November 2002 - Test - lists.nanog.org

Re: Where is the edge of the Internet? Re: no ip forged-source-address
by bdragon＠gweep.net 07 Nov '02

07 Nov '02

> fine now? u can put "loose"...its NO USE!! thats what i said..there will > always be a route to the source....all u may drop is 10.x/192.168 and > 172/16-31......that too if ur network isnt internally using it.... Oh, and if this ends up being the case, what's wrong with that? Less RFC1918 crap leaking between enterprises.

1 0

Re: Where is the edge of the Internet? Re: no ip forged-source-address
by bdragon＠gweep.net 07 Nov '02

07 Nov '02

> fine now? u can put "loose"...its NO USE!! thats what i said..there will > always be a route to the source....all u may drop is 10.x/192.168 and > 172/16-31......that too if ur network isnt internally using it.... > > and if u end up putting "loose" an OSPF router ull drop valid traffic if ur > not redistributing bgp etc..and if u are redistributing...well again the > above argument holds true...every registered network will be there in BGP > ..... > > -rgds > Alok Since you appear to have not looked into the various implementations of RPF, I'll help you out. RPF uses the FIB, the FIB is populated by all the RIBS, therefore OSPF vs. BGP is a red herring. In the case you describe, you can use semi-strict RPF, populated with all of the networks associated with the customer. This would allow sources from the customer, regardless of path back to those sources, still drop other paths from which there is no path back to the source via the customer, is more efficient than acls, and you already have the data if you are filtering their route announcements.

1 0

RE: Where is the edge of the Internet? Re: no ip forged-source-address
by H. Michael Smith, Jr. 07 Nov '02

07 Nov '02

One of my clients is currently a victim of an over-zealous ISP recklessly trying to implement rpf. One (of two) ISPs are trying to monitor my customer's circuit by watching the serial interface (IP address) of the cpe (customer owned and controlled) router (IP address is from ISP's block). Due to the fact that this customer has a T1 to one ISP and a DS-3 to another ISP, the return path of this monitoring traffic is sent via the 2nd ISP's link. This 2nd ISP (DS-3) is dropping the packets because they are being sourced from the serial interface (IP address of 1st ISP). Advertised routes != valid source addresses.... is this not obvious? I can think of MANY examples of different sets of prefixes being advertised across different links, while the routing decision for outbound packets does not consider what routes are being advertised. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of alok Sent: Thursday, November 07, 2002 3:00 PM To: Majdi S. Abbas; nanog(a)merit.edu Subject: Re: Where is the edge of the Internet? Re: no ip forged-source-address On Fri, Nov 08, 2002 at 01:01:33AM +0530, alok wrote: > there was a comment from chris saying..."never possible to knw what networks > an bgp customer uplinks via you" which is very true.. ..so i assume u mean > non-bgp customers? loose or strict, rpf will not work for aasymterically > connected bgp neighbouring AS.... How does loose not work in this scenario? If it's not in the global tables -at all-, it's not reachable, and might as well be discarded. ------> the scenario is this... a BGP customer uplinks network a.b.c.d via me, but advertises it via some place else (some other network he peers with) and some other bgp peer/router to bring that traffic back into his AS... this can also happen mainly due to BGP metrics blah blah.... now, essentially a.b.c.d can be anything...and he need not tell me what he uplinks from me, all he tells me are the networks he downlinks via me so as to tell me what routemaps to put with acls for bgp advertisements from him...... infact people tend to use this very often (also a way of providing link failure etc by multihoming) ..and they have the choice to uplink anything from anywhere and downlink it from another location...they certainly dont need to tell you what they uplink..as far as i know... now the point is that if you use loose rfp here.... what are u filtering on? you dont even know what he is uplinking to you... i assume the subject is still DDoS attacks...using spoofed ips... now when u dont know what he is uplinking from ur networks, how do u even know what to block? if u say "loose" simply means check if the entry for the network is there in the routing table..then the entire internet is there in the routing table...(thanks to bgp)....so it certainly work on bgp based "edges" the other point u made about not reachable...well not reachaable from where? from a ospf running node which uses 0.0.0.0 ? a lot of ones own networks etc may not be reachable from there i guess...as they are covered in default routes... for a bgp running router...all valid internet addresses are "reachable" , for an ospf router....all is reachable either via 0.0.0.0, and if u remove default any, it doesnt even know what the customer networks are.....so a lot "isnt" reachable.... i think as was rightly defined...the edge is the place where the end user/host gets onto the net...

2 1

Re: Where is the edge of the Internet? Re: no ip forged-source-address
by alok 07 Nov '02

07 Nov '02

there was a comment from chris saying..."never possible to knw what networks an bgp customer uplinks via you" which is very true.. ..so i assume u mean non-bgp customers? loose or strict, rpf will not work for aasymterically connected bgp neighbouring AS.... ----- Original Message ----- From: <bdragon(a)gweep.net> To: alok <alok.dube(a)apara.com> Cc: <nanog(a)nanog.org> Sent: Friday, November 08, 2002 12:41 AM Subject: Re: Where is the edge of the Internet? Re: no ip forged-source-address > > I'm opposed to some of the suggestions where to put source address > > filters, especially placing them in "non-edge" locations. E.g. requiring > > address filters at US border crossings is a *bad* idea, worthy of an > > official visit from the bad idea fairy. > > What is bad about filtering facing non-customers, if loose rpf is > used? I'm assuming this is what you mean by "border crossings" rather than > the literal. > > --------->makes sense on the edge/aggregation but if you do it further up in > the network.....there maybe some cases where we have assymetric routing, > where the path of uplink is never the path the same as the downlink, and > infact the source network of the packet may never be present in the routing > table....(it is possible, after all its a packet switched network and the > routing is destination IP based) ... Right, which is why I specifically mentioned loose rpf, vs. strict rpf. Even further up the customer chain, you'll still have a list of customer networks (assuming folks are doing the right thing by filtering customer bgp announcements) which could be used as an input to strict rpf.

5 7

Re: Where is the edge of the Internet? Re: no ip forged-source-address
by alok 07 Nov '02

07 Nov '02

if what u mean by loose is "exist only" then yes on a bgp running router probably the WHOLE INTERNET IS EXIST ONLY...that surely gives u enuf ips to spoof with....?? how do u block by source????????? you could only know that "frrom that link between as-1 and as-2 there will be some traffic from a network IP of AS-1" etc...which still is a huge network..enuf to spoof lots of IPs..... =====> for clarification.....i mean "any *registered* netowrk of AS-1 can uplink via this link" ...this link may not be the downlink for this network into AS-1 but can still be an uplink..... fine now? u can put "loose"...its NO USE!! thats what i said..there will always be a route to the source....all u may drop is 10.x/192.168 and 172/16-31......that too if ur network isnt internally using it.... and if u end up putting "loose" an OSPF router ull drop valid traffic if ur not redistributing bgp etc..and if u are redistributing...well again the above argument holds true...every registered network will be there in BGP ..... -rgds Alok

1 0

RE: no ip forged-source-address
by H. Michael Smith, Jr. 07 Nov '02

07 Nov '02

A fundamental effect of spoofing addresses from your local subnet is that when the packets reach their target, the source addresses are meaningful. I realize that the traceability of these packets has already been mentioned, but I want to point out the profound difference between a DDoS attack with meaningful vs. meaningless source addresses. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Hank Nussbacher Sent: Wednesday, October 30, 2002 2:27 PM To: variable(a)ednet.co.uk Cc: nanog(a)nanog.org Subject: Re: no ip forged-source-address On Wed, 30 Oct 2002 variable(a)ednet.co.uk wrote: If every router in the world did this I could still use spoofed IP addresses and DDOS someone. My little program could determine what subnet I am on, check what other hosts are alive on the subnet and then when it decides to attack, it would use some neighbor's IP. The subnet I am on is a /24 and there very well may be a few dozen hosts. I could be real sneaky and alter my IP randomly to be any of my neighbors for every packet I send out. Traceback would get me instantly back to the offending subnet but then it would take a bit of digging on the network admin to track me down and applying RPF checking won't help. RPF checking can only go so far. You would need RPF checking down to the host level and I haven't heard anyone discuss that yet. -Hank > > Hi, > > I've been following the discussion on DDoS attacks over the last few weeks > and our network has also recently been the target of a sustained DDoS > attack.I'm not alone in believing that source address filters are the > simplest way to prevent the types of DDoS traffic that we have all been > seeing with increasing regularity.Reading the comments on this list have > lead me to believe that there is a lot of inertia involved in applying > what appears to me as very simple filters. > > As with the smurf attacks a few years ago, best practice documents and > RFC's don't appear to be effective.I realise that configuring and > applying a source address filter is trivial, but not enough network admins > seem to be taking the time to lock this down.If the equipment had > sensible defaults (with the option to bypass them if required), then > perhaps this would be less of an issue. > > Therefore, would it be a reasonable suggestion to ask router vendors to > source address filtering in as an option[1] on the interface and then move > it to being the default setting[2] after a period of time?This appeared > to have some success with reducing the number of networks that forwarded > broadcast packets (as with "no ip directed-broadcast"). > > Just my $0.02, > > > Richard Morrell > edNET > > [1] For example, an IOS config might be: > > interface fastethernet 1/0 > no ip forged-source-address > > [2] Network admins would still have the option of turning it off, but this > would have to be explicitly configured. > > >

13 27

Re: Where is the edge of the Internet?
by bdragon＠gweep.net 07 Nov '02

07 Nov '02

> -----------> so its a hardware limitation?....bigger cores needed The best place to filter is the edge of one's network, in the strictest manner possible. While possible to filter in the core of one's network, you lose the majority of the usefulness of RPF (no strict checking, can only check for sources which don't appear in the routing table at all).

1 0

Re: Where is the edge of the Internet? Re: no ip forged-source-address
by bdragon＠gweep.net 07 Nov '02

07 Nov '02

> > I'm opposed to some of the suggestions where to put source address > > filters, especially placing them in "non-edge" locations. E.g. requiring > > address filters at US border crossings is a *bad* idea, worthy of an > > official visit from the bad idea fairy. > > What is bad about filtering facing non-customers, if loose rpf is > used? I'm assuming this is what you mean by "border crossings" rather than > the literal. > > --------->makes sense on the edge/aggregation but if you do it further up in > the network.....there maybe some cases where we have assymetric routing, > where the path of uplink is never the path the same as the downlink, and > infact the source network of the packet may never be present in the routing > table....(it is possible, after all its a packet switched network and the > routing is destination IP based) ... Right, which is why I specifically mentioned loose rpf, vs. strict rpf. Even further up the customer chain, you'll still have a list of customer networks (assuming folks are doing the right thing by filtering customer bgp announcements) which could be used as an input to strict rpf.

1 0

IP Address Allocations in Germany
by Gawie Marais (Home) 07 Nov '02

07 Nov '02

Hi, This is a long shot, but I'm hoping someone can help me out here... I was wondering if it would be possible to purchase an entire Class C address range for use in Germany. I have a Infrastructure company based in south africa that is looking to connect some 80 sites throughout Germany onto the Internet. At this stage I'm not quite sure exactly what and how they are going to do it but I received a request from them to try and locate an entire class c for them. Any suggestions on how to go about doing this ?? Regards, Gawie J Marais Technical Member inX - Internet eXchange SA Tel: +27 11 956 6935 Fax: +27 11 956 6851 Mail: gawie(a)inx.co.za Web: http://www.inx.co.za/

5 4

Internet Measurement Workshop
by Steve Bellovin 07 Nov '02

07 Nov '02

Let me point folk at the Internet Measurement Workshop: http://www.icir.org/vern/imw-2002/ including especially the link to the online proceedings. A fair number of the papers have a lot of operational relevance. --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com ("Firewalls" book)

2 1