October 2001 - Test - lists.nanog.org

RE: Fwd: Re: Digital Island sponsors DoS attempt
by Quibell, Marc 26 Oct '01

26 Oct '01

I will explain further: Companies, trying to make some money (I agree), are attempting to reroute traffic using their own techniques w/o consulting the Internet consortium. What are the consequences? I'll list one for you: The techniques used may conflict with other vendors' techniques- Let's say that DI uses pings to a client's DNS server, which in this case happens to be at the same location as the client. It pings the DNS server everytime a user from that site wants to get to Micro$oft.com. In turn M$ has it's own "local server finder" pings running, which really is more up-to-date than the other vendor, and finds and even closer server -or- M$ uses a different formula to determine the nearest server, -or- the pings from M$ arrive faster than the ones from the other vendor...etc. In each case they both have different outcomes as to which is the nearest server. Now where is the client sent? Does this not effect client routing? There is no standard. And rerouting traffic requires, no demands, Standards. If a vendor uses ping times and hops to determine closest servers, where does it ping from? Each M$ server? And then how does it tell the client or server where to redirect the traffic? If I read the original post right, the pings came from DI. How does this determine the location of off-site servers? Is this the best way to do it and what is the total bandwidth impact on the internet? The original poster of this message stated afterwards, offline, he's now up to over 2400 pings in three hours. Add this number of pings to the number of servers and the number of clients being pinged. It grows exponentially. Do you not think that there should be some Official Standards developed to accomodate and support this? Marc -----Original Message----- From: Patrick W. Gilmore [mailto:patrick@ianai.net] Sent: Friday, October 26, 2001 2:27 PM To: nanog(a)merit.edu; Quibell, Marc Subject: RE: Fwd: Re: Digital Island sponsors DoS attempt At 12:55 PM 10/26/2001 -0500, Quibell, Marc wrote: > >I see that you have no concept of what I just said. Thanks for the >clarification. James is not the only one - I have no clue what you were trying to say either. Let's look at your first statement: > Me thinks that when such technologies be commercialized on the net, there > will be problems. Usually, IP and such technologies are the charge of the > internet community and we form committees, or use IEEE, IETF, RFCs, > ARIN...etc for these and other technologies and come to open internet > standards and agreements on how to improve such things. Now we have these > people coming in here on their own and attempting to shove their technolgies > down our pipes w/o OUR concensus! Anyone now see the problem with this? I > believe this to be the key as to why this is wrong and why DI, or Akamai, > should not be even allowed to 'help' the internet. The IETF, RFCs, etc. define protocol formats. While they do define some prohibited behavior, there is a LOT of leeway in use of the packets & protocols defined. To my knowledge (and please feel free to correct me if I am wrong), the probes discussed in this thread are not prohibited in any draft, RFC, standard, etc. Since the only thing "these people" are shoving down your pipes are PROPERLY FORMATTED IP PACKETS, which violate no existing or proposed standard, I am not certain why the IETF, IEEE, etc. would even care. If you mean that they are using properly formatted packets in an incorrect fashion (e.g. spam), please be more clear. But saying that every time someone has a better way of doing something they must go to the IETF first is just plain silly. BTW: I doubt DI is trying to "'help' the internet". (I could be wrong, I do not work for DI.) They are probably trying to make money (just like most of the rest of us here). Not that they need your permission to "help" the Internet anyway, so your statement about "should not be even allowed" is completely irrelevant. >Marc -- TTFN, patrick P.S. An answer of "you don't understand" will be treated with s/you/I as you would be showing your lack of understanding through your inability to communicate your argument. >-----Original Message----- >From: James Thomason [mailto:james@divide.org] >Sent: Friday, October 26, 2001 12:18 PM >To: Quibell, Marc >Cc: 'Mike Batchelor'; nanog(a)merit.edu >Subject: RE: Fwd: Re: Digital Island sponsors DoS attempt > > >They are using standard technology, Digital Island and Akamai did not >invent ICMP. The methodology is new, and they have the right to use >it. If you dislike the methodology, you can block it, or propose to the >IETF that we change or remove ICMP.

1 0

Re: EXAMPLE: ### xxx Canada detected a penetration attempt from 209.123.x.229. Incident# xxxx
by Dan Hollis 26 Oct '01

26 Oct '01

On Fri, 26 Oct 2001, Christopher Wawak wrote: > Well, not exactly. Looking into the windows or checking the doorknobs is > more akin to looking at your directory structre on your computer or file > ... Scanning is more like going through the phone book or looking at the > names on mailboxes in a neighborhood.... So you dont mind if people portscan your network? -Dan -- [-] Omae no subete no kichi wa ore no mono da. [-]

4 3

Fwd: Re: Digital Island sponsors DoS attempt?
by Rodney Thayer 26 Oct '01

26 Oct '01

Gee, just having attended (part of) a NANOG meeting I would have thought that talking amongst the operators about how to work out connectivity quality issues amongst operators was something that was already happening, sort of like the conversations that go on about peering. If DI, or Akamai, for example, or anybody else wants to worry about connectivity to places not directly doing business with them, one would like to think they'd talk about this in some relevant forum, rather than jabbing a sharp stick in their neighbor's eye to see if they say 'ouch'. > I don't know anything about what digital island is doing in > particular, but for a long time people have struggled with the issue > of how to offer better quality connectivity to sites off of their > network. > > The communal nature of the Internet in times gone by provided > altruistic desires (usually) to provide good connectivity, but as > the quality becomes directly tied to cost, it is likely to suffer. > > I suspect that DI, like many other companies, is actively monitoring > external sites to track, study, and hopefully improve connectivity > quality to them.

1 0

RE: Fwd: Re: Digital Island sponsors DoS attempt
by Patrick W. Gilmore 26 Oct '01

26 Oct '01

At 12:55 PM 10/26/2001 -0500, Quibell, Marc wrote: > >I see that you have no concept of what I just said. Thanks for the >clarification. James is not the only one - I have no clue what you were trying to say either. Let's look at your first statement: > Me thinks that when such technologies be commercialized on the net, there > will be problems. Usually, IP and such technologies are the charge of the > internet community and we form committees, or use IEEE, IETF, RFCs, > ARIN...etc for these and other technologies and come to open internet > standards and agreements on how to improve such things. Now we have these > people coming in here on their own and attempting to shove their technolgies > down our pipes w/o OUR concensus! Anyone now see the problem with this? I > believe this to be the key as to why this is wrong and why DI, or Akamai, > should not be even allowed to 'help' the internet. The IETF, RFCs, etc. define protocol formats. While they do define some prohibited behavior, there is a LOT of leeway in use of the packets & protocols defined. To my knowledge (and please feel free to correct me if I am wrong), the probes discussed in this thread are not prohibited in any draft, RFC, standard, etc. Since the only thing "these people" are shoving down your pipes are PROPERLY FORMATTED IP PACKETS, which violate no existing or proposed standard, I am not certain why the IETF, IEEE, etc. would even care. If you mean that they are using properly formatted packets in an incorrect fashion (e.g. spam), please be more clear. But saying that every time someone has a better way of doing something they must go to the IETF first is just plain silly. BTW: I doubt DI is trying to "'help' the internet". (I could be wrong, I do not work for DI.) They are probably trying to make money (just like most of the rest of us here). Not that they need your permission to "help" the Internet anyway, so your statement about "should not be even allowed" is completely irrelevant. >Marc -- TTFN, patrick P.S. An answer of "you don't understand" will be treated with s/you/I as you would be showing your lack of understanding through your inability to communicate your argument. >-----Original Message----- >From: James Thomason [mailto:james@divide.org] >Sent: Friday, October 26, 2001 12:18 PM >To: Quibell, Marc >Cc: 'Mike Batchelor'; nanog(a)merit.edu >Subject: RE: Fwd: Re: Digital Island sponsors DoS attempt > > >They are using standard technology, Digital Island and Akamai did not >invent ICMP. The methodology is new, and they have the right to use >it. If you dislike the methodology, you can block it, or propose to the >IETF that we change or remove ICMP.

1 0

RE: [SOT Rant] Non-hostile probes / opt-in/out
by Quibell, Marc 26 Oct '01

26 Oct '01

Maybe you should ping NS01.ARMY.MIL about 2400 times in 3 hour and see if you don't get a visit? Pinging a website 2 times means nothing.. Marc -----Original Message----- From: James Thomason [mailto:james@divide.org] Sent: Friday, October 26, 2001 1:51 PM To: Dan Hollis Cc: Mike Batchelor; nanog(a)merit.edu Subject: RE: [SOT Rant] Non-hostile probes / opt-in/out PING www.army.mil (140.183.234.10): 56 data bytes ^C --- www.army.mil ping statistics --- 2 packets transmitted, 0 packets received, 100% packet loss Am I a terrorist now too? On Fri, 26 Oct 2001, Dan Hollis wrote: > > On Fri, 26 Oct 2001, Mike Batchelor wrote: > > > <rant> > > > Digital Island is certainly not alone in their practice of > > > assuming an opt-in stance. > > I think you know that for an operation like Digital Island or Akamai, asking > > every network operator permission to probe is for all practical purposes, > > impossible. Insisting on opt-in is insisting on these companies going out > > of business, or not even starting up at all. > > I wonder if Digital Island "probes" .mil sites. > > -Dan > -- > [-] Omae no subete no kichi wa ore no mono da. [-] > >

1 0

RE: Digital Island sponsors DoS attempt?
by Quibell, Marc 26 Oct '01

26 Oct '01

I actually thought about that being a problem, only if you block ALL ICMP messages. Any router beyond the blocking one will break PMTU discovery, so yeah you're right. One could always deny specific ICMP types.... Marc -----Original Message----- From: Bob K [mailto:melange@yip.org] Sent: Friday, October 26, 2001 1:45 PM To: Quibell, Marc Cc: nanog(a)merit.edu Subject: RE: Digital Island sponsors DoS attempt? On Fri, 26 Oct 2001, Quibell, Marc wrote: > Finally, I do not believe PMTU uses pings to discover the PMTU. I believe it > uses TCP or UDP packets at the layers above IP, and it DOES use "ICMP Packet > Too big" responses (from the receiver) to cut it's packet size. So in > reality, a router blocking ICMP from being routed through can still send > these ICMP messages PMTU needs. Is this how you understand it? Don't forget that routers or hosts beyond (from the point of view of the host attempting PMTU) your ICMP-blocking router may have smaller MTUs than the norm and may be trying to send ICMP errors back... -- Bob <melange(a)yip.org> | We're all wrong.

1 0

Rwhois, etc stuff from Global Crossing
by Dennis Boylan 26 Oct '01

26 Oct '01

At NANOG23 someone from Global Crossing mentioned that they had some rwhois and other stuff that they were going to release under the GPL. Can anyone elaborate on this? I would hate to have to write some of this if it has already been done. I've got an immediate need. Thanks, Dennis

2 1

RE: Fwd: Re: Digital Island sponsors DoS attempt
by Quibell, Marc 26 Oct '01

26 Oct '01

I see that you have no concept of what I just said. Thanks for the clarification. Marc -----Original Message----- From: James Thomason [mailto:james@divide.org] Sent: Friday, October 26, 2001 12:18 PM To: Quibell, Marc Cc: 'Mike Batchelor'; nanog(a)merit.edu Subject: RE: Fwd: Re: Digital Island sponsors DoS attempt They are using standard technology, Digital Island and Akamai did not invent ICMP. The methodology is new, and they have the right to use it. If you dislike the methodology, you can block it, or propose to the IETF that we change or remove ICMP. On Fri, 26 Oct 2001, Quibell, Marc wrote: > > Me thinks that when such technologies be commercialized on the net, there > will be problems. Usually, IP and such technologies are the charge of the > internet community and we form committees, or use IEEE, IETF, RFCs, > ARIN...etc for these and other technologies and come to open internet > standards and agreements on how to improve such things. Now we have these > people coming in here on their own and attempting to shove their technolgies > down our pipes w/o OUR concensus! Anyone now see the problem with this? I > believe this to be the key as to why this is wrong and why DI, or Akamai, > should not be even allowed to 'help' the internet. > > Marc Quibell > ICN Network Operations Center > Data Operations Group > noc(a)icn.state.ia.us > 1-800-572-3940 > > > > -----Original Message----- > From: Mike Batchelor [mailto:mikebat@tmcs.net] > Sent: Friday, October 26, 2001 11:51 AM > To: nanog(a)merit.edu > Subject: RE: Fwd: Re: Digital Island sponsors DoS attempt > > > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > in the case where the sender and receiver are communicating between one > > or many third parties, there is no direct relationship and thus no apriori > > terms of service to which the traffic must conform. for this, we > > reverse the > > model: "everything not welcomed is forbidden" and thus create a prior > > restraint problem which goes by the name "what, then, is implicitly > > welcome or unwelcome?" > > And how does the owner communicate this to the sender ahead of time? I > don't > think you can, else there would not be a spam problem. Therefore, the only > logical position the sender can take, if he is to act at all, is to assume > that whatever is not actively prevented or refused, is welcome, until such > time as he is notified otherwise. If it is not this way, how can ANY > unsolicited communication take place? Must I ask permission to ask > permission? > > - --- > "The avalanche has already begun. It is too late for the pebbles to vote" - > Kosh > > -----BEGIN PGP SIGNATURE----- > Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com> > > iQA/AwUBO9mUbEksS4VV8BvHEQJeQACfUpIpxRMDkZl/4CWpc/fUKF8wOFEAoKj2 > 1bhQXIg33MwAqB++ZOjlLr0r > =6hu1 > -----END PGP SIGNATURE----- >

1 0

Re: Fwd: Re: Digital Island sponsors DoS attempt
by Paul A Vixie 26 Oct '01

26 Oct '01

> > ..., the broader standard of "unwelcome" is more > > widely applicable than the narrow standard of "illegal." > > This is where we arrive at "Acceptable Use", which is why it is > required. But these policies need to be propogated and enforced at > smaller points of intervention. That's vaporware at the moment. Until it's realized, senders must follow a universal standard for determining whether their traffic will be welcomed by receivers and intermediate systems whose AUP's aren't published in a mechanised form and with whom the sender has no direct relationship, or contract, or terms of service. And unlike a direct relationship where it's safe to simply enumerate the things which mustn't be done and then assert that, subject to revision of that list, everything else is OK; in the indirect, transitive case where the recipient is distant and their policy isn't known, it's only safe to err on the side of extreme politeness: send what you know to be welcome, and hold onto the rest.

7 8

Re: Digital Island sponsors DoS attempt?
by Valdis.Kletnieks＠vt.edu 26 Oct '01

26 Oct '01

On Fri, 26 Oct 2001 09:32:39 PDT, Dave Siegel said: > If you have a list of prefix's you intend to measure, it would not be If. This list comes from *where*? What if I pointed out that IBM's AIX implements Path MTU Discovery by sending an ICMP packet with max MTU and the DF bit set (so it can discover the *max* MTU even if the first *TCP* packet is not a full MTU long)? Are you saying that I should contact each prefix that my Listserv machine is sending mail to, to get permission to negotiate PMTU discovery? Ouch. That's 600K subscribers, and I need to go look up where their MX entries point to, figure out what AS the destination is in, and send the AS contact mail (assuming that 'whois' actually has valid data) - and then repeat for every new subscriber to a list from an AS we haven't contacted before. No? That seems silly? How is it any different from 5 PING packets so a site can decide which server to send stuff from? Where do you draw the line? > transit providers needn't be involved, as transit providers typically > don't measure icmp flows bound to customers. We've seen cases where transit providers do things like install blackhole routing because they disagree with a site because of their traffic. This proves that at least *some* transit providers care about *some* traffic for *some* reason. Again, where do you draw the line? -- Valdis Kletnieks Operating Systems Analyst Virginia Tech

2 2