September 1996 - Test - lists.nanog.org

Re: New Denial of Service Attack on Panix
by Guy T Almes 17 Sep '96

17 Sep '96

Nathan, I'm afraid that Kent is right about this one. The Internet, as a business, depends on a variety of enterprises (both commercial, educational, and personal) choosing to use the Internet as a foundation of how they do business. While I'd agree that the PANIX attack is hard to stop, and while most of the needed steps toward solving the problem are, at best, damn nuisences, we should all be putting a high priority on working together as an industry to solve it. Specifically, I liked Curtis's three-part approach to addressing the problem and hope that users, providers, and equipment vendors will all pull together on this one. -- Guy At 08:29 PM 9/16/96 -0400, Nathan Stratton wrote: >On Mon, 16 Sep 1996, Kent W. England wrote: > >> How seriously do you take this threat? If Panix were to go out of business >> and Bob Metcalfe wrote a column on it, ( :-) do you think we would have to >> deal with it together then, or can we sit tight and expect it to blow over? >> After all, it's easy to dump chemicals in the reservoir, but we still drink >> the water, right? > >I think we all have learned to live with Bob, and I have plenty of bottled >water in the basement. > >Nathan Stratton CEO, NetRail, Inc. Tracking the future today! >--------------------------------------------------------------------------- >Phone (703)524-4800 NetRail, Inc. >Fax (703)534-5033 2007 N. 15 St. Suite 5 >Email sales(a)netrail.net Arlington, Va. 22201 >WWW http://www.netrail.net/ Access: (703) 524-4802 guest >--------------------------------------------------------------------------- >"Therefore do not worry about tomorrow, for tomorrow will worry about >itself. Each day has enough trouble of its own." Matthew 6:34 > >

1 0

Re: New Denial of Service Attack on Panix
by Jerry Scharf 17 Sep '96

17 Sep '96

Craig A. Huegen wrote: > ... > > As part of a task force studying this problem, I have called some of the > major hardware vendors (namely SGI, HP, and Sun). SGI told one of the > team members "we're not allowed to really talk about this". Sun and HP > have both said "we've formed a council that has been evaluating the > situation, and will make available anything we have done to help alleviate > or prevent the problems". > > /cah Since everyone is so desperate to say that they are the leader in Internet servers, perhaps the media folks watching this should contact the vendors, then report on their woefully inadequate response to the problem. There needs to be more muscle to get theses folks to move FAST when problems like this come up. Avi has proven it is doable. It shows how used to the router vendors' 'We'll fix it today' response we've gotten. Jerry

1 0

RE: New Denial of Service Attack on Panix
by Jim Browning 17 Sep '96

17 Sep '96

Rather than "educate the enemy" via public discussion, I think it would be best if those capable of contributing to solutions to this problem: 1. Collaborated in private 2. Developed a consensus "I-D" If a solution is developed whose effectiveness is not weakened by making the details public, it can be published. If that is not the case, the solution can be made available in private to "known entities". Make sense? -- Jim

3 2

CIDR report.
by Tony Bates 17 Sep '96

17 Sep '96

Okay, after taking in a few comments. Here's what I will distribute automatically starting this Friday at 12:00 PDT. Note I have changed things around a little and added a general section with a couple of hopefully useful data points. Comments directly to me are still welcome. Cheers, --Tony P.S. It seems section 3 has been very useful in helping folks find leaks they didn't know they had. ------------------------------------------------------------------------------ This is an auto-generated mail on Mon Sep 16 23:33:23 PDT 1996 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. In the future I hope to put some (or most) of this report up on the web. ------------------------------------------------------------------------------ CIDR REPORT for 16Sep96 0) General Status Table History ------------- Date Prefixes 130996 42344 140996 39830 150996 39559 160996 39804 AS Summary ---------- Number of ASes in routing system: 1546 Number of ASes announcing only one prefix: 622 (320 cidr, 302 classful) Largest number of cidr routes: 441 announced by AS3561 Largest number of classful routes: 1244 announced by AS174 1) Gains by aggregating at the origin AS level --- 16Sep96 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS174 1244 918 326 26.2% Performance Systems International AS2493 725 454 271 37.4% i*internet AS3602 546 313 233 42.7% Intergrated Network Services Inc. AS3397 255 94 161 63.1% EMI-AS AS1 446 285 161 36.1% BBN Planet backbone AS3804 384 241 143 37.2% WorldLinx 3 AS1691 292 154 138 47.3% ANS-BLK1 AS568 376 265 111 29.5% JIS (Joint Interconnection Servic AS86 290 183 107 36.9% SURAnet Northern AS AS2386 233 139 94 40.3% INS-AS AS1717 457 365 92 20.1% RENATER AS2704 266 181 85 32.0% HOOKUP-NET-A AS721 344 265 79 23.0% DLA-ASNBLOCK-AS AS3215 128 54 74 57.8% RAIN AS3301 344 277 67 19.5% TeliaNet Sweden AS1790 269 206 63 23.4% SprintLink Washington D.C. AS813 212 150 62 29.2% UUNET Canada (ASN-UUNETCA-AS1) AS2711 109 50 59 54.1% SUNBELT-AS AS3819 79 21 58 73.4% SIGNET AS839 90 35 55 61.1% North West Territories Regional N AS855 119 66 53 44.5% NBTel AS560 356 303 53 14.9% BBN Planet, New England Region (N AS3603 80 33 47 58.8% CETCOL - Uniandes AS701 769 727 42 5.5% Alternet AS225 109 67 42 38.5% University of Virginia (VIRnet) AS278 115 74 41 35.7% Red Academica de la UNAM, Mexico. AS1785 225 184 41 18.2% NYSERNet Backbone AS3824 63 23 40 63.5% WLN AS3132 70 31 39 55.7% Red Cientifica Peruana (ASN-RCP) AS549 202 164 38 18.8% ONet Backbone --- 15Sep96 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS174 1245 915 330 26.5% Performance Systems International AS2493 717 446 271 37.8% i*internet AS3602 547 314 233 42.6% Intergrated Network Services Inc. AS1 462 293 169 36.6% BBN Planet backbone AS3397 255 94 161 63.1% EMI-AS AS3804 383 240 143 37.3% WorldLinx 3 AS1691 293 155 138 47.1% ANS-BLK1 AS568 377 266 111 29.4% JIS (Joint Interconnection Servic AS86 291 184 107 36.8% SURAnet Northern AS AS2386 234 140 94 40.2% INS-AS AS2704 267 181 86 32.2% HOOKUP-NET-A AS721 345 264 81 23.5% DLA-ASNBLOCK-AS AS3215 125 52 73 58.4% RAIN AS3301 342 275 67 19.6% TeliaNet Sweden AS1790 273 209 64 23.4% SprintLink Washington D.C. AS813 212 150 62 29.2% UUNET Canada (ASN-UUNETCA-AS1) AS1717 320 258 62 19.4% RENATER AS2711 109 50 59 54.1% SUNBELT-AS AS839 90 35 55 61.1% North West Territories Regional N AS3819 78 23 55 70.5% SIGNET AS855 119 65 54 45.4% NBTel AS560 355 302 53 14.9% BBN Planet, New England Region (N AS3603 80 33 47 58.8% CETCOL - Uniandes AS701 772 728 44 5.7% Alternet AS225 109 67 42 38.5% University of Virginia (VIRnet) AS3824 63 23 40 63.5% WLN AS278 113 73 40 35.4% Red Academica de la UNAM, Mexico. AS549 203 165 38 18.7% ONet Backbone AS3132 69 31 38 55.1% Red Cientifica Peruana (ASN-RCP) AS1785 220 183 37 16.8% NYSERNet Backbone --- 14Sep96 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS174 1255 920 335 26.7% Performance Systems International AS2493 724 454 270 37.3% i*internet AS3602 546 313 233 42.7% Intergrated Network Services Inc. AS1 458 290 168 36.7% BBN Planet backbone AS3397 255 94 161 63.1% EMI-AS AS3804 384 241 143 37.2% WorldLinx 3 AS1691 293 155 138 47.1% ANS-BLK1 AS568 375 265 110 29.3% JIS (Joint Interconnection Servic AS86 292 184 108 37.0% SURAnet Northern AS AS2386 234 140 94 40.2% INS-AS AS1717 450 361 89 19.8% RENATER AS2704 269 183 86 32.0% HOOKUP-NET-A AS721 344 263 81 23.5% DLA-ASNBLOCK-AS AS3215 126 52 74 58.7% RAIN AS3301 344 277 67 19.5% TeliaNet Sweden AS1790 272 208 64 23.5% SprintLink Washington D.C. AS813 213 151 62 29.1% UUNET Canada (ASN-UUNETCA-AS1) AS2711 109 50 59 54.1% SUNBELT-AS AS855 120 65 55 45.8% NBTel AS839 90 35 55 61.1% North West Territories Regional N AS3819 78 23 55 70.5% SIGNET AS560 353 300 53 15.0% BBN Planet, New England Region (N AS3603 80 33 47 58.8% CETCOL - Uniandes AS701 784 740 44 5.6% Alternet AS225 109 67 42 38.5% University of Virginia (VIRnet) AS3824 63 23 40 63.5% WLN AS3132 70 31 39 55.7% Red Cientifica Peruana (ASN-RCP) AS549 202 164 38 18.8% ONet Backbone AS278 113 76 37 32.7% Red Academica de la UNAM, Mexico. AS1785 220 183 37 16.8% NYSERNet Backbone --- 13Sep96 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS560 1697 877 820 48.3% BBN Planet, New England Region (N AS174 1295 938 357 27.6% Performance Systems International AS2493 728 456 272 37.4% FONOROLA-EAST AS3602 546 313 233 42.7% Intergrated Network Services Inc. AS1 462 293 169 36.6% BBN Planet backbone AS3397 255 94 161 63.1% EMI-AS AS3804 384 241 143 37.2% WorldLinx 3 AS1691 294 156 138 46.9% UNKNOWN AS86 293 183 110 37.5% SURAnet Northern AS AS568 375 265 110 29.3% JIS (Joint Interconnection Servic AS2386 235 140 95 40.4% INS-AS AS2704 271 182 89 32.8% HOOKUP-NET-A AS1717 451 362 89 19.7% RENATER AS721 348 267 81 23.3% UNKNOWN AS2900 207 126 81 39.1% Westnet Arizona (ASU) AS3215 127 53 74 58.3% RAIN AS3301 344 277 67 19.5% TeliaNet Sweden AS813 215 151 64 29.8% UUNET Canada (ASN-UUNETCA-AS1) AS701 868 809 59 6.8% Alternet AS2711 108 49 59 54.6% SUNBELT-AS AS1790 261 205 56 21.5% SprintLink Washington D.C. AS839 90 35 55 61.1% North West Territories Regional N AS3819 78 23 55 70.5% SIGNET AS855 119 66 53 44.5% NBTel AS225 109 67 42 38.5% University of Virginia (VIRnet) AS549 204 163 41 20.1% ONet Backbone AS3824 63 23 40 63.5% UNKNOWN AS3132 72 32 40 55.6% Red Cientifica Peruana (ASN-RCP) AS3566 64 25 39 60.9% UNKNOWN AS4983 62 25 37 59.7% Intel Corporation Autonomous Syst 2) Weekly Delta This a daily snapshot of changes in classfull routes being withdrawn and added. the deltas are calculated over a rolling 7 day period. Please bear in mind this is purely a "snapshot" and a large flucuation could be caused by a connectivity problem for example. However, this does give some indication of service providers that are moving to classless routing. Top 20 Withdrawn Routes from 13Sep96 to 16Sep96 -1341 AS560 BBN Planet, New England Region (N -170 AS2900 Westnet Arizona (ASU) -99 AS701 Alternet -65 AS93 MIDnet -51 AS174 Performance Systems International -29 AS4648 UNKNOWN -22 AS681 KAWAIHIKO-1 -20 AS3848 WORLDLINX -18 AS281 UNKNOWN -16 AS1706 University of Arizona -15 AS1220 Infonet Services Corporation -13 AS1930 RCCN-NET -11 AS4474 Global Village Communication -10 AS2551 NETCOM On-line Communication Serv -9 AS1292 ITESM Campus -- Monterrey -7 AS226 USC/Information Sciences Institut -6 AS1800 ICM-Atlantic -5 AS1822 BBN Planet, New England Region (N -4 AS6521 UNKNOWN -3 AS450 UNKNOWN Top 20 Added Routes from 13Sep96 to 16Sep96 44 AS1221 AARNET-AS 33 AS278 Red Academica de la UNAM, Mexico. 25 AS1794 SprintLink Pennsauken NJ 17 AS3603 CETCOL - Uniandes 13 AS4459 JapanNet ASN 11 AS4387 UNKNOWN 9 AS2686 OpenNet-Europe 8 AS2044 WORLDNET-AS 7 AS3462 Data communications Institute (Hi 6 AS5509 France Telecom Network Services D 5 AS3561 MCI 4 AS1899 Fnet, EUnet-France 3 AS3255 Ukrainian Academic and Research N 2 AS22 NOSC (Naval Ocean Systems Center) 1 AS3354 THENET-AS-1 3) Interesting aggregates List of possibly interesting aggregates --------------------------------------- aggregate origin-AS AS Description 9.2.0.0/16 AS1747 IBM Watson, Yorktown Heights, 9.20.0.0/17 AS2686 Autonomous System number for I 9.67.0.0/19 AS3561 MCI 24.0.0.0/14 AS6172 @Home Corp 24.48.0.0/18 AS1677 ANS Hartford - CNSS 53 24.64.0.0/19 AS6327 Shaw Fiberlink Ltd. 24.64.32.0/19 AS6327 Shaw Fiberlink Ltd. 24.96.0.0/18 AS6541 GTE Intelligent Network Servic 24.112.0.0/18 AS6463 Rogers Network Services 24.113.0.0/18 AS6177 SPRINTLINK11 24.124.0.0/18 AS3561 MCI 24.128.0.0/18 AS7015 UNKNOWN 24.129.0.0/18 AS7017 UNKNOWN 24.131.0.0/18 AS7016 UNKNOWN 38.231.198.0/24 AS3951 ICONNET 57.12.0.0/16 AS5384 Etisalat Emirates Internet 128.145.228.0/24 AS174 Performance Systems Internatio 128.188.1.0/24 AS560 BBN Planet, New England Region 128.193.0.0/19 AS4201 ORST-AS 129.181.216.0/22 AS517 Xlink 130.168.105.0/24 AS1270 EUnet Germany 130.168.115.0/24 AS1270 EUnet Germany 130.168.125.0/24 AS1270 EUnet Germany 130.188.2.0/24 AS565 VTT autonomous system 130.188.3.0/24 AS565 VTT autonomous system 130.188.150.0/24 AS565 VTT autonomous system 130.188.170.0/24 AS565 VTT autonomous system 130.188.252.0/24 AS565 VTT autonomous system 130.205.64.0/18 AS3561 MCI 130.252.178.0/24 AS1321 ANS San Francisco - DNSS 11 131.114.192.0/18 AS2598 Consiglio Nazionale delle Rice 131.115.211.0/24 AS3301 TeliaNet Sweden 131.117.0.0/17 AS559 SWITCH, Swiss Academic and Res 131.119.63.0/24 AS201 BBN BARRNET, Inc. 132.235.204.0/24 AS3561 MCI 134.33.100.0/24 AS701 Alternet 134.204.14.0/24 AS3561 MCI 134.204.176.0/24 AS3561 MCI 134.241.109.0/24 AS560 BBN Planet, New England Region 135.14.65.0/24 AS3111 Internet Direct Inc. (ASN-DIRE 135.37.2.0/24 AS3561 MCI 135.37.4.0/24 AS3561 MCI 135.37.10.0/24 AS3561 MCI 135.37.14.0/24 AS3561 MCI 135.40.66.0/24 AS3561 MCI 136.140.9.0/24 AS3561 MCI 138.95.80.0/24 AS701 Alternet 138.108.100.0/24 AS3561 MCI 138.182.252.0/24 AS5855 Secretary of the Navy 138.182.254.0/24 AS5855 Secretary of the Navy 139.46.35.0/24 AS560 BBN Planet, New England Region 139.61.102.0/24 AS3111 Internet Direct Inc. (ASN-DIRE 139.61.103.0/24 AS3111 Internet Direct Inc. (ASN-DIRE 139.162.128.0/17 AS1136 Unisource Internet Service NL 140.188.86.0/24 AS174 Performance Systems Internatio 140.188.129.0/24 AS174 Performance Systems Internatio 140.188.198.0/24 AS174 Performance Systems Internatio 140.222.27.0/24 AS690 NSFNET-T3-RT-AS 140.222.43.0/24 AS690 NSFNET-T3-RT-AS 140.222.48.0/24 AS690 NSFNET-T3-RT-AS 140.222.96.0/24 AS690 NSFNET-T3-RT-AS 140.231.44.0/24 AS3561 MCI 141.227.111.0/24 AS2529 Demon Internet Ltd 142.77.19.0/24 AS813 UUNET Canada (ASN-UUNETCA-AS1) 142.77.248.0/24 AS813 UUNET Canada (ASN-UUNETCA-AS1) 143.93.32.0/19 AS517 Xlink 143.222.116.0/24 AS3407 Interpath 143.252.80.0/24 AS2856 BTnet UK Regional network 144.192.181.0/24 AS4200 AGIS (Apex Global Information 144.199.161.0/24 AS1238 ICM Malaysia (MIMOS) connectee 144.224.11.0/24 AS1239 SprintLink Backbone 144.224.12.0/24 AS1239 SprintLink Backbone 144.224.13.0/24 AS6176 SPRINTLINK10 144.224.14.0/24 AS6176 SPRINTLINK10 144.224.15.0/24 AS6176 SPRINTLINK10 144.224.16.0/24 AS6176 SPRINTLINK10 144.224.21.0/24 AS1239 SprintLink Backbone 144.224.22.0/24 AS1239 SprintLink Backbone 144.224.23.0/24 AS6175 SPRINTLINK9 144.224.24.0/24 AS6175 SPRINTLINK9 144.224.25.0/24 AS6175 SPRINTLINK9 144.224.26.0/24 AS6175 SPRINTLINK9 144.228.22.0/24 AS1790 SprintLink Washington D.C. 144.228.23.0/24 AS1790 SprintLink Washington D.C. 144.228.25.0/24 AS1790 SprintLink Washington D.C. 144.228.29.0/24 AS1790 SprintLink Washington D.C. 144.228.37.0/24 AS1791 SprintLink Fort Worth TX 144.228.38.0/24 AS1791 SprintLink Fort Worth TX 144.228.39.0/24 AS1791 SprintLink Fort Worth TX 144.228.41.0/24 AS1239 SprintLink Backbone 144.228.44.0/24 AS1239 SprintLink Backbone 144.228.47.0/24 AS1792 SprintLink Stockton CA 144.228.48.0/24 AS1792 SprintLink Stockton CA 144.228.49.0/24 AS1792 SprintLink Stockton CA 144.228.54.0/24 AS1239 SprintLink Backbone 144.228.55.0/24 AS1793 SprintLink Chicago IL 144.228.57.0/24 AS1793 SprintLink Chicago IL 144.228.58.0/24 AS1793 SprintLink Chicago IL 144.228.59.0/24 AS1793 SprintLink Chicago IL 144.228.63.0/24 AS1794 SprintLink Pennsauken NJ 144.228.64.0/24 AS1794 SprintLink Pennsauken NJ 144.228.65.0/24 AS1794 SprintLink Pennsauken NJ 144.228.66.0/24 AS1794 SprintLink Pennsauken NJ 144.228.67.0/24 AS1794 SprintLink Pennsauken NJ 144.228.68.0/24 AS1794 SprintLink Pennsauken NJ 144.228.69.0/24 AS1794 SprintLink Pennsauken NJ 144.228.73.0/24 AS1795 SprintLink Anaheim CA 144.228.74.0/24 AS1795 SprintLink Anaheim CA 144.228.75.0/24 AS1795 SprintLink Anaheim CA 144.228.76.0/24 AS1795 SprintLink Anaheim CA 144.228.77.0/24 AS1795 SprintLink Anaheim CA 144.228.78.0/24 AS1795 SprintLink Anaheim CA 144.228.79.0/24 AS1795 SprintLink Anaheim CA 144.228.83.0/24 AS6174 SPRINTLINK8 144.228.84.0/24 AS6174 SPRINTLINK8 144.228.85.0/24 AS6174 SPRINTLINK8 144.228.91.0/24 AS1239 SprintLink Backbone 144.228.93.0/24 AS6177 SPRINTLINK11 144.228.94.0/24 AS6177 SPRINTLINK11 144.228.95.0/24 AS6177 SPRINTLINK11 144.228.96.0/24 AS6177 SPRINTLINK11 144.228.103.0/24 AS1239 SprintLink Backbone 144.228.104.0/24 AS1239 SprintLink Backbone 144.228.120.0/24 AS1790 SprintLink Washington D.C. 144.228.121.0/24 AS1790 SprintLink Washington D.C. 144.228.122.0/24 AS1790 SprintLink Washington D.C. 144.228.123.0/24 AS1790 SprintLink Washington D.C. 144.228.124.0/24 AS1790 SprintLink Washington D.C. 144.228.125.0/24 AS1790 SprintLink Washington D.C. 144.228.126.0/24 AS1790 SprintLink Washington D.C. 144.228.127.0/24 AS1790 SprintLink Washington D.C. 144.228.128.0/24 AS1790 SprintLink Washington D.C. 144.228.130.0/24 AS1791 SprintLink Fort Worth TX 144.228.131.0/24 AS1791 SprintLink Fort Worth TX 144.228.132.0/24 AS1791 SprintLink Fort Worth TX 144.228.133.0/24 AS1791 SprintLink Fort Worth TX 144.228.134.0/24 AS1791 SprintLink Fort Worth TX 144.228.135.0/24 AS1791 SprintLink Fort Worth TX 144.228.140.0/24 AS1792 SprintLink Stockton CA 144.228.141.0/24 AS1792 SprintLink Stockton CA 144.228.142.0/24 AS1792 SprintLink Stockton CA 144.228.143.0/24 AS1792 SprintLink Stockton CA 144.228.144.0/24 AS1792 SprintLink Stockton CA 144.228.145.0/24 AS1792 SprintLink Stockton CA 144.228.146.0/24 AS1792 SprintLink Stockton CA 144.228.147.0/24 AS1792 SprintLink Stockton CA 144.228.148.0/24 AS1792 SprintLink Stockton CA 144.228.150.0/24 AS1793 SprintLink Chicago IL 144.228.151.0/24 AS1793 SprintLink Chicago IL 144.228.152.0/24 AS1793 SprintLink Chicago IL 144.228.153.0/24 AS1793 SprintLink Chicago IL 144.228.154.0/24 AS1793 SprintLink Chicago IL 144.228.155.0/24 AS1239 SprintLink Backbone 144.228.156.0/24 AS1793 SprintLink Chicago IL 144.228.157.0/24 AS1793 SprintLink Chicago IL 144.228.158.0/24 AS1793 SprintLink Chicago IL 144.228.159.0/24 AS1793 SprintLink Chicago IL 144.228.160.0/24 AS1794 SprintLink Pennsauken NJ 144.228.161.0/24 AS1239 SprintLink Backbone 144.228.162.0/24 AS1794 SprintLink Pennsauken NJ 144.228.163.0/24 AS1794 SprintLink Pennsauken NJ 144.228.164.0/24 AS1794 SprintLink Pennsauken NJ 144.228.165.0/24 AS1794 SprintLink Pennsauken NJ 144.228.166.0/24 AS1792 SprintLink Stockton CA 144.228.214.0/24 AS1792 SprintLink Stockton CA 145.17.100.0/24 AS2856 BTnet UK Regional network 145.72.32.0/19 AS5484 BT Netherlands Regional Servic 145.72.64.0/19 AS5484 BT Netherlands Regional Servic 145.246.16.0/24 AS2856 BTnet UK Regional network 145.246.17.0/24 AS2856 BTnet UK Regional network 145.248.112.0/24 AS2706 HKSUPER 145.248.155.0/24 AS2706 HKSUPER 145.248.157.0/24 AS2706 HKSUPER 145.248.159.0/24 AS2706 HKSUPER 145.248.161.0/24 AS2706 HKSUPER 145.248.165.0/24 AS2706 HKSUPER 146.75.253.0/24 AS1257 SWIPnet Swedish IP Network 146.75.254.0/24 AS3301 TeliaNet Sweden 146.188.254.0/24 AS1849 PIPEX, Public IP EXchange 147.85.21.0/24 AS3951 ICONNET 147.85.25.0/24 AS3951 ICONNET 147.85.39.0/24 AS3951 ICONNET 147.85.44.0/24 AS3951 ICONNET 147.85.51.0/24 AS3951 ICONNET 147.85.115.0/24 AS3951 ICONNET 147.160.0.0/17 AS3561 MCI 147.160.128.0/18 AS3561 MCI 147.160.192.0/20 AS3561 MCI 147.160.208.0/20 AS3561 MCI 147.160.224.0/20 AS3561 MCI 147.160.224.0/19 AS3561 MCI 147.206.20.0/24 AS3561 MCI 148.59.5.0/24 AS2015 Msen, Inc. 148.59.15.0/24 AS2015 Msen, Inc. 148.59.16.0/24 AS2015 Msen, Inc. 148.59.221.0/24 AS2015 Msen, Inc. 148.59.224.0/24 AS2015 Msen, Inc. 148.59.227.0/24 AS2015 Msen, Inc. 148.59.228.0/24 AS2015 Msen, Inc. 148.59.229.0/24 AS2015 Msen, Inc. 148.59.231.0/24 AS2015 Msen, Inc. 148.59.232.0/24 AS2015 Msen, Inc. 148.59.234.0/24 AS2015 Msen, Inc. 148.59.239.0/24 AS2015 Msen, Inc. 148.59.241.0/24 AS2015 Msen, Inc. 148.59.242.0/24 AS2015 Msen, Inc. 148.59.245.0/24 AS2015 Msen, Inc. 148.59.246.0/24 AS2015 Msen, Inc. 148.59.247.0/24 AS2015 Msen, Inc. 148.59.249.0/24 AS2015 Msen, Inc. 148.59.252.0/24 AS2015 Msen, Inc. 148.94.210.0/24 AS5714 EDS-WEB 148.185.45.0/24 AS1849 PIPEX, Public IP EXchange 148.252.1.0/24 AS1849 PIPEX, Public IP EXchange 149.20.64.0/24 AS701 Alternet 149.212.64.0/20 AS1759 Telecom Finland iNET 150.185.128.0/18 AS1800 ICM-Atlantic 150.185.192.0/18 AS1800 ICM-Atlantic 151.185.7.0/24 AS279 SURAnet Southern AS 151.185.10.0/24 AS279 SURAnet Southern AS 152.129.186.0/24 AS4478 PNET-STL 152.158.0.0/17 AS2686 Autonomous System number for I 152.158.192.0/24 AS2687 OpenNet-AP 152.158.192.0/18 AS2687 OpenNet-AP 152.158.192.16/28 AS2687 OpenNet-AP 152.158.192.32/27 AS2687 OpenNet-AP 152.158.192.81/32 AS2687 OpenNet-AP 152.158.208.1/32 AS2687 OpenNet-AP 152.158.212.1/32 AS2687 OpenNet-AP 152.158.212.2/32 AS2687 OpenNet-AP 152.158.212.16/28 AS2687 OpenNet-AP 152.158.212.32/28 AS2687 OpenNet-AP 152.158.212.64/32 AS2687 OpenNet-AP 152.158.212.65/32 AS2687 OpenNet-AP 152.158.212.66/32 AS2687 OpenNet-AP 152.158.212.67/32 AS2687 OpenNet-AP 152.158.212.68/32 AS2687 OpenNet-AP 152.158.212.69/32 AS2687 OpenNet-AP 152.158.212.70/32 AS2687 OpenNet-AP 152.158.212.71/32 AS2687 OpenNet-AP 152.158.212.72/32 AS2687 OpenNet-AP 152.158.212.80/32 AS2687 OpenNet-AP 152.158.212.89/32 AS2687 OpenNet-AP 152.158.212.90/32 AS2687 OpenNet-AP 152.158.212.93/32 AS2687 OpenNet-AP 152.158.215.1/32 AS2687 OpenNet-AP 152.158.244.1/32 AS2687 OpenNet-AP 152.158.245.1/32 AS2687 OpenNet-AP 152.158.247.1/32 AS2687 OpenNet-AP 152.158.248.0/24 AS2687 OpenNet-AP 152.158.248.1/32 AS2687 OpenNet-AP 152.158.248.2/32 AS2687 OpenNet-AP 152.158.248.16/28 AS2687 OpenNet-AP 152.158.248.32/27 AS2687 OpenNet-AP 152.158.248.103/32 AS2687 OpenNet-AP 152.158.254.1/32 AS2687 OpenNet-AP 152.163.193.64/26 AS2056 AOL-AS 152.163.199.0/24 AS2056 AOL-AS 152.163.200.0/28 AS2056 AOL-AS 152.163.200.0/24 AS2056 AOL-AS 152.163.231.0/24 AS2056 AOL-AS 152.163.232.0/23 AS2056 AOL-AS 152.163.234.0/23 AS2056 AOL-AS 152.175.0.0/17 AS1668 ANS-BLK1 152.176.0.0/17 AS1333 ANS Atlanta - DNSS 107 152.176.128.0/17 AS1330 ANS St. Louis - DNSS 83 152.177.0.0/17 AS1332 ANS Denver - DNSS 99 152.177.128.0/17 AS1328 ANS Houston - DNSS 67 152.178.0.0/18 AS1328 ANS Houston - DNSS 67 152.178.64.0/18 AS1335 ANS Honolulu - CNSS 120 152.178.128.0/17 AS1322 ANS Los Angeles - DNSS 19 152.179.0.0/17 AS1321 ANS San Francisco - DNSS 11 152.179.128.0/17 AS1326 ANS Hartford - DNSS 51 152.180.0.0/17 AS-set UNKNOWN 152.180.128.0/17 AS-set UNKNOWN 152.181.0.0/18 AS1329 ANS Greensboro - DNSS 75 152.181.128.0/17 AS-set UNKNOWN 152.181.184.0/22 AS1667 ANS-BLK1 152.181.240.0/26 AS1670 ANS-BLK AS 152.182.0.0/17 AS1323 ANS Chicago - DNSS 27 152.183.0.0/17 AS1331 ANS Seattle - DNSS 91 152.183.128.0/17 AS1334 ANS Albuquerque - CNSS 112 152.184.0.0/17 AS1333 ANS Atlanta - DNSS 107 152.184.128.0/17 AS1330 ANS St. Louis - DNSS 83 152.185.0.0/17 AS1332 ANS Denver - DNSS 99 152.185.128.0/17 AS1328 ANS Houston - DNSS 67 152.186.0.0/18 AS1328 ANS Houston - DNSS 67 152.186.64.0/18 AS1335 ANS Honolulu - CNSS 120 152.186.128.0/17 AS1322 ANS Los Angeles - DNSS 19 152.187.0.0/17 AS1321 ANS San Francisco - DNSS 11 152.187.128.0/17 AS1326 ANS Hartford - DNSS 51 152.188.0.0/17 AS-set UNKNOWN 152.188.128.0/17 AS-set UNKNOWN 152.189.0.0/18 AS1329 ANS Greensboro - DNSS 75 152.189.128.0/17 AS1327 ANS Washington D.C. - DNSS 59 152.189.184.0/22 AS1667 ANS-BLK1 152.190.0.0/17 AS1323 ANS Chicago - DNSS 27 152.191.0.0/17 AS1331 ANS Seattle - DNSS 91 152.191.128.0/17 AS1334 ANS Albuquerque - CNSS 112 153.2.164.0/24 AS3561 MCI 153.39.129.0/24 AS701 Alternet 153.39.130.0/24 AS701 Alternet 153.39.132.0/24 AS701 Alternet 153.39.192.0/24 AS701 Alternet 153.39.193.0/24 AS701 Alternet 153.39.236.0/24 AS701 Alternet 153.39.237.0/24 AS701 Alternet 153.39.238.0/24 AS701 Alternet 153.39.239.0/24 AS701 Alternet 153.39.240.0/24 AS701 Alternet 153.39.241.0/24 AS701 Alternet 153.39.242.0/24 AS701 Alternet 153.39.244.0/24 AS701 Alternet 153.39.245.0/24 AS701 Alternet 153.39.246.0/24 AS701 Alternet 153.39.247.0/24 AS701 Alternet 153.39.248.0/24 AS701 Alternet 153.39.249.0/24 AS701 Alternet 153.39.251.0/24 AS701 Alternet 153.39.252.0/24 AS701 Alternet 153.39.253.0/24 AS701 Alternet 153.96.80.0/21 AS517 Xlink 153.96.92.0/24 AS517 Xlink 153.96.188.0/22 AS517 Xlink 153.96.230.0/24 AS517 Xlink 155.39.191.0/24 AS2685 IGN OpenNet - US 155.134.60.0/24 AS701 Alternet 155.140.124.0/24 AS1849 PIPEX, Public IP EXchange 155.173.244.0/24 AS3561 MCI 155.203.254.0/24 AS3561 MCI 155.229.176.0/22 AS7045 UNKNOWN 156.46.0.0/17 AS4550 Alpha.net Corporation (ASN-AN- 156.46.128.0/17 AS4550 Alpha.net Corporation (ASN-AN- 156.51.204.0/24 AS3301 TeliaNet Sweden 156.114.200.0/24 AS2529 Demon Internet Ltd 157.25.64.0/23 AS1887 NASK 157.25.98.0/24 AS1887 NASK 157.184.150.0/24 AS1330 ANS St. Louis - DNSS 83 157.232.100.0/24 AS3561 MCI 158.43.200.0/24 AS701 Alternet 158.118.51.0/24 AS701 Alternet 158.155.24.0/22 AS1221 AARNET-AS 158.174.254.0/24 AS2856 BTnet UK Regional network 159.24.7.0/24 AS4286 IMCI 159.87.34.0/24 AS200 BBN Planet Western Region 159.179.0.0/24 AS3561 MCI 159.197.158.0/23 AS2529 Demon Internet Ltd 159.245.84.0/22 AS1849 PIPEX, Public IP EXchange 159.245.104.0/22 AS1849 PIPEX, Public IP EXchange 160.92.0.0/17 AS3215 RAIN 160.92.128.0/24 AS3215 RAIN 160.92.129.0/24 AS2917 OLEANE - PIPEX International 160.92.130.0/23 AS3215 RAIN 160.92.132.0/22 AS3215 RAIN 160.92.136.0/21 AS3215 RAIN 160.92.144.0/20 AS3215 RAIN 160.92.160.0/19 AS3215 RAIN 160.92.192.0/18 AS3215 RAIN 161.51.224.0/20 AS1849 PIPEX, Public IP EXchange 161.52.192.0/19 AS2845 SUNET-LUND 161.120.6.0/24 AS3561 MCI 161.223.220.0/22 AS1 BBN Planet backbone 161.223.224.0/24 AS1 BBN Planet backbone 162.81.141.0/24 AS3561 MCI 162.118.201.0/24 AS3561 MCI 163.12.0.0/23 AS3576 PREPnet-EAST 163.12.5.0/24 AS3576 PREPnet-EAST 163.12.16.0/22 AS3576 PREPnet-EAST 163.12.21.0/24 AS3576 PREPnet-EAST 163.12.22.0/24 AS3576 PREPnet-EAST 163.12.23.0/24 AS3576 PREPnet-EAST 163.12.24.0/21 AS3576 PREPnet-EAST 163.12.32.0/19 AS3576 PREPnet-EAST 163.12.64.0/20 AS3576 PREPnet-EAST 163.12.81.0/24 AS3576 PREPnet-EAST 163.12.84.0/22 AS3576 PREPnet-EAST 163.12.88.0/21 AS3576 PREPnet-EAST 163.12.96.0/19 AS3576 PREPnet-EAST 163.12.128.0/21 AS3576 PREPnet-EAST 163.12.136.0/22 AS3576 PREPnet-EAST 163.12.144.0/20 AS3576 PREPnet-EAST 163.12.160.0/19 AS3576 PREPnet-EAST 163.12.192.0/21 AS3576 PREPnet-EAST 163.12.240.0/20 AS3576 PREPnet-EAST 163.49.131.0/24 AS3561 MCI 163.49.132.0/22 AS3561 MCI 163.49.136.0/22 AS3561 MCI 163.49.140.0/23 AS3561 MCI 163.49.142.0/24 AS3561 MCI 163.168.212.0/24 AS3303 Unisource Business Networks (S 163.249.43.0/24 AS3739 NEWNET 163.249.53.0/24 AS3739 NEWNET 163.249.54.0/24 AS3739 NEWNET 163.249.57.0/24 AS3739 NEWNET 163.249.140.0/22 AS3739 NEWNET 163.249.160.0/21 AS3739 NEWNET 163.249.168.0/24 AS3739 NEWNET 163.249.169.0/24 AS3739 NEWNET 163.249.170.0/24 AS3739 NEWNET 164.99.56.192/26 AS2041 CRL-GATE 164.100.64.0/20 AS3561 MCI 164.100.80.0/24 AS3561 MCI 164.100.81.0/24 AS3561 MCI 164.100.82.0/23 AS3561 MCI 164.100.84.0/22 AS3561 MCI 164.100.88.0/21 AS3561 MCI 164.100.96.0/19 AS3561 MCI 164.100.128.0/17 AS3561 MCI 164.100.167.0/24 AS3561 MCI 164.100.199.0/24 AS3561 MCI 164.103.3.0/24 AS3561 MCI 164.131.247.0/24 AS3215 RAIN 164.131.248.0/24 AS3215 RAIN 165.113.197.0/24 AS6006 UNKNOWN 165.113.198.0/24 AS6006 UNKNOWN 165.113.199.0/24 AS6006 UNKNOWN 165.113.211.0/24 AS6006 UNKNOWN 165.166.123.0/24 AS3561 MCI 165.215.64.0/18 AS4183 CompuServe, Incorporated 165.215.191.0/24 AS5090 CWI-NYD 166.38.40.0/24 AS3561 MCI 166.147.0.0/18 AS3561 MCI 166.147.64.0/18 AS3561 MCI 166.147.128.0/18 AS3561 MCI 166.147.192.0/18 AS3561 MCI 166.150.0.0/18 AS3561 MCI 166.150.64.0/18 AS3561 MCI 166.150.128.0/18 AS3561 MCI 166.150.192.0/18 AS3561 MCI 166.151.0.0/18 AS3561 MCI 166.151.64.0/18 AS3561 MCI 166.151.128.0/18 AS3561 MCI 166.151.192.0/18 AS3561 MCI 167.72.128.0/24 AS3561 MCI 167.77.32.0/24 AS3561 MCI 167.105.232.0/24 AS3561 MCI 167.170.6.0/23 AS3313 I.Net S.p.A. 167.170.32.0/23 AS3313 I.Net S.p.A. 168.14.1.0/24 AS3561 MCI 168.14.2.0/23 AS3561 MCI 168.14.4.0/22 AS3561 MCI 168.14.8.0/21 AS3561 MCI 168.14.16.0/20 AS3561 MCI 168.29.0.0/17 AS3492 ATLANTA 168.175.70.0/24 AS3561 MCI 168.175.170.0/24 AS3561 MCI 168.175.171.0/24 AS3561 MCI 168.175.172.0/24 AS3561 MCI 168.224.128.0/24 AS2856 BTnet UK Regional network 168.247.253.0/24 AS174 Performance Systems Internatio 168.247.254.0/24 AS174 Performance Systems Internatio 169.132.80.0/24 AS5000 IDT Corporation 169.200.1.0/24 AS3561 MCI 170.11.20.0/24 AS3561 MCI 170.11.49.0/24 AS3561 MCI 170.11.50.0/24 AS3561 MCI 170.11.88.0/24 AS3561 MCI 170.115.249.0/24 AS4969 Net Access 170.194.51.0/24 AS1849 PIPEX, Public IP EXchange 170.215.192.0/20 AS5650 Electric Lightwave Inc. and XM 171.25.128.0/20 AS3301 TeliaNet Sweden 171.25.144.0/21 AS3301 TeliaNet Sweden 171.25.152.0/21 AS3301 TeliaNet Sweden 171.30.170.0/24 AS2856 BTnet UK Regional network 192.103.70.0/26 AS1673 ANS-BLK1 192.103.74.0/27 AS1673 ANS-BLK1 192.231.184.4/32 AS174 Performance Systems Internatio 194.23.1.36/30 AS3305 Internet Service Provider back 194.51.28.152/30 AS1667 ANS-BLK1 195.212.2.0/28 AS2686 Autonomous System number for I 195.212.6.0/26 AS2686 Autonomous System number for I 195.212.48.0/27 AS2686 Autonomous System number for I 195.212.69.0/26 AS2686 Autonomous System number for I 195.212.74.0/27 AS2686 Autonomous System number for I 195.212.78.0/28 AS2686 Autonomous System number for I 195.212.106.0/26 AS2686 Autonomous System number for I 195.212.110.0/27 AS2686 Autonomous System number for I 195.212.198.0/25 AS2686 Autonomous System number for I 195.212.226.0/28 AS2686 Autonomous System number for I 198.83.24.0/26 AS1673 ANS-BLK1 198.83.47.0/26 AS1673 ANS-BLK1 198.83.195.0/26 AS1673 ANS-BLK1 198.83.209.0/26 AS1673 ANS-BLK1 198.83.210.0/26 AS1673 ANS-BLK1 199.99.247.32/27 AS174 Performance Systems Internatio 199.221.28.0/26 AS1673 ANS-BLK1 199.221.38.0/27 AS1673 ANS-BLK1 199.221.47.0/25 AS1673 ANS-BLK1 199.222.34.0/26 AS1673 ANS-BLK1 200.229.224.8/29 AS2685 IGN OpenNet - US 200.229.224.16/29 AS2685 IGN OpenNet - US 200.229.229.64/26 AS2685 IGN OpenNet - US 200.229.229.128/26 AS2685 IGN OpenNet - US 200.229.231.16/28 AS2685 IGN OpenNet - US 200.229.231.32/28 AS2685 IGN OpenNet - US 200.229.234.0/25 AS2685 IGN OpenNet - US 202.50.137.64/27 AS2687 OpenNet-AP 202.135.0.0/26 AS2687 OpenNet-AP 202.135.0.64/26 AS2687 OpenNet-AP 202.135.0.128/26 AS2687 OpenNet-AP 202.135.0.192/26 AS2687 OpenNet-AP 202.135.1.0/26 AS2687 OpenNet-AP 202.135.1.64/26 AS2687 OpenNet-AP 202.135.1.128/26 AS2687 OpenNet-AP 202.135.1.192/26 AS2687 OpenNet-AP 202.135.2.64/26 AS2687 OpenNet-AP 202.135.4.0/26 AS2687 OpenNet-AP 202.135.4.64/26 AS2687 OpenNet-AP 202.135.4.128/26 AS2687 OpenNet-AP 202.135.4.192/26 AS2687 OpenNet-AP 202.135.17.0/30 AS2687 OpenNet-AP 202.135.17.8/30 AS2687 OpenNet-AP 202.135.17.12/30 AS2687 OpenNet-AP 202.135.18.0/28 AS2687 OpenNet-AP 202.135.18.16/28 AS2687 OpenNet-AP 202.135.18.32/28 AS2687 OpenNet-AP 202.135.18.48/28 AS2687 OpenNet-AP 202.135.18.64/28 AS2687 OpenNet-AP 202.135.18.96/28 AS2687 OpenNet-AP 202.135.20.0/26 AS2687 OpenNet-AP 202.135.20.128/26 AS2687 OpenNet-AP 202.135.22.0/26 AS2687 OpenNet-AP 202.135.22.64/26 AS2687 OpenNet-AP 202.135.22.128/26 AS2687 OpenNet-AP 202.135.22.192/26 AS2687 OpenNet-AP 202.135.40.16/28 AS2687 OpenNet-AP 202.135.40.32/27 AS2687 OpenNet-AP 204.117.90.128/25 AS3491 CAIS-ASN 204.146.30.25/32 AS2686 Autonomous System number for I 204.148.62.0/26 AS1673 ANS-BLK1 204.148.68.0/26 AS1673 ANS-BLK1 204.150.183.0/25 AS1667 ANS-BLK1 204.151.106.0/26 AS1673 ANS-BLK1 204.151.152.0/26 AS1673 ANS-BLK1 205.156.223.176/28 AS2702 Spry AS

1 0

Re: New Denial of Service Attack on Panix
by Bill Sommerfeld 16 Sep '96

16 Sep '96

(2) Using documented stochastic methods, look for the hidden pattern in the pseudo-random sequences. There are computer programs to do this, sorry, I would have to do a search to find one (the exist, however); Watch out for this step, it's a doozey. The attacker could be using a non-cryptographic random number generator (like rand() or random()), but if he had a clue, he would be using a cryptographic random number generator based on DES, IDEA, RC4, etc., to generate the random bitstream to fill the headers. He could also be using /dev/random on late-model linux systems which would probably be even harder to reverse-engineer. - Bill

1 0

Re: Top-50 Report
by Jeffrey S. Curtis 16 Sep '96

16 Sep '96

Sean Donelan writes: }Will people please stop asking this question, it seems to put a jinx }on the net. Everytime it gets asked, some major provider kills their }network for a day, giving the answer to the question. It's not just the multihoming question - I think this entire mailing list is cursed in general. For example, one day after the UPS/generator discussion died down a week or so ago, my 36kVA UPS powering all of my central routers, ATM switches, hubs, DNS servers, network management systems, and so forth blew up (and I've got the charred components sitting behind me to prove it - it started off as a fairly routine inverter failure, but the repair people suggested that we try turning it back on, at which point the rectifier failed and the main capacitors started busting their seals). We were fortunate in that the unit flipped to bypass quickly enough that we didn't lose power to any equipment, and we didn't have any power failures during the three day period it took the repairmen to restore the unit to normal operation. Jeff -- Jeffrey S. Curtis | Internetwork Manager Argonne National Laboratory | Email: curtis(a)anl.gov 9700 South Cass Avenue, ECT-221 | Voice: 630/252-1789 Argonne, IL 60439 | Fax: 630/252-9689

1 0

RE: Top-50 Report
by Jim Browning 16 Sep '96

16 Sep '96

>From: Brett D. Watson[SMTP:bwatson@genuity.net] >Sent: Saturday, September 14, 1996 11:12 AM > > this is what i was getting at in my note a week ago or so. it >appears that many more networks are being announced by 2+ as's. so >i'm assuming we're sort of doomed to poor aggregation as more and >more people dual-home to providers. This is a trend (multi-homing) which will not only continue, but will definitely accelerate. -- Jim

4 4

Re: SYN floods (was: does history repeat itself?)
by Vadim Antonov 16 Sep '96

16 Sep '96

Jeremy Hall <jhall(a)rex.isdn.net> wrote: >In order for your idea to work, the router where you're doing the >filtering must know how to get to all destinations on the Internet, must >not have a default network or route, and they must be symetrical. Well, that is certainly not the case. For reverse-route filters to work paths do not have to be symmetrical. In fact, in interdomain routing the condition for applicability of reverse-route filters is that filtered AS must not do transit. (Note that reverse filters i described do _not_ require that the route back must be best. It just have to be present in the RIB corresponding to exterior routing session over the interface in question.) >As far as your other statement, when an instability occurs, all traffic >starts getting slow because the routers are trying to reroute around a >flapping t3 or whatever caused the outage. Since the whole point around a >denial of service attack is to deny service, by adding in the fact that >we need to know how to get to the source address before we forward the >packet introduces more problems. Ughm, i do not see the relation between flapping and more problems created by reverse-route filtering. >I think you would find this hurts more >than it helps. Would you elaborate? There's certainly little hope that SYN flooding (as well as most of other denial of service attacks) cannot be effectively prevented w/o more robust source identification, so pros are quite obvious. The fact that source identification works, and works well enough even to do billing is beyond any doubt. RELCOM does that on large scale. >Even if you limit this kind of lookups to when the packet >happens to be a TCP packet with the syn option, you still have a problem >in establishing a connection. This creates frustration on the part of the >end user. I will not comment, as that corollary is based on something which is not likely to be true. --vadim

3 3

Re: Top-50 Report
by Sean Donelan 16 Sep '96

16 Sep '96

>Then one must ask, why are so many people finding it necessary to >become multi-homed? A lot of it is kind of a vicious wheel. >Because "NSP A" had routeing problems "customer X" had to backup >their link to "NSP B". I personally think most of its down to a lack >of education to the customers. Will people please stop asking this question, it seems to put a jinx on the net. Everytime it gets asked, some major provider kills their network for a day, giving the answer to the question. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

SYN Flooding [info] (fwd)
by Michael Dillon 15 Sep '96

15 Sep '96

This company has a tool that will supposedly alleviate the effects of a SYN attack. Michael Dillon - ISP & Internet Consulting Memra Software Inc. - Fax: +1-604-546-3049 http://www.memra.com - E-mail: michael(a)memra.com ---------- Forwarded message ---------- Date: Fri, 13 Sep 1996 10:56:28 -0400 (EDT) From: Christopher Klaus <cklaus(a)iss.net> To: firewalls(a)GreatCircle.COM Subject: SYN Flooding [info] [Below we have a software tool that will recognize SYN floods and correct the problem.] Possible solution to SYN Flooding attacks The attack is on! Both 2600 and Phrack, 2 of the biggest well-known underground hacking magazines, have posted exploit code to do one of the nastiest denial of service attacks that the Internet has seen so far. Hundreds of people have access to these programs to bring down services on the Internet. Many of these people are targeting their attacks at various organizations such as ISP. Panix, an ISP, has been under attack for quite a few days now and they have not been able to receive email. Many other ISPs are suffering from the SYN flood attack. This attack is being discussed on many mailing lists, newsgroups, and Thursday's Wall Street Journal (9/12/96). Fortunately a solution already exists as we discuss below. Everyone connected to the Internet relies on TCP/IP. When you establish a connection with TCP, you do a 3-way handshake. The connecting host sends a SYN packet to the receiving host. The receiving host sends a SYN|ACK packet back and to fully establish a connection, the connecting host finally responds with an ACK packet. In a SYN flood attack, an attacker host sends many SYN packets and does not respond with an ACK to the SYN|ACK's. As the receiving host is waiting for more and more ACK's, the buffer queue will fill up and the receiving machine can no longer accepts legitimate connections. This means that attackers can block your email, web, or any other service you are providing on the Internet. To even make this attack worse, the code exploiting the problem randomizes the source address of the attacking host. Thus, the receiving machine gets packets that appear to be from all over the Internet, hiding the location of the attacker. Solution There are several things we can do to stop these attacks from being effective. With the routers for most ISP, they should be blocking any non-internal addresses from leaving their network and going to the Internet. This will stop an attacker if their ISP implements this. Unfortunately, this does not stop an attack from areas on the Internet that do not block that. But at least the ISP can feel comfortable to know that an attacker can not launch his attack from that ISP. Here are two methods of helping eliminate the problem. Some of the exploit code I have seen does not pick a random source port. It would be easy to block the attack with a router denying any packets coming from a specific source port. This may not be too effective because of the trivial nature of adding code to randomize the source port, sequence number, source address, and TTL. But it might help you temporarily if you notice the attacks have any pattern that can be blocked by router rules. Another way to fix this is to set the kernel maximum number of half open connections allowed (SO_MAXCONN) to a higher number than the default value. We have a tool that will look for SYN packets that do not get followed with ACK and clean the half open connections by sending a RST packet. This unclogs the port and allows legitimate connections to happen. This tool is called RealSecure (tm). To obtain a copy of the RealSecure tool, send email to majordomo(a)Iss.net and within the body of the message, type: subscribe realsecure RealSecure (tm) is a comprehensive attack recognition and real time response tool that ISS is alpha testing and will expire in 60 days. -- Christopher William Klaus Voice: (770)395-0150. Fax: (770)395-1972 Internet Security Systems, Inc. "Internet Scanner finds Ste. 660,41 Perimeter Center East,Atlanta,GA 30346 your network security holes Web: http://www.iss.net/ Email: cklaus(a)iss.net before the hackers do."

4 4