- Test - lists.nanog.org

RE: ICANN Targets DDoS Attacks
by H. Michael Smith, Jr. 29 Oct '02

29 Oct '02

If we take Marc Sachs' presentation at face-value, the Gov't is asking us to provide such definitions (as well as anything else we can do to help). -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of bob Sent: Tuesday, October 29, 2002 10:26 AM To: fingers Cc: H. Michael Smith, Jr.; nanog(a)merit.edu Subject: Re: ICANN Targets DDoS Attacks I would point out that if we were to define it and provide the definition to the proper authorities, it would go a long way towards getting a definition that makes sense. I, (and many others here I would imagine) can help get the definition to the right ears if ya'll come up with it. iii fingers wrote: >>Agreed 100%, but Gov't (being run by lawyers) is well accustomed to >>defining what the meaning of 'is' is. If they dictate that ISPs employ >>"DDoS Protection", they will define what "DDoS Protection" means 'for >>the purposes of this policy'. >> > >ah ok > >the point I was trying to make is, there are steps that can be taken to >mitigate/reduce the affects of DDoS. I do not believe there is any >complete way to "protect against a DDoS". perhaps I'm just being pedantic. >perhaps the clarity you mention would be a good thing for other areas too >:) >

1 0

RE: ICANN Targets DDoS Attacks
by H. Michael Smith, Jr. 29 Oct '02

29 Oct '02

Agreed 100%, but Gov't (being run by lawyers) is well accustomed to defining what the meaning of 'is' is. If they dictate that ISPs employ "DDoS Protection", they will define what "DDoS Protection" means 'for the purposes of this policy'. -----Original Message----- From: fingers [mailto:fingers@fingers.co.za] Sent: Tuesday, October 29, 2002 10:04 AM To: H. Michael Smith, Jr. Cc: nanog(a)merit.edu Subject: RE: ICANN Targets DDoS Attacks > Source address verification at access layer and rate limiting icmp would > be fine starts. these are "best practices" and not "DDoS Protection" imho

3 2

ICANN Targets DDoS Attacks
by Sean Donelan 29 Oct '02

29 Oct '02

My comment from September 11, 1996 (that's not a typo) http://www.cctec.com/maillists/nanog/historical/9609/msg00302.html But what's interesting is Paul Vixie is speaking about a very narrow requirement, but when it gets translated into government regulation talk, its very different than where we started. http://www.eweek.com/article2/0,3959,651686,00.asp "Meanwhile, U.S. government security officials are discussing the possibility of creating new regulations that would require federal agencies to buy Internet service only from ISPs that have DDoS protection on their networks, according to people familiar with the situation. Such a decision could place economic pressure on the other ISPs to follow suit, thereby improving Internet security."

5 4

complexity draft
by Randy Bush 28 Oct '02

28 Oct '02

draft-ymbk-arch-guidelines-05.txt

1 0

RE: NMS/OSS commercial software : short summary from NANOG replies
by Daniska Tomas 28 Oct '02

28 Oct '02

do you mean kind of "The box said 'Requires Windows 95, NT, or better,' so I installed FreeBSD" :)))) -- deejay > -----Original Message----- > From: Nipper, Arnold [mailto:arnold@nipper.de] > Sent: 28. októbra 2002 15:51 > To: Petri Helenius; nanog(a)merit.edu; m.rapoport(a)completel.fr > Subject: Re: NMS/OSS commercial software : short summary from > NANOG replies > > > > Expansion of nothing is still nothing. Others call it <insert > your favorite OS> ... > > > Arnold > > > > > That is very short summary, would you care to expand a little bit? > > > > Pete > > > > > > > > Hello, > > > First of all, thanks for all the answers that I received > from the list. > > > Some of you asked me a feedback on the answers received, > so here it is : > > > > > > > > > > > > > > > > > > >

1 0

NMS/OSS commercial software : short summary from NANOG replies
by m.rapoport＠completel.fr 28 Oct '02

28 Oct '02

Hello, First of all, thanks for all the answers that I received from the list. Some of you asked me a feedback on the answers received, so here it is :

3 2

NANOG26 IPv6 instructions
by itojun＠itojun.org 27 Oct '02

27 Oct '02

http://www.kame.net/nanog26/ itojun

1 0

NANOG26: IPv6 unreachable prefix advertised
by itojun＠itojun.org 27 Oct '02

27 Oct '02

it looks that there's unreachable IPv6 prefix advertised at the venue. please stop this router advertisement (2001:468:1420:f::/64), or fix conectivity... with this configuration i can't use IPv6 to connect to my home. itojun itojun[coconut:~] traceroute6 -n -q1 2001:468:1420:f:220:e0ff:fe8d:3a8c traceroute6 to 2001:468:1420:f:220:e0ff:fe8d:3a8c (2001:468:1420:f:220:e0ff:fe8d:3a8c) from 2001:298:308:1:2ae:d0ff:fe00:3b, 30 hops max, 12 byte packets 1 2001:298:308:1:200:24ff:fec0:55de 0.878 ms 2 3ffe:8360:1000::2000 5.885 ms 3 3ffe:8360:1000::1 5.252 ms 4 3ffe:8360:1000:1::3 6.879 ms 5 3ffe:8360:0:1000::1:1 7.379 ms 6 2001:200:0:1800:230:48ff:fe41:4e50 5.001 ms 7 2001:200:0:1800::9c4:2 5.16 ms 8 2001:200:0:1800::9c4:0 5.142 ms 9 2001:200:0:6c01:290:27ff:fe3a:d8 5.557 ms 10 2001:200:0:6c01:209:11ff:fedb:19fe 144.071 ms 11 2001:468:ff:b17::1 390.569 ms 12 2001:468:ff:b17::2 389.938 ms 13 2001:468:ff:1317::1 390.554 ms 14 2001:468:ff:1213::1 402.714 ms 15 2001:468:ff:6c1::1 390.262 ms 16 2001:468:ff:306::1 397.108 ms 17 2001:468:ff:354::2 419.125 ms !A

1 0

2 breaks on TAT 14
by Jesper Skriver 27 Oct '02

27 Oct '02

Hi, It seems that there is 2 breaks on TAT 14, one between Manasquan (US) and Blaabjerg (DK) and one somewhere between Blaabjerg and Pentewan, rumors say somewhere in Holland. The first seems to be some days old, the second failed around 12:20 CET yesterday. Rumors also say one of failures will be fixed around 18:00 CET today. Does anyone have more details ? /Jesper -- Jesper Skriver, jesper(at)skriver(dot)dk - CCIE #5456 One Unix to rule them all, One Resolver to find them, One IP to bring them all and in the zone to bind them.

1 0

Re: How to secure the Internet in three easy steps
by Paul Vixie 27 Oct '02

27 Oct '02

> > not just the bad people. all the people. a network with 2 or 3 in place > > is useless. there is no way to make 2 or 3 happen. > As part of their anti-spam efforts, several providers block SMTP port > 25, and force their subscribers to only use that provider's SMTP > relay/proxy to send mail. Why not extend those same restrictions to > other (all) protocols? each protocol that becomes as widely abused as smtp has been, will be blocked, since blocking will save the ISP money. you also mentioned proxying of web traffic, which due to banner ads often makes the ISP money. this whole thing is really about money. but "1" isn't getting done because the money that could be saved is by ISP "B" whereas the money which must be spent is by ISP "A". so, the nondeployment of BCP38 is all about money, too. the thing i'm trying to work my way back to is that "2" and "3" can be argued to restrict desireable freedoms (like reaching SMTP or WWW servers without being forced to use a local proxies) whereas "1" has no arguments against it, or at least no arguers here on nanog today. why lump them all three together? PS. you mentioned AOL, which uses IP framing in order to leverage off of the IP stack already present in their customer's computers, but other than that it's a captive application. what addresses are used doesn't really matter there in any global sense, nor proxies or nats or whatever.

5 5