RE: Network Problems Big Time

["Bill Paris" <bparis@xxxxxxxxxxx>]

Hi Guy, Neil O'Reilly posted to this list a couple week ago about a similiar
experience. I'll repost it below. Hope it helps...

Bill Paris
Sorrento Cheese Co., Inc.
716-823-6262 x376

PS: This mailing list is ASCII only...
-------------------------------------------------------
We recently conducted some denial of service attacks on various servers in
our LAN as part of a security review. We are running OS/400 V4R2 and found
that it is susceptible to the JOLT attack which involves sending fragmented
IP packets to the host.
I am told that this attack was designed to take down Windows 95 machines but
it completely hung TCP/IP on the AS/400. Ultimately we could not actually
end TCP/IP and had to IPL.

Has anyone come across this or similar vulnerabilities before ? Any advice
or experience would be much appreciated.

Thanks

Neil


-----Original Message-----
From: owner-midrange-l@midrange.com [mailto:owner-midrange-l@midrange.com]On
Behalf Of Murphy, Guy
Sent: Tuesday, August 10, 1999 9:59 AM
To: 'MIDRANGE-L@midrange.com'
Subject: Network Problems Big Time


        Our campus had a denial-of-service attack a week ago today.
Everyone is back to normal *except* our AS/400s.  We can connect to them by
tcp/ip from within our vlan but we cannot get a reliable connection through
the router.  Half of our 400 users come through the router and they cannot
work.  IBM says that the router has been changed so that the tcp/ip packets
are smaller than the tcp/ip packet header says they are, which is a protocol
error.  The campus network dudes say this not happening.  To bolster their
case they point out that no other machine on this router (and there are a
lot of them) is having this problem.  They have a point.  We have an NT
server on the same switch as our 400s and it's working just fine, which
really p*sses me off.
        Has anyone else experienced this problem and what did you do about
it.  We are at V4R3.
Guy Murphy - FACTS system
University of Illinois
217-333-8670

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---