- Test - lists.nanog.org

RE: UUNet Offer New Protection Against DDoS
by Lumenello, Jason 04 Mar '04

04 Mar '04

This sounds like a good idea for us to consider. I think DoS attacks typically get erased in the 95% discard a lot of people use in billing though, but it still has value for the customer. Thanks! Jason -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Mark Kasten Sent: Wednesday, March 03, 2004 5:35 PM To: nanog(a)merit.edu Subject: Re: UUNet Offer New Protection Against DDoS We actually accept up to the customers aggregate. So if they have a /16, they can tag the whole /16. And we do not tag no-export. I saw some time ago on a list, and I think Bill Manning suggested it, that if you are getting bits for unused address space, to announce that address space (up to host specific) with the DDoS community string. That keeps the packets off of your link and thus you don't get charged for them. The same can be done in reverse. We have a customer that is advertising their larger block with the DDoS community string, and then advertising the addresses they are actually using more specifically, so we blackhole everything less specific. These are a couple of applications that can be utilized if you don't tag no-export and accept more than just /32's within their address space. FWIW. Also, we are utilizing Juniper's DCU for tracebacks, which makes life MUCH easier when tracing an attack. :-) SNMP polling the DCU counters every few minutes is relatively fast and painless, and provides quick results. Mark Lumenello, Jason wrote: Oh, and I strip their communities, and apply no-export, on the first term of my route map so the /32 does not get out. Of course my peer facing policy requires specific communities to get out as well (belt and suspenders). This method works very well, and you do not have to give up length restrictions or maintain two sets of customer prefix/access lists. Jason -----Original Message----- From: Lumenello, Jason Sent: Wednesday, March 03, 2004 4:52 PM To: 'Stephen J. Wilcox'; james Cc: nanog(a)merit.edu Subject: RE: UUNet Offer New Protection Against DDoS I struggled with this, and came up with the following. We basically use a standard route-map for all customers where the first term looks for the community. The customer also has a prefix-list on their neighbor statement allowing their blocks le /32. The following terms (term 2 and above) in the route-map which do NOT look for the customer discard community, have a different standard/generic prefix-list evaluation which blocks cruft and permits 0.0.0.0/0 ge 8 le 24. By doing this, I only accept a customer /32 from his dedicated prefix-list when it has the DOS discard community, otherwise I catch them with the ge 8 le 24 in the following terms. Jason Lumenello IP Engineering XO Communications -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Stephen J. Wilcox Sent: Wednesday, March 03, 2004 3:48 PM To: james Cc: nanog(a)merit.edu Subject: Re: UUNet Offer New Protection Against DDoS I'm puzzled by one aspect on the implementation.. how to build your customer prefix filters.. that is, we have prefix-lists for prefix and length. Therefore at present we can only accept a tagged route for a whole block.. not good if the announcement is a /16 etc ! Now, I could do as per the website at secsup.org which means we have a route-map entry to match the community before the filtering .. but that would allow the customer to null route any ip. What we need is one to allow them to announce any route including more specifics of the prefix list - how are folks doing this? Steve On Wed, 3 Mar 2004, james wrote: Global Crossing has this, already in production. I was on the phone with Qwest yesterday & this was one of this things I asked about. Qwest indicated they are going to deploy this shortly. (i.e., send routes tagged with a community which they will set to null) James Edwards Routing and Security jamesh(a)cybermesa.com At the Santa Fe Office: Internet at Cyber Mesa Store hours: 9-6 Monday through Friday 505-988-9200 SIP:1(747)669-1965

1 0

RE: UUNet Offer New Protection Against DDoS
by Lumenello, Jason 04 Mar '04

04 Mar '04

XO set up a similar customer community last year for our customers to trigger their own black hole at our edge. There is no such thing as an original idea. :) This "promised response" probably means if you press 3 on your phone, you will get a CSR to open a ticket within 15 minutes. Sounds like nice marketing. Jason > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of > Stephen Perciballi > Sent: Wednesday, March 03, 2004 12:25 PM > To: Andy Ellifson > Cc: nanog(a)merit.edu > Subject: Re: UUNet Offer New Protection Against DDoS > > > > To the best of my knowledge, MCI/UUNET ~was~ the first to implement this. > I've > been using it for well over a year now. > > The community is 701:9999. Any route you tag with that community gets > dropped > accross the entire 701 edge. Feel free to contact support and tell them > you > want to setup the blackhole community if you are having any troubles. > > [Wed, Mar 03, 2004 at 08:34:00AM -0800] > Andy Ellifson Inscribed these words... > > > > > > When I first saw this post I thought that MCI/UU.Net implemented some > DDOS > > BGP community strings like CW implemented a month ago. If only all of > my > > upstreams would have this type of BGP Community string my life would be > made > > easier. Here is the customer release letter from from CW dated Januray > 23, > > 2004: > > > > Dear Customer, > > > > If you have received this email, you are either a direct customer of > > AS3561, (i.e. you have registered a route object for a customer of > AS3561), > > or are listed in the maintainer of a customer of AS3561. > > > > AS3561 has implemented a blackhole/DDoS community string based solution > to > > aid customers in the mitigation of DoS attacks. If you are currently > running > > BGP with us, you will be able to use this feature. > > > > If you advertise a prefix (route) to us with the community string > > 3561:666, we will NULL route or 'blackhole' all traffic destined to that > > prefix. The prefixes accepted are based on the current prefix-list > generated > > for you. Instead of doing exact match filtering, we will accept any > prefix > > (more "specific") within your address block(s). e.g. if you have > > 192.168.0.0/16 registered, we will accept 192.168.0.0/16 upto /32 as > long as > > the 3561:666 community string is attached. > > > > Please ensure you are configured to send community strings and > understand > > the impact of errant advertisements. Diligence should be used when > > administrating this feature. Once the prefix is received and propagated > > within AS3561, all traffic destined to the prefix will be discarded and > the > > blackholing of traffic will continue as long as DDoS community string is > > being advertised. Neither Cable & Wireless nor AS3561 will be held > liable > > or responsible for customers who errantly advertise prefixes with the > > blackhole community string. > > > > If you wish to utilize this feature, you can verify our acceptance of > the > > advertised prefix by querying the AS3561 route server located at > > http://lg.cw.net. > > > > Please remember, we require you to complete a priority one incident > report > > at http://www.security.cw.net (Report an Incident) and include details > of the > > > > attack. An email describing further details of the attack can be sent to > > security(a)cw.net, please include the incident report number in the > subject to > > assist in the tracking and documentation of the incident. This will > ensure > > the attack is properly administrated handled by our Security and Legal > > Groups. > > > > > > > > --- John Obi <dalnetuzer(a)yahoo.com> wrote: > > > Hello Nanogers! > > > > > > I'm happy to see this, and I hope C&W, Verio, and Level3 ..etc will do > the > > > same! > > > > > > MCI/WorldCom Monday unveiled a new service level agreement (SLA) to > help IP > > > services customers thwart and defend against Internet viruses and > threats. > > > > > > http://informationweek.securitypipeline.com/news/18201396 > > > > > > It's the right time before it's too late! > > > > > > Regards, > > > > > > -J > > > > > > > > > --------------------------------- > > > Do you Yahoo!? > > > Yahoo! Search - Find what you're looking for faster. > > > > -- > > Stephen (routerg) > irc.dks.ca

11 12

Re: UUNet Offer New Protection Against DDoS
by Suresh Ramasubramanian 04 Mar '04

04 Mar '04

Randy Bush [3/4/2004 6:40 AM] : > i think the north american idiom is putting your money where your > mouth is. Thank you. That's exactly what I was driving at. Hmm.. one of the people in that "we've been doing this too" thread was XO. Do I take it then that XO provides for DDoS downtime in its SLA? -- srs (postmaster|suresh)(a)outblaze.com // gpg : EDEDEFB9 manager, outblaze.com security and antispam operations

2 1

RE: UUNet Offer New Protection Against DDoS
by Lumenello, Jason 03 Mar '04

03 Mar '04

Oh, and I strip their communities, and apply no-export, on the first term of my route map so the /32 does not get out. Of course my peer facing policy requires specific communities to get out as well (belt and suspenders). This method works very well, and you do not have to give up length restrictions or maintain two sets of customer prefix/access lists. Jason > -----Original Message----- > From: Lumenello, Jason > Sent: Wednesday, March 03, 2004 4:52 PM > To: 'Stephen J. Wilcox'; james > Cc: nanog(a)merit.edu > Subject: RE: UUNet Offer New Protection Against DDoS > > I struggled with this, and came up with the following. > > We basically use a standard route-map for all customers where the first > term looks for the community. The customer also has a prefix-list on their > neighbor statement allowing their blocks le /32. The following terms (term > 2 and above) in the route-map which do NOT look for the customer discard > community, have a different standard/generic prefix-list evaluation which > blocks cruft and permits 0.0.0.0/0 ge 8 le 24. > > By doing this, I only accept a customer /32 from his dedicated prefix-list > when it has the DOS discard community, otherwise I catch them with the ge > 8 le 24 in the following terms. > > Jason Lumenello > IP Engineering > XO Communications > > > -----Original Message----- > > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of > > Stephen J. Wilcox > > Sent: Wednesday, March 03, 2004 3:48 PM > > To: james > > Cc: nanog(a)merit.edu > > Subject: Re: UUNet Offer New Protection Against DDoS > > > > > > > > I'm puzzled by one aspect on the implementation.. how to build your > > customer > > prefix filters.. that is, we have prefix-lists for prefix and length. > > Therefore > > at present we can only accept a tagged route for a whole block.. not > good > > if the > > announcement is a /16 etc ! > > > > Now, I could do as per the website at secsup.org which means we have a > > route-map > > entry to match the community before the filtering .. but that would > allow > > the > > customer to null route any ip. > > > > What we need is one to allow them to announce any route including more > > specifics of the prefix list - how are folks doing this? > > > > Steve > > > > On Wed, 3 Mar 2004, james wrote: > > > > > > > > Global Crossing has this, already in production. > > > I was on the phone with Qwest yesterday & this was one > > > of this things I asked about. Qwest indicated they are > > > going to deploy this shortly. (i.e., send routes tagged with > > > a community which they will set to null) > > > > > > > > > James Edwards > > > Routing and Security > > > jamesh(a)cybermesa.com > > > At the Santa Fe Office: Internet at Cyber Mesa > > > Store hours: 9-6 Monday through Friday > > > 505-988-9200 SIP:1(747)669-1965 > > > > > >

2 1

RE: dealing with w32/bagle
by Mike Damm 03 Mar '04

03 Mar '04

> We created bogus DNS entries for the following entries, known to be targeted by the worm: > www.sportscheck.de > www.songtext.net > www.songtext.de > www.maiklibis.de > www.gfotxt.net > postertog.de > permail.uni-muenster.de For what its worth ns{1,2,3,4}.everydns.net will answer for the wormy domains with 127.0.0.1 to help mitigate phone-home traffic. I just registered gfotxt.net (some appear to be registered while others are not) with the proper name servers and it should be visible worldwide along the normal timeline. Parties with control over the other mentioned domains or end user resolution are more than welcome to point them our way. We'll be generating some statistical data on DNS traffic and summarizing for anyone interested. -Mike

1 0

UUNet Offer New Protection Against DDoS
by John Obi 03 Mar '04

03 Mar '04

Hello Nanogers! I'm happy to see this, and I hope C&W, Verio, and Level3 ..etc will do the same! MCI/WorldCom Monday unveiled a new service level agreement (SLA) to help IP services customers thwart and defend against Internet viruses and threats. http://informationweek.securitypipeline.com/news/18201396 It's the right time before it's too late! Regards, -J --------------------------------- Do you Yahoo!? Yahoo! Search - Find what you�re looking for faster.

10 13

Re: dealing with w32/bagle
by Brent_OKeeffe＠asc.aon.com 03 Mar '04

03 Mar '04

We created bogus DNS entries for the following entries, known to be targeted by the worm: www.sportscheck.de www.songtext.net www.songtext.de www.maiklibis.de www.gfotxt.net postertog.de permail.uni-muenster.de The entries directed traffic to an interface on a router that can handle the traffic. Currently, we have a logging ACL that drops port 80 to the bogus IP. We might connect a sniffer with that IP address at some point with triggers loaded to notify when systems attempt to access the address. So far this has helped. Any other suggestions are welcome. Brent Dan Hollis <goemon(a)anime.net> Sent by: owner-nanog(a)merit.edu 03/03/2004 03:24 PM To: "'nanog(a)merit.edu'" <nanog(a)merit.edu> cc: Subject: dealing with w32/bagle I am curious how network operators are dealing with the latest w32/bagle variants which seem particularly evil. Also, does anyone have tools for regexp and purging these mails from unix mailbox (not maildir) mailspool files? Eg purging these mails after the fact if they were delivered to user's mailboxes before your virus scanner got a database update. -Dan

1 0

Re: dealing with w32/bagle
by W.D.McKinney 03 Mar '04

03 Mar '04

>-----Original Message----- >From: Dan Hollis [mailto:goemon@anime.net] >Sent: Wednesday, March 3, 2004 08:24 PM >To: 'nanog(a)merit.edu' >Subject: dealing with w32/bagle > > >I am curious how network operators are dealing with the latest w32/bagle >variants which seem particularly evil. > >Also, does anyone have tools for regexp and purging these mails from unix >mailbox (not maildir) mailspool files? Eg purging these mails after the >fact if they were delivered to user's mailboxes before your virus scanner >got a database update. > >-Dan > > Simply put, I run a Barracuda Networks box so I don't worry. Dee

1 0

Contact from (what used to be) CAIS (AS 3491).
by John Palmer 03 Mar '04

03 Mar '04

Could someone from whoever owns CAIS Internet (AS3491) please contact me offlist? One of your customers has a machine that is making a lame attempt at a DDOS attack. Although ineffectual, it is causing a slight uptick in bandwidth usage and we need to get this stopped before I take it to your upstream. Thanks John P. American Webmasters, Inc.

1 0

How much do worms and virus cost ISPs?
by Sean Donelan 03 Mar '04

03 Mar '04

Of course, I'm certain Sandvine is selling something to solve the problem, but it is still a very nice article with some measurable numbers. http://www.globeandmail.com/servlet/story/RTGAM.20040303.gtsandmar2/BNStory… "On any given day," its white paper concluded, "between 2 and 12 per cent of all Internet traffic moving across service provider networks is malicious. Even on well-run networks with dedicated security departments, malicious traffic constitutes, on average, 5 per cent of all data throughput." Service provider with about 100,000 subscribers will lose almost $60,000 in avoidable fees. A provider with one million subscribers will pay an additional $350,000.

1 0