Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Path: utzoo!mnetor!uunet!amdahl!ames!sri-spam!rutgers!bellcore!faline!karn
From: karn@faline.bellcore.com (Phil R. Karn)
Newsgroups: comp.protocols.tcp-ip
Subject: details on misbehaving IP implementations
Message-ID: <1512@faline.bellcore.com>
Date: Mon, 2-Nov-87 18:54:31 EST
Article-I.D.: faline.1512
Posted: Mon Nov  2 18:54:31 1987
Date-Received: Fri, 6-Nov-87 07:13:19 EST
Organization: Bell Communications Research, Inc
Lines: 23
Keywords: broadcast funnies

I've been asked to be less coy about mentioning misbehaving host
implementations by name. Fine. Herewith is a brief summary of what I see on
our own network after about 5 minutes of monitoring with a "bogon trap"
of my own design:

1. A bunch of Excelan hosts emitting rwho/UDP broadcasts with 128.96.0.0
(our local broadcast address) in *both* the IP source and destination
fields.

2. A Vax running 4.3BSD (or at least that's what the login banner says)
that returns an ICMP Unreachable Port to the sender of each RIP packet it
sees.

3. A Vax running MicroVMS V4.6 that's doing the same thing.

4. A big group of Symbolics LISP machines that return ICMP Unreachable
Protocol messages in response to IP broadcasts with a locally-defined protocol
field (255).

None of these machines are under my administrative control so I cannot
verify actual software version numbers, etc.

Phil