Page 1 of 1

POD(PING OF DEATH PROBLEM

Posted: Mon Jan 18, 2010 6:50 pm
by darkwolf999
does somebody know how to block a ping of death? somebody attacked us several times. is there a program or somethingto block that stuff>?

Re: POD(PING OF DEATH PROBLEM

Posted: Mon Jan 18, 2010 7:31 pm
by takhs7
a ping attack? :/ i doubt its that.. sounds weak to me.. probably something like l2j-attacker that floods the memory with crap packet(s)... solution? there isnt anything that can protect u 100% of DDoS attacks as far as i know.. there are some fixes here and there but... :roll:

Re: POD(PING OF DEATH PROBLEM

Posted: Mon Jan 18, 2010 7:46 pm
by janiii
update to latest svn revision. make some firewall precautions. set up your server computer better. check forum for some suggestions how to keep away attackers from your server.

Re: POD(PING OF DEATH PROBLEM

Posted: Tue Jan 19, 2010 9:48 pm
by TheSaint
darkwolf999 wrote:does somebody know how to block a ping of death? somebody attacked us several times. is there a program or somethingto block that stuff>?
If you are sure that the attack is really PoD you may consider to cut off the incoming ICMP traffic on your border firewall on outside interface (or even router). From the certain point of view ICMP is only diagnostic protocol and rejecting such malformed traffic is not harmfull. However this traffic will fill your internet connection because even if it will not reach the destination server, it will reach the outside interface.
In this case you will have to talk to your internet provider and ask him to inspect ICMP on your downlink. Such inspection should allow normalized ICMP and reject malformed packets (in this case packets with abnormal size).

A.

Re: POD(PING OF DEATH PROBLEM

Posted: Wed Jan 20, 2010 1:23 am
by Deadmeat
Most Router's and Firewall's by default have TCP port 7 blocked and ingnore echo packets and if you don't have a hardware Firewall you can use software Firewall to do the same thing but most software Firewall's don't work as well as hardware and slow your computer down, also like TheSaint said it will only stop the packets at the Router/Firewall and you should do a Whois on the IP and find out who the ISP is for the IP address and contact them and let them know that there customer is ping flooding you from that IP address.