- NANOG - lists.nanog.org

RE: Counter DoS
by Priscilla Oppenheimer 12 Mar '04

12 Mar '04

One aspect of the problem with DoS attacks and warlike responses to these attacks is that the younger generation is getting their computer science training via gaming and hacking. Many high schools in the U.S. are so financially strapped that they can't afford to teach programming, networking, etc., and if they can, the teachers are often also the shop teacher or the journalism teacher who happened to "be good with computers" but is actually rather clueless about real computer science issues and the computer industry. Tekkie high school students aren't being challenged. They are learning their computing skills without mentors. We can help with that aspect of the problem. Get involved with your local high schools. Sponsor user groups at the high school. Offer to teach some mini courses. The teenage crowd needs our help learning best practices and ethics. The hacking problem is multi-faceted, of course, and this is just one facet of a partial solution, but still, do consider it. Thanks for listening. :-) Priscilla Oppenheimer At 04:48 PM 3/11/04, Pendergrass, Greg wrote: >By "The Art of War on the Internet" I didn't mean information warfare, >that's been with us as long as there's been information and the internet is >certainly going to be a major part of that. What I am against is anyone >trying to popularize the idea of the internet as a battleground where one >uses force and deception to "gain ground". It's just another case of people >wrongly attempting to fit somthing that they don't understand into a >framework that they do understand, thereby creating a fallacy. Trying to >base a product off of a flawed idea is bound to fail but also likely be a >major irritation before it does. > >GP > > >-----Original Message----- >From: Etaoin Shrdlu [mailto:shrdlu@deaddrop.org] >Sent: 11 March 2004 14:58 >To: Nanog >Subject: Re: Counter DoS > > > >"Pendergrass, Greg" wrote: > > > > I can see now that it's only a matter of time before some nut writes "The > > Art of War in the Internet". I read the whitepaper, it goes on a lot about > > how defensive policies are ineffective but doesn't really say why active > > response has never been tried: > >Ask, and ye shall receive. > >http://btobsearch.barnesandnoble.com/textbooks/booksearch/isbnInquiry.asp?us >erid=2XH986JPUE&btob=Y&isbn=1581128576&TXT=Y&itm=1 > >I thought that someone mentioned that Mr. Forno was reputed to be on staff >with these folk. > > > Their proposition is a terrible idea and their "rules of engagement" would > > be funny instead of frightening if it wasn't serious > >I note that he also has a title from last year, which seems applicable >here: > >Weapons of Mass Delusion (ISBN 158961111X) > >I will point out that I cannot take seriously a company (Symbiot) that >depends on a shockwave plugin to put up a web page. > >Pity that they came out so aggressively; it might have been an interesting >product. Hype can kill as well as sell. > >-- >It is by caffeine alone I set my mind in motion. >It is by the beans of Java that thoughts acquire speed, >the hands acquire shaking, the shaking becomes a warning. >It is by caffeine only I set my mind in motion. > > >Vodafone Global Content Services Limited >Registered Office: Vodafone House, The Connection, Newbury, >Berkshire RG14 2FN > >Registered in England No. 4064873 > >This e-mail is for the addressee(s) only. If you are not an addressee, you >must not distribute, disclose, copy, use or rely on this e-mail or its >contents, and you must immediately notify the sender and delete this e-mail >and all copies from your system. Any unauthorised use may be unlawful. The >information contained in this e-mail is confidential and may also be legally >privileged. _______________________________ Priscilla Oppenheimer www.priscilla.com When your Daemon is in charge, do not try to think consciously. Drift, wait, and obey. -- Kipling.

2 1

Re: Counter DoS
by Rachael Treu 11 Mar '04

11 Mar '04

On Thu, Mar 11, 2004 at 03:21:29AM -0500, Brian Bruns said something to the effect of: > > On Thursday, March 11, 2004 3:05 AM [EST], Brian Bruns <bruns(a)2mbit.com> > wrote: ..snip snip.. > > How the hell could a company put something like this out, and expect not to > > get themselves sued to the moon and back when it fires a shot at an innocent > > party? Caution: 'innocent' is not the buzzword here. Subscribers: check your respective AUPs. You will likely find explicit prohibition of any malicious and generally unsolicited traffic generated by a node in your control, and I don't think that self-defense has an extenuation clause or special case appendix therein. You attack an attacker, he, too, can pursue you legally. There are not provisions made for DoS-ing a DoS-er. Vigilante nonsense is discouraged. > ..snip snip..> > Whats going to happen when they find a nice little exploit in these buggers > (even if they have anti-spoof stuff in them) that allows the kids to take > control of them or trick them into attacking innocents? Instead of thousands > of DDoS drones on DSL and cable modems, you'll see kids with hundreds of these > 'nuclear stike firewalls' on T1s, T3s, and higher, using them like they use > the current trojans? This won't even require a exploit to effect. These boxes can likely be used to do the bidding of miscreants with some simply-crafted packets and source spoofing. This thing could become something akin to a smurf amp with a big-time attitude problem. Anti-spoof rules will afford a modicum of reverse-path protection, but not enough to swat away the majority of inbound crafted traffic. This stupid PoS appliance would have to be installed and widely-deployed provider-side to discern on such a level. This would become the stuff of yet-another-botnet. > > No product is 100% secure (especially not something that runs under Windows, > but thats another issue), so how are they going to deliver updates? This is the least of their concerns; update management is already done effectively and easily by most IDS, anti-virii, and other signature-based appliance manufacturers. Snakeoil salesmen offer at the most basic a valid means of distributing updates, even. > Or make sure that the thing is configured right? Now _that_ is a real problem. Given that no one has beaten the creators with the illustrious clue stick and anyone who'd truly subscribe to this thing is likely mis-wired him/herself, I would guess that poor configuration is an engineering cornerstone on which this entire debacle desperately depends. Flog the scoundrels. ymmv, --ra -- k. rachael treu, CISSP rara(a)navigo.com ..quis costodiet ipsos custodes?.. > I could see blacklists (BGP based) > cropping up of these systems, so that you can filter these networks from ever > being able to come near your network. > > This is starting to sound more and more like a nuclear arms race - on one side > we have company a, on the other company b. Company A fears that B will attack > it, so they get this super dooper nuclear strike system. Company B follows > suit and sets one up as well. Both then increase their bandwidth, outdoing > the other until finally, script kiddie comes along, and spoofs a packet from A > to B, and B attacks A, and A responds with its own attack. ISPs hosting the > companies fall flat on their face from the attack, the backbone between the > two ISPs gets lagged to death, and stuff starts griding to a halt for others > caught in the crossfire. > > So, and who thinks that this is a good idea? :) > -- > Brian Bruns > The Summit Open Source Development Group > Open Solutions For A Closed World / Anti-Spam Resources > http://www.sosdg.org > > The Abusive Hosts Blocking List > http://www.ahbl.org

1 0

Re: Enterprise Multihoming
by John Dupuy 11 Mar '04

11 Mar '04

John As already stated by lots of folks on the list, this is largely a business decision rather than a technical one. However, there are some more useful thoughts: 1. Is the decision to multi-home consistent with your other redundancy plans? For example, why go through all the trouble of multi-homing and setting up BGP, only for both circuits to be plugged into the same router? ..or, two routers but neither of them on UPS. This is akin to insisting on a Class A bank-grade firewall but not bothering to put a lock on the server room door... 2. Multi-homing is usually considered critical when one is discussing hosting of some kind. Could you be served with multiple servers in geographically separate collocation centers inside one ASN? While many MIS departments like to have direct access to their own servers, this can often be an emotional preference rather than a technical one. Often only the "public facing" servers need BGP redundancy. The back-ends can be set up to fail-over to separate VPN/IPs in separate ASNs. Having said all that, I prefer physical access to my machines too. So I'm a hypocrite. 3. If you are not doing hosting, a two-ISP NAT solution may make more sense than BGP. In addition to burdening the global routing tables; good BGP management is expensive. It involves either hiring someone with the proper expertise/experience or purchasing that expertise. Relatively speaking, there are not a lot good experienced BGP admins out there. 4. What is the price of downtime, in real dollars? For many business, this really can be estimated. Consider lost time (wages, utilities, etc.) and lost sales. Then compare it to the various options. Just my two cents, John At 10:04 AM 3/11/2004, you wrote: >On another list we've been having multihoming discussions again and I >wanted to get some fresh opinions from you. > >For the past few years it has been fairly common for non-ISPs to >multihome to different providers for additional redundancy in case a >single provider has problems. I know this is frowned upon now, >especially since it helped increase the number of autonomous systems and >routing table prefixes beyond what was really necessary. It seems to me >that a large number of companies that did this could just have well >ordered multiple, geographically separate links to the same provider. > >What is the prevailing wisdom now? At what point do you feel that it is >justified for a non-ISP to multihome to multiple providers? I ask >because we have three links: two from Sprint and one from Global >Crossing. I'm considering dropping the GC circuit and adding another >geographically-diverse connection to Sprint, and then removing BGP from >our routers. > >I see a few upsides to this, but are there any real downsides? > >Flame on. :-) > >Thanks, >John >--

1 0

Web Based tool for tracking circuits
by Marius Strom 11 Mar '04

11 Mar '04

I know there's always people searching out web based utils for tracking IP allocations and such, but surprisingly I don't recall there ever being discussion on tracking circuits. I'm looking for such a tool and am curious if anyone knows of one? I'm looking to track: circuit type, circuit id, trouble reporting number, serving telco. Possibly more, such as connected-router information, etc. Thanks in advance, if there's sufficient demand I'll summarize back to the list. -- /-------------------------------------------------> Marius Strom | Always carry a short length of fibre-optic cable. Professional Geek | If you get lost, then you can drop it on the System/Network Admin | ground, wait 10 minutes, and ask the backhoe http://www.marius.org/ | operator how to get back to civilization. \-------------| Mike Andrews |-------------------->

4 6

Re: Enterprise Multihoming
by John Neiberger 11 Mar '04

11 Mar '04

> >JN> My current opinion is that since we can't accept much >JN> downtime in the case of a single provider failure, it's >JN> probably not wise to put all of our eggs in Sprint's basket >JN> even if all circuits are geographically diverse. > >Use multiple border routers. Keep your IGP lean and nimble. >Think about BGP/IGP synchronization. > >WAN links can fail, but so can ethernet links and entire routers. We have multiple border routers and are fairly redundant internally. As it is now, any single piece of equipment could fail (except in one case that I intend to rectify soon) or any two of our three Internet connections could fail and no one would notice much except for perhaps slower connections. I've discovered the wonders of fault-tolerant transceivers and I'll be redesigning a portion of that part of the network around them. Once I'm done, quite literally any single device could fail and no one would notice. John --

1 0

Re: Enterprise Multihoming
by John Neiberger 11 Mar '04

11 Mar '04

Thanks to everyone who has responded so far. I'm glad that I got some opinions here before I proceeded. I also participate in another list that has some fairly experienced people on it. They prevailing opinion there was that multihoming to multiple providers was overrated and largely unnecessary, and they just about had me convinced. My current opinion is that since we can't accept much downtime in the case of a single provider failure, it's probably not wise to put all of our eggs in Sprint's basket even if all circuits are geographically diverse. Thanks again, John --

4 3

Re: Enterprise Multihoming
by John Neiberger 11 Mar '04

11 Mar '04

>>> Daniel Roesen <dr(a)cluenet.de> 3/11/04 9:13:04 AM >>> > >On Thu, Mar 11, 2004 at 09:04:57AM -0700, John Neiberger wrote: >> For the past few years it has been fairly common for non-ISPs to >> multihome to different providers for additional redundancy in case a >> single provider has problems. I know this is frowned upon now, >> especially since it helped increase the number of autonomous systems and >> routing table prefixes beyond what was really necessary. > >Who defines what is "really necessary"? What is your understanding >of "really necessary" when it comes to the desire to be commercially >and technically independent of your suppliers? > >It's this discussion again. That goes off in entirely the wrong direction but I guess I'll clarify that statement. :-) My point was that most companies could have met their connectivity requirements by simply getting multiple connections to the same provider from the beginning. However, among the less-technical managers it seemed to be popular to demand connectivity to multiple ISPs. It seems that me that this was not really necessary from a technical perspective in many cases, it just made people feel good. I don't really want to focus on that, though; I'm more interested in the situation as it stands today. If a company were going to add brand new Internet connectivity where it didn't exist before, what factors would you use to determine if multiple ISPs should even be considered? Given the stability of the larger ISPs and the general lack of true BGP expertise at many companies, is the potential benefit of multihoming to different ISPs worth the added risk and responsbility that comes with using BGP? Our BGP configuration isn't very difficult to understand but we do have a lack of BGP knowledge in the department and some additional training is in order. However, might it not be better to just simplify our connectivity and remove BGP altogether? Sure, I like BGP as much as the next guy but there's no sense in running it just because we can. :-) Thanks, John --

2 1

RE: Enterprise Multihoming
by McBurnett, Jim 11 Mar '04

11 Mar '04

Look at it this way: If Multi-homing to ensure maximum reliabilty was not a good thing: why would XYZ isp do it? Take this example: Remember last year (or year before?) when MCI had the routing issue on the east coast? I had a friend that had 2 T-1's to MCI, he lost all reachability for over 5 hours. I had another friend that had a T-1 from MCI and one from AT&T. He stayed up, and so did his ecommerce site. So the end questions is: Do you trust your upstream enough to bank your business, or more importantly your reputation as an IT professional, on the ability of everyone at your ISP to maintain their network and everything that gives you access 99.999% of the time? Jim ->-----Original Message----- ->From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of ->Gregory Taylor ->Sent: Thursday, March 11, 2004 11:41 AM ->To: John Neiberger; nanog(a)merit.edu ->Subject: Re: Enterprise Multihoming -> -> -> ->Mutli-homing a non-ISP network or system on multiple carriers ->is a good ->way to maintain independent links to the internet by means of ->different ->peering, uplinks, over-all routing and reliability. My ->network on NAIS ->is currently multi-homed through AT&T. I use a single ->provider as both ->of my redundant links via 100% Fiber network. Even though this is ->cheaper for me, all it takes is for AT&T to have some major ->outage and I ->will be screwed. If I have a backup fiber line from say, Global ->Crossing, then it doesn't matter if AT&T takes a nose dive, I ->still have ->my redundancy there. -> ->That is why most non-ISPs hold multihoming via different providers as ->their #1 choice. -> ->Greg -> ->John Neiberger wrote: -> ->>On another list we've been having multihoming discussions again and I ->>wanted to get some fresh opinions from you. ->> ->>For the past few years it has been fairly common for non-ISPs to ->>multihome to different providers for additional redundancy in case a ->>single provider has problems. I know this is frowned upon now, ->>especially since it helped increase the number of autonomous ->systems and ->>routing table prefixes beyond what was really necessary. It ->seems to me ->>that a large number of companies that did this could just have well ->>ordered multiple, geographically separate links to the same provider. ->> ->>What is the prevailing wisdom now? At what point do you feel ->that it is ->>justified for a non-ISP to multihome to multiple providers? I ask ->>because we have three links: two from Sprint and one from Global ->>Crossing. I'm considering dropping the GC circuit and adding another ->>geographically-diverse connection to Sprint, and then ->removing BGP from ->>our routers. ->> ->>I see a few upsides to this, but are there any real downsides? ->> ->>Flame on. :-) ->> ->>Thanks, ->>John ->>-- ->> ->> ->> ->> -> -> ->

1 0

RE: Counter DoS
by Pendergrass, Greg 11 Mar '04

11 Mar '04

By "The Art of War on the Internet" I didn't mean information warfare, that's been with us as long as there's been information and the internet is certainly going to be a major part of that. What I am against is anyone trying to popularize the idea of the internet as a battleground where one uses force and deception to "gain ground". It's just another case of people wrongly attempting to fit somthing that they don't understand into a framework that they do understand, thereby creating a fallacy. Trying to base a product off of a flawed idea is bound to fail but also likely be a major irritation before it does. GP -----Original Message----- From: Etaoin Shrdlu [mailto:shrdlu@deaddrop.org] Sent: 11 March 2004 14:58 To: Nanog Subject: Re: Counter DoS "Pendergrass, Greg" wrote: > > I can see now that it's only a matter of time before some nut writes "The > Art of War in the Internet". I read the whitepaper, it goes on a lot about > how defensive policies are ineffective but doesn't really say why active > response has never been tried: Ask, and ye shall receive. http://btobsearch.barnesandnoble.com/textbooks/booksearch/isbnInquiry.asp?us erid=2XH986JPUE&btob=Y&isbn=1581128576&TXT=Y&itm=1 I thought that someone mentioned that Mr. Forno was reputed to be on staff with these folk. > Their proposition is a terrible idea and their "rules of engagement" would > be funny instead of frightening if it wasn't serious I note that he also has a title from last year, which seems applicable here: Weapons of Mass Delusion (ISBN 158961111X) I will point out that I cannot take seriously a company (Symbiot) that depends on a shockwave plugin to put up a web page. Pity that they came out so aggressively; it might have been an interesting product. Hype can kill as well as sell. -- It is by caffeine alone I set my mind in motion. It is by the beans of Java that thoughts acquire speed, the hands acquire shaking, the shaking becomes a warning. It is by caffeine only I set my mind in motion. Vodafone Global Content Services Limited Registered Office: Vodafone House, The Connection, Newbury, Berkshire RG14 2FN Registered in England No. 4064873 This e-mail is for the addressee(s) only. If you are not an addressee, you must not distribute, disclose, copy, use or rely on this e-mail or its contents, and you must immediately notify the sender and delete this e-mail and all copies from your system. Any unauthorised use may be unlawful. The information contained in this e-mail is confidential and may also be legally privileged.

1 0

RE: Counter DoS
by Pendergrass, Greg 11 Mar '04

11 Mar '04

I can see now that it's only a matter of time before some nut writes "The Art of War in the Internet". I read the whitepaper, it goes on a lot about how defensive policies are ineffective but doesn't really say why active response has never been tried: A. Most of the time dDOS traffic is from spoofed sources anyway so whichever machine you "return fire" on is probably not the one that attacked you. B. NAT translation means a hacker has a tailor-made defense against any active repsonse. C. Even if you can directly attack a machine being used against you it's almost certainly not the perpetrator's box, he/she is sitting half a world away. The box you intentionally destroy is likely some innocent family PC that was taken over using some unplugged windows security hole. D. Widely deployed active defense will give an attacker a new form of dDOS attack, spoof the source of the one you want to hit in attacking several "active defense" systems and watch them attack your target for you. Their proposition is a terrible idea and their "rules of engagement" would be funny instead of frightening if it wasn't serious GP -----Original Message----- From: Joshua Brady [mailto:jbrady@neoins.com] Sent: 11 March 2004 01:27 To: isp-chat(a)isp-chat.com Cc: nanog(a)merit.edu Subject: Counter DoS http://news.zdnet.co.uk/internet/security/0,39020375,39148215,00.htm Comments? Vodafone Global Content Services Limited Registered Office: Vodafone House, The Connection, Newbury, Berkshire RG14 2FN Registered in England No. 4064873 This e-mail is for the addressee(s) only. If you are not an addressee, you must not distribute, disclose, copy, use or rely on this e-mail or its contents, and you must immediately notify the sender and delete this e-mail and all copies from your system. Any unauthorised use may be unlawful. The information contained in this e-mail is confidential and may also be legally privileged.

2 1