Solution: Re: Huge smurf attack

Mon Jan 11 19:56:06 UTC 1999

On Mon, 11 Jan 1999, Jon Lewis wrote:
> There are at least 2 different teams already doing this.  The trouble is,
> who has the authority to disconnect smurf amp networks?

Their upstream?

> Nobody, really...but the reality is that if an RBL-like system were
> setup for smurf amp networks, and if some of the larger backbones
> subscribed to it, smurf amp networks would get fixed real fast.

This would be WONDERFUL. Something that takes a list of smurf nets and
feeds them into a bgp->blackhole system?

I notice that contacting the smurf amplifier directly is often pointless
due to unresponsive staff or bad ARIN contact info... but getting their
upstream to pull their connection out of the wall gets their 100% 
attention REAL quick. Response time goes from weeks to minutes.

-Dan