Re: FW: Packets from 255.255.255.255(80) (was: Packet from port 80 wi th spoofed microsoft.com ip)

Good Morning,

        As much as I hate killing a cool conspiracy theory (being chock full of such theories myself), I'm afraid that this one just needs killing...

        (1) This traffic has been seen worldwide, on every major carrier;

        (2) While the aggregate volume for this traffic is estimated by some at several gbps, even the hardest hit circuits are only seeing a handful of these per minute - hardly enough to register, let alone spike the price;

        (3) While burstable pipes do still exist here and there (mostly for low-end DS3's), the vast bulk of the worlds high speed (T1 and up) connections are pay-by-pipe, and not pay-by-traffic. Under this model, the NSPs would bear the brunt of the costs associated with this traffic, and not the smaller ISPs.

        (4) Every major NSP I am personally familiar with (and I work with all of them on a day to day basis) is expending at lest some energy trying to figure out what these packets are. Assuming only a minimal response, say, an hour a day of engineering time, any "benefits" these NSPs would realize through this type of "traffic padding" would be quickly extinguished.

        In short, conspiracy theories should be put forward only when the theory explains something that is otherwise unexplainable, AND, when the theory is not so obviously flawed as to make it's proponents seek the nearest wash rag to scrape off the eggs hanging from their eyebrows...

--
Yours,
J.A. Terranson
sysadmin@mfn.org

> -----Original Message-----





----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: 
http://aris.securityfocus.com

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek