- Test - lists.nanog.org

eBay and the DoS thread
by Richard A Steenbergen 04 May '02

04 May '02

I would like to take this opportunity to publicly shame eBay, who decided to fire one of their engineers for disclosing their "proprietary" methods for defending against DoS in the recent NANOG thread. The only appropriate punishment for a company with its head so far up its proverbial poop chute to prevent the sharing of simple recommendations on DoS prevention with the networking community is that all useful, intelligent, and responsable people consider their policies carefully before working there. </rant> -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

2 1

Re: anybody else been spammed by "no-ip.com" yet?
by blitz 04 May '02

04 May '02

Picture it as a fellow stopping by every night and filling your home mailbox with horse manure...I'm sure you'll get a feeling for how most of us regard it. A) it wastes bandwidth B) It wastes our time C) It's the "litter" of an otherwise clean Internet. D) It's a method of placing the costs for the actual emailing on someone else without their explicit permission...the ISP, the user, and the ISP's other paying customers all pay for the act, either directly or indirectly. We need to make it illegal as soon as possible everywhere..... At 15:27 5/3/02 -0700, you wrote: >I realize this statement I'm about to make is going to open a huge... >can o worms but ... and hoefully everyone knows I mean this in the most >friendly responsible way ever but I'm not sure entirely what the big >deal with spam is. Honestly sure I get it like everyone else, in some >of my accounts more than others but I also get a real truckload in my >snailmail box. Just as with all the pottery barn catalogs <no offense >to pottery barn I guess>:) I have a delete key just like my trash can. >I know at one time the argument was made, and quite correctly that >people were paying to receive this service and these messages cost them >money. Today with flat rate access and many people not paying on a per >packet basis it seems to me that the responsibility lies with the end >user to filter properly and or dress that delete key. I always shut >down customers who spam and disrupt service simply because I don't want >the backlash or want specific ips blocked but in a way I don't feel its >right that the carriers do the filtering it seems tome up to the end >user. > >On Fri, 3 May 2002, Mitch Halmu wrote: > > > > > > > On Fri, 3 May 2002, Paul Vixie wrote: > > > > > > I hate to sound like the big idiot here, but what exactly in the email > > > > you received indicates no-ip.com spammed? It looks to me like you just > > > > have some secret "admirer" who thought you wanted a no-ip.com account, > > > > and no-ip.com emailed you to confirm that you do want the account. > > > > > > spam is like pollution in that (a) whenever you're not sure if you're > > > doing it, you probably are, and (b) if everybody did whatever it is, > > > life would be universally worse for, well, everybody. > > > > > > > Random disclaimer: Yes, we're a competitor of no-ip.com's... And > yes, we > > > > used to send similar emails to people signing up for an account, > > > > although nowadays instead of sending them an initial password we send a > > > > confirm URL instead. > > > > > > that's the right approach. no-ip's problem was they presumed my > permission. > > > > > > > You don't even have to be in the "big idiot" league to figure out that in > > both the "wrong" and the "right" approach as sanctioned above by a higher > > authority, an email message (aka spam) is sent to the presumed subscriber. > > > > One sends a password, one asks for permission to issue a password on their > > site. What's the difference in the annoy factor, if indeed one were to be > > subscribed by a secret "admirer"? > > > > Mr. Halmu chose to think, rather than bindly obey... > > > > --Mitch > > NetSide > >

3 2

RE: ddos attack in progress... help needed
by Hassan, Shehzad 04 May '02

04 May '02

Reporting Security Incidents (PSIRT Advisories) http://www.cisco.com/warp/public/707/sec_incident_response.shtml#Incidents If you are under active security attack or believe that you are about to be attacked, contact the Cisco Technical Assistance Center at +1 408 526 7209 or +1 800 553 2447 or by any of the means listed under "Contact Summary" in this document. SH -----Original Message----- From: Rodney Joffe [mailto:rjoffe@centergate.com] Sent: Friday, May 03, 2002 8:15 PM To: NANOG Subject: ddos attack in progress... help needed Hello folks, We're undergoing a ddos attack on one of our machines. Its quite manageable so far - 28 source IPs, many of them cable modems. But its the first we've ever suffered, and before we get too deep in, I'd appreciate pointers to the appropriate law enforcement parties to contact so we can get to the root eventually. Offline is fine. If there's any value, I'm happy to provide the list. Sustained rate from each machine is around 2mbits per 5 min snapshot. -- Rodney Joffe CenterGate Research Group, LLC. http://www.centergate.com "Technology so advanced, even we don't understand it!"(SM)

2 1

RE: Effective ways to deal with DDoS attacks?
by LeBlanc, Jason 04 May '02

04 May '02

uRPF and Radware DoShield, one DoShield per link btw edge router and core router. Use IDS (yes there is a way to capture all your traffic and anaylyze it, regardless of bandwidth, no it isn't one box) to identify a signature, build a filter, config filter on DoShield, up to ~200Mb/s per DoShield of filtering with zero impact to legit traffic. Scale horizontally (add more links each with a DoShield on it) based on your ingress traffic. I've seen many suggestions on this list, this is the only thing that works for huge (100Mb/s+) attacks. eBay is likely the biggest target on the net, this works for us 90% of the time. Is the HW expensive? Yes. (~$35k per DoShield I think) It works, it scales. There is no way a Cisco router can handle filtering attacks past a certain point, nor is it capable of even filtering on some patterns in attack packets. Juniper is better, but still lacks some filtering capabilities. Your router is a router, not a packet filter, give up trying to make it do this until someone builds this into an ASIC on the router. Email me off list for more info. -----Original Message----- From: Pete Kruckenberg [mailto:pete@kruckenberg.com] Sent: Wednesday, May 01, 2002 4:18 PM To: nanog(a)merit.edu Subject: Effective ways to deal with DDoS attacks? There's been plenty of discussion about DDoS attacks, and my IDS system is darn good at identifying them. But what are effective methods for large service-provider networks (ie ones where a firewall at the front would not be possible) to deal with DDoS attacks? Current method of updating ACLs with the source and/or destination are slow and error-prone and hard to maintain (especially when the target of the attack is a site that users would like to access). A rather extensive survey of DDoS papers has not resulted in much on this topic. What processes and/or tools are large networks using to identify and limit the impact of DDoS attacks? Thanks. Pete.

5 6

DEC AS33 NOC Contact
by David McGaugh 04 May '02

04 May '02

Anyone have a good NOC contact for DEC, AS33? I checked Jared's NOC page and I don't see them listed. Reply off list if preferred. Thanks, Dave

3 2

ddos attack in progress... help needed
by Rodney Joffe 04 May '02

04 May '02

Hello folks, We're undergoing a ddos attack on one of our machines. Its quite manageable so far - 28 source IPs, many of them cable modems. But its the first we've ever suffered, and before we get too deep in, I'd appreciate pointers to the appropriate law enforcement parties to contact so we can get to the root eventually. Offline is fine. If there's any value, I'm happy to provide the list. Sustained rate from each machine is around 2mbits per 5 min snapshot. -- Rodney Joffe CenterGate Research Group, LLC. http://www.centergate.com "Technology so advanced, even we don't understand it!"(SM)

1 0

Re: /31 mask address
by rs＠seastrom.com 03 May '02

03 May '02

Simon Lockhart <simonl(a)rd.bbc.co.uk> writes: > On Fri May 03, 2002 at 10:30:05PM +0200, Andre Chapuis wrote: > > What IOS are you using /31s with ? > > Typically 12.0(x)S on GSR and VXR (where x is 10ish upwards) Not all 12.1(x)y does this properly, even if it was compiled over a year after that RFC went through and caused changes to 12.0S. Caveat utilitor. ---Rob

1 0

OT: Mobile Directories WAS: Large ISPs doing NAT?
by Rowland, Alan D 03 May '02

03 May '02

You would think the phone companies who already have most of the necessary resources, i.e. the yellow pages/directory listings, would be all over this idea as a way to sell thier device/generate even more listing revenue. Killer app: Cell Phone/PDA/GPSw Mapping,routing in a Palm form factor. Just my 2¢. The delete key is your friend. -----Original Message----- From: Scott Francis [mailto:darkuncle@darkuncle.net] Sent: Friday, May 03, 2002 10:43 AM To: Valdis.Kletnieks(a)vt.edu Cc: nanog(a)merit.edu Subject: Re: Large ISPs doing NAT? On Fri, May 03, 2002 at 08:29:32AM -0400, Valdis.Kletnieks(a)vt.edu said: > On Fri, 03 May 2002 00:12:34 PDT, Scott Francis said: > > > Your phone can surf porn? Maybe the technology revolution has finally arriv= > > ed > > after all ... > > No, it's still in the "dancing bear" stage. There's the question of whether > it's worth doing on that class display device.... > > On the other hand, if somebody's looking for a *business* opportunity, I > could see a *big* market for "Where do I find?" databases for GPS-capable > phones - I think somebody already did a "public restrooms in Manhattan", > and I know I've been in strange cities, known there was a specific restraunt > or store somewhere within 10 blocks, and been willing to pay for a reliable > hint for the parking garage nearest... that is an excellent idea. I know one thing I would LOVE to have is a search engine that can answer my question, "Where can I find a coffee house {optionally: with 802.11b} open after midnight during the week in Los Angeles {optionally: the Valley}?" No good answers so far ... at least, none that involve driving less than 30 minutes. :) -- Scott Francis darkuncle@ [home:] d a r k u n c l e . n e t Systems/Network Manager sfrancis@ [work:] t o n o s . c o m GPG public key 0xCB33CCA7 illum oportet crescere me autem minui

2 1

RE: Effective ways to deal with DDoS attacks?
by Gironda, Andre 03 May '02

03 May '02

On 5/3/02 12:05 PM, "Stephen Griffin" <stephen.griffin(a)rcn.com> wrote: > > Most Cisco boxes have 3 related modes of uRPF: 1) pure RPF, if > forwarding path back to source doesn't go via interface packet > received from, then dump. I believe, but am not positive, that it > will handle equal-cost-multipath ok in situations where that exists. > 2) acl exceptions, if source matches the acl, allow the packet 3) > not-so-pure RPF, if there is _any_ forwarding path back to the > source via _any_ interface, then accept. Speaking of this, has anyone seen Barry Greene's and Philip Smith's new book, "Cisco ISP Essentials"? It covers the uRPF strict mode as well using uRPF with multihoming examples, etc. I wish we could hear from them about it on this list. Actually, I'd rather hear it from people using it. Are there any configs out there that show uRPF with multihoming examples especially in ISP POP or IDC's? Let's say you have multiple ECMP on the back side and multiple transit providers and peers taking a mix of full and peering routes at the edge -- what would that look like? > for single-homed customers, simple uRPF for multihomed customers, > acl exceptions based upon their registered IRR-policy, since the > customer should already be registering in the IRR you have a list > of all networks reachable via the customer, regardless of the actual > real-time announcements or policy applications (prepending, localpref > tweaks, etc) for peers that are clued-in, again acl exceptions > based upon the peers registered policy for non-clued peers, accept > based upon any available forwarding path [hopefully, by the 100th > time you beat on the peer about spoofed crud coming from them, > they'll get religion and register, since you'll have less overall > spoofing to track down, you can devote it to slapping them around > more] ACL exceptions based on IRR policy? So you are using RtConfig or similar scripts to build your uRPF rules? Can you clarify this a bit more, or give some examples? On-list or off-list is fine with me. Thanks -dre

1 0

Co-locatation at MAE-West
by Andrew Staples 03 May '02

03 May '02

We have an available cabinet, with private 100mb FDDI connection, available for rent/sale at 55 Market Street, 11th floor. Please contact me off-list if interested. Andrew Staples "As the evening sky faded from a salmon color to a sort of flint gray, I thought back to the salmon I caught that morning, and how gray he was, and how I named him Flint."

1 0