- NANOG - lists.nanog.org

RE: DNS requests and Bandwidth
by David Hubbard 11 May '05

11 May '05

From: aljuhani > > > One way was to block requests from that DNS IP but that was not > practicle as many users on that DNS won't be able to communicate > with our server. > > so What is the best way to prevent DNS queries consuming bandwidth. Run an authoritative-only DNS server that won't respond to queries for domains it doesn't handle. tinydns from http://cr.yp.to/djbdns.html would be an example. David

2 1

Re: Blocking port udp/tcp 1433/1434
by Fergie (Paul Ferguson) 11 May '05

11 May '05

You decide: http://www.dshield.org/topports.php http://www.mynetwatchman.com/tp.asp - ferg -- Joe Maimon <jmaimon(a)ttec.com> wrote: Is there still justification for denying transit for ms-sql slammer ports? Thanks, Joe -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Squid Cache DNS Lookup Spoofing Vulnerability
by Fergie (Paul Ferguson) 11 May '05

11 May '05

Given the recent attention to all matters of DNS cache poisoning (real or imagined), I figured this item might of interest to the list. I know there's a lot of Squid Caches out there... - ferg [snip] Via Secunia: http://secunia.com/advisories/15294/ Secunia Advisory: SA15294 Release Date: 2005-05-11 Impact: Spoofing Where: From local network Solution Status: Vendor Patch Software: Squid 2.x Description: A vulnerability has been reported in Squid, which can be exploited by malicious people to spoof DNS lookups. The vulnerability is caused due to an unspecified error in the DNS client when handling DNS responses and can be exploited to spoof DNS lookups. The vulnerability has been reported in version 2.5 and prior. Solution: Apply patch for version 2.5.STABLE9: http://www.squid-cache.org/Versi...id-2.5.STABLE9-dns_query-2.patch Original Advisory: http://www.squid-cache.org/Versi...ugs/#squid-2.5.STABLE9-dns_query [snip] -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Correction: Squid Cache DNS Lookup Spoofing Vulnerability
by Fergie (Paul Ferguson) 11 May '05

11 May '05

Mea culpa: The correct link for the appropriate patch(es): http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-dns_query - ferg -- "Fergie (Paul Ferguson)" <fergdawg(a)netzero.net> wrote: Given the recent attention to all matters of DNS cache poisoning (real or imagined), I figured this item might of interest to the list. I know there's a lot of Squid Caches out there... - ferg [snip] Via Secunia: http://secunia.com/advisories/15294/ Secunia Advisory: SA15294 Release Date: 2005-05-11 Impact: Spoofing Where: From local network Solution Status: Vendor Patch Software: Squid 2.x Description: A vulnerability has been reported in Squid, which can be exploited by malicious people to spoof DNS lookups. The vulnerability is caused due to an unspecified error in the DNS client when handling DNS responses and can be exploited to spoof DNS lookups. The vulnerability has been reported in version 2.5 and prior. Solution: Apply patch for version 2.5.STABLE9: http://www.squid-cache.org/Versi...id-2.5.STABLE9-dns_query-2.patch Original Advisory: http://www.squid-cache.org/Versi...ugs/#squid-2.5.STABLE9-dns_query [snip] -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: Unusual IN ANY DNS Traffic
by Douglas E. Warner 11 May '05

11 May '05

On Wednesday 11 May 2005 03:57, Simon Waters wrote: > Indeed moderns versions of BIND default to high ports for DNS queries as > well unless configured otherwise. I think old versions of BIND and the odd > firewall product were the main thing doing source port 53 queries. > > I was going to suggest email servers as a possible cause -- I think > probably you'll have to speak to a customer if it still persists. Make sure > they haven't been owned. Might just have been a spam run or mailshot with > "msn.com" as the reply, and you discovering how many email servers are out > there or similar. > I suspect you're correct; these are probably some DSL customers who have "0wn3d" by either a virus or malware and have just been "turned on" to spam domains at "msn.com". Unfortunately we don't do protocol graphs on our major routers or else I would have been able to see a spike of port 25 traffic if it had existed - we just graph our DNS server query which is why I noticed the jump. > I assume your not using something daft like MS DNS server, but a recent > BIND or DJB cache. Also correct; we're running BIND 9.2.2 and I parse the query logs to see what kind of traffic we're getting via the different query types. -Doug -- Douglas E. Warner <dwarner(a)ctinetworks.com> Network Engineer CTI Networks, Inc. http://www.ctinetworks.com +1 717 975 9000

1 0

RE: DOS attack tracing
by Richard 11 May '05

11 May '05

> Right... I did mention that further down in my message. And yeah - > almost impossible to get much done when the CPU is pegged. I remember > a DOS attack demo where they used 7200s for the examples - almost > wanted to yell out "try pegging the CPU with lots of traffic and THEN > try to identify / null0 the destination or source". That's the problem in our case. One of our downstream customers got the attack. Once we disconnected them, everything became fine. I tried pretty much everything under our control to divert the traffic, including ingress acl to block all incoming traffic to their subnets. But every time I turn the downstream ISP back on, our router was dead. We got a 7206VXR and 100M Ethernet to the primary upstream. I think that the lesson is _always_ use a router powerful enough to handle all ingress traffic at wire rate. Without access to the router, there is nothing you can do. So we are going to switch out the router. Richard

2 1

Google DNS problems?!?
by Fergie (Paul Ferguson) 11 May '05

11 May '05

Does anyone else think that its a bit odd that if it were simply "DNS problems" that a redirect for www.google.com would end up at a location which provided this: http://img179.echo.cx/img179/7959/googlehacked7to.jpg [or] http://img241.echo.cx/img241/6208/googlemsn3lp.png Seems more than simple "DNS problems" to me. I hate being played like an idiot.... - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

8 8

RE: DOS attack tracing
by Chris Ranch 10 May '05

10 May '05

> > I don't know why they even sell the NSE100. You want the > NPE with the > > PXF. > > > > Chris > > No, that's backward. > > The NSE100 has the PXF processor. > > The NPE-G100 is a software router. Correct, of course. Thanks. Chris

1 0

Internet Attack Called Broad and Long Lasting by Investigators
by Steven M. Bellovin 10 May '05

10 May '05

SAN FRANCISCO, May 9 - The incident seemed alarming enough: a breach of a Cisco Systems network in which an intruder seized programming instructions for many of the computers that control the flow of the Internet. Now federal officials and computer security investigators have acknowledged that the Cisco break-in last year was only part of a more extensive operation - involving a single intruder or a small band, apparently based in Europe - in which thousands of computer systems were similarly penetrated. .... http://www.nytimes.com/2005/05/10/technology/10cisco.html?hp&ex=1115784000&… --Prof. Steven M. Bellovin, http://www.cs.columbia.edu/~smb

4 5

RE: DOS attack tracing
by Chris Ranch 10 May '05

10 May '05

Correcting a typo... > Yes, the 7206vxr with whatever processor really checks out > when under any kind of real flood through it. It's big > brother, the 7304-NSE100 does as well. But the 7304-NPE100 > with the PXF can forward that (d)DoS very well. Even with > fairly extensive ingress filters. The kick in the head is > that the processors are the same price. I don't know why > they even sell the NPE100... I don't know why they even sell the NSE100. You want the NPE with the PXF. Chris

1 0