March 2004 - Test - lists.nanog.org

RE: UUNet Offer New Protection Against DDoS
by Lumenello, Jason 03 Mar '04

03 Mar '04

Oh, and I strip their communities, and apply no-export, on the first term of my route map so the /32 does not get out. Of course my peer facing policy requires specific communities to get out as well (belt and suspenders). This method works very well, and you do not have to give up length restrictions or maintain two sets of customer prefix/access lists. Jason > -----Original Message----- > From: Lumenello, Jason > Sent: Wednesday, March 03, 2004 4:52 PM > To: 'Stephen J. Wilcox'; james > Cc: nanog(a)merit.edu > Subject: RE: UUNet Offer New Protection Against DDoS > > I struggled with this, and came up with the following. > > We basically use a standard route-map for all customers where the first > term looks for the community. The customer also has a prefix-list on their > neighbor statement allowing their blocks le /32. The following terms (term > 2 and above) in the route-map which do NOT look for the customer discard > community, have a different standard/generic prefix-list evaluation which > blocks cruft and permits 0.0.0.0/0 ge 8 le 24. > > By doing this, I only accept a customer /32 from his dedicated prefix-list > when it has the DOS discard community, otherwise I catch them with the ge > 8 le 24 in the following terms. > > Jason Lumenello > IP Engineering > XO Communications > > > -----Original Message----- > > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of > > Stephen J. Wilcox > > Sent: Wednesday, March 03, 2004 3:48 PM > > To: james > > Cc: nanog(a)merit.edu > > Subject: Re: UUNet Offer New Protection Against DDoS > > > > > > > > I'm puzzled by one aspect on the implementation.. how to build your > > customer > > prefix filters.. that is, we have prefix-lists for prefix and length. > > Therefore > > at present we can only accept a tagged route for a whole block.. not > good > > if the > > announcement is a /16 etc ! > > > > Now, I could do as per the website at secsup.org which means we have a > > route-map > > entry to match the community before the filtering .. but that would > allow > > the > > customer to null route any ip. > > > > What we need is one to allow them to announce any route including more > > specifics of the prefix list - how are folks doing this? > > > > Steve > > > > On Wed, 3 Mar 2004, james wrote: > > > > > > > > Global Crossing has this, already in production. > > > I was on the phone with Qwest yesterday & this was one > > > of this things I asked about. Qwest indicated they are > > > going to deploy this shortly. (i.e., send routes tagged with > > > a community which they will set to null) > > > > > > > > > James Edwards > > > Routing and Security > > > jamesh(a)cybermesa.com > > > At the Santa Fe Office: Internet at Cyber Mesa > > > Store hours: 9-6 Monday through Friday > > > 505-988-9200 SIP:1(747)669-1965 > > > > > >

2 1

RE: dealing with w32/bagle
by Mike Damm 03 Mar '04

03 Mar '04

> We created bogus DNS entries for the following entries, known to be targeted by the worm: > www.sportscheck.de > www.songtext.net > www.songtext.de > www.maiklibis.de > www.gfotxt.net > postertog.de > permail.uni-muenster.de For what its worth ns{1,2,3,4}.everydns.net will answer for the wormy domains with 127.0.0.1 to help mitigate phone-home traffic. I just registered gfotxt.net (some appear to be registered while others are not) with the proper name servers and it should be visible worldwide along the normal timeline. Parties with control over the other mentioned domains or end user resolution are more than welcome to point them our way. We'll be generating some statistical data on DNS traffic and summarizing for anyone interested. -Mike

1 0

UUNet Offer New Protection Against DDoS
by John Obi 03 Mar '04

03 Mar '04

Hello Nanogers! I'm happy to see this, and I hope C&W, Verio, and Level3 ..etc will do the same! MCI/WorldCom Monday unveiled a new service level agreement (SLA) to help IP services customers thwart and defend against Internet viruses and threats. http://informationweek.securitypipeline.com/news/18201396 It's the right time before it's too late! Regards, -J --------------------------------- Do you Yahoo!? Yahoo! Search - Find what you�re looking for faster.

10 13

Re: dealing with w32/bagle
by Brent_OKeeffe＠asc.aon.com 03 Mar '04

03 Mar '04

We created bogus DNS entries for the following entries, known to be targeted by the worm: www.sportscheck.de www.songtext.net www.songtext.de www.maiklibis.de www.gfotxt.net postertog.de permail.uni-muenster.de The entries directed traffic to an interface on a router that can handle the traffic. Currently, we have a logging ACL that drops port 80 to the bogus IP. We might connect a sniffer with that IP address at some point with triggers loaded to notify when systems attempt to access the address. So far this has helped. Any other suggestions are welcome. Brent Dan Hollis <goemon(a)anime.net> Sent by: owner-nanog(a)merit.edu 03/03/2004 03:24 PM To: "'nanog(a)merit.edu'" <nanog(a)merit.edu> cc: Subject: dealing with w32/bagle I am curious how network operators are dealing with the latest w32/bagle variants which seem particularly evil. Also, does anyone have tools for regexp and purging these mails from unix mailbox (not maildir) mailspool files? Eg purging these mails after the fact if they were delivered to user's mailboxes before your virus scanner got a database update. -Dan

1 0

Re: dealing with w32/bagle
by W.D.McKinney 03 Mar '04

03 Mar '04

>-----Original Message----- >From: Dan Hollis [mailto:goemon@anime.net] >Sent: Wednesday, March 3, 2004 08:24 PM >To: 'nanog(a)merit.edu' >Subject: dealing with w32/bagle > > >I am curious how network operators are dealing with the latest w32/bagle >variants which seem particularly evil. > >Also, does anyone have tools for regexp and purging these mails from unix >mailbox (not maildir) mailspool files? Eg purging these mails after the >fact if they were delivered to user's mailboxes before your virus scanner >got a database update. > >-Dan > > Simply put, I run a Barracuda Networks box so I don't worry. Dee

1 0

Contact from (what used to be) CAIS (AS 3491).
by John Palmer 03 Mar '04

03 Mar '04

Could someone from whoever owns CAIS Internet (AS3491) please contact me offlist? One of your customers has a machine that is making a lame attempt at a DDOS attack. Although ineffectual, it is causing a slight uptick in bandwidth usage and we need to get this stopped before I take it to your upstream. Thanks John P. American Webmasters, Inc.

1 0

How much do worms and virus cost ISPs?
by Sean Donelan 03 Mar '04

03 Mar '04

Of course, I'm certain Sandvine is selling something to solve the problem, but it is still a very nice article with some measurable numbers. http://www.globeandmail.com/servlet/story/RTGAM.20040303.gtsandmar2/BNStory… "On any given day," its white paper concluded, "between 2 and 12 per cent of all Internet traffic moving across service provider networks is malicious. Even on well-run networks with dedicated security departments, malicious traffic constitutes, on average, 5 per cent of all data throughput." Service provider with about 100,000 subscribers will lose almost $60,000 in avoidable fees. A provider with one million subscribers will pay an additional $350,000.

1 0

Re: Warning - new trend of attempts to infect ISP users (possibly virus)
by Kevin Oberman 03 Mar '04

03 Mar '04

> Date: Wed, 3 Mar 2004 16:15:39 +0000 (GMT) > From: "Stephen J. Wilcox" <steve(a)telecomplete.co.uk> > Sender: owner-nanog(a)merit.edu > > > > > Erm is it me or are the writers of Bagle and Netsky determined to keep morphing > > > their code to outwit the virus scanners.. is this a new trend in virus writing - > > > beat the systems by evolving your code quicker than the security firms can > > > release updates? > > > > new trend in that it started only a decade ago? > > Perhaps I'm only following this as its affecting us more, but I dont recall a > time previously when I've had so many viruses hitting us and getting thro our > scanners with nothing we can do about it. I dont recall seeing viruses with > variants as high as 'j' before, especially in the relatively short time since > the previous variants were out > > Seriously, drop some references if I'm off-track.. its just my perception and > I'm not an expert at all with viruses... They are getting batter at it, but the WANK worm (1989) used self-modifying code so that no two replicas were the same. (Note: This worm only infected VMS systems running on the global DECNET internet, mostly DOE, NASA, and DEC corporate systems.) -- R. Kevin Oberman, Network Engineer Energy Sciences Network (ESnet) Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab) E-mail: oberman(a)es.net Phone: +1 510 486-8634

1 0

Looking for bandwidth around Penn Station NYC
by Paul Wouters 03 Mar '04

03 Mar '04

Hi guys, Is there anyone with a fiber drop or something around Penn Station in NYC? Or some non T-Mobile wireless presence? We're trying to get some bandwidth in the Pennsylvania Hotel in july, and I had hoped to do this through T-Mobile's wireless, but that doesn't seem to be an option they're willing to offer. Paul

1 0

RE: UUNet Offer New Protection Against DDoS
by Terranson, Alif 03 Mar '04

03 Mar '04

Hi John, While the formalities of the C&W acquisition have yet to kick in, I have no reason to believe that anything will change here: Savvis pioneered the 15 minute response time for DoS issues - whether or not it's our customer calling in. If it involves Savvis customers in any way, we will have the oncall security person on the phone and working the issue in less than 15 minutes - *always* (usual times are closer to 3 minutes because of the oncall cell phone). //Alif Alif Terranson OpSec Engineering Manager Operations Security Department Savvis Communications Corporation (314) 628-7602 Voice (314) 208-2306 Pager (618) 558-5854 Cell -----Original Message----- From: John Obi [mailto:dalnetuzer@yahoo.com] Sent: Wednesday, March 03, 2004 1:21 AM To: nanog(a)merit.edu Subject: UUNet Offer New Protection Against DDoS Hello Nanogers! I'm happy to see this, and I hope C&W, Verio, and Level3 ..etc will do the same! MCI/WorldCom Monday unveiled a new service level agreement (SLA) to help IP services customers thwart and defend against Internet viruses and threats. http://informationweek.securitypipeline.com/news/18201396 It's the right time before it's too late! Regards, -J Do you Yahoo!? Yahoo! Search - Find what youre looking for faster.

1 0