- Test - lists.nanog.org

DDOS anecdotes
by smd＠clock.org 24 Jun '01

24 Jun '01

Some of you may find http://grc.com/dos/grcdos.htm very interesting. Sean.

15 24

Re: Operational Content, I think...
by prelude＠mindspring.com 24 Jun '01

24 Jun '01

I've used boxes as a brace, or mounted a shelf or another piece of equipment immediately below(or used already mounted equipment) to hold up stuff while I put down the screwdriver and slid it out. Most of the time i'm sure i've violated OSHA by doing it. This might be better answered on robbie's datacenter mailing list (datacenter(a)shorty.com) andrew still looking for a job deepak(a)ai.net wrote: > This comes up every now and then, and I still haven't seen a good solution, so here is the situation. Every now and then, the graveyard maintenance shift (read: few people) needs to mount a 7' tall or 600 lb piece of equipment we've all come to know and love in a rack. While pad jacks are available to move them around the datacenter floor, equipped with friendly hydraulics and all, there is a piece missing. Is there a common-sense piece of equipment available that 1 person can operate that will support a very bulky, rackmountable piece of equipment so the same, single person can mount/unmount it near the top of a rack? I have seen plenty of solutions for this on warehouse floors, but most datacenters don't have the ceiling height for track-crane. I don't know how people handle the 15' relay racks either now that I am sharing my gap in knowledge. Your advice, suggestions and even jokes are appreciated, but remember, I'm armed. :) Deepak

1 0

Re: BGP instability (was Re: Exodus Down)
by Andy Bradford 24 Jun '01

24 Jun '01

Thus said "Vivien M." on Sun, 24 Jun 2001 00:05:50 EDT: > > the following != "implies agreeing to an NDA" ?? > > 3. The information received via the list is considered > > confidential information, not to be reproduced in any form > > without prior written approval of Exodus. > > I hate to argue on NANOG about this, but #3 seems to me like it's an NDA > (although a rather informal one), for all intents and purposes. If they aren't encrypting the list traffic, then in reality, it isn't ``private'' or ``confidential'' email now is it? :-) Andy -- [-----------[system uptime]--------------------------------------------] 12:36pm up 46 days, 15:14, 7 users, load average: 1.25, 1.29, 1.24

1 0

BGP instability (was Re: Exodus Down)
by Sean Donelan 24 Jun '01

24 Jun '01

According to Exodus' trouble ticket it is a BGP instability between several locations in their network and with BGP customers. Whether it was a security issue, vendor bug or operator error hasn't been determined yet. Exodus customers should contact Exodus customer service for more information, reporters should contact Exodus media relations for more information. I don't know if Exodus will have any public statement. On Sat, 23 June 2001, "Richard A. Steenbergen" wrote: > On Sat, Jun 23, 2001 at 06:51:51PM -0400, mike harrison wrote: > > Maybe all this DDOS discussion is what killed Exodus? > > > > Websites and services all over the place seem to be down. > > Including my favorites like freshmeat, slashdot... > > and one of our e-commerce credit card processors: CyberSource > > > > The common route seems to take them into Exodus.net but not out again. > > > > Any idea whats up? > > Maybe they couldn't pay the bills and someone reposessed their routers? :P

7 8

RE: DDOS anecdotes
by Bohdan Tashchuk 24 Jun '01

24 Jun '01

> So what do we do about it? There are 10th of thousands of "0wned" machines > out there. 10.000 machines sending one SYN per second to somewhere > constitutes a 6mbit SYN flood that'll make almost any web server get into > trouble. 10 SYNs per second and we're really talking traffic here. From > spoofed sources because ISPs do not source address filter? Gah. Basically > untraceable. Wouldn't it be poetic justice if/when these "Owned" Windoze machines turn their attentions to www.microsoft.com? That would get Microsoft's attention. I don't care how big their pipes or how widely distributed their servers. A DDOS like this would be devastating.

2 1

Re: Exodus Down
by Dee McKinney 24 Jun '01

24 Jun '01

This from the SuSE Linux mail list may help :-) >>>>> Forwarded message from "Lewis E. Wolfgang" <wolfgang(a)nosc.mil> Something is definitely rotten here. Whois reports: Server Name: SLASHDOT.ORG.SUCKS.COMPARED.TO.JIMPHILLIPS.ORG IP Address: 24.240.60.16 Registrar: TUCOWS, INC. Whois Server: whois.opensrs.net Referral URL: http://www.opensrs.org Domain Name: SLASHDOT.ORG Registrar: NETWORK SOLUTIONS, INC. Whois Server: whois.networksolutions.com Referral URL: http://www.networksolutions.com Name Server: NS1.ANDOVER.NET Name Server: NS2.ANDOVER.NET Updated Date: 13-jun-2001 I've never seen whois report two registrars, especially one that says "SLASHDOT.ORG.SUCKS.COMPARED.TO.JIMPHILLIPS.ORG" I also noticed that traceroutes to both slashdot and freshmeat went through 64.14.80.154, then stopped at that point. I'd guess that some cracker broke something somewhere? Maybe a DNS crack? Maybe Andover went bankrupt and pulled the plug on us? Maybe Micro$oft is behind this? It sort of illustrates the hazards of having all the open-source eggs on one server farm.... Regards, Lew Wolfgang On Sat, 23 Jun 2001, ZephyrQ wrote: > > I've been trying all day to get my /. fix, as well as > Freshmeat! > > Did I miss an announcement? Or is there something else going > on? > >

6 5

peering requirements (Re: DDOS anecdotes)
by Paul Vixie 24 Jun '01

24 Jun '01

> ... but I do not blame their IP stack for this like Mr Gibson does though. Same here. > ... From spoofed sources because ISPs do not source address filter? > Gah. Basically untraceable. This is the problem. > What should we do? Recommendation: upgrade your peering requirements to include language like: Each peer agrees to emit only IP packets with accurate source addresses, to require their customers to do likewise, and to extend this requirement to all other peers by $DATE. Where DATE = (now() + '6 months') or some other negotiated value. I've been saying this since 1993. Is anybody ready to believe me yet? We solve this, or our industry stops growing because we're spending too much time dealing with this problem and new customers see diminished returns.

5 5

Re: peering requirements (Re: DDOS anecdotes)
by Sean Donelan 24 Jun '01

24 Jun '01

On Sat, 23 June 2001, Simon Lyall wrote: > Another point, if people are going to have filters then they MUST have a > quick and easy way for this filters to be changed and to propogate > everywhere quickly. People who insist that you provide an exact list of > what you want to advertise (with the exact prefixes) and then take a week > to process any changes (or 12 hours for that matter) should have prices to > match their discount level of service. I hear there are these really cool things called routing registeries. They allow providers to register and change their routing policies. There are tools which have automated the process. With routing registries who can register one-way, two-way, backup, standby, etc routing policies which don't depend on the active announcement of a route in the BGP tables, but allow the network sourced traffic to flow. RIPE, ARIN and MERIT have more information. Ask your network provider to support routing registries.

1 0

RE: BGP instability (was Re: Exodus Down)
by Sean Donelan 24 Jun '01

24 Jun '01

On Sat, 23 June 2001, "Vivien M." wrote: > > According to Exodus' trouble ticket it is a BGP instability between > > several locations in their network and with BGP customers. > > Hmmmmm... You somehow found a way to get this information without agreeing > to the NDA? Impressive. (For the people around here who aren't Exodus > customers: subscribing to their network engineering/outage list > theoretically implies agreeing to an NDA, which is presumably why no one > here mentioned this) I'm not subscribed to Exodus's network engineering mailing list, nor have I agreed to a NDA with Exodus about their outage information. Trying to apply an NDA to outage information has always struck me as a bit stupid. After all, NDA or not, people know you had an outage, what they don't know is your explanation why it happened. As we've seen, when there is a lack of good information, people will make up stories to fit. AT&T, with over 100 years experience of handling outages, seems to have thought out their policy better than some of the newer communication companies. AT&T doesn't go out of its way to advertise problems, but as far as I can tell, AT&T doesn't try to prevent its customers from telling other people about their experience with AT&T, good or bad. Think of it like a movie studio who only lets movie critics who agree to write good things about their movie see the movie. Whether this is "the" problem affecting Slashdot, a contributing factor, or unrelated, I do not know. Verizon also had DACS problems in Boston affecting circuits in the area. I believe Slashdot is located in the Boston area. And, of course, Slashdot has problems on a regular basis even when the network is working.

1 0

Re: for folks tracking DDOS sources or reading the GRC attack log
by Richard A. Steenbergen 24 Jun '01

24 Jun '01

On Sat, Jun 23, 2001 at 10:18:10PM -0400, RJ Atkinson wrote: > > 24.0/8 is the "cable block". ARIN normally allocates residential > cable modem subnets out of this space. Nearly all the cable operators > have one slice or another from this block. Nearly all North American > cable modems users have address space in this block. Cable modems > themselves are nearly always numbered in 10.0/8. > > For those who have read the GRC web site, note that 216.216.8.x > appears not to be a cable modem slice in any event. ARIN reports > that this slice has been allocated to @Work, which is the commercial > IP lease-line business unit within Excite@Home. Presence of a > *.home.net DNS entry does not mean the system is on any cable modem > network. There are no 24.0/8 addresses listed in the log at > http://grc.com/dos/attacklog.htm > so it isn't clear to me that any cable modems were used in that > particular attack. AFAIK 24/8 is exausted. My cable modem is numbered out of 65.4.208.0/19, and the announcement for this block is 65.0.0.0/13. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0