Re: Packet rate limiting

From: alessandro salvatori <alessandrosalvatori(at)virgilio.it>
Date: Mon Jul 14 2003 - 17:24:42 EDT

yes, it works even with packets bigger than the buffer ;) i inserted a 1048 bytes payload into the ECHO REQUEST

libnet 1.1 smurf DoS: ICMP[RAW using context queue]

this much buffer: 1024
this much buffer: 32767
this much buffer: 12345
this much buffer: 32767
this much buffer: 1024

Using amplifier 143.248.16.0
Wrote 1076 byte ICMP packet; check the wire. Using amplifier 143.248.37.255
Wrote 1076 byte ICMP packet; check the wire. Using amplifier 143.248.2.0
Wrote 1076 byte ICMP packet; check the wire. Using amplifier 193.12.197.255
Wrote 1076 byte ICMP packet; check the wire. Using amplifier 193.12.196.255
Wrote 1076 byte ICMP packet; check the wire. Using amplifier 203.36.130.255
Wrote 1076 byte ICMP packet; check the wire. Using amplifier 166.114.192.127
...

I think i should make some more tests with the link layer interface... to know what is the minimum amount the Linux kernel allows... (Linux is so different from all the other implementation of BSD sockets...)

then there's also an other thing i'd like to implement... a new injection_type for the libnet... something we should call LIBNET_AUTO_LINK... using it you should not wonder about link layer hassles and libnet will use LIBNET_LINK internally, constructing the right link-layer header for you... anyway... this would be wuite easy for me to implement over ethernet... but i have no idea about how to do for FDDI and wireless lans... is this a good idea?
is anybody willing to help me?
thank you
cheers
sandr8)

On Sun, 13 Jul 2003 23:25:11 -0700
Aaron Turner <aturner@pobox.com> wrote:

> On Sun, Jul 13, 2003 at 11:22:04PM +0200, alessandro salvatori wrote:

---

To unsubscribe, e-mail: libnet-unsubscribe@securityfocus.com For additional commands, e-mail: libnet-help@securityfocus.com Received on Mon Jul 14 17:36:03 2003