Re: [nsp] Directed broadcasts

From: Dan Boehlke (dboehlke@mr.net)
Date: Sat Jul 04 1998 - 14:58:55 EDT


On Sat, 4 Jul 1998, Craig A. Huegen wrote:

> On Sat, Jul 04, 1998 at 03:29:05AM -0400, Rick Burts wrote:
> ==>the no ip directed-broadcast command configures the router to not pass
> ==>directed (subnet) broadcasts. If you do this on the routers where
> ==>traffic enters your network, broadcast pings will not get to your
> ==>main router.
> ==>There is not a way to configure the router not to answer if the ping
> ==>packet gets to the router.
>
> "no ip directed-broadcast" is per-LAN-interface. Placing it only on border
> routers does not help. It must be placed on every LAN interface on every
> router.
>
> Beginning in 12.0, "no ip directed-broadcast" is the default behavior.
>
> For information on the smurf attack, see
> http://www.quadrunner.com/~chuegen/smurf/
>
> I'll be adding a section relatively soon on using Committed Access Rate
> (CAR) to limit ICMP echo/echo-replies to a certain amount.
>
> /cah

One minor point. The "no ip directed-broadcast" needs to be on more than
just LAN interfaces. If you have a HSSI or other high speed WAN
interface you need it on those too. I recommend it on all interfaces.
A DS3 can act as a nice doubler without it.

--
Dan Boehlke, Senior Network Engineer                          M R N e t
Internet:  dboehlke@mr.net                       A MEANS Telcom Company
Phone:  612-362-5814                  2829 SE University Ave. Suite 200
WWW: http://www.mr.net/~dboehlke/                Minneapolis, MN  55414

 



This archive was generated by hypermail 2b29 : Sun Aug 04 2002 - 04:13:13 EDT