OK OK
i thought I'd seen it all
or at least most of it
In my snort logs I get
Cyberkit, Nmap, Ip spoofing,MS SQL worms etc etc you name it

but what the hell is a broadscan smurf scanner

is this something new or what
are little blue guys ( the smurfs ) trying to crack my system
who are these morons and why arent they locked up in a rubber room

floppy

http://www.pentics.net/denial-of-ser...pers/smurf.cgi

The smurf attack is a type of DoS attack, described here. I'd imaging this smurf scanner is scanning for vulnerabilities that allow someone to use the attack.

They are invariably 15yr olds with far too much time on their hands, playing tit-for-tat against their "friends" on IRC somewhere. In this endeavour, recall neal stephenson: "Arguing with anonymous strangers on the Internet is a sucker's game because they almost always turn out to be - or to be indistinguishable from - self-righteous sixteen-year-olds possessing infinite amounts of free time."

A Smurf attack is a pretty well known DoS attack. It involves sending a ping to the broadcast address of a network. The catch is that the source address is spoofed to that of the target host, so that all the echo reply traffic from each host on the network that responds to broadcast pings will be sent to the target host instead of the attacker, so the initial packet is amplified by the number of hosts on the network. You should have your systems configured so that they do not respond to pings of the broadcast address or at the very minimum filter this kind of traffic at the border router/firewall. The alert is likely telling you that someone was attempting to identify whether your system/network responds to these kinds of packets and can be used as a smurf "amplifier". This attack is a well documented type of DoS, so you can find detailed info using a google search.

----EDIT---

or just follow the linkage christhom posted.

Thanks Capt & Christhom

the Smoothie is set to drop pings, ICMPs, etc etc - its just driving snort crazy
will check out those links
and yes looking at the firewall logs there are a lot of 15 yr olds with way too much time on their hands
thanks again
floppy