Huge smurf attack

Jeremiah Kristal jeremiah at fs.IConNet.NET
Mon Jan 11 17:14:04 UTC 1999

On Mon, 11 Jan 1999, Phil Howard wrote:

<<snip discussion about how clueful operators filter RFC1918 addresses>>

I agree that clueful operators filter RFC1918 addresses at their borders
and that they do not accept advertisements for RFC1918 space, however,
there is a specific network (10.177.180/24) that appears again and again
in smurf logs.  I find it rather interesting that with 65k available /24s
in the 10/8 space, one specific /24 pops up much more often than any
other.  Granted it's not that large an amplifier, but it seems odd that
even an RFC1918 network would be used as an amplifier for this long
without someone finding and securing it.


More information about the NANOG mailing list