- Test - lists.nanog.org

RE: Provider-based DDoS Protection Services
by Chris Ranch 29 Jul '05

29 Jul '05

Perhaps you could improve your site's survivability by colocating or otherwise hosting it. That is, take the T1's out of the picture... The economics of DDoS mitigation may change in your favor too. Changing our policy to not support irc is one of the best things we did. I've always felt DDoS defense is just part of providing a good network to my customers. Chris Florian Weimer: > > * John Neiberger: > > > Protect thyself how? For DDoS protection to work, the nasty traffic > > must be stopped before it gets to my access circuits. Once it gets > > close enough for me to do anything about it directly it's too late. > > It depends. Quite a few DoS attacks are not based on > bandwidth saturation or network device overload. On the > other hand, if you address the easy ones within your own > network, the attackers might switch to types which you can't > deal with on your own. 8-( > > Anyway, you should examine *why* you (or your customers) are > attacked, and address that. Everything else is likely > cost-effective. Of course, this might mean you have to do > without some revenue if you have customers that are DoS > magnets for some reason. >

1 0

Re: Provider-based DDoS Protection Services
by Fergie (Paul Ferguson) 29 Jul '05

29 Jul '05

They're all lying... or telling the truth. Dependent upon their _own_ business models. I'd say: protect thy self. - ferg -- John Neiberger <jneiberger(a)gmail.com> wrote: I've been talking to various providers about their DDoS detection and mitigation services and I'd like to get some opinions about what I'm hearing. One provider prices their product based on how much traffic you will need to mitigate during an attack. The sales engineers say that most DDoS attacks are in the 2-3 Gbps range so, of course, they recommend that you pay for that much protection at great cost. Another provider (using the exact same hardware and software) costs about half as much per month. Yet another provider (again, using exactly the same hardware and software) has much more flexible pricing that is far more attractive, but that's because their engineers state that DDoS attacks are usually sized to match the size of the network they're attacking. For example, according to this sales engineer, attackers usually won't launch a 3 Gbps attack on someone who only has a handful of T1 circuits. So, this provider's pricing looks much more attractive to end-users who have smaller circuit size requirements. If you have a single T1, for example, you could buy 50 Mbps of protection and they say that's enough. What do you think? Is the first vendor closer to telling the truth, or is the third vendor? Or, is there really just no way of knowing ahead of time so you might as well pay for the most protection you can afford? Thanks, John -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

5 6

janog
by Randy Bush 29 Jul '05

29 Jul '05

janog/fukuoka is in the last day of two day meeting. 330+ attending despite being quite far from networking centers of japan. general impressions o food much better than nanog, much better o but no snacks at breaks o program all ops/tech, no gl!tz, no vendor or what wonderful things are coming that i can tell o much emphasis on running safe services, peering, routing, etc. even one on datacenter design for earthquakes o truth about how-we-do-it as opposed to trying to look good (talks can even be "do not take notes or report what i am saying beyond this meeting) see <http://www.janog.gr.jp/meeting/janog16/> for official page see <http://rip.psg.com/~randy/050729.janog/> to see how much it looks like a nanog randy

2 1

Re: Provider-based DDoS Protection Services
by Fergie (Paul Ferguson) 29 Jul '05

29 Jul '05

John, Contrary to popular belief, I (not alone, of course) run, manage, defend, and continually architect very large networks. Very large. On none of them do we outsource the protection of them -- because, in cases where we have extended trust in the past, we have been screwed (PC translation: disappointed). So we protect ourselves. It's been a business decision for my customers' networks (ie. their network) not to outsource security, or rely on an upstreampipedream, for protection of any sort. Thus, I personally can't provide any insight here. Sorry. - ferg -- John Neiberger <jneiberger(a)gmail.com> wrote: In this case it's a business decision. I understand that we could simply weigh the costs of an attack with the costs of preemptively detecting and mitigating an attack, but in our case we won't lose hard dollars like an ecommerce site would. We have different reasons for wanting to have some protection in place before we need it. I look at it like it's an insurance policy, but I don't want to be ripped off. It's like I'm getting estimates on building a protective dike around my house. One contractor tells me that the floodwaters commonly reach six feet so I should pay him $12,000 to build a wall at least that high. Another contractor is telling me that he'll build a six-foot wall for $6,000. Another contractor is telling me that the floodwaters most likely won't go over two feet and he suggests that I pay him $1,000 for a three-foot-high wall. If it turns out that we really do need a six-foot-high wall then so be it. I'm not the one who pays the bills so it isn't really my decision. I just want to make sure I have a clearer picture of reality before I make any suggestions to my boss. Thanks again, John On 7/28/05, Fergie (Paul Ferguson) <fergdawg(a)netzero.net> wrote: > I should've asked the most important question first -- is this > a technical decision, or a business decision? I mean, forgive me > for pointing out the obvious, but you made an issue of cost in your > original post... > > - ferg > -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

7 9

Re: Provider-based DDoS Protection Services
by Fergie (Paul Ferguson) 29 Jul '05

29 Jul '05

As I said, previously, I'm afraid I can't be much help here. There are methods to protect oneself whether you are a home user, an SMB, or a lerge-ish entity... If it comes to down to business decisons, then do whatever business dictates. But me -- I'm an engineer/instigator. ;-) - ferg -- James Feger <jfeger(a)feger.net> wrote: On Fri, 29 Jul 2005, Fergie (Paul Ferguson) wrote: > > John, > > Contrary to popular belief, I (not alone, of course) run, > manage, defend, and continually architect very large > networks. Very large. On none of them do we outsource > the protection of them -- because, in cases where we > have extended trust in the past, we have been screwed > (PC translation: disappointed). > > So we protect ourselves. > > It's been a business decision for my customers' networks > (ie. their network) not to outsource security, or rely on > an upstreampipedream, for protection of any sort. > > Thus, I personally can't provide any insight here. Sorry. > > - ferg > Ferg, Not everyone is in a position to have anetwork large enough to be "self-defending". I think he has clearly stated they are not in a position from a capacity standpoint to self-defend. If he has a few sites with some T1's or DS3's or whatever, his goal is to not stop the traffic at his router, but not ever allow the traffic onto his pipe. I too have been involved in large, very large, networks and we used to see it happen everyday. Customers with OC12's getting smoked off the planet because of some kiddie made someone else mad in IRC. If the upstream offers a "value add" service such as DoS protection, why balk at it? -j -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: Provider-based DDoS Protection Services
by Fergie (Paul Ferguson) 29 Jul '05

29 Jul '05

I should've asked the most important question first -- is this a technical decision, or a business decision? I mean, forgive me for pointing out the obvious, but you made an issue of cost in your original post... - ferg -- John Neiberger <jneiberger(a)gmail.com> wrote: Protect thyself how? For DDoS protection to work, the nasty traffic must be stopped before it gets to my access circuits. Once it gets close enough for me to do anything about it directly it's too late. The problem is that I don't know enough about DDoS traffic patterns to make an accurate assessment of these statements, which is why I asked the question here. I'll be doing other research on my own, of course, but I thought I'd check here first. Many thanks, John On 7/28/05, Fergie (Paul Ferguson) <fergdawg(a)netzero.net> wrote: > They're all lying... or telling the truth. > > Dependent upon their _own_ business models. > > I'd say: protect thy self. > > - ferg > > > > -- John Neiberger <jneiberger(a)gmail.com> wrote: > > I've been talking to various providers about their DDoS detection and > mitigation services and I'd like to get some opinions about what I'm > hearing. > > One provider prices their product based on how much traffic you will > need to mitigate during an attack. The sales engineers say that most > DDoS attacks are in the 2-3 Gbps range so, of course, they recommend > that you pay for that much protection at great cost. > > Another provider (using the exact same hardware and software) costs > about half as much per month. > > Yet another provider (again, using exactly the same hardware and > software) has much more flexible pricing that is far more attractive, > but that's because their engineers state that DDoS attacks are usually > sized to match the size of the network they're attacking. For example, > according to this sales engineer, attackers usually won't launch a 3 > Gbps attack on someone who only has a handful of T1 circuits. So, this > provider's pricing looks much more attractive to end-users who have > smaller circuit size requirements. If you have a single T1, for > example, you could buy 50 Mbps of protection and they say that's > enough. > > What do you think? Is the first vendor closer to telling the truth, or > is the third vendor? Or, is there really just no way of knowing ahead > of time so you might as well pay for the most protection you can > afford? > > Thanks, > John > > -- > "Fergie", a.k.a. Paul Ferguson > Engineering Architecture for the Internet > fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net > ferg's tech blog: http://fergdawg.blogspot.com/ > >

2 1

Provider-based DDoS Protection Services
by John Neiberger 29 Jul '05

29 Jul '05

I've been talking to various providers about their DDoS detection and mitigation services and I'd like to get some opinions about what I'm hearing. One provider prices their product based on how much traffic you will need to mitigate during an attack. The sales engineers say that most DDoS attacks are in the 2-3 Gbps range so, of course, they recommend that you pay for that much protection at great cost. Another provider (using the exact same hardware and software) costs about half as much per month. Yet another provider (again, using exactly the same hardware and software) has much more flexible pricing that is far more attractive, but that's because their engineers state that DDoS attacks are usually sized to match the size of the network they're attacking. For example, according to this sales engineer, attackers usually won't launch a 3 Gbps attack on someone who only has a handful of T1 circuits. So, this provider's pricing looks much more attractive to end-users who have smaller circuit size requirements. If you have a single T1, for example, you could buy 50 Mbps of protection and they say that's enough. What do you think? Is the first vendor closer to telling the truth, or is the third vendor? Or, is there really just no way of knowing ahead of time so you might as well pay for the most protection you can afford? Thanks, John

1 0

Reflecting on Cisco's flaws
by J. Oquendo 29 Jul '05

29 Jul '05

/* The incident highlights the thorny issue of when to go public with a security problem. Security firms and computer vendors generally agree to do so when there's a patch - or fix - available. Cisco said it encourages independent security research but said in a statement that it felt Lynn's presentation "was presented prematurely and did not follow proper industry disclosure rules." [see footnote a] ... Worms - malicious programs that spread automatically - are less likely in today's version of Cisco's operating system because the underlying software is different enough for each device. That will change in the next release, making it possible to attack a wide swath of routers without adjusting the malware for each unique configuration. Such attacks, Lynn said, could modify routers en masse so that they cannot receive updates so they are always infected. Worse, attackers could erase instructions that tell the machine how to turn on. "The purpose of doing this presentation was to prevent a worm from being made," he said. His Las Vegas demonstration was stripped of any information that would lead anyone to figure out how the technique works, Lynn said. He also said he decided to defy his employer because Cisco's operating system source code had been stolen and posted on a hacker Web site. Additionally, Lynn said, he has seen discussions of Cisco vulnerabilities posted on Web sites for Chinese hackers. "Cisco has never told anybody that it was possible to take over one of their routers," Lynn said. "They fought that argument for a long time. You can see how far they're willing to go. I demonstrated it live on stage. That debate is over now." ... That changed when Cisco and ISS hired a team of temporary workers to yank about 20 pages from thousands of conference binders and replace compact discs with presentation materials. [footnote b] http://www.forbes.com/business/feeds/ap/2005/07/28/ap2163964.html */ Footnotes: (a) What are these "industry disclosure rules" and who made them? (b) Cisco Rent A Cops: "You have the right to unset alias echo, any echoing will be used against you in a GPL, OpenSource, XML, RPC, INSERT_LICENSE_HERE court of law." To reflect on earlier incorrect statements from some here, it is now clear that some of the presentation was perhaps based on code that was stolen earlier this year. Secondly for those who think some April fix worked you must have fell for those patches that came out on April 1st. Good old fools day. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x97B43D89 http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x97B43D89 To conquer the enemy without resorting to war is the most desirable. The highest form of generalship is to conquer the enemy by strategy." - Sun Tzu

1 0

U.N. Not Seeking to Govern Net
by Fergie (Paul Ferguson) 29 Jul '05

29 Jul '05

...and I've reached my post limit for the day. Via Red Herring. [snip] The United Nations recent examination of Internet governance does not portend a wholesale shift of control to the international body, the chief of the working group parsing the issue said Thursday. "Our mandate was not a proposal for sweeping regime change," said Markus Kummer, executive coordinator of the U.N. Working Group on Internet Governance (WGIG). The group released a report July 14 that called for more international oversight in the operation of the domain-name system (DNS) for Internet addresses. Mr. Kummer made his remarks at a meeting sponsored by the Internet Governance Project at Syracuse University. [snip] http://www.redherring.com/article.aspx?a=12961 - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Cisco cover up
by J. Oquendo 29 Jul '05

29 Jul '05

On Wed, 27 Jul 2005, Dan Hollis wrote: > > This is looking like a complete PR disaster for cisco. They would have > been better off allowing the talk to take place, and actually fixing the > holes rather than wasting money on a small army of razorblade-equipped > censors. > > -Dan Complete PR disaster? Maybe they're still working on the fix and didn't want those on the blackhat scene to have a glimpse of how they intended on fixing things. I wonder if this has exploit_foo_bar has anything to do with their code being stolen earlier this year was it, or late last year. Maybe for the geeks in you, it may be a PR disaster, but I doubt their stock price will come down much. Oddly I wonder if those in gov are watching closely to those who are running around shorting Cisco stock. Or should that be: "sh0rt1ng c1sc0 st0ck!@$" =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x97B43D89 http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x97B43D89 To conquer the enemy without resorting to war is the most desirable. The highest form of generalship is to conquer the enemy by strategy." - Sun Tzu

11 10