[Tfug] DDoS

[Ryan Mansager]

 As for *why* the OS responds.. 
 
 http://www.ietf.org/rfc/rfc0792.txt

 Because, when not being attacked, it's nice to :)

 -r


On Thu, 11 Jul 2002, Patrick Hollins wrote:

> Ryan,
> 
> Thank you for the advise!  I did not know of the blackhole setting.
> 
> Patrick
> 
> Ryan Mansager wrote:
> 
> >  having
> >
> >  options         ICMP_BANDLIM
> >
> >  in your kernel will help and:
> >
> >  sysctl net.inet.udp.blackhole=1
> >
> >  will silently drop all udp datagrams destined for unbound ports
> >  (ie, not sending icmp responses back). -r
> >
> > On Thu, 11 Jul 2002, Patrick Hollins wrote:
> >
> > > Hi,
> > >
> > > First time poster, short time lurker (just signed up!).
> > >
> > > I run FreeBSD 4.4 and have been under attack since Saturday from a Distributed
> > > Denial of Service Attack.  Hundreds of IP's are sending UDP port 2001 packets at
> > > me, and my machine returns ICMP packets back to them at alarming rates.  It
> > > quickly saturates my DSL link (with downlink speed twice as fast as uplink, you
> > > *really* get hammered).
> > >
> > > A one line entry in the router filter table stops the insanity.
> > >
> > > My questions to the group:
> > >
> > > Has anyone else been subjected to this?
> > >
> > > Is this an old hack I should know about?
> > >
> > > I have no listeners on port 2001 (netstat -a) , why would the OS respond?
> > >
> > > Thanks for any insight.
> > >
> > > Patrick
> > >
> > > _______________________________________________
> > > tfug mailing list
> > > tfug@tfug.org
> > > http://www.tfug.org/mailman/listinfo/tfug
> > _______________________________________________
> > tfug mailing list
> > tfug@tfug.org
> > http://www.tfug.org/mailman/listinfo/tfug
> 
> _______________________________________________
> tfug mailing list
> tfug@tfug.org
> http://www.tfug.org/mailman/listinfo/tfug
--
Ryan Mansager