September 1996 - Test - lists.nanog.org

amusement
by Curtis Villamizar 17 Sep '96

17 Sep '96

***** Off Topic - Delete now if you are humor impaired! ***** Here's a recent incident and an earlier one I just found amusing enough to keep. These are both voice services, not data. I honestly wish I had saved more of these. There have been quite a few and some had some entertaimnent value. Please respect the "Reply-To". This *isn't* worth further discussion. Curtis ps- thought we needed some cheering up. If word gets out about this people might be reluctant to use voice services. ;-) pps- if IP service is as bad as Bell Atlantic Answer Call then people will leave their IP service provider so in a sense that's no joke. ------- Forwarded Messages Received: from interlock.ans.net (interlock.ans.net [147.225.5.5]) by brookfield.ans.net (8.7.3/8.7.3) with SMTP id IAA06101 for <curtis(a)brookfield.ans.net>; Tue, 17 Sep 1996 08:56:07 -0400 (EDT) Received: by interlock.ans.net id AA06319 (InterLock SMTP Gateway 3.0 for ans-world(a)ans.net) Tue, 17 Sep 1996 08:56:41 -0400 Received: by interlock.ans.net (Internal Mail Agent-2); Tue, 17 Sep 1996 08:56:41 -0400 Message-Id: <199609171256.AA04835(a)interlock.reston.ans.net> Received: by interlock.ans.net (Internal Mail Agent-1); Tue, 17 Sep 1996 08:56:41 -0400 X-Mailer: InterCon TCP/Connect II 2.1.2 Mime-Version: 1.0 Date: Tue, 17 Sep 1996 08:59:42 -0700 From: "Carol Harvey" <harvey(a)reston.ans.net> To: ans-world(a)ans.net Cc: ans-reston(a)ans.net Subject: Voice Mail Content-Type: Text/Plain; charset=US-ASCII Content-Disposition: Inline There is a system-wide outage of the Bell Atlantic Answer Call (Voice Mail) in the Northern Virginia Area. They are working on the problem and will restore voice mail as soon as possible. The good news is -- we get our own in-house voice mail with our new phone system this Friday. Carol ------- Message 2 Received: from interlock.ans.net (interlock.ans.net [147.225.5.5]) by brookfield.ans.net (8.7.4/8.7.3) with SMTP id WAA12714 for <curtis(a)brookfield.ans.net>; Tue, 23 Apr 1996 22:54:14 -0400 (EDT) Received: by interlock.ans.net id AA13449 (InterLock SMTP Gateway 3.0 for ans-world(a)ans.net) Tue, 23 Apr 1996 22:53:27 -0400 Message-Id: <199604240253.AA13449(a)interlock.ans.net> Received: by interlock.ans.net (Protected-side Proxy Mail Agent-2); Tue, 23 Apr 1996 22:53:27 -0400 Received: by interlock.ans.net (Protected-side Proxy Mail Agent-1); Tue, 23 Apr 1996 22:53:27 -0400 Date: Tue, 23 Apr 96 22:53:25 EDT From: David Bolen <db3l(a)ans.net> To: ans-world(a)ans.net Subject: Elmsford phones: It's alive! @begin(heavy sarcasm) Well, that was fun... @end(heavy sarcasm) Ok, our local PRI to NYNEX has been restored. While the backup analog connections still require the PBX cards that are getting replaced tomorrow, since the primary route (the PRI) has been restored, all phone services should be back to normal. Direct dialing Elmsford extensions is again working, Elmsford users can make 800 number calls, and local calls from Elmsford are going out over the local circuits. For those interested... It turns out that my "lost" NYNEX technician did in fact find some problems in the basement (rather than in the NYNEX shelf in the lab, which only needed a fuse replaced), but it was in gear he wasn't in the right group to "touch". So when he finally showed up again (around 8pm) he informed me he had requested that the "Hi-Tech" group (T1 and data services) dispatch someone. Luckily, they work 24 hours, and are generally on top of things. A pair (lookie - _two_ techs showed up at once to work together, what a concept) got here by about 10:15pm, and everything was up and running again within 20-30 minutes, after replacing some gear in the basement. So it only took me about 55 hours to get an appropriate crew from NYNEX to show up to handle a 20 minute, "obvious" job... I don't know whether to laugh in relief that it's over or cry in despair over what it took.... But we're back up. - -- David ------- End of Forwarded Messages

1 0

Re: A modest proposal
by Sean Donelan 17 Sep '96

17 Sep '96

>Currently, anyone can program their computer to repeatedly dial a >given business phone line and fill up a company's inbound phone lines, >making a denial of service attack. Why isn't the phone system about >to die because of it? Actually the phone system does periodically die from this. Just ask the White House switchboard operators about it. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

router syn/syn-ack/ack alarming...
by Regis Donovan 17 Sep '96

17 Sep '96

um... maybe i'm missing the clue here, but if the router vendors add something that shuts down an interface if the SYN/SYN-ACK/ACK ratio becomes too bad make it *easier* for me if i'm doing a denial of service attack on a host? instead of denying service to a given host, all i have to do is drive the router into alarm mode so it shuts off the interface and then i get to deny service to an entire segment and everything downstream from that segment... here's to better bang for your cracker-kiddie buck... --regis >

5 4

SYN and Solaris
by dvv＠sprint.net 17 Sep '96

17 Sep '96

The values to play with are tcp_conn_req_max (defines the max value for listen queue), tcp_ip_notify_cinterval (makes tcp send another SYN???), tcp_ip_abort_cinterval (aborts connection and frees the slot). Note "c" in "cinterval". I understand these timer values work for both incoming and outgoing connections. Dima

2 1

Re: New Denial of Service Attack on Panix
by Justin W. Newton 17 Sep '96

17 Sep '96

At 02:51 PM 9/17/96 -0400, Dick St.Peters wrote: > >Logging denies will fill up your log anyway. Packets arriving for a >dialup user after he/she hangs up fall through to the default route >back out of the box. They are then _outbound_ packets with source >address off the network and destination address on the network. That depends how your network is setup. Ours would have the route going to Null0, so it wouldn't be shot back out via the default route. This hides any internal instability from being announced to the outside world except in /extreme/ cases. (Like we fall completely off the net). Why would you want the packet transiting back and forth across your T-1 until the TTL expires anyway? Much better to black hole the sucker. Justin Newton Internet Architect Erol's Internet Services

2 1

Re: SYN and Solaris
by Sanjay Dani 17 Sep '96

17 Sep '96

> From: dvv(a)sprint.net (Dima Volodin) > The values to play with are tcp_conn_req_max (defines the max value for > listen queue), tcp_ip_notify_cinterval (makes tcp send another SYN???), > tcp_ip_abort_cinterval (aborts connection and frees the slot). Note "c" > in "cinterval". I understand these timer values work for both incoming > and outgoing connections. On Solaris, the default for tcp_ip_abort_cinterval is 180000 ms (3 mins). You could try reducing it to a few seconds (at the risk of denying service to legit clients connecting over slow links) using #ndd -set /dev/tcp tcp_ip_abort_cinterval <value in ms> This affects ALL tcp conenctions on the system. Solaris also lets you set the parameter for a specific destination port if the SYN attacker does not use a random destination port: #include <netinet/in.h> #include <netinet/tcp.h> .... int value = <whatever>; setsockopt(fd, IPPROTO_TCP, TCP_CONN_ABORT_THERSHOLD, &value); .... Sanjay. PS. This feature may or may not be documented--I got it from a friend at SunSoft.

1 0

Re: A modest proposal
by Vadim Antonov 17 Sep '96

17 Sep '96

Robert E. Seastrom <rs(a)bifrost.seastrom.com> wrote: >Not worth the trouble. The far ends of the earth where not even the >network admins speak English are on the ends of wet strings; it isn't >worth the aggreivation to telnet through them, and launching a >source-routed synflood through them would be self-defeating. Ah. That's changing faster than you think (can you say OC-3 to places like Singapore? Not a pipe dream anymore). And most of us don't speak German either. --vadim

1 0

Re: router syn/syn-ack/ack alarming...
by Vadim Antonov 17 Sep '96

17 Sep '96

Regis Donovan <regisdo(a)microsoft.com> wrote: >um... maybe i'm missing the clue here, but if the router vendors add >something that shuts down an interface if the SYN/SYN-ACK/ACK ratio >becomes too bad make it *easier* for me if i'm doing a denial of service >attack on a host? No, you took the "anti-SYN" shut-off in opposite direction. ISPs could install the asymmetry shut-off (why stop at SYNs / SYN-ACK pairs?) enforcing rough balance of SYNs coming from customer and SYN-ACKs coming back to customer. If the traffic is legitimate, the balance will hold. Any attempt to flood by that customer (intentional, or unintentional, by a broken software) will cause massive disbalance. The equivalent filter on victim's side won't see those SYNs and SYN-ACKs, simply because thet are going in opposite direction. >instead of denying service to a given host, all i have to do is drive >the router into alarm mode so it shuts off the interface and then i get >to deny service to an entire segment and everything downstream from that >segment... Yes, the defense may be multi-staged. I.e. if a local ISP does not enable anti-flooding defenses on its own customer links, it'll risk backbone ISP shutting its entire operation. BTW, telcos use the statistical traffic analysis (bit-density monitors is the most trivial example) to isolate troubles for years. --vadim

1 0

Re: SYN floods
by Leonid Egoshin 17 Sep '96

17 Sep '96

>From: Michael Dillon <michael(a)memra.com> > [Copyrighted text was deleted] Source address checking ... hm-m, pretty idea, but it do not very large help - it is very simple to make login to some public (or not very protected) host and produce SYN flood from legitimate address. At least one day server would be blocked. And after that - force shutdown communication between server and this public host (net) BY SERVER OWNER HANDS ! - Leonid Yegoshin, LY22

1 0

Re: New Denial of Service Attack on Panix
by Leonid Egoshin 17 Sep '96

17 Sep '96

>From: "Forrest W. Christian" <forrestc(a)iMach.com> > > 5 minute SYNS: 123423 5 minute SYN-ACKS: 50000 > >Then, if the ratio got too high, it can start yelping about "Potential SYN >D-O-S Atttack in progress on Interface Serial 1" I suggest to check not only ratio (assymetric routing !), but high number of SYNs to single host. - Leonid Yegoshin, LY22

1 0