October 2001 - NANOG - lists.nanog.org

Re: Digital Island sponsors DoS attempt
by Quibell, Marc 26 Oct '01

26 Oct '01

Curious Chris, What IP's are they probing? LAN IPs? Or just the DNS server as they claim? And what then do these pings have to do with [quote from D.I.] "finding the nearest servers from our customers (Microsoft) to you"? What good does it do to ping to find distances, since the timing on the internet is not a constant, and neither are the pops, routes, hops...etc. This is why we use routing tables that are not constant... I really see no honest reason to be ping-probing one's LAN. And in the spirit of the internet and "good faith" behavior, a better explaination is warranted. > At 08:37 PM 10/25/2001, Christopher J. Wolff wrote: > > >Unfortunately, in this case I am not a customer of Digital Island in any > >way, nor have I given them authorization to hammer my network 441 times (and > >counting) in the last two hours. > > They're of the opinion that they don't need your permission... if they want > to hammer your network, they will. > > 'course, a nice ACL at the borders reminds 'em who your network actually > belongs to >

2 1

RE: Digital Island sponsors DoS attempt?
by Quibell, Marc 26 Oct '01

26 Oct '01

That's all fine Valdis, but no one does MTU check on the internet or pmtu checks. This is all LAN-based... -----Original Message----- From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] Sent: Friday, October 26, 2001 11:49 AM To: Dave Siegel Cc: nanog(a)merit.edu Subject: Re: Digital Island sponsors DoS attempt? On Fri, 26 Oct 2001 09:32:39 PDT, Dave Siegel said: > If you have a list of prefix's you intend to measure, it would not be If. This list comes from *where*? What if I pointed out that IBM's AIX implements Path MTU Discovery by sending an ICMP packet with max MTU and the DF bit set (so it can discover the *max* MTU even if the first *TCP* packet is not a full MTU long)? Are you saying that I should contact each prefix that my Listserv machine is sending mail to, to get permission to negotiate PMTU discovery? Ouch. That's 600K subscribers, and I need to go look up where their MX entries point to, figure out what AS the destination is in, and send the AS contact mail (assuming that 'whois' actually has valid data) - and then repeat for every new subscriber to a list from an AS we haven't contacted before. No? That seems silly? How is it any different from 5 PING packets so a site can decide which server to send stuff from? Where do you draw the line? > transit providers needn't be involved, as transit providers typically > don't measure icmp flows bound to customers. We've seen cases where transit providers do things like install blackhole routing because they disagree with a site because of their traffic. This proves that at least *some* transit providers care about *some* traffic for *some* reason. Again, where do you draw the line? -- Valdis Kletnieks Operating Systems Analyst Virginia Tech

2 1

RE: Fwd: Re: Digital Island sponsors DoS attempt
by Quibell, Marc 26 Oct '01

26 Oct '01

Me thinks that when such technologies be commercialized on the net, there will be problems. Usually, IP and such technologies are the charge of the internet community and we form committees, or use IEEE, IETF, RFCs, ARIN...etc for these and other technologies and come to open internet standards and agreements on how to improve such things. Now we have these people coming in here on their own and attempting to shove their technolgies down our pipes w/o OUR concensus! Anyone now see the problem with this? I believe this to be the key as to why this is wrong and why DI, or Akamai, should not be even allowed to 'help' the internet. Marc Quibell ICN Network Operations Center Data Operations Group noc(a)icn.state.ia.us 1-800-572-3940 -----Original Message----- From: Mike Batchelor [mailto:mikebat@tmcs.net] Sent: Friday, October 26, 2001 11:51 AM To: nanog(a)merit.edu Subject: RE: Fwd: Re: Digital Island sponsors DoS attempt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > in the case where the sender and receiver are communicating between one > or many third parties, there is no direct relationship and thus no apriori > terms of service to which the traffic must conform. for this, we > reverse the > model: "everything not welcomed is forbidden" and thus create a prior > restraint problem which goes by the name "what, then, is implicitly > welcome or unwelcome?" And how does the owner communicate this to the sender ahead of time? I don't think you can, else there would not be a spam problem. Therefore, the only logical position the sender can take, if he is to act at all, is to assume that whatever is not actively prevented or refused, is welcome, until such time as he is notified otherwise. If it is not this way, how can ANY unsolicited communication take place? Must I ask permission to ask permission? - --- "The avalanche has already begun. It is too late for the pebbles to vote" - Kosh -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com> iQA/AwUBO9mUbEksS4VV8BvHEQJeQACfUpIpxRMDkZl/4CWpc/fUKF8wOFEAoKj2 1bhQXIg33MwAqB++ZOjlLr0r =6hu1 -----END PGP SIGNATURE-----

2 1

Syndesis Postmaster/root contact?
by measl＠mfn.org 26 Oct '01

26 Oct '01

Is there a living breathing person on this list from syndesis.com? I have discussed this with other list members, and I m not the only one who gets the below attached "notice" from their domain EVERY time something goes out to nanog (regardless of content). Their filter is BROKEN, and dozens of politely worded notices (including examples such as the one below) have gone unacknowledged [to postmaster, MAIL-SA, administrator, etc.). This is not just annoying, I believe it violates nanog policy, no? -- Yours, J.A. Terranson sysadmin(a)mfn.org ---------- Forwarded message ---------- Date: Fri, 26 Oct 2001 12:33:32 -0400 From: System Attendant <MAIL-SA(a)syndesis.com> To: "'measl(a)mfn.org'" <measl(a)mfn.org> Subject: ScanMail Message: To Sender, sensitive content found and action t aken. Trend SMEX Content Filter has detected sensitive content. Place = Grant A. Kirkwood; Nick Thompson; Andy Dills; Christopher Wolff; nanog(a)merit.edu; Sender = measl(a)mfn.org Subject = Re: FWD: RE: FW: Getting hacked by Digital Isle? Delivery Time = October 26, 2001 (Friday) 12:33:32 Policy = Sexual Discrimination Action on this mail = Quarantine message Warning message from administrator: Sender, Content filter has detected a sensitive e-mail.

1 0

RE: Fwd: Re: Digital Island sponsors DoS attempt?
by Borchers, Mark 26 Oct '01

26 Oct '01

If ping testing scales as badly as you suggest, all of these products need to be yanked off the market asap. Putting such tools in the hands of millions of end users is certainly more of a threat than their use by network engineers. http://compnetworking.about.com/cs/pingtools/ > On Fri, 26 Oct 2001, Jonas Luster wrote: > > Jonas, > > It's one every 20 seconds from -one- ISP. What happens when > thousands of ISPs begin offering this service? > > a) more people are waken up at 3am by tripped IDS systems > > b) more people filter all icmp and break the internet > > c) more people have to add more acls to their routers to > prevent pushing > garbage as much as possible at the core, driving up cost and cpu > > > This service should clearly be "opt-in". > > Also, I believe the second comment made on this thread was > regarding the > idea that we implicitly give people permission to do this > sort of thing > by connecting to the internet (or per our sla/whatever). I > surely do not > give people permission to attack my network, why is this any > different? > Intentions? > > rgds, > > Adam >

1 0

RE: FWD: RE: FW: Getting hacked by Digital Isle?
by Quibell, Marc 26 Oct '01

26 Oct '01

I believe you subscribed to this thread Andy.... We don't need a flame. Please be more mature. -----Original Message----- From: Andy Dills [mailto:andy@xecu.net] Sent: Friday, October 26, 2001 10:27 AM To: Christopher Wolff Cc: nanog(a)merit.edu Subject: Re: FWD: RE: FW: Getting hacked by Digital Isle? On Thu, 25 Oct 2001, Christopher Wolff wrote: > > Here is the official Digital Isle party line. The part that I like is > > "3) Respond to this message requesting we stop pinging your server. > In this event our pinging will cease in several days." > > Several days? I'm wondering if I can send a bill to Digital Isle for > beta testing their product on my time and bandwidth without even > asking me. Sure. On that same note, I'm sending you a bill for having to read this pointless thread. 400 packets. I could understand your gripe if you were personally hand-delivering packets via camel, but come on. If it bothers you, block it. Stop whining. Andy xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Andy Dills 301-682-9972 Xecunet, LLC www.xecu.net xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Dialup * Webhosting * E-Commerce * High-Speed Access

1 0

Fwd: Re: Digital Island sponsors DoS attempt?
by Jason Forester 26 Oct '01

26 Oct '01

To: chris(a)bblabs.com Subject: Re: Digital Island sponsors DoS attempt? Cc: nanog(a)merit.edu, abuse(a)digisle.net Chris, As the message says, this is not an attack of any kind. It is a system which collects metrics for our Footprint Content Delivery System. The system is attempting to determine the closest servers to your network, to provide good service to your customers when they download from Footprint customers such as Microsoft. I'm sure you will get a response from abuse(a)digisle.net very shortly, but I wanted to allay your fears quickly. There is no attack. - jason -----Original Message----- From: Christopher J. Wolff [mailto:chris@bblabs.com] Sent: Thursday, October 25, 2001 12:58 PM To: nanog(a)merit.edu Subject: Digital Island sponsors DoS attempt? Hello friends, My IDS was just tripped over 300 times. The decoded packet says: mailto:abuse@digisle.com for questions This ICMP ECHO REQUEST/REPLY is part of the real-time network monitoring performed by Digital Island Inc. It is not an attack. If you have questions please contact abuse(a)digisle.com....................................................... .... ........................................................................ .... We are not on their network or in any way affiliated with Digital Island, I'm just curious if anyone else has seen this anomaly, if it is legit, or if it is a real attack being spoofed from Digital Island...no response from abuse(a)digisle.com yet. Regards, Christopher J. Wolff, VP, CIO Broadband Laboratories, Inc. http://www.bblabs.com email:chris@bblabs.com phone:520.622.4338 x234 -- Jason Forester jasonf(a)digisle.net Network Performance Engineer Digital Island

14 16

Digital Island sponsors DoS attempt?
by Christopher J. Wolff 26 Oct '01

26 Oct '01

Hello friends, My IDS was just tripped over 300 times. The decoded packet says: mailto:abuse@digisle.com for questions This ICMP ECHO REQUEST/REPLY is part of the real-time network monitoring performed by Digital Island Inc. It is not an attack. If you have questions please contact abuse(a)digisle.com........................................................... ............................................................................ ............................................................................ ............................................................................ ............................................................................ ............................................................................ ............................................................................ ............................................................................ ............................................................................ ............................................................................ ............................................................................ ............................................................................ ............................................................................ ............................................................................ ............................................................................ ............................................... We are not on their network or in any way affiliated with Digital Island, I'm just curious if anyone else has seen this anomaly, if it is legit, or if it is a real attack being spoofed from Digital Island...no response from abuse(a)digisle.com yet. Regards, Christopher J. Wolff, VP, CIO Broadband Laboratories, Inc. http://www.bblabs.com email:chris@bblabs.com phone:520.622.4338 x234

7 8

RWHOIS Bug Fix
by ginny listman 26 Oct '01

26 Oct '01

Regarding the recent vunerabilities discovered in the RWhois code, ARIN Engineering has released a patch. This patch can be found at: ftp://ftp.arin.net/pub/rwhois/rwhoisd-1.5.7-1.tar.gz Questions can be addressed to dbwg(a)arin.net Ginny Listman Director of Engineering ARIN

1 0

How worried is too worried? Plus, a Global Crossing Story.
by Christopher Wolff 26 Oct '01

26 Oct '01

I truely enjoyed the wide range of reponses to my Digital Island post. Everything from DI is perfectly justified to 'tell DI to stick it' haha. I certainly do not run the largest ISP, nor the smallest, but my small company is managing customer connectivity on both coasts of the continental US. My customers know me as the one that cares about their network infrastructure and can answer most questions quickly. I enjoy offering personal service. I also take pride in managing my network well. I know, for the most part, what kinds of traffic are passing through my network. This helps me take a proactive stance to issues before they become my customers' business impediments. Therefore, I have to respectfully take exception to the opinion of "Welcome to the Internet, there's nothing you can do, just don't worry about 441 packets." I partner with companies that share my view of network management. Recently I had an issue with a customer that was claiming poor throughput. Global crossing did everything in their power to analyze their network, my network, and my customers server farm. Although this turned out to be a TCP/IP tuning issue on the particular host, Global Crossing did not charge me a premium for investigating this issue. Throughout this resolution, Global Crossing earned my respect and confidence that I am *partnered* with a vendor instead of just buying bandwidth from them. Just my $0.02, Christopher J. Wolff, VP, CTO Broadband Laboratories

5 4