In-Reply-To: <E9A01F52DC939448BBDE44ED2E1C468F6710DD@muskie.rc.on.ca> Hi, maybe there was some incomprehension about what I meant. I am aware that "Broadcast Storm" is an old and well known problem, that affects misconfigured LANs. It's easy to find documentation about that matter, but that's not the point of my discussion. A "Broadcast Storm", as far as I know, happens when a lot of machines in a local network, for some reason, start to send broadcast packets and fill the network capacity. My argument was about a different thing: many flooders, like smurf and fraggle, work sending spoofed packets to broadcast addresses of misconfigured networks, making all the machines reply to the spoofed address, which is the "victim" host (outside the network) and gets flooded. (e.g. with ICMP echo replies, UDP echo replies, UDP chargen data, etc). I also noticed that there are a lot of variants of those programs which work also with DNS data or game servers data. Everyone knows this. The only thing i've done is looking if this kind of attack could work even with NetBIOS Name Request packets: after my tests I noticed that it works, and it usually generates a bigger amount of replied data than ICMP echos, UDP chargen or others. I looked around in the Internet and found nothing about NetBIOS being used IN THIS WAY (I mean spoofed NetBIOS Name Requests sent to broadcast addresses of misconfigured networks to flood remote hosts), so I made additional tests and made them public. Best Regards, Francesco Vigo --- Original Message >From: "Russ" <Russ.Cooper@rc.on.ca> >To: "Francesco Vigo" <f.vigo@anti-idle.com>, > <bugtraq@securityfocus.com> > >Its called a NetBIOS Broadcast Storm, and its 15 years old now. No need = >to write your own code, many manufacturers, like Ungermann-Bass, IBM, = >Tandem Computers and others all wrote code that could do this quite = >effectively. The only difference between your code and theirs is that = >theirs would do it when you didn't want them to.
