Understanding the network.pdf - Back to Home

http://www.cert.org/
http://www.rootshell.com/
http://www.phrack.com/
SMURF attacks use IP-directed broadcasts to overload the network segment.
Usually, an ICMP message (like a ping) or IP datagram with the network's broadcast
address as the destination address (and a forged or bogus source address) is sent to
every host on the segment, which forces all the recipient hosts to respond. A
continuous flood of these packets will effectively "melt" the segment, allowing no
real traffic to be passed. These attacks can be prevented by denying ICMP echo
replies as part of your inbound security filter:
access-list 106 deny icmp any any echo-reply
access-list 106 permit icmp any any
In addition, by disabling the router interface's capability to forward IP-directed
broadcasts, you can prevent the propagation of such traffic. This is accomplished
with the interface configuration subcommand .
AppleTalk Access-Lists
ACL filtering for AppleTalk is primarily oriented toward the restriction of user access
to network resources. AppleTalk ACLs make it possible to restrict access to nodes,
printers, file servers, networks (all or part of a cable-range), and zones. This
flexibility provides administrators with a great deal of control over what resources
are accessible to users, zones, and networks. You might want to restrict this kind of
traffic on your network because it's chatty; it takes up a lot of bandwidth, relatively
speaking. AppleTalk network traffic filtering is more complex than IP traffic filtering
due to AppleTalk's use of dynamic addressing and its logical naming scheme.
AppleTalk ACLs are built using a variety of matching criteria, which are listed in
Table 9.5.