- NANOG - lists.nanog.org

RE: DOS Attacks and reliable network contact data.
by rdobbins＠netmore.net 22 Oct '00

22 Oct '00

That's why MPLS is such a Good Thing - attacks which would cripple 72xx-series & 75xx-series routers can actually be handled without flinching, as the CPU overhead is reduced tremendously by making use of the switch's muscle and efficiency. One of my customers was getting DoSed all the time; his router (7206, NPE-150) was seeing 75%-100% CPU utilization during these times (average was 50%). We took that 7206 and used it as the MLS-RP for a Catalyst 5509 he had lying around (Sup-III, NFFC II), and now he just hums along when they try and zorch his router. An attack which would max him out at 100% before now drives his CPU to perhaps 25%. His -average- CPU load went down from the aforementioned 50% to 5%, all without changing the router in any way other than turning it into the layer-3 engine for the switch. A pretty decent solution, for having been put together from existing equipment. ----------------------------------------------------------- Roland Dobbins <rdobbins(a)netmore.net> // 818.535.5024 voice -----Original Message----- From: Basil Kruglov [mailto:basil@cifnet.com] Sent: Saturday, October 21, 2000 4:05 PM To: nanog(a)nanog.org Subject: Re: DOS Attacks and reliable network contact data. On Sat, Oct 21, 2000 at 05:14:53PM -0400, Jason Slagle wrote: > 21259901:21259901(0) ack 1412091198 win 2144 <mss 536> > 22:30:52.822459 255.255.255.255.80 > 205.133.127.30.6667: R 0:0(0) ack > 2473479669 win 0 > 22:30:52.822711 210.251.128.255.80 > 205.133.127.30.6667: R 0:0(0) ack > 529389642 win 0 > 22:30:52.822962 195.53.123.0.80 > 205.133.127.30.6667: . ack 1625272127 > win 9112 (DF) > 22:30:52.823213 152.158.37.127.80 > 205.133.127.30.6667: R 0:0(0) ack > 1362286194 win 0 We do get this sort of crap daily at least 5 times a day, distributed tcp/ack, tcp/syn, etc, over 40-50Kpps+ sometimes.. my list of over ~230 slave networks (in /24 format). Kids are after taking CPUs in routers out and not killing you with hundrends and hundreeds of Mbps, high-pps attacks are also very nasty, and of course everything is over some stupid IRC issue. > Their exists no reliable way to get the contact of a network without first > querying arin, then apnic, then the .jp registry for instance. This is a > royal PITA and is in no way scriptable that I can see. What is neat is all those 'slaves' are spoofing inside their own /24 or whatever allocation they sit in, and it's very hard to persuade somebody to look into this as they claim those ip addresses are not in use or have only routers/switches and there is no way those devices could've generated a [d]DoS attack. -- Basil Kruglov [BK252-ARIN] Network Engineering and Security CIFNet, Inc.

1 0

RE: DOS Attacks and reliable network contact data.
by rdobbins＠netmore.net 22 Oct '00

22 Oct '00

Port 6667 is used quite a bit for IRC traffic, FYI. I think one of my customers got hit with 12mb/sec of this last night, too - didn't do anything, as I've done all the usual stuff to avoid becoming an amplifier. It ran into ACLs in one of my MPLS-enabled switches, which pretty much just ate it. The attack was definitely distributed, because it came in through two of my upstreams. Based upon purely subjective experience, the info I get back from whois from ARIN, APNIC, etc. has been looking more uniform, of late; I should think that some good regexp might do the trick. ----------------------------------------------------------- Roland Dobbins <rdobbins(a)netmore.net> // 818.535.5024 voice -----Original Message----- From: Jason Slagle [mailto:raistlin@tacorp.net] Sent: Saturday, October 21, 2000 2:15 PM To: nanog(a)nanog.org Subject: DOS Attacks and reliable network contact data. I've seen an increase in DOS attacks over the past week or so, of a form I really haven't encountered before. Below are some logs. 22:30:52.821705 255.255.255.255.80 > 205.133.127.30.6667: R 0:0(0) ack 1062615418 win 0 22:30:52.821956 202.172.120.255.80 > 205.133.127.30.6667: R 0:0(0) ack 3046052966 win 0 22:30:52.822208 168.17.227.0.80 > 205.133.127.30.6667: S 21259901:21259901(0) ack 1412091198 win 2144 <mss 536> 22:30:52.822459 255.255.255.255.80 > 205.133.127.30.6667: R 0:0(0) ack 2473479669 win 0 22:30:52.822711 210.251.128.255.80 > 205.133.127.30.6667: R 0:0(0) ack 529389642 win 0 22:30:52.822962 195.53.123.0.80 > 205.133.127.30.6667: . ack 1625272127 win 9112 (DF) 22:30:52.823213 152.158.37.127.80 > 205.133.127.30.6667: R 0:0(0) ack 1362286194 win 0 Lots and lots of TCP ACK's from broadcast addresses. Looks like a new kind of indirect SYN/ACK flood based on broadcast addresses. Which led me to sort through my logs and do my best to get the amps shut down, which led me to my current problem/gripe. Their exists no reliable way to get the contact of a network without first querying arin, then apnic, then the .jp registry for instance. This is a royal PITA and is in no way scriptable that I can see. Am I wrong? Does such a thing exist? What can we do bout these attacks. Jason --- Jason Slagle - CCNA - CCDA Network Administrator - Toledo Internet Access - Toledo Ohio - raistlin(a)tacorp.net - jslagle(a)toledolink.com - WHOIS JS10172 -----BEGIN GEEK CODE BLOCK----- Version: 3.12 GE d-- s:+ a-- C++ UL+++ P--- L+++ E- W- N+ o-- K- w--- O M- V PS+ PE+++ Y+ PGP t+ 5 X+ R tv+ b+ DI+ D G e+ h! r++ y+ ------END GEEK CODE BLOCK------

2 1

RE: decreased caching efficiency?
by Roeland M.J. Meyer 22 Oct '00

22 Oct '00

Christian, I invite you to www.photoloft.com Each album is dynamic and the site uses FlashPix technology. Have fun with it. > -----Original Message----- > From: Christian Kuhtz [mailto:ck@arch.bellsouth.net] > Sent: Friday, October 20, 2000 12:14 PM > To: nanog(a)merit.edu > Subject: Re: decreased caching efficiency? > > On Fri, Oct 20, 2000 at 11:59:58AM -0700, Travis Grant wrote: > [..] > > Commerce sites are also dependent on dynamic technology > that cannot be > > cached. Although you will find sites that are entirely > static (buy.com & > > etoys.com) you will generally find that these models are > based on volume and > > that the majority of these sites have never seen a dollar > in profit. However > > the profitable boutique type sites like eStyle.com, are > entirely dynamic. > > Margins are protected by a contractual product line. When > you place an > > order, a query verifies inventory prior to final checkout. > In addition, > > product pages indicate whether items are in stock or not. > You cant cache > > these types of sites. > [..] > > Each and every button, product image etc could be cached, > regardless of the > dynamic nature of the website. Images cost cycles, bw. > > [..] > > Most caching implementations will cost way more than the > bandwidth costs > > they avoid. > > You get no argument there ;-). I never felt that you could > ever justify > caching in terms of bandwidth savings. You can only justify > in terms of > improving a users experience. And in that sense, you are > giving considerable > resources to a content origin, and a free service to them. > > That's why the CDN strategy is much more attractive, where > you have a hosting > relationship of some kind with the content origin. > > [..] > > load on the DB servers. But TTLs will usually have to be > set pretty low (2 > > seconds) in order to do this and the technologies will have > to be catered to > > web development environments (like cacheflow and ASP). > [..] > > Hmm, if you cache what I suggest above, that's not really > neccessary... No? > > Cheers, > Chris > > -- > Christian Kuhtz > Architecture, BellSouth.net > <ck(a)arch.bellsouth.net> -wk, <ck(a)gnu.org> -hm > Atlanta, GA > "Speaking > for myself only." >

1 0

RE: decreased caching efficiency?
by Roeland M.J. Meyer 22 Oct '00

22 Oct '00

Christian, I invite you to www.photoloft.com Each album is dynamic and the site uses FlashPix technology. Have fun with it. > -----Original Message----- > From: Christian Kuhtz [mailto:ck@arch.bellsouth.net] > Sent: Friday, October 20, 2000 12:14 PM > To: nanog(a)merit.edu > Subject: Re: decreased caching efficiency? > > On Fri, Oct 20, 2000 at 11:59:58AM -0700, Travis Grant wrote: > [..] > > Commerce sites are also dependent on dynamic technology > that cannot be > > cached. Although you will find sites that are entirely > static (buy.com & > > etoys.com) you will generally find that these models are > based on volume and > > that the majority of these sites have never seen a dollar > in profit. However > > the profitable boutique type sites like eStyle.com, are > entirely dynamic. > > Margins are protected by a contractual product line. When > you place an > > order, a query verifies inventory prior to final checkout. > In addition, > > product pages indicate whether items are in stock or not. > You cant cache > > these types of sites. > [..] > > Each and every button, product image etc could be cached, > regardless of the > dynamic nature of the website. Images cost cycles, bw. > > [..] > > Most caching implementations will cost way more than the > bandwidth costs > > they avoid. > > You get no argument there ;-). I never felt that you could > ever justify > caching in terms of bandwidth savings. You can only justify > in terms of > improving a users experience. And in that sense, you are > giving considerable > resources to a content origin, and a free service to them. > > That's why the CDN strategy is much more attractive, where > you have a hosting > relationship of some kind with the content origin. > > [..] > > load on the DB servers. But TTLs will usually have to be > set pretty low (2 > > seconds) in order to do this and the technologies will have > to be catered to > > web development environments (like cacheflow and ASP). > [..] > > Hmm, if you cache what I suggest above, that's not really > neccessary... No? > > Cheers, > Chris > > -- > Christian Kuhtz > Architecture, BellSouth.net > <ck(a)arch.bellsouth.net> -wk, <ck(a)gnu.org> -hm > Atlanta, GA > "Speaking > for myself only." >

1 0

DC Zoning Commission planning to limit carrier hotels?
by rdobbins＠netmore.net 21 Oct '00

21 Oct '00

http://washingtonpost.com/wp-dyn/articles/A41553-2000Oct19.html ----------------------------------------------------------- Roland Dobbins <rdobbins(a)netmore.net> // 818.535.5024 voice

3 2

Cheapest ethernet switch with monitor/mirror port?
by Dan Hollis 21 Oct '00

21 Oct '00

Looking for the cheapest ethernet switch with a monitor/mirror port. Recommendations? -Dan

3 2

RE: decreased caching efficiency?
by Travis Grant 20 Oct '00

20 Oct '00

William, Where does caching make sense? Static assets that can be stored on the edge closest to customers ie images, audio, video. These needs are served by your Akamais, IBeams, and Evokes. One other place where it makes sense to cache, in your Corporate environement. There will probably be a flux point for cost savings in respect to bandwidth if a company is able to get the majority of web traffic to remain on the LAN. But in regards to a caching architecture for your web site. Sites that have any revenue tied to advertising will benefit highly from knowing exact demographics, exact visitor counts, etc... In addition advertisers pay more for "targeted advertising" and targeted advertising is done with Dynamic technologies that can not be cached (the banner can be cached and await retrieval). Push technologies are to the advertising industry as napster is to the music industry. Acting as a catalyst in '96, the advertising industry recognized the benefit of targeted advertising that push technologies offer and embraced the internet. There are entire business models built on this principle (pioneers ADFORCE - formerly IMGIS, recent newbies alladvantage, mvalue, etc...). Commerce sites are also dependent on dynamic technology that cannot be cached. Although you will find sites that are entirely static (buy.com & etoys.com) you will generally find that these models are based on volume and that the majority of these sites have never seen a dollar in profit. However the profitable boutique type sites like eStyle.com, are entirely dynamic. Margins are protected by a contractual product line. When you place an order, a query verifies inventory prior to final checkout. In addition, product pages indicate whether items are in stock or not. You cant cache these types of sites. Granted this architecture is hard to scale, but they represent a rare breed of commerce vendors making cash. And by the way saving bandwidth is not justified for the majority of the market. 80% of deployed sites are sucking less than 2Mbps in monthly fees. Most caching implementations will cost way more than the bandwidth costs they avoid. Some dynamic site architectures will benefit from caching if the cache product is able to reduce the number of web servers required in a farm and/or if the cache engine working with the web farm is able to reduce the load on the DB servers. But TTLs will usually have to be set pretty low (2 seconds) in order to do this and the technologies will have to be catered to web development environments (like cacheflow and ASP). Travis Grant System Architect www.kore.com -----Original Message----- From: William Allen Simpson [mailto:wsimpson@greendragon.com] Sent: Friday, October 20, 2000 7:04 AM To: nanog(a)merit.edu Subject: Re: decreased caching efficiency? Dana Hudes wrote: > > I vehemently disagree with the statement that impressions do not make any sense, > only clickthroughs. There is such a thing as brand awareness, a situation where > a banner ad is good for itself even if it doesn't lead to click through. > Of course, in that case, the benefit is to the advertiser. That is, they get the benefit, but you don't get paid. Not my problem. That seems to follow "not make any sense", but YMMV. > It is NOT for YOU to decide what business model makes sense for MY > business relationship with MY advertisers. > Nope. You can have any business relationship you'd like. But, by the same token, it is not for *YOU* to decide that *I* have to pay to support YOUR business decision. Last time I looked, there's no constitutional right that guarantees that you can make money. > I pay my ISP to carry IP packets around. But, you don't pay ME to carry your IP packets around. My customers pay me. I pay my upstream. Therefore, I pay my upstream as little as possible. > In some cases certainly your cache is in fact a copyright violation. > Interesting, if true. Perhaps you could provide a citation? WSimpson(a)UMich.edu Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32

3 3

Re: DC Zoning Commission planning to limit carrier hotels?
by Steve Sobol 20 Oct '00

20 Oct '00

"John K. Doyle, Jr." wrote: > Various cities in the Bay Area are rapidly enacting anti-.com zoning > ordnances. This isn't specific to data centers. The problem is that, out > here at least, the .com explosion is of sufficient magnitude that it has a > tendency to wipe out "business districts." What happens is that the .com > companies are WAY better funded than your average shoe-shine stand, burger > joint, or even neighborhood pharmacy. So, they can afford to pay way more > rent than a traditional business can. Pretty soon, you look up and there > is NO retail to be seen anywhere in the business district. > > Now imagine the ripple effect. I've read about this phenomenon in the SFO area, although what I read mentioned residential housing. (Several friends who live there have confirmed what I've read). Wouldn't it be better to enforce an anti-price-gouging law that capped the amount of rent landlords could charge? -- North Shore Technologies, Cleveland, OH http://NorthShoreTechnologies.net Steve Sobol, BOFH - President, Chief Website Architect and Janitor Linux Instructor, PC/LAN Program, Natl. Institute of Technology, Akron, OH sjsobol(a)NorthShoreTechnologies.net - 888.480.4NET - 216.619.2NET

1 0

RE: decreased caching efficiency?
by Roeland M.J. Meyer 20 Oct '00

20 Oct '00

> Also don't confuse profit with revenue. A mistake that many make. One can have lots of revenue and still have negative profits.

1 0

Re: decreased caching efficiency?
by Dana Hudes 20 Oct '00

20 Oct '00

I can point out plenty of examples of large sites which do not work without JavaScript. Also don't confuse pofit with revenue. On Fri, 20 Oct 2000, Hendrik Visage wrote: > On Fri, Oct 20, 2000 at 12:43:51PM -0400, Dana Hudes wrote: > > > > > > ----- Original Message ----- > > From: "Majdi S. Abbas" <msa(a)samurai.sfo.dead-dog.com> > > To: "Dana Hudes" <dhudes(a)hudes.org> > > Cc: <nanog(a)merit.edu> > > Sent: Friday, October 20, 2000 12:33 PM > > Subject: Re: decreased caching efficiency? > > > > > > > > > > On Fri, Oct 20, 2000 at 10:24:27AM -0400, Dana Hudes wrote: > > > > No, you are interfering with my revenue stream by preventing > > > > my getting credit for the banner impression. > > > > > > Tough. Banner ads aren't a guaranteed form of revenue. > > > > Neither is being an ISP a guarantee of revenue. > > Depends on a couple of factors, but it could be a pretty decent > form of "guaranteed" revenue. > > > > How would you feel if I said my cache at home filters banner > > > content out? > > > > I hope my JavaScript would detect this and refuse to display the photograph. > > Sofar you've given us LOTS of reasons NOT to visit your site (BTW, url > to exclude from our caches ;^) > > This will actually make several people turn away from your site, as > people don't always like java/javascript and have it actually turned > off, like when browsing via a Nokia 9110, lynx etc. > > Hendrik >

1 0