- NANOG - lists.nanog.org

Re: Arbor Networks DoS defense product
by Dan Hollis 17 May '02

17 May '02

On Thu, 16 May 2002, Dragos Ruiu wrote: > Some people are get all hyper and complain. Which is silly imho. > If you don't like it, stop your network from responding to it. Thats exactly what we plan to do with BGP blackholes and landmines. > Don't bitch and whine if your equipment is silly and leaks info. It's > not the world's problem to compensate for _your_ inferior network > architecture or shoddily designed network hardware. Then you shouldnt be whining about a BGP blackhole system. > Portscanning by no means proves "intent". Or should provoke hostile reaction. Blackholing isnt hostile its defensive. > But then again I'm of the radical opinion that if your host is compromised > it is your fault for not taking appropriate precautions on inbound filters or > gateways. The blackholing is the response to networks which cant be bothered to clean up their compromised hosts. Youre ranting against the wrong target im afraid. Please go back and read the thread from the beginning. > I can't help it if your host does funny things when I send them funny > packets.... :-) Why are you sending funny packets? -Dan -- [-] Omae no subete no kichi wa ore no mono da. [-]

4 4

Re: Arbor Networks DoS defense product
by Dan Hollis 17 May '02

17 May '02

On Thu, 16 May 2002, Dragos Ruiu wrote: > But how do you plan to arbitrate disputes about what merits blackholing > and not on behalf of others? And what guidelines do you use to decide > on how to initiate black holing? (not critical here, just curious?) Thats the beauty here, one can provide multiple databases (eg rogue networks which refuse to shutdown their portscanners, proven spamhausen in bed with spammers, proven active attackers, etc.) and service providers can opt in as they like, and apply whatever policy to those routes that they like. > > Why are you sending funny packets? > Any number of reasons... like I have a compromised host > and I'm watching what it does before shutting it down... So you have a compromised host attacking sites, you know about it, and you're allowing it to continue. Whoops it just defaced a federal government site, and now it has your ip address all over it... I don't think i'd want to open myself to that kind of liability... When we catch compromised hosts, we cut their balls off instantly. > Or maybe the packets don't look funny to me :-). > Or perhaps the packets were so funny I thought I'd share. ;-) > Humor is often in the eye of the beholder :-). Military networks arent well known for their sense of humor, and neither are federal interest sites... -Dan -- [-] Omae no subete no kichi wa ore no mono da. [-]

2 1

Re: Arbor Networks DoS defense product
by Dan Hollis 17 May '02

17 May '02

On Thu, 16 May 2002, Dragos Ruiu wrote: > But that said. Blackholing as a response for portscanning > is stupid. > If you are a small communications end-point it's dumb. > Just run portsentry for a while with auto-firewall rules > if you need convincing. > If you are a communications service provider providing > packet transit for others (even employees), it's hostile. What if you are portscanned repeatedly by a network and that network refuses to shut down their scanners even after being asked many times (eg, rogue chinese and korean networks) I think that you should leave network policy up to the service provider to decide. -Dan -- [-] Omae no subete no kichi wa ore no mono da. [-]

2 1

Re: Arbor Networks DoS defense product
by Dan Hollis 16 May '02

16 May '02

On Wed, 15 May 2002, Lyndon Nerenberg wrote: > I usually avoid blackhole subscription lists like this. They let > the attacker take out your legitimate peers by spoofing the source. If they can take out your legitimate peers by spoofing end to end TCP connections, then you have got some really enormous problems that need to be addressed. I don't think spoofing will be a problem for the landmines. Most attacks (99%?) are tcp. -Dan -- [-] Omae no subete no kichi wa ore no mono da. [-]

9 20

rbl for apnic ranges
by Sabri Berisha 16 May '02

16 May '02

Hi all, Recently there have been discussions on blackholing 211.* on mailboxes. Because I was sick and tired of the massive amount of spam (and non-responsive network admins) I decided to blackhole them too. Because 211.* also has a piece of .au in it, simply listing 211.0.0.0/8 was not an option for me. I decided to put up a list, based on ftp://ftp.apnic.net/pub/apnic/dbase/data/country-ipv4.lst which lists the allocations per country in the form of <countrycode>.rbl.cluecentral.net ie cn.rbl.cluecentral.net, and make it pubically available. You can check the list at http://www.cluecentral.net/rbl which is in the tinydns-data format and of course use it for black/whitelisting purposes. It is not yet updated automagically, I will write something for that soon. -- Sabri Berisha "I route, therefore you are" ~ my own opinions etc ~

2 2

Re: RADB & RRs
by rs＠seastrom.com 16 May '02

16 May '02

Ralph Doncaster <ralph(a)istop.com> writes: > I've been registering my routes in ARIN's RR, only to find that nobody > uses it. ;-( > Do any of the RRs mirrored by the RADB offer free maintainer-IDs? www.altdb.net / db-admin(a)altdb.net / auto-dbm(a)altdb.net the usual drill. ---Rob

1 0

RADB & RRs
by Ralph Doncaster 16 May '02

16 May '02

I've been registering my routes in ARIN's RR, only to find that nobody uses it. ;-( Do any of the RRs mirrored by the RADB offer free maintainer-IDs? Ralph Doncaster principal, IStop.com div. of Doncaster Consulting Inc.

2 1

CPE/OC12 Question
by Sonya Blake 16 May '02

16 May '02

What kind of OC12 CPE devices (routers) are people using out there? Initially for Internet connectivity, but probably would need to do advance features, i.e. BGP, etc. Thanks in advance! Sonya Blake Engineer BellSouth.net sblake(a)arch.bellsouth.net

3 2

Arbor Networks DoS defense product
by Sean Donelan 16 May '02

16 May '02

Telus has gone first, and announced it is using Arbor's products across its backbone network. http://www.eweek.com/article/0,3658,s=720&a=26867,00.asp People have been trying the products for a while. Does Arbor Networks really have an answer to DoS, or does it still need a little longer in the oven.

8 14

Re: Arbor Networks DoS defense product
by Clayton Fiske 16 May '02

16 May '02

On Wed, May 15, 2002 at 06:04:40PM -0700, PJ wrote: > Sorry for not including nanog in the reply. What about MAPS? They > routinely scan netblocks without consent. Does this tool > differenciate between local and non-local scanning? Scanning is The tool in question may not even exist yet. There is no preset definition of how it has to work. Perhaps it can be evolved enough to where it only triggers when an exploit is attempted, rather than just on a TCP connection. > still not a crime and it will still do nothing to deter anyone with > hostile intentions. This is just a bandaid to avoid taking proper > security precautions. I can take all the proper security precautions and it doesn't stop third party network A from being exploited and later used to attack me. The point of this is that it will help identify a specific host which is scanning many blocks belonging to many different networks. If they hit several landmines in my network, I might be concerned. If they hit landmines in my network and 6 others to which I have no affiliation, the net as a whole might want to know about it. I don't think anyone said this was intended to take the place of security on their own networks. But I don't see how that aspect makes this a bad tool on its own either way. -c

3 3