- NANOG - lists.nanog.org

Re: Ping flooding (fwd)
by Michael Dillon 10 Jul '96

10 Jul '96

Are there any procedures in place to track down this kind of network abuse. In particular, is it possible that it is a stealth attack? Before you answer, take note that this is going to appear in Bob Metcalfe's column next week. ---------- Forwarded message ---------- Date: Mon, 8 Jul 1996 15:30:43 -0600 (MDT) From: Kevin Rosenberg <kevin(a)cyberport.com> Reply-To: inet-access(a)earth.com To: inet-access(a)earth.com Subject: Re: Ping flooding Resent-Date: Mon, 8 Jul 1996 15:30:53 -0600 (MDT) Resent-From: inet-access(a)earth.com > Some months later we had an incident of massive amounts of forged email > from a site called SUNSETDIRECT.COM. For several weeks they sent forged We are currently undergoing a ping flood attack, though our upstream provider has filtered icmp from the host so the flood is no longer affecting our T1 line. The system administrator of the site that appears to be flooding us doesn't believe his site is the source of the attack. He states that he can't see the icmp packets, though I don't know how he is sniffing his wire. My questions are these: Is it possible for someone to forged the source IP address of an icmp packet? If so, do they have to be in some routing proximity, or can they forge the source address while they are connected from anywhere in the world? Thanks! -------------------------------------------------------------------- Kevin Rosenberg | CyberPort Station Chief System Administrator | The Finest Internet Service Possible! kevin(a)cyberport.com | http://www.cyberport.com Finger kevin(a)cyberport.com for PGP Public Key -------------------------------------------------------------------- ============================== ISP Mailing List ============================== Email ``unsubscribe'' to inet-access-request(a)earth.com to be removed. Do not post flames to the list -- if you must flame, use private email.

8 11

Re: Ping flooding (fwd)
by Sean Doran 09 Jul '96

09 Jul '96

| Is there an efficient means of retrieving flow data from a Cisco and | not potentially dropping a bunch of it on the floor? Will there be at | some point in the future? We'd use it if it was available. We'd even | pay for it, I imagine. :-) We are not a Cisco beta list nor are we a Cisco sales team. Please approach this kind of thing through your normal vendor channels. You may find that doing so will actually grant you your wish. Sean.

1 0

Re: Ping flooding (fwd)
by avg＠ncube.com 09 Jul '96

09 Jul '96

That's once again a matter of defaults -- routers should _by default_ discard all packets from interfaces which they won't use for forwarding those packets back. This rule works is 99.9% of cases preventing SA spoofing and some cases of transient loops, and can be disabled where asymmetrical routing is desired. I also have thought of some mechanism to allow destination host to quench sender forcefully, by telling the intermediate router(s) to disallow forwarding to some destination for some period of time (a minute would do nice to render flooding attacks ineffective), but there's a problem with authentication (i.e. there's a need for the router to "call back" to confirm that destination indeed wants to shut up somebody). Finally, routers could implement a kind of "reverse trace" ICMP with the following functionality: on receiption of RT ICMP message take the SA from the ICMP and send back reply message. After that install watchpoint to look for packets going to that address (the "watchpoint" may be implemented as a host route to some special interface). If watchpoint is triggered (i.e. we've got a packet going to the SA) send copy of the RT ICMP to the interface from which the offending packet came from and remove the watchpoint. If watchpoing wasn't triggrded for some time, remove it silently. That simple mechanism would allow to track down sources of forged (or mis-configured) SAs pretty quickly. However it is ineffectual if source-based routing with a large number of variant routes is used. But then, unrestricted SBR is very dangerous anyway (it allows to create artificial congestions by emitting relatively small streams of bogons with routes wound in tight loops). --vadim

2 1

Re: Ping flooding (fwd)
by Justin W. Newton 09 Jul '96

09 Jul '96

At 10:43 PM 7/8/96 -0400, Todd Graham Lewis wrote: >If you have a very restrictive security policy, then you might want to >place a packet filter on all outgoing traffic. If your network is >10.1.1.64/26, then you might have the following two rules: > >action source destination >------ ------ ----------- > >allow 10.1.1.64/26 * >deny * * > >Of course, no one does this, because it is very time consuming for your >router to examine every packet in this way. This translates into more >marginal cost on your hardware for very little return. > >Say that person X, the person who owns the network from which these pings >are apparently originating, did have such a filter. What does this do? >It proves that the packets are not originating on his network. Does it >stop anyone else from forging these packets? No. Actually it doesn't prove that. The filter would /allow/ the pavckets to pass through the router since they were coming from one of his networks. If everyone else on the planet had such a rule it would prove that it /was/ coming from him. Justin Newton Internet Architect Erol's Internet Services

3 2

Re: Ping flooding (fwd)
by Dick St.Peters 09 Jul '96

09 Jul '96

> action source destination > ------ ------ ----------- > > allow 10.1.1.64/26 * > deny * * > > Of course, no one does this, Er ... we do this. -- Dick St.Peters, Gatekeeper, Pearly Gateway, Ballston Spa, NY stpeters(a)NetHeaven.com Owner, NetHeaven 518-885-1295/800-910-6671 Internet for Albany/Saratoga, Glens Falls, North Creek, & Lake Placid First Internet service based in the 518 area code

2 1

Re: InfoWorld Column on Netcom-Cisco & collapse
by Larry J. Plato 09 Jul '96

09 Jul '96

Mr Metcalfe, Did you really send this? The header indicates this came from some Kelmscott farms in Lincolnville, ME not infoworld.com. I find it hard to believe a journalist of your stature would descend to such a very LOW level, Just curious, Larry Plato ----- Forwarded message from Perry E. Metzger ----- > From nanog-owner(a)merit.edu Tue Jul 9 21:17:19 1996 > Message-Id: <199607091944.PAA14086(a)jekyll.piermont.com> > X-Authentication-Warning: jekyll.piermont.com: Host perry@localhost didn't use HELO protocol > To: nanog(a)merit.edu > Subject: Bob Metcalfe: Re: InfoWorld Column on Netcom-Cisco Ampersand Collapse > Date: Tue, 09 Jul 1996 15:44:33 -0400 > From: "Perry E. Metzger" <perry(a)piermont.com> > Sender: owner-nanog(a)merit.edu > Precedence: bulk > > > I thought folks might want to see this. > > ------- Forwarded Message > > Date: Tue, 9 Jul 1996 15:33:32 -0400 > X-Sender: bob(a)kelmscott.com > Message-Id: <v02130502ae082a519beb(a)[204.117.49.7]> > To: perry(a)piermont.com > From: bob_metcalfe(a)infoworld.com (Bob Metcalfe) > Subject: Re: InfoWorld Column on Netcom-Cisco Ampersand Collapse > > > Dear Mr. Piermont, > > Stay out of this. Since I'm such a creep, please ignore me in the future. > > /Bob Metcalfe > > [...] > > ------- End of Forwarded Message >

1 0

Re: Internet access and telco usage patterns
by Hong Chen 09 Jul '96

09 Jul '96

Eric, Well, as many people asked me the mailing list on IETF roaming group. The status is that it is setup today, and you can follow the following instructions to subscribe to it Enjoy, Hong ******************************************************************** Welcome to the roamops mailing list! If you ever want to remove yourself from this mailing list, send the following command in email to "roamops-request(a)ns2.rutgers.edu": unsubscribe Or you can send mail to "Majordomo(a)ns2.rutgers.edu" with the following command in the body of your email message: unsubscribe roamops hchen(a)aimnet.net Here's the general information for the list you've subscribed to, in case you don't already have it: Specifications for roaming ip network clients -------- Begin Included Message ------- > At 10:51 AM 7/5/96 -0700, Hong Chen wrote: > >As a matter of fact, it is quite doable. Aimnet developed a roaming > >server (check www.aimnet.com) that allows international ISPs to > >use each other's network to provide dialup services. A group of > >ISPs have joined a consortium GRIC (Global Reach Internet > >Consortium) lead by Aimnet. The roaming server is based > >on Radius protocol. > > > >A telco company can install modems and route the authentication to > >the specific ISP for authentication. > > Hong, > > I looked at this doing this about a year ago but the major stumbling block > was that if ISPs share the authentication responsibility using distributed > RADIUS, they have the capability of keeping each other's passwords for the > user's that used the global access service. > > Also, a service you likely know about, started up around the same time in > Vancouver, where I was living at the time, called GeoAccess > (www.globalexpo.com/goeaccess) was going to target this idea much more > aggressively than I (and plus I did not feel like competing with him in > particular), and decided on the model on centralized authentication, > effectivele becoming a worldwide access ISP without purchasing a single modem > or terminal server. But even ISPs participating in his "network" can log > the entered passwords. > > Telephone companies might have a problem with the legal ramifications of this > "roaming" service. > > >I just came back from Montreal INet 96 last week and a new roaming > >IETF group will be started. We are working on the IETF draft > >for the roaming and stay tuned. > > Please let me know what the name of working group is, and perhaps take this > to private email. I would be very interested to know how the password > access problem is worked around, or at very least, rationaly pushed aside, > and even contribute. > > Eric Woodward. > ejw(a)globecomm.net > > -------- End Included Message --------

1 0

since it's national pick-on-bob-metcalfe week anyway...
by Paul A Vixie 09 Jul '96

09 Jul '96

...i'd like to put in my two cents. the trouble with bob isn't that he's arrogant and self centered and unable to see anybody else's point of view. nor is it that he's rude, insensitive to the pain he causes others, and generally doesn't know how to act around people. bob is all of those things, as demonstrated here. but so am i, and so are 90% of the folks on the nanog mailing list. so i will not be seen here jumping on bob for being "normal" per the NANOG specifications. what's getting bob in trouble is that he has the attitude but the things he did to earn it aren't relevant to this audience. he can talk the talk but he hasn't walked the walk. if anybody on NANOG has ever listened to a thing i've said about anything, and has put forth the effort needed to overcome the natural aversion to my arrogant, self centered, rude, insensitive demeanor, it is because (and ONLY because) i carry a pager and have stayed up all night, many nights, working on broken routers, working on broken code for routers, and working to keep customers happy. bob's contribution to what we're doing here is larger than mine, and perhaps larger than almost anybody's. where would we be without Ethernet? however, that is not how to earn the right to walk around with a chip on your shoulder in the NANOG crowd. if you don't have tire tracks over 70% of your body and you've never worked 45 hours at a stretch renumbering an international class A net, nobody seems to care what you have to say. to attract that audience ANYWAY, you have to be a lot more polite than bob has been, or likely ever will be.

1 0

Bob Metcalfe: Re: InfoWorld Column on Netcom-Cisco Ampersand Collapse
by Perry E. Metzger 09 Jul '96

09 Jul '96

I thought folks might want to see this. ------- Forwarded Message Date: Tue, 9 Jul 1996 15:33:32 -0400 X-Sender: bob(a)kelmscott.com Message-Id: <v02130502ae082a519beb(a)[204.117.49.7]> To: perry(a)piermont.com From: bob_metcalfe(a)infoworld.com (Bob Metcalfe) Subject: Re: InfoWorld Column on Netcom-Cisco Ampersand Collapse Dear Mr. Piermont, Stay out of this. Since I'm such a creep, please ignore me in the future. /Bob Metcalfe [...] ------- End of Forwarded Message

3 2

InfoWorld Column on Netcom-Cisco Ampersand Collapse
by bob_metcalfe＠infoworld.com 09 Jul '96

09 Jul '96

Dear NANOG, You saw that Craig Huegen has caught me in ANOTHER error. He's of course right (way below) that: The Network Works. No Excuses. is Cisco's slogan, not Netcom's, as I incorrectly wrote in my current InfoWorld column. Netcom doesn't seem to have a slogan. I stand corrected AGAIN. A copy of my incorrect InfoWorld column is below FYI. Nothing slips by NANOG (;->). Not to get back at Mr. Huegen, but he should note that Cisco is not "cisco" anymore. Gotcha! By the way, Mr. Huegen, the well-known fact that the Internet offers no service guarantees has not, as you've written, escaped me. This well-known fact is one of those we are working to FIX. Also, tell us, what was the "original purpose" of the Internet? Not that it matters much. Ever your fan and loyal opposition, /Bob Metcalfe, InfoWorld --------------------------------- InfoWorld, July 8, 1996 (www.infoworld.com) Netcom-Cisco outage could foreshadow much bigger collapses ahead When a tropical storm grows large enough -- winds exceeding 75 mph -- we call it a hurricane and give it a name. It's time we do something similar with Internet outages. Borrowing a threshold used by our Federal Communications Commission in the reporting of telephone outages, when more than 50,000 people are denied their Internet access for more than an hour, let's call it an Internet collapse and give it a name. Let's call the threshold a 50Kx1 collapse, or a 50 kilolapse. Then we can say that, two weeks ago, the Internet suffered a 400Kx13 collapse, or a 5.2 megalapse. Beginning in the afternoon of June 18, the 400,000 customers of Netcom On-Line Communication Services Inc. (http://www.netcom.com) experienced not just the usual worsening afternoon Internet brownout but lost their Internet mail and Web access for 13 hours. (See "Netcom service forced into 12-hour shutdown," June 24, page 3.) Netcom says that this 5.2 megalapse was triggered by an engineer incorrectly typing an ampersand into a router made by Cisco Systems Inc. (http://www.cisco.com) This typo was followed by "a flood of non-Netcom BGP [Boundary Gateway Protocol] routes being introduced into our OSPF [open shortest path first] network backbone. This led to a chain reaction of routing protocol fluctuations, which in turn overloaded a majority of the gateway routers on the Netcom WAN. Our network support staff diagnosed the problem early and worked through the night rebuilding the routing tables of our hub and POP routers." So let's name this the Netcom-Cisco Ampersand Collapse. Netcom CEO Dave Garrison apologized to his customers on KGO talk radio in San Francisco. He explained that the collapse was caused by human error. He admitted that the Ampersand Collapse had overwhelmed Netcom's telephone support. He promised to meet with Cisco, maker of most of Netcom's 100 routers, about preventing future outages. Interviewed by The Boston Globe, Garrison explained the Internet is growing rapidly and there is plenty of room for competition. Then he said, "Internet companies face ruthless competition and don't have billions to spend on reliability upgrades." Uh-oh, this despite Netcom's trademarked slogan: The Network Works. No Excuses. Now, to err is human, and Internet fogies ask us to accept this latest megalapse as nothing new, no big deal. But Garrison's upcoming meeting with Cisco is important. Cisco should continuously improve the software with which its routers are programmed so that catastrophic human errors are less likely. Ed Kozel, Cisco's chief technology officer, writes that "network routing is quite susceptible to human error... complete flexibility is driving routing architecture development... in recent years a lot of work has gone into creating interdomain routing firewalls and untrusted routing gateway functions, the result being that, in general, routing misbehavior is usually confined to a specific domain." So we should be encouraged that the Netcom-Cisco Ampersand Collapse did not escape Netcom and go Internetwide, this time. While Netcom and Cisco are at it, they should find a way to make Internet error messages more informative. Throughout the Ampersand Collapse, Netcom customers were told that their user names and passwords were incorrect, their calls were failing, their network connections were lost, or nothing at all as their starting session screens hung. Now why has Netcom not offered each of its 400,000 customers a refund for the access lost during the megalapse? Let's see, that would be, say, half a day out of 30, or typically 33 cents each. Seems only fair. The Netcom-Cisco Ampersand Collapse and other major outages should be prominent agenda items at upcoming meetings of Internet service providers. Unfortunately, my favorite of such meetings, those of the North American Network Operators Group (NANOG), are not likely to take systematic outage analysis seriously. As one NANOG wag put it, "This is the 'net, people, deal with it." What's needed is for NANOG to deal with it. Another NANOG participant minimized the Netcom-Cisco 5.2 megalapse with this arithmetic: Since the Internet has 60 million users, the Netcom outage inconvenienced far fewer than 1 percent -- some collapse. He has a point. There is ample room for much bigger Internet collapses ahead, maybe eventually some gigalapses. (See what else the NANOG wags are writing about at http://www.merit.edu/mail.archives/html/nanog.) Bob Metcalfe invented Ethernet in 1973 and founded 3Com Corp. in 1979. He receives E-mail at bob_metcalfe(a)infoworld.com via the Internet. Copyright © 1996 by InfoWorld Publishing Company At 4:15 PM 7/8/96, Craig A. Huegen wrote: >Received: by ccmail from lserver.infoworld.com >>From c-huegen(a)quad.quadrunner.com >X-Envelope-From: c-huegen(a)quad.quadrunner.com >Received: from quad.quadrunner.com by lserver.infoworld.com with smtp > (Smail3.1.29.1 #12) id m0udR8U-000x1xC; Mon, 8 Jul 96 17:58 PDT >Received: from localhost (c-huegen@localhost) by quad.quadrunner.com >(8.7.5/8.7-quad) with SMTP id QAA12003; Mon, 8 Jul 1996 16:14:36 -0700 >Date: Mon, 8 Jul 1996 16:14:36 -0700 (PDT) >From: "Craig A. Huegen" <c-huegen(a)quad.quadrunner.com> >To: Michael Dillon <michael(a)memra.com> >cc: nanog(a)merit.edu, bob_metcalfe(a)infoworld.com >Subject: Re: Hurricanes redefined! >In-Reply-To: <Pine.BSI.3.93.960708104725.22916I-100000(a)sidhe.memra.com> >Message-ID: <Pine.QUAD.3.94.960708155947.11988A-100000(a)quad.quadrunner.com> >MIME-Version: 1.0 >Content-Type: TEXT/PLAIN; charset=US-ASCII > >On Mon, 8 Jul 1996, Michael Dillon wrote: > >==>The official definition of a hurricane is winds in excess of 5 km/hr >==>for a duration of at least 1 hour. Read all about it at >==>http://www.infoworld.com/cgi-bin/displayNew.pl?/metcalfe/metcalfe.htm > >Interesting as well is Bob's incorrectness once again: > > "Uh-oh, this despite Netcom's > trademarked slogan: The Network > Works. No Excuses. " > >See http://www.cisco.com/public/copyright.html, in which you'll find: > >"All rights reserved. No portion of this service may be reproduced in any >form, or by any means, without prior written permission from Cisco >Systems, Inc. [...], The Network Works. No Excuses. are service marks; >[...] of Cisco Systems, Inc.[...]" > >Bob also states that: > > "Cisco should > continuously improve the software with > which its routers are programmed so > that catastrophic human errors are less > likely. " > >Which gives the connotation that cisco Systems doesn't constantly improve >IOS; everyone who's worked with cisco's software knows it's constantly >being improved. > >Bob also states the following: > > "Unfortunately, my favorite of such > meetings, those of the North American > Network Operators Group (NANOG), > are not likely to take systematic outage > analysis seriously. As one NANOG > wag put it, "This is the 'net, people, deal > with it."" > >What Bob fails to mention is that no one has a service-level agreement >with the Internet. The Internet is designed this way--my network connects >to your network. It is _NOT_ under control of one body. It's very hard >to GUARANTEE outages to _anyone_ without monetary value involved. And >generally, "my networks connects to your network" does not have enough >monetary value to warrant SLA contracts of service. Bob, I challenge you >to find an Internet Service Provider that gives an END-TO-END service >level agreement for the Internet. That is, if my web site isn't fast >enough, you have escalation/remedy procedures. If Joe Blow's sendmail has >crapped out, you have escalation/remedy procedures. I'll buy you dinner >if you find one. > >Bob once again forgets the original purpose behind the Internet, and he >apparently has permanently doffed his engineer hat for his non-technical >businessperson hat long ago. > >/cah ______________________________________________ ______________________________________________ Dr. Robert M. ("Bob") Metcalfe Executive Correspondent, InfoWorld and VP Technology, International Data Group Internet Messages: bob_metcalfe(a)infoworld.com Voice Messages: 617-534-1215 Conference Chairman for ACM97: The Next 50 Years of Computing San Jose Convention Center March 1-5, 1997 ______________________________________________ ______________________________________________

7 6