what is ping of death? getting it a lot on my router

[dfuse]

Hey,
this is not really a Gentoo question, but I wouldn't know where else to post it,
since a few days I'm getting a lot of ping of deaths on my router:

[dfuse]

I've looked up the ipaddress with www.network-tools and came out on some german isp. I've mailed to the abuse mail that was listed on the RIPE database, I hope this helps. It is possible for a hacker to make the origin of the attack appear from that ip but actually coming from another?

[fleed]

It is possible for them to spoof their ip address indeed. And if they're only trying to bring your system down rather than gain access to it then they'd most likely do so. I'm sorry but I don't know anything about ping of death so I can't help you. IIRC though it's something that's been handled safely by the kernel for a few years now. When I turned on logging in my iptables rules I saw that the great majority of the entries were for pings/icmp (which I block anyway). I just added a rule to ignore those instead of logging them otherwise it's difficult to trawl through masses of repetitive data.

[dfuse]

Hm I'm not worried about my linux'es, I have a separate hardware router, which drops pings, but what I'm worried about is if the constant attacks generate traffic that slows down my connection (for which I'm paying in the end)

[fleed]

Then I think you're right to be worried and there's not much you can do unless the ISP of the offender takes action.

On a side note, you can also find out details on the ip address with the whois command. It's in net-misc/whois.

[dfuse]

I'm on windows machine now on my work. But I already looked up the ip with the whois tools on network-tools.com and contacted the abuse departement of the isp I found. No response yet though.