- NANOG - lists.nanog.org

ddos attack in progress... help needed
by Rodney Joffe 04 May '02

04 May '02

Hello folks, We're undergoing a ddos attack on one of our machines. Its quite manageable so far - 28 source IPs, many of them cable modems. But its the first we've ever suffered, and before we get too deep in, I'd appreciate pointers to the appropriate law enforcement parties to contact so we can get to the root eventually. Offline is fine. If there's any value, I'm happy to provide the list. Sustained rate from each machine is around 2mbits per 5 min snapshot. -- Rodney Joffe CenterGate Research Group, LLC. http://www.centergate.com "Technology so advanced, even we don't understand it!"(SM)

1 0

Re: /31 mask address
by rs＠seastrom.com 03 May '02

03 May '02

Simon Lockhart <simonl(a)rd.bbc.co.uk> writes: > On Fri May 03, 2002 at 10:30:05PM +0200, Andre Chapuis wrote: > > What IOS are you using /31s with ? > > Typically 12.0(x)S on GSR and VXR (where x is 10ish upwards) Not all 12.1(x)y does this properly, even if it was compiled over a year after that RFC went through and caused changes to 12.0S. Caveat utilitor. ---Rob

1 0

OT: Mobile Directories WAS: Large ISPs doing NAT?
by Rowland, Alan D 03 May '02

03 May '02

You would think the phone companies who already have most of the necessary resources, i.e. the yellow pages/directory listings, would be all over this idea as a way to sell thier device/generate even more listing revenue. Killer app: Cell Phone/PDA/GPSw Mapping,routing in a Palm form factor. Just my 2¢. The delete key is your friend. -----Original Message----- From: Scott Francis [mailto:darkuncle@darkuncle.net] Sent: Friday, May 03, 2002 10:43 AM To: Valdis.Kletnieks(a)vt.edu Cc: nanog(a)merit.edu Subject: Re: Large ISPs doing NAT? On Fri, May 03, 2002 at 08:29:32AM -0400, Valdis.Kletnieks(a)vt.edu said: > On Fri, 03 May 2002 00:12:34 PDT, Scott Francis said: > > > Your phone can surf porn? Maybe the technology revolution has finally arriv= > > ed > > after all ... > > No, it's still in the "dancing bear" stage. There's the question of whether > it's worth doing on that class display device.... > > On the other hand, if somebody's looking for a *business* opportunity, I > could see a *big* market for "Where do I find?" databases for GPS-capable > phones - I think somebody already did a "public restrooms in Manhattan", > and I know I've been in strange cities, known there was a specific restraunt > or store somewhere within 10 blocks, and been willing to pay for a reliable > hint for the parking garage nearest... that is an excellent idea. I know one thing I would LOVE to have is a search engine that can answer my question, "Where can I find a coffee house {optionally: with 802.11b} open after midnight during the week in Los Angeles {optionally: the Valley}?" No good answers so far ... at least, none that involve driving less than 30 minutes. :) -- Scott Francis darkuncle@ [home:] d a r k u n c l e . n e t Systems/Network Manager sfrancis@ [work:] t o n o s . c o m GPG public key 0xCB33CCA7 illum oportet crescere me autem minui

2 1

RE: Effective ways to deal with DDoS attacks?
by Gironda, Andre 03 May '02

03 May '02

On 5/3/02 12:05 PM, "Stephen Griffin" <stephen.griffin(a)rcn.com> wrote: > > Most Cisco boxes have 3 related modes of uRPF: 1) pure RPF, if > forwarding path back to source doesn't go via interface packet > received from, then dump. I believe, but am not positive, that it > will handle equal-cost-multipath ok in situations where that exists. > 2) acl exceptions, if source matches the acl, allow the packet 3) > not-so-pure RPF, if there is _any_ forwarding path back to the > source via _any_ interface, then accept. Speaking of this, has anyone seen Barry Greene's and Philip Smith's new book, "Cisco ISP Essentials"? It covers the uRPF strict mode as well using uRPF with multihoming examples, etc. I wish we could hear from them about it on this list. Actually, I'd rather hear it from people using it. Are there any configs out there that show uRPF with multihoming examples especially in ISP POP or IDC's? Let's say you have multiple ECMP on the back side and multiple transit providers and peers taking a mix of full and peering routes at the edge -- what would that look like? > for single-homed customers, simple uRPF for multihomed customers, > acl exceptions based upon their registered IRR-policy, since the > customer should already be registering in the IRR you have a list > of all networks reachable via the customer, regardless of the actual > real-time announcements or policy applications (prepending, localpref > tweaks, etc) for peers that are clued-in, again acl exceptions > based upon the peers registered policy for non-clued peers, accept > based upon any available forwarding path [hopefully, by the 100th > time you beat on the peer about spoofed crud coming from them, > they'll get religion and register, since you'll have less overall > spoofing to track down, you can devote it to slapping them around > more] ACL exceptions based on IRR policy? So you are using RtConfig or similar scripts to build your uRPF rules? Can you clarify this a bit more, or give some examples? On-list or off-list is fine with me. Thanks -dre

1 0

Co-locatation at MAE-West
by Andrew Staples 03 May '02

03 May '02

We have an available cabinet, with private 100mb FDDI connection, available for rent/sale at 55 Market Street, 11th floor. Please contact me off-list if interested. Andrew Staples "As the evening sky faded from a salmon color to a sort of flint gray, I thought back to the salmon I caught that morning, and how gray he was, and how I named him Flint."

1 0

RE: DDOS attacks and Large ISPs doing NAT?
by Mansey, Jon 03 May '02

03 May '02

That would come under the heading of a virus or trojan I believe. And sure there is no reason a NAT'd cell phone couldnt participate in this type of attack. The DDOS discussion is specifically referring to a "live" syn or syn/ack attack from hosts that respond to connection requests. A NAT'd cell phone wont, cant ever, respond to an unsolicited connection request. jm > -----Original Message----- > From: Gary E. Miller [mailto:gem@rellim.com] > Sent: Thursday, May 02, 2002 11:00 AM > To: Mansey, Jon > Cc: nanog(a)merit.edu > Subject: RE: DDOS attacks and Large ISPs doing NAT? > > > Yo Jon! > > On Thu, 2 May 2002, Mansey, Jon wrote: > > > To merge these 2 great threads, it is the case is it not > that NAT is a > > great way to avoid DDOS problems. I don't even want to imagine what > > the billing/credit issues would be like if your always-on > phone with a > > real IP is used as a zombie in a DDOS. "Hey I didn't use all that > > traffic last month....etc etc" > > Who says a NATed host can not be a zombie? Get the NATed > host to read an email virus. The virus then coonects to an > IRC channel that tells the zombie when to spew. > > Each phone would not spew much, but imagine you got 100M > phones to do your DDoS for you... > > RGDS > GARY > -------------------------------------------------------------- > ------------- > Gary E. Miller Rellim 20340 Empire Blvd, Suite E-3, Bend, OR 97701 > gem(a)rellim.com Tel:+1(541)382-8588 Fax: +1(541)382-8676 > >

6 5

RE: Large ISPs doing NAT?
by Daniska Tomas 03 May '02

03 May '02

do you think fufme (http://www.fu-fme.com/) would work well over nat? :)))) -- Tomas Daniska systems engineer Tronet Computer Networks Plynarenska 5, 829 75 Bratislava, Slovakia tel: +421 2 58224111, fax: +421 2 58224199 A transistor protected by a fast-acting fuse will protect the fuse by blowing first. > -----Original Message----- > From: Scott Francis [mailto:darkuncle@darkuncle.net] > Sent: 3. mája 2002 9:13 > To: Dan Hollis > Cc: nanog(a)merit.edu > Subject: Re: Large ISPs doing NAT? > > > On Thu, May 02, 2002 at 04:56:40PM -0700, goemon(a)anime.net > said: [snip] > > > I'm not buying a phone I can't run ssh from. End of story. My > > > current phone > > > does all that and more. Why step back into the dark ages > of analog-type > > > services? > > > > The average customer doesn't even know what telnet is, let > alone ssh. > > All they care about is browsing pr0n. > > Your phone can surf porn? Maybe the technology revolution has > finally arrived after all ... > > > -Dan > > -- > > [-] Omae no subete no kichi wa ore no mono da. [-] > > -- > Scott Francis darkuncle@ [home:] d a r k u > n c l e . n e t > Systems/Network Manager sfrancis@ [work:] t > o n o s . c o m > GPG public key 0xCB33CCA7 illum oportet crescere > me autem minui >

1 0

RE: Large ISPs doing NAT?
by Mansey, Jon 03 May '02

03 May '02

Why do you need a public IP to do ssh? jm > -----Original Message----- > From: Simon Higgs [mailto:simon@higgs.com] > Sent: Thursday, May 02, 2002 4:44 PM > To: Scott Francis > Cc: Peter Bierman; nanog(a)merit.edu > Subject: Re: Large ISPs doing NAT? > > > > At 01:20 AM 5/2/2002 -0700, Scott Francis wrote: > > >The average customer buying a "web-enabled" phone doesn't need a > >publicly-routeable IP. I challenge anybody to demonstrate why a cell > >phone needs a public IP. It's a PHONE, not a server. > > I'm not buying a phone I can't run ssh from. End of story. My > current phone > does all that and more. Why step back into the dark ages of > analog-type > services? > > > > Best Regards, > > Simon > > -- > ### >

2 1

RE: Large ISPs doing NAT?
by Daniska Tomas 02 May '02

02 May '02

> -----Original Message----- > From: Tony Rall [mailto:trall@almaden.ibm.com] > Sent: 30. apríla 2002 19:59 > To: nanog(a)merit.edu > Subject: Re: Large ISPs doing NAT? > > > > > On Monday, 2002-04-29 at 08:43 MST, Beckmeyer > <beck(a)pacbell.net> wrote: > > Is anybody here doing NAT for their customers? > > I hope not. > > If you're NATing your customers you're no longer an ISP. > You're a sort-of-tcp-service-provider (maybe a little udp > too). NAT (PAT even more > so) breaks so many things that it would be unconscionable to > advertise as an ISP. Even some tcp apps fail under NAT. The > NAT box may include a number of "fix-ups" but such will never > be equivalent to giving the customer a public address. well.. yes and no. depends on definition and how you set the services. i don't know how you treat this in u.s. but in europe gprs is mostly considered being a value-added service to gsm instead of a real internet connectivity replacement. if you think of gprs a bit it will never have enough capabilities to serve as a full-time inet service. it's a great solution for accessing your data remotely but it's very limited in means of capacity and then you have those 'pdp-contexts' or how they call it. it's just another acronym for a vpn... if a corporate user requires full ip connectivity then why not give him a vpn uplink directly to their hq and the users can safely use private addresses according to corporate policy. in this way gprs is very similar to mpls. i have worked on gprs-mpls vpn integration and it works just fine. > An Internet Service Provider gives the customer a full > connection to the Internet. All IP protocols should work. you also may give the [common] user an opportunity to have 'limited' service set (so you can use private addresses + nat/pat) for lower price or pay a bit more for 'full' service. i think the 'limited' in real life can safely cover requirements of 95% of the customers. do you think they will download mp3's and avi's via gprs? how? :)) from my point of view if you cover http, e-mail and various similar services you will provide most user with more than they ever would expect, wouldn't you? > I'm in favor of using NAT only where there is a good argument > for it and the customers are given the straight story about > what they're buying and what it won't be able to do. Don't > call yourself an ISP. ... > Tony Rall > > deejay -- Tomas Daniska systems engineer Tronet Computer Networks Plynarenska 5, 829 75 Bratislava, Slovakia tel: +421 2 58224111, fax: +421 2 58224199 A transistor protected by a fast-acting fuse will protect the fuse by blowing first.

6 6

RE: DDOS attacks and Large ISPs doing NAT?
by Mansey, Jon 02 May '02

02 May '02

Unless Im mistaken (entirely possible), an IP enabled phone has 2 distinct and separate "stacks", the IP stack and the "phone" stack. As I said, in a NAT'd scenario the IP stack will never see an unsolicited request and hence not respond to it. The phone side of course will ring when called. Duh. GPRS <> VoIP (yet) Jm > -----Original Message----- > From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] > Sent: Thursday, May 02, 2002 11:26 AM > To: Mansey, Jon > Cc: nanog(a)merit.edu > Subject: Re: DDOS attacks and Large ISPs doing NAT? > > > On Thu, 02 May 2002 11:06:33 PDT, "Mansey, Jon" said: > > > The DDOS discussion is specifically referring to a "live" syn or > > syn/ack attack from hosts that respond to connection > requests. A NAT'd > > cell phone wont, cant ever, respond to an unsolicited connection > > request. > > *RING*!! *RING*!! Oh, I'm sorry, that was the clue phone > ringing - it couldn't be your phone, since it wouldn't answer > an unsolicited connection request.... > > You were saying? > > (To fill in the blanks - get a trojan loaded into the > cellphone/PDA combo, and then send it a page telling it > who/what to attack). > > -- > Valdis Kletnieks > Computer Systems Senior Engineer > Virginia Tech > >

2 1