Re: udp packet storms
Darren Reed (avalon@coombs.anu.edu.au)
Sun, 30 Oct 1994 19:19:58 +1100 (EDT)
>
> "In the previous message, Tim Newsham said..."
> >
> >
> > There's at least one way to make a UDP packet storm. Not
> > very hard to do:
> >
> > src address = 255.255.255.255 port 7
> > dst address = <some host> port 7
> >
> > the port will be echoed by the inetd (echo port) back to the
> > sender (255.255.255.255 port 7). Each machine with an inetd
> > that has echo enabled will echo the packet back to the first
> > machine. Broadcast addresses need not be used:
> >
> > src address = <some host> port 7
> > dst address = <some other host> port 7
> >
> > I imagine the same can be done with talkd packets. UDP source
> > addresses are easy to forge.
>
> That's interesting - it amounts to a feedback loop (in electrical
> or audio terminology). Is there a way to interrupt this sort of
> thing (short of killing inetd or the involved daemon) or rebooting (a
> drastic method of doing the same thing)?
>
> How would one prevent this without disabling the udp services?
Can't as they're interal to inetd.
Get xinted and hack that to ignore responses from broadcast addresses
(if it don't already).