- Test - lists.nanog.org

RE: Digital Island sponsors DoS attempt?
by Quibell, Marc 26 Oct '01

26 Oct '01

I actually thought about that being a problem, only if you block ALL ICMP messages. Any router beyond the blocking one will break PMTU discovery, so yeah you're right. One could always deny specific ICMP types.... Marc -----Original Message----- From: Bob K [mailto:melange@yip.org] Sent: Friday, October 26, 2001 1:45 PM To: Quibell, Marc Cc: nanog(a)merit.edu Subject: RE: Digital Island sponsors DoS attempt? On Fri, 26 Oct 2001, Quibell, Marc wrote: > Finally, I do not believe PMTU uses pings to discover the PMTU. I believe it > uses TCP or UDP packets at the layers above IP, and it DOES use "ICMP Packet > Too big" responses (from the receiver) to cut it's packet size. So in > reality, a router blocking ICMP from being routed through can still send > these ICMP messages PMTU needs. Is this how you understand it? Don't forget that routers or hosts beyond (from the point of view of the host attempting PMTU) your ICMP-blocking router may have smaller MTUs than the norm and may be trying to send ICMP errors back... -- Bob <melange(a)yip.org> | We're all wrong.

1 0

Rwhois, etc stuff from Global Crossing
by Dennis Boylan 26 Oct '01

26 Oct '01

At NANOG23 someone from Global Crossing mentioned that they had some rwhois and other stuff that they were going to release under the GPL. Can anyone elaborate on this? I would hate to have to write some of this if it has already been done. I've got an immediate need. Thanks, Dennis

2 1

RE: Fwd: Re: Digital Island sponsors DoS attempt
by Quibell, Marc 26 Oct '01

26 Oct '01

I see that you have no concept of what I just said. Thanks for the clarification. Marc -----Original Message----- From: James Thomason [mailto:james@divide.org] Sent: Friday, October 26, 2001 12:18 PM To: Quibell, Marc Cc: 'Mike Batchelor'; nanog(a)merit.edu Subject: RE: Fwd: Re: Digital Island sponsors DoS attempt They are using standard technology, Digital Island and Akamai did not invent ICMP. The methodology is new, and they have the right to use it. If you dislike the methodology, you can block it, or propose to the IETF that we change or remove ICMP. On Fri, 26 Oct 2001, Quibell, Marc wrote: > > Me thinks that when such technologies be commercialized on the net, there > will be problems. Usually, IP and such technologies are the charge of the > internet community and we form committees, or use IEEE, IETF, RFCs, > ARIN...etc for these and other technologies and come to open internet > standards and agreements on how to improve such things. Now we have these > people coming in here on their own and attempting to shove their technolgies > down our pipes w/o OUR concensus! Anyone now see the problem with this? I > believe this to be the key as to why this is wrong and why DI, or Akamai, > should not be even allowed to 'help' the internet. > > Marc Quibell > ICN Network Operations Center > Data Operations Group > noc(a)icn.state.ia.us > 1-800-572-3940 > > > > -----Original Message----- > From: Mike Batchelor [mailto:mikebat@tmcs.net] > Sent: Friday, October 26, 2001 11:51 AM > To: nanog(a)merit.edu > Subject: RE: Fwd: Re: Digital Island sponsors DoS attempt > > > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > in the case where the sender and receiver are communicating between one > > or many third parties, there is no direct relationship and thus no apriori > > terms of service to which the traffic must conform. for this, we > > reverse the > > model: "everything not welcomed is forbidden" and thus create a prior > > restraint problem which goes by the name "what, then, is implicitly > > welcome or unwelcome?" > > And how does the owner communicate this to the sender ahead of time? I > don't > think you can, else there would not be a spam problem. Therefore, the only > logical position the sender can take, if he is to act at all, is to assume > that whatever is not actively prevented or refused, is welcome, until such > time as he is notified otherwise. If it is not this way, how can ANY > unsolicited communication take place? Must I ask permission to ask > permission? > > - --- > "The avalanche has already begun. It is too late for the pebbles to vote" - > Kosh > > -----BEGIN PGP SIGNATURE----- > Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com> > > iQA/AwUBO9mUbEksS4VV8BvHEQJeQACfUpIpxRMDkZl/4CWpc/fUKF8wOFEAoKj2 > 1bhQXIg33MwAqB++ZOjlLr0r > =6hu1 > -----END PGP SIGNATURE----- >

1 0

Re: Fwd: Re: Digital Island sponsors DoS attempt
by Paul A Vixie 26 Oct '01

26 Oct '01

> > ..., the broader standard of "unwelcome" is more > > widely applicable than the narrow standard of "illegal." > > This is where we arrive at "Acceptable Use", which is why it is > required. But these policies need to be propogated and enforced at > smaller points of intervention. That's vaporware at the moment. Until it's realized, senders must follow a universal standard for determining whether their traffic will be welcomed by receivers and intermediate systems whose AUP's aren't published in a mechanised form and with whom the sender has no direct relationship, or contract, or terms of service. And unlike a direct relationship where it's safe to simply enumerate the things which mustn't be done and then assert that, subject to revision of that list, everything else is OK; in the indirect, transitive case where the recipient is distant and their policy isn't known, it's only safe to err on the side of extreme politeness: send what you know to be welcome, and hold onto the rest.

7 8

Re: Digital Island sponsors DoS attempt?
by Valdis.Kletnieks＠vt.edu 26 Oct '01

26 Oct '01

On Fri, 26 Oct 2001 09:32:39 PDT, Dave Siegel said: > If you have a list of prefix's you intend to measure, it would not be If. This list comes from *where*? What if I pointed out that IBM's AIX implements Path MTU Discovery by sending an ICMP packet with max MTU and the DF bit set (so it can discover the *max* MTU even if the first *TCP* packet is not a full MTU long)? Are you saying that I should contact each prefix that my Listserv machine is sending mail to, to get permission to negotiate PMTU discovery? Ouch. That's 600K subscribers, and I need to go look up where their MX entries point to, figure out what AS the destination is in, and send the AS contact mail (assuming that 'whois' actually has valid data) - and then repeat for every new subscriber to a list from an AS we haven't contacted before. No? That seems silly? How is it any different from 5 PING packets so a site can decide which server to send stuff from? Where do you draw the line? > transit providers needn't be involved, as transit providers typically > don't measure icmp flows bound to customers. We've seen cases where transit providers do things like install blackhole routing because they disagree with a site because of their traffic. This proves that at least *some* transit providers care about *some* traffic for *some* reason. Again, where do you draw the line? -- Valdis Kletnieks Operating Systems Analyst Virginia Tech

2 2

Re: Digital Island sponsors DoS attempt
by Quibell, Marc 26 Oct '01

26 Oct '01

Curious Chris, What IP's are they probing? LAN IPs? Or just the DNS server as they claim? And what then do these pings have to do with [quote from D.I.] "finding the nearest servers from our customers (Microsoft) to you"? What good does it do to ping to find distances, since the timing on the internet is not a constant, and neither are the pops, routes, hops...etc. This is why we use routing tables that are not constant... I really see no honest reason to be ping-probing one's LAN. And in the spirit of the internet and "good faith" behavior, a better explaination is warranted. > At 08:37 PM 10/25/2001, Christopher J. Wolff wrote: > > >Unfortunately, in this case I am not a customer of Digital Island in any > >way, nor have I given them authorization to hammer my network 441 times (and > >counting) in the last two hours. > > They're of the opinion that they don't need your permission... if they want > to hammer your network, they will. > > 'course, a nice ACL at the borders reminds 'em who your network actually > belongs to >

2 1

RE: Digital Island sponsors DoS attempt?
by Quibell, Marc 26 Oct '01

26 Oct '01

That's all fine Valdis, but no one does MTU check on the internet or pmtu checks. This is all LAN-based... -----Original Message----- From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] Sent: Friday, October 26, 2001 11:49 AM To: Dave Siegel Cc: nanog(a)merit.edu Subject: Re: Digital Island sponsors DoS attempt? On Fri, 26 Oct 2001 09:32:39 PDT, Dave Siegel said: > If you have a list of prefix's you intend to measure, it would not be If. This list comes from *where*? What if I pointed out that IBM's AIX implements Path MTU Discovery by sending an ICMP packet with max MTU and the DF bit set (so it can discover the *max* MTU even if the first *TCP* packet is not a full MTU long)? Are you saying that I should contact each prefix that my Listserv machine is sending mail to, to get permission to negotiate PMTU discovery? Ouch. That's 600K subscribers, and I need to go look up where their MX entries point to, figure out what AS the destination is in, and send the AS contact mail (assuming that 'whois' actually has valid data) - and then repeat for every new subscriber to a list from an AS we haven't contacted before. No? That seems silly? How is it any different from 5 PING packets so a site can decide which server to send stuff from? Where do you draw the line? > transit providers needn't be involved, as transit providers typically > don't measure icmp flows bound to customers. We've seen cases where transit providers do things like install blackhole routing because they disagree with a site because of their traffic. This proves that at least *some* transit providers care about *some* traffic for *some* reason. Again, where do you draw the line? -- Valdis Kletnieks Operating Systems Analyst Virginia Tech

2 1

RE: Fwd: Re: Digital Island sponsors DoS attempt
by Quibell, Marc 26 Oct '01

26 Oct '01

Me thinks that when such technologies be commercialized on the net, there will be problems. Usually, IP and such technologies are the charge of the internet community and we form committees, or use IEEE, IETF, RFCs, ARIN...etc for these and other technologies and come to open internet standards and agreements on how to improve such things. Now we have these people coming in here on their own and attempting to shove their technolgies down our pipes w/o OUR concensus! Anyone now see the problem with this? I believe this to be the key as to why this is wrong and why DI, or Akamai, should not be even allowed to 'help' the internet. Marc Quibell ICN Network Operations Center Data Operations Group noc(a)icn.state.ia.us 1-800-572-3940 -----Original Message----- From: Mike Batchelor [mailto:mikebat@tmcs.net] Sent: Friday, October 26, 2001 11:51 AM To: nanog(a)merit.edu Subject: RE: Fwd: Re: Digital Island sponsors DoS attempt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > in the case where the sender and receiver are communicating between one > or many third parties, there is no direct relationship and thus no apriori > terms of service to which the traffic must conform. for this, we > reverse the > model: "everything not welcomed is forbidden" and thus create a prior > restraint problem which goes by the name "what, then, is implicitly > welcome or unwelcome?" And how does the owner communicate this to the sender ahead of time? I don't think you can, else there would not be a spam problem. Therefore, the only logical position the sender can take, if he is to act at all, is to assume that whatever is not actively prevented or refused, is welcome, until such time as he is notified otherwise. If it is not this way, how can ANY unsolicited communication take place? Must I ask permission to ask permission? - --- "The avalanche has already begun. It is too late for the pebbles to vote" - Kosh -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com> iQA/AwUBO9mUbEksS4VV8BvHEQJeQACfUpIpxRMDkZl/4CWpc/fUKF8wOFEAoKj2 1bhQXIg33MwAqB++ZOjlLr0r =6hu1 -----END PGP SIGNATURE-----

2 1

Syndesis Postmaster/root contact?
by measl＠mfn.org 26 Oct '01

26 Oct '01

Is there a living breathing person on this list from syndesis.com? I have discussed this with other list members, and I m not the only one who gets the below attached "notice" from their domain EVERY time something goes out to nanog (regardless of content). Their filter is BROKEN, and dozens of politely worded notices (including examples such as the one below) have gone unacknowledged [to postmaster, MAIL-SA, administrator, etc.). This is not just annoying, I believe it violates nanog policy, no? -- Yours, J.A. Terranson sysadmin(a)mfn.org ---------- Forwarded message ---------- Date: Fri, 26 Oct 2001 12:33:32 -0400 From: System Attendant <MAIL-SA(a)syndesis.com> To: "'measl(a)mfn.org'" <measl(a)mfn.org> Subject: ScanMail Message: To Sender, sensitive content found and action t aken. Trend SMEX Content Filter has detected sensitive content. Place = Grant A. Kirkwood; Nick Thompson; Andy Dills; Christopher Wolff; nanog(a)merit.edu; Sender = measl(a)mfn.org Subject = Re: FWD: RE: FW: Getting hacked by Digital Isle? Delivery Time = October 26, 2001 (Friday) 12:33:32 Policy = Sexual Discrimination Action on this mail = Quarantine message Warning message from administrator: Sender, Content filter has detected a sensitive e-mail.

1 0

RE: Fwd: Re: Digital Island sponsors DoS attempt?
by Borchers, Mark 26 Oct '01

26 Oct '01

If ping testing scales as badly as you suggest, all of these products need to be yanked off the market asap. Putting such tools in the hands of millions of end users is certainly more of a threat than their use by network engineers. http://compnetworking.about.com/cs/pingtools/ > On Fri, 26 Oct 2001, Jonas Luster wrote: > > Jonas, > > It's one every 20 seconds from -one- ISP. What happens when > thousands of ISPs begin offering this service? > > a) more people are waken up at 3am by tripped IDS systems > > b) more people filter all icmp and break the internet > > c) more people have to add more acls to their routers to > prevent pushing > garbage as much as possible at the core, driving up cost and cpu > > > This service should clearly be "opt-in". > > Also, I believe the second comment made on this thread was > regarding the > idea that we implicitly give people permission to do this > sort of thing > by connecting to the internet (or per our sla/whatever). I > surely do not > give people permission to attack my network, why is this any > different? > Intentions? > > rgds, > > Adam >

1 0