- NANOG - lists.nanog.org

Re: FW: Proactive steps to prevent DDOS?
by Jeffrey Meltzer 27 Jan '01

27 Jan '01

Richard, Ever consider giving a talk about pro-active procedures in preventing DoS attacks at a NANOG conference? You seem to have a great handle on it. For those that haven't read his summary yet, check it out. He touched on some things you don't normally think about.... -- Jeffrey Meltzer Sr. Network Administrator VillageWorld.com, Inc. http://www.SolarisGuide.com/ > After much nagging^H^H^H^H^H^H^Hrequests, I put some concepts about DoS > down in writing. > > http://www.e-gerbil.net/ras/dos.txt > > Maybe it'll be useful. > > -- > Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras > PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6) > > >

1 0

Re: Proactive steps to prevent DDOS?
by Richard A. Steenbergen 27 Jan '01

27 Jan '01

On Fri, Jan 26, 2001 at 11:54:11PM -0500, Valdis.Kletnieks(a)vt.edu wrote: > > On Fri, 26 Jan 2001 16:40:04 PST, Sean Donelan said: > > Most are suggestions for what other networks can do to prevent them from > > being a source of a DDOS attack. There is less help for what the target > > of a DDOS can do. > > Unfortunately, the current draft document for the Center for Internet Security > (www.cisecurity.org) Solaris security checklist suffers from the same problem. > It mandates RFC2644 broadcasts, RFC1918 martian and RFC2827 egress filtering, > but I couldn't find any stuff on the victim end of it. > > If anybody can provide me with a good reference, I'll be happy to add > it and give credit. http://www.sans.org/dosstep/index.htm is what I > have currently on filtering. If you have a *partial* reference > (something that will work for *many* or *most* sites, for example), I > am able to phrase it as "Evaluate the techniques listed at <URL> for > appropriateness". > > Anybody got input to add? After much nagging^H^H^H^H^H^H^Hrequests, I put some concepts about DoS down in writing. http://www.e-gerbil.net/ras/dos.txt Maybe it'll be useful. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

Re: Proactive steps to prevent DDOS?
by Sean Donelan 27 Jan '01

27 Jan '01

On Fri, 26 January 2001, John Hawkinson wrote: > > But in reality there is nothing you can do, but wait for the > > attacker to get bored and stop on their own. > > This is the "state a fact that might be wrong to poll for dissent," approach? Yep. > Some people have, or are working on, automated tools that try to > detect-and-then-filter-at-the-border DDOS attacks when they happen. > > This is something to do that is not useless PR fluff that is not a magic > command. If I called my Genuity sales rep, what part number or product should I order?

3 2

microsoft explains. again.
by Marc Slemko 26 Jan '01

26 Jan '01

Hmm... sounds... umh... "interesting". And certainly something that others could benefit from knowing the details of, at an appropriate time. http://www.microsoft.com/presspass/press/2001/Jan01/01-25WebSitePR.asp says: Statement by Microsoft on Web Site Availability REDMOND, Wash. -- Jan. 25, 2001 -- During the morning of Jan. 25, Microsoft was the target of a denial of service attack against the routers that direct traffic to the company's Web sites. As a result, access to some of the Microsoft Internet properties, including Microsoft.com and MSN.com, was intermittent for many customers throughout this morning. Microsoft's global networking team quickly determined that today's issue was completely separate from yesterday's outage, and has taken a number of steps to address the issue. Currently, all sites are available to customers. This type of denial of service attack is not related to any Microsoft product. Such an attack is an attempt to interfere with the routers in one of Microsoft's Internet data centers. Microsoft's servers were running normally throughout the event, but the attack prevented access to some of the company's Web sites. It is unfortunate that an individual or group of individuals would engage in this kind of illegal activity. Microsoft has made the FBI aware of this situation, and has taken immediate steps to ensure our customers can gain access to our Web sites. These steps will also make sure that our networks have improved protection from this type of attack. We apologize for any inconvenience this has caused customers, and want to assure our customers that we will be taking more steps in the days and weeks ahead to further protect them and continue to provide a great Web experience.

4 3

The Cidr Report
by Tony Bates 26 Jan '01

26 Jan '01

This is an auto-generated mail on Fri Jan 26 12:00:00 PST 2001 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 26Jan01 0) General Status Table History ------------- Date Prefixes 190101 95598 200101 95336 210101 95386 220101 95447 230101 96665 240101 96583 250101 96891 260101 96902 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- *** Bogus 91.16.23.0/24 from AS11770 AS Summary ---------- Number of ASes in routing system: 9727 Number of ASes announcing only one prefix: 5673 (3187 cidr, 2486 classful) Largest number of cidr routes: 967 announced by AS701 Largest number of classful routes: 1624 announced by AS701 1) Gains by aggregating at the origin AS level --- 26Jan01 --- ASnum NetsNow NetsCIDR NetGain % Gain Description For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

Re: Network diversity Software diversity
by Steve Sobol 26 Jan '01

26 Jan '01

Clarification: Roeland Meyer replied to an e-mail I sent earlier today. > I thought you have no PDC's <g>. I said "My PDC is a Linux box". I should have said "was" - I run a very small LAN here in the office that doesn't really require me to run a PDC. It's ready to go if I need to use it in the future; I just am not using it right now. Sorry about that. -- Steve Sobol, BOFH, President 888.480.4NET 866.DSL.EXPRESS 216.619.2NET North Shore Technologies Corporation http://NorthShoreTechnologies.net JustTheNet/JustTheNet EXPRESS DSL (ISP Services) http://JustThe.net mailto:sjsobol@NorthShoreTechnologies.net Proud resident of Cleveland, OH

1 0

RE: Network diversity Software diversity
by Roeland Meyer 26 Jan '01

26 Jan '01

> From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] > Sent: Thursday, January 25, 2001 11:48 PM > > On Thu, 25 Jan 2001 22:40:50 PST, Roeland Meyer said: > > Okay, how do you do security, in Win2K, without a domain > controller? > > How do you do a Win2K domain without active directory? > > Contrary to what many puntits would have you believe, you don't > need to be in a domain and be running AD just to serve up static HTML. > Beware such pundits - they are probably trying to sell you > either a software > or hardware upgrade. ;) > You don't even need to be running Win2K. I hear even NT 4.0 does > a passable job once you install all the IIS patches. ;) Actually, Linux does it better w/ Apache. But, IIS is a better RAD environment. But, that isn't the issue. The track started about DNS at MSFT. Windows networks have Win domain controllers ... > > > From: Eric Germann [mailto:ekgermann@cctec.com] > > > > > > Uhh, I highly doubt they have a requirement to run DDNS on > > > the front ends. If all you're doing is serving up html pages > > > without user authentication, Win2K is perfectly happy with > > > its own internal account database. DDNS is a pre-req for AD, > > As Eric said.... you don't need bells and whistles. And if you're > building a machine that *has* to work, you probably want to avoid > bellls and whistles, as broken bell and whistle parts get jammed in > the gears and cause failures.... MSFT is not running static anything.

4 3

charitable organization for the shrinkage of the global routing table
by smd＠clock.org 26 Jan '01

26 Jan '01

The slopes of the curves maintained by Geoff, Erik and Tony appear to be steepening, and while 10**5 routes is a no-brainer to a modern core router, 10**6 is hard, and nothing known will deal with 10**7. We all save enormous money by making sure CIDR keeps the curve as flat as reasonably possible. It seems that getting people to be good aggregators is pretty tricky, in part because alot of the offenders don't seem to have the time to follow the operational forums in which their names come up again and again. At the last IEPG I suggested we collectively send "slot-occupation" bills for small numbers of dollars per long prefix to the worst offenders, in hopes they get the message, or pay each of us for necessary equipment upgrades, operational costs, R&D, and so forth. Since nobody seems as crazy as me, it was counter-suggested that I start a charitable clearing-house, which would send out bills on behalf of "everyone" to the baddies. Hey, maybe some folks will pay, maybe some will aggregate (having gotten the message), while others will have to be handed over to maximally aggressive collections agencies, or even *gasp* be subjected to filtering by one or more providers. I have a simple alternative proposal to put pressure on the "bad guys". Project: set up streaming porn servers that, when a source connects from -------- an address block announced by an AS in the list of Tony Bates's top-N bad aggregators, results in a message like this: Dear Prospective User - You are connecting from [A.A.A.A], an IP address in a netblock [P.P.P.P/M] which should be aggregated by your ISP or one of its upstream providers into a longer prefix. Please see the CIDR Report Project at http://www.employees.org/~tbates/ for an indication of the growth of the global routing table, which is an expensive phenomenon exacerbated by your upstream provider(s). REWARD REWARD REWARD If you can convince your upstream provider(s) to aggregate, renumber, or otherwise withdraw [P.P.P.P/M], we will give you FREE XXX hours of FREE access to the streaming porn on this site. Otherwise, please have your credit-card handy. All proceeds go to the charitable fund for the elimination of long prefixes and the drainage of the routing table swamp, much of which is spent on maintaining this excellent source of adult entertainment. Now then, to kick-start the project, we need some bandwidth (easy enough), some sort of content distribution network or server farm (also easy), a studio in a convenient legal jurisdiction (straightforward), lighting, technical support, that kind of thing (simple opex). Oh, and models. Oh Vint, are you busy? We need your sexy strip tease. It's for the good of the Internet, promoting its long-term sustainability and growth. Other suggestions welcome. Sean.

4 3

RE: From Microsoft's site
by Roeland Meyer 26 Jan '01

26 Jan '01

> From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] > Sent: Wednesday, January 24, 2001 11:22 PM > I have *NO* evidence that Ramen was the actual cause other > than it's this > week's problem. However, I'm pretty sure that *whatever* happened, > the poor router tech was *already* having a Very Bad Day > before he ever GOT to the part where he changed the config..... You know, there are times, when I am so tired or stressed out that I will refuse to "su -". It took many, many, years of fixing the resultant problems, to formulate that policy and set the threshold. At that point, I don't care where the dead-line is, or how much $$$ is on the table. Because, I *know* that I'll scrog (neat word) it when I do. That router-tech needs to learn where their thresholds are.

3 2

RE: Network diversity Software diversity
by Roeland Meyer 26 Jan '01

26 Jan '01

Okay, how do you do security, in Win2K, without a domain controller? How do you do a Win2K domain without active directory? How do you install active directory without DNS SRV updates(it won't let you)? Which are the ONLY two DNS packages that can do SRV updates correctly (and one of them is doubtful)? > -----Original Message----- > From: Eric Germann [mailto:ekgermann@cctec.com] > Sent: Thursday, January 25, 2001 6:00 PM > To: Roeland Meyer > Cc: 'nanog(a)merit.edu' > Subject: RE: Network diversity Software diversity > > > Uhh, I highly doubt they have a requirement to run DDNS on > the front ends. If all you're doing is serving up html pages > without user authentication, Win2K is perfectly happy with > its own internal account database. DDNS is a pre-req for AD, > but AD is not a requirment. In fact, I would probably strip > it off to save resources if all I was doing was pumping out > pages. Furthermore, why would you run DDNS to map names to > IP addresses for devices that should stay on static > addresses? DDNS is used in Win2K for resource location, such > as AD and the various role servers. None of those have any > use outside on the Internet > > (assuming of course they don't let you map a drive to their > web servers, which by the way you used to be able to do to > their FTP server many eons ago. I remember the fun of > copying their FTP site with XCOPY from a mapped drive to a > local drive with a 56K line [probably on both ends at the > time] in between). > > Reaching further back, I also remember NFS mounting the WUSTL > archive to our brand new RS/6K in the comp sci department. > Really drove home the idea of mounting NFS hard and the > transparency of the link when the tape filled up using our > 56K campus line over a weekend. Really pissed off the sys > admin also. :) Then again, thats when you had to be at least > 18 to get on the Internet ... > > Eric > > > At 09:30 AM 1/25/01 -0800, Roeland Meyer wrote: > > >> From: woods(a)weird.com [mailto:woods@weird.com] > >> Sent: Wednesday, January 24, 2001 9:47 PM > >> > >> [ On , January 24, 2001 at 17:19:29 (-0800), Sean Donelan wrote: ] > >> > Subject: Network diversity Software diversity > >> > > >> > Using FreeBSD and BIND on *ALL* your name servers may be just as > >> > bad a practice as using Windows 2000 and Microsoft DNS on *ALL* > >> > your name servers. I still think NSI is taking a tremendous risk > >> > using identical servers for all their GTLD-servers, even though > >> > they are geographically distributed. > >> > >> Yeah, I was going to mention that, but I thought I'd already been > >> preaching too much to the converted! :-) > > > >Unless another name server, besides BIND8p7, can do SRV > updates properly, I > >don't think it is possible to build that heterogenous > software environment, > >when Win2K Active Directory is involved. In fact, even BIND8 > has problems. > >It's only possible, with WinNT4, because WinNT4 doesn't have > [very] many > >silly requirements and can live with a standard name server. > > > >> > You might try using UltraDNS on half your critical > nameservers and > >> > BIND on the other half. And even using Solaris on some of the > >> > boxes and AIX or Linux, or NetBSD on the others. This is > not because > >> > I think one or the other has a fatal flaw, but because > software is > >> > a hard beast to manage. The idea behind diversity isn't you will > >> > never have an error. But the errors are unlikely to strike both > >> > servers at the same time. > >> > >> Therein lies the rub -- adding extra complexity to your > systems also > >> makes them more difficult to manage, prone to error, and subject to > >> interoperational problems. > >> > >> Diversity of all forms definitely has its advantages, but > it has its > >> costs too. The trick is to find a fair balance. :-) > > > >In this case, at this time, that is not possible under > Win2K. It's the MSFT > >way or the highway ... However, if you think about it, this > will definitely > >delay MANY Win2K Data Center migrations. > > > ============================================================== > ============ > Eric Germann Inacom > Info Systems > egermann(a)inacomlima.com Lima, OH 45801 > Ph: > 419 331 9050 > ICQ: 41927048 Fax: > 603 825 5893 > > "It is so easy to miss pretty trivial solutions to problems deemed > complicated. The goal of a scientist is to find an > interesting problem, > and live off it for a while. The goal of an engineer is to evade > interesting problems :)" -- Vadim Antonov <avg(a)kotovnik.com> on NANOG >

2 1