Smurfing

Sat Feb 14 15:02:00 UTC 1998

Thanks for the excellent reply, although you forgot to mention that
every other ICMP message, including error messages, timestamps, and
such, MUST discard broadcast/multicast.  Echo is the _only_ MAY be
discarded.

As the discussion notes, there was some controversy.  I vaguely remember
the discussion at the time.  But _all_ the stacks that I've ever worked
on follow the MAY and _do_ the discard.  Maybe I should join a *nix
group.  We need to put pressure on vendors (especially router vendors
and large commercial host vendors) to _discard_ by default.

I am unaware of any troubleshooting value.  After all, should you want
to scan for hosts, use SNMP.  Or increment your ping address.  Lots of
simple harmless ways to do the same thing.  Especially since you need to
know the (now variable) local mask to effectively use a directed
broadcast anyway.

Directed broadcast was a kludge in the first place.  Maybe it's time to
deprecate it entirely.

> From: "Craig A. Huegen" <chuegen at quadrunner.com>
> Most stack implementors have chosen to respond to it because of its
> troubleshooting value; then again, the date of the RFC shows why many
> folks would tend to believe the threat of the attack wouldn't be very
> large.
>
WSimpson at UMich.edu
    Key fingerprint =  17 40 5E 67 15 6F 31 26  DD 0D B9 9B 6A 15 2C 32