October 2002 - Test - lists.nanog.org

Lame reports - thanks!
by Rob Thomas 30 Oct '02

30 Oct '02

Hi, NANOGers. My thanks to the increasing number of you who submit lame delegation logs to me. This helps to increase the reach and usefulness of the Weekly Lame Name Server Report page: http://www.cymru.com/DNS/lame.html If you have logs you can share, anonymously or with full credit, feel free to send them to lamer(a)cymru.com. Be the first on your block to fill my lamer file system. :) Thanks! Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

1 0

IANA IPv4 allocation list format change
by Rob Thomas 30 Oct '02

30 Oct '02

Hi, NANOGers. For those of you who don't know, the format of the IANA IPv4 allocation list has changed. It now lists each prefix as a distinct /8, instead of hyphenated ranges of prefixes. This change took place on 25 October. If you are parsing this file automagically, you may wish to modify your scripts. My own script claimed that several new allocations had been made. It's fixed now. :) http://www.iana.org/assignments/ipv4-address-space My thanks to the IANA folks for this change! Thanks, Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

1 0

Re: ICANN Targets DDoS Attacks
by Jared Mauch 29 Oct '02

29 Oct '02

On Tue, Oct 29, 2002 at 06:00:06PM -0500, Ken Chase wrote: > On Tue, Oct 29, 2002 at 04:11:49PM -0500, Jared Mauch's all... > > > Once again, i'd like to see (other than a performance > > checking customer) generate more than 2Mb/s of icmp.echo and icmp.echo-reply > > packets that are legit and not part of a DoS. This is quite rare. > > little blip in the internet, and all your intelligent customers running > linux use their leet tools to figure out whats wrong. They all run > mtr vs their preferred sites. Mtr generates one ICMP packet (~80 bytes?) > of traffic PER hop in the trace. A route of 20+ hops, means 1600 bytes/s > per customer (thats 12.8Kbps). 150 customers later you got 2Mbps of > traffic (2Mb/s is 2 megaBIT per second right? you didnt mean 2 mega BYTES > per second? in which case *8). > > Is 150 customers a large number? > > And there are lots of nice graphical traceroute tools for windoze as well > of course, dont know their packet load in full operation however. > > Silly me, sometimes I leave mtrs running. I've found 2-3 going all at > once at times. <slap!/> > > Why is ICMP rate limiting on ECHO and ECHO reply going to stop all DOS > attacks? What are they going to do about UDP floods? (Are they proposing I don't recall saying it will stop all DoS attacks. It will help minimize them. Please discontinue imagination. You obviously don't understand how traceroute works by sending udp packets and getting icmp ttl expired messages back which are not icmp {echo,echo-reply}. Come back when you do understand how it works. /sigh > that DDOS attacks are all smurf based? They've just found a solution to 1996's > problems? Amazing!) They're not, but there is still a large amount of things that just do ping -f <10.2.3.4> and similar types of attacks. If you know what your usual patterns are, it's easy to notice what is out of place. > [ hopefully this post makes it to nanog. my posts've been going to /dev/null > with previous attempts ] > > /kc > > > > > Do your own stats and test your hardware. > > > > - jared > > > > -- > > Jared Mauch | pgp key available via finger from jared(a)puck.nether.net > > clue++; | http://puck.nether.net/~jared/ My statements are only mine. > > -- > Ken Chase, math(a)velocet.ca * Velocet Communications Inc. * Toronto, CANADA -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

3 2

ATM service classes
by Dan Lockwood 29 Oct '02

29 Oct '02

I'm in a knock down drag-out with my RBOC about some ATM DS3s and an OC3. Proceeding on the advice of a Cisco engineer I requested that the circuits be provisioned with UBR+. After the Bell failed to have the circuits provisioned correctly, they installed UBR, and discovering that they could not support UBR+ I have requested that the circuits be reprovisioned with VBR-NRT. These circuits are primarily used for non time sensitive data, but may be used for VOIP in the future. What suggestions does the group have regarding selecting ATM service classes with the Bell and Cisco IOS/hardware. As always, the expertise of the group is unsurpassed and GREATLY appreciated. Dan Lockwood Microsoft Certified Professional CompTIA Network+ Certified Cisco Certified Network Associate

1 0

RE: ICANN Targets DDoS Attacks
by Dan Lockwood 29 Oct '02

29 Oct '02

Would anyone be willing to post an operational example of CAR for ICMP. I would like to see what others are doing to combat the problem. Dan -----Original Message----- From: Jared Mauch [mailto:jared@puck.Nether.net] Sent: Tuesday, October 29, 2002 13:12 To: Jeff Shultz Cc: nanog(a)nanog.org Subject: Re: ICANN Targets DDoS Attacks On Tue, Oct 29, 2002 at 01:03:52PM -0800, Jeff Shultz wrote: > >> On 10/29/2002 at 3:40 PM Valdis.Kletnieks(a)vt.edu wrote: > >> >On Tue, 29 Oct 2002 22:25:44 +0200, Petri Helenius > >> ><pete(a)he.iki.fi> > >> said: > >> > > >> >> Why would you like to regulate my ability to transmit and > >> >> receive > >> data > >> >> using ECHO and ECHO_REPLY packets? Why they are considered > >> >> harmful? > >> > > >> >Smurf. > >> > > >> > >> Okay. What will this do to my user's ping and traceroute times, if > >> anything? I've got users who tend to panic if their latency hits > 250ms > >> between here and the moon (slight exaggeration, but only slight). > >> > >> I just love it when I've got people blaming me because the 20th hop > on > >> a traceroute starts returning * * * instead of times. > > > > that's icmp ttl expired messages. > > I know that, and I try to explain it to my customers... but it doesn't > answer the first part of the question - what will throttling ICMP do > to ping and traceroute times? My gut reaction is that it will a. slow > them ICMP? Or only icmp echo and icmp echo-reply messages? In a well behaved router, nothing. Obviously if you have a 7500 or older GSR linecards that are incapable of doing this due to design problems from day one in pps rates and feature path, there may be a hit. I'm not saying rate-limit anything other than echo+reply. > down and/or b. discard a lot of them making the circuit look > unreliable to ping. But I don't know enough about the underlying > technology to be sure of that. Once again, i'd like to see (other than a performance checking customer) generate more than 2Mb/s of icmp.echo and icmp.echo-reply packets that are legit and not part of a DoS. This is quite rare. Do your own stats and test your hardware. - jared -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

2 2

URLs (IPv6 ISP situations in Japan)
by itojun＠itojun.org 29 Oct '02

29 Oct '02

from the last page of my slide, in case you have missed it. itojun http://www.kame.net/ http://www.v6pc.jp/ http://www.wide.ad.jp/ http://www.wide.ad.jp/nspixp6/ http://www.iij.com/

1 0

Re: How to secure the Internet in three easy steps
by Paul Vixie 29 Oct '02

29 Oct '02

> Not only that, but unless _everyone_ implements 2 and/or 3, all the bad > people that exploit the things these are meant to protect will migrate to > the networks that lack these measures, mitigating the benefits. not just the bad people. all the people. a network with 2 or 3 in place is useless. there is no way to make 2 or 3 happen. > This seems to be a catch-22; no one will implement these for the good > of the net because it costs money, and ignorant competitors that don't > implement them will not share in that expense. Have any such ideas > been implemented in the modern internet? How? neither 2 or 3 would be for the good of the net. 1 would be. the problem with 1 is that the person who feels pain when ISP "A" doesn't do 1 is most likely to be ISP "B". therefore people confuse 1 with "internet altruism" rather than the "rational selfishness" that it is.

14 15

RE: ICANN Targets DDoS Attacks
by H. Michael Smith, Jr. 29 Oct '02

29 Oct '02

If we take Marc Sachs' presentation at face-value, the Gov't is asking us to provide such definitions (as well as anything else we can do to help). -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of bob Sent: Tuesday, October 29, 2002 10:26 AM To: fingers Cc: H. Michael Smith, Jr.; nanog(a)merit.edu Subject: Re: ICANN Targets DDoS Attacks I would point out that if we were to define it and provide the definition to the proper authorities, it would go a long way towards getting a definition that makes sense. I, (and many others here I would imagine) can help get the definition to the right ears if ya'll come up with it. iii fingers wrote: >>Agreed 100%, but Gov't (being run by lawyers) is well accustomed to >>defining what the meaning of 'is' is. If they dictate that ISPs employ >>"DDoS Protection", they will define what "DDoS Protection" means 'for >>the purposes of this policy'. >> > >ah ok > >the point I was trying to make is, there are steps that can be taken to >mitigate/reduce the affects of DDoS. I do not believe there is any >complete way to "protect against a DDoS". perhaps I'm just being pedantic. >perhaps the clarity you mention would be a good thing for other areas too >:) >

1 0

RE: ICANN Targets DDoS Attacks
by H. Michael Smith, Jr. 29 Oct '02

29 Oct '02

Agreed 100%, but Gov't (being run by lawyers) is well accustomed to defining what the meaning of 'is' is. If they dictate that ISPs employ "DDoS Protection", they will define what "DDoS Protection" means 'for the purposes of this policy'. -----Original Message----- From: fingers [mailto:fingers@fingers.co.za] Sent: Tuesday, October 29, 2002 10:04 AM To: H. Michael Smith, Jr. Cc: nanog(a)merit.edu Subject: RE: ICANN Targets DDoS Attacks > Source address verification at access layer and rate limiting icmp would > be fine starts. these are "best practices" and not "DDoS Protection" imho

3 2

ICANN Targets DDoS Attacks
by Sean Donelan 29 Oct '02

29 Oct '02

My comment from September 11, 1996 (that's not a typo) http://www.cctec.com/maillists/nanog/historical/9609/msg00302.html But what's interesting is Paul Vixie is speaking about a very narrow requirement, but when it gets translated into government regulation talk, its very different than where we started. http://www.eweek.com/article2/0,3959,651686,00.asp "Meanwhile, U.S. government security officials are discussing the possibility of creating new regulations that would require federal agencies to buy Internet service only from ISPs that have DDoS protection on their networks, according to people familiar with the situation. Such a decision could place economic pressure on the other ISPs to follow suit, thereby improving Internet security."

5 4