[Tier1 ISP] : Vulnerable to a new DDoS amplification attack

Thu Dec 22 17:04:03 UTC 2016

On 22 Dec 2016, at 23:56, Tom Beecher wrote:

> What he did was send 1500 byte ICMP packets with a max TTL at an IP 
> address that is not reachable due to a routing loop.

Same here.  Here's some context I sent him:

<https://www.usenix.org/legacy/events/imc05/tech/full_papers/xia/xia_html/imc05-paper-128-final.html>

<http://nanog.org/meetings/nanog36/presentations/xia.pdf>

<https://youtu.be/cWF4p5EuvQk>

Note related discussion of mitigation tactics here (e.g., TTL-based 
filtering via tACLs):

<http://www.cisco.com/c/en/us/about/security-center/ttl-expiry-attack.html>

-----------------------------------
Roland Dobbins <rdobbins at arbor.net>