smurf, the MCI-developed tracing tools (was Re: Bogus announcement)

Mon Dec 29 12:10:48 UTC 1997

What are you talking about? If they have NETFLOW switching and NETFLOW 
accounting, it's easy to search for the router originated for the 
SMURF/initialised packets (this packets can be searched by the such list, 
or by the simular search pattern):

 xxx permit ip any 0.0.0.255 255.255.255.0 log

And then it takes 5 minutes to look for the originating interface.

On Sat, 27 Dec 1997, Phil Howard wrote:

> Date: Sat, 27 Dec 1997 16:08:05 -0600 (CST)
> From: Phil Howard <phil at charon.milepost.com>
> To: nanog at merit.edu
> Subject: Re: smurf, the MCI-developed tracing tools (was Re: Bogus announcement)
> 
> > 	Hello Karl & All,  Where or at what price are these tools
> > 	available.
> > 			Tia, JimL
> > PS:	In a further responce Karl was heard to say :
> > 
> > > The bottom line is that MONTHS after these were made available your NOC crew
> > 
> > 	I never heard nor was made aware that these tools were available,
> > 	even though I am an MCI Customer . :-(
> 
> Same here.  Are they free or do they cost money?
> 
> People want the tools.
> 
> -- 
> Phil Howard | w7x4y4z5 at noplace2.net end5ads8 at dumbads8.com suck1it7 at dumbads7.edu
>   phil      | end6ads8 at no52ads1.edu no2spam7 at dumb7ads.net crash291 at spammer6.org
>     at      | no1spam9 at no57ads7.net crash075 at spammer8.edu eat9this at spam1mer.edu
>   milepost  | stop5it8 at spammer5.edu no53ads9 at lame7ads.org no8way17 at s3p3a9m9.com
>     dot     | eat0this at dumbads9.edu no5spam6 at anyplace.com stop7865 at no40ads3.edu
>   com       | a1b6c7d7 at dumb8ads.edu no1spam5 at lame8ads.edu no1way93 at dumbads1.com
> 

Aleksei Roudnev, Network Operations Center, Relcom, Moscow
(+7 095) 194-19-95 (Network Operations Center Hot Line),(+7 095) 239-10-10, N 13729 (pager)
(+7 095) 196-72-12 (Support), (+7 095) 194-33-28 (Fax)