Re: [FW1] How do I stop being smurfed?

[Tim Gollschewsky <tim@FW1-NOSPAMvirgin.com>]

For everyone who has been following this, they have decided to add
an ACL on the router (finally!).  Not sure if they made that decision
based on the amount of noise I was making or the fact that it was just
plain common sense and the right thing to do.

Although, saying that, they haven't done it yet.....

And yes, once this is over I'm putting my own router in between my
FW and theirs which I'm going to use for packet-filtering and
for these sort of situations.

For all those who offered advice, thanks heaps!!

On Tue, Oct 03, 2000 at 04:17:39PM +0100, Murphy, Paul spoke thusly:
> 
> You seem to have the option of putting your own router in between the one
> you cannot control and your firewall, which wouldn't prevent these icmps
> getting to your bit of the internet, but would at least take the pressure
> off the firewall.
> 
> Else get a new service providor.  There is a school of thought that says
> your boundery router should packet filter which leaves your firewall more
> processor time to do the stateful inspection, simply because it doesn't have
> to drop all the traffic that shouldn't get to it from the outside in the
> first place.
> 
> Paul.
> 
> 
> -----Original Message-----
> From: Tim Gollschewsky [mailto:tim@virgin.com]
> Sent: 03 October 2000 14:11
> To: Firwall-1 List
> Subject: Re: [FW1] How do I stop being smurfed?
> 
> 
> 
> I agree, but next hop outside my FW is controlled by exodus who
> refuse to do anything.
> 
> On Tue, Oct 03, 2000 at 03:05:44PM +0200, Jonas Thambert spoke thusly:
> > A filtering router would probably do it...
> > 
> > /Jonas
> > 
> > 
> > 
> > -----Original Message-----
> > From: Tim Gollschewsky [mailto:tim@virgin.com]
> > Sent: den 3 oktober 2000 14:39
> > To: Firwall-1 List
> > Subject: [FW1] How do I stop being smurfed?
> > 
> > 
> > 
> > Hi,
> > 
> > One of the sites I manage is currently under a heavy smurf attack, the
> > only way I can think of to stop it is to go upstream to my provider
> > and ask them to block echo-replys (or just ICMP) to the target machine,
> > but my provider (exodus) refuses to help.   :(
> > 
> > Is there ANYTHING else I can do?
> > 
> > Thanks,
> > 
> > Tim.
> > 
> > 
> >
> ============================================================================
> > ====
> >      To unsubscribe from this mailing list, please see the instructions at
> >                http://www.checkpoint.com/services/mailing.html
> >
> ============================================================================
> > ====
> 
> 
> ============================================================================
> ====
>      To unsubscribe from this mailing list, please see the instructions at
>                http://www.checkpoint.com/services/mailing.html
> ============================================================================
> ====
> ---------------------------------------------------------------------------------
> This e-mail is intended only for the above addressee. It may contain
> privileged information. If you are not the addressee you must not copy,
> distribute, disclose or use any of the information in it. If you have
> received it in error please delete it and immediately notify the
> sender.
> 
> evolvebank.com is a division of Lloyds TSB Bank plc.
> Lloyds TSB Bank plc, 71 Lombard Street, London EC3P 3BS.  Registered in
> England, number 2065.  Telephone No: 020 7626 1500
> Lloyds TSB Scotland plc, Henry Duncan House, 120 George Street,
> Edinburgh EH2 4LH. Registered in Scotland, number 95237.  Telephone
> No:> 
> Lloyds TSB Bank plc and Lloyds TSB Scotland plc are regulated by the
> Personal Investment Authority and represent only the Scottish Widows
> and Lloyds TSB Marketing Group for life assurance, pensions and
> investment business.
> 
> Members of the UK Banking Ombudsman Scheme and signatories to the UK
> Banking Code.
> ----------------------------------------------------------------------------------


================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================