On Thu, Mar 19, 2009 at 4:45 AM, Stuart Henderson <s...@spacehopper.org> wrote: > On 2009/03/18 20:45, Mail Lists wrote: >> >> Is there anyway possible that this is 'legitimate' traffic? >> > >> > damned unlikely. I think I'd be looking at a layer-1 solution if the >> > box can't be made to behave... >> >> Sorry, I don't quite know what you mean by a layer one solution short >> of moving the box to a different network. B I'm a little new to this >> sort of stuff. > > layer 1 = physical -> pulling the cable :-) > >> Thanks for the help - I'll probably end up insisting he move us to a >> different cabinet or a different VLAN if he can't contact the owner of >> the server sending the traffic. The funny thing is that they have >> VLAN's set up for separate cabinets but don't seem to be able to setup >> individual customers with their own vlan. > > They might not want to segregate customers as a matter of course, it's > a fair bit of work to setup in the first place (and extra IP address use > unless you use filtering bridges), and if they're a very large operation, > the maximum of 4096 VLANs might make things excessively complicated if > they do this for everyone. But I don't think you should accept being > DOS'd by someone in the same rack.. > > Did you see what sort of packets they are? Broadcast or multicast or > something? I'm wondering why they would even hit your machine otherwise. > >
They are multicast packets that are going to 224.0.1.24 which according to this: http://www.iana.org/assignments/multicast-addresses/ is for microsoft-ds. A snippet of the UDP stream looks like this: 8.............J.8.............J.8.............J.8.............J.8............ .J.8.............J.8.............J.8.............J.8.............J.8......... ....J.8.............J.8.............J I have not a clue that that means. Is there perhaps something in this that lets me tell the administrator of the offending box what's going on since the network admin seems unwilling or unable to to so? Anyways -this isn't really openbsd related any longer. Apologies if this is turning into noise. Thanks for all the help!
