x539
join:2003-08-23
Oklahoma City, OK
| Re: Please Prove My Father Wrong! I suspect that what you're seeing is not a "smurf attack" at all. Reason being that this is a very old-school attack, and it's pretty hard to pull it off effectively any more. The reasons this attack used to be successful are:
1. Windows machines used to reply to ICMP ECHO directed to the broadcast address. They haven't for several years. Note: Most Linux/UNIX machines in default configuration will. In Linux adding "net.ipv4.icmp_echo_ignore_broadcasts = 1" to sysctl.conf will stop this.
2. Most people used slower connections. It takes a whole lot more pings to knock someone off a broadband connection than off a 28.8 dialup.
What I think is more likely is that your router assumes that all x.x.x.0 and x.x.x.255 IPs are network/broadcast addresses, and classifies packets coming from these hosts as smurfs. That is not necessarily the case though, as those addresses are dependent on the size of the subnet. For example, the address 10.1.4.255 is not a broadcast address on a 10.1.0.0/16 network.
As far as why the network "goes down", it would appear that way if you were waiting for packets from a host that your router was eating because it thinks its an attack.
It's possible that you really are the victim of a smurf attack, but I would say that it's highly improbable  |
