December 2002 - Test - lists.nanog.org

[Article] Core competency - ISP backbones stand up in grueling 30-day performance test
by Hank Nussbacher 17 Dec '02

17 Dec '02

http://www.nwfusion.com/research/2002/1216isptest.html -Hank

1 0

RE: Identifying DoS-attacked IP address(es)
by Brennan_Murphy＠NAI.com 16 Dec '02

16 Dec '02

I can send you screenshots of our tool if you are interested. -----Original Message----- From: Andre Chapuis [mailto:chapuis@ip-plus.net] Sent: Monday, December 16, 2002 9:12 AM To: nanog(a)nanog.org Subject: Identifying DoS-attacked IP address(es) Hi, How do you identify a DoS-attacked IP address(es) on your ingress border router, assuming the latter is a Cisco 12000 ? I used to use ip accounting but they removed it from the S-code. Thanks, André --------------------- Andre Chapuis IP+ Engineering Swisscom Ltd Genfergasse 14 3050 Bern +41 31 893 89 61 chapuis(a)ip-plus.net CCIE #6023 ----------------------

1 0

Re: Identifying DoS-attacked IP address(es)
by Andre Chapuis 16 Dec '02

16 Dec '02

Chris, I often see the input-interface load is 100%. André At 16:35 16.12.2002 +0000, Christopher L. Morrow wrote: >On Mon, 16 Dec 2002, Andre Chapuis wrote: > >> >> Hi, >> How do you identify a DoS-attacked IP address(es) on your ingress border router, assuming the latter is a Cisco 12000 ? I used to use ip accounting but they removed it from the S-code. > >What info do you have when you are trying to accomplish this mission? > >> Thanks, >> André >> >> >> --------------------- >> Andre Chapuis >> IP+ Engineering >> Swisscom Ltd >> Genfergasse 14 >> 3050 Bern >> +41 31 893 89 61 >> chapuis(a)ip-plus.net >> CCIE #6023 >> ---------------------- >> --------------------- Andre Chapuis IP+ Engineering Swisscom Ltd Genfergasse 14 3050 Bern +41 31 893 89 61 chapuis(a)ip-plus.net CCIE #6023 ----------------------

7 13

RE: Identifying DoS-attacked IP address(es)
by Livio Ricciulli 16 Dec '02

16 Dec '02

At 09:17 PM 12/16/2002 +0000, Christopher L. Morrow wrote: >On Mon, 16 Dec 2002, Livio Ricciulli wrote: > > > FYI, we developed a system that sniffs FE,GE,DS3,OC3-48 POS and creates > > a model using the cross-product of: > > 1) source/destination address distributions > > 2) packet rate > > 3) protocol > >But I can't field deploy this 2 continents away at 4am with 10 mins >notice... Yes, there needs to be some up-front investment to proactively deploy these boxes/taps in strategic places. I did some analysis and the numbers are doable even for the largest networks. But then we get into philosophy; I have a lot of screwdrivers at home laying around but I would much rather invest in chisels rather than keep trying carving wood with flathead screwdrivers (but that's just me..) Livio.

1 0

[candidhosting.com #25891] AutoReply: RE: Identifying DoS-attacked IP address(es) (fwd)
by Christopher L. Morrow 16 Dec '02

16 Dec '02

who signed up a ticketing system to nanog?? --Chris (chris(a)uu.net) ---------- Forwarded message ---------- Date: Mon, 16 Dec 2002 16:22:09 -0500 (EST) From: Candid Hosting Support <support(a)candidhosting.com> To: chris(a)UU.NET Subject: [candidhosting.com #25891] AutoReply: RE: Identifying DoS-attacked IP address(es) Greetings, This message has been automatically generated in response to your trouble ticket request regarding: "RE: Identifying DoS-attacked IP address(es)", a summary of which appears at the bottom of this e-mail. Your ticket has been assigned an ID of [candidhosting.com #25891]. Our support personnel will contact you shortly in regards to this matter. If your request is concerning a dedicated server, please make sure that you have provided the following required information: - At least one domain name or IP address used on the server - Login and/or root passwords as required by the specific issue - Remote access, such as a pcAnywhere or VNC password, for Windows systems For future correspondence concerning this issue, please reply to this e-mail or include the string "[candidhosting.com #25891]" in the subject line of new messages. Regards, Candid Hosting Technical Support Team - support(a)candidhosting.com - ICQ #141214819 - 1-877-248-9888, Option #2 ------------------------------------------------------------------------- On Mon, 16 Dec 2002, Livio Ricciulli wrote: > FYI, we developed a system that sniffs FE,GE,DS3,OC3-48 POS and creates > a model using the cross-product of: > 1) source/destination address distributions > 2) packet rate > 3) protocol But I can't field deploy this 2 continents away at 4am with 10 mins notice... > > This works very well to detect floods and does not require messing with > routers.. > > Livio. > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of > Neil J. McRae > Sent: Monday, December 16, 2002 9:38 AM > To: Andre Chapuis > Cc: Christopher L. Morrow; nanog(a)nanog.org > Subject: Re: Identifying DoS-attacked IP address(es) > > > Sampled netflow, or look at the traceback stuff in later > IOS 12.0S versions. Avoid filter lists as the GSR engine cards > have a statically limited number of entries. > > Regards, > Neil. > (NH)

1 0

Identifying DoS-attacked IP address(es)
by Andre Chapuis 16 Dec '02

16 Dec '02

Hi, How do you identify a DoS-attacked IP address(es) on your ingress border router, assuming the latter is a Cisco 12000 ? I used to use ip accounting but they removed it from the S-code. Thanks, André --------------------- Andre Chapuis IP+ Engineering Swisscom Ltd Genfergasse 14 3050 Bern +41 31 893 89 61 chapuis(a)ip-plus.net CCIE #6023 ----------------------

3 2

RE: Identifying DoS-attacked IP addresses)
by Pena, Antonio 16 Dec '02

16 Dec '02

Hello Andre The best way we use to identify DOS attacks is measuring and monitoring the backbone circuits the packets/second in and out, normally most of the DOS attacks generated a lot of packets/second, in our case we created an alarm that sends an email and page each time any of our backbone circuits exceed 17000 Packets/second, second alarm when packets exceed 20k using Intermapper 3.6 and SNMP. After this is you are using the Cisco 12000 is no problem to try of detect the type of traffic using Extended Access-list and sending to the loggin for 15-20 seconds and then look for ICMP, UDP and TCP, in our case we found 7 of ten DOS attacks target IP's and only 10% are coming from known sources, most of the attacks used smurfed sources. Regards; Antonio J. Pena Senior Manager, Network Engineering ( /_ _ _ __/_ _ |_/(-/ (-_) /(// Verestar, inc. 3040 Williams, Dr Suite 100 Fairfax, VA, 22031 Phone (703)206-9000 Direct (571)226-5772 Fax (703) 573-3522 antonio_pena(a)verestar.com http://www.verestar.com -----Original Message----- From: Andre Chapuis [mailto:chapuis@ip-plus.net] Sent: Monday, December 16, 2002 9:12 AM To: nanog(a)nanog.org Subject: Identifying DoS-attacked IP address(es) Hi, How do you identify a DoS-attacked IP address(es) on your ingress border router, assuming the latter is a Cisco 12000 ? I used to use ip accounting but they removed it from the S-code. Thanks, André --------------------- Andre Chapuis IP+ Engineering Swisscom Ltd Genfergasse 14 3050 Bern +41 31 893 89 61 chapuis(a)ip-plus.net CCIE #6023 ----------------------

1 0

'Digital Pearl Harbor' May Be No Real Threat
by Sean Donelan 16 Dec '02

16 Dec '02

Wall Street Journal Boomtown by Lee Gomes (subscription required) http://online.wsj.com/article/0,,SB1039990777685324633,00.html "As a result, homeland-security conferences, newsletters, sales offices and the like have become a standard part of the technology-business landscape. In the prototypical presentation, a salesperson describes some crucial part of the high-tech infrastructure -- for example, the router that moves messages around in a computer network -- and then asks, "Imagine what would happen if terrorists got their hands on THAT!" The better question, though, is, "How likely is it that terrorists would actually get their hands on that?"

2 1

Junipers / Concord
by Andrew McConnell 14 Dec '02

14 Dec '02

Can any Concord admins clue me in on how to configure Network Health so that it displays ifDescr as part of nmsName? Our current configuration requires manual effort to create an alias for each interface element even though Concord knows about ifDescr. That's obviously an annoyance for reporting purposes. When I discover Juniper devices, in particular, Concord refuses to populate nmsName in poller.cfg with any useful information...I see that it's using mib2-rfc1573-v2c*.mtf for MIB translations on Juniper devices but I'm not certain what needs to happen there (if anything) to make the poller populate nmsName properly. Concord's support tells me we need to purchase an additional level of support to fix this, but I imagine other people have found the same issue. Please respond off-list as I realize this is not exactly on topic. Thanks. -- Andrew McConnell <drew(a)pigish.com>

1 0

Bogon announcement list
by Rob Thomas 13 Dec '02

13 Dec '02

Hi, NANOGers. At the behest of several requestors, we have created a new, one-way list solely for the announcement of new IP prefix allocations to the sundry RIRs. The posts will include the allocated prefix, allocation date, the RIR(s) involved, and pointers to the documents we (Steve Gill, Barry Greene, and Rob Thomas) update when such allocations are made. These announcements will be made as we detect such allocations. The list is moderated by Steve Gill, Barry Greene, Jared Mauch, and Rob Thomas. It is open to anyone who wishes to subscribe. Aliases are welcome to subscribe. To subscribe to the list, please visit the following URL: http://puck.nether.net/mailman/listinfo/bogon-announce A mini-FAQ: 1. Why form yet another list? I already receive enough e-mail. We share your pain. :) Such a list will help some folks to automagically process, filter, or file such announcements. 2. How do you know about new allocations from IANA to the RIRs? We have a cronjob that diffs the list on a daily basis. 3. How soon after the allocation is made will you announce it? In some cases our release will be coordinated with the RIR. In other cases it will be made as soon as we detect it. In all cases it will be made as quickly as possible. Please note that all of the monitoring and templates will be updated as soon as the allocation is detected. 4. What sort of message volume can I expect on the list? Messages will only be posted to the list when new allocations are made. 5. Does this mean you won't send these updates to several other lists? No. We will continue to send e-mail to a variety of lists when allocations are made. 6. Sheesh, where do you find the time for such things? Have you no social life? Nope, none at all. :) Thanks! Steve, Barry, Jared, Rob, your bogon-announce list administrators.

1 0