- Test - lists.nanog.org

Slightly OT: Hosting Providers in Hong Kong
by Damian Gerow 17 Dec '02

17 Dec '02

Can anyone recommend a good hosting company located in Hong Kong? One of our clients needs to host some files overseas, and we've had some troubles actually getting in touch with someone to get some stable pricing. We're only looking for 50-100 MB of space to store some files, but like I said, we've had problems getting people to call us back. (Responses would probably be better off-list. Thanks.) - Damian

2 1

Alternative to NetFlow for Measuring Traffic flows
by William B. Norton 17 Dec '02

17 Dec '02

Hi all - Here is the problem: Everyone wants to know how much traffic would ultimately be passed in peering relationships at an IX before signing up/building into an IX. I heard an interesting solution recently to estimating the traffic volume destined to an AS in the absence of NetFlow or the like. The ability to measure traffic via sampling has been difficult for a variety of reasons (lack of staff resources, capabilities of the interface cards, expensive SW, etc.) and I found from talking to Peering Coordinators that less than 1 in 20 ISPs actually do the traffic measurements. In the absence of data, ISPs are often left to intuition, guessing that a particular AS would be a good peering candidate. Here is the Solution: Assuming that: 1) You are multi-homed 2) You have some ideas of who you would want to peer with 3) <more assumptions here I'm sure> 1) You adjust routing to prefer one transit provider or the other for the AS 2) Shift traffic to the particular AS from one transit provider to the other, noting the change in the loads on the transit providers. If you do this at peak time you can get a rough estimate of the peak traffic to this AS, and therefore a rough order of magnitude estimate of the amount of traffic that would go to this AS in a peering relationship. (Rough Estimate means determining if the traffic volume is likely to be 2 Mbps vs. 20 Mbps vs. 200Mbps) Interesting idea. Comments? The other approach some ISPs use is to set up a "trial" peering session, usually using a private cross connect to measure the traffic volume and relative traffic ratios. Then both side can get an idea of the traffic before engaging in a contractual Settlement-Free Peering relationship. Bill

8 17

RE: Identifying DoS-attacked IP address(es) Sniffer
by alex＠yuriev.com 17 Dec '02

17 Dec '02

> The Sniffer and other tools like it are meant to drink from a fire hose. > So, is it far fetched to analyze a dozen or more OC-12's other than from a > router?? No. In fact carriers should embrace a different approach to > further understand and analyze their backbone. Analyzers' with filters of > attack/virus definitions can play a key role in fast, efficient response in > the fight against distributed attacks. Should the sales people trying to peddle their wares learn a bit about underlying technologies and be forced to take Algebra 101 before be let lose on NANOG? So your SONET sniffer decodes STS->[other stuff]->IP->[other-stuff]->app-layer and matches against definitions that you have, and does it all in real-time, does not fall over due to load, deals with fragmentation and assymetic routing and so on. Oh, and then of course it does it all in a secure manner since the traffic should not be exposed to 3rd parties. Yeah, right. Alex

1 0

RE: Identifying DoS-attacked IP address(es) Sniffer
by Brennan_Murphy＠NAI.com 17 Dec '02

17 Dec '02

Even though you are asking this question with regard to what can be done on the router itself, it's worth mentioning, if only for the archives, a non-router approach to the problem...especially if you are an enterprise network manager. It's even worth mentioning despite the fact that I work for a company that provides said approach. Some of our enterprise customers place distributed Sniffers on their internet links themselves. Upon receiving an alert, they connect to the Sniffer and click on Top Ten talkers by bytes (presented in pie/bar chart). On the left side of the screen are the source/destination pairs generating the most traffic. Typically, top talkers are the culprits but sometimes weak DOS attacks can hide among legitimate traffic, which is why it's occasionally useful to check the Protocol Distribution window. More sophisticated attacks sometimes require that you take a capture of traffic and analyse packet level data. If it's a simple DOS, jot down the IP's involved and call your ISP or upstream provider with a filter request. Near future versions of Sniffer will have IDS capabilities built in. I've also seen a proof of concept tool that automates the filtering process based on DDOS data and network thresholds. Obviously, there's lots of cases where this is a problematic approach but I was impressed with the tool's current intelligence...especially traceback analysis and filtering at ingress. In any case, Sniffer isn't the only protocol analysis tool. Shop around if a non-router approach interests you. -----Original Message----- From: Andre Chapuis [mailto:chapuis@ip-plus.net] Sent: Monday, December 16, 2002 9:12 AM To: nanog(a)nanog.org Subject: Identifying DoS-attacked IP address(es) Hi, How do you identify a DoS-attacked IP address(es) on your ingress border router, assuming the latter is a Cisco 12000 ? I used to use ip accounting but they removed it from the S-code. Thanks, André --------------------- Andre Chapuis IP+ Engineering Swisscom Ltd Genfergasse 14 3050 Bern +41 31 893 89 61 chapuis(a)ip-plus.net CCIE #6023 ----------------------

3 2

[Article] Core competency - ISP backbones stand up in grueling 30-day performance test
by Hank Nussbacher 17 Dec '02

17 Dec '02

http://www.nwfusion.com/research/2002/1216isptest.html -Hank

1 0

RE: Identifying DoS-attacked IP address(es)
by Brennan_Murphy＠NAI.com 17 Dec '02

17 Dec '02

I can send you screenshots of our tool if you are interested. -----Original Message----- From: Andre Chapuis [mailto:chapuis@ip-plus.net] Sent: Monday, December 16, 2002 9:12 AM To: nanog(a)nanog.org Subject: Identifying DoS-attacked IP address(es) Hi, How do you identify a DoS-attacked IP address(es) on your ingress border router, assuming the latter is a Cisco 12000 ? I used to use ip accounting but they removed it from the S-code. Thanks, André --------------------- Andre Chapuis IP+ Engineering Swisscom Ltd Genfergasse 14 3050 Bern +41 31 893 89 61 chapuis(a)ip-plus.net CCIE #6023 ----------------------

1 0

Re: Identifying DoS-attacked IP address(es)
by Andre Chapuis 17 Dec '02

17 Dec '02

Chris, I often see the input-interface load is 100%. André At 16:35 16.12.2002 +0000, Christopher L. Morrow wrote: >On Mon, 16 Dec 2002, Andre Chapuis wrote: > >> >> Hi, >> How do you identify a DoS-attacked IP address(es) on your ingress border router, assuming the latter is a Cisco 12000 ? I used to use ip accounting but they removed it from the S-code. > >What info do you have when you are trying to accomplish this mission? > >> Thanks, >> André >> >> >> --------------------- >> Andre Chapuis >> IP+ Engineering >> Swisscom Ltd >> Genfergasse 14 >> 3050 Bern >> +41 31 893 89 61 >> chapuis(a)ip-plus.net >> CCIE #6023 >> ---------------------- >> --------------------- Andre Chapuis IP+ Engineering Swisscom Ltd Genfergasse 14 3050 Bern +41 31 893 89 61 chapuis(a)ip-plus.net CCIE #6023 ----------------------

7 13

RE: Identifying DoS-attacked IP address(es)
by Livio Ricciulli 16 Dec '02

16 Dec '02

At 09:17 PM 12/16/2002 +0000, Christopher L. Morrow wrote: >On Mon, 16 Dec 2002, Livio Ricciulli wrote: > > > FYI, we developed a system that sniffs FE,GE,DS3,OC3-48 POS and creates > > a model using the cross-product of: > > 1) source/destination address distributions > > 2) packet rate > > 3) protocol > >But I can't field deploy this 2 continents away at 4am with 10 mins >notice... Yes, there needs to be some up-front investment to proactively deploy these boxes/taps in strategic places. I did some analysis and the numbers are doable even for the largest networks. But then we get into philosophy; I have a lot of screwdrivers at home laying around but I would much rather invest in chisels rather than keep trying carving wood with flathead screwdrivers (but that's just me..) Livio.

1 0

[candidhosting.com #25891] AutoReply: RE: Identifying DoS-attacked IP address(es) (fwd)
by Christopher L. Morrow 16 Dec '02

16 Dec '02

who signed up a ticketing system to nanog?? --Chris (chris(a)uu.net) ---------- Forwarded message ---------- Date: Mon, 16 Dec 2002 16:22:09 -0500 (EST) From: Candid Hosting Support <support(a)candidhosting.com> To: chris(a)UU.NET Subject: [candidhosting.com #25891] AutoReply: RE: Identifying DoS-attacked IP address(es) Greetings, This message has been automatically generated in response to your trouble ticket request regarding: "RE: Identifying DoS-attacked IP address(es)", a summary of which appears at the bottom of this e-mail. Your ticket has been assigned an ID of [candidhosting.com #25891]. Our support personnel will contact you shortly in regards to this matter. If your request is concerning a dedicated server, please make sure that you have provided the following required information: - At least one domain name or IP address used on the server - Login and/or root passwords as required by the specific issue - Remote access, such as a pcAnywhere or VNC password, for Windows systems For future correspondence concerning this issue, please reply to this e-mail or include the string "[candidhosting.com #25891]" in the subject line of new messages. Regards, Candid Hosting Technical Support Team - support(a)candidhosting.com - ICQ #141214819 - 1-877-248-9888, Option #2 ------------------------------------------------------------------------- On Mon, 16 Dec 2002, Livio Ricciulli wrote: > FYI, we developed a system that sniffs FE,GE,DS3,OC3-48 POS and creates > a model using the cross-product of: > 1) source/destination address distributions > 2) packet rate > 3) protocol But I can't field deploy this 2 continents away at 4am with 10 mins notice... > > This works very well to detect floods and does not require messing with > routers.. > > Livio. > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of > Neil J. McRae > Sent: Monday, December 16, 2002 9:38 AM > To: Andre Chapuis > Cc: Christopher L. Morrow; nanog(a)nanog.org > Subject: Re: Identifying DoS-attacked IP address(es) > > > Sampled netflow, or look at the traceback stuff in later > IOS 12.0S versions. Avoid filter lists as the GSR engine cards > have a statically limited number of entries. > > Regards, > Neil. > (NH)

1 0

Identifying DoS-attacked IP address(es)
by Andre Chapuis 16 Dec '02

16 Dec '02

Hi, How do you identify a DoS-attacked IP address(es) on your ingress border router, assuming the latter is a Cisco 12000 ? I used to use ip accounting but they removed it from the S-code. Thanks, André --------------------- Andre Chapuis IP+ Engineering Swisscom Ltd Genfergasse 14 3050 Bern +41 31 893 89 61 chapuis(a)ip-plus.net CCIE #6023 ----------------------

3 2