- NANOG - lists.nanog.org

Over a decade of DDOS--any progress yet?
by Sean Donelan 08 Dec '10

08 Dec '10

February 2000 weren't the first DDOS attacks, but the attacks on multiple well-known sites did raise DDOS' visibility. What progress has been made during the last decade at stopping DDOS attacks? SMURF attacks creating a DDOS from directed broadcast replies seems to have been mostly mitigated by changing defaults in major router OS's. TCP SYN attacks creating a DDOS from leaving many half-open connections seems to have been mostly mitigated with SYN Cookies or similar OS changes. Other than buying lots of bandwidth and scrubber boxes, have any other DDOS attack vectors been stopped or rendered useless during the last decade? Spoofing? Bots? Protocol quirks?

12 19

Re: Over a decade of DDOS--any progress yet?
by alvaro.sanchez＠adinet.com.uy 08 Dec '10

08 Dec '10

May be. Anyway, under ddos attack, your links may be congested, and you need to recover them. You have small margin to move. The farther upstream the attack is repelled, the better chances you have for restoring connectivity. >----Mensaje original---- >De: deleskie(a)gmail.com >Fecha: 08/12/2010 12:31 >Para: "Drew Weaver"<drew.weaver(a)thenap.com> >CC: "alvaro.sanchez(a)adinet.com.uy"<alvaro.sanchez(a)adinet.com.uy>, "rdobbins(a)arbor.net"<rdobbins(a)arbor.net>, "North American Operators' Group"<nanog(a)nanog.org> >Asunto: Re: Over a decade of DDOS--any progress yet? > >+1 > >On Wed, Dec 8, 2010 at 10:30 AM, Drew Weaver <drew.weaver(a)thenap.com> wrote: >> Yes, but this obviously completes the 'DDoS attack' and sends the signal that the bully will win. >> >> -Drew >> >> >> -----Original Message----- >> From: alvaro.sanchez(a)adinet.com.uy [mailto:alvaro.sanchez@adinet. com.uy] >> Sent: Wednesday, December 08, 2010 8:46 AM >> To: rdobbins(a)arbor.net; North American Operators' Group >> Subject: Re: Over a decade of DDOS--any progress yet? >> >> A very common action is to blackhole ddos traffic upstream by sending a >> bgp route to the next AS with a preestablished community indicating the >> traffic must be sent to Null0. The route may be very specific, in order >> to impact as less as possible. This needs previous coordination between >> providers. >> Regards. >> >>>----Mensaje original---- >>>De: rdobbins(a)arbor.net >>>Fecha: 08/12/2010 10:53 >>>Para: "North American Operators' Group"<nanog(a)nanog.org> >>>Asunto: Re: Over a decade of DDOS--any progress yet? >>> >>> >>>On Dec 8, 2010, at 7:28 PM, Arturo Servin wrote: >>> >>>> One big problem (IMHO) of DDoS is that sources (the host of >> botnets) may be completely unaware that they are part of a DDoS. I do >> not mean the bot machine, I mean the ISP connecting those. >>> >>>The technology exists to detect and classify this attack traffic, and >> is deployed in production networks today. >>> >>>And of course, the legitimate owners of the botted hosts are >> generally unaware that their machine is being used for nefarious >> purposes. >>> >>>> In the other hand the target of a DDoS cannot do anything to stop >> to attack besides adding more BW or contacting one by one the whole >> path of providers to try to minimize the effect. >>> >>>Actually, there're lots of things they can do. >>> >>>> I know that this has many security concerns, but would it be good >> a signalling protocol between ISPs to inform the sources of a DDoS >> attack in order to take semiautomatic actions to rate-limit the traffic >> as close as the source? Of course that this is more complex that these >> three or two lines, but I wonder if this has been considerer in the >> past. >>> >>>It already exists. >>> >>>----------------------------------------------------------------------- >>>Roland Dobbins <rdobbins(a)arbor.net> // <http://www.arbornetworks. com> >>> >>> Sell your computer and buy a guitar. >>> >>> >>> >>> >>> >>> >> >> >> >> >> >

1 0

A fascinating piece of spam
by Steven Bellovin 08 Dec '10

08 Dec '10

Well -- spammers are following the NANOG list in real-time, it seems. A few hours after my post this afternoon, I received some spam with a correct Subject: line for that post. I'll be happy to forward the email to anyone who wants to analyze it or find the offender and permanently blacklist "her" from NANOG... --Steve Bellovin, http://www.cs.columbia.edu/~smb

4 4

Abuse@ contacts
by Gavin Pearce 08 Dec '10

08 Dec '10

Hello, After a weekend of heavy spam last month, we decided to fire some reports over to the abuse contacts for each relevant IP or domain - some US/Europe based, others from more "obscure" locations. We've not had a reply from any of the reports sent over, other than some automated bounces. Each report from us contained detailed information about IP, date, headers, spam content, relevant ranges etc ... How many of you (honestly) actively manage and respond to abuse@ contact details listed in WHOIS? Or have had any luck with abuse@ contacts in the past? Who's good and who isn't? Apologies in advance if this has been around before - I'm new here. (: Gav

10 9

Re: A fascinating piece of spam
by Scott Weeks 08 Dec '10

08 Dec '10

--- smb(a)cs.columbia.edu wrote: From: Steven Bellovin <smb(a)cs.columbia.edu> Yup, same purported sender... ------------------------------------ >From what company? So we don't make the mistake of buying from them. scott

3 2

RE: ipfix/netflow/sflow generator for Linux
by Thomas York 08 Dec '10

08 Dec '10

I just retested nprobe and it has the same issue as most of the other tools. It doesn't specify the InputInt and OutputInt properly. Yes, you can statically set it but that will drastically skew the data in this environment. I'm not against running multiple processes, I've just not found a product that runs using multiple processes that does what I need to. I just noticed the ntop version in EPEL is fairly old, so I'll try to compile the latest myself and see if it's more stable. Also, FYI to anyone who is interested in this, I've opened a support ticket with ipcad to fix the interface numbering issue. http://tinyurl.com/32pjyfa From: packetmonger(a)gmail.com [mailto:packetmonger@gmail.com] On Behalf Of Darren Bolding Sent: Monday, December 06, 2010 8:57 PM To: Thomas York Subject: Re: ipfix/netflow/sflow generator for Linux We've used nprobe with good success, passing the flows to ntop, nfsen etc. nProbe supports specifying the interface- so yes, you would have to run multiple processes, but I believe it would work. We went ahead and purchased the PF_RING driver as it significantly improved the capture performance of our systems. I'm assuming since you tried it, you really don't want to fire up a separate process for each interface? I'd love to hear what you thought about the various tools and what you end up deciding on. For us, we collect the data using nprobe and have had no problem getting ntop to stably analyze those flows when pointed to it. NFSEN is pretty damn cool also. We point various nprobe, netflow, sflow data at it with good effect. --D On Mon, Dec 6, 2010 at 11:15 AM, Thomas York <straterra(a)fuhell.com> wrote: At my current place of work, we use all Linux routers. I need to do some IP accounting/reporting and am currently trying to use Scrutinizer. Scrutinizer can use netstream, jstream, ipfix, netflow, and sflow data without qualms. My only issue is that I can't seem to find any good software for Linux that works with multiple interfaces to generate the flow information. I've tried ndsad, nprobe, softflowd, host sflow, and ipcad without much luck. Most of the software only works on one interface (which is useless as I need to do accounting for numerous interfaces). I've had the best luck with ipcad. The only thing that seems to not work with it is that it doesn't correctly give the interface number in the flow information. It refers to all interfaces as interface 65535. I've tried the config option for ipcad to map an interface directly to an SNMP interface ID, but that option of the config file seems to be ignored. Ntop functionally does exactly what I need, but it's extremely buggy. It segfaults after a few minutes, regardless of Linux distro or Ntop version. So..any ideas on what I can do to get good flow information from our Linux routers? -- -- Darren Bolding -- -- darren(a)bolding.org --

2 1

Re: A fascinating piece of spam
by Scott Weeks 08 Dec '10

08 Dec '10

From: "Scott Weeks" <surfer(a)mauigateway.com> From: Steven Bellovin <smb(a)cs.columbia.edu> Yup, same purported sender... ------------------------------------ >From what company? So we don't make the mistake of buying from them. ---------------------------------- Never mind, I got one too. www.bradleydentaloffice.com 8 ae1d0.mcr1.saltlake2-ut.us.xo.net (216.156.1.2) 9 ip65-46-63-46.z63-46-65.customer.algx.net (65.46.63.46) 10 206.130.126.61.west-datacenter.net (206.130.126.61) 11 68.169.38.135.static.westdc.net (68.169.38.135) Someone from Westhost here? <plonk> them please! scott

1 0

ARIN space not accepted
by Dustin Swinford 07 Dec '10

07 Dec '10

We have run into an issue with the 107.7.0.0/16 assigned to us several months ago. It appears that many sites have not yet accepted this space. I understand this is not a normal type post to NANOG, but hoped to get the word out to as many operators as possible. Does anyone know of a better way to get the word out to ask people to update their BOGONs/filters? Dustin Swinford | Sr. IP/Ethernet Engineer <http://www.deltacom.com/> Deltacom | Integrated Communications and Technology Solutions

11 11

ARIN receives 2 new /8 blocks
by Leslie Nobile 07 Dec '10

07 Dec '10

Hello- ARIN received the IPv4 address blocks 23.0.0.0/8 and 100.0.0.0/8 from the IANA on November 30, 2010. We will begin making allocations of /22 and shorter prefixes from these blocks in the near future in accordance with ARIN’s minimum allocation policy. Network operators may wish to adjust any filters in place accordingly. For informational purposes, a list of ARIN's currently administered IP address blocks can be found at: https://www.arin.net/knowledge/ip_blocks.html Regards, Leslie Nobile Director, Registration Services American Registry for Internet Numbers (ARIN)

1 0

Lightning Debates at NANOG 51
by Tom Daly 07 Dec '10

07 Dec '10

Folks, I've been tempted by the NANOG PC into trying to run some "Lightning Debates" at NANOG 51 in Miami. The idea, similar to lighting talks, is a 30 minute session, covering 3 debate topics, 10 minutes each. Each person would get 5 minutes to argue their side of the issue. Some ideas so far: UPS Systems: Battery vs. Flywheel Cooling: Raised floor vs. Underfloor Power: AC vs. DC Ethernet: 40GE vs. 100GE Optics: XFP vs. SFP+ Address Families: IPv4 vs. IPv6 I'm soliciting panelists, and ideas. Please let me know if you're interested in participating in what will hopefully be a unique and exciting session. Best, Tom -- Tom Daly http://dyn.com/

9 13