lists-nanog at silverwraith.com
Tue Jan 22 01:47:47 UTC 2002
On Mon, 21 Jan 2002, Stephen Griffin wrote:
> Is this type of filtering common? What alternate solutions are available
> to mitigate (I'm assuming) concerns about smurf amplifiers, that still
> allow traffic to/from legitimate addresses. What rationale is used to
> filter all traffic to network/broadcast addresses of /24 networks while
> ignoring network/broadcast of /25-/30? For that matter, what percentage
> of smurf amplifiers land on /24 boundaries?
As of last Monday / Tuesday, approximately 45% of all smurf amplifiers in
the RIPE region had addresses ending in .0 or .255 .
I'm unsure about ARIN / APNIC IP space.
I would certainly hope the kind of filtering you mention is uncommon :)
If you filter on your ingress, packets who destination address ends in .0
or .255, and you are a smurf amplifier, you're only stalling the
The best course of action is to fix the smurf amplifier itself :)
Check http://www.ircnetops.org/smurf/faq.php if you need to do this.
 = Data provided by SAFE (http://www.ircnetops.org/smurf)
Network Security Officer
Smurf Amplifier Finding Executive: http://www.ircnetops.org/smurf
More information about the NANOG