January 2002 - NANOG - lists.nanog.org

Re: representativeness of flow data based on samples
by Mark Allman 31 Jan '02

31 Jan '02

> Does anybody here know of recent research with real internet > traffic which compares different sample rates wrt the > representativeness of the resulting flow data? You might take a look at: Nick Duffield, Carsten Lund, Mikkel Thorup. Charging from Sampled Network Usage. ACM SIGCOMM Internet Measurement Workshop, November 2001. http://www.icir.org/vern/imw-2001/imw2001-papers/03.pdf It may be along the lines your thinking about. allman --- Mark Allman -- BBN/NASA GRC -- http://roland.grc.nasa.gov/~mallman/

1 0

Re: WEF cyber-protest (was Re: distributed attack, high or not)
by Steven M. Bellovin 31 Jan '02

31 Jan '02

In message <Pine.GSO.4.40.0201310238250.16671-100000(a)clifden.donelan.com>, Sean Donelan writes: > >We're entering protest season. The World Economic Forum opens >today in New York City. Some protesters have launched what they >call a cyber-protest using several different tools. So far it >appears directed at a few selected, although well-known, corporations. > >http://www.geocities.com/net_strike_net/english_active.html > Right -- but an attack that lasts exactly an hour is much more like a zombie-based DDoS tool. Of course, the two aren't mutually exclusive. --Steve Bellovin, http://www.research.att.com/~smb Full text of "Firewalls" book now at http://www.wilyhacker.com

1 0

representativeness of flow data based on samples
by Joe Abley 31 Jan '02

31 Jan '02

Traffic measurement techniques such as NetFlow work by associating some characteristics of inbound packets on an interface with a flow, e.g. some tuple like (source addr, source port, dest addr, dest port, protocol). Counters per flow are incremented, and the numbers are exported periodically or when flows become inactive. There are a few vendors who now provide traffic export from high-speed interfaces by sampling those interfaces at a particular rate, and using the sampled packets to populate the per-flow counters, rather than looking at every packet. Does anybody here know of recent research with real internet traffic which compares different sample rates wrt the representativeness of the resulting flow data? For example, if I am trying to rank the top traffic sinks for my network beyond an attached peer (i.e. an ordinal rather than cardinal measurement), will I get different answers if I use a sampling rate of 1:1000 compared to 1:50, given a statistically "long enough" measurement period? Intuitively, it seems to me that the answers should be the same. However, it also seems to me that statistics are frequently non- intuitive. Joe

3 2

Re: distributed attack, high or not
by Joseph T. Klein 31 Jan '02

31 Jan '02

I define it as random because the traffic rise could be seen coming in from multiple providers and looked to be the same percent from all sources (separate routers with separate interfaces to separate ASNs in separate geographic locations). The traffic was inbound and not backsplash from randomized source addresses. It looks to me like a infection with someone turning a control knob. Is this common or a precusor of a bad thing? The anomaly was exactly one hour long. First I have seen of something like this in a relativly short time of gathering stats ... which I'm doing for another project. --On Thursday, 31 January 2002 02:09 +0000 Avleen Vig <lists-nanog(a)silverwraith.com> wrote: > On Thu, 31 Jan 2002, Joseph T. Klein wrote: > >> I saw what appears to be a distributed attack against a single IP >> address that reached nearly 500Mbs. I was thinking that this is >> high. Are people seeing any random attacks of this magnitude? > > Please define random :) > If you mean the source is random, then yes this attack is of a high > magnitude and I've seen one other this bad. > The addresses could be real, or spoofed - depending on the circumstance > and exact nature of the attack it'll vary. > > If you mean the target appears to be random, then you're probably just > very very unlucky :( > Attacks of this size are normally aimed at large IRC servers or large / > popular websites. > > -- > Avleen Vig > Network Security Officer > Smurf Amplifier Finding Executive: http://www.ircnetops.org/smurf -- Joseph T. Klein jtk(a)titania.net

1 0

RE: distributed attack, high or not
by LeBlanc, Jason 31 Jan '02

31 Jan '02

juno2? > -----Original Message----- > From: Joseph T. Klein [mailto:jtk@titania.net] > Sent: Wednesday, January 30, 2002 4:12 PM > To: nanog(a)merit.edu > Subject: distributed attack, high or not > > > > I saw what appears to be a distributed attack against a single IP > address that reached nearly 500Mbs. I was thinking that this is > high. Are people seeing any random attacks of this magnitude? > -- > Joseph T. Klein > jtk(a)titania.net >

1 0

OT: Wireless Billing Trivia Being Sought
by Leigh Anne Chisholm 30 Jan '02

30 Jan '02

Definitely off topic, but I thought there'd likely be someone out there that could answer this question for me. Last night a group of friends and myself were talking about using cellular telephones in light aircraft. The question that was posed is, what happens if the call is originated to a locally dialed number but transitions into the long-distance toll area? Conversely, what happens if a call originates in an area where long-distance charges apply but you transition into the local toll area? I know what I'd expect to happen--but does it actually work that way? Perhaps in an effort to keep this group "on-topic" - replies could be sent to me directly. If anyone else is interested in the answer, I'd be willing to forward them the information I get. Thanks... -- Leigh Anne -- Leigh Anne

1 0

RE: UUNet outage?
by LeBlanc, Jason 30 Jan '02

30 Jan '02

Was a maintenance window I think, though I missed the first part of this thread and don't know what times you folks had problems. During the Normal operations window on Jan 29, 2002 WorldCom will be performing the following scheduled maintenance activities. This activity is scheduled to take place from 3:00 a.m. to 6:00 a.m. (local hub time) in the contiguous US and elsewhere from 3:00 a.m. to 7:00 a.m. (local hub time) and may affect your connectivity. The following customer ID will be impacted: #####. If you have any questions, please contact our local Customer Network Support Center. Please reference the internal ticket number #####. Quality System Management-Global Maintenance Planning Worldcom (http://www.uu.net) 1(800) 900-0241 / +1(703) 206-5440 WorldCom United States 1-800-900-0241 (select the following options in order: 2, then 4, then 1) WorldCom Denmark (45) 80.30.50.50 WorldCom Italy (39) 02.3600.1887 WorldCom Sweden (46) 8.750.88.50 WorldCom Switzerland (41) 1.580.86.11 > -----Original Message----- > From: Vandy Hamidi [mailto:vhamidi@insweb.com] > Sent: Tuesday, January 29, 2002 7:06 PM > To: 'dlark(a)elmresources.com'; nanog(a)merit.edu > Subject: RE: UUNet outage? > > > > I noticed unavailability of some sites through our UUNet > connection as well. > Trace routes showed that the packets were being dropped after > it was passed > onto above.net but also before that. I assume not only was > above.net having > problems, but I screwed up UUNet's routes they received from them. > A call to UUNet didn't help. The tech, though nice, had no > idea what to > look for. I was sitting there giving him commands and asking > the result. > After I figured everything was ok between us, I figured it > was bigger than > just my connection and waited patiently. > All was good within 15 min or less. > > -=Vandy=- > > > -----Original Message----- > From: Daniel Lark [mailto:dlark@elmresources.com] > Sent: Friday, January 25, 2002 8:04 PM > To: nanog(a)merit.edu > Subject: Re: uunet outage? > > > > I have been noticing several UUNet problems recently. My > Oakland office > (connected via UUNet) and my company's service bureau, run by a > contractor company (also UUNet) had problems seeing my main corp. web > server colo'd at Hurricane Electric, yesterday. Turns out there was a > DoS attack ran against a router on above.net (which provides > the peering > between UUNet and HE). > > However, I have also seen problems with customers being > unable to see my > contractor's machines. Supposedly, there are some rather strategic DoS > attacks going on. Can anyone confirm this? > > Regards, > Dan Lark > ELM Resources, Inc. >

1 0

RE: NANOG 24: NAP BoF
by James Smith 30 Jan '02

30 Jan '02

Marketecture. It looks better to call yourself a NAP than to call yourself an IX. The naming of the "type" of exchange is by custom, and not law, AFAIK. Thus, the marketing droids take over. Look at what they have done to "broadband"... Maybe if we classed them by aggregate provisioned bandwidth, with a secondary classification that ranks number of peers at the point... James H. Smith II NNCDS NNCSE Systems Engineer The Presidio Corporation I speak for myself, even when I shouldn't.

2 1

RE: NANOG 24: NAP BoF
by Peter Ford 30 Jan '02

30 Jan '02

Looks like all of you can use the scheduled time to establish a glossary so that you understand why you are at the NAP BoF. Or perhaps there needs to be a liaison established to an established Internet Etymology and Terminology Forum. Apologies in advance and in arrears, peter -----Original Message----- From: Randy Bush [mailto:randy@psg.com] Sent: Tuesday, January 29, 2002 10:40 PM To: Alan Hannan Cc: nanog(a)merit.edu Subject: Re: NANOG 24: NAP BoF > Something bothers me about this thread, and I think it is the > assertion that there is a proper definition for 'NAP' as > differentiated from 'IXP' or what not. yup. george santayana was right

1 0

RE: UUNet outage?
by Vandy Hamidi 30 Jan '02

30 Jan '02

I noticed unavailability of some sites through our UUNet connection as well. Trace routes showed that the packets were being dropped after it was passed onto above.net but also before that. I assume not only was above.net having problems, but I screwed up UUNet's routes they received from them. A call to UUNet didn't help. The tech, though nice, had no idea what to look for. I was sitting there giving him commands and asking the result. After I figured everything was ok between us, I figured it was bigger than just my connection and waited patiently. All was good within 15 min or less. -=Vandy=- -----Original Message----- From: Daniel Lark [mailto:dlark@elmresources.com] Sent: Friday, January 25, 2002 8:04 PM To: nanog(a)merit.edu Subject: Re: uunet outage? I have been noticing several UUNet problems recently. My Oakland office (connected via UUNet) and my company's service bureau, run by a contractor company (also UUNet) had problems seeing my main corp. web server colo'd at Hurricane Electric, yesterday. Turns out there was a DoS attack ran against a router on above.net (which provides the peering between UUNet and HE). However, I have also seen problems with customers being unable to see my contractor's machines. Supposedly, there are some rather strategic DoS attacks going on. Can anyone confirm this? Regards, Dan Lark ELM Resources, Inc.

1 0