Our .NET web application was getting blocked in several routers (DLink) as a "Smurf Attack" (a faked sender
IP address). This was systematically happening in the transfer between the first and the second page on our
web site
After much ado we found out that turning off client viewstate (in the Aspx page) caused the problem to go
away; or so we thought. it turns out we only moved the problem a couple of pages later in the system, but
this time it was a HttpHandler that was being blocked (no Aspx involved)
Before we got the second bug report, I thought this problem was related to the actual _VIEWSTATE HTML hidden
field that was being sent. When the second problem was reported, I am more inclined to believe that the
ViewState toggle (in the Aspx) has some side-effect on Socket Pooling in IIS/.NET. Between the two page
requests, there is idle time on the socket (obviously, we are waiting for user action); could the Smurf
Attack be triggered by a change of socket for the next request ? Anyone have any experience on this
Kristia