October 1996 - Test - lists.nanog.org

Re: BSDI announcement about defense against syn-flooding attacks
by Rob Liebschutz 04 Oct '96

04 Oct '96

> Rob Liebschutz writes: > > It scares me to think how much effort has gone into defense against > > this one denial of service attack when there are endless possibilities > > for other ones. > > Really? I don't think enough effort has been expended... which is why I'm > expending more. This was intended to be a comparison of how much effort has already been expended with how much more is really needed. I strongly agree that more effort needs to be expended here. Both at the lab/research level and at getting the technology on every box on the Internet (and you've contributed significantly in both of those areas). Good security requires an enormous amount of ongoing effort. It's not like you secure your network and it's done. At least one good things that's happened in the last few years is that many vendors have started paying much more attention to security in their products. This really helps in the distribution effort. I've done alot of consulting in the past, and I've found at many sites that the cost of security was very hard to sell. For startup ISP's network security almost never had a line in the budget. They'd usually tell me they can't afford it. I'd tell them they can't afford to be without it. Of course alot of starup ISP's had never thought about hiring a networking person either! You just go down to the local discount computer store and buy a bunch of 10baseT hubs to plug all your computers into. One big network :-). Talk about startup ISP's (a little off topic here), I had one "WANNA-BE" ISP come to me with a T1 already installed to PBI (no CSU/DSU or router, no hubs, 1 windows 3.11 box) and they wanted me to "bring them up as an ISP". I quoted them a price, but they told me that they only had $3000 to spend. They didn't know what services they wanted to provide either. Then there were two others that came to me that had been sold NAP connections. One guy was sitting their with a single Win95 box plugged into his Cisco 75xx with a DS3 NAP connection, "Well, how do I get this thing configured?". Now he can browse the WEB on his Win 95 box at DS3 speeds:-). > > Th point is not that we have to defeat the SYN attacks. We all know by now > that the severity of that problem is, at least for modern OSes, reduced > to a tolerable level (or will be soon). But these SYN attacks are just > the precursor to other even more dangerous attacks that all share one > characteristic: forged source addresses. If we can use this event to > raise consciousness about the forged-source issue, everyone wins big. And > if we don't... well, film at 11, as we say. > > /a > Rob

1 0

Re: TCP SYN attacks
by Richard Stiennon 04 Oct '96

04 Oct '96

At 11:37 AM 10/3/96 -0700, Ran Atkinson wrote: >>Dima Volodin writes: >>> Now can I hold my breath waiting for vendors to incorporate this stuff >>> into their products? > >At least BSDI, Sun, SGI, and HP are working on TCP SYN hardening. >(yes, cisco is also on top of things :-). > >I have no data on what might be up at other vendors. Check out the elegant solution just announced by Checkpoint: http://www.checkpoint.com/fw21/syndefender/syndefender-white.html This is a firewall solution. I like the psuedo-NAT done to adjust sequence number. ---------------------------------------------------------------------------- Richard Stiennon richards(a)netrex.com Director, Business Development http://www.netrex.com Netrex, Inc. Voice: 810-352-9643 Southfield, Michigan Fax: 810-352-2375 ----------------------------------------------------------------------------- Providing businesses and organizations with secure Internet solutions.

8 10

Agenda item for Nanog?
by Peter Lothberg 04 Oct '96

04 Oct '96

I could say some worlds about this if anyone is interested and there are 20 minutes avaliable on the Nanog agenda. -Peter "" Worlds first transatlantic 155Mbit native IP service On Monday 23 September 1996 00:15 UTC, Was the worlds first transatlantic 155Mbit native IP service brought into operation by Sprint/USA and Tele2/Sweden. The circuit which is part of SprintLink and ICMnet runs between the NY-NAP in Pennsauken, NJ, USA and Tele2 in Sweden and uses Cisco packet-over-sonet/sdh technology. (Native IP over SDH) In 1995 the same team from Sprint and Tele2 brought up the worlds first transatlantic E3 service between the same endpoints. For more information; Sprint: Tricia Schibler, +1 703 904 2042, <tricia.schibler(a)qm.sprintcorp.com> Tele2: Olle Wallner, +46 8 5626 4058, <wallner(a)swip.net> ""

5 4

NANOG Registration
by Pam Ciesla 04 Oct '96

04 Oct '96

The list of attendees has been updated today at 9:15AM EST. The list will not be updated again until next week. Alex Bligh has registered since the update and will be added to the list at a later date. Hotels..the only hotel that I know of that still has rooms available is the Holiday Inn. Please let me know if you are having problems finding availability. Thanks Pam

1 0

Re: Fixing "clueless ISPs" etc etc etc, typical NANOG topic answered decisively
by Vadim Antonov 04 Oct '96

04 Oct '96

Will the "Novell Internet Professional" be the same mark of clueless as CNE? --vadim

4 3

Re: Peering versus Transit
by Barney Wolff 04 Oct '96

04 Oct '96

> Date: Mon, 30 Sep 1996 09:01:14 +0100 > From: "Alex.Bligh" <amb(a)xara.net> > > > And of course, to be in a position to "dump data" on a router at an > > exchange, one must have one's own router there peering with *somebody*, > > right? > > You needn't peer with anyone > > ip route 0.0.0.0 0.0.0.0 w.x.y.z > > will do the trick nicely if you aren't carrying full routing. Er, why did the exchange operator let you put a router on their switching fabric if you're not peering there with somebody? Are there actual cases of people with routers at NAPs/MAEs/xIXs who don't peer with anyone? Barney Wolff <barney(a)databus.com>

6 8

BSDI announcement about defense against syn-flooding attacks
by Rob Liebschutz 04 Oct '96

04 Oct '96

They've made a big announcement about it, but the code doesn't yet appear to be on their ftp site. The announcement does not describe what approach they took to solving the problem (presumably something more then their existing patch for the larg PCB hash table). See http://www.bsdi.com/press/19961002.html for the full announcement. It scares me to think how much effort has gone into defense against this one denial of service attack when there are endless possibilities for other ones. ______________________________________________________________________________ Colorado Springs, CO (October 2, 1996) -- Berkeley Software Design, Inc. (BSDI) anounced today its enhancements to its BSD/OS and BSDI Internet Server that are designed to protect against the recent wave of "SYN-flooding" denial-of-service attacks. Beginning this week, BSDI will make the source code for these enhancements available at no charge via the Internet to BSDI customers as well as all interested operating system suppliers, system administrators, and software developers.

3 2

Re: New Denial of Service Attack on Panix
by Jeff Weisberg 03 Oct '96

03 Oct '96

Avi writes: | > But of course. The problem is that SYN_RCVD is a transient state in the | > TCP automaton, and it requires some resources allocation. The life | > might have been a little bit different if servers weren't forced | > to track this state. Something like a signed ticket accompanying the | > second SYN and the following ACK. | > | > Dima | | That's the idea of making the iss a ticket that includes mss info and | a hash of the other info plus a security ticket. | | I had hoped to work on that but it looks like someone else local is almost | done and claims that ignoring window size and any data with the SYN(s) | is harmless... "someone else local" :-) has thrown the initial implementation up on his ftp server; sun3 & sun4 .o's and a back-port to Net/2 src code (note though, I have not tested the Net/2 port): ftp.op.net:/pub/src/syn-prophylactica/ I have been able to withstand a ~600+ syn/sec attack with no noticable problems (slightly increased load, but no dropped connections). --jeff

2 1

RE: BSDI announcement about defense against syn-flooding attacks
by William Sommers 03 Oct '96

03 Oct '96

On Thu, 3 Oct 96 16:35:13 PDT Rob Liebschutz wrote: > They've made a big announcement about it, but the code doesn't yet > appear to be on their ftp site. The announcement does not describe > what approach they took to solving the problem (presumably something > more then their existing patch for the larg PCB hash table). See > http://www.bsdi.com/press/19961002.html for the full announcement. > > It scares me to think how much effort has gone into defense against > this one denial of service attack when there are endless possibilities > for other ones. Actually, they released a number of patches all at once, including (quoting the notice just sent out by polk(a)bsdi.com) The remainder of the patches (K210-021, K210-022, and U210-025) add support for IP source checking, and for reducing and/or eliminating problems associated with SYN attacks, IP fragment attacks, and some other denial of service/looped server attacks. Unfortunately, these are available only for BSD/OS 2.1 -- nothing for prior releases. William Sommers San Francisco Online Televolve, Inc. sommers(a)sfo.com

2 1

'show ip bgp' musings and a useful script
by Michael Dillon 03 Oct '96

03 Oct '96

---------- Forwarded message ---------- Date: Thu, 3 Oct 1996 07:26:46 -0700 From: Rahul Dhesi <dhesi(a)rahul.net> Reply-To: inet-access(a)earth.com To: inet-access(a)earth.com Subject: 'show ip bgp' musings and a useful script Resent-Date: Thu, 3 Oct 1996 08:27:01 -0600 (MDT) Resent-From: inet-access(a)earth.com I wanted to see if the global Internet was receiving routing announcements for one of my netblocks, and wished there were several strategic places, all over the Internet, where one could do the equivalent of Cisco's 'show ip bgp'. Similar to remote traceroutes that can be done at a number of URLs, such as http://www.getnet.com/cgi-bin/trace. People might not jump at the chance of letting the rest of the world access their routers, but I am going to try to make it real easy for them. To this end I have written and made available a perl5 script that will telnet to your Cisco router, log in with the non-enable password, and do 'show ip bgp' for selected networks. I think it's reasonably secure. Point your web browser towards http://www.rahul.net/dhesi/ and follow the links to 'show ip bgp'. Then -- please -- set it up somewhere where you get a significant set of routes, so the rest of us can get some debugging benefit. -- Rahul Dhesi <dhesi(a)rahul.net> "please ignore Dhesi" -- Mark Crispin <mrc(a)CAC.Washington.EDU> ============================== ISP Mailing List ============================== Email ``unsubscribe'' to inet-access-request(a)earth.com to be removed. Because this is a restricted list -- DO NOT CROSS POST TO OTHER LISTS.

1 0