smurf's attack...

Sat Sep 6 18:16:16 UTC 1997

> > Likewise, not all broadcast adresses necessarily end with .255, 
> > so filtering .255 won't help anyway in the presence of something
> > like a /25 with a X.X.X.127 broadcast.
> 
> Agreed but it is not easy for a hacker to determine CIDR masks.  It
> is my impression that the only thing being sent is classfull broadcasts.

   That's unfortunatly not true.  My hope is that this will change -
I just sent CERT an advisory about this, and they're contacting 
several vendors whose equipment is misconfigured - but a very large
number of systems out there will very cheerfully let you know their
broadcast mask in violation of the Host Requirements RFC.

   It would take a bit more work to code a "smurf" program to first
determine the broadcast mask, but since the smurf program uses 
hardcoded target addresses, all it would take is for someone to
probe a few networks adequately, build them in to the next release
of the smurf program, and start using it.

   I agree with the point of the discussion, however - many, many
networks are broken in to /24s for various reasons, but blocking
packets _outbound_ to what you presume are broadcast addresses
is a bad thing.

   (Btw:  If you feel the desire to _not_ let your netmasks hang
out in the open, you can use an access list like:

   access-list blah deny icmp any any mask-request

   Most sites should have NO need to allow mask requests or replies
in and out of their internal network).

    -Dave Andersen