Denial of service attack dissected

[Undertoad]

I have a few Linux boxes and a few Windows boxes. The Linux boxes are all patched with the latest stuff and only run the services that are needed. The Windows boxes are all running ZoneAlarm except one.

I was broken into once. Somebody rooted a server on the ISP's network where I live and installed a packet sniffer that basically watched the entire network for passwords. At that point they were able to root just about everyone.

Since then the ISP has tightened considerably. One time last year an employee of mine ran a portsniffer on our boxes just to see what we could find. But he screwed up and the sniffer sniffed addresses in other people's subnets. The next day I got a call from the ISP saying cut it out!

But we could be tracked, because we weren't spoofing our addresses. The scariest point in the article is that, if WinXP goes out in its current state, all these kiddies will be able to spoof to their hearts content, hiding their own addresses and becoming untraceable.