- NANOG - lists.nanog.org

RE: Fwd: Re: Digital Island sponsors DoS attempt
by Patrick W. Gilmore 26 Oct '01

26 Oct '01

At 03:29 PM 10/26/2001 -0500, Quibell, Marc wrote: >You said, "If I feel like using..(someone's) performance improving gizmo, >it's my decision." The problem with this is, in the DI example, it is not >your choice. I suppose if you're confortable with the idea of rogue >companies trying to enhance internet traffic on their own, whether you agree >with the methodology or not and giving you no choice, then that is your >perogative. Somehow I knew you would misinterpret what I said. Allow me to help you out a bit. You completely missed this part: <quote> And the IETF, IEEE, RFC-editor, NANOG, EFF, PTA, SPCA, or any other alphabet organization has nothing to say about it. (Assuming, of course, I am not violating standards, attacking people, etc.) [...] Unfortunately, it *MAY* be that DI is violating that "assuming, of course" part above. </quote> As for "rogue companies trying enhance internet traffic on their own", well, we better make sure everyone has the same routers, same transit provider, same BGP config, same web server software, etc., etc. Certainly would not want someone to upgrade from a DS3 to an OC3 to "enhance internet traffic" from their site to me, or multi-home to make sure if one provider / line dies their site is still available. And forget about using load balancers, Content Distribution Networks, etc. Marc, I have tried to be nice, but your replies just get more & more silly as time goes on. Please read the whole post & think before (if) you reply.... >Marc -- TTFN, patrick P.S. I wonder if Keynote has permission from every web page they test?

1 0

RE: Fwd: Re: Digital Island sponsors DoS attempt
by Quibell, Marc 26 Oct '01

26 Oct '01

You said, "If I feel like using..(someone's) performance improving gizmo, it's my decision." The problem with this is, in the DI example, it is not your choice. I suppose if you're confortable with the idea of rogue companies trying to enhance internet traffic on their own, whether you agree with the methodology or not and giving you no choice, then that is your perogative. Marc -----Original Message----- From: Patrick W. Gilmore [mailto:patrick@ianai.net] Sent: Friday, October 26, 2001 3:17 PM To: nanog(a)merit.edu; Quibell, Marc Subject: RE: Fwd: Re: Digital Island sponsors DoS attempt At 02:56 PM 10/26/2001 -0500, Quibell, Marc wrote: [...] >If a vendor uses ping times and hops to determine closest servers, where >does it ping from? Each M$ server? And then how does it tell the client or >server where to redirect the traffic? If I read the original post right, the >pings came from DI. How does this determine the location of off-site >servers? Is this the best way to do it and what is the total bandwidth >impact on the internet? While I agree there may be unintended consequences, even to the point of poor performance or effectively DoS'ing a site, this is not really relevant, or the province of the IETF. If I feel like using cisco's or DI's or Joe-The-Web-Guru's new wiz-bang load-balancer speeder-upper performance-improving reliability-enhancer on MY WEB PAGE, then that is MY decision. Period. And the IETF, IEEE, RFC-editor, NANOG, EFF, PTA, SPCA, or any other alphabet organization has nothing to say about it. (Assuming, of course, I am not violating standards, attacking people, etc.) >The original poster of this message stated afterwards, offline, he's now up >to over 2400 pings in three hours. Add this number of pings to the number of >servers and the number of clients being pinged. It grows exponentially. Do >you not think that there should be some Official Standards developed to >accomodate and support this? Unfortunately, it *MAY* be that DI is violating that "assuming, of course" part above. I honestly am not sure why they would need to send 2400 pings in 3 hours. But I am also not 100% certain that sending 2400 pings is excessive or "wrong". Suppose the end users on that network asked for 500 GB of data from 100 DI customers? Honest, I do not know the answer, and I doubt most people here do either. Without knowing the circumstances on both sides of the connection, it is a bit difficult to say "You did a BAAAAAAD thing". IMHO, of course. >Marc -- TTFN, patrick

1 0

Re: The grass is green? No! The sky is blue!
by Dave O'Shea 26 Oct '01

26 Oct '01

As an official representative* of the U.S. Department of Bad Analogies, I am here to help. When I'm on a freeway, I expect to see a lot of cars, and I expect a small number of them to be driven by idiots. I wear my seat belt and try to be aware of the idiots to make sure I keep my distance. But I don't let them distract me from my primary task. I also see, very rarely, someone truly dangerous, perhaps a drunk, or a truck that is unknowingly losing cargo on the road. Those very few are worth making note of and pointing out to The Proper Authorities. At home, living at the end of a cul-de-sac, I expect to see very few cars, and I expect to be familiar with the drivers of most of them. When I see one that doesn't look familiar, I will probably notice it. If I see the same car more than once, I would probably say hello to the driver, and determine why he's there. The few times I've done this, I've usually found that they're a contractor, or someone visiting a relative. Once I've done so, I'll go back to something productive like watching The Simpsons. Yes, I could make a stink about them parking on the street, but it would make my neighbors think I'm far more grumpy and weird than they already think, and they'll be less inclined to lend me a hand next time I need to move something heavy. Moral of the story: Things that are alarming in one context are harmless in another, and vice versa. The value is in that SJDLR ("something just don't look right") instinct that cops and similar professions, that allows them to spot trouble. *I'm lying, of course. I don't even claim to represent my own opinion, never mind anyone else's. > -----Original Message----- > From: Matt Levine [mailto:matt@deliver3.com] > Sent: Friday, October 26, 2001 2:43 PM > To: Simon Lockhart; Dan Hollis > Cc: Christopher Wawak; Alex Rubenstein; nanog(a)nanog.org > Subject: RE: EXAMPLE: ### xxx Canada detected a penetration > attempt from > 209.123.x.229. Incident# xxxx > > > > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Wouldn't it be more appropriate to use "businesses" instead of > houses? Trying the front door to a business to see if they're open > (while no excuse for checking the windows, obviously) is a little > more appropriate IMO.. > > > Matt > > - -- > Matt Levine > @Home: matt(a)deliver3.com > @Work: matt(a)eldosales.com > ICQ : 17080004 > PGP : http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x6C0D04CF > "The Trouble with doing anything right the first time is that nobody > appreciates how difficult it was." > > - -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf > Of > Simon Lockhart > Sent: Friday, October 26, 2001 3:19 PM > To: Dan Hollis > Cc: Christopher Wawak; Alex Rubenstein; nanog(a)nanog.org > Subject: Re: EXAMPLE: ### xxx Canada detected a penetration attempt > from > 209.123.x.229. Incident# xxxx > > > > > > >On Fri, 26 Oct 2001, Christopher Wawak wrote: > >> Well, not exactly. Looking into the windows or checking the > >> doorknobs is more akin to looking at your directory structre on > >> your computer or file ... Scanning is more like going through the > >> phone book or looking at the names on mailboxes in a > >> neighborhood.... > > > >So you dont mind if people portscan your network? > > Stupid analogy # 54325235: > > pinging all hosts on a net: Walking down a street finding out which > houses > exist > > Portscan: Trying the doors, windows, etc on a house > > I know which one I don't mind... > > Simon > - -- > Simon Lockhart | Tel: +44 (0)1737 839676 > Internet Engineering Manager | Fax: +44 (0)1737 839516 > BBC Internet Services | Email: > Simon.Lockhart(a)bbc.co.uk > Kingswood Warren,Tadworth,Surrey,UK | URL: > http://support.bbc.co.uk/ > > > > -----BEGIN PGP SIGNATURE----- > Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> > > iQA/AwUBO9m8rsp0j1NsDQTPEQKtSwCfdo8BpdgJoUZ5kJlvptNB14UwTLgAn0yy > G6u7HTmDnKp9fAmJontSwdsd > =LpNH > -----END PGP SIGNATURE----- > >

1 0

RE: [SOT Rant] Non-hostile probes / opt-in/out--BTW
by Quibell, Marc 26 Oct '01

26 Oct '01

BTW, I just tried pinging ns01.army.mil...no reply. :( Marc -----Original Message----- From: James Thomason [mailto:james@divide.org] Sent: Friday, October 26, 2001 3:00 PM To: Patrick W. Gilmore Cc: nanog(a)merit.edu; Quibell, Marc Subject: RE: [SOT Rant] Non-hostile probes / opt-in/out If I did, and they responded negatively, I would tell them YOU said it was a good idea. Seriously, why should the administrators of *.army.mil care if I test packet response time between our networks? Is this an illegal activity I am unaware of? On Fri, 26 Oct 2001, Patrick W. Gilmore wrote: > > At 02:16 PM 10/26/2001 -0500, Quibell, Marc wrote: > > > >Maybe you should ping NS01.ARMY.MIL about 2400 times in 3 hour and see if > >you don't get a visit? Pinging a website 2 times means nothing.. > > How about 441 times in 2 hours? :) > > > >Marc > > -- > TTFN, > patrick > >

1 0

RE: Fwd: Re: Digital Island sponsors DoS attempt
by Patrick W. Gilmore 26 Oct '01

26 Oct '01

At 02:56 PM 10/26/2001 -0500, Quibell, Marc wrote: [...] >If a vendor uses ping times and hops to determine closest servers, where >does it ping from? Each M$ server? And then how does it tell the client or >server where to redirect the traffic? If I read the original post right, the >pings came from DI. How does this determine the location of off-site >servers? Is this the best way to do it and what is the total bandwidth >impact on the internet? While I agree there may be unintended consequences, even to the point of poor performance or effectively DoS'ing a site, this is not really relevant, or the province of the IETF. If I feel like using cisco's or DI's or Joe-The-Web-Guru's new wiz-bang load-balancer speeder-upper performance-improving reliability-enhancer on MY WEB PAGE, then that is MY decision. Period. And the IETF, IEEE, RFC-editor, NANOG, EFF, PTA, SPCA, or any other alphabet organization has nothing to say about it. (Assuming, of course, I am not violating standards, attacking people, etc.) >The original poster of this message stated afterwards, offline, he's now up >to over 2400 pings in three hours. Add this number of pings to the number of >servers and the number of clients being pinged. It grows exponentially. Do >you not think that there should be some Official Standards developed to >accomodate and support this? Unfortunately, it *MAY* be that DI is violating that "assuming, of course" part above. I honestly am not sure why they would need to send 2400 pings in 3 hours. But I am also not 100% certain that sending 2400 pings is excessive or "wrong". Suppose the end users on that network asked for 500 GB of data from 100 DI customers? Honest, I do not know the answer, and I doubt most people here do either. Without knowing the circumstances on both sides of the connection, it is a bit difficult to say "You did a BAAAAAAD thing". IMHO, of course. >Marc -- TTFN, patrick

1 0

Re: MIT network measurement probes
by Christopher Wolff 26 Oct '01

26 Oct '01

David, I respect your approach, letting us know about your bandwidth study and what each network operator can expect. The important part is that we get the opportunity to either opt-out, or find out a way to "opt-in" and help you acquire more information to complete your research. Too bad Digital Isle didn't follow the same approach. Regards, Christopher J. Wolff, CTO Broadband Laboratories ---------- Original Message ---------------------------------- From: "David G. Andersen" <dga(a)lcs.mit.edu> Date: Thu, 25 Oct 2001 23:51:44 -0400 (EDT) > >Given the current thread about unwanted network probe traffic, >I figured it would be a good idea to pre-announce this and >let people have a chance to put their netblocks on a deny >list in advance, if they so desire. > >(Note: We'd really appreciate it if you'd let our probes go >through! It's an important part of some of the research we're >doing). > >We're running some traceroutes and pings to observe the end-to-end >reachability of sites around the times of BGP route changes. >This means that if you have a stable network, you probably won't >see too many probes from us, but if you flap all the time, >you'll see up to a few probes per hour. >(One probe == one traceroute). > >The probes are extremely low-bandwidth and as non-invasive as >we can make them, but if you'd like to be put on an exclusion >list for this and any other probing experiments our >research group runs, please send mail to: > > mon-request(a)nms.lcs.mit.edu > >Include all of the netblocks that you'd like excluded, preferably >like: > >18.31.0.0/24 > >Thanks, > > -Dave Andersen > >-- >work: dga(a)lcs.mit.edu me: dga(a)pobox.com > MIT Laboratory for Computer Science http://www.angio.net/ >

7 6

RE: Fwd: Re: Digital Island sponsors DoS attempt
by Quibell, Marc 26 Oct '01

26 Oct '01

I will explain further: Companies, trying to make some money (I agree), are attempting to reroute traffic using their own techniques w/o consulting the Internet consortium. What are the consequences? I'll list one for you: The techniques used may conflict with other vendors' techniques- Let's say that DI uses pings to a client's DNS server, which in this case happens to be at the same location as the client. It pings the DNS server everytime a user from that site wants to get to Micro$oft.com. In turn M$ has it's own "local server finder" pings running, which really is more up-to-date than the other vendor, and finds and even closer server -or- M$ uses a different formula to determine the nearest server, -or- the pings from M$ arrive faster than the ones from the other vendor...etc. In each case they both have different outcomes as to which is the nearest server. Now where is the client sent? Does this not effect client routing? There is no standard. And rerouting traffic requires, no demands, Standards. If a vendor uses ping times and hops to determine closest servers, where does it ping from? Each M$ server? And then how does it tell the client or server where to redirect the traffic? If I read the original post right, the pings came from DI. How does this determine the location of off-site servers? Is this the best way to do it and what is the total bandwidth impact on the internet? The original poster of this message stated afterwards, offline, he's now up to over 2400 pings in three hours. Add this number of pings to the number of servers and the number of clients being pinged. It grows exponentially. Do you not think that there should be some Official Standards developed to accomodate and support this? Marc -----Original Message----- From: Patrick W. Gilmore [mailto:patrick@ianai.net] Sent: Friday, October 26, 2001 2:27 PM To: nanog(a)merit.edu; Quibell, Marc Subject: RE: Fwd: Re: Digital Island sponsors DoS attempt At 12:55 PM 10/26/2001 -0500, Quibell, Marc wrote: > >I see that you have no concept of what I just said. Thanks for the >clarification. James is not the only one - I have no clue what you were trying to say either. Let's look at your first statement: > Me thinks that when such technologies be commercialized on the net, there > will be problems. Usually, IP and such technologies are the charge of the > internet community and we form committees, or use IEEE, IETF, RFCs, > ARIN...etc for these and other technologies and come to open internet > standards and agreements on how to improve such things. Now we have these > people coming in here on their own and attempting to shove their technolgies > down our pipes w/o OUR concensus! Anyone now see the problem with this? I > believe this to be the key as to why this is wrong and why DI, or Akamai, > should not be even allowed to 'help' the internet. The IETF, RFCs, etc. define protocol formats. While they do define some prohibited behavior, there is a LOT of leeway in use of the packets & protocols defined. To my knowledge (and please feel free to correct me if I am wrong), the probes discussed in this thread are not prohibited in any draft, RFC, standard, etc. Since the only thing "these people" are shoving down your pipes are PROPERLY FORMATTED IP PACKETS, which violate no existing or proposed standard, I am not certain why the IETF, IEEE, etc. would even care. If you mean that they are using properly formatted packets in an incorrect fashion (e.g. spam), please be more clear. But saying that every time someone has a better way of doing something they must go to the IETF first is just plain silly. BTW: I doubt DI is trying to "'help' the internet". (I could be wrong, I do not work for DI.) They are probably trying to make money (just like most of the rest of us here). Not that they need your permission to "help" the Internet anyway, so your statement about "should not be even allowed" is completely irrelevant. >Marc -- TTFN, patrick P.S. An answer of "you don't understand" will be treated with s/you/I as you would be showing your lack of understanding through your inability to communicate your argument. >-----Original Message----- >From: James Thomason [mailto:james@divide.org] >Sent: Friday, October 26, 2001 12:18 PM >To: Quibell, Marc >Cc: 'Mike Batchelor'; nanog(a)merit.edu >Subject: RE: Fwd: Re: Digital Island sponsors DoS attempt > > >They are using standard technology, Digital Island and Akamai did not >invent ICMP. The methodology is new, and they have the right to use >it. If you dislike the methodology, you can block it, or propose to the >IETF that we change or remove ICMP.

1 0

Re: EXAMPLE: ### xxx Canada detected a penetration attempt from 209.123.x.229. Incident# xxxx
by Dan Hollis 26 Oct '01

26 Oct '01

On Fri, 26 Oct 2001, Christopher Wawak wrote: > Well, not exactly. Looking into the windows or checking the doorknobs is > more akin to looking at your directory structre on your computer or file > ... Scanning is more like going through the phone book or looking at the > names on mailboxes in a neighborhood.... So you dont mind if people portscan your network? -Dan -- [-] Omae no subete no kichi wa ore no mono da. [-]

4 3

Fwd: Re: Digital Island sponsors DoS attempt?
by Rodney Thayer 26 Oct '01

26 Oct '01

Gee, just having attended (part of) a NANOG meeting I would have thought that talking amongst the operators about how to work out connectivity quality issues amongst operators was something that was already happening, sort of like the conversations that go on about peering. If DI, or Akamai, for example, or anybody else wants to worry about connectivity to places not directly doing business with them, one would like to think they'd talk about this in some relevant forum, rather than jabbing a sharp stick in their neighbor's eye to see if they say 'ouch'. > I don't know anything about what digital island is doing in > particular, but for a long time people have struggled with the issue > of how to offer better quality connectivity to sites off of their > network. > > The communal nature of the Internet in times gone by provided > altruistic desires (usually) to provide good connectivity, but as > the quality becomes directly tied to cost, it is likely to suffer. > > I suspect that DI, like many other companies, is actively monitoring > external sites to track, study, and hopefully improve connectivity > quality to them.

1 0

RE: Fwd: Re: Digital Island sponsors DoS attempt
by Patrick W. Gilmore 26 Oct '01

26 Oct '01

At 12:55 PM 10/26/2001 -0500, Quibell, Marc wrote: > >I see that you have no concept of what I just said. Thanks for the >clarification. James is not the only one - I have no clue what you were trying to say either. Let's look at your first statement: > Me thinks that when such technologies be commercialized on the net, there > will be problems. Usually, IP and such technologies are the charge of the > internet community and we form committees, or use IEEE, IETF, RFCs, > ARIN...etc for these and other technologies and come to open internet > standards and agreements on how to improve such things. Now we have these > people coming in here on their own and attempting to shove their technolgies > down our pipes w/o OUR concensus! Anyone now see the problem with this? I > believe this to be the key as to why this is wrong and why DI, or Akamai, > should not be even allowed to 'help' the internet. The IETF, RFCs, etc. define protocol formats. While they do define some prohibited behavior, there is a LOT of leeway in use of the packets & protocols defined. To my knowledge (and please feel free to correct me if I am wrong), the probes discussed in this thread are not prohibited in any draft, RFC, standard, etc. Since the only thing "these people" are shoving down your pipes are PROPERLY FORMATTED IP PACKETS, which violate no existing or proposed standard, I am not certain why the IETF, IEEE, etc. would even care. If you mean that they are using properly formatted packets in an incorrect fashion (e.g. spam), please be more clear. But saying that every time someone has a better way of doing something they must go to the IETF first is just plain silly. BTW: I doubt DI is trying to "'help' the internet". (I could be wrong, I do not work for DI.) They are probably trying to make money (just like most of the rest of us here). Not that they need your permission to "help" the Internet anyway, so your statement about "should not be even allowed" is completely irrelevant. >Marc -- TTFN, patrick P.S. An answer of "you don't understand" will be treated with s/you/I as you would be showing your lack of understanding through your inability to communicate your argument. >-----Original Message----- >From: James Thomason [mailto:james@divide.org] >Sent: Friday, October 26, 2001 12:18 PM >To: Quibell, Marc >Cc: 'Mike Batchelor'; nanog(a)merit.edu >Subject: RE: Fwd: Re: Digital Island sponsors DoS attempt > > >They are using standard technology, Digital Island and Akamai did not >invent ICMP. The methodology is new, and they have the right to use >it. If you dislike the methodology, you can block it, or propose to the >IETF that we change or remove ICMP.

1 0