On Wed, 26 Mar 1997, Karl Kraft wrote:
> Lately however, I've been getting about 20-30 rejects per day for different
> hosts connecting to port 7/UDP and from about 4 different hosts, in
> Germany, Austria, and Ukraine. According to /etc/services, this is the
> echo port, and is usually internal to inetd.
If you spoof an echo request for UDP port 7 from another host on the same
network, you can effectively flood the network with echos from each host.
Some software has been known to use UDP echo as a 'ping' as well, so it's
not definitely an attack if you see a valid source address. If I recall
correctly, Harvest cache used to do this at one point, it may still be an
option.
Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts @
clark .
net which may have no basis whatsoever in fact."
PSB#9280
Follow-Ups:
References:
|
|
