- NANOG - lists.nanog.org

DDOS attacks lately?
by John O Comeau 21 Aug '00

21 Aug '00

It's been a while since the big-name websites got DDOS'ed, but some large data centers I know of still see hosts on their networks getting DDOS'ed once or twice a day. It's not uncommon for those with only DS3 connections to get them completely clogged for several minutes with attack traffic. If it happens on the UUNet connection then it can get blocked quickly but other NOCs often take a half hour or more to answer. And as discussed earlier on this list, the major players will NOT maintain access lists on their routers for their customers. (At least, that's what they tell their DS3-and-smaller customers). One thing I've recommended to my clients is to temporarily add a (shorter prefix) route through one of their upstream providers who _will_ maintain access lists for them. For example, 1.2.3.4 is under attack. 1.0.0.0/8 is the netblock being advertised through teir 1 providers, and the DS3's to those major providers is being swamped with attack traffic. Quickly modify the BGP advertisement through ???.net to advertise 1.2.3.0/24 as a route. Since that is a shorter prefix, it becomes the preferred route to 1.2.3.4, and since ???.net will maintain access lists providing, let's say, CAR for UDP and ICMP, that's all that needs to be done to block that particular attack. That plan quickly falls apart if several hosts are getting attacked at once, though if your total NORMAL inbound traffic is smaller than the committed rate on ???.net, you can split all your netblocks into two subnets and advertise those through ???.net for the duration of the attacks. Or if it's an ACK attack, or something else that can't easily be rate-limited or blocked, you're still screwed until you can reach the provider and have the target null-routed. I know this causes the global routing tables to increase temporarily, BUT it keeps the datacenter's routes from flapping due to losing the BGP sessions with the upstreams, which often happens if nothing is done about the attack. Another interesting point to note is that lately, most attacks have been for the age-old purpose of taking over IRC channels by knocking out the host on which the operator's bot is running. At least, none of my clients have seen their websites getting attacked lately. Maybe the calm before the storm? Of course, there is also the option of stopping them at the source, which is time-consuming and is usually done after it has been blocked via other means. And for every compromised server or workstation (usually on .edu domains) that gets fixed, two more take its place. Plus, we rarely get helpful responses from non-US domains (primarily because we're unwilling to make the international long-distance calls and find out we don't have any languages in common). It's looking like the only way to improve is to buy bigger connections; but in light of the Yahoo attack (800Mbps was the last word I guess?) how big is big enough? How many OC48 connections can _your_ data center afford? jcomeau(a)world.std.com aka John Otis Lene Comeau Home page: http://world.std.com/~jcomeau/ Disclaimer: Don't risk anything of value based on free advice. "Anybody can do the difficult stuff. Call me when it's impossible."

9 13

Re: DDOS attacks lately? ('Is'...your FCC & FBI too 'P.C.'?)
by John Fraizer 20 Aug '00

20 Aug '00

Whoa. I really wish you had not attached my name in any way shape or form to your statement. While I agree that criminals are criminals and there is no place for them in society, I don't recall this thread having anything to do with sexual preferences or practices of foreign nationals on US soil. Please let me be one of the first to tell you that you have stepped WAY outside the bounds of rational and of the scope of NANOG. Sometimes it's not what you say but, how you say it. In this case, it's both. --- John Fraizer EnterZone, Inc On Sun, 20 Aug 2000, kysi ferul wrote: > Casey Farrell, Authority, "Dorset Dialecet, Wm. > Barnes" > > Attn: Fellow ICANN/IETF/NANOG Members, > > My findings are this- > > 1. Most of the "immigrants" in this country are here > to practice a lifestyle which is not tolerated at > home. > (This is generally Homosexuality; & other > 'practices') > If they are for instance combining Adult Male > Homosexual parctices with asy VooDoo rituals and Child > Endangerment, or Child Abuse, or Child Rape, or Child > Abuduction or Child Kidnap, and Child Homocides, we > don't REALLY need that kind here-and there is NO REAL > "OFFICIAL" (unforged,tamper free evidenciary > documents) > papers which PROOF the CITIZENSHIP of these 'perps!' > > 2. But 'they' (NOT 'illegal Aliens'...ENEMY ALIENS!) > then apply for "SANCTUARY" within the AMERICAN > POLITICAL and CORPORATE 'SCENE' which by and large is > a CONCLAVE of 'GAY' men! This is a DISGUSTING STATE of > AFFAIRS! But nevertheless, these 'refugees' > (criminals) > get to hide under the 'wings' of the US GOVERNMENT! If > anyone complains...they are "RACIST!" ('sexist?')See, > you cannot have a NATION DIVIDED by STRAIGHTS & GAYS! > (No one said ONE DAMN THING ABOUT AMERICAN LESBIANS... > if they are JUST LESBIANS...why then do they PROMOTE > GAY MALE LIFESTYLE? Why few "CIVIL RIGHTS" workers and > > 'teachers' etc...not helping the truly DOWN-TRODDEN?) > > 3. Hey! we 'love everyone equally'...isn't THAT > enough? But NO COUNTRY, CITY, STATE, COMPANY, POPSICLE > STAND CLUB SOCIETY FAMILY etc, can tolerate LIARS who > are ALSO MISCHIEF MAKERS! Either you steal the silver > and depart...or you just get in for the free meal and > hang around...but you don't turn it into a "JOB FOR > LIFE!" > > 4. AMERICA (and therefore the WORLD!) NEEDS and WANTS > a FREE AND CLEAN INTERNET! No FOREIGN ESPIONAGE > 'workers' no SPIES on US SOIL! > > Thank you. Your commnets are welcome. > > > --- John Fraizer <nanog(a)EnterZone.Net> wrote: > > > > > > On Sun, 20 Aug 2000, Mikael Abrahamsson wrote: > > > > > > > > On Sun, 20 Aug 2000, Dan Hollis wrote: > > > > > > > The civilian authorities dont see it as a big > > enough problem to bother > > > > going after the military to shut down their > > smurf amps and shut down their > > > > rooted boxes. > > > > > > My suggesion was that this would change. The > > military is interconnected to > > > others at certain points. If they would tear down > > these connections then > > > perhaps they would wake up? > > > > > > > The problem here is that it becomes a matter of > > decreased national > > security. Some enterprising Corporal out there > > looking for an M.promotion > > might consider cleaning up the net under his/her > > watch however. > > > > > > And remember, McDonalds has *deep* pockets. How > > deep are yours? > > > > > > Uncle Sam got to the tobacco industry. Nuf said. > > > > Uncle Sam jumped in to reduce the case load on the > > courts. It was > > millions of individual citizens who got the tobacco > > industry. > > > > > > What about russian or chinese or (insert > > unfriendly country here) networks? > > > > Go ahead and sue them. Fine them into the > > stratosphere. Theyre *not* going > > > > to pay up, and they certainly arent going to > > change their complacent or > > > > negligent behaviour. > > > > > > Trade sanctions. Filtering. Same thing, different > > name. > > > > Oh ya... Trade sanctions have done wonders for us. > > It sure made Saddam > > back down and cry like a baby. > > > > > My major point is that we have to do something > > about the tool they use, > > > not going after why they use it. Taking away > > reasons to flood wont work, > > > we have to take away (or limit) their ability to > > do so. > > > > Make it a crime to run an IRC server. Take away the > > targets, you will > > have very few shots fired. > > > > --- > > John Fraizer > > EnterZone, Inc > > > > > > > ===== > redwingblakburdz(a)yahoo.com > > > > __________________________________________________ > Do You Yahoo!? > Yahoo! Mail � Free email you can access from anywhere! > http://mail.yahoo.com/ >

1 0

Re: DDOS attacks lately?
by Mikael Abrahamsson 20 Aug '00

20 Aug '00

On Sun, 20 Aug 2000, Dan Hollis wrote: > The civilian authorities dont see it as a big enough problem to bother > going after the military to shut down their smurf amps and shut down their > rooted boxes. My suggesion was that this would change. The military is interconnected to others at certain points. If they would tear down these connections then perhaps they would wake up? > And remember, McDonalds has *deep* pockets. How deep are yours? Uncle Sam got to the tobacco industry. Nuf said. > What about russian or chinese or (insert unfriendly country here) networks? > Go ahead and sue them. Fine them into the stratosphere. Theyre *not* going > to pay up, and they certainly arent going to change their complacent or > negligent behaviour. Trade sanctions. Filtering. Same thing, different name. > IMHO, its going to have to end up being stuff like a BGP death penalty on > recalcitrant networks. Shut them off entirely from the net until they > start playing by the rules. This involves some kind of authority to make those decisions. The MAPS/ORBS dispute shows it has to be done somewhat officially. My major point is that we have to do something about the tool they use, not going after why they use it. Taking away reasons to flood wont work, we have to take away (or limit) their ability to do so. -- Mikael Abrahamsson email: swmike(a)swm.pp.se

2 1

Re: DDOS attacks lately?
by Mikael Abrahamsson 20 Aug '00

20 Aug '00

On Sun, 20 Aug 2000, Dan Hollis wrote: > On Sun, 20 Aug 2000, Mikael Abrahamsson wrote: > > A start would be to make it criminal negligence worldwide to operate a > > network that can be abused even after several notices about this fact. If > > you are a smurf amplifier and have been for quite some time after several > > notices, you should be punished. > > I can name military networks which fit the above description. Now whos > going to 'nail them to the wall'? Are you telling me that you have no civilian authorities in the US that can do anything about your armed forces and what they do? They can do whatever they want? > > If you have rooted machines on your network that are used for DDOS > > attacks and you do nothing about it, you should too be nailed to the > > wall. > > tin.it (apparently the incumbent telco for all of italy) fits this > description. Not only have they disclaimed any responsibility for the > activities of their users, they have also publically stated they will do > *nothing* about it. > > So, whos going to nail an entire telco to the wall? Who nails McDonalds to the wall if they start serving toxic burgers? Multinational huge companies can be fined for negligence too. That's why I said "make it criminal negligece worldwide". It's very possible that this is already the case, it just hasn't been tried in a court of law. As the internet becomes more and more mission critical, either we (the business) start to clean up, or we will be forced to clean up by the authorities (or by law suits). -- Mikael Abrahamsson email: swmike(a)swm.pp.se

2 1

Re: DDOS attacks lately?
by Sean Donelan 20 Aug '00

20 Aug '00

On Sat, 19 August 2000, John O Comeau wrote: > It's been a while since the big-name websites got DDOS'ed, but some large > data centers I know of still see hosts on their networks getting DDOS'ed > once or twice a day. It's not uncommon for those with only DS3 connections > to get them completely clogged for several minutes with attack traffic. If In the last couple of weeks the government held a few meetings with selected industry people. The National Security Council decided the FBI's NIPC should be the lead agency for warning the public and other government agencies about "cyber-threats." Unfortunately the historical focus of the FBI has been chasing criminals, not warning the public. They don't seem to have much experience providing details to the public, and default saying as little as possible. It might have been better to select the National Weather Service as the lead agency for warning the public. Or at least some other agency with fewer conflicts of interest. Supposedly "top people" are working on it, but I'm not sure what they are doing. http://biz.yahoo.com/st/000731/16974.html

1 0

Rochelle Park NJ CO in the news again
by Sean Donelan 19 Aug '00

19 Aug '00

Bell Atlantic's (now Verizon) Rochelle Park NJ was in the news again. The central office experienced a clocking failure around Midnight on Friday resulting in errors on circuits in the region. It was repaired about 7am. Verizon says the failure was not related to the current work stoppage. You may remember, Rochelle Park as the central office flooded during Hurricane Floyd last September. AT&T and BA had a bit of a tiff over who left some doors open, and who was responsible for the basement flooding. Bell Atlantic alleged the flooding was caused because AT&T left the rear doors of the building open. Both the FCC and the NJ BPU (NJ's version of a PUC) launched investigations into the flooding and loss of service. I found NJ's report on their web site at http://www.bpu.state.nj.us/wwwroot/telco/TX99090671ORD.PDF I haven't found the FCC's report, even though it was scheduled to be completed by now.

1 0

Re: lame delegations
by John O Comeau 19 Aug '00

19 Aug '00

Obviously I didn't make it clear what is the problem in my previous post. So far I got the following 2 replies: "The NIC should allow for dummy [default] nameservers and allow the technical contact of a nameserver to remove his or her nameservers from a domain without requiring an administrative ack." Yes, but we are not the technical nor the admin contact for these domains; we just provide the IPs. What I propose is that the tech or admin contact of the NETBLOCK has authority to delete the host registration by virtue of the IP being his. "If the IP's are allocated to you, what's it matter where your old customer still points their NS? Just remove the old customer from all of your db's and reallocate your IP's elsewhere." We've been doing precisely that, and that's where the problem comes in. The new customer cannot register his nameservers because the IP is already registered as a nameserver. Then he complains, we look like idiots, and we have to give him other IPs to use. jcomeau(a)world.std.com aka John Otis Lene Comeau Home page: http://world.std.com/~jcomeau/ Disclaimer: Don't risk anything of value based on free advice. "Anybody can do the difficult stuff. Call me when it's impossible."

8 10

RE: lame delegations
by Karyn Ulriksen 19 Aug '00

19 Aug '00

With this in mind, then is it just a failing of BIND that it only recognizes the first PTR record and disregards the rest (unlike the typical A record format used for round-robin) ? << Yes, I know what kind of flack that this will lead to, but the logic isn't that wierd... Karyn > 10.2. PTR records > > Confusion about canonical names has lead to a belief that a PTR > record should have exactly one RR in its RRSet. This is incorrect, > the relevant section of RFC1034 (section 3.6.2) indicates that the > value of a PTR record should be a canonical name. That > is, it should > not be an alias. There is no implication in that section that only > one PTR record is permitted for a name. No such restriction should > be inferred. > > Note that while the value of a PTR record must not be an > alias, there > is no requirement that the process of resolving a PTR record not > encounter any aliases. The label that is being looked up for a PTR > value might have a CNAME record. That is, it might be an > alias. The > value of that CNAME RR, if not another alias, which it > should not be, > will give the location where the PTR record is found. That record > gives the result of the PTR type lookup. This final result, the > value of the PTR RR, is the label which must not be an alias. > > -- > Greg A. Woods > > +1 416 218-0098 VE3TCP <gwoods(a)acm.org> > <robohack!woods> > Planix, Inc. <woods(a)planix.com>; Secrets of the Weird > <woods(a)weird.com> >

2 1

surge in spam email (fwd)
by multics＠ruserved.com 19 Aug '00

19 Aug '00

I haven't exactly seen an increase in spam, per se, what I have seen is the spammers are working harder at getting around the RBL and other spam blocks. Forwarded message: > Has anyone else noticed a surge in the amount of spam email they've been > getting? Anyone know the cause? I use RBL but I'm still getting quite a > bit. > > Tony > > -------------- -- ---- ---- --- - - - - - -- - - - - - - > Tony Bourke tony(a)vegan.net -- Richard Shetron multics(a)ruserved.com multics(a)acm.rpi.edu NO UCE What is the Meaning of Life? There is no meaning, It's just a consequence of complex carbon based chemistry; don't worry about it The Super 76, "Free Aspirin and Tender Sympathy", Las Vegas Strip.

18 25

US NTIA Requests Comments on ".US"
by Robert Cannon 19 Aug '00

19 Aug '00

The National Telecom and Information Agency (an office in the US Dept of Commerce) has issued a request for comments on the ".US" ccTLD. Pasted below is the media advisory with the URL to the full federal register notice. Please distribute widely. -B www.cybertelecom.org ****M E D I A A D V I S O R Y**** WASHINGTON- The Commerce Department's National Telecommunications and Information Administration (NTIA), in a notice to be published shortly in the Federal Register, announced a Notice and a Request for public comment on a draft statement of work that the department contemplates will be ultimately incorporated into a request for proposals to manage .us on behalf of the U.S. government. The .us domain is the "national" or "country code" top level domain (ccTLD) assigned to the United States for domain name registration and is currently managed as a locality-based hierarchy in which second-level domain space is allocated to States and U.S. territories. In its Federal Register notice, NTIA said the draft statement of work is part of an effort to develop a more concrete framework for the procurement of .us domain space administration services. The Federal Register notice requesting comments can be accessed at www.ntia.doc.gov/ntiahome/domainname/usrfc2/dotusrfc2.htm Public comments are due no later than 45 days after the notice is published in the Federal Register. For more information on NTIA's work on the .us domain space issue, please visit the domain name web site, www.ntia.doc.gov/ntiahome/domainname/domainhome.htm ______________________________________________ FREE Personalized Email at Mail.com Sign up at http://www.mail.com/?sr=signup

1 0