January 2001 - Test - lists.nanog.org

Re: Proactive steps to prevent DDOS?
by Sean Donelan 27 Jan '01

27 Jan '01

On Fri, 26 January 2001, RJ Atkinson wrote: > > At 19:15 26/01/01, Sean Donelan wrote: > > >Help me, what proactive steps can I take to protect my network from a DDOS? > > A good starting point is to review the past NANOG presentations. > URL for NANOG is: > http://www.nanog.org Most are suggestions for what other networks can do to prevent them from being a source of a DDOS attack. There is less help for what the target of a DDOS can do.

3 2

RE: How common is lack of DNS server diversity?
by Roeland Meyer 27 Jan '01

27 Jan '01

> From: Sean Donelan [mailto:sean@donelan.com] > Sent: Friday, January 26, 2001 7:01 PM > > Mice and Men found that 38% of the .COM domains surveyed > had all their name servers on the same subnet. And 75% > had one or more configuration errors. > > http://www.menandmice.com/dnsplace/healthsurvey.html Distribution requirements,of root name servers, is dependent on where in the tree you live. dot root servers should be spread out, as they are authoritative for everything. TLD root servers should also be spread out, they are authoritative for many things. SLD root servers need not be spread out so much, they are authoritative for few things. 3LD root servers don't need to even leave their AS, if the AS is down the servers, they are authoritive for, are probably also down. 4LD root servers ... who cares? More interestingly, how many root servers allow recursive lookup?

2 1

Re: DNS availability
by Bill Woodcock 27 Jan '01

27 Jan '01

> Perhaps instead of snaping [sic] back with elitist, your [sic] so > clueless banter, how about someone explain for us how if abovenet > (were [sic] their servers are) goes down how they deal with it. I don't have any reason to assume that they have servers in AboveNet's physical space. You may know more about it than I do. A quick look shows that they've got _services_ advertised from two different /24s, both of which are being advertised _through_ both AboveNet's and Exodus' ASes. It seems likely that those _services_ are being advertised from _servers_ which are located at AboveNet and Exodus facilities, however they may be locating their _servers_ at exchange points, as Nominum does, rather than in colos. Taking a quick look in Route-Views, I don't see that they have any peering, so that doesn't help us discern whether they're in colo or exchange facilities. They have servers hanging off both AboveNet's DC and SJ routing hubs, and one presumes that they're doing the same sort of geographic diversity thing with Exodus. Perhaps if you look at their web site they have a map of where their servers are, or perhaps not. So in short, it's pretty unlikely that anyone other than UltraDNS would ever know if their AboveNet connectivity went away. -Bill

1 0

Re: DNS availability
by Troy Corbin 27 Jan '01

27 Jan '01

Rich- Actually, there has... Perform a few traceroutes from various route-servers to UDNS1.ULTRADNS.NET. They are announcing the same netblock from various locales, so basically it will take you to the closest server. To actually traceroute to a few of their specific boxen in various locales, change your destination to ns1.east.ultradns.net, ns1.west.ultradns.net, ns1.jp.ultradns.net, etc. This was laid out in detail somewhere on their site during the very generous free trial of their service while in Beta. -troy On Fri, 26 Jan 2001 richb(a)pioneer.ci.net wrote: > > Christian Nielsen <cnielsen(a)nielsen.net> wrote: > > ultradns does this and has a great product. > > Interesting to read the faq on UltraDNS's website: > > > Q. I read that your service is supposed to make use of several servers > > all over the world, but you only give people two server addresses to > > provide to their registrar. How do I make use of all the other > > servers? > > > A. The two server addresses you supply your registrar when you set up > > a domain on the Managed DNS Service system are actually 'virtual' > > addresses that will route to the best possible server on our network, > > based on a number of factors. This highly intelligent mechanism allows > > you to achieve full redundancy and reliability with only two name > > server addresses actually listed. In fact, if the registrar would > > allow you to do so, you could achieve the same level of reliability > > with only one name server address. > > Looks to me like most of their hiring lately has been in marketing > and business-dev. How could an engineer make statements like the > above with a straight face? > > Or maybe there have been a few extensions to BGP which I haven't > learned about...;-) > > -rich > >

1 0

Proactive steps to prevent DDOS?
by Sean Donelan 27 Jan '01

27 Jan '01

Ok, Yahoo, Ebay, Amazon and Microsoft have all made essentially the same statement after being hit by a DDOS: "taken steps to improve protection of their networks from this type of attack." My question is What are these steps, and why can't people take them before they experience a DDOS? Is there some magic command I can put into my router to help protect my network from a DDOS, or is this just PR fluff to make it look like the corporation is doing something. But in reality there is nothing you can do, but wait for the attacker to get bored and stop on their own.

4 4

Re: DNS availability
by richb＠pioneer.ci.net 27 Jan '01

27 Jan '01

Christian Nielsen <cnielsen(a)nielsen.net> wrote: > ultradns does this and has a great product. Interesting to read the faq on UltraDNS's website: > Q. I read that your service is supposed to make use of several servers > all over the world, but you only give people two server addresses to > provide to their registrar. How do I make use of all the other > servers? > A. The two server addresses you supply your registrar when you set up > a domain on the Managed DNS Service system are actually 'virtual' > addresses that will route to the best possible server on our network, > based on a number of factors. This highly intelligent mechanism allows > you to achieve full redundancy and reliability with only two name > server addresses actually listed. In fact, if the registrar would > allow you to do so, you could achieve the same level of reliability > with only one name server address. Looks to me like most of their hiring lately has been in marketing and business-dev. How could an engineer make statements like the above with a straight face? Or maybe there have been a few extensions to BGP which I haven't learned about...;-) -rich

3 2

Re: FW: Proactive steps to prevent DDOS?
by Jeffrey Meltzer 27 Jan '01

27 Jan '01

Richard, Ever consider giving a talk about pro-active procedures in preventing DoS attacks at a NANOG conference? You seem to have a great handle on it. For those that haven't read his summary yet, check it out. He touched on some things you don't normally think about.... -- Jeffrey Meltzer Sr. Network Administrator VillageWorld.com, Inc. http://www.SolarisGuide.com/ > After much nagging^H^H^H^H^H^H^Hrequests, I put some concepts about DoS > down in writing. > > http://www.e-gerbil.net/ras/dos.txt > > Maybe it'll be useful. > > -- > Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras > PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6) > > >

1 0

Re: Proactive steps to prevent DDOS?
by Richard A. Steenbergen 27 Jan '01

27 Jan '01

On Fri, Jan 26, 2001 at 11:54:11PM -0500, Valdis.Kletnieks(a)vt.edu wrote: > > On Fri, 26 Jan 2001 16:40:04 PST, Sean Donelan said: > > Most are suggestions for what other networks can do to prevent them from > > being a source of a DDOS attack. There is less help for what the target > > of a DDOS can do. > > Unfortunately, the current draft document for the Center for Internet Security > (www.cisecurity.org) Solaris security checklist suffers from the same problem. > It mandates RFC2644 broadcasts, RFC1918 martian and RFC2827 egress filtering, > but I couldn't find any stuff on the victim end of it. > > If anybody can provide me with a good reference, I'll be happy to add > it and give credit. http://www.sans.org/dosstep/index.htm is what I > have currently on filtering. If you have a *partial* reference > (something that will work for *many* or *most* sites, for example), I > am able to phrase it as "Evaluate the techniques listed at <URL> for > appropriateness". > > Anybody got input to add? After much nagging^H^H^H^H^H^H^Hrequests, I put some concepts about DoS down in writing. http://www.e-gerbil.net/ras/dos.txt Maybe it'll be useful. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

Re: Proactive steps to prevent DDOS?
by Sean Donelan 26 Jan '01

26 Jan '01

On Fri, 26 January 2001, John Hawkinson wrote: > > But in reality there is nothing you can do, but wait for the > > attacker to get bored and stop on their own. > > This is the "state a fact that might be wrong to poll for dissent," approach? Yep. > Some people have, or are working on, automated tools that try to > detect-and-then-filter-at-the-border DDOS attacks when they happen. > > This is something to do that is not useless PR fluff that is not a magic > command. If I called my Genuity sales rep, what part number or product should I order?

3 2

microsoft explains. again.
by Marc Slemko 26 Jan '01

26 Jan '01

Hmm... sounds... umh... "interesting". And certainly something that others could benefit from knowing the details of, at an appropriate time. http://www.microsoft.com/presspass/press/2001/Jan01/01-25WebSitePR.asp says: Statement by Microsoft on Web Site Availability REDMOND, Wash. -- Jan. 25, 2001 -- During the morning of Jan. 25, Microsoft was the target of a denial of service attack against the routers that direct traffic to the company's Web sites. As a result, access to some of the Microsoft Internet properties, including Microsoft.com and MSN.com, was intermittent for many customers throughout this morning. Microsoft's global networking team quickly determined that today's issue was completely separate from yesterday's outage, and has taken a number of steps to address the issue. Currently, all sites are available to customers. This type of denial of service attack is not related to any Microsoft product. Such an attack is an attempt to interfere with the routers in one of Microsoft's Internet data centers. Microsoft's servers were running normally throughout the event, but the attack prevented access to some of the company's Web sites. It is unfortunate that an individual or group of individuals would engage in this kind of illegal activity. Microsoft has made the FBI aware of this situation, and has taken immediate steps to ensure our customers can gain access to our Web sites. These steps will also make sure that our networks have improved protection from this type of attack. We apologize for any inconvenience this has caused customers, and want to assure our customers that we will be taking more steps in the days and weeks ahead to further protect them and continue to provide a great Web experience.

4 3