- Test - lists.nanog.org

RE: LoadBalancing products: Foundry ServerIron
by Karyn Ulriksen 07 Jul '00

07 Jul '00

> How about Local Director? Everyone I've spoke to about LD is very unhappy with it's performance. -----Original Message----- From: Richard Colella [mailto:colella@aol.net] Sent: Thursday, July 06, 2000 5:38 AM To: nanog(a)merit.edu Subject: RE: LoadBalancing products: Foundry ServerIron Products are also available from Alteon, Cisco (Distributed Director) and Resonate. Last time I looked, none of these products does everything one wants, IMHO, but the set union of features comes pretty close. --Richard > > I believe BigIP has a product called DNS3 that serves a similar function. > One of our ".com's" uses it to support their dual co-lo set-up. > > -TY > > -----Original Message----- > From: Brantley Jones [mailto:bjones@redundant.net] > Sent: Wednesday, July 05, 2000 10:06 PM > To: nanog(a)merit.edu > Subject: RE: LoadBalancing products: Foundry ServerIron > > > > At 09:28 PM 7/5/2000 -0400, you wrote: > > >they also have the dns based solution > >available on serverirons. > >-- > >dima. > > Speaking of using a DNS proxy, does anybody know of anybody else doing this > besides Foundry?? > > Brantley > >

3 2

RBL-type BGP service for known rogue networks?
by Dan Hollis 07 Jul '00

07 Jul '00

Is there any RBL-type BGP service for blackholing known rogue networks? Eg, networks which harbor script kiddies and refuse to take any action when notified of ongoing attacks? For instance the network tin.it (194.243.154.0 - 194.243.155.255) appears to be rogue. -Dan

2 2

Re: RBL-type BGP service for known rogue networks?
by Dan Hollis 07 Jul '00

07 Jul '00

On Thu, 6 Jul 2000, Brian Sheppard wrote: > I doubt any such database exists publically. It's a liability issue for one > and if it was being compiled, officials at the big providers would probably > already have taken corrective action. These *exact* same arguments were used/continue to be used against RBL/RSS... -Dan

4 4

RE: bad idea?
by Jamie Rishaw 07 Jul '00

07 Jul '00

| In the event of a route flap, or other instability, you could | potentially | have traffic shifted to another server without the | established TCP state, | which would prompt that server to generate an RST and end the | connection. If the route then comes back, you end up resetting your | connection for nothing. True, but in the world of what-would-we-use-this-practice-for, it mostly applies to web, which for most intents is a one shot connect-get-drop; I doubt a single TCP RST would really irk too many users. | Actually, DNS works very well for this kind of thing. Since its a | stateless protocol it isn't affected by this, and once your | client has its | answer it continues to use the same IP, which is routed normally. I | believe this is how's Akamai load balancer works (try looking up | www.yahoo.com from a name server on the left coast and on the right | coast). I see absolutily nothing wrong with using DNS in this manner. I've been a fan of advertising one globally-routed block for server farms in multiple locations for some time. Think in global terms: If you have a farm in the States (West, East), add one in AU, one in EU, one in JP, you don't have to worry about a smart DNS server. Just one server, one IP address, advertised at each data center (or site) you're at (or are). If a certain site goes down (in my argument, say, the AU site goes down), the AU clients that would normally hit the AU site would be seamlessly (as far as "seamless" goes) directed to the next closest site. If a smart DNS server gave a local AU address, AU clients with the AU IP address cached would fail.

2 1

Re: RBL-type BGP service for known rogue networks?
by Richard A. Steenbergen 06 Jul '00

06 Jul '00

On Thu, 6 Jul 2000, Dan Hollis wrote: > > On Thu, 6 Jul 2000, Tony Mumm wrote: > > I think that is similar to what you want....and it might be adequate > > against scanners and other simple hacks. I don't think it would be > > worth anything against a flood, > > The BL wouldnt try to block floods or DoS attacks. Its aim is to block > sites which originate breakins. "Script kiddie" sites come in 3 flavors, the script kiddies themselves (dialups or cable modems for the 14 year olds), the "helper sites" aka the sites run by those who are friends of the SKs or associated with them (usually machines on college dorm ethernets or some 18 year old's "linux shell server" business project), and the compromised sites from which attacks are launched. You'd probably have more luck just reporting the security breaches on the hacked machines, I don't know too many places that will take NO action against them assuming you can actually contact them (which can sometimes be extremely difficult to do). Getting the dialups will not be possible with this kind of a system, DHCP makes it useless, and even sites with static addresses like most cable modems will probably not be pollitically possible. Sometimes its difficult to form a proven association between the people behind the mischief and the mischief itself, because after they lose one or two accounts they generally catch on and try not to do it from their direct connections, but its possible. The "helper sites" are questionable as well, I don't see this being viable against university connections, and as for the "helper /24s" these are almost always some 18 year old's attempt at a small business by colo'ing a Linux server at some provider, paying a few hundred for a small connection, etc. Most of these places receive as many attacks as they generate (if any), and quickly get tossed by their providers. I can think of very few actual networks who are entirely uncooperative regarding proveable issues, certainly not enough to make any kind of impact in the grand scheme of things IMHO. While spam has an economic motivation which can draw semi-legit networks into "bad" activities, SK stuff generally does not. I think these are the reasons such a blackhole list has never been done. An unresponsive smurf amplifier blackhole list on the other hand, might be useful... but probably wouldn't have a huge impact either these days... -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/humble PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

2 1

MCI Outage
by Larry McLemore 06 Jul '00

06 Jul '00

FYI At 17:10 all traffic from the initial MCI fiber cut has been restored. Larry

1 0

RE: scripts kiddie sites
by Karyn Ulriksen 06 Jul '00

06 Jul '00

Thanks, Scott. I figured that these were what was being referred to. I just never heard them referred to as scripts kiddies before. karyn -----Original Message----- From: Scott Francis [mailto:scott@virtualis.com] Sent: Thursday, July 06, 2000 3:01 PM To: Karyn Ulriksen Cc: 'nanog(a)merit.edu' Subject: Re: scripts kiddie sites Karyn Ulriksen wrote: > > For my edjumacation, could someone clarify what a scripts kiddie source > network as it's being bandied about here is? I can only *assume*, and I try > to avoid doing that (not always successfully). check rootshell.com, assorted BUGTRAQ postings, antionline.com, 2600.com, l0pht.com, cultdeadcow.com, etc. etc.and just start following links. CAVEAT: I am not saying that any of the above sites are exclusively script kiddie warehouses; however, I know from former experience that they are all good places to start if you're looking to crack some anonymous box somewhere. Most any well done Unix security site is. Please don't flame for either dissing a site you like or not including one that you think should be blackballed - this list was off the top of my head, and I haven't done any research on the subject in months. YMMV. -- Scott Francis ----BEGIN GEEK CODE BLOCK---- GCS/MC/>AT d--(?) s: a24 C++++ UBL++++$ P+++ L++@ E- W++(-) N+ o? K- w-- !O M-- !V PS+(-) PE Y+ PGP++ t* 5 X+ R(+) tv b++@ DI+++ D++@ G++ -----END GEEK CODE BLOCK-----

1 0

RE: RBL-type BGP service for known rogue networks?
by Karyn Ulriksen 06 Jul '00

06 Jul '00

Q. Yeah, but do we really want to black hole Exodus?? :) A. Ok, Yeah, we really do... but can we get away with it?!! :) :) Karyn -----Original Message----- From: Dan Hollis [mailto:goemon@sasami.anime.net] Sent: Thursday, July 06, 2000 1:39 PM To: Brian Sheppard Cc: 'nanog(a)merit.edu' Subject: Re: RBL-type BGP service for known rogue networks? On Thu, 6 Jul 2000, Brian Sheppard wrote: > I doubt any such database exists publically. It's a liability issue for one > and if it was being compiled, officials at the big providers would probably > already have taken corrective action. And those that dont take corrective action are those who need to be blackholed. -Dan

3 2

RE: RBL-type BGP service for known rogue networks?
by Karyn Ulriksen 06 Jul '00

06 Jul '00

Genuity used to do a lot of work with this type of service, they refered me to Paul Vixie for mediation when a site we hosted back when I was at AnaServe decided to spam the world and they blackholed us. Also, Paul Vixie (www.vix.net, I think)has some links to services of this type originally geared towards SPAM, but I'm sure it has these types of capabilities. -----Original Message----- From: Dan Hollis [mailto:goemon@sasami.anime.net] Sent: Thursday, July 06, 2000 11:53 AM To: 'nanog(a)merit.edu' Subject: RBL-type BGP service for known rogue networks? Is there any RBL-type BGP service for blackholing known rogue networks? Eg, networks which harbor script kiddies and refuse to take any action when notified of ongoing attacks? For instance the network tin.it (194.243.154.0 - 194.243.155.255) appears to be rogue. -Dan

7 8

Re: RBL-type BGP service for known rogue networks?
by Richard A. Steenbergen 06 Jul '00

06 Jul '00

On Thu, 6 Jul 2000 Valdis.Kletnieks(a)vt.edu wrote: > On Thu, 06 Jul 2000 12:22:09 PDT, Dan Hollis said: > > Im not talking about spammer networks im talking about script kiddie > > networks. We already have several systems for dealing with spammers but > > none for script kiddies. (I cant be the only person who sees a problem > > with this picture?) > > The biggest problem is that it's a lot easier to verify that a given site > is a spamhaus. Remember that source IP addresses (which is all that your > border router sees) are forgeable - making for a nice DOS attack. Forge > packets from a competitor's site, get them labelled as a skriptz kiddie site, > and BGP-blackholed. DoS attacks with possible spoofed source addresses would obviously not be a good criteria to blackhole by... Unauthorized mass vunerability scans on the other hand, COULD be. You'd have to make sure that it wasn't just a spoofed SYN flood designed to look like a scan, and that there were actual successfully opened sockets (this is assuming TCP scans). For certain things this pretty much entails setting up a "bait" server, perhaps binding a range of IPs on it, to look for at least the "obvious" scans. I suspect not as many people as you would think are qualified to setup and accurately use this kind of system (the number of stupid and paranoid people who will complain about innocent behavior is almost as high as the number of stupid and unconcerned people out there who will be compromised). -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/humble PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

4 4