March 2004 - Test - lists.nanog.org

RE: Counter DoS
by Pendergrass, Greg 11 Mar '04

11 Mar '04

I can see now that it's only a matter of time before some nut writes "The Art of War in the Internet". I read the whitepaper, it goes on a lot about how defensive policies are ineffective but doesn't really say why active response has never been tried: A. Most of the time dDOS traffic is from spoofed sources anyway so whichever machine you "return fire" on is probably not the one that attacked you. B. NAT translation means a hacker has a tailor-made defense against any active repsonse. C. Even if you can directly attack a machine being used against you it's almost certainly not the perpetrator's box, he/she is sitting half a world away. The box you intentionally destroy is likely some innocent family PC that was taken over using some unplugged windows security hole. D. Widely deployed active defense will give an attacker a new form of dDOS attack, spoof the source of the one you want to hit in attacking several "active defense" systems and watch them attack your target for you. Their proposition is a terrible idea and their "rules of engagement" would be funny instead of frightening if it wasn't serious GP -----Original Message----- From: Joshua Brady [mailto:jbrady@neoins.com] Sent: 11 March 2004 01:27 To: isp-chat(a)isp-chat.com Cc: nanog(a)merit.edu Subject: Counter DoS http://news.zdnet.co.uk/internet/security/0,39020375,39148215,00.htm Comments? Vodafone Global Content Services Limited Registered Office: Vodafone House, The Connection, Newbury, Berkshire RG14 2FN Registered in England No. 4064873 This e-mail is for the addressee(s) only. If you are not an addressee, you must not distribute, disclose, copy, use or rely on this e-mail or its contents, and you must immediately notify the sender and delete this e-mail and all copies from your system. Any unauthorised use may be unlawful. The information contained in this e-mail is confidential and may also be legally privileged.

2 1

RE: Counter DoS
by Michael.Dillon＠radianz.com 11 Mar '04

11 Mar '04

>I wonder, are they planning to launch these DDoS attacks from >compromised hosts belonging to unwitting accomplices like the >bad guys do? Could they be the people behind NetSky? We know now that Bagle and MyDoom come from spammer gangs but I haven't heard if anyone has identified a motive behind Netsky yet. I suppose that Symbiot is the logical next step. Now that there is a market for compromised hosts to build distributed networks for DoS, DNS, or anonymous hosting the logical next step is for a legitimate company (or semi-legitimate) to step into that market and try to dominate it. If the ISP and the vendor community won't work together to build the tools and systems needed to identify and block DDoS emitters then this is the inevitable result. If it goes much further then ISPs risk being sued for blocking DDoS because they will also be blocking somebody's revenue stream as well. --Michael Dillon

1 0

Re: Counter DoS
by Brandon Butterworth 11 Mar '04

11 Mar '04

> The Symbiot whitepaper on their service describes a process with a > little more imagination Like hooking it up to DARPA Grand Challenge winners? http://abcnews.go.com/sections/SciTech/WorldNewsTonight/robot_race_darpa_04… > I applaud the idea of a outsourced department that will manage the > denial of service, and "hordes of script kiddie" trouble with sending a droid round to kick ass is you've just made Skynet V0.1 brandon

2 1

Re: Counter DoS
by Baldwin, James 11 Mar '04

11 Mar '04

http://www.symbiot.com/media/iwROE.pdf The Symbiot whitepaper on their service describes a process with a little more imagination and use than simply flooding attacking nodes with packets. It describes a process which appears to require human intervention through an Operations Center to aid in tracking down offending nodes and notifying the offenders service providers prior to an deployment of active defenses. That being said, it also specifically mentions "distributed denial of service counterattacks" as a not quite so last resort, and possibly automated response gesture for multiple identified offenders with whom intervention from service providers and other authorities has not been forth coming. I applaud the idea of a outsourced department that will manage the denial of service, and "hordes of script kiddie" (nod to Ranum) problems that plague modern networks. Anything that keeps me from being distracted from more interesting lines of thought, rather than constantly following up on outside nuisances is a Good Thing (tm). However, the deployment of "active defenses" in response to a failure of service providers to adequately secure their egress and ingress points is not a choice any reasonable person would make. Vigilante justice might be rewarding in the short term, but I choose not to leave the judgment of friend and foe in the hands of someone with large amounts of bandwidth at the tips their itchy trigger fingers. James Baldwin WorldWide Technology, Services, and Operations Operations Center Electronic Arts, Inc.

2 1

Check Your Routing Table! Production Use of 84/8 Imminent.
by Daniel Karrenberg 11 Mar '04

11 Mar '04

The first allocation out of 84/8 has happened. It is *now* high time to check whether you see the pilot prefixes 84.192/16 and 84.255.248/21. If you do not see both of these prefixes it is extremely likely that you will have a connectivity problem very shortly. We also suggest that you check any packet filters you may be responsible for. Regards Daniel Karrenberg RIPE NCC ------ Notes: 84/8 has been allocated by the IANA on November 17th 2003, almost 4 months ago. The fact has been announced on this list a couple of times since. Routing decisions are fully within the responsibility of the network operators. The IANA and the RIRs will only announce which parts of the address space are currently in use. They have no authority whatsoever over routing decisions taken by you and other network operators. More details about the pilot prefixes can be found at http://www.ripe.net/ripe/draft-documents/deboganising-draft.html A visibility comparison of the pilot prefixes with some production prefixes can be found at http://www.ris.ripe.net/debogon/debogon.html Those interested in history, see http://www.ris.ripe.net/debogon/ More information on how to do Bogon filtering efficiently and reliably can be found at Team CYMRU: http://www.cymru.com/Bogons/index.html Unfortunately we are not currently able to provide a host within the pilot prefixes that can reliably answer pings, nor are we able to do connectivity checks from there. The allocation had to happen before we were ready with this part of the pilot prefix pilot.

1 0

AT&T Outage 01:25-01:50 AM EST
by pr＠isprime.com 11 Mar '04

11 Mar '04

Anyone else notice that little AT&T outage just now? All of their routes just flapped, and pinging their side of /30's from level3 and Teleglobe in NYC, I had ~1.0sec ping times. Curious to know what went wrong... --Phil

8 8

Greetings
by Gregory Taylor 11 Mar '04

11 Mar '04

Hello Everyone, I'm new to this mailing list and as such I would like to introduce myself. My name is Gregory Taylor. Some of you know who I am and some of you don't. For those who don't, I am a network and systems engineer up here in the rainy northwest. I'd just like to say hello to everyone and I hope that I can contribute to any discussions you may have constructively and be as helpful as I possibly can. Thank You, -- N E T W O R K A T L A N T I S Premium Internet Services ========================================= Gregory Taylor = Network Engineer ========================================= Email: taylog(a)networkatlantis.com ========================================= Visit us at http://www.networkatlantis.com

1 0

Asking about .iq at ICANN Rome
by Eric Brunner-Williams in Portland Maine 10 Mar '04

10 Mar '04

Oki all, Apropos of plaintive discussion by gTLD registries about repurposed ccTLDs such as .{bz,cc,md,pw,tv}, I asked Paul Twomey during the 1st open mic hour about the current status of .iq. The net of the response was "we know less than you do" and a longish and booring statement that got read the next morning to punish all and sundry, which hasn't made it into the meeting minutes. Later, during the 2nd open mic hour when the subject of ICANN staff and NS change requests (secondary followed by primary, effecting covert redelegation) came up, I asked whether staff had any data to share on communications of any kind concerning .iq. Recall: The .iq sponsor and operator are in a Federal pen in Texas and are awfully quiet. See http://nic-iq.nic-naa.net for what little I know about .iq. The net of the response was "we have gotten above double-digit inquiries from various parties concerning the .iq space", and no corroborating details beyond this assertion will be available. Life being the random thing that it is, I ran into a Haliburton contractor in Rome, who knew that RTI got the Iraq schools deal, so most of whatever could go into the .k12.iq zone, easily 1k of site entries, is already on file somewhere inside www.rti.org. Life being even further random, the dns-free mobile infrastructure of Iraq is now being advertized in the broadcast media in Rome. Folks interested in this please drop me a note. Folks interested in ICANN'T should note that with WLS, the base registry price for a domain name just went from $6/yr to $30/yr, with the usual caveats that it really is just $6/yr unless one, or someone, wants the additional $24/yr WLS subscription value. The current crop of alternatives to ICANN now includes: The ITU: http://www.itu.int/osg/spu/forum/intgov04/ The UN: http://www.unicttaskforce.org/sixthmeeting/ and Weinstein, Neuman, and Farber have something cooking on the general failure of packetized life that is nominally relevant: http://www.pfir.org/meltdown/ That's my 0.02 € for this evening. This list actually was mentioned by name at ICANN. Forward as appropriate, or inappropriate. Eric

1 0

Comcast Contact
by Matt Hess 10 Mar '04

10 Mar '04

Can somebody at comcast.net with a clue about possible ip routing problems please contact me off-list.

1 0

ALTER.NET packet loss / huge latencies?
by Avleen Vig 10 Mar '04

10 Mar '04

Is anyone else seeing this? It seems to be happening all over thier network, here is one example: 7 POS1-2.BR2.LAX9.ALTER.NET (204.255.169.137) 13.461 ms 16.557 ms 12.602 ms 8 * 0.so-0-2-0.XL2.LAX9.ALTER.NET (152.63.114.246) 230.718 ms 245.466 ms 9 * 0.so-0-0-0.TL2.LAX9.ALTER.NET (152.63.115.146) 220.956 ms * 10 0.so-7-0-0.IL2.DCA6.ALTER.NET (152.63.9.221) 261.532 ms 258.602 ms 263.568 ms 11 so-0-0-0.IR2.DCA4.ALTER.NET (146.188.13.42) 257.150 ms 246.301 ms * 12 so-5-0-0.TR2.LND2.ALTER.NET (146.188.3.222) 389.056 ms 377.858 ms 406.916 ms 13 so-6-0-0.XR1.LND2.ALTER.NET (146.188.7.225) 368.634 ms 341.144 ms * And another: 8 POS1-1.BR1.SEA1.ALTER.NET (204.255.174.169) 289.566 ms 288.612 ms 295.284 ms 9 * 0.so-7-3-0.XL2.SEA1.ALTER.NET (152.63.105.22) 247.114 ms * 10 0.so-7-0-0.TL2.SEA1.ALTER.NET (152.63.2.134) 252.573 ms 250.192 ms 251.660 ms 11 * 0.so-4-0-0.TL2.SAC1.ALTER.NET (152.63.1.5) 252.037 ms 262.443 ms 12 0.so-7-0-0.XL2.SJC1.ALTER.NET (152.63.55.133) 252.823 ms * 252.452 ms 13 POS1-0.XR2.SJC1.ALTER.NET (152.63.55.125) 255.131 ms 248.951 ms 252.414 ms -- Avleen Vig Systems Administrator Personal: www.silverwraith.com EFnet: irc.mindspring.com (Earthlink user access only)

2 1