Re: Fwd: Re: Interesting request. block x.x.0.0

Re: Fwd: Re: Interesting request. block x.x.0.0

[Daniel F. Chief Security Engineer -]

Patrick Schaaf kindly pointed out that I could do this. 

iptables -I INPUT -s 0.0.0.0/0.0.255.255 -j DROP

That will drop any IP that ends in 0.0

Thanks for every ones help. 

I will also look into the u32 patch thanks again. 



On Thursday 23 January 2003 19:04, you wrote:
>  > I do not want to block every IP on say 45.208.0.0/16 just the ips ending
>  > in 0.0 as the last two octets.
>  >
>  > I can write a tcpdump filter to find the traffic Im just not sure if we
>  > have a way to craft a netfilter rule to do so. Or maybe the "recent"
>  > patch could be of use. Although the dDoS included 65000 source IP
>  > addresses. all ending in 0.0 for the ip address.
>  >
>  > the tcdump filter looks like this.
>  >
>  > tcpdump -nn -i eth0 'ip[18:2] == 00'
>
> The u32 match I recently posted can do this.

-- 
Daniel Fairchild - Chief Security Engineer | danielf@supportteam.net
The distance between nothing and infinity is always the same no matter how 
close you get to nothing.