- NANOG - lists.nanog.org

RE: [SOT Rant] Non-hostile probes / opt-in/out
by Patrick W. Gilmore 26 Oct '01

26 Oct '01

At 02:16 PM 10/26/2001 -0500, Quibell, Marc wrote: > >Maybe you should ping NS01.ARMY.MIL about 2400 times in 3 hour and see if >you don't get a visit? Pinging a website 2 times means nothing.. How about 441 times in 2 hours? :) >Marc -- TTFN, patrick

3 2

Re: Fwd: Re: Digital Island sponsors DoS attempt
by Paul A Vixie 26 Oct '01

26 Oct '01

> Until there are standards and technology available to push subscriber > policy to the edge of the network and beyond, the subscriber has > explicitly accepted the overall terms and conditions by which the service > is to be provided. no. i do not agree to receive a smurf attack, no matter whether my contract with a nexthop fails to require them to prevent it from reaching me. > I am assuming in this discussion that when you refer to "benefit", you are > in fact refering to "financial benefit". no, there's no known financial benefit to smurfing me, but the entities who direct such attacks have positive motivation of some kind for doing so -- and i assure you that this benefit to them, whatever it is, is far greater than the benefit to me (which would have to be expressed in negative terms.) > > another test for "welcome" is "if everybody did this, would the recipient > > be injured?" > > An interesting hypothesis, but it is seldom the case that the sender of > traffic knows the details of the recipients infrastructure. i think it's reasonable for a smurfer to know that my infrastructure cannot tolerate multiplicitous input streams from tens of thousands of sources. just as a spammer can indeed know, without doubt, that if millions of senders, all at once, decided to send me unsolicited nonpersonal e-mail, that my inbox would not hold up well. no specific knowledge is required in those cases. in those cases and in other cases where specific knowledge of my infrastructure is not necessary to determine that the traffic would be "not welcome", then it ought not be sent. > > smurf, ddos in general, and spam also classify well by this criteria. it > > Smurf and DDOS attacks are precisely that - attacks. They are > intentionally initiated for the purpose of disrupting infrastructure or > service. They are illegal. in some places, they are illegal. in all places, they are "unwelcome." since a sender of this (or any) traffic may not know the laws in force at the place where the recipient host resides, the broader standard of "unwelcome" is more widely applicable than the narrow standard of "illegal." of course, illegal things ought also not be done. but that'd be a new thread.

7 7

DI pings
by michael＠aplatform.com 26 Oct '01

26 Oct '01

Hello, As one poster pointed out the idea of a web page where on can supply IP ranges to a site that are doing "research" via pings. I have had an issue or concern with some to my site. I sent off an email last night asking for an explanation. The below is an decent response and a way to have ones IP space removed. I dont agrtee 100% with the reasoning but I do like the care offorded. No I dont like not being asked beforehand. But at least there is a response and a vehicle to have it stopped in a timely manner. Michael... ---------- Forwarded message ---------- Date: Fri, 26 Oct 2001 16:57:57 -0400 From: Customer Care at Akamai <ccare(a)akamai.com> To: "'michael(a)aplatform.com'" <michael(a)aplatform.com> Greetings Michael - Our company sometimes does research on Internet connectivity. The goal of our research is to improve download times for end users. No attack to your system was intended or attempted. The activity you saw was a standard ICMP echo request (ping) packet. We're using standard pings which only send one packet per second so there is no risk of a ping flood attack. Pings from different machines are coordinated to prevent a machine from being simultaneously pinged from a multitude of locations. The ping traffic is intended to try and triangulate the location of name-servers with respect to our data- centers in order to provide end users with better performance when they download web pages via the Akamai network. We regret any concern or inconvenience on your part. If you have IP addresses you'd like to be excluded from our testing, please visit the following URL. http://support.akamai.com/cgi-public/cease-pinging.cgi?id=134 Best, Akamai Customer Care

1 0

RE: Fwd: Re: Digital Island sponsors DoS attempt
by Patrick W. Gilmore 26 Oct '01

26 Oct '01

At 04:46 PM 10/26/2001 -0500, Quibell, Marc wrote: >That's great Pat, I especially liked the twist/jump from "upgrading to >DS3...etc" to "Who said I had to use a standardized method to deliver my web >page?". Intead of trying to figure out what your web page has to do with >our- standardized upgrades vs. non-standard, non-internet-community >sanctioned "internet performance enhancement" ping probes- debate, I give >up. I see that the subjects at hand are a big scramble in your gord. >Regardless, have a wonderful weekend. Marc, you continue to latch on to random statements in random e-mails, take them out of context, ignore the main points, and then wonder why people cannot follow your logic. Honestly, I do not blame you for giving up. I still stand by my assertion that the IETF has nothing to do with DI pinging someone. And I stand by my assertion that lots of people do lots of things that are not standardized, and this can frequently be a Good Thing, both for the networks / web pages / whatever involved, and the Internet as a whole. (Feel free to point out that it can also be bad, just so everyone knows you got the last word, even if that was not the point.) Oh, and it's patRICK. Or at least Happy. But not "Pat". Show some simple courtesy and at least look at the signature. >Marc -- TTFN, patrick

1 0

RE: Fwd: Re: Digital Island sponsors DoS attempt
by Quibell, Marc 26 Oct '01

26 Oct '01

That's great Pat, I especially liked the twist/jump from "upgrading to DS3...etc" to "Who said I had to use a standardized method to deliver my web page?". Intead of trying to figure out what your web page has to do with our- standardized upgrades vs. non-standard, non-internet-community sanctioned "internet performance enhancement" ping probes- debate, I give up. I see that the subjects at hand are a big scramble in your gord. Regardless, have a wonderful weekend. Marc -----Original Message----- From: Patrick W. Gilmore [mailto:patrick@ianai.net] Sent: Friday, October 26, 2001 4:33 PM To: nanog(a)merit.edu; Quibell, Marc Subject: RE: Fwd: Re: Digital Island sponsors DoS attempt At 04:00 PM 10/26/2001 -0500, Quibell, Marc wrote: >Don't be insulting Happy Gilmore. My goodness. You are so original. Lord knows I ain't never heard that one before. Oh, three words - Pot, Kettle, Black. >You said, "Certainly would not want someone to upgrade from a DS3 to an OC3 >to "enhance internet >traffic" from their site to me, or multi-home to make sure if one provider >/ line dies their site is still available. And forget about using load >balancers, Content Distribution Networks, etc." > >Talk about silly! Ever notice why STANDARD (hint) upgrades are warranted, >while not even remotely connected to the subject at hand? >S-T-A-N-D-A-R-D-I-Z-E-D. We all can use our brains and tell the difference >between standard upgrades and standard load-balancing, as defined by >numerous RFCs, and non-standard, uninformed haphazard methodology! First: Who said I had to use a standardized method to deliver my web page? Second: Most "standards" are in use before they are standardized (e.g. IP Anycast). Third: Last time I checked, you did not get to decide what was "warranted" on my network / web server / whatever. Fourth: You have yet to show you can use your brain. Uh, I mean, "use your brain to tell the difference between standard and non-standard methodology". (Yeah, that's what I meant. :) >I made a point that basically said DI's unorthodoxed methodologies are not >your choice (at least not until you discover them). You addressed that point >by saying I misinterpreted that, that "using a gizmo was my choice" and I >said that the difference is that one is a choice, your choice, the other is >not. And I must also add that one affects only you while the other affects >the entire Internet. Big difference, see it? Now take back that 'silly' >comment! :) No, you are still being silly. I specifically take exception to your comment: "Usually, IP and such technologies are the charge of the internet community and we form committees, or use IEEE, IETF, RFCs, ARIN." Those bodies make a framework, and we are allowed to be as creative inside (and sometimes outside) that framework as we please. Period. Furthermore, you stated: "I believe this to be the key as to why this is wrong and why DI, or Akamai, should not be even allowed to 'help' the internet." I did not ask your permission to be "allowed" to help the Internet, or run my business. And after this thread, you can be assured I never shall. If you do not like the fact other people can do things on the Internet which are not sanctioned by the RFCs, or you personally, I am afraid you are in for a life full of disappointment. And I seriously doubt a single network will give a gnat's ass whether it bothers you or not. >Marc -- TTFN, patrick

1 0

RE: Fwd: Re: Digital Island sponsors DoS attempt
by Patrick W. Gilmore 26 Oct '01

26 Oct '01

At 04:00 PM 10/26/2001 -0500, Quibell, Marc wrote: >Don't be insulting Happy Gilmore. My goodness. You are so original. Lord knows I ain't never heard that one before. Oh, three words - Pot, Kettle, Black. >You said, "Certainly would not want someone to upgrade from a DS3 to an OC3 >to "enhance internet >traffic" from their site to me, or multi-home to make sure if one provider >/ line dies their site is still available. And forget about using load >balancers, Content Distribution Networks, etc." > >Talk about silly! Ever notice why STANDARD (hint) upgrades are warranted, >while not even remotely connected to the subject at hand? >S-T-A-N-D-A-R-D-I-Z-E-D. We all can use our brains and tell the difference >between standard upgrades and standard load-balancing, as defined by >numerous RFCs, and non-standard, uninformed haphazard methodology! First: Who said I had to use a standardized method to deliver my web page? Second: Most "standards" are in use before they are standardized (e.g. IP Anycast). Third: Last time I checked, you did not get to decide what was "warranted" on my network / web server / whatever. Fourth: You have yet to show you can use your brain. Uh, I mean, "use your brain to tell the difference between standard and non-standard methodology". (Yeah, that's what I meant. :) >I made a point that basically said DI's unorthodoxed methodologies are not >your choice (at least not until you discover them). You addressed that point >by saying I misinterpreted that, that "using a gizmo was my choice" and I >said that the difference is that one is a choice, your choice, the other is >not. And I must also add that one affects only you while the other affects >the entire Internet. Big difference, see it? Now take back that 'silly' >comment! :) No, you are still being silly. I specifically take exception to your comment: "Usually, IP and such technologies are the charge of the internet community and we form committees, or use IEEE, IETF, RFCs, ARIN." Those bodies make a framework, and we are allowed to be as creative inside (and sometimes outside) that framework as we please. Period. Furthermore, you stated: "I believe this to be the key as to why this is wrong and why DI, or Akamai, should not be even allowed to 'help' the internet." I did not ask your permission to be "allowed" to help the Internet, or run my business. And after this thread, you can be assured I never shall. If you do not like the fact other people can do things on the Internet which are not sanctioned by the RFCs, or you personally, I am afraid you are in for a life full of disappointment. And I seriously doubt a single network will give a gnat's ass whether it bothers you or not. >Marc -- TTFN, patrick

1 0

route-views, current status
by David Meyer 26 Oct '01

26 Oct '01

After talking to many of you at NANOG, we came to the conclusion that the best course here was to leave the Cisco (route-views.oregon-ix.net) as it was, and to replicate some part (if not all) of the peerings on a zebra bgpd box that could do the MRT format export of RIBs and UPDATEs. Please check http://archive.routeviews.org and let me know what you think. Thanks, Dave

1 0

RE: Digital Island sponsors DoS attempt?
by Quibell, Marc 26 Oct '01

26 Oct '01

Hierarchial routing, not routing protocols: from far-end points to backbone and back out. Different interfaces support different MTU's. In this context, let's say your lowest common denominator starts at (A maximum of) 64000 MTU, from your GBit. Jumbo frames. Somewhere in that range I think. Let's say your pipe to the internet is an OC-3, an edge router. What is that, 9172 MTU? Your MTU has just been sliced and diced and PMTU-D, from it's return "Packet too big" ICMPs has cut it down to size. You basically said it already, and in fact the RFC defines this as well, though does not go into further detail. This is what I think is meant by hierarchial routing. Concerning ACLs, I don't see a problem filtering ICMPs using source and destination addresses. An admin's source and destination address or just his/her source being permitted? I believe there are also methods of filtering ICMP types as well, as defined in RFC1700? Yes Networks are private, and using firewalls help keep them that way. Can you login to a private network? Just because you can ping does not grant you access..And just because they have an internet line does not make them public domain. Marc -----Original Message----- From: Nicholas Bastin [mailto:nbastin@opnet.com] Sent: Friday, October 26, 2001 4:08 PM To: Quibell, Marc Cc: 'Valdis.Kletnieks(a)vt.edu'; nanog(a)merit.edu Subject: RE: Digital Island sponsors DoS attempt? On Fri, 2001-10-26 at 14:19, Quibell, Marc wrote: > > The answer is yes, that's what I'm saying. PMTU is fine on a LAN that could > be capable of Jumbo Frames, but is pretty much useless over the WAN or > internet since the PMTU has to use the lowest comon denominator MTU in the > path. Nobody I know, nor have I ever had a problem with "PMTU" and shutting > off ICMP routing. And no I do not believe it is used across the internet, > and if it does, it is probably hindering performance since it's probably > using a lower mtu than is allowed, such as 576 or smaller. It would also > have problems running across multi-level routing hierarchies. (I'll make the assumption here that PMTU really means PMTU-D in some cases) Using the lowest common denominator MTU in the path is exactly the point, and it's pretty hard to find out what that value is with PMTU-D. It *is* used across the internet, and while the MTU usually gets affected nearer to the edge than the core (PPPoE or other reasons), various forms of tunneling in the path can drop it below 1500 bytes. Also, I'd be interested in hearing any facts you might be able to present on why it would have any problem running across multi-level routing hierarchies, as I can't possibly see how the choice of routing protocol or hierarchy would affect the path MTU in the least. > No, there is a greater need for ICMP drops, and that is ping attacks. Still > happening to some of our customers. No one's going to sit there and filter > IP blocks. There are currently no viable uses or reasons for pinging into > private networks, except for possible troubleshooting, in which case the > admin would be involved. So, your ACLs can determine whether it's an admin or a user sending ICMP. That's an interesting piece of hardware you have there... And I don't know about everyone else, but if your network were truly 'private', I wouldn't be able to ping into it anyhow. As soon as you have users, connect to the internet, and expect to be able to reach the internet in a mostly unrestricted manner, your network doesn't fit my definition of 'private'. -- Nick Bastin OPNET Technologies

1 0

RE: Digital Island sponsors DoS attempt?
by Quibell, Marc 26 Oct '01

26 Oct '01

The answer is yes, that's what I'm saying. PMTU is fine on a LAN that could be capable of Jumbo Frames, but is pretty much useless over the WAN or internet since the PMTU has to use the lowest comon denominator MTU in the path. Nobody I know, nor have I ever had a problem with "PMTU" and shutting off ICMP routing. And no I do not believe it is used across the internet, and if it does, it is probably hindering performance since it's probably using a lower mtu than is allowed, such as 576 or smaller. It would also have problems running across multi-level routing hierarchies. No, there is a greater need for ICMP drops, and that is ping attacks. Still happening to some of our customers. No one's going to sit there and filter IP blocks. There are currently no viable uses or reasons for pinging into private networks, except for possible troubleshooting, in which case the admin would be involved. Finally, I do not believe PMTU uses pings to discover the PMTU. I believe it uses TCP or UDP packets at the layers above IP, and it DOES use "ICMP Packet Too big" responses (from the receiver) to cut it's packet size. So in reality, a router blocking ICMP from being routed through can still send these ICMP messages PMTU needs. Is this how you understand it? Marc -----Original Message----- From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] Sent: Friday, October 26, 2001 12:22 PM To: Quibell, Marc Cc: nanog(a)merit.edu Subject: Re: Digital Island sponsors DoS attempt? On Fri, 26 Oct 2001 12:01:38 CDT, "Quibell, Marc" said: > That's all fine Valdis, but no one does MTU check on the internet or pmtu > checks. This is all LAN-based... Umm.. I'm confused. What's all LAN-based? Or you saying that PMTU Discovery isn't used *at all*? Or that it's not *widely* used, mostly because a large chunk of the net *is* stuck at 1500-byte MTUs, and a large fraction of the rest has broken PMTU discovery because of boneheaded ICMP filtering? -- Valdis Kletnieks Operating Systems Analyst Virginia Tech

4 3

RE: Fwd: Re: Digital Island sponsors DoS attempt
by Quibell, Marc 26 Oct '01

26 Oct '01

Don't be insulting Happy Gilmore. You said, "Certainly would not want someone to upgrade from a DS3 to an OC3 to "enhance internet traffic" from their site to me, or multi-home to make sure if one provider / line dies their site is still available. And forget about using load balancers, Content Distribution Networks, etc." Talk about silly! Ever notice why STANDARD (hint) upgrades are warranted, while not even remotely connected to the subject at hand? S-T-A-N-D-A-R-D-I-Z-E-D. We all can use our brains and tell the difference between standard upgrades and standard load-balancing, as defined by numerous RFCs, and non-standard, uninformed haphazard methodology! I made a point that basically said DI's unorthodoxed methodologies are not your choice (at least not until you discover them). You addressed that point by saying I misinterpreted that, that "using a gizmo was my choice" and I said that the difference is that one is a choice, your choice, the other is not. And I must also add that one affects only you while the other affects the entire Internet. Big difference, see it? Now take back that 'silly' comment! :) Marc -Trying to find the silliness... -----Original Message----- From: Patrick W. Gilmore [mailto:patrick@ianai.net] Sent: Friday, October 26, 2001 3:47 PM To: nanog(a)merit.edu; Quibell, Marc Subject: RE: Fwd: Re: Digital Island sponsors DoS attempt At 03:29 PM 10/26/2001 -0500, Quibell, Marc wrote: >You said, "If I feel like using..(someone's) performance improving gizmo, >it's my decision." The problem with this is, in the DI example, it is not >your choice. I suppose if you're confortable with the idea of rogue >companies trying to enhance internet traffic on their own, whether you agree >with the methodology or not and giving you no choice, then that is your >perogative. Somehow I knew you would misinterpret what I said. Allow me to help you out a bit. You completely missed this part: <quote> And the IETF, IEEE, RFC-editor, NANOG, EFF, PTA, SPCA, or any other alphabet organization has nothing to say about it. (Assuming, of course, I am not violating standards, attacking people, etc.) [...] Unfortunately, it *MAY* be that DI is violating that "assuming, of course" part above. </quote> As for "rogue companies trying enhance internet traffic on their own", well, we better make sure everyone has the same routers, same transit provider, same BGP config, same web server software, etc., etc. Certainly would not want someone to upgrade from a DS3 to an OC3 to "enhance internet traffic" from their site to me, or multi-home to make sure if one provider / line dies their site is still available. And forget about using load balancers, Content Distribution Networks, etc. Marc, I have tried to be nice, but your replies just get more & more silly as time goes on. Please read the whole post & think before (if) you reply.... >Marc -- TTFN, patrick P.S. I wonder if Keynote has permission from every web page they test?

1 0