- Test - lists.nanog.org

NANOG36-NOTES 2006.02.14 talk 4 Flooding via routing loops
by Matthew Petach 14 Feb '06

14 Feb '06

2006.02.14 talk 4 Flooding attacks Jianhong Xia A new talk added right before lunch by Randy Bush will push us to 12:25. Two talks coming up about DoS attacks against control information Flooding Attacks by exploiting persistent forwarding loops. Introduction: routing determines forwarding path. Transient forwarding loops happen all the time during convergence; that's normal. But this focuses on persistent fowarding loops. why would persistent loops exist? Example on neglecting pull-up routes. Router announces 18.0/16 to internet router A has default pointing to B router A uses 18.0.0/24 only Any traffic to 18.0.1.0-18.0.255.255 will enter the forwarding loop between A and B Risk of persistent forwarding loops can amplify based on ttl of packets injected into the looping pair of routers. Can create a denial of service by flooding the upstream links between routers in front of host they want to knock off. any other hosts behind that link are "imperiled addresses" Measurement Design: balancing granularity and overhead samples 2 addresses in each /24 IP block Addresses space collection addresses covered by RouteView table de-aggregate prefixes into /24 prefixes fine-grained prefixes data traces traceroute to 5.5 million fine-grained prefixes measurement lasts for 3 weeks in sept 2005 Almost 2.5% of routable addresses have persistent forwarding loops Almost .8% of routable addresses are imperiled addresses. Validating these persistent forwarding loops from multiple places from asia, europe, west and east cost of US 90% of shadowed prefixes consistently have persistent forwading loops Validation to multiple addresses in shadowed prefixes sampling 50 addresses in each shadowed prefix 68% of shadowed prefixes shows that... Properties of the loops How long are the loops? 86.6% of loops are 2 hops long 0.4% are more than 10 hops long some are more than 15 hops location 82.2% of persistent loops happen within destination domain implications significantly amplify attacking traffic can be exploited from different places. (oops. Matt gets paged out to deal with issue, so no more notes for a while).

1 0

NANOG36-NOTES 2006.02.14 talk 3 Flamingo Netflow Visualization Tool
by Matthew Petach 14 Feb '06

14 Feb '06

2006.02.14 talk 3 Flamingo netflow visualization Manish (from BGP Inspect project from Merit) bgpinspect.merit.edu:8080 He'll be talking later at the Tools BOF as well apparently. Introduction: What is Flamingo? Visualization The Flamingo Tool combining visualizations with controls Case Studies traffic anomaly network scans worm traffic P2P traffic the slashdot effect. The tool has been under development for a year; John, in audience, and Mike (now employed) have been working on it as undergrads. It's just a view into netflow, no filters or adjustment of data it's just a visualization system. client/server architecture a single server can support multiple clients Visualation methods 5 different views extended quad tree implementation volume by src/dst IP prefix volume by src/dst AS Basic quad tree represent 32bit IP address into fixed space. 4 areas representable by 2 bits. Keep splitting 16 times, you represent 32 bit address in 2D mapping. convert it into 3 dimension, have an axis of freedom to represent additional info. So one side is the quad tree, the Z axis is volume of traffic, so you can see relative volumes. nice slide showing visualization of the traffic flow patterns. Can show traffic flows aggregated by src/dst IP; now there's 2 surfaces needed on the cube, so they use line thickness between the surfaces to show flow sizes between ASes. last visualization incorporates port info as well But since there's only one axis left; so now port level info is on z axis. so IP/port is X1Y1Z1; same for dest IP and port. Once there are coordinates, the line can be drawn, scale the width based on the volume, and now you have the full info in one view. Same colour used to represent traffic from the same source ntuple. combine 2D and 3D representation of data to help keep yourself oriented. They have text representatiosn of information, same as visual data, but in text form. Slider bars allow thresholding of what gets displayed, to prevent clutter; only over a certain size, or only certain ports, etc. Can also apply labels to help pull information out for fast refrence. You can also restrict the address space you care about to only look at certain subnets. Case study: Traffic anomaly sunday Oct 16, 2005 large burst of traffic from one host at umich, lasted 6 hours, four targets, not widely distributed, it was UDP traffic. Was visible in normal view. from 12pm to 6pm. visible on main view, zoomed in, and the 4 million flows show as a huge block. going to src/dest view lets you see where the traffic is going. adding the port info, and you see the entire port space is being sprayed. Another case study--worm traffic doing port 42 scans a fan view on the graph, highly visible. An artificial case study, a host scanning a /24 subnet SSH scans also show up as many many ports probing a single port; a reverse fan. Slashdot effect on campus Oct 31 2004; have before and during pictures showing the huge traffic swing. Zotob worm infection; random destination IPs, but same port, coming from same host, cone effect. P2P traffic; single host with multiple connections to different destinations, significant volume to each. Darkspace traffic visualizations show nothing but scans, show up really dramatically. Conclusion The Flamingo Visualization Tool provides users with the ability to easily explore and extract meaning information regarding traffic flows in their network. More will be discussed at the Tools BOF this afternoon. http://flamingo.merit.edu/ Break now, come back at 10:50. Someone left a jacket at the Yahoo party with a digital camera; describe it to the registration desk to get it back.

1 0

NANOG36-NOTES 2006.02.14 talk 1 IRR power tools
by Matthew Petach 14 Feb '06

14 Feb '06

Apologies in advance, notes from this morning will be a bit more scattered, as I was working on an issue in parallel to taking notes. Matt 2006.02.14 talk 1 IRR Power Tools 12:10 to 12:25, extra talk added, not on printed agenda. Thanks to those who submitted lightning talks. PC committee members are doing moderation, Todd Underwood will be handling the first session this morning. There will be 3 talks about tools for operators 1 IRR and 2 Netflow tools. Be thinking of interesting questions to ask. Todd has to introduce RAS at 9am, 7am west coast time which is normally his bedtime. IRR power tools, Dec 2004 first generation re-write. IRR--a quick review People have been asking him "why do we need the IRR?" Any time you have a protocol like BGP that can propagate information, you need some form of filtering in place to limit damage. IRRs are databases for storing lists of customer information. Written to speak RPSL some speak RPSLng. RADB ALTDB VERIO, LEVEL3, SAVVIS RIR-run databases: ARIN, RIPE, APNIC, etc. IRRs better than manual filtering. huge list on the slides. Filtering is needed, and hard to keep updated by hand. Why doesn't everyone use IRR? Many people do In Europe, pretty much total support in Europe; it's required by RIPE, providers won't deal with you if you don't keep your entries up, large exchanges likewise check. Few major networks in US use IRR too: NTT/Verio Level3 Savvis Most people don't. Why doesn't everyone use it? In US, it's too complex for customers. support costs go up if you have to teach customers. Networks don't like to list their customers in a public database that can be mined by competitors RAS figured he could fix at least one piece Wrote a tool to help with: automatic retrieval of prefixes behind an IRR object automatic filtering of bogon or other undesirable routes Automatic aggregation of prefixes to reduce config size Tracking and long-term recording of prefix changes Emails the customer and ISP with prefix changes Exports the change data to plain-text format for easy interaction with non-IRR enabled networks Generates router configs for easy deployments. Doesn't do import/export policies, doesn't do filter-sets, rtr-set, peering-set, etc. Just focuses on essential portions. Tool was written around IRRToolSet initially, but the C++ code didn't compile nicely. This isn't a complete replacement for IRRToolSet, but provides the basic functionality A few conf files: IRRDB.CONF EXCLUSIONS.CONF NAG.CONF ./irrpt_fetch grabs the current database info It also speaks clear english on add/remove of prefixes for access lists; default format is english, but you can change it to diff format. ./irrpt_pfxgen ASNUM generates a prefix list suitable for the customer interface. Can use -f juniper to create juniper filters. http://irrpt.sourceforge.net/ Always looking for more feedback; it's been deployed by a few people in the peering community; this will be its first widescale announcement. Future plans: Add support for IPv6/RPSLng needs IPv6 aggregation tools RADB tool uses a faster protocol, RIPE just breaks down one level; you have to do multiple iterations to get the full expansion. Servers tend to time out before you can get all the answer; RIPE servers have hard 3 minute timeout that closes the socket. Add SQL database support for a backend Convert from a script to a real application IRRWeb -- http://www.irrweb.com/ He'll talk about irrweb at next nanog. Allow end users to register routes without needing to know ANYTHING about RPSL You can play with it, register routes, but it doesn't publish anywhere. That's it--happy valentine's day! Richard A Steenbergen ras at nlayer.net Susan notes that RADB is developed by Merit, the two primary developers are here today Chris Fraiser, main cust interface now Larry Blunk is RPSLng person, also here today. Right now, no mirroring between IRRs, you have to mesh with everyone else when a new IRR comes up. RADB at least does pick up from the others, so right now RADB is the best spot to do your queries against. Todd asks about filters; does it do prefix list only, or prefix list plus as-path? It builds off as's behind other as's, which might not be the best model; latest code is starting to understand as-sets. To do it properly, you might need import/export policy support. Randy Bush, IIJ. Like IPv6, this meeting marks the tenth anniversary of Randy pushing for IRR adoption. And like IPv6, adoption rate has not been going well. What's wrong? Pretty much too complex, which is why this effort is to make it much simpler, to try to get more uptake in the US. Todd notes that 2 things; 1, tools are too difficult; this addresses that. second piece is that in US, allocations aren't tied to registry entry creation; this won't solve that part at all. For the second part, the benefits are seen mostly the closer you are to the registration process. Anyone can register any block; and if you don't use AS123:, people can register anything in your block, whether you want them to or not. Randy notes that they're trying to tweak allocation policy on something that nobody wants; he thinks this might approaching the issue at the wrong end. There's no push for it, so better tools doesn't necessarily help; and the data in the database are poor, so what of the data can really be trusted? Randy feels that certification path for allocation is more needed to formally track and make the data correct and verifiable, so no stale/bogus data can enter the database. Richard will talk at tools BOF this afternoon, and Andrew Dole, Boeing. ARIN region policy, modify ORG template, add ASN entry into registry entry to link AS to prefix in the registry. Could be a useful database that could be used to cross-verify the RADB data. Discuss on ppml list, if you think it needs more, or should be mandatory, etc. RAS notes it would take a communication protocol between RIRs to make it widespread. Sandy Murphy, Sparta. She submitted the policy to the ppml list. There is a security language for RPSLng--with the tools being submitted, is there plans to support those security specifications? You have to have authorization of prefix holder and AS holder before you can create the route entry in RIPE, for example. RAS's goal is to just try to bring US up to level of rest of the world. Need to tie registration of prefix to authority to put entries in routing registry. IRRs are chock full of old stale data, and no way to remove it.

1 0

Re: Fed Bill Would Restrict Web Server Logs
by Gregory Hicks 14 Feb '06

14 Feb '06

> Date: Tue, 14 Feb 2006 09:47:50 -0500 > From: "Jon R. Kibler" <Jon.Kibler(a)aset.com> > > > Date: Thu, 09 Feb 2006 00:14:23 -0800 > > From: Declan McCullagh <declan(a)well.com> > > > > I've posted the text here: > > http://www.politechbot.com/docs/markey.data.deletion.bill.020806.pdf > > > > A summary is here: > > http://news.com.com/2100-1028_3-6036951.html > > "A bill just announced in Congress would require every Web site operator > > to delete information about visitors, including e-mail addresses, if the > > data is no longer required for a "legitimate" business purpose. > > > > An open question is whether Rep. Ed Markey's bill would require that > > Internet addresses be deleted by default from Apache and other web > > server logs. One reading is that it would be. But it's not clear whether > > an IP address falls under the definition of personal information. > > > > This bill applies to anyone running a web site, including individuals > > and bloggers. So it's not just companies that have to worry. > > > > Original posting from Declan McCullagh's PoliTech mailing list. > Thought NANOGers would be interested since, if this bill passes, it > would impact almost all of us. Just imagine the impact on security of > not being able to login IP address and referring page of all web > server connections! Jon: The proposed bill states to delete when data is no longer required for "legitimate" business purposes. If you business model requires that you keep the logs for some "tracking" function, then keep them. As long as the logs are required for business purposes. Once the business purpose finishes, then delete them. How is this different that the way we operate now? Except that, if the bill passes, then - possible/probably - our "privacy policy" (such as they are) will have to state the business purposes... IANAL, but my $0.002 worth. Regards, Gregory Hicks ------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer Cadence Design Systems | Direct: 408.576.3609 555 River Oaks Pkwy M/S 6B1 San Jose, CA 95134 I am perfectly capable of learning from my mistakes. I will surely learn a great deal today. "A democracy is a sheep and two wolves deciding on what to have for lunch. Freedom is a well armed sheep contesting the results of the decision." - Benjamin Franklin "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

1 0

RE: Fed Bill Would Restrict Web Server Logs
by David Hubbard 14 Feb '06

14 Feb '06

From: Andy Davidson > > > Speaking with my e-commerce vendor hat on, server logs (apache, mail, > application audit logs) and other information about visitors > (especially those who have conducted a purchase transaction with > us, or signed up to our newsletter) never stop having a business > purpose - it's called referential integrity. > > We want to use them to track the behaviour fraudulent users > for example. Anyone who runs mailing lists has to keep that info to be able to prove how and when someone opted in. David

2 1

Re: Interesting paper by Steve Bellovin - Worm propagation in a v6 internet
by Suresh Ramasubramanian 14 Feb '06

14 Feb '06

On 2/14/06, Mohacsi Janos <mohacsi(a)niif.hu> wrote: > In the 6NET project we identified, that exhaustive search in IPv6 is not > feasible (e.g. nmap does not support it for IPv6), but there are also Interesting. By the way is there a "currently" missing between "not" and "feasible" there? Even given the sheer size of v6 space some of the other traits noted by SMB - like the tendency of network equipment to be clustered in the first few bits of a /48, and possibly observing new v6 netblocks get announced and routed might be used by someone to make intelligent guesses. And nmap can probably be hacked into doing that kind of scanning. After all when there's an unlimited number of hosts connected to the v6 network, all that needs to happen is a small botnet to develop, and then start to port scan. The potentially larger number of hosts that can get infected will probably help do an exhaustive search for you, so that v6 botnets start small and then grow exponentially in size over time. I rather suspect that the portscanning will grow to keep pace with the actual number of v6 connected hosts. -- Suresh Ramasubramanian (ops.lists(a)gmail.com)

2 1

ISP filter policies
by Ricardo V. Oliveira 14 Feb '06

14 Feb '06

Hi, i would like to know where i can get info about ISP filter policies, namely use of community values? Is there any page other than: http://www.nanog.org/filter.html (lots of broken links)? Thanks! --Ricardo

2 1

NANOG36 wireless issue
by Steve Feldman 14 Feb '06

14 Feb '06

Sorry to annoy those of you not here in Dallas, but I'm told that we have an dead access point in the main ballroom, which is causing congestion on its neighbor as everyone reassociates. Merit will replace the dead unit during the lunch break. Steve

3 3

[NANOG] Cogent problem in NYC area
by Lyons, Myke 14 Feb '06

14 Feb '06

Cogent is having problems in the NYC area, they have said they are waiting for equipment to come back up. This has been going on for about 30 minutes now. They would not give me any more details than this. Regards, .myke

1 0

ASNumber Extension for Firefox available
by Andre Oppermann 14 Feb '06

14 Feb '06

We've written a Firefox Extension that displays the AS Number of every website visited along with some additional interesting information. All data is updated daily and the prefix to AS number mapping is from a DFZ BGP feed. You can download the extension here (a screenshot is available too): http://www.asnumber.networx.ch If you have any feedback, comments or feature requests please contact me either directly or at <asnumber at networx.ch>. We are working on providing a lot more information on the RIR IP address delegations but need fully access to all RIR's whois records for that. I've completed all paperwork last week and we should receive full access in the near future. Another thing I want to do is to show the number of RBL (Spamhaus, etc) listed IPs per AS. Contacting those RBLs is rather difficult and any help to discuss this directly with the RBL administrators is appreciated. Another request: So far we've got data servers in Europe and USA but none in Asia-Pacific. If you are able to host either a dedicated or shared (vmware/xen) FreeBSD server in Japan or South Korea with excellent inter-Asia connectivity please contact me directly. BGP Experts, Traffic & Network Engineering Gurus -- Andre Oppermann Internet Business Solutions AG Hardstrasse 235 8005 Zürich Switzerland Fon +41 44 277 75 75 Fax +41 44 277 75 77 Web www.networx.ch

6 8