons this attack used to be successful are:

1. Windows machines used to reply to ICMP ECHO directed to the broadcast address. They haven't for several years. Note: Most Linux/UNIX machines in default configuration will. In Linux adding "net.ipv4.icmp_echo_ignore_broadcasts = 1" to sysctl.conf will stop this.

2. Most people used slower connections. It takes a whole lot more pings to knock someone off a broadband connection than off a 28.8 dialup.

What I think is more likely is that your router assumes that all x.x.x.0 and x.x.x.255 IPs are network/broadcast addresses, and classifies packets coming from these hosts as smurfs. That is not necessarily the case though, as those addresses are dependent on the size of the subnet. For example, the address 10.1.4.255 is not a broadcast address on a 10.1.0.0/16 network.

As far as why the network "goes down", it would appear that way if you were waiting for packets from a host that your router was eating because it thinks its an attack.

It's possible that you really are the victim of a smurf attack, but I would say that it's highly improbable ;-)]]> http://www.dslreports.com/forum/remark,10262121 Mon, 17 May 2004 10:41:12 EDT http://www.dslreports.com/forum/remark,10261756 Qumahlin :

said by mziemba :

---

I'm not really sure what you mean when you say "intermediate or spoofed target"

My Network address is the one that the SMURF attack goes to and there by floods the network slowing it to a snails pace.

Some, if not Most, of the places that I visit are not run by people that would run SMURF.

---

Do you use IRC or such? I ask because Smurf is not some random attack..If someone is lauching a Smurf attack against you...repeatedly...then you did something to piss them off.
--
Forum Posts:4326]]> http://www.dslreports.com/forum/remark,10261756 Mon, 17 May 2004 09:44:11 EDT http://www.dslreports.com/forum/remark,10260845 mziemba : I'm not really sure what you mean when you say "intermediate or spoofed target"

My Network address is the one that the SMURF attack goes to and there by floods the network slowing it to a snails pace.

Some, if not Most, of the places that I visit are not run by people that would run SMURF.]]> http://www.dslreports.com/forum/remark,10260845 Mon, 17 May 2004 03:34:22 EDT http://www.dslreports.com/forum/remark,10260647 pcscdma : Are you the intermediate or the spoofed target of the SMURF? If you are the intermediate you can get a router or software that filters those packets. Cookies don't generate specially crafted ICMP packets. The web server that you are using could be set up to automatically use your IP for a SMURF. The web server needs your IP to SMURF and it needs your IP to send you the pages.
You could just have a popular IP address.
--
Be patriotic or I'm reporting you to Ashcroft.]]> http://www.dslreports.com/forum/remark,10260647 Mon, 17 May 2004 02:13:04 EDT http://www.dslreports.com/forum/remark,10260635 norky : there's not much you can do to stop a smurf

perhpas he'll beleive CERT? »www.cert.org/advisories/CA-1998-01.html

DOH! beaten to the punch!]]> http://www.dslreports.com/forum/remark,10260635 Mon, 17 May 2004 02:10:33 EDT http://www.dslreports.com/forum/remark,10260628 snoop69 : here is something your dad can read about smurf attacks, »www.cert.org/advisories/CA-1998-01.html hopefully you can get some piece of mind.:)]]> http://www.dslreports.com/forum/remark,10260628 Mon, 17 May 2004 02:09:01 EDT http://www.dslreports.com/forum/remark,10260534 mziemba : ok before anyone says anything, my father and I openly hate each other. I don't need any "family counceling" or anything I am already seeing a shrink and he even agrees with me my father is a complete control freak.

------

OK tonight we got hit with a smurf attack. It comes through my IP on the network (I for some reason am ALWAYS the one that is the target for these attacks)

So the network goes down for 5 minutes.

Now my dad is all pissed off be cause I'm visiting all of these sites that are hacking into me. Yes you read that right. By simply visiting a website I can be hacked because of the cookies. Cookies can do EVERYTHING according to my dad.

No matter how many times I tell him it's not how it works, he doesn't believe me. Even I know that visiting a site that isn't constantly monitored or run on a 100% private server has NO chance of hacking into our network and initating a SMURF attack.

If that's not sad enough he think's SMURF is a person.

I'm going to all of these rouge sites. Of cource about 90% of them, are about wrestling, or anime, or comics, or cartoons.

Of cource that is more that he's mad that I'm 20 years old and I still watch cartoons. But that's not the point.

Please I need some information to shut him up once and for all on this and how aI can stop these "smurf" attacks from happening to our network.

We're running an SMC router (I an't remember the model)

(P.S. I'm willing to bet anyone $100 when I show him this he'll say "See you just gave out more of our information. you told them our router and now they can do more hacking!")]]> http://www.dslreports.com/forum/remark,10260534 Mon, 17 May 2004 01:40:53 EDT