July 2001 - Test - lists.nanog.org

Re: DDoS attacks
by Richard A. Steenbergen 12 Jul '01

12 Jul '01

> For the last few days, I have experienced a series of DDoS attacks > on various targets around the globe. The general target is the EFNet > irc network, and servers have been attacked all through Europe, USA, > Canada, Israel, and such. Wow, EFNet is being attacked? That's never happened before. Someone should alert the media. > Due to the various attacks, more than half of the servers on the > network were black holed (null routed). The others which hold 1/3 of > the client count, are attacked, or going to be attacked soon. Perhaps because there are only 5 servers which actually accept clients? > If this keeps on going, this irc network will cease to exist. Oh the humanity. > In this time of need, it would be a great help if the large > carriers would be helpful in tracing the traffic. Hrm you may have an idea there. Since so many attacks are related to EFNet, and there are so many possible reasons for it to be impacting the rest of the internet, I propose we introduce a new ICMP type, ICMP EFNet. This message type could be used to convey all kinds of important information about why things are broken, for example: ICMP EFNet code 1 - Smurfing ICMP EFNet code 2 - SYN Flooding ICMP EFNet code 3 - Channel takeover ICMP EFNet code 4 - Warring botnets ICMP EFNet code 5 - Dianora and many other useful messages. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

9 12

Re: DDoS attacks
by Adam Herscher 12 Jul '01

12 Jul '01

> > This is pathetic. Someone asks for help and you demean them with jokes. > > Who was joking? I wasn't. I suppose that we should all start posting > "HELP ME!" posts to NANOG instead of sending an email to/calling the NOC > of networks with which we are having issues with DIRECTLY. All the > original poster did was add to the impact of the attack in question. The > attackers can now say, "Look! We kicked SO MUCH BUTT THAT THEY HAD TO GO > WHINE ON NANOG! WE RULE!" I did not originally reply because I figured you were going for a troll. Now I realize you're just clueless. Just because IRC servers are the first to feel the effects of a new, intense denial of service attack does not mean it should be ignored. The "they brought it upon themselves" argument lost all merit (hehe - Merit), when we saw large corporations (yahoo, ebay, cnn, etc) being brought to their knees by the same types of attacks. For what its worth, what we've seen in these attacks is somewhat new (log included below courtesy of Steven Nash, Lightning Internet). We should deal with them (and the networks they are coming from) now, and stop this flame war. lose the caps, lose the attitude, get a life, etc.. "kthx" Adam Herscher Administrator, irc.umich.edu -- After dealing with all these attacks on lightning the past 48 hours, and especially the past 24 hours, I noticed a trend. Very small arbitrary packets, built up of garbage (protocol FF (255) with a s.port and d.port of 0. Here is what the last blast looked like: ---netflow snippit--- AT3/0.147 24.102.124.6 Se1/0 207.45.69.69 FF 0000 0000 48K AT3/0.147 24.101.120.14 Se1/0 207.45.69.69 FF 0000 0000 4103 AT3/0.147 24.9.118.233 Se1/0 207.45.69.69 FF 0000 0000 7578 AT3/0.147 24.248.115.52 Se1/0 207.45.69.69 FF 0000 0000 465 AT3/0.147 24.9.71.197 Se1/0 207.45.69.69 FF 0000 0000 36K AT3/0.147 24.18.81.210 Se1/0 207.45.69.69 FF 0000 0000 15K AT3/0.147 24.101.82.141 Se1/0 207.45.69.69 FF 0000 0000 74K AT3/0.147 24.102.41.106 Se1/0 207.45.69.69 FF 0000 0000 69K AT3/0.147 24.8.59.35 Se1/0 207.45.69.69 FF 0000 0000 35K AT3/0.147 24.7.1.224 Se1/0 207.45.69.69 FF 0000 0000 23K AT3/0.147 24.9.29.11 Se1/0 207.45.69.69 FF 0000 0000 33K [snip] For those of you who aren't familiar with a netflow output, the second IP is the destination IP followed by the Protocol (FF), the source port (0000), the destination port (0000) and the number of packets. --

1 0

DDOS attacks and AIS and so forth
by Sean Donelan 12 Jul '01

12 Jul '01

After the DDOS attacks on several high-profile websites, a number of companies met at the White House and formed the Alliance for Internet Security. According to the web site, the AIS has several thousand members. Is the Alliance for Internet Security providing a useful function? Could something like the ISP-ISAC discussed at the last NANOG provide more or less assistance to Internet operators handling DDOS and other issues? Would an out-of-band communication system help Internet operators when a DDOS attack hits their network? Do Internet operators care about the issues affecting other networks so they can make plans, or do they prefer to concentrating only on things affecting their own network right now.

1 0

DDoS attacks
by Ariel Biener 12 Jul '01

12 Jul '01

Hi people, For the last few days, I have experienced a series of DDoS attacks on various targets around the globe. The general target is the EFNet irc network, and servers have been attacked all through Europe, USA, Canada, Israel, and such. Due to the various attacks, more than half of the servers on the network were black holed (null routed). The others which hold 1/3 of the client count, are attacked, or going to be attacked soon. If this keeps on going, this irc network will cease to exist. These attacks are all coordinated, and some people are trying to locate the source. Alot of traffic is coming via AboveNet from Korea. Alot of "zombies" are used to attack targets, PCs infected with trojans, that can be remote controlled. In this time of need, it would be a great help if the large carriers would be helpful in tracing the traffic. I am, trying to gather more data, and since alot of ISPs were attacked (C&W, Concentric, Global crossing, exodus, different academic institues in the US, Internet Gold in Israel via UUnet, the swedish telia backbone and academic institues in sweden, russian rosstelekom, gigabell.de in germany and the list goes on), I think this is a time when these people have to be stopped. At this time, it would be very helpful if AboveNet people could contact me in private. thanks, --Ariel -- Ariel Biener e-mail: ariel(a)post.tau.ac.il PGP(6.5.8) public key http://www.tau.ac.il/~ariel/pgp.html

11 11

Improving Robustness of Distributed Services (Re: DDoS attacks)
by Aleksi Suhonen 12 Jul '01

12 Jul '01

Hello, I've been involved in running part of another IRC network and I've been trying to find reasonable ways to immunize networks to DoS attacks. The reasoning behind this quest is that if there is no way to deny the service, then the attacker shouldn't have a reason to even try. I think this is relevant content for this mailing list because: * Most of DoS attacks are against IRC networks. Hence, if we can get rid of those, the health of the Internet as a whole should improve. * Experience gathered with this approach should be useful to developers and administrators of other distributed services and protocols. (e.g. usenet news, web cache heirarchies, DNS, BGP, ... YMMV) Protecting the network can be divided into two parts: Protecting network links and protecting client servers. There are a lot of well known ways to protect client servers and someone else can write about that. But apart from myself, I haven't observed anyone trying to protect network links. This I find surprising since it is often the links that the abusers are specifically trying to attack. The way I feel major inter server links should be protected is that they should be moved "out of band." They could for example be moved into permanent virtual circuits with a few megabits of guaranteed bandwidth per second. Since this protocol does not use a fully meshed network, but only an acyclic subset of it, most of the reserved bandwidth would be available for use by other services. In essence, using this dedication wouldn't use up any more bandwidth in the backbones than the current way of running links over the public Internet. It would just make sure that these critical links couldn't be caused to flap by denying their bandwidth. If resources exist and are readily available, the inter server links could maybe even be assigned a real dedicated circuit. Wrt. the applicability of this approach to other distributed services and protocols: It was just yesterday that I was talking with a friend about BGP transit and peering practises (in general) and one of the things I mentioned was that I would like to see the practise of separating the BGP transit session on its own circuit apart from the transit circuit being deployed more widely. This would not be such a bad idea at exchanges either. In some cases it might have very apparent uses for purposes other than DoS resistance as well: With the emergence of exchanges for multiple different "Internet Commodities" (IPv4, IPv4 MBone, IPv6, ...) many of the exchanges have a separate shared medium (often just a VLAN) for each of the exchanged protocols. I don't find debating about the reasons of separating them or not at this stage of hardware, software and protocol maturity useful. I'm just stating that this is one of the current practises. Now, what operators - that are capable of carrying all the protocols over a single infrastructure - could do at these exchanges is that they could run peering their sessions for all the protocols in one and work similar magic with the next-hop addresses etc. as in the transit session case above. The exchange point could provide a separate out of band shared medium over which the operators could run these peering sessions. This would simultaneously increase network stability by making the BGP sessions themselves impervious to attacks. These approaches of course require more complex configuration, more thought, more clue when debugging, and generally more everything, but I find that nothing new. Kindest regards, -- Aleksi Suhonen / Axu TM Oy Internetworking Consulting http://www.axu.tm/ PS. Of the people that flamed the original poster, tell me which were ones that didn't have any kind of affiliation with the provider that the original poster had trouble with? There was a time when they weren't the ones to effectively say "We are the phone company. We don't care. We don't have to."

2 2

Security Problem
by Diamond Technology Group 12 Jul '01

12 Jul '01

I'm working with some techs at sega.com to address a security problem. We are having trouble finding a technical contact for on.wave.home.com. Seems there is an endless shuffle. If anyone has a contact related to this, please forward to me offlist. Jeff Johnstone Diamond Technical Group Ltd.

1 0

RE: DDoS attacks
by Roeland Meyer 12 Jul '01

12 Jul '01

> From: Rob Thomas [mailto:robt@cymru.com] > Sent: Wednesday, July 11, 2001 8:24 PM > > ] I happen to agree, if only because; when script kiddies > don't have IRC to > ] play with they'll start looking elsewhere. I'd rather them > have an IRC net > ] to play with while they're being hunted. Wouldn't you? > > Agreed. Keep in mind that when the kiddies really want to > test something > nasty, they simply build their own (hidden and secured) IRC servers in > which to park the zombies. So a paucity of IRC > servers/networks isn't an > issue to them. > > Eradicating IRC isn't the solution. IRC is the "SOSUS net" > of DDoS. It > would be wise if everyone paid close attention to what is discovered > therein. Of course, it also wouldn't hurt if we actually STARTED a script-kiddie hunt, while they're making themselves so visible/vulnerable, rather than kvetching at the victim, neh?

1 0

RE: MPLS Deployments?
by Irwin Lazar 11 Jul '01

11 Jul '01

There are currently over 20 production MPLS networks in the world. A list of service providers can be found in the MPLS FAQ at www.mplsrc.com irwin ----- Irwin Lazar - ilazar(a)tbg.com <mailto:ilazar@tbg.com> Senior Consultant, The Burton Group Office: 703-742-9659 Cell: 703-402-4119 http://www.tbg.com/ "The Ultimate Resource For Network Architects" -----Original Message----- From: Serbest, Yetik [mailto:serbest@tri.sbc.com] Sent: Wednesday, July 11, 2001 11:06 AM To: 'nanog(a)merit.edu' Subject: MPLS Deployments? Hi, We would like to get some information on MPLS deployments in Today's networks. Specifically, we are interested if there are any large scale deployment with MPLS traffic engineering capabilities. Are the MPLS deployments today just best-effort tunnels based on destination prefixes? Any response is appreciated, thanks, Yetik Serbest SBC-TRI

1 0

MPLS Deployments?
by Serbest, Yetik 11 Jul '01

11 Jul '01

Hi, We would like to get some information on MPLS deployments in Today's networks. Specifically, we are interested if there are any large scale deployment with MPLS traffic engineering capabilities. Are the MPLS deployments today just best-effort tunnels based on destination prefixes? Any response is appreciated, thanks, Yetik Serbest SBC-TRI

1 0

Re: Open Peers at PAIX
by Richard A. Steenbergen 10 Jul '01

10 Jul '01

On Thu, Jun 28, 2001 at 12:46:04PM -0600, Pete Ashdown wrote: > > What follows is a list I compiled of organizations at PAIX who peer > without restrictions. Restrictions are "requirements" like nationwide > [...] > > Organization IP address AS# Email contact > > AboveNet 198.32.176.11 6461 noc(a)above.net > Exodus 198.32.176.15 3967 peering(a)exodus.net > Global Crossing 198.32.176.29 3549 peering(a)gblx.net These are the only large service provider networks I see listed. AboveNet would probably peer with a bum on the street outside PAIX if he could speak BGP, but AFAIK GBLX's requirements were at least 3 locations and bi-costal at a minimium. If I remember correctly Exodus is also slightly picky about its "ghetto peers", probably falling somewhere the middle of the other two. The rest of the list seems to basically fall into the categories of other "tier 2" regionals (Hurricane Electric, Maxim, etc), content looking for a way to save money on their transit bill (Hotmail, EA, etc), Asian networks who have a circuit to the US but aren't willing to cross it and will take any peers they can get (SingTel, KDD, etc), and misc small networks with little overwhelming value. Seems almost all the larger service providers are requiring at least bi-costal these days. You also missed a couple of the email contacts, abov is peering@ and lightning is not noc(a)cp.net :P -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

9 11