Huge smurf attack

Sat Jan 9 20:42:22 UTC 1999

On Sat, 9 Jan 1999, Brandon Ross wrote:

> We are currently seeing a smurf attack larger than any one we've ever seen
> before... it looks like it's causing us over 200Mb/s of incoming
> echo-reply traffic to 207.69.200.132 (our IRC server, imagine that).
> Please check your networks and see if you can help us trace this attack to
> the perpetrator, we'd love to prosecute if we can find them.

This attack has now stopped.  I managed to collect over 100,000 addresses
that we being used as amplifiers in this attack.  If anyone would like a
copy, please let me know.

Brandon Ross            Network Engineering     404-815-0770 800-719-4664
Director, Network Engineering, MindSpring Ent., Inc.  info at mindspring.com
                                                            ICQ:  2269442

Stop Smurf attacks!  Configure your router interfaces to block directed
broadcasts. See http://www.quadrunner.com/~chuegen/smurf.cgi for details.