Re: IGMP DOS Attack

From: Valdis.Kletnieksat_private
Date: Thu Apr 11 2002 - 12:53:03 PDT

  • Next message: Cushing, David: "RE: IGMP DOS Attack"

    On Thu, 11 Apr 2002 15:00:00 EDT, "Headley, Kevin" <kevin.headleyat_private>  said:
    
    > Since IGMP is multicast group membership and wouldn't pass a router unless
    > specifically configured to do so (in many cases at least)...I have seen
    > occasions where either the local machine is sending packets or a few other
    > machines on that segment are joinging the group, responding...
    
    Anybody *else* remember a certain worm randomly picking IP addresses to attack,
    and causing IGMP meltdowns when it happened to pick a 224.x.x.x address, as
    all the multicast-aware hosts would start asking about the group?  I remember
    a 2AM firestorm that took several of our routers and part of Abeliene with
    it...
    
    -- 
    				Valdis Kletnieks
    				Computer Systems Senior Engineer
    				Virginia Tech
    
    
    
    



    This archive was generated by hypermail 2b30 : Thu Apr 11 2002 - 13:32:25 PDT