From owner-freebsd-isp  Mon May  5 11:32:18 1997
Return-Path: <owner-isp>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.5/8.8.5) id LAA10683
          for isp-outgoing; Mon, 5 May 1997 11:32:18 -0700 (PDT)
Received: from amiga.amitar.com.au (root@amiga.amitar.com.au [203.57.242.1])
          by hub.freebsd.org (8.8.5/8.8.5) with ESMTP id LAA10678
          for <freebsd-isp@freebsd.org>; Mon, 5 May 1997 11:32:15 -0700 (PDT)
Received: from localhost (slaterm@localhost)
          by amiga.amitar.com.au (8.8.4/8.8.4) with SMTP
	  id CAA02123 for <freebsd-isp@freebsd.org>; Tue, 6 May 1997 02:23:40 +0800
Date: Tue, 6 May 1997 02:23:40 +0800 (SGT)
From: Michael Slater <slaterm@amiga.amitar.com.au>
To: freebsd-isp@freebsd.org
Subject: Ping flood atacks 
Message-ID: <Pine.LNX.3.95.970506021744.2020C-100000@amiga.amitar.com.au>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-isp@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk

Hello,
     earlier this evening my system with a 64k ISDN link was subjected to
an extremley vicious Ping flood attack with randomly spoofed I.P
addresses.This completly saturated our link rendering it unusable for
several hours. My question, is it in any way possible to trace such an
attack back to it's true source ?

any info would be appriciated


Michael Slater
slaterm@amitar.com.au