- NANOG - lists.nanog.org

Re: Ping flooding (fwd)
by Doug Stanfield 10 Jul '96

10 Jul '96

At 06:43 AM 7/9/96 +0000, you wrote: >Michael Dillon writes: >> >> On Tue, 9 Jul 1996, Daniel W. McRobb wrote: >> >> > There will likely never be a means for a single NSP to track down the >> > real source of spoofed packets using IPv4. Service providers won't be >> > letting other service providers track spoofed packets through their >> > network. >> >> Why not? Don't telcos do this? >> Or if your answer is that telcos only do it for the police and not for >> each other, then my question would be why can't we form an Internet >> equivalent, maybe affiliated with something like CERT, that can make these >> requests and with whom NSP's would cooperate. > >What sort of incentive or penalty do you think would enable this >cooperation? > > Nevin > These garbage packets are flooding through somebodies network to get to the target. I'd think it would benefit the intervening operators to eliminate traffic tthat is harmful, probably illegal, and wasting the resource they sell, bandwidth. Doug Stanfield "The significant problems we face cannot be solved Oceanic Cable at the same level of thinking we were at when we Project Engineer created them." - Albert Einstein dougs(a)oceanic.com (808) 625-8455 fax (808) 625-5888

2 1

Re: Ping flooding (fwd)
by Michael Dillon 10 Jul '96

10 Jul '96

Are there any procedures in place to track down this kind of network abuse. In particular, is it possible that it is a stealth attack? Before you answer, take note that this is going to appear in Bob Metcalfe's column next week. ---------- Forwarded message ---------- Date: Mon, 8 Jul 1996 15:30:43 -0600 (MDT) From: Kevin Rosenberg <kevin(a)cyberport.com> Reply-To: inet-access(a)earth.com To: inet-access(a)earth.com Subject: Re: Ping flooding Resent-Date: Mon, 8 Jul 1996 15:30:53 -0600 (MDT) Resent-From: inet-access(a)earth.com > Some months later we had an incident of massive amounts of forged email > from a site called SUNSETDIRECT.COM. For several weeks they sent forged We are currently undergoing a ping flood attack, though our upstream provider has filtered icmp from the host so the flood is no longer affecting our T1 line. The system administrator of the site that appears to be flooding us doesn't believe his site is the source of the attack. He states that he can't see the icmp packets, though I don't know how he is sniffing his wire. My questions are these: Is it possible for someone to forged the source IP address of an icmp packet? If so, do they have to be in some routing proximity, or can they forge the source address while they are connected from anywhere in the world? Thanks! -------------------------------------------------------------------- Kevin Rosenberg | CyberPort Station Chief System Administrator | The Finest Internet Service Possible! kevin(a)cyberport.com | http://www.cyberport.com Finger kevin(a)cyberport.com for PGP Public Key -------------------------------------------------------------------- ============================== ISP Mailing List ============================== Email ``unsubscribe'' to inet-access-request(a)earth.com to be removed. Do not post flames to the list -- if you must flame, use private email.

8 11

Re: Ping flooding (fwd)
by Sean Doran 09 Jul '96

09 Jul '96

| Is there an efficient means of retrieving flow data from a Cisco and | not potentially dropping a bunch of it on the floor? Will there be at | some point in the future? We'd use it if it was available. We'd even | pay for it, I imagine. :-) We are not a Cisco beta list nor are we a Cisco sales team. Please approach this kind of thing through your normal vendor channels. You may find that doing so will actually grant you your wish. Sean.

1 0

Re: Ping flooding (fwd)
by avg＠ncube.com 09 Jul '96

09 Jul '96

That's once again a matter of defaults -- routers should _by default_ discard all packets from interfaces which they won't use for forwarding those packets back. This rule works is 99.9% of cases preventing SA spoofing and some cases of transient loops, and can be disabled where asymmetrical routing is desired. I also have thought of some mechanism to allow destination host to quench sender forcefully, by telling the intermediate router(s) to disallow forwarding to some destination for some period of time (a minute would do nice to render flooding attacks ineffective), but there's a problem with authentication (i.e. there's a need for the router to "call back" to confirm that destination indeed wants to shut up somebody). Finally, routers could implement a kind of "reverse trace" ICMP with the following functionality: on receiption of RT ICMP message take the SA from the ICMP and send back reply message. After that install watchpoint to look for packets going to that address (the "watchpoint" may be implemented as a host route to some special interface). If watchpoint is triggered (i.e. we've got a packet going to the SA) send copy of the RT ICMP to the interface from which the offending packet came from and remove the watchpoint. If watchpoing wasn't triggrded for some time, remove it silently. That simple mechanism would allow to track down sources of forged (or mis-configured) SAs pretty quickly. However it is ineffectual if source-based routing with a large number of variant routes is used. But then, unrestricted SBR is very dangerous anyway (it allows to create artificial congestions by emitting relatively small streams of bogons with routes wound in tight loops). --vadim

2 1

Re: Ping flooding (fwd)
by Justin W. Newton 09 Jul '96

09 Jul '96

At 10:43 PM 7/8/96 -0400, Todd Graham Lewis wrote: >If you have a very restrictive security policy, then you might want to >place a packet filter on all outgoing traffic. If your network is >10.1.1.64/26, then you might have the following two rules: > >action source destination >------ ------ ----------- > >allow 10.1.1.64/26 * >deny * * > >Of course, no one does this, because it is very time consuming for your >router to examine every packet in this way. This translates into more >marginal cost on your hardware for very little return. > >Say that person X, the person who owns the network from which these pings >are apparently originating, did have such a filter. What does this do? >It proves that the packets are not originating on his network. Does it >stop anyone else from forging these packets? No. Actually it doesn't prove that. The filter would /allow/ the pavckets to pass through the router since they were coming from one of his networks. If everyone else on the planet had such a rule it would prove that it /was/ coming from him. Justin Newton Internet Architect Erol's Internet Services

3 2

Re: Ping flooding (fwd)
by Dick St.Peters 09 Jul '96

09 Jul '96

> action source destination > ------ ------ ----------- > > allow 10.1.1.64/26 * > deny * * > > Of course, no one does this, Er ... we do this. -- Dick St.Peters, Gatekeeper, Pearly Gateway, Ballston Spa, NY stpeters(a)NetHeaven.com Owner, NetHeaven 518-885-1295/800-910-6671 Internet for Albany/Saratoga, Glens Falls, North Creek, & Lake Placid First Internet service based in the 518 area code

2 1

Re: InfoWorld Column on Netcom-Cisco & collapse
by Larry J. Plato 09 Jul '96

09 Jul '96

Mr Metcalfe, Did you really send this? The header indicates this came from some Kelmscott farms in Lincolnville, ME not infoworld.com. I find it hard to believe a journalist of your stature would descend to such a very LOW level, Just curious, Larry Plato ----- Forwarded message from Perry E. Metzger ----- > From nanog-owner(a)merit.edu Tue Jul 9 21:17:19 1996 > Message-Id: <199607091944.PAA14086(a)jekyll.piermont.com> > X-Authentication-Warning: jekyll.piermont.com: Host perry@localhost didn't use HELO protocol > To: nanog(a)merit.edu > Subject: Bob Metcalfe: Re: InfoWorld Column on Netcom-Cisco Ampersand Collapse > Date: Tue, 09 Jul 1996 15:44:33 -0400 > From: "Perry E. Metzger" <perry(a)piermont.com> > Sender: owner-nanog(a)merit.edu > Precedence: bulk > > > I thought folks might want to see this. > > ------- Forwarded Message > > Date: Tue, 9 Jul 1996 15:33:32 -0400 > X-Sender: bob(a)kelmscott.com > Message-Id: <v02130502ae082a519beb(a)[204.117.49.7]> > To: perry(a)piermont.com > From: bob_metcalfe(a)infoworld.com (Bob Metcalfe) > Subject: Re: InfoWorld Column on Netcom-Cisco Ampersand Collapse > > > Dear Mr. Piermont, > > Stay out of this. Since I'm such a creep, please ignore me in the future. > > /Bob Metcalfe > > [...] > > ------- End of Forwarded Message >

1 0

Re: Internet access and telco usage patterns
by Hong Chen 09 Jul '96

09 Jul '96

Eric, Well, as many people asked me the mailing list on IETF roaming group. The status is that it is setup today, and you can follow the following instructions to subscribe to it Enjoy, Hong ******************************************************************** Welcome to the roamops mailing list! If you ever want to remove yourself from this mailing list, send the following command in email to "roamops-request(a)ns2.rutgers.edu": unsubscribe Or you can send mail to "Majordomo(a)ns2.rutgers.edu" with the following command in the body of your email message: unsubscribe roamops hchen(a)aimnet.net Here's the general information for the list you've subscribed to, in case you don't already have it: Specifications for roaming ip network clients -------- Begin Included Message ------- > At 10:51 AM 7/5/96 -0700, Hong Chen wrote: > >As a matter of fact, it is quite doable. Aimnet developed a roaming > >server (check www.aimnet.com) that allows international ISPs to > >use each other's network to provide dialup services. A group of > >ISPs have joined a consortium GRIC (Global Reach Internet > >Consortium) lead by Aimnet. The roaming server is based > >on Radius protocol. > > > >A telco company can install modems and route the authentication to > >the specific ISP for authentication. > > Hong, > > I looked at this doing this about a year ago but the major stumbling block > was that if ISPs share the authentication responsibility using distributed > RADIUS, they have the capability of keeping each other's passwords for the > user's that used the global access service. > > Also, a service you likely know about, started up around the same time in > Vancouver, where I was living at the time, called GeoAccess > (www.globalexpo.com/goeaccess) was going to target this idea much more > aggressively than I (and plus I did not feel like competing with him in > particular), and decided on the model on centralized authentication, > effectivele becoming a worldwide access ISP without purchasing a single modem > or terminal server. But even ISPs participating in his "network" can log > the entered passwords. > > Telephone companies might have a problem with the legal ramifications of this > "roaming" service. > > >I just came back from Montreal INet 96 last week and a new roaming > >IETF group will be started. We are working on the IETF draft > >for the roaming and stay tuned. > > Please let me know what the name of working group is, and perhaps take this > to private email. I would be very interested to know how the password > access problem is worked around, or at very least, rationaly pushed aside, > and even contribute. > > Eric Woodward. > ejw(a)globecomm.net > > -------- End Included Message --------

1 0

since it's national pick-on-bob-metcalfe week anyway...
by Paul A Vixie 09 Jul '96

09 Jul '96

...i'd like to put in my two cents. the trouble with bob isn't that he's arrogant and self centered and unable to see anybody else's point of view. nor is it that he's rude, insensitive to the pain he causes others, and generally doesn't know how to act around people. bob is all of those things, as demonstrated here. but so am i, and so are 90% of the folks on the nanog mailing list. so i will not be seen here jumping on bob for being "normal" per the NANOG specifications. what's getting bob in trouble is that he has the attitude but the things he did to earn it aren't relevant to this audience. he can talk the talk but he hasn't walked the walk. if anybody on NANOG has ever listened to a thing i've said about anything, and has put forth the effort needed to overcome the natural aversion to my arrogant, self centered, rude, insensitive demeanor, it is because (and ONLY because) i carry a pager and have stayed up all night, many nights, working on broken routers, working on broken code for routers, and working to keep customers happy. bob's contribution to what we're doing here is larger than mine, and perhaps larger than almost anybody's. where would we be without Ethernet? however, that is not how to earn the right to walk around with a chip on your shoulder in the NANOG crowd. if you don't have tire tracks over 70% of your body and you've never worked 45 hours at a stretch renumbering an international class A net, nobody seems to care what you have to say. to attract that audience ANYWAY, you have to be a lot more polite than bob has been, or likely ever will be.

1 0

Bob Metcalfe: Re: InfoWorld Column on Netcom-Cisco Ampersand Collapse
by Perry E. Metzger 09 Jul '96

09 Jul '96

I thought folks might want to see this. ------- Forwarded Message Date: Tue, 9 Jul 1996 15:33:32 -0400 X-Sender: bob(a)kelmscott.com Message-Id: <v02130502ae082a519beb(a)[204.117.49.7]> To: perry(a)piermont.com From: bob_metcalfe(a)infoworld.com (Bob Metcalfe) Subject: Re: InfoWorld Column on Netcom-Cisco Ampersand Collapse Dear Mr. Piermont, Stay out of this. Since I'm such a creep, please ignore me in the future. /Bob Metcalfe [...] ------- End of Forwarded Message

3 2