More amplifier blocks

ken emery ken at cnet.com
Fri May 1 17:57:45 UTC 1998


On Fri, 1 May 1998, chris wrote:

> Here's a small subset of a packet log received from a rather large
> attack Friday.  The second field is the number of packets received
> from the /24s in the time the log spans.
> 
> Some of the addresses are interesting; for example, the handful of
> 10.* blocks; however, I did receive icmp echo_reply traffic from them.
 
<SNIP>

> 204.162.80 11

This was behind a 56K frame link, it is now fixed.

> 204.162.81 494

What the #$%^& is this?  This is a class C which is divided into 
a /25 and two /26's.  One of the /26's was open (not any more).  If 
the number at the end is the quantity of hosts the program collecting 
data needs to be checked.  If this number is something else please 
specify.

> 204.162.84 18

One of my compatriots had a /27 which was open.  It should be closed 
now.

> 204.162.86 19

Behind a 56K but now fixed.

I have turned off ip directed broadcasts on all links in our network
so the 204.162.80.0/21 netblock should be clean.  

Is Karl adding these to his list?  If so do we need to go through the 
normal contact procedure (call MCS's NOC) to be removed?

bye,
ken emery




More information about the NANOG mailing list