- NANOG - lists.nanog.org

Re: Solution: Re: Huge smurf attack
by danderson＠lycos.com 14 Jan '99

14 Jan '99

I should have been more careful when stating 'filtering icmp' in my previous messages. I use something similar to this: >access-list 101 deny icmp any any echo >access-list 101 deny icmp any any echo-reply >access-list 101 permit icmp any any Only I'm allowing the echo-reply so I can ping/traceroute out for my troubleshooting needs. However, I don't buy the 'it breaks testing methods' because there are other ways to test that using icmp for incoming stuff. Plus, if you use named access lists (in new code releases), you can throw in a permit statement then delete it without taking out the whole list. (That is done with the 'ip access-list extended <name>' subset- very nice, check it out) Of course this doesn't do anything for your upstream links, but what can you do about that anyway? Get on your tier 1 provider for that! Plus, you STILL have directed broadcasts turned off in my scenario so the access list is almost futile. And if you are worried about excess CPU utilization, so what? Look into stuff like the netflow switching commands rather than the optimal setting. That can make a tremendous difference. Or you can always buy better gear! How important is your service?? later- devin "Craig A. Huegen" <chuegen(a)quadrunner.com> on 01/12/99 02:01:04 PM To: Steve Gibbard <scg(a)wwnet.net>, Devin Anderson/Lycos cc: nanog(a)merit.edu Subject: Re: Solution: Re: Huge smurf attack On Tue, Jan 12, 1999 at 01:11:09PM -0500, Steve Gibbard wrote: ==>On Tue, 12 Jan 1999 danderson(a)lycos.com wrote: ==> ==>> I'm not sure what the big issue here is with the smurf attacks. If you set ==>> up some kind of access list that disables incoming icmp traffic, then turn ==> ==>That breaks path MTU discovery (see RFC 1435 for more info on that), among ==>other things. Two choices: access-list 101 deny icmp any any echo access-list 101 deny icmp any any echo-reply access-list 101 permit icmp any any -or- access-list 101 permit icmp any any packet-too-big access-list 101 deny icmp any any Neither of these is a particularly elegant solution because they block troubleshooting tools such as ping and traceroute. CAR works well to provide these troubleshooting services during normal operations and to help suppress attacks. /cah

4 3

MCI Fiber Cut in VA
by Martin, Christian 13 Jan '99

13 Jan '99

MCI is reporting a cut in the Danville, VA area. MCI reports 175 DS3s down. Cause: Homeowner building a new driveway. Splicers have been on site since 4:00 PM EST. Seems like traffic in the area is taking the scenic route, as we are seeing 30 ms response times across SMDS T1 lines... Chris

1 0

RE: latency vs. packet loss
by Martin, Christian 13 Jan '99

13 Jan '99

The question you pose cannot be answered as succinctly as you may think. Various factors contribute to packet loss and latency - many of which are completely unrelated. For example, if you purchase ATM CBR connectivity from NY to Australia, you will see high latency, but (assuming you are within your trffic contract) no packet loss. Here the latency is due to propogation delay. Then again, you may have GigE connectivity across the data center floor to a switching cluster supporting a group of application servers that cannot handle the load being delivered by the network. Here, there isn't much latency, but there may be significant packet loss. Also note that the traditional Poisson distribution that early queueing theory was founded on is not always the best model for todays Internet. Traffic patterns at exchange points are becoming more and more fractal in nature, and new queuing technologies such as WRED coupled with rate limiting technologies such as CAR, take your assumptions about available bandwidth, switching latency, and queue/buffer depth and flush them down the drain. The point is, this is a difficult question to answer. If I were to make a VERY general assumption, however, I may be persuaded to agree with your proposed correlation, although many would find objection to this with evidence to substantiate their claim. Regards, Chris -----Original Message----- From: jzeeff(a)whs.verio.net [mailto:jzeeff@whs.verio.net] Sent: Wednesday, January 13, 1999 4:18 PM To: nanog(a)merit.edu Subject: latency vs. packet loss How well does latency correlate to packet loss on the Internet? For example, if one were to pick one of several randomly placed sites on the net based on lowest latency to/from point x, what percentage of this time would this also yield the site with the lowest packet loss to/from point x? My guess is that the correlation is high (due to typical buffer sizes).

1 0

RE: source filtering
by Scott McGrath 13 Jan '99

13 Jan '99

GTE and ATT both filter via access lists on the customers CPE routers IF they provide the routers to the customer > -----Original Message----- > From: Jared Mauch [SMTP:jared@puck.nether.net] > Sent: Tuesday, January 12, 1999 12:31 PM > To: nanog(a)merit.edu > Subject: source filtering > > > I'm interested in what providers actually do source > filtering of their customers. > > Including: > > 1) Using access-lists to filter your customers > 2) Using the "ip verifiy unicast reverse-path" Cisco feature > (it's in 11.1CC images when you use CEF, so I don't get a flood > of e-mails) > 3) Using other router vendors and features you have to > filter source addresses. > > I'd like to summarize this all and start a quest to fix > providers that don't source filter (as people quest against spam, and > against smurfable network blocks). > > jared > > -- > Jared Mauch | pgp key available via finger from jared(a)puck.nether.net > clue++; | http://puck.nether.net/~jared/ My statements are only > mine.

1 0

h.root-servers.net returning false negatives (fwd)
by Marc Slemko 13 Jan '99

13 Jan '99

FYI, below is a copy of a message I sent to the appropriate people. I guess that this time it isn't as bad since it is at least possible that there were automated scripts that didn't detect this, since it is only happening for certain domains. Expect sporadic difficulties resolving names for domains that are impacted if you happen to talk to h.root-servers.net. ---------- Forwarded message ---------- Date: Wed, 13 Jan 1999 09:58:50 -0800 (PST) From: Marc Slemko <marcs(a)znep.com> Subject: h.root-servers.net returning false negatives for some .com domains, and possibly others. eg. marcs@alive:~$ dig stocksite.com ns @h.root-servers.net ; <<>> DiG 8.1 <<>> stocksite.com ns @h.root-servers.net ; (1 server found) ;; res options: init recurs defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 10 ;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUERY SECTION: ;; stocksite.com, type = NS, class = IN ;; AUTHORITY SECTION: COM. 1D IN SOA A.ROOT-SERVERS.NET. hostmaster.INTERNIC.NET. ( 1999011105 ; serial 30M ; refresh 15M ; retry 1W ; expiry 1D ) ; minimum ;; Total query time: 144 msec ;; FROM: alive.znep.com to SERVER: h.root-servers.net 128.63.2.53 ;; WHEN: Wed Jan 13 09:54:54 1999 ;; MSG SIZE sent: 31 rcvd: 108 Other examples include worldgate.com, znep.com, yahoo.com, etc. Not all domains are impacted. h.root-servers.net needs to be taken down ASAP since it is causing any queries for those domains that hit those servers to be given a false nxdomain. Also note that many or most of the root nameservers have a zone file a few days out of date (as does this one...) which may or may not be related.

1 1

Re: Solution: Re: Huge smurf attack
by danderson＠lycos.com 13 Jan '99

13 Jan '99

Well, I speak as a content provider instead of a service provider, your rules are a little different. later- Devin Anderson Network Engineer Lycos, Inc. Brandon Ross <bross(a)mindspring.net> on 01/13/99 02:29:41 AM To: nanog(a)merit.edu cc: (bcc: Devin Anderson/Lycos) Subject: Re: Solution: Re: Huge smurf attack On Tue, 12 Jan 1999 danderson(a)lycos.com wrote: > Only I'm allowing the echo-reply so I can ping/traceroute out for my > troubleshooting needs. However, I don't buy the 'it breaks testing methods' > because there are other ways to test that using icmp for incoming stuff. Yes, but, do you have any idea how many tech support calls would be generated by our customers complaining that they can't ping or be pinged? Our service is advertised as unrestricted Internet access. Our customers rightfully expect to be able to ping out as well as be pinged. If we blocked all echo throughout our network, we would be completed flooded with technical support calls. Doing something like this, similar to the serveral suggestions to filter all .0 and .255 addresses, is an attempt to fix the symptom instead of the real problem. > Plus, you STILL have directed broadcasts turned off in my scenario so the > access list is almost futile. Of course. Brandon Ross Network Engineering 404-815-0770 800-719-4664 Director, Network Engineering, MindSpring Ent., Inc. info(a)mindspring.com ICQ: 2269442 Stop Smurf attacks! Configure your router interfaces to block directed broadcasts. See http://www.quadrunner.com/~chuegen/smurf.cgi for details.

1 0

Smurfing and IP filtering
by Scott McGrath 13 Jan '99

13 Jan '99

I have been lurking on the Smurfing issue for a while In my experience most tier 2&3 ISP's when they sell T1 access to the internet just deliver a basic configuration on the router with NO route filters whatever they do not even put the most basic access restrictions on the router We as a group should create a best practices document (with sample config's) to increase the distribution of cluefulness across the network as a whole to reduce the incidence of these problems and make less firefighting neccessary for ourselves. Scott Mc Grath Yankee Book Peddler 999 Maple Street Contoocook, NH 03229 Phone: 603 746-3102 x3350 Fax: 603 746-5628 mailto:smcgrath@ybp.com

1 0

RE: InterNIC problems with Contact modifications.
by Chris Mauritz 13 Jan '99

13 Jan '99

That begs the question of where all those $70 registration fees are going? Are they taking any concrete steps to fix their process so that it can handle these loads? Domain speculators aren't going away and they can't just continue to ignore their responsibilities to the rest of us honest folk that need timely service. C Chris Mauritz Director, Systems Administration Rare Medium, Inc. chrism(a)raremedium.com -----Original Message----- From: Roeland M.J. Meyer [mailto:rmeyer@mhsc.com] Sent: Wednesday, January 13, 1999 2:56 AM To: John Fraizer Cc: nanog(a)merit.edu Subject: Re: InterNIC problems with Contact modifications. At 04:01 PM 1/12/99 -0500, John Fraizer wrote: > >Is anyone else experiencing problems updating contact information at the >internic? I have been attempting for two weeks now to update information >on three contacts. The templates I'm sending in clearly say "Modify" on >line 0a and in the subject line. They keep being returned with a message >like so: This needs to go on the InterNIC list. The subject as already been broached there. Chuck Gomes says that they have been getting pounded into jelly by Domain Name speculators. It took me three weeks to get my Billing Contact's tele changed. It took a month to get the invoice from new domain registrations. ___________________________________________________ Roeland M.J. Meyer - e-mail: mailto:rmeyer@mhsc.com Internet phone: hawk.lvrmr.mhsc.com Personal web pages: http://staff.mhsc.com/~rmeyer Company web-site: http://www.mhsc.com ___________________________________________________ KISS ... gotta love it!

1 0

Re: source filtering
by prue＠ISI.EDU 13 Jan '99

13 Jan '99

On Tue, Jan 12, 1999 at 01:11:09PM -0500, Steve Gibbard wrote: ==>On Tue, 12 Jan 1999 danderson(a)lycos.com wrote: ==> ==>> I'm not sure what the big issue here is with the smurf attacks. If you set ==>> up some kind of access list that disables incoming icmp traffic, then turn ==> ==>That breaks path MTU discovery (see RFC 1435 for more info on that), among ==>other things. What I have done is write a C program which looks at netflow records as they come in,(close to real time). It checks the source port on the Cisco, the flow record identifies, and compares the source address to a list of acceptable source addresses for validity. I give the program a list of permit and deny like records with IP address and mask along with the ordinal port number. Any that are not legit get printed out. You can then beat on your customer until they clean up their act. If they don't stop right away you can always put in a filter on the interface til they do. We have pretty strong contract verbage which permits us to cut people off if their connection is being used for predatory activity. We haven't had to resort to that yet but being able to say "Fix it or I turn your connection down til you do" is very effective. The nice thing is that it doesn't slow the router down at all, as long as you are doing netflow anyhow. I modified a copy of fdget which is Ciscos netflow demonstration software they have available via ftp. That made the programming task easy for a non programming type like me. Walt Prue

2 1

InterNIC problems with Contact modifications.
by John Fraizer 13 Jan '99

13 Jan '99

Is anyone else experiencing problems updating contact information at the internic? I have been attempting for two weeks now to update information on three contacts. The templates I'm sending in clearly say "Modify" on line 0a and in the subject line. They keep being returned with a message like so: Greetings, The contact shown below has already been registered. You can view the related information at the URL http://rs.internic.net/cgi-bin/whois by typing the contact's last name, first name in the WHOIS query form. If the information in WHOIS is incorrect or you would like to choose a password or use PGP, please submit a modification for your contact record by completing the form at the URL: http://rs.internic.net/cgi-bin/itts/handle InterNIC Registration Services email hostmaster(a)internic.net I'm just about ready to drive to VA and see if I can convince them in person just how frustrated I am with their incompetence. ------------------------------------------------------------------ ML.ORG is gone. Check out http://www.EZ-IP.Net - It's *FREE* ------------------------------------------------------------------ Get your *FREE* Parked Domain account at http://www.EZ-Hosting.Com ------------------------------------------------------------------ John Fraizer | __ _ | The System Administrator | / / (_)__ __ ____ __ | The choice mailto:John.Fraizer@EnterZone.Net | / /__/ / _ \/ // /\ \/ / | of a GNU http://www.EnterZone.Net/ | /____/_/_//_/\_,_/ /_/\_\ | Generation PGP Key fingerprint = 7DB6 1CA2 DAA6 43DA 3AAF 44CD 258C 3D7E B425 81A8

2 1