June 2004 - Test - lists.nanog.org

Re: Worst cast worm damage estimates: Research
by Sean Donelan 05 Jun '04

05 Jun '04

On Fri, 4 Jun 2004, Vern Paxson wrote: > > Some people regularly rebuild their Windows computer a few > > times a year. > > Including recovering from a trashed BIOS? As you point out in the paper, the BIOS scrambler attack is the one with the most variation between platforms. It could have a relatively low success rate. On the other hand, board and even system replacement occurs pretty frequently. Even without a superworm, computer repair depots return alot of computers to the factory instead of trying to fix them locally, especially if the computer is new/recent/under warranty. The newest computers are most likely to have a fast replacement cycle from inventory. I agree the BIOS scrambler is a particular nasty form of attack, but the current state of computer repair expertise means its not that different from the problems created by current viruses. In 2000 Intel needed to recall over one million motherboards already shipped to end-users due to a defect. Instead of fixing the defective otherboards, Intel offered to replace them with new motherboards. Analysts estimated that recall cost $300 million to $400 million dollars including the labor to replace the motherboard. That's less than $400 per defective motherboard. Your paper estimates it would cost more than double to replace a scrambled BIOS. Although some people have a personal attachment to their computers, business PCs are very fungible. If the PC was more than a few years old, the business probably has depreciated it, and may just replace it sooner than planned with newer (faster, more productive?) model. If the business has more than one computer, again the BIOS scrambler has the most variables, some of the other computers may be different vintage. The business may just use one of the working computers instead. The damaged computers don't need to be replaced with the exact same make and model, in the short term even older models may be sufficient or do all those executives and other people need their computers 24x7? On a CPU hour basis, PC's have a very low utilization. SETI@HOME may have fewer free CPU cycles to borrow because any working "personal" computers will be shared by multiple people timesharing until their own replacement computers arrive. According to the banking industry, on average 5% of the cash machines in the country aren't working on any particular day. Its even higher during a holiday weekend. What's the economic impact of 5% failure rate of cash machines? If 10% of the cach machines had their BIOS scrambled, would the impact be doubled? Instead of an economic loss, do you create a Y2K effect of companies accelerating the replacement of equipment and hiring consultants to fix problems creating a mini-economic boom. Captalism seems to make more money treating illness than preventing it.

2 1

Re: Worst cast worm damage estimates: Research
by vern＠ee.lbl.gov 04 Jun '04

04 Jun '04

> Some people regularly rebuild their Windows computer a few > times a year. Including recovering from a trashed BIOS? Vern

1 0

Worst cast worm damage estimates: Research
by Sean Donelan 04 Jun '04

04 Jun '04

Nicholas Weaver and Vern Paxson have published a paper estimating the worst case scenario of a network worm attack from USD$52 to $103 Billion. http://www.icir.org/vern/papers/worst-case-worm.WEIS04.pdf Although it was published last month, it was quoted in a new article today. One thing the left out the study was the improvement in productivity that occurs after you rebuild your Microsoft Windows computer. Some people regularly rebuild their Windows computer a few times a year. If companies and people have already factored in the need to regularly rebuild Windows computers in the Total Cost of Ownership, would a network worm really have that much additional economic impact? What's the economic impact of CTRL-ALT-DEL? The marketplace has already factored it in, because its business as usual. The well known (but not necessarily well respected) Mi2g Intelligence Unit has estimated the costs for previous infections as follows: Sobig: $37.1 billion MyDoom: $22.6 billion Klez: $19.8 billion Mimail: $11.5 billion Yaha: $11.5 billion Swen: $10.4 billion Love Bug: $8.8 billion Bugbear: $3.9 billion Dumaru: $3.8 billion SirCam: $3 billion

2 1

Comcast abuse contact
by Stephen Perciballi 04 Jun '04

04 Jun '04

If anyone from Comcast is listening, can you put me in contact with someone responsible for AUP enforcement off list. tia -- Stephen (routerg) irc.dks.ca

1 0

The Cidr Report
by cidr-report＠potaroo.net 04 Jun '04

04 Jun '04

This report has been generated at Fri Jun 4 21:43:44 2004 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 28-05-04 136044 96273 29-05-04 137423 96268 30-05-04 137948 96174 31-05-04 137863 96101 01-06-04 137984 96125 02-06-04 137818 96104 03-06-04 137774 96139 04-06-04 137884 95196 AS Summary 17255 Number of ASes in routing system 6964 Number of ASes announcing only one prefix 1420 Largest number of prefixes announced by an AS AS7018 : ATTW AT&T WorldNet Services 73559296 Largest address span announced by an AS (/32s) AS568 : DISOUN DISO-UNRRA Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 04Jun04 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 136767 95172 41595 30.4% All ASes AS6347 940 160 780 83.0% SAVV SAVVIS Communications Corporation AS4134 738 158 580 78.6% CHINANET-BACKBONE No.31,Jin-rong Street AS18566 708 169 539 76.1% CVAD Covad Communications AS4323 731 204 527 72.1% TWTC Time Warner Telecom AS7018 1420 985 435 30.6% ATTW AT&T WorldNet Services AS6197 709 321 388 54.7% BNS-14 BellSouth Network Solutions, Inc AS701 1297 932 365 28.1% UU UUNET Technologies, Inc. AS9583 464 105 359 77.4% SATYAMNET-AS Satyam Infoway Ltd., AS7843 499 142 357 71.5% ADELPH-13 Adelphia Corp. AS22909 390 33 357 91.5% CMCS Comcast Cable Communications, Inc. AS6198 566 232 334 59.0% BNS-14 BellSouth Network Solutions, Inc AS22773 378 58 320 84.7% CXAB Cox Communications Inc. Atlanta AS27364 360 44 316 87.8% ARMC Armstrong Cable Services AS1239 941 639 302 32.1% SPRN Sprint AS11172 351 56 295 84.0% Servicios Alestra S.A de C.V AS17676 339 50 289 85.3% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS9929 316 33 283 89.6% CNCNET-CN China Netcom Corp. AS4355 381 99 282 74.0% ERSD EARTHLINK, INC AS6140 390 129 261 66.9% IMPSA ImpSat AS6478 305 48 257 84.3% ATTW AT&T WorldNet Services AS1221 852 617 235 27.6% ASN-TELSTRA Telstra Pty Ltd AS209 737 503 234 31.8% QWEST-4 Qwest AS25844 243 16 227 93.4% SASMFL-2 Skadden, Arps, Slate, Meagher & Flom LLP AS14654 230 5 225 97.8% WAYPOR-3 Wayport AS3356 886 673 213 24.0% LEVEL3 Level 3 Communications AS4766 476 264 212 44.5% KIX Korea Internet Exchange for "96 World Internet Exposition AS9443 359 156 203 56.5% INTERNETPRIMUS-AS-AP Primus Telecommunications AS2386 430 233 197 45.8% ADCS-1 AT&T Data Communications Services AS5668 380 196 184 48.4% CIH-12 CenturyTel Internet Holdings, Inc. AS6327 208 28 180 86.5% SHAWC-2 Shaw Communications Inc. Total 17024 7288 9736 57.2% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 AHSICHCL Andara High Speed Internet c/o Halifax Cable Ltd. 24.246.0.0/17 AS7018 ATTW AT&T WorldNet Services 24.246.128.0/18 AS7018 ATTW AT&T WorldNet Services 64.46.4.0/22 AS11711 TULARO TULAROSA COMMUNICATIONS 64.46.12.0/24 AS7850 IHIGHW iHighway.net, Inc. 64.46.27.0/24 AS8674 NETNOD-IX Netnod Internet Exchange Sverige AB 64.46.34.0/24 AS3408 64.46.63.0/24 AS7850 IHIGHW iHighway.net, Inc. 66.114.0.0/19 AS16526 BIRCHT Birch Telecom, Inc. 69.26.32.0/19 AS17307 VIRTEL-15 Virtela Communications 132.0.0.0/10 AS568 DISOUN DISO-UNRRA 137.0.0.0/13 AS568 DISOUN DISO-UNRRA 138.136.0.0/13 AS568 DISOUN DISO-UNRRA 158.0.0.0/13 AS568 DISOUN DISO-UNRRA 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.30.127.0/24 AS719 LANLINK Elisa Oyj 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.43.230.0/24 AS4738 SAARDNET-AS South Australian Academic Research and Development Network 192.44.0.0/19 AS702 AS702 MCI EMEA 192.81.182.0/24 AS719 LANLINK Elisa Oyj 192.81.183.0/24 AS719 LANLINK Elisa Oyj 192.81.184.0/24 AS719 LANLINK Elisa Oyj 192.119.135.0/24 AS270 NASA National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS4004 GLOBALONE-EQUANT-UK Equant UK & Greece Autonomous System 192.135.50.0/24 AS7018 ATTW AT&T WorldNet Services 192.136.71.0/24 AS719 LANLINK Elisa Oyj 192.136.79.0/24 AS719 LANLINK Elisa Oyj 192.153.144.0/21 AS568 DISOUN DISO-UNRRA 192.172.0.0/19 AS568 DISOUN DISO-UNRRA 192.188.208.0/20 AS568 DISOUN DISO-UNRRA 192.243.32.0/23 AS2044 PALINA Palin Aquisitions Inc. 198.23.26.0/24 AS4390 BELLAT-7 Bell Atlantic, Inc. 198.97.72.0/21 AS568 DISOUN DISO-UNRRA 198.97.80.0/20 AS568 DISOUN DISO-UNRRA 198.97.88.0/24 AS89 NUSC-1 Naval Underwater Systems Center 198.97.192.0/20 AS568 DISOUN DISO-UNRRA 198.97.240.0/20 AS568 DISOUN DISO-UNRRA 198.97.247.0/24 AS3475 DEPART-52 Department of the Navy 198.101.4.0/22 AS568 DISOUN DISO-UNRRA 198.136.32.0/20 AS19329 MCBCC Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY CityNet, Inc. 198.161.87.0/24 AS6539 GTGR GT Group Telecom Services Corp. 198.161.165.0/24 AS852 AGTA Telus Advanced Communications 198.163.155.0/24 AS684 MRN Manitoba Regional Network 198.167.0.0/16 AS7456 INS-51 Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 UU UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASK SaskTel 198.232.133.0/24 AS23075 SKOTOS Skotos Tech, Inc 199.10.0.0/16 AS568 DISOUN DISO-UNRRA 199.60.0.0/20 AS271 UBC-3 University of British Columbia 199.84.0.0/16 AS701 UU UUNET Technologies, Inc. 199.114.0.0/18 AS568 DISOUN DISO-UNRRA 199.114.0.0/21 AS568 DISOUN DISO-UNRRA 199.114.128.0/18 AS568 DISOUN DISO-UNRRA 199.114.130.0/24 AS721 DNIC DoD Network Information Center 199.114.132.0/24 AS721 DNIC DoD Network Information Center 199.114.136.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.138.0/24 AS721 DNIC DoD Network Information Center 199.114.140.0/24 AS3544 DISAUN DISA/UNRRA 199.114.142.0/24 AS721 DNIC DoD Network Information Center 199.114.144.0/24 AS721 DNIC DoD Network Information Center 199.114.148.0/24 AS721 DNIC DoD Network Information Center 199.114.150.0/24 AS721 DNIC DoD Network Information Center 199.114.152.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.154.0/24 AS1733 ADP-41 AF DDN PMO 199.114.156.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.160.0/24 AS1733 ADP-41 AF DDN PMO 199.120.32.0/19 AS16582 NXLI NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS568 DISOUN DISO-UNRRA 199.123.0.0/18 AS568 DISOUN DISO-UNRRA 199.123.16.0/20 AS568 DISOUN DISO-UNRRA 199.123.80.0/21 AS568 DISOUN DISO-UNRRA 199.189.32.0/19 AS7332 IQUEST IQuest Internet 199.197.8.0/22 AS21814 PARSON-18 Parsons Corp. 199.202.0.0/16 AS701 UU UUNET Technologies, Inc. 202.2.64.0/20 AS9729 IS-AP iAdvantage Limited 202.47.1.0/24 AS7491 PI-PH-AS-AP PI-PHILIPINES 202.70.0.0/20 AS4658 NETFRONT-AS NETFRONT I.T. LIMITED (HONG KONG) 202.70.28.0/24 AS4515 ERX-STAR Star Internet Services Ltd. 202.73.128.0/22 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.86.142.0/24 AS30362 HAWAI-1 Hawaii-Pacific Teleport 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.123.96.0/20 AS9288 COMCEN-AS-AP Com-Cen Pty Ltd 202.133.3.0/24 AS9335 CIP-JAPAN-AS-AP ATT IPlus 202.141.160.0/24 AS9237 HUTCHCA-AS BTN Access Limited 202.141.190.0/24 AS10026 ANC Asia Netcom Corporation 202.141.191.0/24 AS4637 REACH Reach Network Border AS 202.164.224.0/19 AS7599 IPXC-AS-AP IP Exchange 203.32.4.0/23 AS7617 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.132.107.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 204.69.144.0/22 AS5668 CIH-12 CenturyTel Internet Holdings, Inc. 204.154.125.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBI Exobit Networks Inc. 205.150.0.0/15 AS701 UU UUNET Technologies, Inc. 205.159.72.0/24 AS1660 ANSCOM-5 ANS Communications 206.41.32.0/19 AS14824 NCC-105 NewSouth Communications Corp. 206.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 206.167.57.0/24 AS376 RISQR-3 Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 206.251.69.0/24 AS27429 TIL-33 Telesat International Ltd. 206.253.190.0/23 AS8123 POLYBA Polybase 207.231.96.0/19 AS11194 NUNETI NuNet Inc 208.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 209.169.219.0/24 AS189 GNTY Genuity 209.169.223.0/24 AS189 GNTY Genuity 209.172.0.0/18 AS7770 TRTI Triton Technologies, Inc. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.213.32.0/19 AS10629 INS-52 Inter-Pacific Network Services 209.213.50.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.51.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.55.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.56.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.222.137.0/24 AS27429 TIL-33 Telesat International Ltd. 209.251.0.0/19 AS11036 SISCOM-1 SISCOM, Inc 216.18.224.0/21 AS11458 IMBRIS-1 IMBRIS, INC. 216.18.224.0/22 AS11458 IMBRIS-1 IMBRIS, INC. 216.18.228.0/22 AS11458 IMBRIS-1 IMBRIS, INC. 216.96.128.0/18 AS7018 ATTW AT&T WorldNet Services 216.145.130.0/24 AS11937 TRXI TRX Inc. 216.145.132.0/24 AS11937 TRXI TRX Inc. 216.145.133.0/24 AS11937 TRXI TRX Inc. 216.145.134.0/24 AS11937 TRXI TRX Inc. 216.145.135.0/24 AS11937 TRXI TRX Inc. 216.145.152.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.156.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.158.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.176.0/21 AS20304 JIS-32 JVLNET Internet Services 216.145.177.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.178.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.184.0/21 AS10758 INWAVE INWave Internet, Inc 216.145.200.0/21 AS20304 JIS-32 JVLNET Internet Services 216.186.151.0/24 AS3356 LEVEL3 Level 3 Communications 216.186.152.0/21 AS3356 LEVEL3 Level 3 Communications 216.186.160.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.164.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.192.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.198.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.248.0/23 AS3356 LEVEL3 Level 3 Communications Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org swinog(a)swinog.ch

3 2

Real-Time Mitigation of Denial of Service Attacks Now Available With AT&T
by John Obi 04 Jun '04

04 Jun '04

Hello folks, Here is a great move from one of the biggest NSPs, I'm sure we will see L3, Sprint, UUNet and others will do the same soon to gain more customers since DDoS is the nightmare of the internet now. http://biz.yahoo.com/prnews/040601/nytu051a_1.html Thanks, -J __________________________________ Do you Yahoo!? Friends. Fun. Try the all-new Yahoo! Messenger. http://messenger.yahoo.com/

22 30

RE: Real-Time Mitigation of Denial of Service Attacks Now Available With AT&T
by Michel Py 04 Jun '04

04 Jun '04

Woulda, shoulda. If it is so simple, how come not everyone does it? -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Patrick W.Gilmore Sent: Wednesday, June 02, 2004 9:17 AM To: nanog(a)merit.edu Cc: Patrick W.Gilmore Subject: Re: Real-Time Mitigation of Denial of Service Attacks Now Available With AT&T On Jun 2, 2004, at 11:35 AM, Michel Py wrote: >> Jon R. Kibler wrote: >> IMHO, there is absolutely no excuse for not doing ingress and >> egress filtering. In fact, if you are an ISP, I would argue >> that you are negligent in your fiduciary responsibilities to >> your customers and shareholders if you are not filtering >> source IP addresses. > > Hey, I'm all for it. Where's the money and the staff? The money is from your customers, and the staff is your staff. This scales nicely as the number of customers you have, and therefore your money and staff, is directly related to the effort you have to put into the system. The Internet is a collective. The whole thing does not work if everyone does not help to keep the whole, well, whole. If DDoS gets out of hand, if BGP churn is too high, if spam gets out of hand, if, if, if. Of course, if everyone filtered ISPs who did not validate the source IPs of packets originating in their network the way some networks filter spam sources, the problem would likely correct itself quickly. The problem is figuring out which providers do not validate source addresses since, by definition, the problem we are discussing are spoofed source addresses.... =) -- TTFN, patrick

6 5

RE: Real-Time Mitigation of Denial of Service Attacks Now Available With AT&T
by Krichbaum, Eric 04 Jun '04

04 Jun '04

Because there are legitimate reasons for async routing. DirectPC/Isat/etc. (Satelite based services) come to mind immediately. Customers dial-up to an ISP and downstream traffic returns via the sat connection. Reverse-path immediately disables every one of these customers. Qwest deployed this on us with no notice and killed off thousands of customers in one fell swoop. Although I agree with the principal, the implentation needs more thought than a simple 'turn it on for 100%'. Eric Krichbaum -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Alexei Roudnev Sent: Thursday, June 03, 2004 1:40 AM To: Jon R. Kibler; nanog(a)merit.edu Subject: Re: Real-Time Mitigation of Denial of Service Attacks Now Available With AT&T You even do not need to maintain ACL - many routers have 'back-path verification' feature. I wonder, why DSL and other 'consumer level' providers are not doing it for 100% of their customers. ----- Original Message ----- From: "Jon R. Kibler" <Jon.Kibler(a)aset.com> To: <nanog(a)merit.edu> Sent: Wednesday, June 02, 2004 8:25 AM Subject: Re: Real-Time Mitigation of Denial of Service Attacks Now Available With AT&T > John Obi wrote: > > ... since DDoS is the > > nightmare of the internet now. > > > > The sad fact is that simple ingress and egress filtering would > eliminate the majority of bogus traffic on the Internet -- including > (D)DoS attacks. If all ISPs would simply drop all outbound packets > whose source address is not a valid IP for the subnet of origin, > and all inbound packets that do not have valid source IP addresses, > the DDoS problem would be (for all intents and purposes) fixed. If > proper filtering was done, then any DoS attacks would have to have > either valid source IP addresses, or IP addresses that spoofed IPs > within their network of origin. In either case, identifying and > shutting down the attackers would become a greatly simplified task > compared to the mess it is today. > > Why no filtering by ISPs? "Because it takes resources and only benefits > the other guy" -- unless your network is the one under attack. > > Maintenance of the ACLs should not be the issue. A single ACL for each > subnet would be all that would be required for egress filtering. About > 30 ACLs on an inbound border router would be required for ingress > filtering. Keeping the ingress ACLs current is a brain-dead task -- just > subscribe to the bogon mailing list at cymru.com. > > ACLs have had a bad reputation for greatly slowing down routers. That > may have been true in the past, but properly written ACLs do not seem > to have a significant impact on most new routers. Yes, they may cut > peak through-put a few percent -- but if you are running that close to > the edge, it is time to upgrade anyway. > > IMHO, there is absolutely no excuse for not doing ingress and egress > filtering. In fact, if you are an ISP, I would argue that you are > negligent in your fiduciary responsibilities to your customers and > shareholders if you are not filtering source IP addresses. > > Fancy solutions may make great marketing, but simple proper router > filtering is a very workable lower-cost solution. > > (Step down from soap box.) At least, that's my $0.02 worth. > > Jon Kibler > -- > Jon R. Kibler > Chief Technical Officer > A.S.E.T., Inc. > Charleston, SC USA > (843) 849-8214 > > > > > ================================================== > Filtered by: TRUSTEM.COM's Email Filtering Service > http://www.trustem.com/ > No Spam. No Viruses. Just Good Clean Email. > >

2 1

Need (temporary) bandwidth in NYC/Lower Manhattan, ASAP.
by chuck goolsbee 03 Jun '04

03 Jun '04

We have a large client who is moving into a new office space on Broadway in lower Manhattan *this weekend* and they just learned their DS1 (provided by Verizon, IP by UUnet) has been pushed back to July 2nd. The space is at 39 Broadway, NYC, 10006, 18th floor. NPA-NXX is 212-785 Can anybody here deliver a megabit or so bandwidth to that location? 802.11, DSL, whatever... BY MONDAY??? If so, please contact me ASAP, off-list. BTW: This client came to us under very similar circumstances (as a colo) and has been with us ever since. Great folks. Regards, -- Chuck Goolsbee V.P. Technical Operations _________________________________________________________________ digital.forest Phone: +1-877-720-0483, x2001 where Internet solutions grow Int'l: +1-425-483-0483 19515 North Creek Parkway Fax: +1-425-482-6871 Suite 208 http://www.forest.net Bothell, WA 98011 email: cg(a)forest.net

1 1

RE: Real-Time Mitigation of Denial of Service Attacks Now Available With AT&T
by Krichbaum, Eric 03 Jun '04

03 Jun '04

They went to a loose configuration to get the Isat (most of our sat users) back to an operational state. The Isat vendor is now testing a tunneled version. Eric Krichbaum, Chief Engineer MCSE: NT4, 2000, 2003, MCSE: Messaging, MCSE: Security, MCP+I, MCDBA, MCSD.Net, ASE, CCNP, CCDP, CCSP, CCIP, ISSP, CNA, A+, Net+, iNet+, Security+, Server+, Linux+, CQS-VPN Specialist, CQS- Firewall Specialist, CQS- IDS Specialist, CQS-Wireless Design, CQS-Wireless Support, CQS-IP Telephony, etc. -----Original Message----- From: Daniel Senie [mailto:dts@senie.com] Sent: Thursday, June 03, 2004 9:20 AM To: Krichbaum, Eric; nanog(a)merit.edu Subject: RE: Real-Time Mitigation of Denial of Service Attacks Now Available With AT&T At 08:04 AM 6/3/2004, Krichbaum, Eric wrote: >Because there are legitimate reasons for async routing. >DirectPC/Isat/etc. (Satelite based services) come to mind immediately. DirecPC has had satellite return path for a long time. Their older systems with dialup/cable for upstream involved loading of software into your PC. That software could EASILY have encapsulated the upstream packets into UDP packets so that their upstream packets were valid. >Customers dial-up to an ISP and downstream traffic returns via the sat >connection. Reverse-path immediately disables every one of these >customers. Qwest deployed this on us with no notice and killed off >thousands of customers in one fell swoop. > >Although I agree with the principal, the implentation needs more >thought than a simple 'turn it on for 100%'. The documents leading up to BCP38 began in 1996. This didn't just happen out of the blue. Some assumptions made by more than one group that routing decisions would forever be made based on destination IP address only. One of these was mobile IP, and that WG worked on an alternative as soon as the ingress filtering draft started gaining momentum. Tunnels are a good answer where legitimate traffic has to flow in a way that does not match the addressing topology. Having this dropped on you by Qwest without warning was a bad thing. I wonder if you asked them to temporarily undo it while while you worked with the vendor (Hughes in this case) to implement tunneling of the return traffic? >-----Original Message----- >From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of >Alexei Roudnev >Sent: Thursday, June 03, 2004 1:40 AM >To: Jon R. Kibler; nanog(a)merit.edu >Subject: Re: Real-Time Mitigation of Denial of Service Attacks Now >Available With AT&T > > >You even do not need to maintain ACL - many routers have 'back-path >verification' feature. >I wonder, why DSL and other 'consumer level' providers are not doing it >for 100% of their customers. > > >----- Original Message ----- >From: "Jon R. Kibler" <Jon.Kibler(a)aset.com> >To: <nanog(a)merit.edu> >Sent: Wednesday, June 02, 2004 8:25 AM >Subject: Re: Real-Time Mitigation of Denial of Service Attacks Now >Available With AT&T > > > > John Obi wrote: > > > ... since DDoS is the > > > nightmare of the internet now. > > > > > > > The sad fact is that simple ingress and egress filtering would > > eliminate the majority of bogus traffic on the Internet -- including > > (D)DoS attacks. If all ISPs would simply drop all outbound packets > > whose source address is not a valid IP for the subnet of origin, and > > all inbound packets that do not have valid source IP addresses, the > > DDoS problem would be (for all intents and purposes) fixed. If > > proper filtering was done, then any DoS attacks would have to have > > either valid source IP addresses, or IP addresses that spoofed IPs > > within their network of origin. In either case, identifying and > > shutting down the attackers would become a greatly simplified task > > compared to the mess it is today. > > > > Why no filtering by ISPs? "Because it takes resources and only >benefits > > the other guy" -- unless your network is the one under attack. > > > > Maintenance of the ACLs should not be the issue. A single ACL for > > each subnet would be all that would be required for egress > > filtering. About 30 ACLs on an inbound border router would be > > required for ingress filtering. Keeping the ingress ACLs current is > > a brain-dead task -- >just > > subscribe to the bogon mailing list at cymru.com. > > > > ACLs have had a bad reputation for greatly slowing down routers. > > That may have been true in the past, but properly written ACLs do > > not seem to have a significant impact on most new routers. Yes, they > > may cut peak through-put a few percent -- but if you are running > > that close to the edge, it is time to upgrade anyway. > > > > IMHO, there is absolutely no excuse for not doing ingress and egress > > filtering. In fact, if you are an ISP, I would argue that you are > > negligent in your fiduciary responsibilities to your customers and > > shareholders if you are not filtering source IP addresses. > > > > Fancy solutions may make great marketing, but simple proper router > > filtering is a very workable lower-cost solution. > > > > (Step down from soap box.) At least, that's my $0.02 worth. > > > > Jon Kibler > > -- > > Jon R. Kibler > > Chief Technical Officer > > A.S.E.T., Inc. > > Charleston, SC USA > > (843) 849-8214 > > > > > > > > > > ================================================== > > Filtered by: TRUSTEM.COM's Email Filtering Service > > http://www.trustem.com/ No Spam. No Viruses. Just Good Clean Email. > > > >

2 1