- NANOG - lists.nanog.org

RE: Effective ways to deal with DDoS attacks?
by LeBlanc, Jason 02 May '02

02 May '02

I'm with Richard. Often the attacker is stupid enough to have something in the header that doesn't change that you can filter on. Looking at the payload would be a tough job with the size of some of these attacks. -----Original Message----- From: Richard A Steenbergen [mailto:ras@e-gerbil.net] Sent: Thursday, May 02, 2002 10:19 AM To: Hank Nussbacher Cc: LeBlanc, Jason; 'Pete Kruckenberg'; nanog(a)merit.edu Subject: Re: Effective ways to deal with DDoS attacks? On Thu, May 02, 2002 at 08:07:31PM +0200, Hank Nussbacher wrote: > > At 12:23 PM 02-05-02 -0400, Richard A Steenbergen wrote: > > >Thats what the IP2 does, match bytes in the headers and come back with a > >thumbs down or a thumbs up and a destination interface. It's really not > >that much harder to match the bytes for a dest port against a compiled > >ruleset and decide yes or no then it is to match the dest address against > >a forwarding table and decide which nexthop. > > Looking into the IP header is not enough. In order to filter DDOS packets > one has to look into the payload as well. I don't think routers are > suitable for that level of filtering (think advanced NBAR). I disagree. There are a world of things you can do when you look at the entire payload, from IDS to playing Big Brother. But stopping DDoS does not require it, in almost every case layer 3+4 headers is sufficient. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

as 22934
by Scott Granados 02 May '02

02 May '02

Just a note. I've been getting telephone calls on my home number concerning route flapping and other issues originating from as 22934 <Ebroadbandnow>. Just wanted to pass on that I no longer work there or have any contacts in the company. I'd suggest noc(a)ebroadbandnow.com or peering(a)ebroadbandnow.com but it appears their web, mail and dns servers are off line and have been now for almost a month. I don't have any valid telephone numbers to refer people to but I'm no longer able to effect changes or even contact anyone there. Thanks. Scott

1 0

RE: Effective ways to deal with DDoS attacks?
by LeBlanc, Jason 02 May '02

02 May '02

It (rpf) can't stop a DoS, but it does cut down on some of the spoofed packets, any reduction in the number of packets hitting whatever has to filter or deal with the attack packets helps. I don't have the stats in front of me, but our findings were than urpf would cut enough out to be worthwhile. -----Original Message----- From: Iljitsch van Beijnum [mailto:iljitsch@muada.com] Sent: Thursday, May 02, 2002 9:58 AM To: LeBlanc, Jason Cc: nanog(a)merit.edu Subject: RE: Effective ways to deal with DDoS attacks? If you just filter out anything that's not in the routing table, that's about half the address space and it only works if the spoofers are stupid. When you're looking at pure bandwidth that's still helpful, but it doesn't really solve anything. However, You can use unicast RPF as a very efficient source address filter, by routing addresses to the null interface. This way you can get rid of huge amounts of unwanted sources in a very clean way. As long as we're asking for features: what I would like is a unicast RPF check that allows everything that isn't routed to the null interface. And of course unicast RPF period for all vendors who aren't Cisco.

1 0

RE: Large ISPs doing NAT?
by Daniska Tomas 02 May '02

02 May '02

> -----Original Message----- > From: Jake Khuon [mailto:khuon@NEEBU.Net] > Sent: 2. mája 2002 10:32 > To: nanog(a)merit.edu > Subject: Re: Large ISPs doing NAT? > > > > > Time to start thinking a little further down the line. What > if the phone actually becomes an wireless IP gateway router? > It routes packets from a PAN (personal area network) riding > on top of Bluetooth or 802.11{a,b} to the 3G network for > transit. NAT would certainly become very messy. > greeeeat and what if one of the devices behind that phone would also be a personal "ip gateway router" (or how you call that)... you could recursively iterate as deep as your mail size allows you to... hope this thread will not end in a router behind a router that serves as a router seving as a router to another router which has some other routers connected... > > -- > /*===================[ Jake Khuon <khuon(a)NEEBU.Net> > ]======================+ > | Packet Plumber, Network Engineers /| / [~ [~ |) | | > --------------- | > | for Effective Bandwidth Utilisation / |/ [_ [_ |) |_| N > E T W O R K S | > +============================================================= > ============*/ > -- Tomas Daniska systems engineer Tronet Computer Networks Plynarenska 5, 829 75 Bratislava, Slovakia tel: +421 2 58224111, fax: +421 2 58224199 A transistor protected by a fast-acting fuse will protect the fuse by blowing first.

3 2

Joint NANOG/ARIN Meetings
by Susan Harris 02 May '02

02 May '02

Hi everyone - NANOG and ARIN are pleased to announce our first joint meetings, to be held October 27-November 1 in Eugene, Oregon. Our host will be the University of Oregon. NANOG will meet as usual from Sunday - Tuesday, and ARIN from Wednesday - Friday. We hope you'll plan on staying the whole week - it's a great opportunity for operators to participate in ARIN policy discussions.

1 0

Forget Bernie...
by blitz 02 May '02

02 May '02

http://biz.yahoo.com/rc/020502/telecoms_worldcom_1.html Bernie was dragged kicking and screaming out of Wcom today according to news I read....perhaps they chained him to his multi-milliondollar sailboat and pushed it twords the Bermuda triangle. John Sidgmore is now CEO. Yawn... Of course, they make little mention of his $630 mil "loan" that seems to be "dissapeared". >Then become a UUNET customer cause we already do this... Perhaps other >providers with 24/7 security teams will pipe up to give potential >customers a heads-up on options other than UUNET? If you go with UUNET >please tell the sales driod I sent you cause then I get 50 bucks :) (my >only raise thanks to bernie)

3 2

RE: Large ISPs doing NAT?
by Daniska Tomas 02 May '02

02 May '02

> -----Original Message----- > From: Jake Khuon [mailto:khuon@NEEBU.Net] > Sent: 2. mája 2002 10:51 > To: nanog(a)merit.edu > Subject: Re: Large ISPs doing NAT? > > > DT> and what if one of the devices behind that phone would also be a > DT> personal "ip gateway router" (or how you call that)... you could > DT> recursively iterate as deep as your mail size allows you to... > > It's possible. Could it get ugly? Yes. Do we just want to > shut our eyes and say "let's not go there."... well... maybe. > I just don't think the solution is to say, "this can never > happen... we must limit all handheld devices to sitting > behind a NAT gateway." > no eye-shutting. it's just about considering HOW MANY (or WHAT PART) of your users will need the 'full' service. if you have 95% of bfu's with web+mail phones or pda's then nat is completely ok for them. and those 5% (if so many ever) phreaks - give them an opportunity to have public ip with no nat for a few bucks more you will end up with exactly two exactly specified services... not that bad, is it? -- Tomas Daniska systems engineer Tronet Computer Networks Plynarenska 5, 829 75 Bratislava, Slovakia tel: +421 2 58224111, fax: +421 2 58224199 A transistor protected by a fast-acting fuse will protect the fuse by blowing first.

3 2

Re: Effective ways to deal with DDoS attacks?
by Hank Nussbacher 02 May '02

02 May '02

At 04:16 AM 02-05-02 +0000, Christopher L. Morrow wrote: >What we use and we're a 'largeish' network: > >http://www.secsup.org/Tracking/ >(shameless plug #1) > >Among other things this is a tool we use... there was a great set of >slides and presentation given at NANOG23: > >http://www.nanog.org/mtg-0110/greene.html >(shameless plug #2) Shameless plug #3 from RIPE41: http://www.ripe.net/ripe/meetings/archive/ripe-41/tutorials/eof-ddos.pdf 155 slides - 2.3M -Hank Consultant Riverhead Networks (formerly Wanwall Networks) www.riverhead.com >There is also a set of papers Barry Greene from Cisco has available on the >Cisco website... I'm positive he'll respond to this with the link, if he >doesn't search the NANOG mailing list archive for the link it should be >obvious in posts from Barry. > >If you want more pointers I'd be glad to chat on the phone with you, >numbers included below. > > >--Chris >(chris(a)uu.net) >####################################################### >## UUNET Technologies, Inc. ## >## Manager ## >## Customer Router Security Engineering Team ## >## (W)703-886-3823 (C)703-338-7319 ## >####################################################### > >On Wed, 1 May 2002, Pete Kruckenberg wrote: > > > > > There's been plenty of discussion about DDoS attacks, and my > > IDS system is darn good at identifying them. But what are > > effective methods for large service-provider networks (ie > > ones where a firewall at the front would not be possible) to > > deal with DDoS attacks? > > > > Current method of updating ACLs with the source and/or > > destination are slow and error-prone and hard to maintain > > (especially when the target of the attack is a site that > > users would like to access). > > > > A rather extensive survey of DDoS papers has not resulted in > > much on this topic. > > > > What processes and/or tools are large networks using to > > identify and limit the impact of DDoS attacks? > > > > Thanks. > > Pete. > > > >

1 0

Lab/testing time
by Pete Kruckenberg 01 May '02

01 May '02

I'm putting together a justication for additional lab equipment and personnel, and would be interested what an average network engineering group spends in terms of budget and personnel on a lab and people to run it, as a percentage of overall budget. This would be primarily for main-stream issues (software testing, configuration testing), as opposed to new-vendor/bleeding-edge lab work. I'm also interested if there are significant variations between these costs with various vendors. Are the lab/testing costs significantly different if I were primarily using vendor X vs. vendor Y, and how would costs for a pure X vendor network compare to a X+Y multivendor network? Thanks. Pete.

1 0

Re: news-peering
by Lyndon Nerenberg 01 May '02

01 May '02

> } I'm trolling for newspeers, if there is anyone out there still using > } NNTP.. > > http://www.usenet-se.net/peering/ A useless list based on my experience (zero responses to requests to twelve different sites). --lyndon

3 2