- NANOG - lists.nanog.org

RE: Counter DoS
by Michael.Dillon＠radianz.com 11 Mar '04

11 Mar '04

>I wonder, are they planning to launch these DDoS attacks from >compromised hosts belonging to unwitting accomplices like the >bad guys do? Could they be the people behind NetSky? We know now that Bagle and MyDoom come from spammer gangs but I haven't heard if anyone has identified a motive behind Netsky yet. I suppose that Symbiot is the logical next step. Now that there is a market for compromised hosts to build distributed networks for DoS, DNS, or anonymous hosting the logical next step is for a legitimate company (or semi-legitimate) to step into that market and try to dominate it. If the ISP and the vendor community won't work together to build the tools and systems needed to identify and block DDoS emitters then this is the inevitable result. If it goes much further then ISPs risk being sued for blocking DDoS because they will also be blocking somebody's revenue stream as well. --Michael Dillon

1 0

Re: Counter DoS
by Brandon Butterworth 11 Mar '04

11 Mar '04

> The Symbiot whitepaper on their service describes a process with a > little more imagination Like hooking it up to DARPA Grand Challenge winners? http://abcnews.go.com/sections/SciTech/WorldNewsTonight/robot_race_darpa_04… > I applaud the idea of a outsourced department that will manage the > denial of service, and "hordes of script kiddie" trouble with sending a droid round to kick ass is you've just made Skynet V0.1 brandon

2 1

Re: Counter DoS
by Baldwin, James 11 Mar '04

11 Mar '04

http://www.symbiot.com/media/iwROE.pdf The Symbiot whitepaper on their service describes a process with a little more imagination and use than simply flooding attacking nodes with packets. It describes a process which appears to require human intervention through an Operations Center to aid in tracking down offending nodes and notifying the offenders service providers prior to an deployment of active defenses. That being said, it also specifically mentions "distributed denial of service counterattacks" as a not quite so last resort, and possibly automated response gesture for multiple identified offenders with whom intervention from service providers and other authorities has not been forth coming. I applaud the idea of a outsourced department that will manage the denial of service, and "hordes of script kiddie" (nod to Ranum) problems that plague modern networks. Anything that keeps me from being distracted from more interesting lines of thought, rather than constantly following up on outside nuisances is a Good Thing (tm). However, the deployment of "active defenses" in response to a failure of service providers to adequately secure their egress and ingress points is not a choice any reasonable person would make. Vigilante justice might be rewarding in the short term, but I choose not to leave the judgment of friend and foe in the hands of someone with large amounts of bandwidth at the tips their itchy trigger fingers. James Baldwin WorldWide Technology, Services, and Operations Operations Center Electronic Arts, Inc.

2 1

Check Your Routing Table! Production Use of 84/8 Imminent.
by Daniel Karrenberg 11 Mar '04

11 Mar '04

The first allocation out of 84/8 has happened. It is *now* high time to check whether you see the pilot prefixes 84.192/16 and 84.255.248/21. If you do not see both of these prefixes it is extremely likely that you will have a connectivity problem very shortly. We also suggest that you check any packet filters you may be responsible for. Regards Daniel Karrenberg RIPE NCC ------ Notes: 84/8 has been allocated by the IANA on November 17th 2003, almost 4 months ago. The fact has been announced on this list a couple of times since. Routing decisions are fully within the responsibility of the network operators. The IANA and the RIRs will only announce which parts of the address space are currently in use. They have no authority whatsoever over routing decisions taken by you and other network operators. More details about the pilot prefixes can be found at http://www.ripe.net/ripe/draft-documents/deboganising-draft.html A visibility comparison of the pilot prefixes with some production prefixes can be found at http://www.ris.ripe.net/debogon/debogon.html Those interested in history, see http://www.ris.ripe.net/debogon/ More information on how to do Bogon filtering efficiently and reliably can be found at Team CYMRU: http://www.cymru.com/Bogons/index.html Unfortunately we are not currently able to provide a host within the pilot prefixes that can reliably answer pings, nor are we able to do connectivity checks from there. The allocation had to happen before we were ready with this part of the pilot prefix pilot.

1 0

AT&T Outage 01:25-01:50 AM EST
by pr＠isprime.com 11 Mar '04

11 Mar '04

Anyone else notice that little AT&T outage just now? All of their routes just flapped, and pinging their side of /30's from level3 and Teleglobe in NYC, I had ~1.0sec ping times. Curious to know what went wrong... --Phil

8 8

Greetings
by Gregory Taylor 11 Mar '04

11 Mar '04

Hello Everyone, I'm new to this mailing list and as such I would like to introduce myself. My name is Gregory Taylor. Some of you know who I am and some of you don't. For those who don't, I am a network and systems engineer up here in the rainy northwest. I'd just like to say hello to everyone and I hope that I can contribute to any discussions you may have constructively and be as helpful as I possibly can. Thank You, -- N E T W O R K A T L A N T I S Premium Internet Services ========================================= Gregory Taylor = Network Engineer ========================================= Email: taylog(a)networkatlantis.com ========================================= Visit us at http://www.networkatlantis.com

1 0

Asking about .iq at ICANN Rome
by Eric Brunner-Williams in Portland Maine 11 Mar '04

11 Mar '04

Oki all, Apropos of plaintive discussion by gTLD registries about repurposed ccTLDs such as .{bz,cc,md,pw,tv}, I asked Paul Twomey during the 1st open mic hour about the current status of .iq. The net of the response was "we know less than you do" and a longish and booring statement that got read the next morning to punish all and sundry, which hasn't made it into the meeting minutes. Later, during the 2nd open mic hour when the subject of ICANN staff and NS change requests (secondary followed by primary, effecting covert redelegation) came up, I asked whether staff had any data to share on communications of any kind concerning .iq. Recall: The .iq sponsor and operator are in a Federal pen in Texas and are awfully quiet. See http://nic-iq.nic-naa.net for what little I know about .iq. The net of the response was "we have gotten above double-digit inquiries from various parties concerning the .iq space", and no corroborating details beyond this assertion will be available. Life being the random thing that it is, I ran into a Haliburton contractor in Rome, who knew that RTI got the Iraq schools deal, so most of whatever could go into the .k12.iq zone, easily 1k of site entries, is already on file somewhere inside www.rti.org. Life being even further random, the dns-free mobile infrastructure of Iraq is now being advertized in the broadcast media in Rome. Folks interested in this please drop me a note. Folks interested in ICANN'T should note that with WLS, the base registry price for a domain name just went from $6/yr to $30/yr, with the usual caveats that it really is just $6/yr unless one, or someone, wants the additional $24/yr WLS subscription value. The current crop of alternatives to ICANN now includes: The ITU: http://www.itu.int/osg/spu/forum/intgov04/ The UN: http://www.unicttaskforce.org/sixthmeeting/ and Weinstein, Neuman, and Farber have something cooking on the general failure of packetized life that is nominally relevant: http://www.pfir.org/meltdown/ That's my 0.02 € for this evening. This list actually was mentioned by name at ICANN. Forward as appropriate, or inappropriate. Eric

1 0

Comcast Contact
by Matt Hess 10 Mar '04

10 Mar '04

Can somebody at comcast.net with a clue about possible ip routing problems please contact me off-list.

1 0

ALTER.NET packet loss / huge latencies?
by Avleen Vig 10 Mar '04

10 Mar '04

Is anyone else seeing this? It seems to be happening all over thier network, here is one example: 7 POS1-2.BR2.LAX9.ALTER.NET (204.255.169.137) 13.461 ms 16.557 ms 12.602 ms 8 * 0.so-0-2-0.XL2.LAX9.ALTER.NET (152.63.114.246) 230.718 ms 245.466 ms 9 * 0.so-0-0-0.TL2.LAX9.ALTER.NET (152.63.115.146) 220.956 ms * 10 0.so-7-0-0.IL2.DCA6.ALTER.NET (152.63.9.221) 261.532 ms 258.602 ms 263.568 ms 11 so-0-0-0.IR2.DCA4.ALTER.NET (146.188.13.42) 257.150 ms 246.301 ms * 12 so-5-0-0.TR2.LND2.ALTER.NET (146.188.3.222) 389.056 ms 377.858 ms 406.916 ms 13 so-6-0-0.XR1.LND2.ALTER.NET (146.188.7.225) 368.634 ms 341.144 ms * And another: 8 POS1-1.BR1.SEA1.ALTER.NET (204.255.174.169) 289.566 ms 288.612 ms 295.284 ms 9 * 0.so-7-3-0.XL2.SEA1.ALTER.NET (152.63.105.22) 247.114 ms * 10 0.so-7-0-0.TL2.SEA1.ALTER.NET (152.63.2.134) 252.573 ms 250.192 ms 251.660 ms 11 * 0.so-4-0-0.TL2.SAC1.ALTER.NET (152.63.1.5) 252.037 ms 262.443 ms 12 0.so-7-0-0.XL2.SJC1.ALTER.NET (152.63.55.133) 252.823 ms * 252.452 ms 13 POS1-0.XR2.SJC1.ALTER.NET (152.63.55.125) 255.131 ms 248.951 ms 252.414 ms -- Avleen Vig Systems Administrator Personal: www.silverwraith.com EFnet: irc.mindspring.com (Earthlink user access only)

2 1

BellNexxia to C&W problems in NY ? (AS577 - AS3561)
by Mike Tancsa 09 Mar '04

09 Mar '04

I have a few users exchanging data with sites inside Bell Canada call in to complain today with various symptoms (eg. VPNs timing out, transfers taking a long time). After a bit of narrowing down, it would seem that when the traffic comes at me via C&W from Bell (2 of my 3 transit providers 852 and 6539 talk to parts of Bell this way) the problems are acute. Looking at traceroutes between C&W and Bell IP space, there does indeed seem to be some issue between their exchange point in NY The 2 snippets being From bell to cw 6 bx2-newyork83-pos3-0.in.bellnexxia.net (206.108.103.194) 20 msec 20 msec 16 msec 7 iar4-so-2-3-0.NewYork.cw.net (208.173.135.185) [AS 3561] 172 msec 176 msec 176 msec From cw to bell 6 iar4-loopback.NewYork.cw.net (206.24.194.39) 68 msec 68 msec 72 msec 7 teleglobe.NewYork.cw.net (208.173.135.186) 208 msec 208 msec 208 msec At one point in the day, it was adding about 400 to 500ms of latency Type escape sequence to abort. Tracing the route to route-server.cw.net (209.1.220.234) 1 dis40-toronto63-fe5-0-0.in.bellnexxia.net (205.207.238.210) 32 msec 0 msec 232 msec 2 core2-toronto63-pos11-5.in.bellnexxia.net (206.108.98.141) 0 msec 0 msec 0 msec 3 core3-toronto63-pos6-0.in.bellnexxia.net (64.230.242.101) 0 msec 0 msec 0 msec 4 core4-montreal02-pos13-1.in.bellnexxia.net (64.230.243.237) 28 msec 204 msec 208 msec 5 core1-newyork83-pos0-0.in.bellnexxia.net (206.108.99.190) 20 msec 20 msec 16 msec 6 bx2-newyork83-pos3-0.in.bellnexxia.net (206.108.103.194) 20 msec 20 msec 16 msec 7 iar4-so-2-3-0.NewYork.cw.net (208.173.135.185) [AS 3561] 172 msec 176 msec 176 msec 8 agr2-loopback.NewYork.cw.net (206.24.194.102) [AS 3561] 184 msec 176 msec 180 msec 9 dcr1-so-6-1-0.NewYork.cw.net (206.24.207.53) [AS 3561] 184 msec 180 msec 184 msec 10 dcr2-loopback.SantaClara.cw.net (208.172.146.100) [AS 3561] 248 msec 248 msec 248 msec 11 bhr1-pos-0-0.SantaClarasc8.cw.net (208.172.156.198) [AS 3561] 256 msec 244 msec 244 msec 12 bhr2-ge-2-0.SantaClarasc8.cw.net (208.172.147.54) [AS 3561] 252 msec 248 msec 248 msec 13 209.1.169.177 [AS 3561] 172 msec 184 msec * route-server.cw.net>traceroute looking-glass.in.bellnexxia.net Translating "looking-glass.in.bellnexxia.net"...domain server (64.41.189.214) [OK] Type escape sequence to abort. Tracing the route to looking-glass.in.bellnexxia.net (205.207.237.50) 1 209.1.169.178 0 msec 0 msec 0 msec 2 bhr1-ge-2-0.SantaClarasc8.cw.net (208.172.147.53) 0 msec 0 msec 0 msec 3 dcr2-so-3-0-0.SantaClara.cw.net (208.172.156.197) 0 msec 4 msec 0 msec 4 dcr1-loopback.NewYork.cw.net (206.24.194.99) 76 msec dcr2-loopback.NewYork.cw.net (206.24.194.100) 72 msec dcr1-loopback.NewYork.cw.net (206.24.194.99) 68 msec 5 agr1-so-0-0-0.NewYork.cw.net (206.24.207.50) 68 msec 72 msec 68 msec 6 iar4-loopback.NewYork.cw.net (206.24.194.39) 68 msec 68 msec 72 msec 7 teleglobe.NewYork.cw.net (208.173.135.186) 208 msec 208 msec 208 msec 8 core1-newyork83-pos1-1.in.bellnexxia.net (206.108.103.193) 260 msec 332 msec 216 msec 9 core4-montreal02-pos6-3.in.bellnexxia.net (206.108.99.189) 196 msec 204 msec 200 msec 10 64.230.243.238 208 msec 296 msec 460 msec 11 core2-torontodc-pos3-1.in.bellnexxia.net (206.108.104.2) [AS 577] 432 msec 404 msec 404 msec 12 dis4-torontodc-Vlan82.in.bellnexxia.net (206.108.104.30) [AS 577] 400 msec 240 msec 440 msec 13 looking-glass.in.bellnexxia.net (205.207.237.50) [AS 577] 452 msec 236 msec 244 msec route-server.cw.net> Anyone know whats up ? ---Mike -------------------------------------------------------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike(a)sentex.net Providing Internet since 1994 www.sentex.net Cambridge, Ontario Canada www.sentex.net/mike

2 2