May 2002 - Test - lists.nanog.org

Qwest outage in NY
by Eric Gauthier 08 May '02

08 May '02

Heya... Just found out that Qwest had an outage in one of their NY pops (jfk?) that disrupted access out of the Boston area for about 20 minutes. The master ticket (I believe) is 566548. Does anyone know what happened? Thanks, Eric :)

2 2

Another reason to not use MAPS
by Andy Dills 08 May '02

08 May '02

For a long time, I liked MAPS. They were doing good things for free. Then they started charging for access to their data, under the excuse that it costs so much, they just need to start covering their expenses. No big deal, right? They can't bleed money. I understand. Now, MAPS has filed a lawsuit against a former employee. Why? Because he might interfere with their ability to make money by giving away something for free that they charge for! Read about it on slashdot, I don't feel like pasting URLs. But the bottom line is that Nick Nicholas, who was Executive Director of MAPS for a bit a couple of years back, has this to say: "Last year I decided to write a book about the history of MAPS. My intent was to focus on the companies that sued MAPS and abused the legal system in order to prevent MAPS from exercising its legitimate free speech rights. I wanted to portray Paul and Dave Rand as beleaguered but slightly flawed heroes. However, my opinion of MAPS was forever changed this past April when it decided to sue DUL founder, Gordon Fecyk, after Gordon attempted to exercise a December 1998 contract he entered into with Paul Vixie in his capacity as MAPS CEO. ... It seems that MAPS has learned a great deal from the lawsuits brought against it by Harris Interactive and others, and has adopted the same slimy tactics. In particular, the affidavits filed by Margie Arbon and Anne Mitchell are full of factual errors and material misrepresentations. I will add my commentary on these affidavits at a later date." So, you who subscribe to MAPS: When will you be cancelling your subscriptions? It's no longer about stopping spam with them, now it's about money. FWIW, the other blacklists out there are just as good. I particularly like njabl.org. Andy xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Andy Dills 301-682-9972 Xecunet, LLC www.xecu.net xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Dialup * Webhosting * E-Commerce * High-Speed Access

4 5

Re: Effective ways to deal with DDoS attacks?
by vern＠ee.lbl.gov 07 May '02

07 May '02

> 1) rate-limits aren't going to solve anything. Um, you *could* try reading the paper. > 2) I'm pretty sure most providers aren't going to let customers determine > traffic engineering methods on their networks See the above. This is not something done by the customers (well they could, but that's not the main idea). > 3) if this is NOT done in a secure manner I bet I can make > www.whitehouse.com disappear... :) Could be we thought of that too! Vern

2 1

Re: Effective ways to deal with DDoS attacks?
by vern＠ee.lbl.gov 07 May '02

07 May '02

> It seems to me that the real issue in defending against an attack of this > type of differentiating between legitimate traffic and zombie traffic. Exactly. And while with today's DDoS attacks this is often not so hard, tomorrow's floods will be more carefully crafted so that there are no telltales that can be cheaply used to filter them out. Steve Bellovin and colleagues (me being one of them) have been working on a scheme called "Pushback", in which routers detect traffic aggregates that are burdening one of their links, and send pushback messages upstream to their peers responsible for the bulk of the traffic, asking them to rate-limit the aggregates. The key idea is that the upstream peers then monitor which of *their* upstream peers are responsible for the bulk of the traffic they're now rate-limiting, and send them pushback messages in turn, too. In this fashion, the pushback propagates out to the edge of the network (or the ISP's cloud, if that's the limit of pushback deployment). While there is still collateral damage in terms of any legitimate traffic that happens to enter from the same edge as the attack traffic will be subject to the same rate-limiting, *other* legit traffic that comes from other locations will escape the effects of the rate-limiting; so collateral damage is a lot less than if you just blindly rate-limit the aggregate. There are a number of issues concerning identifying aggregates, timing out the rate-limiting, etc. It's also not clear to what degree Pushback will work in the face of an extremely diffuse attack (see my next message). But it's at least a start on a solution that doesn't require uniform filtering of visibly distinct traffic. Pushback is described at: http://www.icir.org/pushback/ - Vern

3 2

Fiber cut on East Coast
by Miller, Steve 07 May '02

07 May '02

Anyone know of a fiber cut on the east coast? Possibly in the Miami area....XO is having problems but won't confirm anything. Steve

2 1

Re: Effective ways to deal with DDoS attacks?
by vern＠ee.lbl.gov 07 May '02

07 May '02

> > We most frequently are the zombie/reflector participants > > in an attack that originates outside our network, to a > > target outside our network. As many as 8,000 hosts on > > our network are reflecting SYN floods in the current > > attacks. > > I finally found a paper on this type of attack. You might also try: "An Analysis of Using Reflectors for Distributed Denial-of-Service Attacks," V. Paxson, Computer Communication Review 31(3), July 2001. http://www.icir.org/vern/papers/reflectors.CCR.01/index.html http://www.icir.org/vern/papers/reflectors.CCR.01.ps.gz http://www.icir.org/vern/papers/reflectors.CCR.01.pdf - Vern

1 0

Re: ratios
by PETER JANSEN 07 May '02

07 May '02

Scott: Traffic ratios are one of the many parameters that ensure equality and a mutual benefit between networks in a settlement free peering relationship. Have a look at our peering policy at www.cw.com/peering. It will provide you with some information on peering with large networks. Regards Peter Jansen Global Peering Cable & Wireless Date: Tue, 07 May 2002 13:30 -0400 (EDT) From: Scott Granados <scott(a)graphidelix.net> To: nanog(a)merit.edu Sender: owner-nanog(a)merit.edu Delivered-to: nanog-outgoing(a)trapdoor.merit.edu Delivered-to: nanog(a)trapdoor.merit.edu Delivered-to: nanog(a)merit.edu Subject: ratios I'm not overly familiar with this but I wondered if someone could detail for me the basics of using ratios to determine elegibility to peer? I have heard that some carrers especially the largest require a specific ratio is this in fact true and is the logic as simple as just insuring equal use of the peer? Thanks Scott

3 2

no-ip.com spam
by Sameer R. Manek 07 May '02

07 May '02

The subjects of spam by no-ip.com has gone beyond operational issues, and has moved to a debate. If anyone has any view points they feel have not been sufficiently addressed, please respond privately via email. ------------------------------------------------------------------------- Sameer R. Manek Email: manek(a)ghur.net "What one has not experienced, one will never understand in print." --Isadora Duncan -------------------------------------------------------------------------

1 0

Effective ways to deal with DDoS attacks?
by Pete Kruckenberg 06 May '02

06 May '02

There's been plenty of discussion about DDoS attacks, and my IDS system is darn good at identifying them. But what are effective methods for large service-provider networks (ie ones where a firewall at the front would not be possible) to deal with DDoS attacks? Current method of updating ACLs with the source and/or destination are slow and error-prone and hard to maintain (especially when the target of the attack is a site that users would like to access). A rather extensive survey of DDoS papers has not resulted in much on this topic. What processes and/or tools are large networks using to identify and limit the impact of DDoS attacks? Thanks. Pete.

20 56

RE: anybody else been spammed by "no-ip.com" yet?
by Randy Neals 06 May '02

06 May '02

An example of challenge/response email authentication. http://www.myprivacy.ca/ -R -----Original Message----- From: Ralph Doncaster [mailto:ralph@istop.com] Sent: May 6, 2002 7:32 PM To: Scott Francis Cc: Forrest W. Christian; measl(a)mfn.org; Eric A. Hall; nanog(a)nanog.org Subject: Re: anybody else been spammed by "no-ip.com" yet? On Mon, 6 May 2002, Scott Francis wrote: > On Sat, May 04, 2002 at 06:01:49PM -0600, forrestc(a)imach.com said: > [snip] > > Passing laws and putting on filters don't work. Depending on each mail > > server admin to do the right thing doesn't work. We need to find > > something else that will. > > I'm beginning to think that fighting the spam itself is futile. What we > should perhaps be focusing on is removing access to whatever is being > spamvertised (frequently a get-rich-quick website, porn site, diet site, etc. > - but generally a website somewhere, that can have the plug pulled). Actually, my analysis of spam seems to indicate authentication of remote SMTP servers through a process similar to joining this list would remove 99+% of SPAM. i.e. the first email from a particular remote server that is received, requires the sender to take some action (respond with a password, click on a URL, etc.) before the mail gets through. One of these days I hope to write the procmail rules to do it (if I don't find someone that has done it already) -Ralph

1 0