- NANOG - lists.nanog.org

RE: Fwd: Re: Digital Island sponsors DoS attempt?
by Borchers, Mark 26 Oct '01

26 Oct '01

If ping testing scales as badly as you suggest, all of these products need to be yanked off the market asap. Putting such tools in the hands of millions of end users is certainly more of a threat than their use by network engineers. http://compnetworking.about.com/cs/pingtools/ > On Fri, 26 Oct 2001, Jonas Luster wrote: > > Jonas, > > It's one every 20 seconds from -one- ISP. What happens when > thousands of ISPs begin offering this service? > > a) more people are waken up at 3am by tripped IDS systems > > b) more people filter all icmp and break the internet > > c) more people have to add more acls to their routers to > prevent pushing > garbage as much as possible at the core, driving up cost and cpu > > > This service should clearly be "opt-in". > > Also, I believe the second comment made on this thread was > regarding the > idea that we implicitly give people permission to do this > sort of thing > by connecting to the internet (or per our sla/whatever). I > surely do not > give people permission to attack my network, why is this any > different? > Intentions? > > rgds, > > Adam >

1 0

RE: FWD: RE: FW: Getting hacked by Digital Isle?
by Quibell, Marc 26 Oct '01

26 Oct '01

I believe you subscribed to this thread Andy.... We don't need a flame. Please be more mature. -----Original Message----- From: Andy Dills [mailto:andy@xecu.net] Sent: Friday, October 26, 2001 10:27 AM To: Christopher Wolff Cc: nanog(a)merit.edu Subject: Re: FWD: RE: FW: Getting hacked by Digital Isle? On Thu, 25 Oct 2001, Christopher Wolff wrote: > > Here is the official Digital Isle party line. The part that I like is > > "3) Respond to this message requesting we stop pinging your server. > In this event our pinging will cease in several days." > > Several days? I'm wondering if I can send a bill to Digital Isle for > beta testing their product on my time and bandwidth without even > asking me. Sure. On that same note, I'm sending you a bill for having to read this pointless thread. 400 packets. I could understand your gripe if you were personally hand-delivering packets via camel, but come on. If it bothers you, block it. Stop whining. Andy xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Andy Dills 301-682-9972 Xecunet, LLC www.xecu.net xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Dialup * Webhosting * E-Commerce * High-Speed Access

1 0

Fwd: Re: Digital Island sponsors DoS attempt?
by Jason Forester 26 Oct '01

26 Oct '01

To: chris(a)bblabs.com Subject: Re: Digital Island sponsors DoS attempt? Cc: nanog(a)merit.edu, abuse(a)digisle.net Chris, As the message says, this is not an attack of any kind. It is a system which collects metrics for our Footprint Content Delivery System. The system is attempting to determine the closest servers to your network, to provide good service to your customers when they download from Footprint customers such as Microsoft. I'm sure you will get a response from abuse(a)digisle.net very shortly, but I wanted to allay your fears quickly. There is no attack. - jason -----Original Message----- From: Christopher J. Wolff [mailto:chris@bblabs.com] Sent: Thursday, October 25, 2001 12:58 PM To: nanog(a)merit.edu Subject: Digital Island sponsors DoS attempt? Hello friends, My IDS was just tripped over 300 times. The decoded packet says: mailto:abuse@digisle.com for questions This ICMP ECHO REQUEST/REPLY is part of the real-time network monitoring performed by Digital Island Inc. It is not an attack. If you have questions please contact abuse(a)digisle.com....................................................... .... ........................................................................ .... We are not on their network or in any way affiliated with Digital Island, I'm just curious if anyone else has seen this anomaly, if it is legit, or if it is a real attack being spoofed from Digital Island...no response from abuse(a)digisle.com yet. Regards, Christopher J. Wolff, VP, CIO Broadband Laboratories, Inc. http://www.bblabs.com email:chris@bblabs.com phone:520.622.4338 x234 -- Jason Forester jasonf(a)digisle.net Network Performance Engineer Digital Island

14 16

Digital Island sponsors DoS attempt?
by Christopher J. Wolff 26 Oct '01

26 Oct '01

Hello friends, My IDS was just tripped over 300 times. The decoded packet says: mailto:abuse@digisle.com for questions This ICMP ECHO REQUEST/REPLY is part of the real-time network monitoring performed by Digital Island Inc. It is not an attack. If you have questions please contact abuse(a)digisle.com........................................................... ............................................................................ ............................................................................ ............................................................................ ............................................................................ ............................................................................ ............................................................................ ............................................................................ ............................................................................ ............................................................................ ............................................................................ ............................................................................ ............................................................................ ............................................................................ ............................................................................ ............................................... We are not on their network or in any way affiliated with Digital Island, I'm just curious if anyone else has seen this anomaly, if it is legit, or if it is a real attack being spoofed from Digital Island...no response from abuse(a)digisle.com yet. Regards, Christopher J. Wolff, VP, CIO Broadband Laboratories, Inc. http://www.bblabs.com email:chris@bblabs.com phone:520.622.4338 x234

7 8

RWHOIS Bug Fix
by ginny listman 26 Oct '01

26 Oct '01

Regarding the recent vunerabilities discovered in the RWhois code, ARIN Engineering has released a patch. This patch can be found at: ftp://ftp.arin.net/pub/rwhois/rwhoisd-1.5.7-1.tar.gz Questions can be addressed to dbwg(a)arin.net Ginny Listman Director of Engineering ARIN

1 0

How worried is too worried? Plus, a Global Crossing Story.
by Christopher Wolff 26 Oct '01

26 Oct '01

I truely enjoyed the wide range of reponses to my Digital Island post. Everything from DI is perfectly justified to 'tell DI to stick it' haha. I certainly do not run the largest ISP, nor the smallest, but my small company is managing customer connectivity on both coasts of the continental US. My customers know me as the one that cares about their network infrastructure and can answer most questions quickly. I enjoy offering personal service. I also take pride in managing my network well. I know, for the most part, what kinds of traffic are passing through my network. This helps me take a proactive stance to issues before they become my customers' business impediments. Therefore, I have to respectfully take exception to the opinion of "Welcome to the Internet, there's nothing you can do, just don't worry about 441 packets." I partner with companies that share my view of network management. Recently I had an issue with a customer that was claiming poor throughput. Global crossing did everything in their power to analyze their network, my network, and my customers server farm. Although this turned out to be a TCP/IP tuning issue on the particular host, Global Crossing did not charge me a premium for investigating this issue. Throughout this resolution, Global Crossing earned my respect and confidence that I am *partnered* with a vendor instead of just buying bandwidth from them. Just my $0.02, Christopher J. Wolff, VP, CTO Broadband Laboratories

5 4

Distance range?
by bhchoi＠smartnet.co.kr 26 Oct '01

26 Oct '01

Hi nanog. Does anyone know distance support range about gigabit ethernet in IEEE 802.3z and 802.3ab and SONET/SDH? Gigabit Ethernet SX Transceiver : ? km LX Transceiver : ? km Long Haul Transceiver : ? km SONET/SDH MM(Multimode) : ? SR(Short reach) : ? IR(Intermediate reach) : ? LR(Long reach) : ? thanks for any input or pointer. Brian

1 0

Re: Fwd: Re: Digital Island sponsors DoS attempt
by Christopher Wolff 26 Oct '01

26 Oct '01

Paul, Some very valid points here. I would be interested to see just what the legal definition of "network intrusion" is on a federal level with all of the recent computer-crime and anti-terrorism legislation sailing through the legislative branch. Regards, Christopher ---------- Original Message ---------------------------------- From: Paul A Vixie <vixie(a)vix.com> Date: Fri, 26 Oct 2001 00:07:05 -0700 > >> Until there are standards and technology available to push subscriber >> policy to the edge of the network and beyond, the subscriber has >> explicitly accepted the overall terms and conditions by which the service >> is to be provided. > >no. i do not agree to receive a smurf attack, no matter whether my contract >with a nexthop fails to require them to prevent it from reaching me. > >> I am assuming in this discussion that when you refer to "benefit", you are >> in fact refering to "financial benefit". > >no, there's no known financial benefit to smurfing me, but the entities who >direct such attacks have positive motivation of some kind for doing so -- >and i assure you that this benefit to them, whatever it is, is far greater >than the benefit to me (which would have to be expressed in negative terms.) > >> > another test for "welcome" is "if everybody did this, would the recipient >> > be injured?" >> >> An interesting hypothesis, but it is seldom the case that the sender of >> traffic knows the details of the recipients infrastructure. > >i think it's reasonable for a smurfer to know that my infrastructure cannot >tolerate multiplicitous input streams from tens of thousands of sources. just >as a spammer can indeed know, without doubt, that if millions of senders, >all at once, decided to send me unsolicited nonpersonal e-mail, that my inbox >would not hold up well. > >no specific knowledge is required in those cases. in those cases and in other >cases where specific knowledge of my infrastructure is not necessary to >determine that the traffic would be "not welcome", then it ought not be sent. > >> > smurf, ddos in general, and spam also classify well by this criteria. it >> >> Smurf and DDOS attacks are precisely that - attacks. They are >> intentionally initiated for the purpose of disrupting infrastructure or >> service. They are illegal. > >in some places, they are illegal. in all places, they are "unwelcome." since >a sender of this (or any) traffic may not know the laws in force at the place >where the recipient host resides, the broader standard of "unwelcome" is more >widely applicable than the narrow standard of "illegal." > >of course, illegal things ought also not be done. but that'd be a new thread. >

1 0

Re: How worried is too worried? Plus, a Global Crossing Story.
by Christopher Wolff 26 Oct '01

26 Oct '01

James, As someone recently said, cmd.exe and root.exe are my two top URL's haha Actually I have a NBAR list on my border routers that handle those extremely well. ---------- Original Message ---------------------------------- From: James Thomason <james(a)divide.org> Date: Thu, 25 Oct 2001 23:56:03 -0700 (PDT) > > >Perhaps you can speak with your friends at Global Crossing, and have >filters placed on your upstream routers to prevent stray "DDOS attacks >from Digital Island". > >Just curious, but aren't you a little more concerned about all of those >"GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../ >winnt/system32/cmd.exe?/c+dirHTTP/1.0" requests than a few ICMP datagrams >from Digital Island? > >Regards, >James > >On Thu, 25 Oct 2001, Christopher Wolff wrote: >> >> I truely enjoyed the wide range of reponses to my Digital Island post. Everything from DI is perfectly justified to 'tell DI to stick it' haha. >> >> I certainly do not run the largest ISP, nor the smallest, but my small company is managing customer connectivity on both coasts of the continental US. My customers know me as the one that cares about their network infrastructure and can answer most questions quickly. I enjoy offering personal service. >> >> I also take pride in managing my network well. I know, for the most part, what kinds of traffic are passing through my network. This helps me take a proactive stance to issues before they become my customers' business impediments. >> >> Therefore, I have to respectfully take exception to the opinion of "Welcome to the Internet, there's nothing you can do, just don't worry about 441 packets." >> >> I partner with companies that share my view of network management. Recently I had an issue with a customer that was claiming poor throughput. Global crossing did everything in their power to analyze their network, my network, and my customers server farm. Although this turned out to be a TCP/IP tuning issue on the particular host, Global Crossing did not charge me a premium for investigating this issue. >> >> Throughout this resolution, Global Crossing earned my respect and confidence that I am *partnered* with a vendor instead of just buying bandwidth from them. >> >> Just my $0.02, >> >> Christopher J. Wolff, VP, CTO >> Broadband Laboratories >> >> > >

1 0

uunet/packbell problems in the bay area
by Barb Dijker 26 Oct '01

26 Oct '01

Does anyone know the real story about a major outage in the bay area? For example, 131.106/16 is off the map and has been since Wed. ETR? ...Barb

3 2