November 2000 - Test - lists.nanog.org

Re: DoS attacks, NSPs unresponsiveness (fwd)
by Christopher L. Morrow 08 Nov '00

08 Nov '00

Having seen Ariel's message today, and NOT seeing my original response to his post (sent to him directly, did you NOT get this email Ariel?). I've reposted this message.. my original response to Ariel and Rubens. As to the others today, Steve Sobol, you too are not a UUNET direct customer, BUT if you are under attack and your Upstream tracks this traffic to UUNET have them follow the procedures outlined below and I will track the attack. UUNET DOES pay 4 people (six actually) to do nothing but stop and track DoS attacks on its backbone... and we are quite good at it. --Chris ####################################################### ## UUNET Technologies, Inc. ## ## Manager ## ## Customer Router Security Engineering Team ## ## (W)703-289-8479 (C)703-283-3734 ## ####################################################### ---------- Forwarded message ---------- Date: Thu, 2 Nov 2000 20:02:48 -0500 (EST) From: Christopher L. Morrow <cmorrow(a)uu.net> To: Ariel Biener <ariel(a)fireball.tau.ac.il>, rkuhljr(a)uol.com.br Cc: nanog(a)merit.edu, amos rosenboim <slick(a)xchange.wan.inter.net.il> Subject: Re: DoS attacks, NSPs unresponsiveness Ariel and Rubens, I'd like to address your concerns about UUNET NOT getting involved when you networks (both downstreams of UUNET customers) are under attack. In both of your cases I have personally, on more than one occasion, contacted your upstream providers to inform them of proper contact procedures for Live Attacks. To clarify those procedures for the 10th time in a public forum, if you are under attack and your upstream is either UUNET, or it's a customer of UUNET have the DIRECT CUSTOMER of UUNET Call the UUNET Security/Fraud/Abuse Department and ask for a Rotuer Engineer. The phone number is: 1-800-900-0241 options 2,3,1 or for those that live outside the USA: 1-703-206-5440 options 2,3,1. If you no one calls there can be no action taken... in the case of Rubens, your upstream (Embratel, correct?) has been emailing attack notifications and null routing your addresses. They have been told by me personally (I spoke to an individual named 'Jorge' I believe) several times to call us so we can stop and track the attack. I have 4 engineers dedicated to dealing with DoS attacks on UUNET customers. We track several attacks per day and are available 24/7. I will not be held accountable for people's issues when they do NOT follow the appropriate contact procedures. If you would like to talk with me personally about this I invite you to call or email me directly as I'd be more than happy to clarify anything I've written in this message, my contact information is included for your convenience. For the others on this list, if you are a UUNET customer you can call our Security Department if you ever have any issues with security, DoS, fraud, spam, or the like. If you are under DoS attack either one of my engineers will stop and track the attack, or I will do it... it's what we get paid to do. If you are NOT a UUNET customer you know that other ISP's (Tier 1's atleast) do NOT filter attack traffic, and they do NOT track attacks. The ONLY exceptions to this are: Genuity, Global Crossing and at one time Verio. --Chris ####################################################### ## UUNET Technologies, Inc. ## ## Manager ## ## Customer Router Security Engineering Team ## ## (W)703-289-8479 (C)703-283-3734 ## ####################################################### On Thu, 2 Nov 2000, Ariel Biener wrote: > > > > > Hi, > > > > This e-mail comes to describe a common problem among a large number of > ISPs, mostly foreign, when dealing with US network service providers. I > don't want to talk about anyone I don't know of, so I will limit this > initial e-mail to talking about UUnet. > > As most of you know, some ISPs run irc servers, and provide an IRC > service to the community. The service is free, and maintenance and cost of > networking/hardware/human hours is on the ISPs expense. > > Irc tends to be a volatile medium, like interpersonal relationships in > real life. Thus, many times arguements turn into heated disputes, and > sometimes, some people pick up arms, and attack. The attacks usually take > out whole ISPs for hours, or days. > > The problem is that when trying to get help from the upstream provider > (UUnet in this example), you either receive a negative answer, or you're > just ignored completely. Thus, by terrorism, people get what they want, > and hold you at a threat of force, without any ability to defend yourself. > > Smurfing, icmp attacks, udp attacks, tcp synflooding (spoofed > sources) are just a number of these weapons. The problem with alot of > networking entities, be it ISPs, enterprises, and such, is that they allow > spoofed packets to leave their network (i.e. do not check if the packets > originate from within their netblocks before letting them leave their > routers). > > The question is, how can we defend ourselves, and why do the large NSPs > turn a blind eye, and act as if it's not their concern ? > > Is there a chance that by helping one another, and by implementing > Internet RFCs corrctly (rfc 1918 for example), we can contribute to the > elimination of this kind of electronic terrorism ? > > Any chance a UUnet person might answer ? > > > best regards, > > --Ariel > > -- > Ariel Biener > e-mail: ariel(a)post.tau.ac.il Work phone: 03-6406086 > fingerprint = 07 D1 E5 3E EF 6D E5 82 0B E9 21 D4 3C 7D 8B BC > >

5 7

Re: DoS issue, conclusion
by Ben Browning 08 Nov '00

08 Nov '00

At 15:17 11/7/2000 -0800, Christian Nielsen wrote: >not that... it is just that most ISPs dont have large staff to deal with these >types of issues. And maybe, if you were being DoSed, and you offered to pay >for their time, they might answer differently. One should not have to bribe ones upstream to make them behave in a reasonable and responsible manner. --- Ben Browning <benb(a)oz.net> oz.net Network Operations Tel (206) 443-8000 Fax (206) 443-0500 http://www.oz.net/

1 0

Those Pesky People at PSI
by Jeff Workman 08 Nov '00

08 Nov '00

Good morning NANOG. I present to you, for your entertainment: http://yahoo.cnet.com/news/0-1005-200-3417237.html?pt.yfin.cat_fin.txt.ne Jeff Representing me, myself, and I. -- "For competitive reasons we can't tell you the location of our fiber." -- An anonymous representative of a very large telco "For competitive reasons we can't tell you the location of our backhoe." -- An anonymous representative of a contractor.

3 2

Re: Those Pesky People at PSI
by Mauro Lollo 08 Nov '00

08 Nov '00

Yes, I would generally agree :) >From: Scott Francis <scott(a)virtualis.com> >To: Mauro Lollo <mlollo(a)hotmail.com> >CC: nanog(a)merit.edu >Subject: Re: Those Pesky People at PSI >Date: Wed, 08 Nov 2000 06:56:15 -0800 > >Mauro Lollo wrote: > >> >>Quote from the article: >> >>"My general understanding is that we have a general anti-spamming >>policy..." >> >>Hmmm, what does this generally mean ? > >_my_ general understanding is that I have a generally large blackhole >for spam networks. :) > >-- >Scott Francis v i r t u a l i s . c o m >PGP fingerprint 7ABF E2E9 CD54 A1A8 804D 179A 8802 0FBA CB33 CCA7 >illum oportet crescere me autem minui > _________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. Share information about yourself, create your own public profile at http://profiles.msn.com.

1 0

Re: Those Pesky People at PSI
by Mauro Lollo 08 Nov '00

08 Nov '00

Quote from the article: "My general understanding is that we have a general anti-spamming policy..." Hmmm, what does this generally mean ? M. >From: Jeff Workman <jworkman(a)pimpworks.org> >To: nanog(a)merit.edu >Subject: Those Pesky People at PSI >Date: Wed, 8 Nov 2000 05:06:28 -0500 (EST) > > > >Good morning NANOG. I present to you, for your entertainment: > >http://yahoo.cnet.com/news/0-1005-200-3417237.html?pt.yfin.cat_fin.txt.ne > > >Jeff >Representing me, myself, and I. > >-- >"For competitive reasons we can't tell you the location of our fiber." > -- An anonymous representative of a very large telco >"For competitive reasons we can't tell you the location of our backhoe." > -- An anonymous representative of a contractor. > > _________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. Share information about yourself, create your own public profile at http://profiles.msn.com.

1 0

DoS attacks, NSPs unresponsiveness
by Ariel Biener 08 Nov '00

08 Nov '00

Hi, This e-mail comes to describe a common problem among a large number of ISPs, mostly foreign, when dealing with US network service providers. I don't want to talk about anyone I don't know of, so I will limit this initial e-mail to talking about UUnet. As most of you know, some ISPs run irc servers, and provide an IRC service to the community. The service is free, and maintenance and cost of networking/hardware/human hours is on the ISPs expense. Irc tends to be a volatile medium, like interpersonal relationships in real life. Thus, many times arguements turn into heated disputes, and sometimes, some people pick up arms, and attack. The attacks usually take out whole ISPs for hours, or days. The problem is that when trying to get help from the upstream provider (UUnet in this example), you either receive a negative answer, or you're just ignored completely. Thus, by terrorism, people get what they want, and hold you at a threat of force, without any ability to defend yourself. Smurfing, icmp attacks, udp attacks, tcp synflooding (spoofed sources) are just a number of these weapons. The problem with alot of networking entities, be it ISPs, enterprises, and such, is that they allow spoofed packets to leave their network (i.e. do not check if the packets originate from within their netblocks before letting them leave their routers). The question is, how can we defend ourselves, and why do the large NSPs turn a blind eye, and act as if it's not their concern ? Is there a chance that by helping one another, and by implementing Internet RFCs corrctly (rfc 1918 for example), we can contribute to the elimination of this kind of electronic terrorism ? Any chance a UUnet person might answer ? best regards, --Ariel -- Ariel Biener e-mail: ariel(a)post.tau.ac.il Work phone: 03-6406086 fingerprint = 07 D1 E5 3E EF 6D E5 82 0B E9 21 D4 3C 7D 8B BC

17 37

RE: DoS attacks, NSPs unresponsiveness (fwd)
by Christopher L. Morrow 08 Nov '00

08 Nov '00

Jim, I'm sure glad C&W is 24/7 could you publish a phone number that atleast other providers could use to get intouch with the proper security element in your org? I spent 4 hours today trying to get to an engineer who could help me track an attack through corerouter1.blookington.cw.net and got bounced through your NOC, your leased line crew, your contact at MCI (yeah, that was fun), your managed firewall services crew, two other engineers I had to explain what a Syn Attack was and finally got hung up on by someone who has yet to call me back... Perhaps you can call me to get this track finished? (Since it's still going strong at over 5kpps?) --Chris ####################################################### ## UUNET Technologies, Inc. ## ## Manager ## ## Customer Router Security Engineering Team ## ## (W)703-289-8479 (C)703-283-3734 ## ####################################################### On Tue, 7 Nov 2000, Jim Farrar wrote: > > Christopher, > > I'm sure other providers will find your comments equally interesting. > > http://www.security.cw.net/ > > 7x24 Naturally. > > > /jim > > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Christopher L. Morrow > Sent: Tuesday, November 07, 2000 9:09 PM > To: nanog(a)merit.edu > Subject: Re: DoS attacks, NSPs unresponsiveness (fwd) > > > > Having seen Ariel's message today, and NOT seeing my original response > to > his post (sent to him directly, did you NOT get this email Ariel?). > I've > reposted this message.. my original response to Ariel and Rubens. > > As to the others today, Steve Sobol, you too are not a UUNET direct > customer, BUT if you are under attack and your Upstream tracks this > traffic to UUNET have them follow the procedures outlined below and I > will > track the attack. > > UUNET DOES pay 4 people (six actually) to do nothing but stop and > track > DoS attacks on its backbone... and we are quite good at it. > > --Chris > > ####################################################### > ## UUNET Technologies, Inc. ## > ## Manager ## > ## Customer Router Security Engineering Team ## > ## (W)703-289-8479 (C)703-283-3734 ## > ####################################################### > > ---------- Forwarded message ---------- > Date: Thu, 2 Nov 2000 20:02:48 -0500 (EST) > From: Christopher L. Morrow <cmorrow(a)uu.net> > To: Ariel Biener <ariel(a)fireball.tau.ac.il>, rkuhljr(a)uol.com.br > Cc: nanog(a)merit.edu, amos rosenboim <slick(a)xchange.wan.inter.net.il> > Subject: Re: DoS attacks, NSPs unresponsiveness > > Ariel and Rubens, > I'd like to address your concerns about UUNET NOT getting involved > when > you networks (both downstreams of UUNET customers) are under attack. > > In both of your cases I have personally, on more than one occasion, > contacted your upstream providers to inform them of proper contact > procedures for Live Attacks. To clarify those procedures for the 10th > time > in a public forum, if you are under attack and your upstream is either > UUNET, or it's a customer of UUNET have the DIRECT CUSTOMER of UUNET > Call > the UUNET Security/Fraud/Abuse Department and ask for a Rotuer > Engineer. The phone number is: 1-800-900-0241 options 2,3,1 or for > those > that live outside the USA: 1-703-206-5440 options 2,3,1. > > If you no one calls there can be no action taken... in the case of > Rubens, > your upstream (Embratel, correct?) has been emailing attack > notifications > and null routing your addresses. They have been told by me personally > (I > spoke to an individual named 'Jorge' I believe) several times to call > us > so we can stop and track the attack. I have 4 engineers dedicated to > dealing with DoS attacks on UUNET customers. We track several attacks > per > day and are available 24/7. > > I will not be held accountable for people's issues when they do NOT > follow > the appropriate contact procedures. If you would like to talk with me > personally about this I invite you to call or email me directly as I'd > be > more than happy to clarify anything I've written in this message, my > contact information is included for your convenience. > > For the others on this list, if you are a UUNET customer you can call > our > Security Department if you ever have any issues with security, DoS, > fraud, > spam, or the like. If you are under DoS attack either one of my > engineers > will stop and track the attack, or I will do it... it's what we get > paid > to do. If you are NOT a UUNET customer you know that other ISP's (Tier > 1's > atleast) do NOT filter attack traffic, and they do NOT track attacks. > The > ONLY exceptions to this are: Genuity, Global Crossing and at one time > Verio. > > --Chris > > ####################################################### > ## UUNET Technologies, Inc. ## > ## Manager ## > ## Customer Router Security Engineering Team ## > ## (W)703-289-8479 (C)703-283-3734 ## > ####################################################### > > On Thu, 2 Nov 2000, Ariel Biener wrote: > > > > > > > > > > > Hi, > > > > > > > > This e-mail comes to describe a common problem among a large > number of > > ISPs, mostly foreign, when dealing with US network service > providers. I > > don't want to talk about anyone I don't know of, so I will limit > this > > initial e-mail to talking about UUnet. > > > > As most of you know, some ISPs run irc servers, and provide an > IRC > > service to the community. The service is free, and maintenance and > cost of > > networking/hardware/human hours is on the ISPs expense. > > > > Irc tends to be a volatile medium, like interpersonal > relationships in > > real life. Thus, many times arguements turn into heated disputes, > and > > sometimes, some people pick up arms, and attack. The attacks usually > take > > out whole ISPs for hours, or days. > > > > The problem is that when trying to get help from the upstream > provider > > (UUnet in this example), you either receive a negative answer, or > you're > > just ignored completely. Thus, by terrorism, people get what they > want, > > and hold you at a threat of force, without any ability to defend > yourself. > > > > Smurfing, icmp attacks, udp attacks, tcp synflooding (spoofed > > sources) are just a number of these weapons. The problem with alot > of > > networking entities, be it ISPs, enterprises, and such, is that they > allow > > spoofed packets to leave their network (i.e. do not check if the > packets > > originate from within their netblocks before letting them leave > their > > routers). > > > > The question is, how can we defend ourselves, and why do the > large NSPs > > turn a blind eye, and act as if it's not their concern ? > > > > Is there a chance that by helping one another, and by > implementing > > Internet RFCs corrctly (rfc 1918 for example), we can contribute to > the > > elimination of this kind of electronic terrorism ? > > > > Any chance a UUnet person might answer ? > > > > > > best regards, > > > > --Ariel > > > > -- > > Ariel Biener > > e-mail: ariel(a)post.tau.ac.il Work phone: 03-6406086 > > fingerprint = 07 D1 E5 3E EF 6D E5 82 0B E9 21 D4 3C 7D 8B BC > > > > > > > > > >

3 2

RE: legacy root servers missing domains again ?
by Roeland Meyer 08 Nov '00

08 Nov '00

I'd like to correct a fallacy, just before it gets started. I'm only doing this because this was so widely cross-posted. I correct this, not because I am enamoured with ICANN. It is because I don't want alternate root-server systems tarnished with false ideas and concepts. There is a huge difference in stability between alternet root server and ICANN root servers. There are serious operational issues that are different between alternet roots and ICANN roots. This stems primarily from the fact that the alternet roots are adding new TLDs at a higher rate than the ICANN is. This is in addition to the normal motion of IP addrs, as hosts get moved around, maintained, re-assigned. The alternate roots are actually adding TLDs, the ICANN isn't, yet. Even when the ICANN does, it is unlikely that they will ever match the addition rate of the alternate root system. The net result of this is, by the definition of stability, the system with the higher rate of change is more unstable. It is the fact that there are few failures, in the face of this instability, that the alternate root systems stand out as superior. Given the fact that the ICANN root system has been glacially frozen for the past four years (aka. stable as an ice-cube in an antarctic winter) there is really no reason for ANY root-zone failures on the part of ICANN/NSI. Let's face it, two or three root-zone edits per year hardly even registers as brownian motion. Yet the ICANN/NSI root server system has been documented to fail, repeatedly, for the past three years. With some outages having lasted as long as three days. Mainly due to problems with, what should be, a regular automated operational system. The issues are not about which system is inherently more stable. It's about operations management. If the alternate root system operators were running the ICANN/NSI root system it would probably have fewer failures. The converse case, I leave to the imagination of the reader. The alternate root system cannot be more stable than the ICANN/NSI system and it isn't. However, it has a great deal lower failure rate, in spite of the inherent instability of regular TLD additions. It is the one area where I have a great deal of concern about ICANN adding more TLDs next week. I'll see you all in Marina Del Rey. --- Roeland M.J. Meyer Managing Director, MHSC-NET Morgan Hill Software Company, Inc. /ICANN/DNSO/WG-C, WG-B, and GA member > -----Original Message----- > From: Philippe Landau [mailto:lists@A-Z-Internet.com] > Sent: Tuesday, November 07, 2000 7:49 PM > To: nanog(a)merit.edu > Cc: domain-policy(a)lists.netsol.com; Rick Macdougall; > discuss-list(a)opensrs.org > Subject: legacy root servers missing domains again ? > > > > wouldn't be too surprising after the DOC/NSI/ICANN cabal > did nothing to correct problems revealed last time > it happened. talking stability while staging intrigues. > and illegally censoring the net, for the first time with > admittedly political justification (voteauction.com) > corporate government is just not compatible with stability, > especially when undermining democracy through systematic corruption. > if it continues like this, alternative roots will take over > much faster then expected, be it just because they are more stable. > > kind regards philippe, InternetRoots.com > > --- *** --- > <nslookup:www.bluesnews.com/*/62.2.32.250> > > Non-authoritative answer: > www.bluesnews.com A 61660 205.229.73.2 > > Authority: > BLUESNEWS.com NS 61660 > ns1.ugonetworks.com 205.229.75.1 > BLUESNEWS.com NS 61660 > ns2.ugonetworks.com 205.229.75.2 > BLUESNEWS.com NS 61660 > nserv1.actionworld.com 206.41.27.5 > NSLookup normal completion. > --- > > <nslookup:www.bluesnews.com/*/a.root-servers.net> > > Authoritative answer: > Name Error - domain name referenced does not exist. > NSLookup Terminated. > --- > > <nslookup:www.rhythms.net/*/a.root-servers.net> > > Authoritative answer: > Name Error - domain name referenced does not exist. > NSLookup Terminated. > --- > > http://voteauction.com/ > http://62.116.31.68/pr2.htm > http://voteauction.de/ >

1 0

Re: legacy root servers missing domains again ?
by Philippe Landau 08 Nov '00

08 Nov '00

the missing domains i give as examples are heavyweights unlike the bluenews.com you mention. (and as we learned from answers to questions from karl auerbach, a "stealth" server is replacing a.root-servers.net as "master server" for the legacy root servers.) sorry about the initial cross-posting, i thought there might be some urgency in the matter. kind regards philippe, InternetRoots.com --- *** --- >Hello Philippe, > >Tuesday, November 07, 2000, 7:49:25 PM, you wrote: > >> --- *** --- >> <nslookup:www.bluesnews.com/*/62.2.32.250> > >Sometimes people jump to conclusions too quickly >;; AUTHORITY SECTION: >bluenews.com. 2D IN NS FINNA.RADIANT.NET. >bluenews.com. 2D IN NS SHAMU.RADIANT.NET. > >;; ADDITIONAL SECTION: >FINNA.RADIANT.NET. 2D IN A 207.194.200.1 >SHAMU.RADIANT.NET. 2D IN A 207.194.200.129 > >;; Total query time: 99 msec >;; FROM: frodo.dso.net to SERVER: a.root-servers.net 198.41.0.4 > >That is from the a.root-servers.net server, the master server for the >dot-com zone. > > >-- >Best regards, > William mailto:william@userfriendly.com >> --- *** --- >><nslookup:www.bluesnews.com/*/a.root-servers.net> >> >>Authoritative answer: >> Name Error - domain name referenced does not exist. >>NSLookup Terminated.

1 0

BOF on MPLS peering?
by Bob Biver 07 Nov '00

07 Nov '00

Is anyone currently talking about MPLS peering ? _________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. Share information about yourself, create your own public profile at http://profiles.msn.com.

3 3