Protocol 17 likely refers to UDP.
https://en.wikipedia.org/wiki/List_of_IP_protocol_numbers
-Original Message-
From: NANOG [mailto:nanog-boun...@nanog.org] On Behalf Of Large Hadron Collider
Sent: Wednesday, 13 September 2017 11:08 AM
To: nanog@nanog.org
Subject: Protocol 17 floods from
om>
To: Krunal Shah <ks...@primustel.ca>
Cc: "nanog@nanog.org" <nanog@nanog.org>
Sent: Wednesday, September 13, 2017 7:59 AM
Subject: Re: Protocol 17 floods from Vietnam & Mexico?
On Wed, Sep 13, 2017 at 9:59 AM, Krunal Shah <ks...@primustel.ca> wrote:
&
; -Original Message-
> From: NANOG [mailto:nanog-boun...@nanog.org] On Behalf Of Mark Andrews
> Sent: Tuesday, September 12, 2017 10:45 PM
> To: Large Hadron Collider
> Cc: nanog@nanog.org
> Subject: Re: Protocol 17 floods from Vietnam & Mexico?
>
>
> In message <08ed
It might be spoofed source IPs
Krunal Shah
-Original Message-
From: NANOG [mailto:nanog-boun...@nanog.org] On Behalf Of Mark Andrews
Sent: Tuesday, September 12, 2017 10:45 PM
To: Large Hadron Collider
Cc: nanog@nanog.org
Subject: Re: Protocol 17 floods from Vietnam & Me
In message <08ed2903-c81c-aa2e-cd04-4fa117840...@gmx.com>, Large Hadron
Collider writes:
> Yes, I'm being UDP flooded. I worked that out by grepping /etc/protocols.
>
>
> On 12/09/2017 18:24, Matt Harris wrote:
> > Protocol 17 is UDP. UDP is pretty common on the internet. Not sure
> > why
Yes, I'm being UDP flooded. I worked that out by grepping /etc/protocols.
On 12/09/2017 18:24, Matt Harris wrote:
Protocol 17 is UDP. UDP is pretty common on the internet. Not sure
why source and destination ports aren't being shown by your tool
there, might be malformed UDP packets designed
Protocol 17 == UDP. These are just very big (65500 byte) UDP packets
which have been fragmented. Somebody need to teach that packet
analyser that UDP packets can be this big over IPv4 and bigger still
if you are using IPv6 jumbo packets.
Mark
In message
18:04:32.391082 IP 138-122-97-251.internet.static.ientc.mx >
umbrellix.net: ip-proto-17
18:04:32.391088 IP 138-122-97-251.internet.static.ientc.mx >
umbrellix.net: ip-proto-17
18:04:32.391110 IP 115.75.50.106.35180 > umbrellix.net.10454: UDP, bad
length 65500 > 1464
18:04:32.391145 IP
8 matches
Mail list logo