Re: [FW1] How do I stop being smurfed?

["Barry W. Kokotailo" <merlin@FW1-NOSPAMathabascau.ca>]

Add a rule to your firewall to disallow icmp packets inbound. Also, cherk
that policy for the
firewall to prevent icmp. By default, it is checked. On your internal
machines turn off the broadcast flag.
For BSDi systems, use sysctl. For Solaris systems use ndd. This will
prevent the machines from broadcasting if
they are asked to broadcast.

Hope this helps and good luck.

merlin
 
 

Tim Gollschewsky wrote:

Hi,

One of the sites I manage is currently under a heavy smurf attack, the
only way I can think of to stop it is to go upstream to my provider
and ask them to block echo-replys (or just ICMP) to the target machine,
but my provider (exodus) refuses to help.   :(

Is there ANYTHING else I can do?

Thanks,

Tim.

================================================================================
     To unsubscribe from this mailing list, please see the instructions at
              http://www.checkpoint.com/services/mailing.html
================================================================================

-- 
Barry W. Kokotailo
Senior Unix Systems AdministratorPGP =  71 71 96 A3 C0 C2 23 7A  23 4E D4 04 8C E0 42 6B  B0 2D D1 A5