Skip site navigation (1)Skip section navigation (2)
Date:      Sun, 28 Jan 2001 01:46:33 +0900
From:      Kwangyul Seo <skyul@plus.or.kr>
To:        freebsd-questions <freebsd-questions@freebsd.org>
Subject:   Re: ICMP attacks
Message-ID:  <20010128014633.A1727@plus.or.kr>
In-Reply-To: <20010127170042.A737@basildon.homerun>; from tmseck@web.de on Sat, Jan 27, 2001 at 05:00:42PM %2B0100
References:  <NEBBIEGPMLMKDBMMICFNOEHBECAA.mit@mitayai.net> <20010127170042.A737@basildon.homerun>

next in thread | previous in thread | raw e-mail | index | archive | help

--sm4nu43k4a2Rpi4c
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Fr , Jan 26, 2001 at 04:44:51am -0500, Will Mitayai Keeso Rowe wrote:
> > icmp-response bandwidth limit 205/200 pps
> > icmp-response bandwidth limit 264/200 pps
> > icmp-response bandwidth limit 269/200 pps
> > icmp-response bandwidth limit 273/200 pps
> > icmp-response bandwidth limit 273/200 pps
> > icmp-response bandwidth limit 271/200 pps
> > icmp-response bandwidth limit 261/200 pps
> > icmp-response bandwidth limit 268/200 pps
> > icmp-response bandwidth limit 205/200 pps
> > icmp-response bandwidth limit 223/200 pps
> 
> Is there any way to trace the people that are causing this? It's becoming a
> daily occurance and it's beginning to irritate me.
 
You can also use ipfw to detect who is scanning you.

# ipfw add deny log icmp from any to any icmptypes 3

icmptypes 3 means "destination unreachable" which contains "port unreachable".

for more info, man ipfw.


-- 
Kwangyul Seo <skyul@plus.or.kr>
My Gnupg key is available at http://skyul.plus.or.kr/skyul.gpg

--sm4nu43k4a2Rpi4c
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD4DBQE6cvtpqUpO7he7BaERAoc1AKCU2lfNVXWauga92aQHleO4WL1CLgCY6IeG
OyzrNcexSY7N1oZUZvvn3Q==
=6xWK
-----END PGP SIGNATURE-----

--sm4nu43k4a2Rpi4c--


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010128014633.A1727>