June 2004 - Test - lists.nanog.org

DDoS mitigation with BGP communities
by Matthew Crocker 14 Jun '04

14 Jun '04

Hello, I just experienced my first official DDoS attack against my network. I never realized how helpless I was :(. I had roughly 70 mbps of traffic aimed at one IP. The IP wasn't even in use, I'm assuming someone typed the wrong IP and meant to send it somewhere else. I shut it down by removing the /24 announcement. This was fine except for the customers on that /24. I know my upstreams have special communities I can set via BGP announcements that effectively say 'route packets to this network to null0'. My question is, what do I need to put on my router (i.e. code examples) to inject the /32 into the BGP announcements. I try to be a good net citizen and announce aggregate blocks. I had to break my /21 up so I could announce everything but the /24 in the middle. Any help would be greatly appreciated. Routers are a couple 7500 series running 12.0.xx -Matt

3 2

hybrid approaches (Re: "Default" Internet Service)
by Edward B. Dreger 14 Jun '04

14 Jun '04

Apologies for forking yet another thread from one which I myself have been largely ignoring. AFAICT, though, most posts have shown little interest in combining different approaches: * Provide a "default" sandbox. * Allow unrestricted access -- perhaps after a quiz, perhaps when a user activates a form. * Let IDS trigger sandbox mode. * Provide IDS-triggered-sandbox override for those who agree in writing to <blah>. * Anyone in the IDS-proof class who spews filth deserves to be fined. * Use different IP ranges for different service classes. Flag in rwhois, a special RRTYPE, or whatever suits one's fancy. (This assumes that providers could agree on a standard.) Perhaps no one tactic fixes everything. Fine. I readily admit that the above combination isn't a miracle cure. But is there a moderate chance for improvement? I think so. A substantial part of the problem is critical mass. Few networks want to be the first to take the plunge. I wonder what happens first... networks improve community spirit? government [attempts at] regulation? users get fed up and reduce Internet service consumption? Eddy -- EverQuick Internet - http://www.everquick.net/ A division of Brotsman & Dreger, Inc. - http://www.brotsman.com/ Bandwidth, consulting, e-commerce, hosting, and network building Phone: +1 785 865 5885 Lawrence and [inter]national Phone: +1 316 794 8922 Wichita _________________________________________________________________ DO NOT send mail to the following addresses : blacklist(a)brics.com -or- alfra(a)intc.net -or- curbjmp(a)intc.net Sending mail to spambait addresses is a great way to get blocked.

2 1

Re: "Default" Internet Service
by Hannigan, Martin 14 Jun '04

14 Jun '04

Actually, these problems are economical and business model problems. Socio went out in 97/98. If not sooner. Regards, -- Martin Hannigan (c) 617-388-2663 VeriSign, Inc. (w) 703-948-7018 <http://www.verisign.com/> -----Original Message----- From: owner-nanog(a)merit.edu <owner-nanog(a)merit.edu> To: nanog <nanog(a)merit.edu> Sent: Mon Jun 14 16:23:48 2004 Subject: Re: "Default" Internet Service AL> Date: Mon, 14 Jun 2004 17:57:21 -0500 (CDT) AL> From: Adi Linden AL> Who do you suppose pays for the abuse department staff? Those AL> are operational costs passed on to all customers. Unless one does nothing, in which case the cost goes to the rest of the world. I'd rather take on a handful of infected users and hosts on the inside than deal with crud from the rest of the world. Yet another slew of NANOG threads with hundreds of posts that boil down to sociotechnical issues and how to shift the costs to the guilty parties. Eddy -- EverQuick Internet - http://www.everquick.net/ A division of Brotsman & Dreger, Inc. - http://www.brotsman.com/ Bandwidth, consulting, e-commerce, hosting, and network building Phone: +1 785 865 5885 Lawrence and [inter]national Phone: +1 316 794 8922 Wichita _________________________________________________________________ DO NOT send mail to the following addresses : blacklist(a)brics.com -or- alfra(a)intc.net -or- curbjmp(a)intc.net Sending mail to spambait addresses is a great way to get blocked.

1 0

Re: "Default" Internet Service
by Matthew Sullivan 14 Jun '04

14 Jun '04

Owen DeLong wrote: > Frankly, I don't want to have to read the *@#( tutorial. I should at > least > have the option of skipping to the questions. I don't mind "You must be > this tall to ride." I do mind "Now we, who have been in business for > fewer years than you have been running backbone routers, are going to > give you a brief tutorial on internet security." No, I referred to the questions as simple questions where someone would have had to have read the tutorial (or already knows the answers) to get a less restricted account..... There would of course be the option to say 'I want a completely unrestricted incoming and outgoing account, I do know what I'm doing'.... The point being that the majority of mum's, dad's and indeed small businesses don't have a clue about what they are doing, and most just want to be able to browse the web, do some internet banking or shopping, and have access to email. Yours Mat

2 3

sorry.
by Drew Weaver 14 Jun '04

14 Jun '04

Is anyone else having problems connecting to any of these on port 25?: herndon.mgw.rr.com. 131 IN A 65.32.1.38 herndon.mgw.rr.com. 131 IN A 65.32.1.42 herndon.mgw.rr.com. 131 IN A 65.32.1.49 herndon.mgw.rr.com. 131 IN A 66.75.160.12 herndon.mgw.rr.com. 131 IN A 66.75.160.13 herndon.mgw.rr.com. 131 IN A 24.25.4.95 herndon.mgw.rr.com. 131 IN A 24.25.4.96 herndon.mgw.rr.com. 131 IN A 24.25.4.97 herndon.mgw.rr.com. 131 IN A 24.29.99.40 herndon.mgw.rr.com. 131 IN A 24.29.99.41 herndon.mgw.rr.com. 131 IN A 24.92.226.25 herndon.mgw.rr.com. 131 IN A 24.92.226.31 herndon.mgw.rr.com. 131 IN A 24.92.226.159 herndon.mgw.rr.com. 131 IN A 24.92.226.164 herndon.mgw.rr.com. 131 IN A 24.93.35.209 herndon.mgw.rr.com. 131 IN A 24.93.35.210 herndon.mgw.rr.com. 131 IN A 24.93.40.180 herndon.mgw.rr.com. 131 IN A 24.94.163.190 herndon.mgw.rr.com. 131 IN A 24.94.165.190 this could be a coincidence but I randomly tried connecting to 7 or 8 of those on port 25 and they all timed out. Anyone else? Just me? -Drew

1 0

Anyone from Roadrunner's mail team
by Drew Weaver 14 Jun '04

14 Jun '04

This is not in regards to your spam policies, it looks like a few of your MX servers are down and its playing a slight havoc on this end.. please contact me. -Drew

1 0

New IPv6 Address Block Allocated to RIPE NCC
by leo vegoda 14 Jun '04

14 Jun '04

Dear Colleagues, The RIPE NCC received the IPv6 address range 2001:4000::/23 from the IANA in June 2004. You may wish to adjust any filters you have in place accordingly. More information on the IP space administered by the RIPE NCC can be found on our web site at: <https://www.ripe.net/ripe/docs/smallest-alloc-sizes.html> Regards, -- leo vegoda Registration Services Manager RIPE NCC

1 0

Re: QOD: Which is worse - Spam or Attacks?
by Pete 13 Jun '04

13 Jun '04

> > > > So, I put these question on the floor . . . > > > > How is it that a small web-hosting ISP can be condemned for not > > handling their clientele as spammers. On the otherhand > > the "fat-dog" ISP's can blantantly state that they deny access and > > using misleading information are not held to the same standards. And > > in-fact are not even using any port filtering to prevent their clients > > from infecting the world? > > http://puck.nether.net/netops/nocs.cgi?ispname=sbc > > 877 588-1316 > > Does this not work? > NOC != abuse department. Nope it sure doesn't! > > I believe SBC is filtering atleast 4 TCP ports on their DSL customers > (135, 139, 445 and 1025). > http://puck.nether.net/netops/nocs.cgi?ispname=sbc is BOGUS Info as far as SBC goes, just like I said it was, try t yourself and see how far you get. SBC's peering is in the MAE's, Ashburn and PAIX sure aren't filtered [:-(] very well.

1 0

design related question
by Vicky 13 Jun '04

13 Jun '04

Hi there, Just want to hear your thoughts (pros and cons) on placing qos appliance between the below choke points. (a) appliance sitting between internal lan<->appliance<->dmz<->pix<->edge router<->wan cloud. or (b) appliance sitting between wan cloud<->edge router<->appliance<->dmz<->pix<->internal lan Currently this appliance supports the following qos components w/ 45mbps support on eth0 and eth1: -- shaping -- buffering -- policing Any pointers to white papers, similar deployment, lesson learned or simply your feedback will be appreciated. regards, /vicky

1 0

Re: Internet Credibility Bureau (Re: Points on your Internet driver's license)
by sgorman1＠gmu.edu 13 Jun '04

13 Jun '04

Also the problem of off shoring spam probably should be taken into consideration. No matter how good the plan is if a country is willing not to enforce it there will be a problem. I read a study recently that analyzed where spam destination sites were hosted (where the link in the spam message takes you) and 70% was in China. http://www.businessweek.com/technology/content/may2004/tc20040517_1934_tc05… ----- Original Message ----- From: John Curran <jcurran(a)istaff.org> Date: Sunday, June 13, 2004 2:57 pm Subject: Internet Credibility Bureau (Re: Points on your Internet driver's license) > > You underestimate the profitability of spam and the creativity of such > folks in filling out applications. I do think that it's workable, > but just > don't presume that its going to be airtight. > > /John > > At 10:45 AM -0700 6/13/04, Owen DeLong wrote: > >As I said earlier in private mail to John, I think this will only > work if > >the reporting is done on indivuduals, not companies. For non- > corporate>business entities, the president of the company should > be used as a stand-in > >for the company. For corporate business entities, the CEO or > chairman of the > >board should be used. I'm betting that spammers will rapidly run > out of > >people willing to forego future internet access in the name of > continuing>their business fairly rapidly. > > > >Owen > >

1 0