[nsp] known networks for broadcast ping attacks

Tue Aug 12 16:14:44 UTC 1997

Charles Sprickman <spork at inch.com> wrote:

> On Tue, 12 Aug 1997, Jon Lewis wrote:
> 
> > This may be true, but what's to stop the writers of smurf and the other
> > programs from distributing version 2 with all new network addresses?
> > Fixing the 119 networks used to attack FDT will help, but I doubt it will
> > solve the problem.
> > 
> When I type "no ip source route" on a Cisco, what exactly is that doing
> for me?  Is it just disallowing the router itself to generate
> source-routed packets or is it saying sink all source-routed packets?
> All this talk of spoofing is getting me a bit confused.  What exactly is
> the difference between source-routing and spoofing?
> 
> Just trying to understand a bit more,
> 
> Charles

It prevents the Cisco from handling packets with source routing header
options set, whether locally generated, or switched. It doesn't prevent
the router generating or switching packets with invalid source addresses
e.g. packets with source addresses from inside the network entering the
router via an external interface - you need to apply access lists to the
appropriate interfaces (in the appropriate directions) to prevent this.

M.