- Test - lists.nanog.org

Re: no ip forged-source-address
by Daniel Senie 30 Oct '02

30 Oct '02

At 02:26 PM 10/30/2002, you wrote: >On Wed, 30 Oct 2002 variable(a)ednet.co.uk wrote: > >If every router in the world did this I could still use spoofed IP >addresses and DDOS someone. My little program could determine what subnet >I am on, check what other hosts are alive on the subnet and then when it >decides to attack, it would use some neighbor's IP. The subnet I am on is >a /24 and there very well may be a few dozen hosts. I could be real >sneaky and alter my IP randomly to be any of my neighbors for every packet >I send out. And the company being attacked would be able to find out what network you are on. >Traceback would get me instantly back to the offending subnet but then it >would take a bit of digging on the network admin to track me down and >applying RPF checking won't help. While that traceback is happening, your upstream ISP would be quite able to cut connectivity to your /24 while investigating which machine was causing the problem. It's a question of accountability. If that /24 is used by one company, it's now possible to know that company is your target when you file your court papers. >RPF checking can only go so far. You would need RPF checking down to the >host level and I haven't heard anyone discuss that yet. Getting to the subnet is sufficient bring the problem to the local entity involved. I think that's quite reasonable. If the /24 is a cable network, a packet analyzer in use by the local cable ISP will find the culprit. >-Hank > > > > > Hi, > > > > I've been following the discussion on DDoS attacks over the last few weeks > > and our network has also recently been the target of a sustained DDoS > > attack.I'm not alone in believing that source address filters are the > > simplest way to prevent the types of DDoS traffic that we have all been > > seeing with increasing regularity.Reading the comments on this list have > > lead me to believe that there is a lot of inertia involved in applying > > what appears to me as very simple filters. > > > > As with the smurf attacks a few years ago, best practice documents and > > RFC's don't appear to be effective.I realise that configuring and > > applying a source address filter is trivial, but not enough network admins > > seem to be taking the time to lock this down.If the equipment had > > sensible defaults (with the option to bypass them if required), then > > perhaps this would be less of an issue. > > > > Therefore, would it be a reasonable suggestion to ask router vendors to > > source address filtering in as an option[1] on the interface and then move > > it to being the default setting[2] after a period of time?This appeared > > to have some success with reducing the number of networks that forwarded > > broadcast packets (as with "no ip directed-broadcast"). > > > > Just my $0.02, > > > > > > Richard Morrell > > edNET > > > > [1] For example, an IOS config might be: > > > > interface fastethernet 1/0 > > no ip forged-source-address > > > > [2] Network admins would still have the option of turning it off, but this > > would have to be explicitly configured. > > > > > >

1 0

NMS/OSS commercial software : short summary from NANOG replies - here it is
by m.rapoport＠completel.fr 30 Oct '02

30 Oct '02

Sorry for my previous mail that was sent empty, due to a mouse clicking bug ;-) So, at last, here is the summary of the answers, plus additional information resulting from meetings I had with some vendors in the last days : First of all, one contributor emphazises on the fact that focusing on people and process is at least as important as on the tools used for NMS. Now the products : - Infovista : According to someone (Hi Mike,see you on rs-sp ;-) ), the product is considered to be flexible to build SLA reporting package, and very customizable to specific needs. According to another one: "Our NOC uses it and it just is not useful in any way, it usually is not common sense, the implementation is not straight- forward, it is awkward, and makes shortcuts that shall not be made". no comments .... >From a meeting I had with Infovista recently, my personal feelings are a mix of both opinions : It is surely a powerful tool, very customizable and scalable, but quite complex and heavy to deploy, and it costs a fortune (multiple hundreds of K$, not to say more). - Concord : >From one contributor :"horrible in multi-vendor environments" I have briefly met a Concord integrator, the product seems quite straight and simple to deploy, but very limited in terms of customization (all changes require C developpment). - Proviso : I have met the people from Quallaby today, the product looks both simple to install and powerful in terms flexibility and scalability. It might be a good product for perfs monitoring and customer SLA reports, but I had some rumors of possible bankrupcy of Quallaby ... I need to check more about it. - Netcool : seems to be quite a reference on the market, I only had good but not detailed opinions on it. - Cisco Works: not recommended by some people, or to be used for Natkit, which requires the NSA (Network supported account) level of support from Cisco (which is not cheap at all ;-). Quite an interesting doc recommended on NOC topics in general : http://www.cisco.com/networkers/nw02/presos/pws/docs/PS-510.pdf Other products that have been recommended by people on the list : - Smarts : http://www.smarts.com/ . The product looks interesting, and it was recommended by several persons on the list. Regarding my personal needs, I am not sure how well it is supported in Europe, and especially in France .... - LINMOR : www.linmor.com : a Canadian product. >From the contributor :"They are the prefered vendor for both Cisco & Micromuse when it comes to performance management" I might have the same problem that with Smarts in terms of finding here a reseller and appropriate support ... - SpiderMon, from Pathway Communication (a Canadian ISP reselling its in house NM tool) : It seems to be an all-in-1 product covering the whole FCAPS range. I can give more details on the product for person requesting it. An interesting article comparing Spectrum, Patrol, Netcool, and Smarts : http://www.networkcomputing.com/1316/1316f2.html All comments welcomed. ________________________ Marc Rapoport Architecture Dpt Completel tel : +33 1 72 92 25 38 fax: +33 6 09 76 56 79 m.rapoport(a)completel.fr ________________________

1 0

tiscali please:)
by Scott Granados 30 Oct '02

30 Oct '02

Can someone with Tiscali write to me off list concerning as9105.net Thanks Scott

1 0

Lame reports - thanks!
by Rob Thomas 30 Oct '02

30 Oct '02

Hi, NANOGers. My thanks to the increasing number of you who submit lame delegation logs to me. This helps to increase the reach and usefulness of the Weekly Lame Name Server Report page: http://www.cymru.com/DNS/lame.html If you have logs you can share, anonymously or with full credit, feel free to send them to lamer(a)cymru.com. Be the first on your block to fill my lamer file system. :) Thanks! Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

1 0

IANA IPv4 allocation list format change
by Rob Thomas 30 Oct '02

30 Oct '02

Hi, NANOGers. For those of you who don't know, the format of the IANA IPv4 allocation list has changed. It now lists each prefix as a distinct /8, instead of hyphenated ranges of prefixes. This change took place on 25 October. If you are parsing this file automagically, you may wish to modify your scripts. My own script claimed that several new allocations had been made. It's fixed now. :) http://www.iana.org/assignments/ipv4-address-space My thanks to the IANA folks for this change! Thanks, Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

1 0

Re: ICANN Targets DDoS Attacks
by Jared Mauch 30 Oct '02

30 Oct '02

On Tue, Oct 29, 2002 at 06:00:06PM -0500, Ken Chase wrote: > On Tue, Oct 29, 2002 at 04:11:49PM -0500, Jared Mauch's all... > > > Once again, i'd like to see (other than a performance > > checking customer) generate more than 2Mb/s of icmp.echo and icmp.echo-reply > > packets that are legit and not part of a DoS. This is quite rare. > > little blip in the internet, and all your intelligent customers running > linux use their leet tools to figure out whats wrong. They all run > mtr vs their preferred sites. Mtr generates one ICMP packet (~80 bytes?) > of traffic PER hop in the trace. A route of 20+ hops, means 1600 bytes/s > per customer (thats 12.8Kbps). 150 customers later you got 2Mbps of > traffic (2Mb/s is 2 megaBIT per second right? you didnt mean 2 mega BYTES > per second? in which case *8). > > Is 150 customers a large number? > > And there are lots of nice graphical traceroute tools for windoze as well > of course, dont know their packet load in full operation however. > > Silly me, sometimes I leave mtrs running. I've found 2-3 going all at > once at times. <slap!/> > > Why is ICMP rate limiting on ECHO and ECHO reply going to stop all DOS > attacks? What are they going to do about UDP floods? (Are they proposing I don't recall saying it will stop all DoS attacks. It will help minimize them. Please discontinue imagination. You obviously don't understand how traceroute works by sending udp packets and getting icmp ttl expired messages back which are not icmp {echo,echo-reply}. Come back when you do understand how it works. /sigh > that DDOS attacks are all smurf based? They've just found a solution to 1996's > problems? Amazing!) They're not, but there is still a large amount of things that just do ping -f <10.2.3.4> and similar types of attacks. If you know what your usual patterns are, it's easy to notice what is out of place. > [ hopefully this post makes it to nanog. my posts've been going to /dev/null > with previous attempts ] > > /kc > > > > > Do your own stats and test your hardware. > > > > - jared > > > > -- > > Jared Mauch | pgp key available via finger from jared(a)puck.nether.net > > clue++; | http://puck.nether.net/~jared/ My statements are only mine. > > -- > Ken Chase, math(a)velocet.ca * Velocet Communications Inc. * Toronto, CANADA -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

3 2

ATM service classes
by Dan Lockwood 30 Oct '02

30 Oct '02

I'm in a knock down drag-out with my RBOC about some ATM DS3s and an OC3. Proceeding on the advice of a Cisco engineer I requested that the circuits be provisioned with UBR+. After the Bell failed to have the circuits provisioned correctly, they installed UBR, and discovering that they could not support UBR+ I have requested that the circuits be reprovisioned with VBR-NRT. These circuits are primarily used for non time sensitive data, but may be used for VOIP in the future. What suggestions does the group have regarding selecting ATM service classes with the Bell and Cisco IOS/hardware. As always, the expertise of the group is unsurpassed and GREATLY appreciated. Dan Lockwood Microsoft Certified Professional CompTIA Network+ Certified Cisco Certified Network Associate

1 0

RE: ICANN Targets DDoS Attacks
by Dan Lockwood 29 Oct '02

29 Oct '02

Would anyone be willing to post an operational example of CAR for ICMP. I would like to see what others are doing to combat the problem. Dan -----Original Message----- From: Jared Mauch [mailto:jared@puck.Nether.net] Sent: Tuesday, October 29, 2002 13:12 To: Jeff Shultz Cc: nanog(a)nanog.org Subject: Re: ICANN Targets DDoS Attacks On Tue, Oct 29, 2002 at 01:03:52PM -0800, Jeff Shultz wrote: > >> On 10/29/2002 at 3:40 PM Valdis.Kletnieks(a)vt.edu wrote: > >> >On Tue, 29 Oct 2002 22:25:44 +0200, Petri Helenius > >> ><pete(a)he.iki.fi> > >> said: > >> > > >> >> Why would you like to regulate my ability to transmit and > >> >> receive > >> data > >> >> using ECHO and ECHO_REPLY packets? Why they are considered > >> >> harmful? > >> > > >> >Smurf. > >> > > >> > >> Okay. What will this do to my user's ping and traceroute times, if > >> anything? I've got users who tend to panic if their latency hits > 250ms > >> between here and the moon (slight exaggeration, but only slight). > >> > >> I just love it when I've got people blaming me because the 20th hop > on > >> a traceroute starts returning * * * instead of times. > > > > that's icmp ttl expired messages. > > I know that, and I try to explain it to my customers... but it doesn't > answer the first part of the question - what will throttling ICMP do > to ping and traceroute times? My gut reaction is that it will a. slow > them ICMP? Or only icmp echo and icmp echo-reply messages? In a well behaved router, nothing. Obviously if you have a 7500 or older GSR linecards that are incapable of doing this due to design problems from day one in pps rates and feature path, there may be a hit. I'm not saying rate-limit anything other than echo+reply. > down and/or b. discard a lot of them making the circuit look > unreliable to ping. But I don't know enough about the underlying > technology to be sure of that. Once again, i'd like to see (other than a performance checking customer) generate more than 2Mb/s of icmp.echo and icmp.echo-reply packets that are legit and not part of a DoS. This is quite rare. Do your own stats and test your hardware. - jared -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

2 2

URLs (IPv6 ISP situations in Japan)
by itojun＠itojun.org 29 Oct '02

29 Oct '02

from the last page of my slide, in case you have missed it. itojun http://www.kame.net/ http://www.v6pc.jp/ http://www.wide.ad.jp/ http://www.wide.ad.jp/nspixp6/ http://www.iij.com/

1 0

Re: How to secure the Internet in three easy steps
by Paul Vixie 29 Oct '02

29 Oct '02

> Not only that, but unless _everyone_ implements 2 and/or 3, all the bad > people that exploit the things these are meant to protect will migrate to > the networks that lack these measures, mitigating the benefits. not just the bad people. all the people. a network with 2 or 3 in place is useless. there is no way to make 2 or 3 happen. > This seems to be a catch-22; no one will implement these for the good > of the net because it costs money, and ignorant competitors that don't > implement them will not share in that expense. Have any such ideas > been implemented in the modern internet? How? neither 2 or 3 would be for the good of the net. 1 would be. the problem with 1 is that the person who feels pain when ISP "A" doesn't do 1 is most likely to be ISP "B". therefore people confuse 1 with "internet altruism" rather than the "rational selfishness" that it is.

14 15