<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2650.12">
<TITLE>RE: DDOS anecdotes</TITLE>
</HEAD>
<BODY>
<BR>
<BR>
<P><FONT SIZE=2>-----Original Message-----</FONT>
<BR><FONT SIZE=2>From: woods@weird.com [<A HREF="mailto:woods@weird.com">mailto:woods@weird.com</A>]</FONT>
<BR><FONT SIZE=2>Sent: Saturday, June 23, 2001 3:56 PM</FONT>
<BR><FONT SIZE=2>To: nanog@merit.edu</FONT>
<BR><FONT SIZE=2>Subject: RE: DDOS anecdotes</FONT>
</P>
<BR>
<BR>
<P><FONT SIZE=2>[ On Saturday, June 23, 2001 at 20:04:06 (+0200), Mikael Abrahamsson wrote: ]</FONT>
<BR><FONT SIZE=2>> Subject: RE: DDOS anecdotes</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>> This is a real problem. It's not FUD. Microsofts choice to include full</FONT>
<BR><FONT SIZE=2>> IP stack capabilities will make the problem worse, but I do not blame</FONT>
<BR><FONT SIZE=2>> their IP stack for this like Mr Gibson does though.</FONT>
</P>
<P><FONT SIZE=2>>No, their stack's not the root of the problem -- all the rest of their</FONT>
<BR><FONT SIZE=2>>OS is (and of course in particular the security model, or lack thereof).</FONT>
</P>
<BR>
<P><FONT SIZE=2>FYI beware of service pack 2. It sets the DF bit so packets cannot fragment. Particularily offensive if your server is on the other side of a tunnel (due to the overhead). The solution is to reduce the MTU on the box. Or use a different OS :)</FONT></P>
<BR>
<BR>
<P> <FONT SIZE=2>Greg A. Woods</FONT>
</P>
<P><FONT SIZE=2>+1 416 218-0098 VE3TCP <gwoods@acm.org> <woods@robohack.ca></FONT>
<BR><FONT SIZE=2>Planix, Inc. <woods@planix.com>; Secrets of the Weird <woods@weird.com></FONT>
</P>
</BODY>
</HTML>