Use Google or the usual security sites to research smurf... "A perpetrator sends a large amount of ICMP echo (ping) traffic at IP broadcast addresses, all of it having a spoofed source address of a victim."
Since all ntop sees is the packet with it's spoofed source address, you aren't going to get far... -----Burton -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Niels Sent: Monday, April 04, 2005 3:09 PM To: [email protected] Subject: [Ntop] RE: RE: Promisc mode dangerous? Burton Strauss wrote: > Setting promisc means that the hardware processes all frames and > passes them into the stack. Tools like libpcap which hook at that > level can then see all frames. But the stack implements the same type > of 'is it for me' > tests before passing frames to higher levels (e.g. tcp/ip, > applications, etc.). > I see, good explanation. Thanks. How would I go about finding out who is smurfing me? //Niels _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
