- Test - lists.nanog.org

Re: Inter-provider communications (Re: nobody @home)
by Patrick Greenwell 22 Jan '01

22 Jan '01

On Sun, 21 Jan 2001, Jared Mauch wrote: > On Sun, Jan 21, 2001 at 09:41:49PM -0500, Steve Sobol wrote: > > > > Patrick Greenwell wrote: > > > > > If a provider won't help their own paying customers, what chance is their > > > that they are going to help anyone that isn't their customer? > > > > I'm just waiting for one of the big NSPs to be sued due to complicity in > > an attack. That, essentially, is what we're dealing with. > > I don't see that happening anytime. If it's big enough to sue over > the law enforcement agencies get involved and they tend to get the > attention required to stop these attacks on the isp/nsp side. I think you are absolutely right, but not solely for that reason. Anyone big enough to play "my lawyers can beat up your lawyers" for real is likely to garner the attention of the provider and avoid litigation. So here we are with the Internet being ruled by lawyers.

1 0

Re: Inter-provider communications (Re: nobody @home)
by Patrick Greenwell 22 Jan '01

22 Jan '01

On Sun, 21 Jan 2001, Richard A. Steenbergen wrote: > On Sun, Jan 21, 2001 at 11:11:55AM -0800, Patrick Greenwell wrote: > > > > One large provider of hosting services who shall remain nameless in > > the hopes they will become more helpful through private discussion > > recently told one of my clients that placing RFC-1918 filters within > > their borders(the client was being DDOS'd in part from machines within > > that providers network) was "against policy" and they wouldn't do it. > > > > I shudder to think what they tell non-customers(if they even talk to > > them at all.) > > How would placing RFC1918 filters on that providers borders I said "within" not "on". To their credit the do have filters on their borders. > In all fairness, many large providers have a legitimate point when > refusing to deploy just any customer-request filter. Sure, but I'd hardly characterize this as some random request for just any customer-requested filter. They(the client) were undergoing a pretty significant DDOS attack in part being accomplished from within their(the hosting providers) network against another customer within their network, and the request (RFC-1918 filtering) isn't vodoo. > With most large hosting providers, what cisco markets as "core" routers > are required for customer aggregation. ACLs can have a serious impact on > performance and stability on these routers. And deploying filters "on > their borders" is a time consuming, performance impacting, perl-powered > mess. Huh? First, see above regarding "within" and "on." Second, RFC-1918 filtering is hardly a "time-consuming", "perl-powered" mess. > Why should they go through this for your 1Mbps of normal paid traffic > just so you can get on irc and taunt the packet kids with your "large > provider filters"? The client in question pushes a near constantly sustained 100Mbit and has no need, desire, and would see no value in tauting script kiddies on IRC. They're an attractive target simply because they are a high-profile site. If a provider won't help their own paying customers, what chance is their that they are going to help anyone that isn't their customer? Awaiting obligatory comments about moving away from said provider, SLAs, etc.... :-)

2 1

RE: Second day of rolling blackouts starts
by Sean Donelan 22 Jan '01

22 Jan '01

On Thu, 18 January 2001, "Steven J. Sobol" wrote: > Is anyone seeing lots of routing oddities? I'm not able to get to a lot > of sites that I normally can, that are hosted in different places; and I'm > wondering if some providers are routing around California outages. Not that I know of. There is something squirrely going on with the root name servers, but I haven't figured it out if it is just my location or more widespread.

6 6

Re: Inter-provider communications (Re: nobody @home)
by Basil Kruglov 21 Jan '01

21 Jan '01

On Sun, Jan 21, 2001 at 02:42:58PM -0500, Richard A. Steenbergen wrote: > How would placing RFC1918 filters on that providers borders help prevent > attacks originating from that providers network? Perhaps they should have > been busy tracing the attacker on their network? <not exactly related, but...> if you do host an irc server, or shell, or anything related to chat/irc... at some point attacks will become normal day to day events, no known NSP (to me) will be tracking those... no resources, time, most importantly -will- to justify it... "you're getting those daily, even if we do track this one down for you it won't make a bit of a difference" as for RFC1918, out-of-bgp table attacks, smurf/fraggle perhaps (?), new "loose" unicast RPF for Cisco might help, but only if big boys start putting this at edge (customer aggregation routers) to prevent stupid customers from spoofing, and at borders (peering points) to deny crap from peers... (if I'm not mistaken Verio, one of many who's doing this at some places, please do correct me if I'm wrong.) > In all fairness, many large providers have a legitimate point when > refusing to deploy just any customer-request filter. With most large > hosting providers, what cisco markets as "core" routers are required for > customer aggregation. ACLs can have a serious impact on performance and > stability on these routers. And deploying filters "on their borders" is a > time consuming, performance impacting, perl-powered mess. Why should they > go through this for your 1Mbps of normal paid traffic just so you can get > on irc and taunt the packet kids with your "large provider filters"? Yes.. yes... yes... personally I'd pay for that traffic, I can even work in 'no-filter' environment, but only if big boys work together to track and shut down those attacks, shut down smurf amps if they happen to be their customers/downstreams, etc.. "We provide transit to sh*tload of people, and we are not required to do any tracebacks, filtering...work with your upstream, bye bye.."; I've been getting this quite a lot lately... And what if my upstream is too damn tired or have no will to deal with it? Getting transit to someone else is not an option, simply no one is going to host or deal with you if you or your downstreams are getting 3-5, sometimes more attacks *daily*. I only see two options 1) get rid of all DoS-getting applications/clients, 2) peering, more peering, and even more peering never advertising prefixes that are getting attacked to certain companies that can't control their customers. > I've been accused of being anti-Cisco, but the simple fact of the matter > is that if you have a Juniper with an IP2 you will be able to filter > things that would make a GSR puke all over itself. "Cisco powered network" > be damned. Oh and just a quick note, just because someone has the > technically ability or the willingness to filter packets does not mean > they will be able to filter it well or stop the attacks. Oh yes... crisco sucks when it comes to performance. -Basil

1 0

Inter-provider communications (Re: nobody @home)
by Sean Donelan 21 Jan '01

21 Jan '01

On Sat, 20 January 2001, Dan Hollis wrote: > Youre lucky. Ive noticed an increasing trend that the NOC phone numbers > listed on corporate web pages come back as disconnected/RNA, and the > emails bounce "no such user". Real cute, especially when you're being > ddos'd. > > whois data is even worse. I suspect upwards of 25% of whois contact data > is worthless. This is not new, or even an increasing trend. I used to contact between 80 and 100 different NOCs every six months. I would call every NOC contact phone number, and ask them to confirm it was the correct phone number. Its amazing how many NOC's didn't know their own number. And when I told them what number I had dialed, didn't know that number was connected to their NOC. The phone number churn was a consistent 30%, even with contact information exchanged in accordance with written peer agreements. Every six months it would take me almost a week to reach 90 or so NOCs, and get the current contact information. In the case of a couple of NOCs, in three years I was never able to reach anyone at the NOC willing to confirm the information. I used to post the results of my "drill" on NANOG. IOPS set up a contact list for its members, and for a while was doing monthly drills. But since IOPS's keeps it a secret, I don't know how successful they've been. About two years ago, I proposed to all major providers we set up a set of permanent, private communication links between all the NOCs. The "phone number" would be your ASN(s). The system would be based on the same technology used by the NAWAS and NTA. Which lets you set up an instant conferences. I can set up the system so those providers who want to talk in "private," have conferences as small as two parties or as large as everyone on the network, while monitoring multiple circuits at the same time. 10 providers thought it was a good idea, but the two largest providers never responded to any inquiries. I can bring the idea out of mothballs again, if folks are interested.

4 4

The Pillsbury Doughboy vs. Engineers
by Jeff.Hodges＠kingsmountain.com 21 Jan '01

21 Jan '01

The Pillsbury Doughboy vs. Engineers http://slashdot.org/articles/01/01/20/227233.shtml Posted by timothy on Saturday January 20, @05:10PM from the who-would-you-bet-on? dept. Anonymous Coward writes: "Just when you thought things could not get more st[u]pid. Salon is reporting in this story that Pillsbury is sending cease-and-desist letters this week to universities and Sun Microsystems among others ordering engineers to stop holding what the doughboy company considers illegal "bake-offs." ... see also: Pillsbury Doughboy mauls techies http://www.salon.com/tech/log/2001/01/19/pillsbury/index.html] Structure of Protiens & DNA: Shake & Bake http://www.psc.edu/science/Hauptman/Hauptman.html

1 0

Re: nobody @home
by Dan Hollis 20 Jan '01

20 Jan '01

On Sat, 20 Jan 2001, Basil Kruglov wrote: > On Sat, Jan 20, 2001 at 02:10:18PM -0500, Jim Mercer wrote: > > i've always found the list at http://puck.nether.net/netops/nocs.cgi to be > > most helpful, including reaching noc@home. > Only when it comes to routing issues/problems, not security - > "[d]DoS-in-progress" issues. :| > 90% of those "NOCs" are help desk phone numbers, and it takes at least > good 30-60min+ to get to the real NOC/people, if ever. Youre lucky. Ive noticed an increasing trend that the NOC phone numbers listed on corporate web pages come back as disconnected/RNA, and the emails bounce "no such user". Real cute, especially when you're being ddos'd. whois data is even worse. I suspect upwards of 25% of whois contact data is worthless. -Dan

1 0

Re: nobody @home
by Daniel L. Golding 20 Jan '01

20 Jan '01

Great. Every NOC in the country has just been slashdotted, as well as this list. Some of the key suggestions posted on that fine forum include: 1) Calling the NOC (i.e. http://puck.nether.net/netops/ was posted as a link) if you have a problem as an individual user. 2) Launch DDOS attack on offending ISPs 3) Post emails to NANOG to find clueful network engineer types, to help you with your email problems. Needless to say, prepare for calls and emails from some "E1it3 Dud3Z". After all, they read it on Slashdot... :) Oh well, information wants to be free. Daniel Golding NetRail,Inc. "Better to light a candle than to curse the darkness" On Sat, 20 Jan 2001, Philippe Landau wrote: > > http://slashdot.org/article.pl?sid=01/01/19/081222&mode=thread > Contacting Network Admins Of Large Internet Companies? > > kind regards philippe, http://InternetRoot.com/ >

1 0

Re: Cisco PIX
by abt 20 Jan '01

20 Jan '01

http://www.interhack.net/pubs/fwfaq/ rc. ----- Original Message ----- From: "Dave McKay" <dave(a)sneakerz.org> To: <deen(a)slt.lk> Cc: <nanog(a)merit.edu> Sent: Saturday, January 20, 2001 5:53 AM Subject: Re: Cisco PIX > > http://www.cisco.com/warp/public/110/38.html > > deen(a)slt.lk (deen(a)slt.lk) wrote: > > > > > > Hi!! > > > > Has anybody configured the Cisco PIX F/w as a VPN. Any feelers will be welocome. > > -- > Dave McKay > dave(a)sneakerz.org > Microsoft Global Network Architect >

1 0

Sprint / C&W peering issues?
by jlewis＠lewis.org 20 Jan '01

20 Jan '01

The past few days, I've been noticing packet loss, apparently at the points where Sprint and C&W exchange traffic. Today, I emailed a note about this including the output from a few mtr's in each direction to noc(a)sprint.net, and though I got no reply, an hour or so later, I noticed packets were taking a slightly different route (apparently going through a different peering connection in a different city if you believe the hostnames) and the packet loss was gone and round trip times much better. I left the office for a bit, and now that I'm back, I see the packets are back to using the old peering connection that I can only assume must be overloaded. Anyone know what the deal is? Matt's traceroute [v0.42] orldfl-ns-1.atlantic.net Fri Jan 19 18:58:51 2001 Keys: D - Display mode R - Restart statistics Q - Quit Packets Pings Hostname %Loss Rcv Snt Last Best Avg Worst 1. orldflwcom-br-1-fe0-0.atlantic.net 0% 30 30 0 0 0 1 2. sl-gw8-orl-3-0-TS11.sprintlink.net 0% 30 30 1 0 1 1 3. sl-bb11-orl-5-2.sprintlink.net 0% 30 30 1 1 1 2 4. sl-bb21-atl-9-1.sprintlink.net 0% 30 30 11 11 11 12 5. sl-bb2-atl-0-0-0.sprintlink.net 0% 30 30 12 11 30 190 6. core3-serial2-0-0.Atlanta.cw.net 20% 24 30 37 33 37 41 7. corerouter1.Atlanta.cw.net 27% 22 30 34 33 36 50 8. acr1-loopback.Atlantaald.cw.net 20% 24 30 36 32 37 39 9. bar7-loopback.Atlantaald.cw.net 27% 22 30 48 33 37 48 10. ??? Hop 10 is a router with some packet filtering...no response is expected there. -- ---------------------------------------------------------------------- Jon Lewis *jlewis(a)lewis.org*| I route System Administrator | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

2 1