- NANOG - lists.nanog.org

Re: Smurf Amp Nets
by Richard Thomas 18 Jun '98

18 Jun '98

-----Original Message----- From: Richard Thomas <buglord(a)ex-pressnet.com> To: Jon Lewis <jlewis(a)inorganic5.fdt.net> Cc: nanog(a)merit.net <nanog(a)merit.net> Date: Thursday, June 18, 1998 1:09 PM Subject: Re: Smurf Amp Nets >Might want to add a delay considering the amount of bandwidth they will be receiving if they tried to send out all those probes at once. In a previous message it was stated that a probe uses 4x64bytes, plus amplification by the broadcasts. I just took the SAR offline for about 4 minutes while trying running a SMALL portion of my bcasts through your script on my 28.8k modem, and it didn't even come close to completing that portion. That fact aside you won't get very accurate results if the SAR is so flooded it can't receive the replies. I would suggest they use ping >-s 1 or -s 8 if the timing information is desired. Woops my bad missed the ''s to protect &, I really WAS firing 'em off all at once =)

1 0

RE: DoS attack.
by S.J.Brannon 18 Jun '98

18 Jun '98

I have been thinking of a witty answer to this email. This will do Tony !! ---------- From: Tony Li[SMTP:tli@juniper.net] Sent: Thursday, June 18, 1998 10:22 To: brad Cc: nanog(a)merit.edu Subject: Re: DoS attack. brad(a)poofy.tbn.tm (brad) writes: > If you only feel confident cutting and pasting the configuration > into your router, here is the config line: > > no ip routing ;-) Thanks, I needed that. Tony

1 0

Re: GRE packets
by Danny McPherson 18 Jun '98

18 Jun '98

Perhaps to combat this, unless I'm missing something, one could justifiably deploy GRE filters with source & destination addresses of the exchange subnets. Filtering GRE in general seems nothing more than foolish. -danny [snip] (we certainly allow GRE packets and expect everyone else does, too) > This could kill IP-GRE VPNs indiscriminately.

4 3

Re: DoS attack.
by Tony Li 18 Jun '98

18 Jun '98

brad(a)poofy.tbn.tm (brad) writes: > If you only feel confident cutting and pasting the configuration > into your router, here is the config line: > > no ip routing ;-) Thanks, I needed that. Tony

1 0

Re: Smurf Amp Nets
by Richard Thomas 18 Jun '98

18 Jun '98

-----Original Message----- From: Jon Lewis <jlewis(a)inorganic5.fdt.net> To: Oystein Homelien <oystein(a)homelien.no> Cc: Andrew Herdman <andrew(a)whine.com>; nanog(a)merit.net <nanog(a)merit.net> Date: Wednesday, June 17, 1998 7:51 PM Subject: Re: Smurf Amp Nets >On Thu, 18 Jun 1998, Oystein Homelien wrote: > >> You need to push the "probe=" parameter to the cgi as well. What you are >> doing above is merely looking up already-registered networks in the SAR >> database. Again, you are NOT probing the networks through the SAR by >> running the above lynx command! >> >> To do what you want, you must use URLs of this form: >> >> http://www.powertech.no/smurf/probe.cgi?network=1.2.3.4&probe=PROBE > >ack! I somehow missed that when pasting the URL from Netscape into my >editor. Here's an updated version. Chris Bongaarts <cab(a)tc.umn.edu> sent >the 172.16/12 regex I was too lazy to include before. > >#!/usr/bin/perl > >while (<STDIN>) { > ($net,$junk)=split /:/,$_,2; > if (($net=~/\d+\.\d+.\d+/) && > !($net=~/^(0\.)|(10\.)|(192\.168)|(172\.((1[6-9])|(2[0-9])|(3[01]))\.)|(255\ .255\.255)/)){ > system("lynx -dump 'http://www.powertech.no/smurf/probe.cgi?network=$net&probe=PROBE'"); > } > elsif ($net=~/---/) { > die "\ndone.\n"; > } >} > >I'm using this to make sure all the nets I recently posted about are >registered. Based on the times reported by SAR, I think I'll be adding a >bunch of new nets to it. Might want to add a delay considering the amount of bandwidth they will be receiving if they tried to send out all those probes at once. In a previous message it was stated that a probe uses 4x64bytes, plus amplification by the broadcasts. I just took the SAR offline for about 4 minutes while trying running a SMALL portion of my bcasts through your script on my 28.8k modem, and it didn't even come close to completing that portion. That fact aside you won't get very accurate results if the SAR is so flooded it can't receive the replies. I would suggest they use ping -s 1 or -s 8 if the timing information is desired.

2 1

Re: GRE packets
by Sean Donelan 18 Jun '98

18 Jun '98

>Moreover, if IPSEC is in use, you can't even sniff. With IPSEC you infer things from traffic analysis. Or if you don't feel like doing grevious harm to IPSEC, you block the traffic and wait to see who complains. Many telephone companies do this type of blocking to control fraud on international calls. Your calling card will suddenly just stop working. You'll call up your communications provider, and while usually acting totally clueless, they'll re-enable your calling card. Most of the time, the spikes in traffic are fairly obvious. People share the 'secret' with their friends and like hogs at the trough they can never use it just a little. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

DoS attack.
by brad 18 Jun '98

18 Jun '98

Our network is currently experiencing DoS attacks originating from many providers (both national and local). It seems that we are seeing spurious and bursty packets coming across our network with headers that seem to contain 6 octet layer 2 source followed by four octet layer 3 source. Normally we see minimal or non-existant traffic on our network (the broadcast network) but in this case, packets of questionable integrity are lining up in our queues and our banyan-batcher doesn't have enough fabric to deal with it. Our senior network engineer (Frank Rizzo) charged me to enlist the network operating community to help fight the spread of these debilitating attacks across the internet. Please help us if you can. Here is a sample of the command (much like no ip directed-broadcast stops 'smurf' attacks) rotsb(config)#no ip routing rotsb(config)#^Z rotsb#wr m Building configuration... [OK] rotsb# If you only feel confident cutting and pasting the configuration into your router, here is the config line: no ip routing Thank you all for helping to make the internet a better place for small isps like me. B. Bork

1 0

GRE packets
by Eric Germann 18 Jun '98

18 Jun '98

Anyone have a definitive list or info on network operators who definately allow or definately disallow GRE packets across their networks. Sorry for the semi-operational content :) Eric ============================================================================= Eric Germann Computer and Communications Technologies ekgermann(a)cctec.com Van Wert, OH 45891 Phone: 419 968 2640 http://www.cctec.com Fax: 419 968 2641 Network Design, Connectivity & System Integration Services A Microsoft Solution Provider "Linux.. the choice of a gnutered generation." - brad(a)poofy.tbn.tm

4 4

Re: GRE packets
by Sean Donelan 18 Jun '98

18 Jun '98

>> Perhaps to combat this, unless I'm missing something, one could justifiably >> deploy GRE filters with source & destination addresses of the exchange >> subnets. > >What's the point of this? Wouldn't it make more sense to just run a >sniffer on the exchange fabric looking for such GRE tunnels and then >kick the offending parties out of the exchange? Seems to me this has >happened at least once at LINX. It is a bit tricky figuring out exactly who can do the sniffing. There are a lot of parties, and agreements, and handshakes floating around any exchange point. In the USA, a number of communications laws were written in the days of Ma Bell. There was only one system, one network, one operator. While the Ma Bell exception is huge, an operator can do almost (but not quite) anything to protect its rights or property, it is unclear exactly how it applies at a 'exchange-point' between multiple operators. I feel sorry for the first FBI agent who has to serve a court order at 1919 Gallows Road. Interesting enough, at other multi-carrier meet-points, e.g. border crossing and trans-oceanic cable headends, there is often a very oddly worded warning/no trespassing sign about Presidential war powers and national defense installations. But back to the current issue, Internet exchange points between network providers. Can only the exchange point operator use the Ma Bell exception? Can the exchange point operator do this only with the consent of one or more of the attached carriers? Can an individual carrier monitor addressed to them? What about broadcast traffic? Some providers have gone so far as prohibit any modification to the infrastructure, but it is unclear exactly what this means. Is it yet another one of the useless paragraphs in the agreements? Most providers don't seem to show the same concern when someone points 'default' at them, bringing the full arsenal of debugging and monitoring tools to bear on tracking the source. OC3-MON anyone? I tend to view GRE tunnels like any other traffic. A tunnel to/from any of my customers is like any other traffic to/from those customers. However, a tunnel between two end-points, neither of which is on my network, is a form of third-party transit traffic and gets blocked when I figure out the new way they are doing it. I know, in theory you can encapsulate anything in anything. But even IP inside USENET still has the transitive property, which is what concerns folks. But like many problems on the Internet, it is often easier just to block it than try to track down the source. If it is an honest issue, the source will usually contact you in a while. And sometimes you can figure out a better way of doing it. More often, you hear about the source moving on to do the same thing to another provider until they block it. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

2 1

Re: Government scrutiny is headed our way
by owen＠DeLong.SJ.CA.US 18 Jun '98

18 Jun '98

> > For those who don't bother filtering "because it's too hard or too > > complicated", if you don't want or can't afford to put the work into tight > > ingress filtering on all interfaces, it's really easy to just say "our IP > > blocks are A, B, and C. Allow input with source addresses in A, B, or C, > > deny everything else." That will at least protect the rest of the > > internet from your lusers. > > Right. That's what we do on the dial plant today, because there isn't a > syntax available on our RAS hardware which says "allow anything with this > RADIUS assigned or dynamic address block (depending on the account) and deny > everything else". So we have to relax the filters to be "allow anything from > netblocks A, B, and C, block everything else" since the syntax we really > want isn't available. > I believe RADIUS has a facility for setting ifilt and ofilt based on the particular user based on the Framed-Filter-ID. So, for dynamic users, you could set a filter that allows the Dynamic IP range of that NAS for single-host users. For network users, you could either use blocks like are listed now, or you could set up a filter per user through the choicenet features (Livingston). At the very least, with a rational allocation policy, it should be possible to limit the filters to some subset of Every IP we own. > We do that for all dial and ISDN inbound connections today, and have been > for a long time. > Some people don't. That's the problem. > Still, that's good enough. You can't launch a DOS attack against ANOTHER > provider from our plant this way. We also have directed broadcasts shut > off network-wide, so attempts to bounce pingstorms off our internal plant > (even to internal targets) don't work either. > > That's the 95th percentile solution, and is a hell of a lot more than most > other ISPs do. Most don't do ANY filtering of any kind. I've tested this > against accounts on other providers, and most will happily forward packets > with ANY source address from dial customers. > Exactly. > I understand the CPU problems filtering ingress on a DS-3 to a customer, > for example, if the box has a bunch of other interfaces. But in that case > you should insist (contractually) that the *CUSTOMER* router have the > filters on ITS interface which talks to you, and TEST it from time to time. > Actually, with Cisco's running the newer Fast Drop code, filtering on a DS-3 is not that big a deal. Especially when you consider that this can be done with a simple access-list. Owen

1 0