Subject: Re: Fragmentation Attack

From: "David S. Miller" <[email-masked]>
Date: Sun, 8 Feb 2004 12:45:28 -0800

On Sat, 07 Feb 2004 12:00:42 -0600
Gandalf The White <[email-masked]> wrote:

> The requirements of the attack (from the perspective of the paper I wrote)
> was that you had taken over 20 cable modem computers.  From this viewpoint
> this could (of course) produce the required number of packets IMHO.
>
> Of course you could also clog up the bandwidth of just about any destination
> network with this requirement, but that is a different DoS.

Yes, but this very fact makes the "DoS" much much less interesting.
If I can clog your link anyways with arbitrary traffic, who cares
what it does as a second order effect, the machine is made unreachable
and unusable either way.

Also, these half-complete ICMP packets are really super easy to create
firewall rules for to block them at ingress of a major site.