More amplifier blocks
ken at cnet.com
Fri May 1 17:57:45 UTC 1998
On Fri, 1 May 1998, chris wrote:
> Here's a small subset of a packet log received from a rather large
> attack Friday. The second field is the number of packets received
> from the /24s in the time the log spans.
> Some of the addresses are interesting; for example, the handful of
> 10.* blocks; however, I did receive icmp echo_reply traffic from them.
> 204.162.80 11
This was behind a 56K frame link, it is now fixed.
> 204.162.81 494
What the #$%^& is this? This is a class C which is divided into
a /25 and two /26's. One of the /26's was open (not any more). If
the number at the end is the quantity of hosts the program collecting
data needs to be checked. If this number is something else please
> 204.162.84 18
One of my compatriots had a /27 which was open. It should be closed
> 204.162.86 19
Behind a 56K but now fixed.
I have turned off ip directed broadcasts on all links in our network
so the 22.214.171.124/21 netblock should be clean.
Is Karl adding these to his list? If so do we need to go through the
normal contact procedure (call MCS's NOC) to be removed?
More information about the NANOG