Re: icmp: echo reply? Am I being attacked?
* John Vivian (John.Vivian@Exxecom.com) [000727 10:43]:
> Just a small correction: the broadcast address is
> (typically) .255, but a bit of experimentation has
> shown that pings to .0 and .255 result in the same
> response. You would be best to block both.
I seem to remember reading somewhere that in the original
implementations of IP xxx.xxx.xxx.0 was a broadcast address.
I think the early BSD's worked this way. Sometime or another
everyone decided to use xxx.xxx.xxx.255, but I guess some
IP stacks still support both.?.
I wish I could remember where I read this so that I could
provide a pointer. TCP/IP Illustrated V2. has a small blurb
about accepting an IP address of all 1's or all 0's
as a broadcast, but it doesn't go into any detail or supply
any historical context.
--
---
Nathan Valentine - nrvale0@uky.edu
University of Kentucky Distributed Computing Systems Lab
AIM: NRVesKY ICQ: 39023424
Reply to: