May 2002 - Test - lists.nanog.org

Re: Arbor Networks DoS defense product
by Clayton Fiske 15 May '02

15 May '02

On Wed, May 15, 2002 at 06:04:40PM -0700, PJ wrote: > Sorry for not including nanog in the reply. What about MAPS? They > routinely scan netblocks without consent. Does this tool > differenciate between local and non-local scanning? Scanning is The tool in question may not even exist yet. There is no preset definition of how it has to work. Perhaps it can be evolved enough to where it only triggers when an exploit is attempted, rather than just on a TCP connection. > still not a crime and it will still do nothing to deter anyone with > hostile intentions. This is just a bandaid to avoid taking proper > security precautions. I can take all the proper security precautions and it doesn't stop third party network A from being exploited and later used to attack me. The point of this is that it will help identify a specific host which is scanning many blocks belonging to many different networks. If they hit several landmines in my network, I might be concerned. If they hit landmines in my network and 6 others to which I have no affiliation, the net as a whole might want to know about it. I don't think anyone said this was intended to take the place of security on their own networks. But I don't see how that aspect makes this a bad tool on its own either way. -c

3 3

(fwd) Re: Arbor Networks DoS defense product
by PJ 15 May '02

15 May '02

Forgot to include nanog ----- Forwarded message from PJ <briareos(a)otherlands.net> ----- > Date: Wed, 15 May 2002 17:50:01 -0700 > From: PJ <briareos(a)otherlands.net> > Subject: Re: Arbor Networks DoS defense product > To: Clayton Fiske <clay(a)bloomcounty.org> > Message-ID: <20020516005001.GB2107(a)elvander.otherlands.net> > Reply-To: PJ <briareos(a)otherlands.net> > User-Agent: Mutt/1.3.25i > > On Wed, 15 May 2002, Clayton Fiske wrote: > > > > > On Wed, May 15, 2002 at 05:22:39PM -0700, PJ wrote: > > > Are you now operating under the premise that scans != anything but the > > > prelude to an attack? Sorry if I missed it earlier in the thread, but > > > I would hate to think any legitimate scanning of a network or host > > > would result in a false positive. Even more, I would hate to see the > > > advocation of a hostile reaction to what, so far, is not considered a > > > crime. > > > > So you can think of a perfectly legitimate reason to scan someone else's > > netblocks on specific TCP ports? > > > > -c > > > > > > Has no one ever tested firewall rules from external networks? The > fact remains is that a scan != an attack. > > PJ > > -- > The worst thing one can do is not to try, to be aware of what one > wants and not give in to it, to spend years in silent hurt wondering > if something could have materialized -- and never knowing. > -- David Viscott

1 0

Re: Arbor Networks DoS defense product
by Dan Hollis 15 May '02

15 May '02

On Wed, 15 May 2002, Chris Parker wrote: > That's fine until the first person spoofs a scan from 'www.cisco.com' > or 'a.root-servers.net' and *poof* it's now automagically unreachable. Only tcp connections with full handshake would be counted. -Dan -- [-] Omae no subete no kichi wa ore no mono da. [-]

1 0

Re: Arbor Networks DoS defense product
by Dan Hollis 15 May '02

15 May '02

On 15 May 2002, Johannes B. Ullrich wrote: > See http://www.dshield.org/block.txt ;-). We are about 24hrs away from > getting a BGP test feed up. Error Sorry, the page could not be found. Click HERE to return to the DShield.org homepage. -Dan -- [-] Omae no subete no kichi wa ore no mono da. [-]

2 1

The Art of Peering : The Peering Playbook
by William B. Norton 15 May '02

15 May '02

Hi all - Folks were talking about Traffic Ratios, Depeering, etc. that reminded me I should probably thank everyone for contributing to the "Tactical Peering" white paper which has now been renamed "The Art of Peering : The Peering Playbook". Thanks to the feedback from folks on this list and at RIPE and the Gigabit Peering Forum I have released version 1.0 of this document and it is available to anyone who would like a copy. Send me e-mail at wbn(a)equinix.com with the Subject: Art of Peering and I'll send it back directly, or alternatively you can get it from the Equinix web site. In this paper I asked the Peering Coordinators the question "What do you do if noone answers your peering request at peering@<ispdomain>.net ? What are the 'Tricks of the Trade' that distinguish seasoned Peering Coordinators from newbies?" The Summary (below) does the best job of highlighting the techniques detailed in the paper: Summary We have presented 19 peering maneuvers that the Peering Coordinator Community have effectively used to obtain peering. 1) The Direct Approach uses peering@<ispdomain>.net , phone calls, face to face meetings, or some such direct interaction to establish peering. 2) The Transit with Peering Migration tactic leverages an internal advocate to buy transit with a contractual migration to peering at a later time. 3) The End Run Tactic minimizes the need for transit by enticing a direct relationship with the target ISP's largest traffic volume customers. 4) In Europe the Dual Transit/Peering separates the peering traffic from the transit traffic using separate interface cards and/or routers. 5) Purchasing Transit Only from Large Tier 2 ISPs is an approach to reduce the risk of being a customer of a potential peer on the road to Tier 1 status. 6) Paid Peering as a maneuver is positioned by some as a stepping stone to peering for those who don't immediately meet the peering prerequisites. 7) In the Partial Transit tactic, the routes learned at an exchange point are exchanged with the peer for a price slightly higher than transport costs. 8) The Chicken tactic involves de-peering in order to make the other peer adjust the peering relationship. 9) In the Traffic Manipulation tactic, ISPs or content players force traffic along the network path that makes peering appear more cost effective. 10) The Bluff maneuver is simply overstating future traffic volumes or performance issues to make peering appear more attractive. 11) The Wide Scale Open Peering Policy as a tactic signals to the Peering Coordinator Community the willingness to peer and therefore increases the likelihood of being contacted for peering by other ISPs. 12) The Massive Colo Build tactic seeks to meet the collocation prerequisites of as many ISPs as possible by building POPs into as many exchange points as possible. 13) The Aggressive Traffic Buildup tactic increases the traffic volume by large scale market and therefore traffic capture to make peering more attractive. 14) Friendship-based Peering leverages contacts in the industry to speed along and obtain peering where the process may not be in place for a peering. 15) The Spam Peering Requests tactic is a specific case of the Wide Scale Open Peering tactic using the exchange point contact lists to initiate peering. 16) Purchasing Legacy Peering provides an immediate set of peering partners. 17) The Bait and Switch tactic leverages a large corporate identity to obtain peering even though ultimately only a small subset or unrelated set of routes are actually announced. 18) The False Peering Outage tactic involves deceiving an ill-equipped NOC into believing a non-existing peering session is down. 19) The Leverage Broader Business Arrangement takes advantage of other aspects of the relationship between two companies to obtain peering in exchange for something else. Thanks again for your help! If there are questions or comments I'd love to hear them; I fully expect this document (like the other white papers) to evolve over time. Bill --------------------------------------------------------------------------------------------------------------- William B. Norton <wbn(a)equinix.com> 650.315.8635 Co-Founder and Chief Technical Liaison Equinix, Inc.

1 0

RE: Arbor Networks DoS defense product
by Cheung, Rick 15 May '02

15 May '02

Is it common practice to place your own equipment at the ISP? My thought is that if we are able to have our own routers at the ISP, we'd be in a better position to mitigate the effects of a DDOS. As long as the stream of traffic does not adversely affect our routers from performing properly at the ISP, we can then mitigate the effects through access-lists, QOS, etc. That is if the attack is not too distributed, where the source IPs with the highest amount of syn traffic for example can be easily identified. Rick Cheung NPI IT Wan Team, CCNP -----Original Message----- From: Pete Kruckenberg [mailto:pete@kruckenberg.com] Sent: Wednesday, May 15, 2002 2:15 AM To: nanog(a)merit.edu Subject: Re: Arbor Networks DoS defense product On Wed, 15 May 2002, Rubens Kuhl Jr. wrote: > If and when > (a) customers don't get exemption for attack traffic > (b) the DoS traffic occurs more than 5% (or 1 - your percentile level) of > the month per customer circuit > (c) the DoS increases bytes transferred like large ICMP packet flood; this > is not the case for all DoS traffic, which can be a bunch of small packets > that actually decreases traffic These might apply to noticeable DoS attacks that occur as specific events. But how much (D)DoS traffic goes unnoticed by the average customer because it's too tough to detect or defend against? The 10% I've measured on my network is primarily reflected DDoS (reflected off my customers, to off-net targets), which is not trivial to detect or defend against. Pete.

1 0

Test Post
by Erich Kuehn 14 May '02

14 May '02

__________________________________________________ Do You Yahoo!? LAUNCH - Your Yahoo! Music Experience http://launch.yahoo.com

1 0

RE: Phone for Broadwing NOC?
by Joe.Payne＠Broadwing.com 14 May '02

14 May '02

I'm not quite sure what number you could be dialing...we have changed a few things around the last couple of months. I would suggest calling 1-888.235.0273. This is a generic care number that will get you to a live person much quicker than 45 minutes 24x7...I checked with our care people and they say the only time a person should hear a response like you say is when a billing inquiry is selected...Please send me the number, off list, and I will forward it and see what's up. btw, thanks for the heads up. Joe... -----Original Message----- From: Roy [mailto:garlic@garlic.com] Sent: Monday, May 13, 2002 9:45 PM To: nanog(a)merit.edu Subject: Phone for Broadwing NOC? Anyone get a better phone number for the broadwing NOC? The one I used just left me on hold for 45 minutes. Their repair number says to call back during business hours. Roy Engehausen +++The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and destroy any copies of this document.+++

1 0

Call for Participation - Smart Routing Panel
by Susan Hares 14 May '02

14 May '02

Smart Routing Panel Description: The Internet is not resilient to two types of problems: outages and data flow quality degrading. Network outages are defined as periods where traffic to a portion of the network is down. A network is identified by a network prefix. Data flow quality degradation occurs when links or routers are so overloaded that traffic does not flow through at normal rates. Normally, data flow quality has to dramatically decrease for the Enterprise to be concerned. Some companies in industries such as stock trading or insurances have time critical information. Data flow in these companies must react quickly to data flow degradation. A group of vendors of "Smart Routing" products and services proposes to route around outages and areas of poor data flow. We are soliciting participants for a panel that will discuss this at NANOG 25 (June 9-11). This panel will focus solely on the technology issues in "smart routing" and "BGP". In the finest of NANOG traditions, we will eschew any marketing content in order to focus on the interesting technical issues in this area. We are looking for participants for this panel with deployed product. Each panel member will be required to prepare the answers to the questions below and to aid in preparing a the general panel discussions. Question 1 (parts A-F) and Question 2 will form the basis of the 1st panel session that will highlight the technology behind the smart routing. Question 3: "BGP issues that Smart Routing has highlighted" will be done in a second panel discussion. The format of this panel will be - Overview of Smart Routing - Presentations by Smart Routing Vendors - Q & A on Smart Routing - BGP issues Smart Routing has Highlighted - Q & A on BGP issues If you are interested in this panel, please contact me at skh(a)nexthop.com. Sue Hares skh(a)nexthop.com (734)222-1610 Participant Questionnaire: =========================== 1) Overview of Products 1-a) The smart routing product uses BGP to routes around "problems" in the network. We would like you to discuss the following 6 components of your product. Question 1-b through 1-g give detailed questions that will aid you in presenting these 6 components. - Is your product a box or a service or both ? (Question 1-b) - Definition of "quality" of data flow (Question 1-c) - Detection of traffic flow problems (Question 1-d) - Building up of database of alternative BGP routes (Question 1-e) - Policy engines to tailor the "re-routing" to the customers' needs (Question 1-e) - Traffic steering capability (Question 1-f) - Interaction with other products (Question 1-g) Please indicate which of the following methods your product defaults to. Also indicate which of these methods your product can support. Please indicate how your product does each of these 5 tasks. For the database item, please indicate if both history and current data is being used. 1-b) What do you sell? - Box or service or both? - Do you utilize a POP in your topology? - What is in your POP? Is it 7x24x365? - Do you have a NOC for your service? - What does your product change? - IBGP routes in the Enterprise - Data traffic flow - Do you use tunneling techniques to points inside your network to "re-route" traffic to the correct site? - Do you characterize data flows by applications? - Management information - Do you tunnel management information to a management server? - What reports to you provide? 1-c) How does your product define "quality" for the Enterprise customer? - What factors are measured for quality of data flow through the Internet? - What factors are common with other Smart Routing vendors and what parts of your product are unique? - What is the default mechanism your product utilizes to set quality? - Who sets default quality - the product (by discovery) or the customer? Why did you choose your defaults? - Is the customer required to set-up quality definitions? - Is the policy you set for an enterprise set by destination address? - As single prefix or a group of prefixes? - Is the policy you set for an enterprise set on something in the packet beside the destination address? - By source address, destination address? - By other things in the IP packet? - Does the product include work load characterization mechanisms? - Application prioritization, - Traffic mixture statistics, or - Traffic type based queuing Please provide any additional information you consider as part of "quality" that these questions have not indicated. 1-d) The detection of traffic flow problems has been done with tools that ping, trace-route, sniffing on data traffic, or query statistics in the network. These tools may make use of the ICMP network functions or may be application protocols based in UDP or HTTP information. - IP Ping packages (both ICMP and non-ICMP) to determine delay in programs, - Do you use an ICMP (normal ping) program? - Do you use a proprietary UDP based ping (end to end query)? - Do you use a proprietary HTTP based ping (end-to-end query)? - How do you select the locations to be queried via ping or application UDP program? Are you using your web sites or customer machines? If you are using web sites, who owns the web site or the content? - Do you use a traceroute like packages to determine the hop-by-hop characteristics of the route? - Is the traceroute package based in ICMP, UDP, or other network protocols?] - Do you utilize a MPLS Trace-route package? - Do you display this information in visual form? Is this visual form in text or graphical? - Do you do data traffic flow monitoring or packet sniffing on a LAN? - Why do you utilize this in your product? - Do you tunnel to obtain the traffic or "listen" to wire packets? 1-f) Traffic steering and route flapping -Traffic steering involves steering traffic by inserting information in to the IBGP mix. Please indicate which of these functions you support. - Insertion of a prefix with a better local_pref, - Insertion of a longer prefix, - Insertion of BGP communities to allow the enterprise to route around the difficulty, or - Insert of changes to AS Path length. - What is your default? - If you use the insertion of a prefix with a better LOCAL_PREF value, how do you keep from the new route being the "better" route and IBGP killing the supporting route? - If you inserts two longer prefixes, what happens if the two longer prefixes are in the routing traffic already? (for example a /16 is replaced by 2 /17s) - How do you prevent flapping between two different paths for traffic flows? - How often do you change traffic flows directions (route changes)? - Why would you change routes or exit points with the Enterprise? 1-g) how does your product interact with other products in the Enterprise? - Do firewalls impact your product? - Do you run through a firewall? - Does the security or the traffic filters impact your product? - How does your product interact with existing routers? - Does it receive BGP routes? Does it send BGP routes? - Does it receive statistics? - How does your product interact with web servers or web caches? - How does it improve the web cache update? (Please be specific as this is a technical audience.) - How does the product improve web server traffic? - Does your product interact with packet optimizers? 2) What is it worth it to Customers? 2-a) Why Does the Enterprise buy smart routing? What benefits does it provide to the Enterprise customer? 2-b) Multi-homing of Enterprises - How many connections do individual Enterprises have? - Does the number of connections vary widely? - What is the range? 2-c) Return on Investment for Customer - What improvements to traffic flow can you obtain? - How can you prove to your customers that you are improving traffic? - Using the box, can or should the customer reduce the number of required connections to the Internet? 2-d) What performance problem are you fixing? - Tier 1 providers claim 5 9s of performance, where is the problem? In the "middle mile " between service providers? At the edge on access? In the Tier 1 or Tier 2 or Tier N service provider? 3) BGP issues that "Smart Routing" has highlighted 3-a) BGP selecting the Best route - What percentage of time does BGP pick the optimum route for data flow? - Is the less efficient usage based on - No policy based so the select devolves on BGP tie breaking? - Explicit policy (go through this AS) - AS Path Length policy? - How many months of BGP problem evaluation have you had? 3-b) does BGP Convergence issues cause some of these problems? - Do you see any results of the IBGP persistent route oscillation? - Do you see any MPBGP Multicast routes? http://www.multicasttech.com/status/index.html indicates that there are over 350 AS that are doing multicast. - What is the effect of Non-Stop-Forwarding on Smart Routing? At times the NSF will cause the control plane to go while you are making measurement? Do you require any coupling between the data plane and the control plane? 3-c) MPLS and BGP - What does the impact of MPLS and GMPLS cores on Smart Routing? - Do you see any Layer 3 VPNs in use in the Enterprise or by the service providers connecting to Enterprises? - Have you encountered MPLS forwarding in the Enterprise? - If so, what type: link layer or BGP VPNs? - If not, is the enterprise using Frame Relay or ATM

1 0

Geocities human contact
by Thomas Kernen 14 May '02

14 May '02

I'm trying to locate a human contact at Geocities that deals with illegal/fake content hosted on the Geocities servers. Any attempt via the automated system(s) have failed. Thomas

1 0