Milk attack

Fri Oct 2 04:43:57 UTC 1998

On Thu, Oct 01, 1998 at 05:26:57PM -0400, Steve Nash wrote:
==>SrcIf    SrcIPaddress  DstIf  DstIPaddress    Pr SrcP DstP Pkts B/Pk
==>Active
==>Fa0/0    208.10.5.2      Local    X.X.X.X           11 0498 0017
==>164K1028  985.3
==>
==>except from 10 to 15 hosts all nailing us at the same time.  The
==>protocol as you see is "11" which
==>I have been unable to find information about.  There was no way to
==>filter it and access-lists denying
==>protocol "11" showed 0 matches.  Anyone have any ideas?

Protocol 0x11 is 17 in decimal.

#define IPPROTO_UDP             17              /* user datagram protocol */

Simple UDP flood.

/cah