- NANOG - lists.nanog.org

detecting and blocking DoS/DDoS attacks
by Constantinos A. Kotsokalis 05 Mar '02

05 Mar '02

Hello everyone, I recently finished the latest beta release of a tool to detect (and possibly block) DoS/DDoS attacks. There are a few problems that I am trying to resolve, but all in all it seems to work. The tool is released under the GPL (i.e. it is free to use and modify the source code) and is available at: http://prdownloads.sourceforge.net/panoptis/panoptis-0.1b4.tar.gz Any contribution to the code, or functionality tests, will be of great value. Please note that the input is provided by Cisco routers exporting NetFlow data. At the moment, versions 1 and 5 have been tested. Support for version 8 is included, but not tested at all. The tool also allows for the creation of a detector mesh, in order to achieve trace-back in the case of spoofed IP addresses. Another thing to keep in mind is that it is written in C++ (so you will need a C++ compiler), it has been tested on Linux and it needs the GNU CommonC++ library (available at http://sourceforge.net/projects/cplusplus ). Please understand that this is a beta release, so not everything might work as it should; However, enough testing will lead to a stable release which will help all of us get rid of script kiddies bringing our networks to their knees. Thanks, Costas -- Constantinos A. Kotsokalis || ckotso(a)grnet.gr Greek Research and Technology Network Tel: +30 10 7474243 || Fax: +30 10 7474490

1 0

Re:The end of ASN 6172
by rkuhljr＠uol.com.br 03 Mar '02

03 Mar '02

Another thing to look at is SMTP banners: 220 mx2.corp.home.net ESMTP Sendmail 8.11.6/8.11.6; Sat, 2 Mar 2002 16:59:31 -0800 (PST) Excite@Home Unpowered By AT&T May be they will use some route announcements to spell out more "last wish" messages... Rubens Kuhl Jr. > >ASN 6172 (ATHOME) is still announcing a few routes. Any word >on when @Home will turn off the last router? Or are they being >abandoned in place. In the past, some defunct networks have >been announced for as long as two years after everyone left. > > > --- Use o melhor sistema de busca da Internet Radar UOL - http://radaruol.uol.com.br

1 0

Re: The end of ASN 6172
by burgan＠corp.home.net 02 Mar '02

02 Mar '02

At 03:13 PM 3/1/02, Sean Donelan wrote... >ASN 6172 (ATHOME) is still announcing a few routes. Any word >on when @Home will turn off the last router? Or are they being >abandoned in place. In the past, some defunct networks have >been announced for as long as two years after everyone left. I can guarantee that won't happen. Any announcements from 6172 will stop by the end of March. Jeff

1 0

The Cidr Report
by CIDR Report 02 Mar '02

02 Mar '02

This is an auto-generated mail on Fri Mar 1 23:00:00 PST 2002 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. NEW: Check http://www.employees.org/~tbates/cidr-report-region.html for the regional version of this report. NEW: Check http://www.employees.org/~tbates/autnums.html for a complete list of autonomous system number to name mappings as used by the CIDR-Report. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to GX Networks for giving me access to their routing tables once a day. Please send any comments about this report directly to CIDR Report <cidr-report(a)cisco.com>. ------------------------------------------------------------------------------ CIDR REPORT for 01Mar02 0) General Status Table History ------------- Date Prefixes 220202 106236 230202 106385 240202 106326 250202 106519 260202 106454 270202 106725 280202 106799 010302 106896 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- *** Bogus 96.0.0.0/20 from AS3549 AS Summary ---------- Number of ASes in routing system: 12522 Number of ASes announcing only one prefix: 7615 (4306 cidr, 3309 classful) Largest number of cidr routes: 769 announced by AS701 Largest number of classful routes: 1402 announced by AS701 1) Gains by aggregating at the origin AS level --- 01Mar02 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS701 1402 1138 264 18.8% UUNET Technologies, Inc. AS1221 1140 883 257 22.5% Telstra Pty Ltd AS17557 224 96 128 57.1% Pakistan Telecom AS16473 198 77 121 61.1% Bell South AS7018 801 684 117 14.6% AT&T AS6595 162 57 105 64.8% DoD Education Activity Network As AS4151 255 150 105 41.2% USDA AS705 307 203 104 33.9% UUNET Technologies, Inc. AS852 432 329 103 23.8% Telus Advanced Communications AS7046 346 244 102 29.5% UUNET Technologies, Inc. AS577 288 192 96 33.3% Bell Advanced Communications Inc. AS19632 94 9 85 90.4% Metropolis Intercom S.A. AS12302 114 32 82 71.9% MobiFon S.A. AS2048 186 105 81 43.5% State of Louisiana AS1239 488 409 79 16.2% Sprint AS4755 226 150 76 33.6% Videsh Sanchar Nigam Ltd. Autonom AS4323 424 350 74 17.5% Time Warner Communications, Inc. AS3908 333 266 67 20.1% Supernet, Inc. AS7303 117 53 64 54.7% Telecom Argentina Stet-France Tel AS3464 157 97 60 38.2% Alabama SuperComputer Network AS724 218 159 59 27.1% DLA Systems Automation Center AS10620 79 21 58 73.4% TVCABLE BOGOTA AS16758 63 6 57 90.5% IKON Office Solutions AS226 145 89 56 38.6% Los Nettos AS1 473 417 56 11.8% BBN Planet AS19834 63 8 55 87.3% NetForce, Inc. AS9051 75 22 53 70.7% INCONET Autonomous System AS703 269 217 52 19.3% UUNET Technologies, Inc. AS702 619 567 52 8.4% UUNET Technologies, Inc. AS2149 301 249 52 17.3% Performance Systems, Inc. Total 54098 42109 11989 22.2% For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

The end of ASN 6172
by Sean Donelan 01 Mar '02

01 Mar '02

ASN 6172 (ATHOME) is still announcing a few routes. Any word on when @Home will turn off the last router? Or are they being abandoned in place. In the past, some defunct networks have been announced for as long as two years after everyone left.

1 0

Reverse DNS and SMTP
by Patrick Muldoon 01 Mar '02

01 Mar '02

We have recently implemented a policy on our mail servers of not accepting mail from hosts that do not correctly resolve via reverse DNS. While we on the technical side love the idea, there have been some questions from the business side of the house. If an ISP who doesn't have reverse DNS setup correctly on their mail servers, we point them to the RFC's and generally offer to help them correct it. We have noticed that our spam has reduced drastically, and the complaints are few, but alas this is a double edged sword, where if you even block 1 legitimate e-mail out of the 100K+ that we receive daily, someone is going to complain. Just curious if anybody here is doing the same and the response that they have had from doing so. Replies off list are fine and I will summarize if people are interested. Thanks, Patrick -- Patrick Muldoon, Network/Software Engineer INOC, LLC doon(a)inoc.net Press Ctrl-Alt-Del now for IQ test.

8 7

Teleglobe Contact
by Daniel Concepcion 01 Mar '02

01 Mar '02

Have someone any operative contact in Teleglobe for a Peering issues with AS8297 in Spain. I try the noc@ peering@ and I dont't have any response. PD: Sorry for the offtopic. Regards, Daniel Intelideas Spain

1 0

Re: DNS timeline
by Simon Higgs 01 Mar '02

01 Mar '02

At 01:40 AM 2/25/2002 -0500, Sean Donelan wrote: >Since it appears DNS goofiness is about to return, I put together >a timeline of significant events that affected DNS service technically >over the last 20 years. > >http://www.donelan.com/dnstimeline.html Here's some that you missed: 7/31/1996. DNS root fragments (no-one notices). IANA-rep authorizes Draft Postel TLD applicants to go live with new registr(ies) as proof of concept. AlterNIC chosen as the "test root" until 10/1/1996 when TLDs were due to go live in IANA root. Process hi-jacked by ISOC/ITU/WIPO whereby new TLDs forced to exist outside IANA root. ?/2001. ICANN introduce the first intentionally duplicate TLDs (.BIZ/.INFO), de-stabilizing the DNS and causing cross-root pollution (now everyone notices). ?/2001. .US domain moved to .BIZ name servers creating permanent state of DNS root cross-pollution and creates new .US resolution problems. And the latest major internet outage: 2/2002. Randy Bush starts sounding rational (Go Randy, go!): http://www.interesting-people.org/archives/interesting-people/200202/msg002… Best Regards, Simon -- ###

2 3

ep.net status?
by Chris Parker 28 Feb '02

28 Feb '02

Anyone know what's going on with ep.net? It's been unresolvable since at least yesterday. PAIX, SIX and several other exchanges point to ep.net to register for an IP assignment at the exchange. The two authoritive servers, flag.ep.net (198.32.4.13) dot.ep.net (198.32.2.10) are not working by my testing (from own network as well as looking glasses). I cannot even reach flag, and dot doesn't know about ep.net. $ dig @198.32.2.10 ep.net soa ; <<>> DiG 8.1 <<>> @198.32.2.10 ep.net soa ; (1 server found) ;; res options: init recurs defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 10 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUERY SECTION: ;; ep.net, type = SOA, class = IN $ dig @198.32.4.13 ep.net soa ; <<>> DiG 8.1 <<>> @198.32.4.13 ep.net soa ; (1 server found) ;; res options: init recurs defnam dnsrch ;; res_send to server 198.32.4.13: Connection timed out Any insight or answer on how to register for IPs at an exchange ( since the exchange operators are just as stumped ) would be greatly appreciated. Thanks, -Chris -- \\\|||/// \ StarNet Inc. \ Chris Parker \ ~ ~ / \ WX *is* Wireless! \ Director, Engineering | @ @ | \ http://www.starnetwx.net \ (847) 963-0116 oOo---(_)---oOo--\------------------------------------------------------ \ Wholesale Internet Services - http://www.megapop.net

4 3

Re: Reverse DNS and SMTP
by David Charlap 28 Feb '02

28 Feb '02

Jared Mauch wrote: > > What I do is format my smtp headers such that a very simple > regex can find mail with no reverse dns and dump it in a spam folder. > I find this catches a lot of the messages. If your server is using a heuristic that has the potential of offending your customers, you can make the blocking optional. More specifically, respond to the "spam detected" condition by writing a header that customers can check for. Once that header's in place, a customer can configure his mail client to accept, delete, or spam-folder the message. If a client wants these kinds of messages to be deleted on the server, that may not be too hard to do either, once the header is written. -- David

1 0