October 1996 - Test - lists.nanog.org

Re: New Denial of Service Attack on Panix
by Paul Ferguson 03 Oct '96

03 Oct '96

At 06:43 PM 10/3/96 EDT, Daniel W. McRobb wrote: > >I think Tim was using the assumption (which I consider quite valid) that >once vendors release patches, those being attacked are likely to apply a >patch quite quickly. It's a motivaton issue... people are much more >motivated to save their own butts in a hurry before trying to save >everyone else's. ;-) > Well, I would tend to agree with you here. Incentive comes in different flavors. In any event, and being a realist, I don't envision either one to be implemented with blazing speed. - paul >I think most folks in this forum are good netizens and want to do the >Right Thing(s) for everyone. Others, especially those not privy to all >the fuss about this issue, are less likely to take action and will >probably be hosting these attacks for a while, possibly w/o knowing it >until someone tracks it down and yells at them and/or they're attacked >themselves (in which case they'll probably reach for things to protect >themselves before trying to protect others). >

1 0

Re: New Denial of Service Attack on Panix
by Daniel W. McRobb 03 Oct '96

03 Oct '96

> At 03:08 PM 10/3/96 -0400, Tim Bass wrote: > > > > >The TCP fix and possibly and ICMP fix (and more work on > >kernel hackers part) will, I can safely predict, the > >faster short term solution than trying to coordinate > >the world into doing filters. > > > >Random Drop, is not a panacea, as you say Paul, but it > >is a very big, big step in the right direction and > >I predict that within 30 days and at the latest 60 > >days (because people are busy) that the SYN attack > >much less 'troublesome'. > > > > Hm. And how quickly do you think all of the reachable hosts in the > world are patched? I would suggest that ingress filtering is, by far, > less resource intensive, since the numbers of routers v. hosts are > much, much smaller. I think Tim was using the assumption (which I consider quite valid) that once vendors release patches, those being attacked are likely to apply a patch quite quickly. It's a motivaton issue... people are much more motivated to save their own butts in a hurry before trying to save everyone else's. ;-) I think most folks in this forum are good netizens and want to do the Right Thing(s) for everyone. Others, especially those not privy to all the fuss about this issue, are less likely to take action and will probably be hosting these attacks for a while, possibly w/o knowing it until someone tracks it down and yells at them and/or they're attacked themselves (in which case they'll probably reach for things to protect themselves before trying to protect others). Daniel ~~~~~~

1 0

Re: DoS, ICMP, proxies, SYNDefender
by Leonid Egoshin 03 Oct '96

03 Oct '96

>From: Tim Bass <bass(a)linux.silkroad.com> > >> Tim, unfortunately ICMP UNREACHABLE can be sent some intermediate >> router during routing flip process. For this reason some customer >> prefer cut off this sort of ICMP - it would break running TCP connection. > >Understood, however the conditions to terminate the connection >is not just as simple as UNREACHABLE. A few possible conditions: >(1) UNREACHABLE && TCP_SYN_STATE >(2) UNREACHABLE && TCP_SYN_STATE && sk->time_in_state I am not shure that it is in _ALL_ host types. Experience gave me that some time I had problem with uninterraptable service up to I configure router to cut off ICMP UNREACHABLE from outside. - Leonid Yegoshin, LY22

1 0

Re: New Denial of Service Attack on Panix
by Paul Ferguson 03 Oct '96

03 Oct '96

At 03:08 PM 10/3/96 -0400, Tim Bass wrote: > >The TCP fix and possibly and ICMP fix (and more work on >kernel hackers part) will, I can safely predict, the >faster short term solution than trying to coordinate >the world into doing filters. > >Random Drop, is not a panacea, as you say Paul, but it >is a very big, big step in the right direction and >I predict that within 30 days and at the latest 60 >days (because people are busy) that the SYN attack >much less 'troublesome'. > Hm. And how quickly do you think all of the reachable hosts in the world are patched? I would suggest that ingress filtering is, by far, less resource intensive, since the numbers of routers v. hosts are much, much smaller. In any event, I believe ingress filtering is certainly a Good Thing. Also, what progress has been made in hardening OS's for UDP flooding? - paul

1 0

Re: DoS, ICMP, proxies, SYNDefender
by Leonid Egoshin 03 Oct '96

03 Oct '96

>From: Tim Bass <bass(a)linux.silkroad.com> > >I feel like a cheerleader 'Give me an U N R E A C H A B L E' >wha-at-ya-got ......... Tim, unfortunately ICMP UNREACHABLE can be sent some intermediate router during routing flip process. For this reason some customer prefer cut off this sort of ICMP - it would break running TCP connection. - Leonid Yegoshin, LY22

2 1

NANOG Registration
by Pam Ciesla 03 Oct '96

03 Oct '96

I have just updated the list of attendees for the NANOG Meeting on the web. If you have registered and are not on the list please let me know. Thanks Pam Ciesla

2 1

Re: New Denial of Service Attack on Panix
by Paul Ferguson 03 Oct '96

03 Oct '96

I agree completely, but neither one is a panacea. - paul At 08:40 AM 10/3/96 -0400, Dima Volodin wrote: >And if everyone doesn't make any attacks we won't have any problems >either. To rephrase - relying on ingress filtering is putting your >security in someone other's hands, doing host-based stuff is protecting >yourself with your own hands. To rephrase once again - doing ingress >filtering is "being conservative with what you produce", being able to >cope with SYN floods on the host level is "being liberal on what you >accept." We need both, and overemphasising one side of the solution will >do a lot of harm. > > >Dima >

4 3

JVNC and CIX
by Paul A Vixie 03 Oct '96

03 Oct '96

FWIW, CIX allows its point to point members (such as JVNC who has a T1) to have the association filter incoming routes. Most point to point members do not take advantage of this service, since they can filter on their end and have more fine grained control over the results. JVNC's voluntary filtering is: ip as-path access-list 6 permit _46$ ip as-path access-list 6 permit _97$ ip as-path access-list 6 permit _262$ ip as-path access-list 6 permit _263$ ip as-path access-list 6 permit _1250$ ip as-path access-list 6 permit _2697$ ip as-path access-list 6 permit _3132$ ip as-path access-list 6 permit _4628$ ip as-path access-list 6 permit _4629$ Note, though, that at the moment JVNC is sending CIX precisely _no_ routes. Whether this is a coincidence or is related to Petach's complaints, I do not know. When I see routes from them again, I'll hand verify several of them and if they are still doing "the bad thing" to Petach et al, I'll see if I can get JVNC to tighten down the filters on their side.

1 0

"Basic BGP configuration problem"
by Bradley Dunn 03 Oct '96

03 Oct '96

For a good laugh, call: 800-669-8303 and select option 2. -BD

9 10

Fixing "clueless ISPs" etc etc etc, typical NANOG topic answered decisively
by Sean Doran 03 Oct '96

03 Oct '96

I thought this would bring a bright moment to everyone's Thursday. Sean. ------- Start of forwarded message ------- From: James Chellis <jchellis(a)well.com> Newsgroups: alt.internet.guru Subject: Internet Certification Date: 2 Oct 1996 05:19:04 GMT Organization: The WELL Message-ID: <52su08$28j(a)filth.well.com> Microsoft and Novell recently began looking into certification for Internet expertise. Microsoft decided to integrate material related to the Internet into existing MCP programs. Novell took a different approach; they created a new certification called the Novell Internet Professional. Do you see a value in Internet certification? Would you want to be certified in this area? What should the subject matter focus upon (since the Internet is so vast and quickly changing)? Are Microsoft, Novell,and Netscape the right companies to do this, or would a more neutral third party be more appropriate? Just a few questions I'm curious about. Please feel free to reply to this list or to me personally. Thanks. James ------- End of forwarded message -------

4 3