Subject: Re: Distributed denial of service attacks.
To: NetBSD Security Technical Discussion List <tech-security@netbsd.org>
From: Andrew Brown <atatat@atatdot.net>
List: tech-security
Date: 09/09/2001 20:23:31
>> this is a good suggestion, but leads me to ask: how does one typically
>> "fling an arbitrarily formed packet" at host x?
>
>ipsend, iptest, etc., all part of IP Filter....  (maybe not compiled and
>installed by default in the integrated version)

they seem to be compiled and installed on my machine, so i'm betting
that they get compiled and installed on most peoples' machines.

on the flip side, that's good, but not quite enough.  i can't specify
tcp data (or arbitrary ip packet data) on the command line.  the thing
i threw together three years ago would allow me to do, eg,

	datagram ip_{src,dst}=1.2.3.4 tcp_{s,d}port=139 tcp_flags=2

and "land" attack the machine at 1.2.3.4.  seq and ack numbers were
also settable, as was (well, is) random tcp data, so that i could send
anything.  unfortunately, as with most things, it got far enough for
me to do what i needed with it, and it has since languished in a large
tar vall of "old stuff".

i was just wondering if there was something better, besides the use of
ipsend with a configuration file.

-- 
|-----< "CODE WARRIOR" >-----|
codewarrior@daemon.org             * "ah!  i see you have the internet
twofsonet@graffiti.com (Andrew Brown)                that goes *ping*!"
andrew@crossbar.com       * "information is power -- share the wealth."