- Test - lists.nanog.org

Blech!
by Paul Ferguson 13 Feb '00

13 Feb '00

I hate to ask this, but can't bite my lip, given the fact that people are throwing lawyers at this stuff now. Is it within the realm of possibility that ISP's will start to craft SLA's, peering & transit agreements, to include who is responsible for ingress filtering? I would think so. Also, if so, do you think that this would technically be effcient, given that the filters would actually be applied? Feel free to be silent, - paul

7 8

RE: Cisco - ip verify unicast reverse-path
by Paul Ferguson 13 Feb '00

13 Feb '00

At 02:06 PM 02/13/2000 +0100, Erik-Jan Bos wrote: > >There's always RFC2267. > >Nice RFC, IMO, who wrote that piece of fine work? :-). Some trouble maker... ;-) - paul

1 0

Cisco - ip verify unicast reverse-path
by trall＠almaden.ibm.com 13 Feb '00

13 Feb '00

This command has been mentioned numerous times during the DDoS discussion. I, for one, don't have a good idea of how it works. Perhaps someone can enlighten us? Cisco's web site certainly doesn't do much to help the situation. I found it mentioned in the guide (not the reference) for the Cat 6000 (http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/ios127xe/config…) - no description of syntax, let alone what it does. And then there is http://www.cisco.com/warp/public/707/newsflash.html. It says that the RPF check is based on CEF. I'm not familiar with CEF and want to clarify something about unicast RPF. If the source address of a packet arrived on an interface that would not be the preferred route for that address but is one of the less-preferred routes would the packet get dropped? If, as I hope, it would not, I don't understand the argument that it doesn't work for multi-homed connections. Such systems should be advertising their routes over all connections - thus the routes should appear on all paths outbound from the multi-homed systems (less any long prefix filtering being done by the upstreams). Another issue is why has Cisco made this such a stealth feature? Is it still buggy? Are the side-effects of using it so negative that hardly anyone can use it? If any such speculation is true, the folks advocating the use of this feature should also be pointing out the downside. Tony Rall

4 3

RE: Cisco - ip verify unicast reverse-path
by Paul Ferguson 13 Feb '00

13 Feb '00

At 09:18 PM 02/12/2000 -0500, jlixfeld(a)idirect.com wrote: >Correct me if I'm wrong, but it has the potential to cause more damage than >anything else if you network routes asynchronously. I turned it on a while >ago and noticed my in and outbound traffic dropped by about 60%. I'm sure >that the 60% drop in traffic had to do with traffic coming into the network >on one interface and being local pref'd out a different interface. > >Because of the asynchronous routing, it's useless in my environment, unless >there is a knob that doesn't cause it to break under these circumstances. > >If not, would this feature not be best suited for ISPs who are not in a BGP >relationship with their upstreams? Like everything else, it depends. There's always RFC2267. - paul

1 0

Make Inggress Filtering the LAW for all ISPs!
by Toplez Razer 12 Feb '00

12 Feb '00

It should eliminate 99.9% of DOS attacks! Audie Onibala ____________________________________________________________________ Get free email and a permanent address at http://www.netaddress.com/?N=1

7 7

[fwd] Lawyers Forsee Denial Of Service Suits
by Paul Ferguson 12 Feb '00

12 Feb '00

It has begun. Sigh. FYI, - paul http://www.techweb.com/wire/story/TWB20000211S0014

2 1

Re: Internet SYN Flooding, spoofing attacks
by Mark Prior 12 Feb '00

12 Feb '00

This is a small percentage, I would thing, since the percentage of ISP's offering transit pales in comparison to all other "access" ISP's that do not. And in cases where ISP's _do_ offer transit, or have transit agreements, will they really do this on their transit interfaces? I think not. Maybe not as small as you think when simplex satellite is involved. Mark.

1 0

Re: Internet SYN Flooding, spoofing attacks
by Mark Prior 12 Feb '00

12 Feb '00

We (at least cisco, anyways) already have a knob for this: [no] ip verify unicast reverse-path We call it Unicast RPF. And its well documented... NOT and available on all routers/interfaces... NOT If it was documented and available on things like PRIs then it would be a lot easier to deploy. Also some of the bugs that turn off CEF need to be addressed (or at least also cause "ip verify unicast reverse-path" to be turned off too). Mark.

1 0

POWER OUTAGE: Palo Alto California
by Sean Donelan 12 Feb '00

12 Feb '00

There is a power failure in parts of Palo Alto California. I bring this up because the last time Palo Alto had power problems, several providers had significant outages. So far, it appears major providers are operating normally. Outages are confined to individual customers, which I assume is due to loss of power at the customer location.

1 0

Re: Internet SYN Flooding, spoofing attacks
by Paul Ferguson 12 Feb '00

12 Feb '00

At 10:44 PM 02/11/2000 -0500, Vijay Gill wrote: >I suspect we are in violent agreement here. Violent agreement. What a concept! ;-) - paul

1 0