- NANOG - lists.nanog.org

RE: Blocking worms/ddos for customer for free?
by Chad Skidmore 06 Dec '04

06 Dec '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > -----Original Message----- > From: Kim Onnel [mailto:karim.adel@gmail.com] > Posted At: Monday, December 06, 2004 11:46 AM > Posted To: NANOG > Conversation: Blocking worms/ddos for customer for free? > Subject: Blocking worms/ddos for customer for free? > > > > Hello, > > Currently, on our ingress, we block spoofed packets, common > worms/trojans ports. > > We do that for all of our customers(residential DSL, Dial-up, > Corporate DSL, and the data center hosted websites/servers), > however, > > For me there are 2 ways to look at it, > if i leave these worms to come in, they would consume our > bandwidth and CPU, and on the other hand, it looks like we're > giving a free service, which in a way uses up our resources, > > Its the same for DDoS, if i stop it for a customer, i'm > giving him a free a service, if i dont, its gonna wreck my network. > > Personally, i block the illegitimate packets out of my > network(egress) but thats because i owe this to the internet > community, even if i am not getting paid for it. > > I would like to know other providers policy about this? > Blocking spoofed packets (inbound and outbound) is certainly a good thing and, in my opinion should be done by providers across the board. Blocking worms/trojan/whatever ports starts to get a little more difficult. Mainly due to the fact that they often times use ports and protocols that are valid and blocking them breaks things that are required. At the risk of starting the whole "Microsoft stuff should be banned from the Internet rant" I'll use the example of ports 135-139. Some people block those ports and don't get too much grief from their customer base. Others that try to block them find that at least some portion of the customer base complains because they have something that relies on those ports to work. This leads many to choose the path of least resistance and not filter. The other challenge with filtering is that it can consume resources, in some cases more quickly than not filtering at all. If traffic levels are high enough filtering can melt down your router more quickly than not filtering. This obviously depends on a number of things and we are seeing vendors produce routers that can filter at line rate without impacting performance or just plain falling over. Those routers can be very expensive however and if someone isn't paying for that additional service it can be hard to justify upgrading to a new line card that runs an easy six figures just to become your customer's free firewall. Those two things said, we don't believe that we are our customer's firewall unless specifically contracted to perform that task. That insures that we are compensated for the resources consumed and that we all agree on what is or is not valid traffic. All to often we have found that valid traffic for one person is not valid traffic for another so "firewall rules" will vary from one customer to the next. DDOS inbound to your customer may or may not wreck your network and what looks like a DDOS attack can be valid traffic for some customers. I know that we handle it on a case-by-case basis with good customer communication before we take action, assuming it isn't wrecking the rest of our network. If it is wrecking our network then we subscribe to the "Sacrifice the one to save the many" philosophy and will stop the attack. DDOS outbound from your network is again something that you need to double check to insure that it really is a DDOS attack. In our case if we see something that we strongly believe to be an outbound attack or can verify as an outbound attack then we'll take action. Anomolous traffic gets investigated to see if it is an attack or if it is valid. That, to us, is just part of being a good net citizen and making sure our customers don't ruin someone else's day. Regards, Chad - ---------------------------- Chad E Skidmore One Eighty Networks, Inc. http://www.go180.net 509-688-8180 -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQA/AwUBQbS/XU2RUJ5udBnvEQKY9ACdEDqM/PMlkKCokIgduKfQnvkHf3cAoN2B 40u2sItiQQdZ/xVChcXO1oTP =E0NF -----END PGP SIGNATURE-----

1 0

Re: 16-bit ASN kludge
by John Dupuy 06 Dec '04

06 Dec '04

Along these lines, one could leave the transit AS networks alone if a parallel 16 bit ASN space were created. Essentially, any non-transit network would have it's non-public ASN retranslated NAT-style by upstream transit network border routers. Only the border routers would have to be changed. They would have to differentiate between public ASN X and non-public ASN X (same number) based on the which side of the router the ASN was learned from. This would essentially double the ASN numbers available. All that being said, I'd much rather see 32-bit ASNs. John At 10:48 AM 12/3/2004, Edward B. Dreger wrote: >Perhaps transit networks should receive 16-bit ASNs. Leaf networks >would use { a special ASN | I'm still brainstorming | who knows } and >carry an "available upstreams" BGP tag for each upstream. > >Metrics are calculated for each transit AS. Those metrics are then >combined with <as yet unspecified intelligence in "available upstreams" >tag> for each leaf ASN. > >BGP loop detection might present a problem if all leaf ASNs use, say, >16-bit AS65535. If existing allowas-in is too coarse, refer to "32-bit >ASN" BGP attribute for fine-grained control. > >In short: I'm trying to think up a mechanism that performs full Dijkstra >calculations _only_ for transit networks, and uses some cheaper version >for the degenerate case of a leaf network. > > >Eddy >-- >Everquick Internet - http://www.everquick.net/ >A division of Brotsman & Dreger, Inc. - http://www.brotsman.com/ >Bandwidth, consulting, e-commerce, hosting, and network building >Phone: +1 785 865 5885 Lawrence and [inter]national >Phone: +1 316 794 8922 Wichita >________________________________________________________________________ >DO NOT send mail to the following addresses: >davidc(a)brics.com -*- jfconmaapaq(a)intc.net -*- sam(a)everquick.net >Sending mail to spambait addresses is a great way to get blocked.

6 17

RE: Bogon filtering (don't ban me)
by Mark Segal 06 Dec '04

06 Dec '04

Then you could also just get a connection to team cymru's bogon servers. Works Perfectly for us. I have been peering with them from our sink hole/black hole trigger router, for a while now, and I no longer need to manually update the files. More info here. http://www.cymru.com/BGP/bogon-rs.html Regards, Mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of David Barak > Sent: December 3, 2004 10:08 AM > To: J. Oquendo; nanog(a)nanog.org > Subject: Re: Bogon filtering (don't ban me) > > > > --- "J. Oquendo" <sil(a)politrix.org> wrote: > > > I thought about it over and over, and wonder why this hasn't been > > done. > > Any care to beat me with a clue stick or two. I can understand the > > arguments of not wanting a vendor to have control of some > aspect of my > > business, or control over my network, but correct me if I am wrong, > > wouldn't this solve a heck of a lot of issues concerning > network based > > attacks, spam, scumware/spyware/fooware/$*something? > > Vendor C has something similar, in their "autosecure" > feature. However, the trouble is that the list of bogon > networks is static, and in fact includes 70/8 among many > others. This is (I'm certain) contributing to the > reachability issues that those folks with new netblocks experience. > > A better implementation would be for vendors to include a > "bogon-subscribe server x.x.x.x" feature, which would simply > allow a router to talk to a centralized bogon server. > > However, the complexity of setting up the real-time BGP bogon > feeds is not that hard - anyone who would use the above > command could do it - so I'm not sure that this requires any > new tools. > > ===== > David Barak > -fully RFC 1925 compliant- > > > > __________________________________ > Do you Yahoo!? > Yahoo! Mail - now with 250MB free storage. Learn more. > http://info.mail.yahoo.com/mail_250 > >

16 27

RE: Bogon filtering (don't ban me)
by Church, Chuck 06 Dec '04

06 Dec '04

Rob, Just thinking out loud, but is there any reason that this route-server methodology couldn't be applied to other 'undesirable' destinations, such as the world's top spammers, phishing web sites, etc? Maybe break them up into different communities, so subscribers can pick which ones they want to filter. Chuck Church Lead Design Engineer CCIE #8776, MCNE, MCSE Netco Government Services - Design & Implementation Team 1210 N. Parker Rd. Greenville, SC 29609 Home office: 864-335-9473 Cell: 703-819-3495 cchurch(a)netcogov.com PGP key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x4371A48D -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Rob Thomas Sent: Saturday, December 04, 2004 7:22 PM To: NANOG Subject: RE: Bogon filtering (don't ban me) Hi, Hank. ] I do as well, but does this scale? Can Team CYMRU handle 2,000 BGP ] sessions? 20K? 200K? -Hank We can handle quite a lot of sessions, and already do, thanks to the distributed nature of the Bogon route-server project. We have several routers deployed, and are prepared to deploy more if necessary. By the way we recommend that folks peer with at least two of the Bogon route-servers. Thanks, Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

5 4

Re: Banned on NANOG
by Hannigan, Martin 06 Dec '04

06 Dec '04

You expect? Bill, nothing personal, but your S:N is 0:6 at this point. Not one single op post ever. No meeting attendance. Not one answered technical question. How about earning a few stripes before making demands of NANOG? Srh may be in need of a config change, but she's one of us. Show some respect. /plonk -M --- Martin Hannigan hannigan(a)verisign.com Verisign, Inc. -----Original Message----- From: owner-nanog(a)merit.edu <owner-nanog(a)merit.edu> To: J.D. Falk <jdfalk(a)cybernothing.org> CC: my network has a second name, it's n-a-n-o-g <nanog(a)merit.edu> Sent: Sun Dec 05 00:09:58 2004 Subject: Re: Banned on NANOG On Sat, 4 Dec 2004, J.D. Falk wrote: > On 12/04/04, Patrick W Gilmore <patrick(a)ianai.net> wrote: > >> I also think that makes it nearly impossible to run a good, informative >> list. Certainly FAR more difficult than just leaving the list >> completely unmoderated. I do not believe anyone here would argue those >> points either (besides, obviously, the moderator herself). > > ...who has been silent during this whole debate, which only > serves to feed the flames (and the flamers) as we all make wild > guesses regarding motive and intent. My last email contained an explicit request for a responst. I expect to see one. - billn

2 1

RE: [OT] Re: Banned on NANOG
by Joe Johnson 06 Dec '04

06 Dec '04

I wanted to say the same thing earlier, but a hands-off approach works best on NANOG. The question at hand is not whether procmail will work . . . It's whether procmail should have to work. Joe Johnson -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Paul Vixie Sent: Thursday, December 02, 2004 9:47 PM To: nanog(a)merit.edu Subject: Re: [OT] Re: Banned on NANOG > From: Daniel Golding <dgolding(a)burtongroup.com> > ... > Its entirely possible for nanog-l to be self policing, or, failing > that, for users to simply use procmail on those who wander off-topic > (for some definition of off-topic). Putting an [OT] subject banner on > such posts is also nice. i don't want widescale procmail to be the only way nanog@ is readable by a big subset of the netops community, simply because i know a lot of the folks here (lazy overworked disorganized bums, mostly) and if it takes way more effort to be subscribed than not, many will just unsubscribe. > There's such a thing as throwing the baby out with the bathwater. When > highly clued, genuinely contributing folks are treated poorly for the > occasional in-joke or comment, the S:N ratio will suffer in the longer > term. nope nope nope no-no-nope. that's a subjective standard. there's no way to moderate based on "does more good than harm" without strong and formal and objective definitions of what "good" is and what "harm" is, plus an appeals process. trust me: we don't want "strong" "formal" "process". (my own system, which has produced only two warnings in about 10 years, is to make the good:harm ratio high enough in any given message that the "in" jokes are merely a tolerable percentage of the mass of THAT message; what i see some other bums doing, though, is pure-"in"-joke messages.) > I'm certainly hoping that the network operations community will feel > no need to "talk with their feet" after we all sit down with the Merit > staff and let our feelings be known, but that is certainly a possibility. like the libertarians say, "use your dollar votes!" i'm comfortable with a system whereby susan occasionally turns around in the front seat of ye olde station wagon and says "you'd better stop that right now, because if i have to stop this car and come back there, you'll be sorry" and the rest of the time we just keep the fighting down to (bloodless) dull roar. but if you have a better system in mind you should propose it; and if you can't get traction for it inside nanog, there's always room for another ops list. (in Usenet days we used to say "could you move this thread to $other_group, where it will be on-topic, and where i'm not a subscriber?" and it WORKED a lot of the time, just to wake folks up and show that topic-consensus was a property both nec'y and desireable in ALL forums, digital or otherwise.)

16 19

Bangladesh gets itself an IXP
by suresh＠outblaze.com 06 Dec '04

06 Dec '04

http://www.bdix.net looks quite good to me. Open peering, with over 10 local ISPs peering there. What a change from the joke that is NIXI (www.nixi.org) in India .. srs (depressed)

1 0

MCI/Worldcom billing hell?
by joe mcguckin 05 Dec '04

05 Dec '04

So, how many of you out there have been been lucky enough to experience the joys of trying to get MCI billing errors corrected? On today's episode of "This American Life", they detail the experiences of the show's producer, who had her long distance service slammed over to MCI. A call to her mother that should have cost a couple of dollars ended up as a $900 past due amount that MCI tried to collect. Here's the synopsis published at the show's website (www.thislife.org) > On Hold, No One Can Hear You Scream. This show documents This American Life > Senior Producer Julie Snyder's ten-month battle with her phone company (MCI > Worldcom), which overcharged her $946.36. She spent hours on hold, in a > bureaucratic nowhere. Finally, she enlists the aid of the national media > specifically host Ira Glass. You can register a complaint about the phone > company at the Better Business Bureau or at the FCC. To reach Jim Myers, the > MCI executive interviewed in the story, email him at jim.myers(a)mci.com. An audio archive of the show will be available next week from the show's website. In the meantime, I'd suggest that you send your tales of woe to Jim Meyers of MCI to dispute any argument that MCI's pervasive, systemic billing problems are isolated, rare occurrences. -- Joe McGuckin ViaNet Communications 994 San Antonio Road Palo Alto, CA 94303 Phone: 650-213-1302 Cell: 650-207-0372 Fax: 650-969-2124

3 3

ddos from .mil, and from state.oh.us
by Eric Brunner-Williams in Portland Maine 05 Dec '04

05 Dec '04

Oki all, A month ago today Gadi was looking for a contact at US .mil, this morning I had the same need, as a node in the nipr.mil playpen was a major player in a 100+ node ddos directed at a web blog customer we host -- it had a high rate of fire, accounting for over 20% of the total POST methods. Email to the DO was a waste of time, but I did find a useful contact. One of the nodes used in today's ddos against that customer blog appeard in a seperate multi-thousand ad insert (unpaid, naturally) attack on another of our customer blogs, accounting for about half of the total POST methods. If anyone has a useful contact in the state.oh.us playpen, please drop me a line. Email since 24/Nov is unanswered. TiA, Eric

2 1

is reverse dns required? (policy question)
by Greg Albrecht 04 Dec '04

04 Dec '04

i'm currently having an argument with management. we've recently gotten an influx of customer request for us to setup reverse dns for the customer's mail servers, since most sites (aol, freebsd, others) require it to accept mail, and reject mail if it is not from a server with reverse dns (i'm aware this is an emerging trend). because of previous management decisions, we were never directed to setup any reverse dns records for any customers unless solicited to do so by the customer. however, management has taken it upon themselves to charge our customers for every reverse dns request they submit to us. my argument to management is that it's good practice to set this up even before customer solicitation, and to do specific host names per customer specification, completely with-out cost. my question is: are we obligated, as a user of ARIN ip space, or per some BCP, to provide ad-hoc reverse dns to our customers with-out cost, or without financial obligation. thanks!, -xs -- Greg Albrecht (gba(a)undef.net) www.undef.net * 1-415-794-5944

15 22