Date: Fri, 18 May 2001 22:15:38 +1000 (E. Australia Standard Time) From: Doug Young <dougy@gargoyle.apana.org.au> To: freebsd-questions@freebsd.org Subject: anti-smurf setup Message-ID: <Pine.WNT.4.21.0105182211380.1272-100000@oracle>
next in thread | raw e-mail | index | archive | help
I was just browsing through the Complete FreeBSD & stumbled across the following stuff. If blocking smurf attacks is as simple as this, why isn't the line included in the default "etc/rc.conf" ?? ### Miscellaneous network options: ### icmp_bmcastecho="NO" # respond to broadcast ping packets This parameter relates to the so-called smurf ``denial of service'' attack: according to the RFCs, a machine should respond to a ping to its broadcast address. But what happens if somebody pings a remote network's broadcast address across the Internet, as fast as he can? Each system on the remote network will reply, completely overloading the Internet interface. Yes, this is silly, but there are silly people out there. If you leave this parameter as it is, your system will not be vulnerable. See http://www.cert.org/advisories/CA-98.01.smurf.html for more details. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.WNT.4.21.0105182211380.1272-100000>