Duplicitni pakety

[Martin Macok]

On Sun, 20 Jun 1999, Dusan Sys wrote:

> Zdravim,
> Tento nas server funguje jako brana do inetu. Pokud dam ping primo z tohoto serveru na jine stroje v nasi siti, tak je vse ok, ale pokud hodim ping s jine masiny nekam do internetu tak, ze data jen prochazi pres server hned mam na krku duplikaty. Primo ze serveru ( z brany ) je vse OK. Jsem z toho uplne vedle ....
> 
> >Mate nakonfigurovanou "broadcastovou odpoved" na ICMP ECHO (a nejspise i na jine 'veci') na vasi siti. Vase sit >figuruje jako tzv. broadcast "amplifier" a lze zneuzivat cizimi lidmi k floodovani jinych pocitacu/siti. Jedna se o >spatne nakonfigurovanou sit.
> 
> A jak dal........ jine jadro ???
> 
> Zdravi Dusan Sys

OK, abych rekl pravdu, routerum moc nerozumim a neporadim vam presne
kucharku, jak a co mate nastavit, nicmene jadrem by to byt nemelo, proste
je jen spatne nakonfigurovan firewall/router ...

Jde o to, ze pokud ja poslu ping dovnitr vasi site, vrati se mi 4 odpovedi
- muzu tedy zfalsovat odesilatele mych paketu a pokud vyuziji vetsiho
mnozstvi siti jako je ta vase, mohu tyto odpovedi nasobit napriklad
100-200x - pokud to pronasobite pomerne slusnou propustnosti pevne linky u
me a nizsi propustnosti napriklad modemovych pripojeni ... muzu tim hodne
lidem zablokovat pripojeni (tento utok se nazyva smurf).
Vam tim v podstate zadne extra nebezpeci nehrozi, 4-nasobek je jeste
pomerne OK, ale je to zbytecne zatizeni site navic. Existuje i podobna
verze utoku pomoci UDP (fraggle).

RFC 1812,
"Requirements for IP Version 4 Routers", Section 5.3.5, specifies:

---
   A router MAY have an option to disable receiving network-prefix-
   directed broadcasts on an interface and MUST have an option to
   disable forwarding network-prefix-directed broadcasts.  These options
   MUST default to permit receiving and forwarding network-prefix-
   directed broadcasts.
---

Generally, with IP providers and IP applications as we know them today,
this behavior should not be needed, and it is recommended that
directed-broadcasts be turned off, to suppress the effects of this
attack..


Podrobnejsi popis a rady:
URL: http://users.quadrunner.com/chuegen/smurf.cgi

P.S. Pokud si prectete tuto ^^^ stranku, budete jiste o mnoho chytrejsi
nez ja, ja jsem jenom BFU, ktery toto "umi" (neni nic lehciho) zneuzivat
... ;-)

P.S.2 Poznamka pro administratory moji site:
	umi zneuzivat != zneuziva

-- 
 -===========================<ISO-8859-2-compatible>=- 
 |           Martin Mačok                            |
 | email:  martin.macok na st.mff.cuni.cz               |
 | WWW:    http://kocour.ms.mff.cuni.cz/~macok/      |
 -===================================================-
 ... but Microsoft is today and Linux is tomorrow ...