- NANOG - lists.nanog.org

Re: Source address validation (was Re: UUNet Offer New Protection Against DDoS)
by James Edwards 07 Mar '04

07 Mar '04

On Sun, 2004-03-07 at 11:08, fingers wrote: > just a question > > why is DDoS the only issue mentioned wrt source address validation? uRPF, strict mode, is how I control 1000+ DSL pvc's from leaking private address space via broken NAT. Also, all other customer facing interfaces run uRPF, strict mode. It is a very powerful tool; null route some trouble causing customer space and traffic destined to this space is dropped via this null route AND traffic sourced from this space is dropped via uRPF, strict check. An AS112 NS also takes care of another facet of this problem. As to the question of DDoS'es and spoofed address space; once we close the hole of allowing DDoS'es to come from untraceable address space I feel we gain something very useful. We now know where the bad stuff is coming from. The solution to DDoS is not a black box that will go to Def Con 1 at the first sign of a port scan. You don't put out a fire with more fuel. Criminal investigation techniques are quite advanced. We cannot start to put them to use if attacks come from addresses that do not point back to the attacker. I am just as jaded as the next person with the present lack of law enforcement support in abuse issues but all of this is a quite new form of crime through a new medium. A "push back" system would give us the ability to quickly bring DDoS/DoS'es under control and complement a system to track down, gather evidence, and prosecute to persons in control of a DDoS/DoS. Based on my limited experience with all of this it seems the place for uRPF is not at the core (core in the context of the Internet backbone) but at the customer edge, where the problem starts. -- James H. Edwards Routing and Security At the Santa Fe Office: Internet at Cyber Mesa jamesh(a)cybermesa.com noc(a)cybermesa.com

1 0

looking for broadwing IP engineer
by matthew zeier 07 Mar '04

07 Mar '04

I'm having problems tracking down a Broadwing IP engineer who can help me with what appears to be a partial hijacking of my netblock. Please contact me off-list. -- matthew zeier - "Nothing in life is to be feared. It is only to be understood." - Marie Curie

1 0

RE: One hint - how to detect invected machines _post morten_... Re: dealing with w32/bagle
by McBurnett, Jim 07 Mar '04

07 Mar '04

Take a look at Kiwi-cattools. It has some great Cisco Automation ability.. Well, Cisco, Entersys, Redhat etc. www.kiwisyslog.com You can run commands on hundreds of devices on a schedule.. I use to pull config backups and certain reports I want directly from the devices.. Jim ->-----Original Message----- ->From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of ->Alexei Roudnev ->Sent: Friday, March 05, 2004 11:20 AM ->To: Sam Stickland; nanog(a)merit.edu ->Subject: One hint - how to detect invected machines _post ->morten_... Re: ->dealing with w32/bagle -> -> -> ->Just for information - may be useful for someone. -> ->Task - we determined, that few infected machines was ->connected to one of our ->offices few days ago. ->They run one of this viruses, which generated a lot of scans ->and created ->sugnificant traffic (but traffic was not ->big enough to rais alarm on outgoing gateway). Activity was short. -> ->Computers are not connected in the time of investigation. -> ->IDS system and Cisco logs was not active in this office (few ->tricks with ->Cisco ACL's and logs allows to detect many viruses instantly; good IDS ->systems can do it as well). -> ->Solution: ->- get all port statistics from switch (using SNMPGET and using simple ->'telnetting' script - we have 'RUN-cmd' tool allowing to run ->switch commands ->from shell file; ->- remove all ports with traffic less than some threshold; ->- calculate IN/OUT packets ratio for the rest of ports; ->- find ports, where IN/OUT ratio (IN - to switch) > 6; ->- in this ports, find ports with average packet size < 256 bytes; -> ->It shows all ports with infected notebooks (even if notebook ->was connected ->for a half of day). -> ->PS. Of course, after this few additional monitoring tools was ->installed, and ->we added _all_ switches and _all_ ports to 'snmpstat' ->monitoring system (it ->allows to see a traffic in real time, and analiz historical charts, ->including such things as packet size). -> -> -> -> ->

3 3

Re: SPAM Prevention/Blacklists
by Anne P. Mitchell, Esq. 07 Mar '04

07 Mar '04

>> Are there any other good lists out there that you folks have had good >> experience with? Any that we might want to consider taking a look at? >> Thanks, As a follow-up to my previous post, for those interested, the IADB (ISIPP Accreditation Database) is now officially up and running. We'll give a courtesy listing to anyone from NANOG who is *not* a commercial sender (and listings for individuals are always free). Querying is, of course, also always free. http://www.isipp.com/iadb.php Anne Anne P. Mitchell, Esq. President/CEO Institute for Spam and Internet Public Policy

1 0

"Information Warfare"
by John Bishop 07 Mar '04

07 Mar '04

Since it has the potential to make everyone's jobs here more interesting, I thought I'd bring it up and get everyone's opinion. This company claims to be developing a "security solution" that claims to "fight back" against attackers. I'm sure I'm not the only one here who thinks this is a tremendously bad idea. I'll let you guys tear it apart; take a look at their "white paper" and press release, both of which are dripping with enough war analogies and corporate bizspeak to make any self-respecting techie cringe. http://symbiot.com/ -- John Bishop -- moonwick(a)lasthome.net http://lasthome.net/~moonwick/ "When I'm working on a problem, I never think about beauty. I think only how to solve the problem. But when I have finished, if the solution is not beautiful, I know it is wrong." -- R. Buckminster Fuller

7 6

Re: How relable does the Internet need to be?
by John Curran 06 Mar '04

06 Mar '04

>The question in all cases is what is the level of service acceptable >to regulators and emergency services coordinators? Clearly there are >problems of both power and call routing which must be addressed. >It's unlikely NANOG is the forum for specifying standards in this >area. It is similarly unlikely the IETF is the appropriate body, >though it may be a place to figure out how to meet the requirements >specifications of some other body. Active discussion ongoing: <http://hraunfoss.fcc.gov/edocs_public/attachmatch/DOC-243851A1.pdf> /John

2 1

RE: UUNet Offer New Protection Against DDoS
by Terranson, Alif 06 Mar '04

06 Mar '04

> On Fri, 5 Mar 2004, Christopher L. Morrow wrote: > > the packets as possible. Nebulous filtering and dropping of > > miniscule amounts of traffic in the core of a large network is > > just a waste of effort and false panacea. Agreed. > uunet does operate lots of dialup RAS though correct? any > reason why urpf > is not reasonable there? Nobody I know terminates a dial connection on a *core router* ;-) //Alif Alif Terranson OpSec Engineering Mgr. Operations Security Dept. Savvis Communications Corp. (314) 628-7602 Voice (618) 558-5854 Cell (314) 628-7710 Fax >

1 0

RE: UUNet Offer New Protection Against DDoS
by Terranson, Alif 05 Mar '04

05 Mar '04

> Terranson, Alif wrote: > > >As long as we're doing "Me Too"... > > > >Savvis has had prefix:666 for around 18 months as well. > > > > > Do you know if C&W does? Or will that wait until the integration? While I am not 100% certain (and there are plenty of "new-Savvis" folks here who *do* know for sure ;-), I believe the CW network does support a BH tag. > This thread has caused me to add this as a requirement for a > new gigabit ISP circuit I am ordering, as well as uRPF in the core, Woah! Never said *anything* about that! No plans for it that I am aware of. No reason I can think of to do this either. > etc. > I've had two ISPs say "We don't do this yet, but based on the > fact you are making it a requirement, we will role those functions out > into our core." This is really not "new", and considering how easy it is to implement, I'm surprised it isn't *much* more widely implemented. > Steve > Voting with his money for better net-security.... Go Steve! Go!! Alif Terranson OpSec Engineering Mgr. Operations Security Dept. Savvis Communications Corp. (314) 628-7602 Voice (618) 558-5854 Cell (314) 628-7710 Fax

1 0

[OT: slightly]Looking for Engineers
by Owens, Loren 05 Mar '04

05 Mar '04

Currently Progress Telecom LLC is in need of 1 or 2 qualified IP engineers in the St. Pete area. The open positions are full time positions engineering PTC's IP network (EPIK Communications old network) and BGP AS 19962. The Network consists of Juniper M160/M20 routers and Foundry NetIron switches. Candidate must be highly skilled in BGP and MPLS, have an ability to communicate with customers (both internal and external), have a good working knowledge if IRR's, and have strong trouble resolution skills. If you are interested in applying, or for more information please contact ghadlock(a)progresstelecom.com. Shane

4 3

SPAM Prevention/Blacklists
by Brandon Shiers 05 Mar '04

05 Mar '04

Greetings from Wyoming -- Just a real quick question for the folks on the Nanog list: We are using the following RBL's on our MTA right now: Spamhaus (sbl-xbl) DSBL NJABL (dynablock) Are there any other good lists out there that you folks have had good experience with? Any that we might want to consider taking a look at? Thanks, Brandon

8 11