I checked the attack against Catalyst 3550 running IOS 12.1(11)EA1 (the EMI variant having router functions). Here are my observations:
1. It was possible to disable an "L3 interface" of 3550 by sending "evil" packets to its IP address. I did not check whether you could kill an arbitrary interface by sending evil traffic to its specific IP address. 2. I was able to carry out the attack both directly, over a single (V)LAN, and indirectly through one router. In the second case (indirect), I had to increase TTL computed by the script by one. 3. "Evil" packets fill the input queue of a target interface but the amount of consumed queue slot is not equal to the number of received packets. A batch of 4 packets (1 for each "dangerous" protocol) consumed 3 slots, a batch of 40 packets (10 per protocol) consumed approximately 10 slots, larger batches appeared to be even less efficient. I think there is some kind of rate limiting mechanism involved. 4. As soon as an input queue fills up, the corresponding interface becomes unresponsive. This means a simple ping (ICMP or TCP) against the affected interface is sufficient to determine whether the attack has been succesful. On the other hand, forwarded traffic is unaffected (presumably only as long as ARP records needed to deliver forwarded packets remain in the cache). --Pavel Kankovsky aka Peak [ Boycott Microsoft--http://www.vcnet.com/bms ] "Resistance is futile. Open your source code and prepare for assimilation."
