From owner-freebsd-security Fri Jan 21 22:44:19 2000 Delivered-To: freebsd-security@freebsd.org Received: from lariat.lariat.org (lariat.lariat.org [206.100.185.2]) by hub.freebsd.org (Postfix) with ESMTP id 9D19F14C19 for ; Fri, 21 Jan 2000 22:44:16 -0800 (PST) (envelope-from brett@lariat.org) Received: from workhorse (IDENT:ppp0.lariat.org@lariat.lariat.org [206.100.185.2]) by lariat.lariat.org (8.9.3/8.9.3) with ESMTP id XAA00338; Fri, 21 Jan 2000 23:44:08 -0700 (MST) Message-Id: <4.2.2.20000121234159.0198a100@localhost> X-Sender: brett@localhost X-Mailer: QUALCOMM Windows Eudora Pro Version 4.2.2 Date: Fri, 21 Jan 2000 23:44:06 -0700 To: Gene Harris From: Brett Glass Subject: Re: Follow Up to NT DoS w/stream Cc: freebsd-security@freebsd.org In-Reply-To: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org At 11:42 PM 1/21/2000 , Gene Harris wrote: >I then played around, using the FreeBSD box to launch an >attack with the command ./stream 10.255.255.255 0 0 10000. >Oh WOW! The network came to a screaching halt. An old >laptop 100 MHz Pentium laptop stopped responding, and a much >newer Windows 98 machine slowed noticably. The collision >light went from an occasional blink to pegged on the >network hub. The NT machine took forever to read from the CD >ROM on the Win98 machine. The linux box stopped responding >altogether. No machine crashed. I ran the attack for 30 >minutes. As soon as the attack was terminated, all boxes >returned to normal activity. Sounds like the RSTs were being amplified into an ICMP storm. --Brett To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message