- NANOG - lists.nanog.org

Re: Impending (mydoom) DOS attack
by Mikael Abrahamsson 31 Jan '04

31 Jan '04

;; ANSWER SECTION: www.sco.com. 60 IN A 216.250.128.12 As far as I can see, someone has taken precation and lowered the TTL on www.sco.com to 60 seconds so any DOS attack towards www.sco.com can be hindered by them changing their DNS information. This wont stop any DoS in progress, or it might, I dont know if the worm will do repeated DNS resolves or only do it once and keep sending data to that IP until reboot. -- Mikael Abrahamsson email: swmike(a)swm.pp.se

1 0

RE: CIsco 7206VXR w/NPE-G1 Question
by Michel Py 31 Jan '04

31 Jan '04

>> Michel Py wrote: >> That would be where the NPE-G1 would be better than an RSP8; > jlewis(a)lewis.org [mailto:jlewis@lewis.org] > Isn't it somewhat wrong to compare the NPE-G1 to any RSP > since most of the packets, most of the time, are handled > by the processors on the VIPs and never bother the RSP In general, yes indeed. However, you have to place it in the same context as I did, quoted below: >>> alex(a)pilosoft.com wrote: >>> flow-based means router's performance is based on number >>> of flows established, and first packet of each 'flow' is >>> processed differently [slower] from all other within the >>> flow, and things like nachi will kill it. >> Michel Py wrote: >> That would be where the NPE-G1 would be better than an RSP8; In this very case, where a large part of the traffic is a shitload of new flows, dCEF is irrelevant and the NPE-G1 has indeed an advantage over any RSP because it has a 700Mhz processor and the RSP16 is 400Mhz and the RSP8 250Mhz. Of course, this assumes that you are actually doing flow-based routing, which I don't see being that common among ISPs. > If you take a 7500 as far as you can (RSP16, VIP6-80s), > then how does it compare to a 7206VXR/NPE-G1? Ah that's an interesting academic question, and although I will take a shot at it, 1. The question is vague. 2. #include <disclaimer.h> 3. Can't really be answered without testing it. 4. Even when actually testing it with real traffic, your mileage may vary as the traffic patterns being used can indeed greatly the results. That being said, here's my take at it: We have on one side 7206VXR with NPE-G1 and 6x PA-POS-OC3 (or similar) And on the other: 7507MX with RSP16, 3x VIP6-80, 6x PA-POS-OC3 (or similar), 2x GEIP [ this setup is flawed in the first place, as the GEIP is based on the VIP2-50; the correct setup should be: 7507MX with RSP16, 4x VIP6-80, 6x PA-POS-OC3 (or similar), 2x PA-GE. Unfortunately, the VIP6-80 does not support the PA-GE :-( ] On each router: two of the GigE are connected to tier-1 transit, and the DS3s to either big customer or remote pop. I call this a draw. On one hand, if the traffic between the two GigE is not well balanced, the 7507 has a problem with the throughput of the GEIP. On the other hand, the NPE-G1 has a 700 Mhz CPU, but has to deal with all of the following: - two GigE - six PAs - BGP and flows where the 7507 has: - 2x 200Mhz VIP2-50 for the GigE - 3x 400Mhz VIP6-80 for the PAs - 1x 400Mhz RSP16 for BGP and flows My take is: in some situations, the 7507 will be better and in some others the 7206 will be better. The weak point of the 7507 setup is the GEIP, the weak point of the 7206 is that is has only one CPU. Now, _if_ in the 7507 you could replace 2x GEIP with 1x VIP6-80 + 2x PA-GE, I would give a clear advantage to the 7507 setup. In any case, a 7600 will beat the crap out of any 7200. Michel.

1 0

RE: CIsco 7206VXR w/NPE-G1 Question
by Lincoln Dale 31 Jan '04

31 Jan '04

At 03:51 AM 31/01/2004, alex(a)pilosoft.com wrote: >Keep in mind, 72xx is still flow-based 72xx NPE-xxx is NOT flow-based -- unless you explicitly configure it to be. (i.e. disable CEF, enable flow switching). CEF is prefix-based switching - where all possible prefixes (routes/RIB) are already programmed into the forwarding table (FIB). anything not programmed into the FIB doesn't exist in the RIB, ergo there is no route therefore is dropped. i believe the words you're looking for is "NPE-xxx is SOFTWARE-based forwarding". this part is true enough - but a NPE-G1 has far more cpu cycles to switch/route than previous NPE-400/300/225/200/150 et al. software-based forwarding isn't so bad -- it means that platforms such as the 7200 typically have lots of features. this is different to the NSE-xxx which is part software-based forwarding and part PXE-based forwarding. the exact features accelerated by PXE varies depending what code release is used. your said: flow-based means router's performance is based on number of flows established, and first packet of each 'flow' is processed differently [slower] from all other within the flow, and things like nachi will kill it. no, this isn't true. (at ieast, it isn't unless you explicitly configure it that way). for a service-provider, you wouldn't want to use it in any forwarding mode other than CEF, unless there is very good reason to. to provide you with a summary of forwarding paths and their uses: CEF switching: prefix-based pre-populated FIB dCEF switching: distributed version of CEF - typically each linecard has its own FIB and therefore switching decisions are distributed per linecard Fast switching: destination-based demand switching. a 'route cache' exists of destinations to be forwarded to. the first packet to a destination is "process switched", which installs the route-cache entry. subsequent packets are switched in the "fast" (aka interrupt) path. Process switching: all packets received (at interrupt level) are queued for process-level to route. then there's Flow Switching, whose definition has changed over time: Flow Switching: a variation on Fast-switching, but where a flow-entry is created based on a 5-tuple (srcip/dstip/proto/srcport/dstport/TOS). first packet is process- switched, which installs the flow entry, subsequent packets are switched at interrupt level now, Flow Switching has changed over time. you can enable both CEF+Flow and Flow simply becomes an accounting method that is useful for netflow - but you continue to have packets switched using CEF. as to the exact level of forwarding used for each packet, that varies -- if you enable a feature that isn't in the CEF path, then the packet is switched using the next-lower-layer that supports the 'feature'. for service-provider type environments, there aren't too many features necessary for /most/ deployments that aren't already covered in CEF on 7200, so you're mostly ok there. this is just a brief description of how a 72xx works - and there are many permutations and differences between different platforms and boxes. if you want the full rundown, Phil Harris normally gives a "Router Architecture" presentation at every Networkers i've ever attended, and it covers all this and more. cheers, lincoln. disclosure: my other email address is ltd(a)cisco.com, but i work in Fibre Channel not IP these days.

1 0

RE: CIsco 7206VXR w/NPE-G1 Question
by Jack.W.Parks＠alltel.com 31 Jan '04

31 Jan '04

Does anyone have definitive speed results on the 3 "built-in" Gig ports on the NPE-G1? I know that they aren't attached to the PCI Buses, and don't consume bandwidth points, but all of that is mute. Can all three of the ports do line rate Gig? The Gig PA is limited to 400Mbps. I have seen posts that allude to the fact the max throughput on the 3 Gigs are 800Mbps. It's is like a big mystery that cannot be solved. With a "J" M7i, I know I'm going to get line rate per port up to the total forwarding capacity of the FPC. We are trying to create a comparison matrix and any info you have would be great. Jack -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Simon Hamilton-Wilkes Sent: Friday, January 30, 2004 9:36 AM To: nanog(a)merit.edu Subject: RE: CIsco 7206VXR w/NPE-G1 Question One more interesting feature - if you need a 4th GigE port, you can add the GigE I/O card which still uses none of the bus bandwidth points. The buses are fine for OC3 and below... Simon ****************************************************************************************** The information contained in this message, including attachments, may contain privileged or confidential information that is intended to be delivered only to the person identified above. If you are not the intended recipient, or the person responsible for delivering this message to the intended recipient, ALLTEL requests that you immediately notify the sender and asks that you do not read the message or its attachments, and that you delete them without copying or sending them to anyone else.

4 3

Fw: Impending (mydoom) DOS attack
by james 31 Jan '04

31 Jan '04

OK, enough ppl are asking so I will post this public, instead of just sending this to those who asked. Since I do not understand assembly or FORTH I cannot verify what this guy on the full disclosure list said & so far no one on the list is commenting on this persons post. So I make NO claims about this. James Edwards Routing and Security Administrator jamesh(a)cybermesa.com At the Santa Fe Office: Internet at Cyber Mesa Store hours: 9-6 Monday through Friday 505-988-9200 SIP:1(747)669-1965 This is from the full disclosure list: : : : : Here's why people have been getting inconsistent results when setting : : the system date forward and looking for the DoS attack to start: : : : : Begining of DDoS date check subroutine: : : : : 4A3DB0 PUSH EBP ; callCreateSCOddos : : 4A3DB1 MOV EBP,ESP : : 4A3DB3 SUB ESP,10 : : : : : : Get the current system time as a FILETIME struct: : : : : 4A3DB6 LEA EAX,DWORD PTR SS:[EBP-8] : : 4A3DB9 PUSH EAX : : 4A3DBA CALL DWORD PTR DS:[<&KERNEL32.GetSystemTimeAsFileTime>] : : : : : : Convert the stored DoS start date from SystemTime to FileTime: : : : : 4A3DC0 LEA EAX,DWORD PTR SS:[EBP-10] : : 4A3DC3 PUSH EAX : : 4A3DC4 MOV EAX,DWORD PTR SS:[EBP+8] : : 4A3DC7 ADD EAX,214 : : 4A3DCC PUSH EAX ; Feb 1, 2004 : : 4A3DCD CALL DWORD PTR DS:[<&KERNEL32.SystemTimeToFileTime>] : : : : : : Compare high-order dword dwHighDateTime: : : : : 4A3DD3 MOV EAX,DWORD PTR SS:[EBP-4] : : 4A3DD6 CMP EAX,DWORD PTR SS:[EBP-C] : : 4A3DD9 JB SHORT <message.skipDoS> : : : : : : Compare low-order dword wLowDateTime: : : : : 4A3DDB MOV EAX,DWORD PTR SS:[EBP-8] : : 4A3DDE CMP EAX,DWORD PTR SS:[EBP-10] : : 4A3DE1 JB SHORT <message.skipDoS> : : : : : : Start the DoS: : : : : 4A3DE3 CALL <message.createSCOddos> ; DoS_Loop : : 4A3DE8 PUSH 400 : : 4A3DED CALL DWORD PTR DS:[<&KERNEL32.Sleep>] : : 4A3DF3 JMP SHORT <message.DoS_Loop> : : 4A3DF5 LEAVE ; skipDos : : 4A3DF6 RETN : : : : >From MSDN: : : The FILETIME structure is a 64-bit value representing the number of : : 100-nanosecond intervals since January 1, 1601 (UTC). : : : : typedef struct _FILETIME { : : DWORD dwLowDateTime; : : DWORD dwHighDateTime; : : } FILETIME, : : *PFILETIME; : : : : The stored starttime as filetime is: : : 0xbe9ecb00 : : 0x01c3e8dd : : : : Because the dwords are compared independently, the DoS will not start : : anytime the current dwLowDateTime is less than 0xbe9ecb00, no matter : : what the dwHighDateTime is. Obviously, this is close to three-quarters : : of the time. : : : : -Joe : : : : -- : : Joe Stewart, GCIH : : Senior Security Researcher : : LURHQ http://www.lurhq.com/ : : : : _______________________________________________ : : Full-Disclosure - We believe in it. : : Charter: http://lists.netsys.com/full-disclosure-charter.html : : ----- Original Message ----- : : From: "bcm" <bcm(a)inkline.com> : : To: <nanog(a)merit.edu> : : Sent: Friday, January 30, 2004 2:18 PM : : Subject: Impending (mydoom) DOS attack : :

1 0

RE: CIsco 7206VXR w/NPE-G1 Question
by Michel Py 31 Jan '04

31 Jan '04

> alex(a)pilosoft.com wrote: > flow-based means router's performance is based on number > of flows established, and first packet of each 'flow' is > processed differently [slower] from all other within the > flow, and things like nachi will kill it. That would be where the NPE-G1 would be better than an RSP8; however what I don't like is when you rely on the internal switching of the NPE-G1 you end up creating a 1-slot router with the PAs then becoming substandard additions. I understand that money is an issue, but the original question was about backbone use and I would rather go with a 7603 or a 7606 instead of a 7206VXR. Michel.

3 2

here are some postfix patterns i found useful today
by Paul Vixie 31 Jan '04

31 Jan '04

what you do is, install postfix 2.0 or later, set header_checks to some filename (in your main.cf), and in that file, you put the following: /^Subject: Anti-Virus Notification/ REJECT av01 /^Subject: BANNED FILENAME/ REJECT av02 /^Subject: File blocked - ScanMail for Lotus/ REJECT av03 /^Subject: InterScan NT Alert/ REJECT av04 /^Subject: Message deleted/ REJECT av05 /^Subject: NAV detected a virus)/ REJECT av06 /^Subject: Norton AntiVirus detected/ REJECT av07 /^Subject: RAV AntiVirus scan/ REJECT av08 /^Subject: Symantec AntiVirus/ REJECT av09 /^Subject: VIRUS (.*) IN MAIL FROM YOU/ REJECT av10 /^Subject: VIRUS IN YOUR MAIL/ REJECT av11 /^Subject: Virus Detected by Network Assoc/ REJECT av12 /^Subject: Virus Notification:/ REJECT av13 /^Subject: Virus found in a message you sent/ REJECT av14 /^Subject: Virus found in sent message/ REJECT av15 i guess this isn't something you can cut&paste into an IOS box, but it's sure saving my ass here today, so i thought i'd share. i'm getting MUCH MORE E-MAIL TRAFFIC today from antivirus adware servers than from worms. see also <http://www.attrition.org/security/rant/av-spammers.html>.

1 0

AOL web troubles.. New AOL speedup seems to be a slowdown
by Nicole 30 Jan '04

30 Jan '04

Any AOL people around? In the past few days our AOL users have been reporting serious problems accessing images to their accounts on our picturesharing site Picturetrail.com The images show up as broken images (red x) in their browsers about 30% of the time. They also report almost total failure when trying to upload images to their accounts. We however are seeing a slow AOL low data network that we feel is causing the problems. We have not received any such complaints from non-aol users. We have replicated the problems using our AOL test accounts. No such problems occur when using a non-AOL internet connection. Below is the traceroute from an AOL users IP to the Abovenet datacenter in San Jose California where our servers are located. I just heard that they are now offering some new speedup technology.. Hence probobly more web caching. Anyone else having these types of issues? And 20 hops to get to a proxy.. at that speed? traceroute to 64.12.96.107 (64.12.96.107), 30 hops max, 40 byte packets 1 inside.fw1.sjc2.mfnx.net (208.184.213.129) 0.359 ms 0.276 ms 0.427 ms 2 99.ge-5-1-1.er10b.sjc2.us.above.net (64.124.216.11) 0.529 ms 0.564 ms 0.538 ms 3 so-1-0-0.mpr3.sjc2.us.above.net (64.125.30.97) 0.547 ms 0.581 ms 0.578 ms 4 so-0-0-0.pr1.sjc2.us.above.net (64.125.30.30) 0.594 ms 0.708 ms 0.572 ms 5 sl-gw19-sj-3-0.sprintlink.net (144.228.44.145) 1.146 ms 1.185 ms 1.114 ms 6 sl-bb23-sj-4-0.sprintlink.net (144.232.0.249) 1.509 ms 1.307 ms 1.227 ms 7 sl-bb24-sj-14-0.sprintlink.net (144.232.3.222) 17.685 ms 16.042 ms 5.352 ms 8 sl-bb20-ana-6-0.sprintlink.net (144.232.20.100) 11.036 ms 11.128 ms 11.208 ms 9 sl-bb24-ana-13-0.sprintlink.net (144.232.1.138) 11.110 ms 12.263 ms 11.081 ms 10 sl-st21-la-14-0.sprintlink.net (144.232.20.126) 14.179 ms 12.567 ms 14.047 ms 11 pop1-las-P5-2.atdn.net (66.185.150.253) 10.689 ms 10.538 ms 10.596 ms 12 bb2-las-P0-0.atdn.net (66.185.137.130) 10.704 ms 10.541 ms 10.737 ms 13 bb2-sjg-P7-0.atdn.net (66.185.152.23) 10.442 ms 10.565 ms 10.469 ms 14 bb1-sjg-P2-0.atdn.net (66.185.153.26) 54.948 ms 125.951 ms 227.168 ms 15 bb1-ash-P14-0.atdn.net (66.185.153.58) 286.153 ms 83.629 ms 83.592 ms 16 bb1-rtc-P4-0.atdn.net (66.185.152.157) 216.817 ms 132.213 ms 201.491 ms 17 pop1-rtc-P14-0.atdn.net (66.185.140.97) 83.479 ms 83.383 ms 83.268 ms 18 dar1-mtc-S0-0-0.atdn.net (66.185.143.114) 83.535 ms 83.708 ms 83.631 ms 19 172.21.44.66 (172.21.44.66) 83.718 ms 83.729 ms 83.749 ms 20 cache-mtc-af06.proxy.aol.com (64.12.96.107) 83.886 ms 83.982 ms 84.020 ms -------------------------------------------------------------------------------- Thanks for any assistance!! Nicole

8 11

RE: CIsco 7206VXR w/NPE-G1 Question
by Matt Ryan 30 Jan '04

30 Jan '04

The Juniper software is great, very stable under testing (for 2 weeks in the lab). But as with all routers there are pro's and con's and it also has some issues. What is unfortunate is that the poster runs (by their own admission) neither Cisco or Juniper in their network and yet make unfounded claims about the performance of the Juniper under any conditions. Clearly this will never be true as the cost of developing such a box would be prohibitive and the delivery timescales far too long. I'm as happy as the next person to give Cisco a bashing but I also like to see some balance when unrealistic claims are made. Matt. -----Original Message----- From: Alex Yuriev [mailto:alex@yuriev.com] Sent: 30 January 2004 14:45 To: Matt Ryan Cc: nanog(a)merit.edu Subject: RE: CIsco 7206VXR w/NPE-G1 Question > It's not the Cisco bashing I was referring to, but the all singing all > dancing Juniper performance claim. That would not have anything to do with Juniper sucking the least? Alex ------------------------------------------------------------------------------ Live Life in Broadband www.telewest.co.uk The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Statements and opinions expressed in this e-mail may not represent those of the company. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender immediately and delete the material from any computer. ==============================================================================

1 0

RE: CIsco 7206VXR w/NPE-G1 Question
by Matt Ryan 30 Jan '04

30 Jan '04

It's not the Cisco bashing I was referring to, but the all singing all dancing Juniper performance claim. Matt. -----Original Message----- From: Petri Helenius [mailto:pete@he.iki.fi] Sent: 30 January 2004 17:43 To: Matt Ryan Cc: nanog(a)merit.edu Subject: Re: CIsco 7206VXR w/NPE-G1 Question Matt Ryan wrote: >Do you get commission from Juniper? > > > Where do I get my comission then? I´ve described inferior product as such many times and so far I haven´t seen deposits from vendors in my bank account? !!OT warning!! Pete ------------------------------------------------------------------------------ Live Life in Broadband www.telewest.co.uk The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Statements and opinions expressed in this e-mail may not represent those of the company. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender immediately and delete the material from any computer. ==============================================================================

3 2