- NANOG - lists.nanog.org

RE: Anycast 101
by Hannigan, Martin 20 Dec '04

20 Dec '04

> -----Original Message----- > From: Gadi Evron [mailto:ge@linuxbox.org] > Sent: Monday, December 20, 2004 3:32 PM > To: Bill Nash > Cc: Hannigan, Martin; nanog(a)merit.edu > Subject: Re: Anycast 101 > > > > Botnets aren't new. They've been prototyped on various IRC > networks for > > years. It started with hordes of linked eggdrop bots for Death Star > > style privmsg/notice flood attacks on single users (1998? > 1999?). When > > For history's sake, most people name BO and netbus as the "original" > remote control Trojan horses. Those that started all the mess. My sentence was a typo. I mean they "aren't a new" phenomenon. I agree with you on the rest.

1 0

RE: Anycast 101
by Hannigan, Martin 20 Dec '04

20 Dec '04

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > John Kristoff > Sent: Monday, December 20, 2004 1:10 PM > To: nanog(a)merit.edu > Subject: Re: Anycast 101 > > > > On Mon, 20 Dec 2004 17:18:30 +0000 > Paul Vixie <paul(a)vix.com> wrote: > > > there are some million-bot drone armies out there. with > enough attackers > > I've heard that claim before, but I've yet to be convinced that those > making it were doing more than speculating. It is not unreasonable to > believe there are millions of bot drones, but that is not the same as > an army under a single or even coordinated control structure. It is > entirely possible to build armies of that size, but maintaining them > over any length of time is probably quite difficult. I'd of course be > interested to hear about any evidence to the contrary on or off list. > > John I know I haven't seen any 1MM+ zombie armies out there and I'm looking for them. Why spend all that time getting 1MM bots when you only need 100K? -M<

2 1

RE: Anycast 101
by Hannigan, Martin 20 Dec '04

20 Dec '04

> -----Original Message----- > From: Bill Nash [mailto:billn@billn.net] > Sent: Monday, December 20, 2004 3:33 PM > To: Hannigan, Martin > Cc: John Kristoff; nanog(a)merit.edu > Subject: RE: Anycast 101 > > > On Mon, 20 Dec 2004, Hannigan, Martin wrote: > > > >>> there are some million-bot drone armies out there. with > >> enough attackers > >> > > I know I haven't seen any 1MM+ zombie armies out there and I'm > > looking for them. Why spend all that time getting 1MM bots when you > > only need 100K? > > Dormant reinforcements. Multiple operational floodnets in > smaller cells. > Rapid reconfiguration of a cell, cycling in new hosts, > removing hosts that > have sustained functional losses to reactive routing changes. > Having those > kinds of resources on hand allows an attacker to use a > 'Captain Tripps'[1] > style of attack to maintain a sustained assault on single, or even > multiple targets. We aren't dealing with stupid people. If 1/10th of the bots will do the trick, that's 1/10th of the work. A larger botnet would expose the controllers much more rapidly with focused traffic flows towards the controllers. No controller = no $$. You'd also have more people involved to speed up the process and now you're spending money that you don't have to when 100K will suffice nicely. Whether you buy the botnets or you build them yourself, you need time to generate revenue. Survival and greed are factors here. Aggregating botnets is possible, sure. But that means you're paying someone for their use. They aren't just giving them away. Of course, you could buy a botnet, but again, why buy when you can build 100K botnet in short order and for free? Discussing botnet sizes is irrelevant though except in the case of mitigation and deciding where to spend time working *80/20*. Look at how the discussions surrounding SPAM have evolved. It went from "damn abusers", to "damn software", to "where's the money coming from?". The BotNet problem has already evolved to "where's the money". Botnets are a new phenomenon. [ Gadi!?] [ SNIP ]

3 3

Re: Anycast 101
by Paul Vixie 20 Dec '04

20 Dec '04

> > but at that point, the only thing anycast would buy you is ddos > > resistance and the ability to have more than 13 physical > > servers... which is all the > > Is that true? I'm failing to see how anycast helps expand a network's > DDoS survivability. At best a dumb attacker would attack the IP > address of the server and it would be distributed to all the > participating anycast nodes. as it turns out, some attackers really are idiots, and it's considered socially acceptable to pander to them even while also attempting to guard against real attacks coming from experts. > What prevents the attacker to hit just a few nodes from the anycast > network to hurt percentages of the dns queries? nothing, of course. but we like that the percentage isn't always 100% (as it would be in the non-anycast case.) > Obviously health checking would prevent some of the problems but then > the attacker can just shift from site to site as the health checks > happen. there are some million-bot drone armies out there. with enough attackers you can just attack everything the defenders might try to use -- no need to shift from site to site in response to anything. > With that thought process, an anycast network is only as it's most > beefed up node. As the smaller nodes fail the one left standing will > be what prevents the attack, not anycast. i admit that this appears true on the surface... but if you dig into it you'll see that even a root name server with 10,000 direct 10GigE connections (one for every autonomous system in the internet) would still be vulnerable to congestion based attacks, since a congestion based attack is against OPN's (other people's networks) where even infinite point-source provisioning cannot help you. > For an example, let's look at f.root: > f.root-servers.org is 204.152.187.7 that's .org not .net. f.-.org is just a web server. you want f.-.net. > If an attacker wanted to be violent and have complete disregard for > the anycast design, he/she would hit either each node independently > and at the same time hit the upstream routes of both nodes. That > would isolate each node from the anycast primary "VIP" of > 204.152.187.7 and introduce problems into the design. Then, as those > sites were failed out, he/she would shift the attack to the current > operating sites. an effective attack doesn't need to be nearly that subtle. > Eventually this cat and mouse would cause such a problem that the > saving grace of the anycast design would be the strongest node in the > cluster and the operators would have to fail each site in and out as > the attack shifted around. i suppose that you could do it that way, if you wanted to be more artful. > If they were really violent they would include a randomized valid > query attack in the mix. you mean they aren't? > Can you explain to me how anycast would prevent this? i knew, at the time i wrote the words "ddos resistant" in this thread, that at least one person would think i meant "ddos proof". in wristwatches, "water resistant" means you can shower or bathe while wearing the device, but only "water proof" means you can scuba dive with it. anycast makes a dns service more ddos resistant. nothing can make a dns service ddos proof.

4 5

Re: Anycast 101
by Paul Vixie 20 Dec '04

20 Dec '04

> Since when bad engineering is bad to the big business? whenever it makes your service less attractive than your competitors. > The world is full of examples to the contrary. yes, but only where there's a monopoly of some kind.

1 0

verizon.net and other email grief
by Simon Waters 20 Dec '04

20 Dec '04

Hi, trying to pin down why so much email isn't making it recently. We see issues with various big ISPs. The most obvious is none of the three UK ISPs I have ready access to can connect to port 25 on relay.verizon.net. (MX for all the verizon.net email addresses). We can ping it (I'm sure it isn't singular?), but we have no more luck delivering email than contacting verizon technical staff, logs suggests we are in day 3 of this. I'm now listening to hold music at International rates - ouch. Have a support call with GXN open on connectivity to hotmail, which seems to vary with UK ISP, but is in general pretty poor from all of them. In general I'd say off topic in Nanog, but there comes a point where you start wondering if the routing is messed up. Am I alone before posting more details. Simon

27 44

Online safety study
by Sean Donelan 20 Dec '04

20 Dec '04

http://www.staysafeonline.info/news/safety_study_v04.pdf Dialup Users Broadband users Antivirus installed 84% 86% Firewall installed 7% 51% Parental controls 16% 4% Virus infected 25% 15% Spyware/adware 88% 74%

1 0

Re: New Computer? Six Steps to Safer Surfing
by Suresh Ramasubramanian 20 Dec '04

20 Dec '04

On Sun, 19 Dec 2004 18:10:14 -0600, Jerry Pasker <info(a)n-connect.net> wrote: > > Are we, as network operators, supposed to protect people (stupid or > not) from themselves? > ... if it is your network, your bandwidth, and their stupidity affects these ... -- Suresh Ramasubramanian (ops.lists(a)gmail.com)

1 0

Re: New Computer? Six Steps to Safer Surfing
by Barney Wolff 20 Dec '04

20 Dec '04

On Mon, Dec 20, 2004 at 12:26:31AM +0100, Florian Weimer wrote: > * Barney Wolff: > > > Perhaps, then, one should not be so quick to disparage software-based > > firewalls, resident on the computer itself. > > Yes, but it's only a real obstacle if the malware doesn't run with > SYSTEM privileges. If it's impossible for home users to work with > reduced privileges, a host-based filter is no good (unless it's a very > obscure brand which is not targeted by the malware 8-). In general, home firewalls are better at preventing infection than containing it. That's true no matter where the firewall resides. > By the way, do you know if these "hardware firewalls" have a > management interface on a factory-default IP address? 192.168.0.1 admin/admin is a good bet. -- Barney Wolff http://www.databus.com/bwresume.pdf I'm available by contract or FT, in the NYC metro area or via the 'Net.

2 1

latest FCC rulings
by Matt Hess 18 Dec '04

18 Dec '04

I'm curious.. with the new fcc rulings out how are other clecs planning on coping with them? I'd love to hear reactions or thoughts on the latest the fcc is throwing at the lecs. (http://hraunfoss.fcc.gov/edocs_public/attachmatch/DOC-255344A1.pdf) Offlist is fine in case this is considered off-topic. Matt Hess

4 4