- Test - lists.nanog.org

Efficient DoS filter
by Alex Bligh 29 Mar '98

29 Mar '98

I think this is an operational issue, at least for those running Cisco. Having just been hit by 10Mb/s of DoS attack and finding a 75xx has difficulty filtering it, here is quite a nice way (assuming we're talking a randomized source, single destination attack). Find your favorite ATM interface (sorry Sean). Set up a sub-interface covering the IP address concerned, put in a map-list to the duff interface, and put it on a VC that doesn't go anywhere through your ATM switch. This way the ATM switch foes the filtering. PLEASE can we have hardware assisted switching to null0: if anyone's listening at Cisco? Nothing else would filter this out (no convenient LANs nearby, serial type interface just sends the data anyway etc...). This would probably work on FR too. Alex Bligh GX Networks (formerly Xara Networks)

2 1

Re: consistency and cix
by Randy Bush 28 Mar '98

28 Mar '98

> I suppose the issue comes down to whether one considers the CIX > relationship to be one of transit provider or if it is considered an > exchange point. This is is the crux of the question I meant to be posing. > Again, this is a political issue, and should probably be worked out between > the two providers involved (hopefully through operational people and not > lawyers though ;). It is also a technical issue, as there are technical reasons why consistent routing announcements are usually specified, whether the CIX is an exchange or a for-fee transit provider is partially a technical judgement, ... The two providers did, for the moment, work it out at the engineering level. But we agreed the issue was interesting and the answer not obvious. randy

2 1

more directed broadcast attacks
by Kelly J. Cooper 28 Mar '98

28 Mar '98

Something on the order of 100 networks all tried to send as many echo response packets as possible down a little 56Kb pipe on my network today (from ~19:00 - 21:00 GMT today, 27 March 1998) and I couldn't reach a single network-owning site to get it shut down because ALL of the networks abused were in the Asian Pacific area, where it was NOT business hours. So the individual numbers listed with the various NICs were useless & the main numbers were rather difficult to find and/or parse from the POV of another country. Needless to say, I did not have any fun today. And, although it is very tempting to just post the list of networks that were abused I decided not to (instead, I contacted our peers who are upstream of the various networks and asked them to educate their downstreams because we've noticed an increase in attacks every time someone posts a list of vulnerable networks to NANOG). But I would like to forward this subset of the networks I pulled out of my accounting data during the attack and post them here as MY VOTE on why using RFC 1918 nets on an exterior net can be a Bad Idea: 10.15.1.254 10.21.1.11 10.21.1.90 10.21.1.191 10.21.1.193 10.21.1.195 10.21.1.196 10.21.1.197 10.21.1.199 10.21.1.200 10.21.1.201 10.21.1.202 10.21.1.203 10.21.1.205 10.21.1.206 10.21.1.207 10.21.1.208 10.21.1.209 10.21.2.53 10.21.2.100 127.0.0.2 172.16.31.3 172.16.31.10 172.16.31.11 172.16.31.249 172.16.71.11 172.16.71.12 172.16.71.180 192.168.1.1 Regards, Kelly J. -- Kelly J. Cooper - Internet Security Officer GTE Internetworking - Powered by BBN - 800-632-7638 150 Cambridge Park Drive Fax - 617-873-5508 Cambridge, MA 02140 http://www.bbn.com

1 0

consistency and cix
by Randy Bush 27 Mar '98

27 Mar '98

V peers with X at a number of points. V and X announce the same routes to each other at all these points. V and X are also members of the CIX and are announcing routes to the CIX router. X announces different routes to the CIX router than they announce directly to peer V because Y pays X to specifically announce Y's routes at the CIX. Should V be unhappy with X's inconsistent route announcements? Should X's announcement via the CIX be consistent with their announcements at the other points V and X meet? o yes, because the CIX is a peering point, though router-based (this in itself may be worth a different discussion). o no, because in realty V and X each are paying customers of the CIX, and the CIX is merely announcing their customers' routes to each other. My apologies for opening an operational issue in an inappropriate forum. randy

3 3

Re: consistency and cix
by Randy Bush 27 Mar '98

27 Mar '98

> Actually, sounds like a political issue to me. > > What do your peering contracts say? if the the cix relationship is mutual purchase of transit from a third party, then V and X have no contractual relationship. randy

2 1

The Cidr Report
by Tony Bates 27 Mar '98

27 Mar '98

This is an auto-generated mail on Fri Mar 27 12:00:00 PST 1998 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 27Mar98 0) General Status Table History ------------- Date Prefixes 200398 49893 210398 50064 220398 50031 230398 49930 240398 49998 250398 50244 260398 49981 270398 50071 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 3371 Number of ASes announcing only one prefix: 1596 (826 cidr, 770 classful) Largest number of cidr routes: 418 announced by AS3561 Largest number of classful routes: 1039 announced by AS701 1) Gains by aggregating at the origin AS level --- 27Mar98 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS4293 437 213 224 51.3% IMCI AS2493 560 343 217 38.8% iSTAR Internet, Inc. AS816 653 448 205 31.4% UUNET Canada (ASN-UUNETCA-AS4) AS3602 465 300 165 35.5% Sprint Canada Inc. AS174 786 627 159 20.2% Performance Systems International AS3749 219 64 155 70.8% TECNET AS701 1039 885 154 14.8% Alternet AS11003 128 56 72 56.2% UNKNOWN AS5668 113 42 71 62.8% Century Telephone Inc. AS2048 160 92 68 42.5% LaNet AS3221 102 37 65 63.7% EENet Autonomous System AS3804 205 142 63 30.7% Bell Solutions AS1239 550 493 57 10.4% SprintLink Backbone AS271 110 54 56 50.9% BCnet Backbone AS10928 98 43 55 56.1% UNKNOWN AS549 211 160 51 24.2% ONet Backbone AS4755 84 34 50 59.5% Videsh Sanchar Nigam Ltd. India AS1221 272 223 49 18.0% AARNET-AS AS72 84 36 48 57.1% Schlumberger Information Network AS4763 122 76 46 37.7% Telstra New Zealand AS7046 146 102 44 30.1% UUNET-CUSTOMER AS6392 73 29 44 60.3% MidWest Communications, Inc. AS4740 355 313 42 11.8% ASN-OZEMAIL (Ozemail Pty Ltd) AS2711 98 56 42 42.9% SUNBELT-AS AS852 157 117 40 25.5% AGT Advance Communication AS6335 63 23 40 63.5% NTRNET AS3493 162 124 38 23.5% INTERLINK AS684 90 53 37 41.1% Manitoba Regional Network Backbon AS6332 83 46 37 44.6% TELNOR AS4200 127 90 37 29.1% AGIS (Apex Global Information Ser For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

NANOG 13 "broadcast"
by Forrest W. Christian 27 Mar '98

27 Mar '98

What are the current plans regarding multicasting and/or realvideo-ing NANOG 13 at this point? The last couple of meetings seem to have been plagued with problems related to the "broadcasting" of the session. I'm sure that this hasn't really been anyone in particular's fault, but instead a side effect of the unfortunate realities of the Data Communications world we all live in. Basically, I'd like to see what I can do to help make sure that this one goes more smoothly. Especially since it looks like I'm going to have to miss NANOG 13. Feel free to e-mail me directly if you feel that this doesn't need to be discussed on the whole list. - Forrest W. Christian (forrestc(a)imach.com) ---------------------------------------------------------------------- iMach, Ltd., P.O. Box 5749, Helena, MT 59604 http://www.imach.com Solutions for your high-tech problems. (406)-442-6648 ----------------------------------------------------------------------

2 1

AU Hacker/Credit Card Distributro gets 3years/18 months
by Adam Todd 27 Mar '98

27 Mar '98

Australian Computer Hacker and Credit Card distributor gets 18 months. This is "unoffical" news, I'm waiting for something more concrete, but certainlthe AU ISP list is reeling in on this matter. Skeeve Stevens wasn't the most "liked" person in the Internet Industry and is known for making very strong and critical comments - often abusive - towards other users. Brings me to question the "religious" bit ??? >From: Zed Connect Pty Ltd <isp(a)zed.org> >Subject: [Oz-ISP] SKEEVE GOT GOAL >To: aussie-isp(a)aussie.net >Date: Fri, 27 Mar 1998 13:28:37 +1100 (EST) > >SKEEVE STEVENS GOT GOAL >======================= > >Mr Skeeve Stevens, the alleged "Optik Surfer", has been gailed for the >crime of "altering data", which holds a maximum term of 10 years goal. > >During sentancing this morning, at the Downing Local Court, the Judge >announced that she had fully considered all the material and evidence >presented, and taking into account that the crime appeared to have been >done with malice. > >She disregarded his recent marriage, to Zita Gorman, and his religeous >beliefs, and the work he is doing with various religeous bodies. > >She also commented that although he had pleaded GUILTY to to crime, this >was done in the '11th hour', and appeared to show no remorse, and was just >a tactic to lighten the sentance. > >On final summation she announced that the only punishement that would fit >this crime would be 3 years goal, with reconnecance for 18 months. Which >means if he is a good boy he will be out in 18 months. > >He was then immediatley taken down by court security. > >Witnesses commented that this outcome was an unexpected blow by the Stevens >camp. Mr Stevens wife had appeared disrought at the decision. ------------------------------------------------------------------------- The advice offered in this email is not considered professional advice, or it would be accompanied by an invoice. No permission is granted for republication of comments, without written consent. ------------------------------------------------------------------------- Business Development, Technology Domain Registration and Network Advisory Telstra Convery Member AURSC http://www.aursc.ah.net Adam Todd Personal http://adamtodd.ah.net at@aus or at(a)ah.net http://adam.says.sheesh Phone +61 2 9729 0565 Network http://www.ah.net AU Internet News http://www.ah.net/lists/lwgate/INTERNET/ AU Internet User Mail List http://www.ah.net/lists/lwgate/OZ-USER/

1 0

RE: Access Lists
by Martin, Christian 26 Mar '98

26 Mar '98

It's not that I don't want to protect my customers. But, most of them are ISPs, who are doing web hosting and the like. They find out that a warez ftp site is on their network, most likely consuming a ton of bandwidth, and to protect themselves, they boot the guy. Usually, warez guys have methods to retaliate. Jeez, anyone with a web browser and a C compiler can launch a land.c attack! I am very willing to help my customers, but there is a tradeoff in terms of what it costs me. If it is a good customer, or more importantly, a big one, then I will write a 200 line access list, no problem! But say I implement this type of service for a few customers, and word spreads that we are doing it, then everyone wants that type of service. How many of you out there have 50, 60, 80 + extended access lists on your border routers? What if I go over 99? Get IOS 11.2? This has been my point all along. creating an access list and applying it to a BGP distribute list on my outbound advertisements solves the attack problem, but that is useless because the customer cannot get out to the Internet( cannot be reached from, actually). NetFlow is a viable tracking tool, however, I still need help from my peers. Say it comes from one ISP, who delivers it to, say, MAE-West, where it is picked up and carried over to MAE-East, picked up again and dropped of over here. Tha is four providers, four NOCs to tassle with, to catch an attack that lasts usually no more than an hour. I suppose my biggest question was this. Has anyone got themselves into a hole by providing ICMP filtering on their routers to protect downstream customers, be it in terms of manageability, processor overhead, packet discarding. Also, where is the best place to do this, ingress, egress, or a combination? Do buffers need to be increased? What about queueing strategy? How does NetFlow affect access-list processing? I know these questions may be best answered by Cisco, but I want some real answers, from real people in the field. No offense to any Cisco employees, but you do have a company bias, just as we all do. Guys, thanks for all of the replies. You've all been a great help!!!! -Chris Jain Depak wrote > Why not just filter all ping traffic to his T1 until the attack > subsides? Christian Martin replied > That is what I am going to do. But with over 100 downstream customers, > and IOS 11.1 (sans named access lists) I don't want to start a > precedent. You don't want to start a precedent of protecting customers from DoS attacks? -- Steve Sobol, Tech Support Guru, NACS.NET [http://www.nacs.net/support] (The address I use on Usenet is a valid address - don't try to unmunge it!) Moderator, alt.religion.afterburner [http://antispam.nstc.com/ara] 1997 AL and 1998 World Series Champions: [http://www.indians.com]

2 1

Q&E
by Per Gregers Bilse 26 Mar '98

26 Mar '98

You may have seen this, then again you may not. In any case, somewhat off-topic for NANOG (but unquestionably of interest), please direct all speculation to com-priv. Needless to say, both parties feel very good. http://www.EU.net/cinfo/news/press980326qwest.html QWEST ENTERS EUROPEAN DATA MARKET IN 13 COUNTRIES THROUGH ACQUISITION OF EUNET INTERNATIONAL LTD Denver - Amsterdam - March 26, 1998 Qwest Communications International Inc. today announced it has agreed to acquire Amsterdam-based EUnet International in a cash and stock transaction valued at approximately $154 million. EUnet is a leading European Internet service provider (ISP) with business units operating in 13 countries - Austria, Belgium, Finland, France, Spain, Portugal, Norway, Sweden, Luxembourg, Czech Republic, Switzerland, Romania and Estonia. EUnet had revenues in 1997 of approximately $55 million, and 1998 revenues are expected to reach $16 million in the first quarter and over $75 million for the entire year. EUnet has over 400 employees and serves approximately 60,000, primarily business, customers throughout Europe. In addition, Qwest will fund EUnet's recent acquisition of a 50 percent interest in X-Link, a leading German Internet service provider. The board of directors of each company has approved the acquisition and the requisite number of EUnet shareholders have agreed to the transaction. EUnet shareholders will receive approximately $135.5 million in newly issued shares of Qwest common stock, approximately $4.5 million in cash, and approximately $14.4 million in cash or additional Qwest shares at Qwest's option. The acquisition will be accounted for as a purchase. The closing is subject to the satisfaction of certain customary conditions, including the receipt of applicable securities law approval. The parties expect to consummate the acquisition within 30 days. "The European data market is exploding to an estimated $55 billion by the year 2000. The Internet is the driving force behind this trend," said Joseph P. Nacchio, president and CEO at Qwest. "EUnet has extensive Internet expertise and an understanding of Europe's diverse national markets and regulatory issues. The liberalization of the European telecommunications market and our recently acquired transatlantic capacity, combined with the EUnet acquisition, allow Qwest to provide business customers with high performance and cost effective end-to-end data and Internet services between North America and Europe." "EUnet recognizes that the future of Internet usage rides on the ability to move large amounts of data and images quickly and without error. Partnering with Qwest allows the two companies to capitalize on their expertise in IP data networking products and to leverage the superior Qwest network infrastructure to deliver a leading edge American-European data strategy," said Jim Omand, chairman of the board at EUnet International. "Joining Qwest will allow us to further expand our presence in Europe and to continue to deliver to our customers the data network services that have made EUnet a market leader." The Qwest shares will be issued in a private placement exempt from registration under the Securities Act of 1933. Qwest has agreed to register the shares for resale under the Securities Act within three weeks after the closing of the previously announced merger between Qwest and LCI International, Inc. or by September 30, 1998, if earlier (or under certain circumstances as late as October 31, 1998). The Qwest Macro CapacitySM Fiber Network Qwest's planned domestic 16,250 mile network will serve more than 125 cities, which represent approximately 80 percent of the data and voice traffic originating in the United States, upon its scheduled completion in the second quarter of 1999. Currently, nearly 3,750 miles are activated from Los Angeles to Cleveland; and from Dallas to Houston. Qwest is also extending its network 1,400 miles into Mexico with completion slated for late third quarter 1998. The Qwest Macro Capacity Fiber network is designed with a highly reliable and secure bi-directional, line switching OC-192 SONET ring architecture. Upon completion, the network will offer a self-healing system that provides the ultimate security and reliability by allowing instantaneous rerouting in the event of a fiber cut. About EUnet Established in 1982 and the first European provider of Internet services for business use, EUnet was instrumental in creating Europe's Internet infrastructure. Today, EUnet International provides, via subsidiaries, affiliated companies and business partners, one-stop shopping for corporate Internet access in Europe with a network spanning over 42 countries and more than 400 PoPs (Points of Presence). Via its transit-free backbone, EUnet International offers the business community a wide range of turnkey solutions from full-service, centrally-managed connectivity and Intranets to mobile access, Webcasting, Web Storefront and Electronic Commerce solutions. For more information, please visit EUnet's website at www.EU.net. About Qwest Qwest Communications International Inc. (NASDAQ:QWST) is a multimedia communications company building a high-capacity, fiber optic network for the 21st century. With its cutting-edge technology, Qwest will deliver high-quality data, video and voice connectivity securely and reliably to businesses, consumers and other communications service providers. Further information is available at www.qwest.net. ### This release may contain forward-looking statements that involve risks and uncertainties. These statements may differ materially from actual future events or results. Readers are referred to the documents filed by Qwest with the SEC, specifically the most recent reports filed under the Securities Exchange Act of 1934, which identify important risk factors that could cause actual results to differ from those contained in the forward-looking statements, including potential fluctuations in quarterly results, dependence on new product development, rapid technological and market change, failure to complete the network on schedule, failure to consummate the proposed merger with LCI International timely or at all, volatility of stock price, financial risk management and future growth subject to risks. Information regarding EUnet (including forecasts of results of operation for 1998 or portions thereof) have been provided by EUnet and have not been verified by Qwest or its representatives. No assurance can be given with respect to such information or that such forecasts will be realized. This announcement is not an offer to sell or a solicitation to buy any securities of Qwest. Any offering securities will be make only pursuant to a prospectus prepared by Qwest. The Qwest shares to be issued in the transaction have not been registered under the Securities Act and, unless so registered or an exemption from registration is available, may not be offered or sold in the United States or its territories and possessions or to any "U.S. Person" (within the meaning of the Securities Act) and hedging transactions involving such shares may not be conducted unless in compliance with the Securities Act. The Qwest logo is a registered trademark of Qwest Communications International Inc. in the U.S. and certain other countries. -- ------ ___ --- Per G. Bilse, Director Network Eng & Ops ----- / / / __ ___ _/_ ---- EUnet Communications Services B.V. ---- /--- / / / / /__/ / ----- Singel 540, 1017 AZ Amsterdam, NL --- /___ /__/ / / /__ / ------ tel: +31 20 5305333, fax: +31 20 6224657 --- ------- 24hr emergency number: +31 20 421 0865 --- Connecting Europe since AS286 --- http://www.EU.net e-mail: bilse at domain

1 0