More amplifier blocks
ken emery
ken at cnet.com
Fri May 1 17:57:45 UTC 1998
On Fri, 1 May 1998, chris wrote:
> Here's a small subset of a packet log received from a rather large
> attack Friday. The second field is the number of packets received
> from the /24s in the time the log spans.
>
> Some of the addresses are interesting; for example, the handful of
> 10.* blocks; however, I did receive icmp echo_reply traffic from them.
<SNIP>
> 204.162.80 11
This was behind a 56K frame link, it is now fixed.
> 204.162.81 494
What the #$%^& is this? This is a class C which is divided into
a /25 and two /26's. One of the /26's was open (not any more). If
the number at the end is the quantity of hosts the program collecting
data needs to be checked. If this number is something else please
specify.
> 204.162.84 18
One of my compatriots had a /27 which was open. It should be closed
now.
> 204.162.86 19
Behind a 56K but now fixed.
I have turned off ip directed broadcasts on all links in our network
so the 204.162.80.0/21 netblock should be clean.
Is Karl adding these to his list? If so do we need to go through the
normal contact procedure (call MCS's NOC) to be removed?
bye,
ken emery
More information about the NANOG
mailing list