- NANOG - lists.nanog.org

Re: What percentage of the Internet Traffic is junk?
by Joe St Sauver 06 May '04

06 May '04

[discussing the traffic statistics reported at http://netflow.internet2.edu/ ] #Note that this is biased by a very significant factor - we're looking here at #Internet2 traffic *only*, which basically ends up meaning that email isn't seen #unless both the sender *and* recipient are at one of the 200 or so universities #that are members, or one of the 50 or so corporate/associate members. Actually, that understates the relevant population. The traffic seen on Abilene represents traffic associated with the groups you mentioned, PLUS: -- all the foreign R&E networks that peer with Internet2 (Canarie, Geant, etc, see http://abilene.internet2.edu/peernetworks/international.html ) -- the federal R&E networks that peer with Internet2 (ESNet, DREN, NREN/NISN, etc., see: http://abilene.internet2.edu/peernetworks/domestic.html) -- the 30+ state K12 networks that now connect to Abilene as "sponsored educational group participants (SEGPs)," (many of which dwarf their affiliated state university systems by a factor of ten or more in size) (see http://abilene.internet2.edu/community/segp/list.html ) -- the smaller schools, museums, hospitals, observatories, etc. that are connected as "sponsored participants" (see http://abilene.internet2.edu/community/sponsored/list.html ) -- event-related traffic associated with things like SC2003 and similar exhibitions/meetings -- intra-Abilene traffic associated with backbone performance/conformance testing, etc. #For starters, if the sender *or* recipient is at a commercial ISP, it won't #have been included in those numbers. That's true for IPv4 unicast trafifc, but Internet2's conditions of use allow it to carry IP multicast traffic and IPv6 traffic regardless of whether the source is R&E or commercial. So yes, it is true that Abilene's traffic doesn't accurately reflect the activities of the greater Internet, but it does reflect the activity of a wider base of folks than you might think. What it does not reflect is the traffic to and from popular destinations such as Google, Yahoo, MSN, CNN, eBay, etc. Regards, Joe

1 0

RE: FW: Worms versus Bots
by Rob Nelson 06 May '04

06 May '04

>The goal of this document is help new XP users survive long enough to do >their updates. >Many of them cant/wont put up acls/nat/firewalls ... but if they follow >the steps listed they have a better chance of >successfully downloading and updating their new machine then they will >have with OUT these steps. >It is not meant as a complete XP hardening document. There are lots of >documents that discuss in detail how to harden >windows (xp,nt,2k...). If the person doesn't continue to do acls/nat/firewalls, they'll just get infected after the next hole is discovered. And yes, there are plenty of holes that a firewall/nat box won't fix. Still, better than the user only doing Windows Update on the day of install and never having a firewall... Rob Nelson ronelson(a)vt.edu

3 2

Re: What percentage of the Internet Traffic is junk?
by Hank Nussbacher 06 May '04

06 May '04

> >With all the spam, infected e-mails, DOS attacks, ultimately blackholed >traffic, etc. I wonder if there has been a study that quantifies > >What percentage of the Internet traffic is junk? Record Broken: 82% of U.S. Email is Spam http://www.esecurityplanet.com/trends/article.php/3349921 -Hank

1 0

What percentage of the Internet Traffic is junk?
by William B. Norton 06 May '04

06 May '04

With all the spam, infected e-mails, DOS attacks, ultimately blackholed traffic, etc. I wonder if there has been a study that quantifies What percentage of the Internet traffic is junk? Bill

7 6

RE: What percentage of the Internet Traffic is junk?
by Michel Py 06 May '04

06 May '04

Bill, > What percentage of the Internet traffic is junk? I think two things needs to be clarified: 1. What is "junk" (my $0.02: "junk" is what is as follows and associated by-product traffic of: - Viruses - Worms - Attacks of all kinds including DOS/dDOS - Spam - Crapware (which includes unwanted pop-up windows while surfing, challenging to measure) 2. Assuming that we a) have a clear definition of 1. and b) are able to netflow-measure it (both of which present challenges), how do you define "Internet traffic" and WHERE would you measure it (if it was technically possible to sniff/netflow everywhere). In other words, does "Internet traffic" include: - Peering traffic between tier-1s (at Equinix facilities, of course :-) - Transit traffic from/to tier-1s to smaller operators. - Peering between content providers and eyeballs. - Peering between eyeballs. - Peering between x and y (you should read Bill Norton's papers about peering, me thinks) - Internal traffic within eyeballs. - Non-data traffic (VOIP..)? - Etc? Michel.

1 0

RE: What percentage of the Internet Traffic is junk?
by Michel Py 06 May '04

06 May '04

> Steve Gibbard wrote: > If a few of you can stop being so pedantic for a second, > the definition looks pretty easy to me: traffic unlikely > to be wanted by the recipient. This looks good to me although it also needs to include _return_ traffic from junk traffic (say, you flood a target with ICMP echo request, and the target does not rate-limit the ICMP echo reply; in that case the reply is junk as well as the request although it is wanted by the destination which is the attacker). Another way at looking at the issue is to measure how much traffic is legitimate. Your mileage may vary and I made up the following figures as they can greatly vary depending on the network, but... Let's say there's 50% of p2p file sharing, 10% of downloading pr0n, 5% of downloading services packs and anti-virus signatures and 15% of misc HTTP surfing, all of which I would consider legitimate and would also match Steve's definition, this already makes for 80% legit. Legal != legit IMHO. Although 99% of p2p file sharing traffic is likely illegal, it is legitimate (the destination wants to receive it). Michel.

1 0

Yahoo Mail problems ? (queue issues in general)
by Mike Tancsa 05 May '04

05 May '04

Anyone else seeing Yahoo mail queue up today ? Some of their servers respond in about 10secs with the HELO banner, most others take more than 2m. Because of the recent increase in SPAM, I was looking to reduce the wait time for the initial HELO to 2m from 5m. However, the RFC calls for 5m on the HELO and another 5m for the MAIL command. Having a process block like that for up to 10m seems a bit excessive to deliver one email (and its probably a bounce to boot!). What are others doing? This problem seems to becoming more and more acute. ---Mike -------------------------------------------------------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike(a)sentex.net Providing Internet since 1994 www.sentex.net Cambridge, Ontario Canada www.sentex.net/mike

2 2

RE: BGP Exploit
by Smith, Donald 05 May '04

05 May '04

I have seen 3 pubic ally available tools that ALL work. I have seen 2 privately tools that work. A traffic generator can be configured to successfully tear down bgp sessions. Given src/dst ip and ports : I tested with a cross platform EBGP peering with md5 using several of the tools I could not tear down the sessions. I tested both Cisco and juniper BGP peering after code upgrades without md5 I could not tear down the sessions. Donald.Smith(a)qwest.com GCIA http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xAF00EDCC pgpFingerPrint:9CE4 227B B9B3 601F B500 D076 43F1 0767 AF00 EDCC kill -13 111.2 > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Steven M. Bellovin > Sent: Tuesday, May 04, 2004 11:54 AM > To: Kurt Erik Lindqvist > Cc: kwallace(a)pcconnection.com; nanog(a)merit.edu > Subject: Re: BGP Exploit > > > > > In message > <C4E8C22A-9DA6-11D8-B28B-000A95928574(a)kurtis.pp.se>, Kurt > Erik Lindq vist writes: > > >> > >> Now that the firestorm over implementing Md5 has quieted > down a bit, > >> is anybody aware of whether the exploit has been used? > Feel free to > >> reply off list. > > > >Even more interesting, did anyone manage to reproduce it? > > > > I don't know if it's being used; I know that reimplementations of the > idea are out there. > > > --Steve Bellovin, http://www.research.att.com/~smb > > >

3 2

RE: Worms versus Bots
by Michel Py 05 May '04

05 May '04

> Matthew Crocker wrote: > We require a NAT device or true firewall on all DSL > customer connections. We sell cheap Linksys boxes > to customers or they can upgrade to a SonicWall. This makes a lot of sense to me. It's not a silver bullet, but it does help. > I still like PPPoE for customer authentication > because I can place individual packet filters or > re-assign users to different contexts based on > username/password authentication. PPPoE/NAT is a > good combination. Tends to be a non-issue now, but it's a lot easier to deal with PPPoE on the Linksys than have the customer install a more or less crummy PPPoE client on their PC. The cost of dealing with one customer that trashed their PC installing an early PPPoE client (with the help of helpdesk :-( is worth ten Linksys. Michel.

1 0

RE: BGP Exploit
by Smith, Donald 05 May '04

05 May '04

%tcp-6-badauth: No MD5 digest from SRC.IP.NET.HOST(portnumber) to DST.IP.NET.HOST(portnumber) Donald.Smith(a)qwest.com GCIA http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xAF00EDCC pgpFingerPrint:9CE4 227B B9B3 601F B500 D076 43F1 0767 AF00 EDCC kill -13 111.2 > -----Original Message----- > From: james [mailto:hackerwacker@cybermesa.com] > Sent: Tuesday, May 04, 2004 4:41 PM > To: Smith, Donald > Cc: nanog(a)merit.edu > Subject: Re: BGP Exploit > > > What would a Cisco log if the IP's for the BGP sessions were > attacked & MD5 was in place ? "No MD5 digest from <IP>", " > Invalid MD5 digest from <IP>" or something else ? So far, > grepping through my logs all I see for "MD5" are the the > times I set MD5 for my BGP sessions. > > -- > James H. Edwards > Routing and Security > At the Santa Fe Office: Internet at Cyber Mesa > jamesh(a)cybermesa.com noc(a)cybermesa.com > (505) 795-7101 > >

1 0