December 2004 - Test - lists.nanog.org

Unflattering comments about ISPs and DDOS
by Michael.Dillon＠radianz.com 06 Dec '04

06 Dec '04

This article in ZDNET UK entitled "WIth ISPs like this, who needs enemies?" http://comment.zdnet.co.uk/andrewdonoghue/0,39027004,39175983,00.htm contains some rather unflattering comments about ISPs who don't help customers deal with DDOS attacks. The head of security technology for a major ISP named in the article said: "Why should ISPs do something? It's very much as if people want something for nothing. This noise is superfluous and silly." The thinking is this. There are two operational problems here, one big and one small. The big one is when your customer is the target of DDoS. The small one is when your customers originate the DDoS. I think the writer is telling us to treat these as two sides of the same problem. If management buys into this view then it would make the business case for the operational effort needed to clean up botnets. And if enough people clean up the bots on their network, then a case can be made for depeering (or severely damping) networks that don't clean up their act. --Michael Dillon

6 5

LG close to MCI Japan anyone?
by Elmar K. Bins 06 Dec '04

06 Dec '04

Hi there, I'm currently searching for a looking glass close to AS703 in Japan. Unfortunately, JPIX doesn't offer one (would have been to easy anyway). Any pointers? Yours, Elmar. PS: Whoever maintains traceroute.org and is on the list: Very many of the listed RS and LGs are offline and some have been for quite a while.

3 2

RE: Bangladesh gets itself an IXP
by Majid Farid 06 Dec '04

06 Dec '04

Also http://www.pie.net.pk/ for Pakistan. -- Majid. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Suresh Ramasubramanian Sent: Monday, December 06, 2004 8:56 AM To: nanog(a)nanog.org Subject: Bangladesh gets itself an IXP http://www.bdix.net looks quite good to me. Open peering, with over 10 local ISPs peering there. What a change from the joke that is NIXI (www.nixi.org) in India .. srs (depressed)

2 1

Sprint security contact
by Erond 06 Dec '04

06 Dec '04

One of our customers is currently undergoing a ~30Mbs DDoS to a single IP. We've BGP blackholed them within our network, but they are still beating up on our upstream links. UUNET has blocked them internally, but I'm getting bounced around within Sprint to have their NOC/security group work on it. I started with our contact information and also the puck.nether.net info. If there is a Sprint security person on list, please contact me. If somebody has a direct Sprint NOC/Security contact, please pass it along. Thanks, Rick

2 1

Blocking worms/ddos for customer for free?
by Kim Onnel 06 Dec '04

06 Dec '04

Hello, Currently, on our ingress, we block spoofed packets, common worms/trojans ports. We do that for all of our customers(residential DSL, Dial-up, Corporate DSL, and the data center hosted websites/servers), however, For me there are 2 ways to look at it, if i leave these worms to come in, they would consume our bandwidth and CPU, and on the other hand, it looks like we're giving a free service, which in a way uses up our resources, Its the same for DDoS, if i stop it for a customer, i'm giving him a free a service, if i dont, its gonna wreck my network. Personally, i block the illegitimate packets out of my network(egress) but thats because i owe this to the internet community, even if i am not getting paid for it. I would like to know other providers policy about this?

2 1

RE: Blocking worms/ddos for customer for free?
by Chad Skidmore 06 Dec '04

06 Dec '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > -----Original Message----- > From: Kim Onnel [mailto:karim.adel@gmail.com] > Posted At: Monday, December 06, 2004 11:46 AM > Posted To: NANOG > Conversation: Blocking worms/ddos for customer for free? > Subject: Blocking worms/ddos for customer for free? > > > > Hello, > > Currently, on our ingress, we block spoofed packets, common > worms/trojans ports. > > We do that for all of our customers(residential DSL, Dial-up, > Corporate DSL, and the data center hosted websites/servers), > however, > > For me there are 2 ways to look at it, > if i leave these worms to come in, they would consume our > bandwidth and CPU, and on the other hand, it looks like we're > giving a free service, which in a way uses up our resources, > > Its the same for DDoS, if i stop it for a customer, i'm > giving him a free a service, if i dont, its gonna wreck my network. > > Personally, i block the illegitimate packets out of my > network(egress) but thats because i owe this to the internet > community, even if i am not getting paid for it. > > I would like to know other providers policy about this? > Blocking spoofed packets (inbound and outbound) is certainly a good thing and, in my opinion should be done by providers across the board. Blocking worms/trojan/whatever ports starts to get a little more difficult. Mainly due to the fact that they often times use ports and protocols that are valid and blocking them breaks things that are required. At the risk of starting the whole "Microsoft stuff should be banned from the Internet rant" I'll use the example of ports 135-139. Some people block those ports and don't get too much grief from their customer base. Others that try to block them find that at least some portion of the customer base complains because they have something that relies on those ports to work. This leads many to choose the path of least resistance and not filter. The other challenge with filtering is that it can consume resources, in some cases more quickly than not filtering at all. If traffic levels are high enough filtering can melt down your router more quickly than not filtering. This obviously depends on a number of things and we are seeing vendors produce routers that can filter at line rate without impacting performance or just plain falling over. Those routers can be very expensive however and if someone isn't paying for that additional service it can be hard to justify upgrading to a new line card that runs an easy six figures just to become your customer's free firewall. Those two things said, we don't believe that we are our customer's firewall unless specifically contracted to perform that task. That insures that we are compensated for the resources consumed and that we all agree on what is or is not valid traffic. All to often we have found that valid traffic for one person is not valid traffic for another so "firewall rules" will vary from one customer to the next. DDOS inbound to your customer may or may not wreck your network and what looks like a DDOS attack can be valid traffic for some customers. I know that we handle it on a case-by-case basis with good customer communication before we take action, assuming it isn't wrecking the rest of our network. If it is wrecking our network then we subscribe to the "Sacrifice the one to save the many" philosophy and will stop the attack. DDOS outbound from your network is again something that you need to double check to insure that it really is a DDOS attack. In our case if we see something that we strongly believe to be an outbound attack or can verify as an outbound attack then we'll take action. Anomolous traffic gets investigated to see if it is an attack or if it is valid. That, to us, is just part of being a good net citizen and making sure our customers don't ruin someone else's day. Regards, Chad - ---------------------------- Chad E Skidmore One Eighty Networks, Inc. http://www.go180.net 509-688-8180 -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQA/AwUBQbS/XU2RUJ5udBnvEQKY9ACdEDqM/PMlkKCokIgduKfQnvkHf3cAoN2B 40u2sItiQQdZ/xVChcXO1oTP =E0NF -----END PGP SIGNATURE-----

1 0

Re: 16-bit ASN kludge
by John Dupuy 06 Dec '04

06 Dec '04

Along these lines, one could leave the transit AS networks alone if a parallel 16 bit ASN space were created. Essentially, any non-transit network would have it's non-public ASN retranslated NAT-style by upstream transit network border routers. Only the border routers would have to be changed. They would have to differentiate between public ASN X and non-public ASN X (same number) based on the which side of the router the ASN was learned from. This would essentially double the ASN numbers available. All that being said, I'd much rather see 32-bit ASNs. John At 10:48 AM 12/3/2004, Edward B. Dreger wrote: >Perhaps transit networks should receive 16-bit ASNs. Leaf networks >would use { a special ASN | I'm still brainstorming | who knows } and >carry an "available upstreams" BGP tag for each upstream. > >Metrics are calculated for each transit AS. Those metrics are then >combined with <as yet unspecified intelligence in "available upstreams" >tag> for each leaf ASN. > >BGP loop detection might present a problem if all leaf ASNs use, say, >16-bit AS65535. If existing allowas-in is too coarse, refer to "32-bit >ASN" BGP attribute for fine-grained control. > >In short: I'm trying to think up a mechanism that performs full Dijkstra >calculations _only_ for transit networks, and uses some cheaper version >for the degenerate case of a leaf network. > > >Eddy >-- >Everquick Internet - http://www.everquick.net/ >A division of Brotsman & Dreger, Inc. - http://www.brotsman.com/ >Bandwidth, consulting, e-commerce, hosting, and network building >Phone: +1 785 865 5885 Lawrence and [inter]national >Phone: +1 316 794 8922 Wichita >________________________________________________________________________ >DO NOT send mail to the following addresses: >davidc(a)brics.com -*- jfconmaapaq(a)intc.net -*- sam(a)everquick.net >Sending mail to spambait addresses is a great way to get blocked.

6 17

RE: Bogon filtering (don't ban me)
by Mark Segal 06 Dec '04

06 Dec '04

Then you could also just get a connection to team cymru's bogon servers. Works Perfectly for us. I have been peering with them from our sink hole/black hole trigger router, for a while now, and I no longer need to manually update the files. More info here. http://www.cymru.com/BGP/bogon-rs.html Regards, Mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of David Barak > Sent: December 3, 2004 10:08 AM > To: J. Oquendo; nanog(a)nanog.org > Subject: Re: Bogon filtering (don't ban me) > > > > --- "J. Oquendo" <sil(a)politrix.org> wrote: > > > I thought about it over and over, and wonder why this hasn't been > > done. > > Any care to beat me with a clue stick or two. I can understand the > > arguments of not wanting a vendor to have control of some > aspect of my > > business, or control over my network, but correct me if I am wrong, > > wouldn't this solve a heck of a lot of issues concerning > network based > > attacks, spam, scumware/spyware/fooware/$*something? > > Vendor C has something similar, in their "autosecure" > feature. However, the trouble is that the list of bogon > networks is static, and in fact includes 70/8 among many > others. This is (I'm certain) contributing to the > reachability issues that those folks with new netblocks experience. > > A better implementation would be for vendors to include a > "bogon-subscribe server x.x.x.x" feature, which would simply > allow a router to talk to a centralized bogon server. > > However, the complexity of setting up the real-time BGP bogon > feeds is not that hard - anyone who would use the above > command could do it - so I'm not sure that this requires any > new tools. > > ===== > David Barak > -fully RFC 1925 compliant- > > > > __________________________________ > Do you Yahoo!? > Yahoo! Mail - now with 250MB free storage. Learn more. > http://info.mail.yahoo.com/mail_250 > >

16 27

RE: Bogon filtering (don't ban me)
by Church, Chuck 06 Dec '04

06 Dec '04

Rob, Just thinking out loud, but is there any reason that this route-server methodology couldn't be applied to other 'undesirable' destinations, such as the world's top spammers, phishing web sites, etc? Maybe break them up into different communities, so subscribers can pick which ones they want to filter. Chuck Church Lead Design Engineer CCIE #8776, MCNE, MCSE Netco Government Services - Design & Implementation Team 1210 N. Parker Rd. Greenville, SC 29609 Home office: 864-335-9473 Cell: 703-819-3495 cchurch(a)netcogov.com PGP key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x4371A48D -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Rob Thomas Sent: Saturday, December 04, 2004 7:22 PM To: NANOG Subject: RE: Bogon filtering (don't ban me) Hi, Hank. ] I do as well, but does this scale? Can Team CYMRU handle 2,000 BGP ] sessions? 20K? 200K? -Hank We can handle quite a lot of sessions, and already do, thanks to the distributed nature of the Bogon route-server project. We have several routers deployed, and are prepared to deploy more if necessary. By the way we recommend that folks peer with at least two of the Bogon route-servers. Thanks, Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

5 4

Re: Banned on NANOG
by Hannigan, Martin 06 Dec '04

06 Dec '04

You expect? Bill, nothing personal, but your S:N is 0:6 at this point. Not one single op post ever. No meeting attendance. Not one answered technical question. How about earning a few stripes before making demands of NANOG? Srh may be in need of a config change, but she's one of us. Show some respect. /plonk -M --- Martin Hannigan hannigan(a)verisign.com Verisign, Inc. -----Original Message----- From: owner-nanog(a)merit.edu <owner-nanog(a)merit.edu> To: J.D. Falk <jdfalk(a)cybernothing.org> CC: my network has a second name, it's n-a-n-o-g <nanog(a)merit.edu> Sent: Sun Dec 05 00:09:58 2004 Subject: Re: Banned on NANOG On Sat, 4 Dec 2004, J.D. Falk wrote: > On 12/04/04, Patrick W Gilmore <patrick(a)ianai.net> wrote: > >> I also think that makes it nearly impossible to run a good, informative >> list. Certainly FAR more difficult than just leaving the list >> completely unmoderated. I do not believe anyone here would argue those >> points either (besides, obviously, the moderator herself). > > ...who has been silent during this whole debate, which only > serves to feed the flames (and the flamers) as we all make wild > guesses regarding motive and intent. My last email contained an explicit request for a responst. I expect to see one. - billn

2 1