ICMP Flooding vs SMURF Attack

August 20, 2006 @ 10:59 am · Filed under CCIE Study

Hi Andy
Could you explain the third line of ur ACL why have you done this one:
deny udp any eq echo any
Thanks Aamir
On 8/20/06, Anderson Mota Alves wrote: > > Hi Aamir, > > I just don’t know why are you using so many statements, from my > understanding this question could be answered with a few lines, someone > let me know if I’m wrong: > > ip access-list extended SMURF_UDP_FLOODING > deny icmp any any echo > deny icmp any eny echo-reply > deny udp any eq echo any > deny udp any any eq echo > permit ip any any > > Andy > > ——————————————————————– > > From: “Aamir Aziz” > Reply-To: “Aamir Aziz” > To: ccielab@groupstudy.com > Subject: ICMP Flooding vs SMURF Attack > Date: Sun, 20 Aug 2006 15:08:31 +0400 > >Hi there ppl > > > >I just wanted to clear something, if the tast says that certain > router is > >experiencing attack via ICMP and UDP flooding does it mean SMURF > ATTACK? > >and would the following ACL work to mitigate this flooding issue? > > > >deny icmp any 0.0.0.255 255.255.255.0 echo > >deny icmp any 0.0.0.0 255.255.255.0 echo > >deny icmp any 0.0.0.255 255.255.255.0 echo-reply deny icmp any > 0.0.0.0 > >255.255.255.0 echo-reply > >deny upd any 0.0.0.255 255.255.255.0 echo > >deny upd any 0.0.0.0 255.255.255.0 echo > >permit ip any any > > > >Thanks > >Aamir > > > >_______________________________________________________________________ > >Subscription information may be found at: > >http://www.groupstudy.com/list/CCIELab.html > > _______________________________________________________________________ > Subscription information may be found at: > http://www.groupstudy.com/list/CCIELab.html

Bookmark this post:These icons link to social bookmarking sites where readers can share and discover new web pages.