- Test - lists.nanog.org

Re: Yahoo! Lessons Learned
by robert＠UU.NET 10 Feb '00

10 Feb '00

> > i am rather amused at folk who fear dialup systems being used as ddos > slaves. > I'm more worried about a master being connected there. Remember, with at least one of the tools you can trigger the "slaves" via forged ICMP reply messages. It doesn't take a fat pipe to do that and it makes finding the perp that much harder, especially since dial connections are generally more anonymous. Yes, we have tested "source validation" in our live dial network. Yes, there is a performance impact. "Can do" or "Can't do" depends on how many dial customers you are trying to pile into one box, and what equipment you are using. Also, ingress filtering one-hop-up isn't necessarily so easy. Some of us will dynamically route prefixes other than /32 to certain dial customers. This complicates things.

2 1

Re: NANOG meeting subject of attack? Hmmmm....
by Bino Gopal 10 Feb '00

10 Feb '00

As Charles says, from what I've read of the CERT advisories, there is nothing proactive one can really do for these DDos attacks, besides securing machines from being hacked, correct? Also note that the link that Paul gave to the cnet story doesn't mention anything about NANOG (for those who were looking). That only came later tonight, by 8:30pm with this story: http://news.cnet/com/news/0-1005-200-1545456.html Also see CNN (as they got hit) at: http://cnnfn.com/2000/02/08/technology/yahoo/ Looks like the news organizations have picked up on the timing 'coincidence' (if it was one). Apologies if this is old news; I just didn't see any mention of it yet, and it seemed rather operational, given the nature of what happened. :) BINO On Tue, 8 Feb 2000, Charles Sprickman wrote: > On Tue, 8 Feb 2000, Christian Nielsen wrote: > > > > On Tue, 8 Feb 2000, Paul Ferguson wrote: > > > > > http://news.cnet.com/news/0-1007-200-1544910.html?dtn.head > > > > I guess the only way to 'protect' against something this big would be to > > follow Pauls RFC and/or have big, fat pipes sitting idle. > > It's my understanding that these recent attacks are DDoS attacks, which > really don't need to involve any address spoofing. The MO would look > similar to a smurf (many different source addresses bombarding you), but > here the negligent (call the lawyers?) party with the hacked Solaris boxes > running out-of-the-box configs would not be helped by said RFC, right? > > > This is a sad day for the internet. :( > > Just a reminder that we are working in a anarchic, non-cooperative > business, that's all :) > > Charles > > > Christian

2 1

IRR/RADB (was Re: Yahoo! Lessons Learned)
by Sean Donelan 10 Feb '00

10 Feb '00

On Wed, 09 February 2000, Henry Kilmer wrote: > Kai Schlichting writes: > >I recall that SprintLink had some, uhm, plans to put ingress (and > >egress?) filters on all interfaces facing dedicated customers that > >were not multi-homed. This came after realization that education of > > This becomes rather difficult to do properly when a large percentage > of an ISPs customer base are multihomed. The unicast RPF check knob > does not handle this situation so you are left generating access > lists which has different scaling issues to contend with. Still > doable but more difficult. I know this is in the category of beating a dead horse, but.... This sounds like the perfect application for the IRR/RADB.

1 0

Which Part(s) Failed in the recent DOS Attacks?
by Toplez Razer 10 Feb '00

10 Feb '00

1. Was it the firewall DOS filter? 2. No firewall in Yahoo, EBay, ETrade, etc? 3. Firewall DOS filter worked, but the links were still clogged with massive ACKs/NACKs? Thanks, Audie Onibala ____________________________________________________________________ Get free email and a permanent address at http://www.netaddress.com/?N=1

2 1

RE: Yahoo offline because of attack (was: Yahoo network outage)
by Shawn McMahon 10 Feb '00

10 Feb '00

As co-moderator emeritus of Fidonet's CONSPRCY echo, I love a good conspiracy theory as much as the next guy, but let's get real, folks. No deeper motive need be applied to this than "ActiveX sucks, and I'm gonna show 'em" or "wow, look what I can do if I combine these two script-kiddie exploits I found on rootshell.com" or "oh, yeah? Prove it." The latter being the driving force behind many destructive hacks over the years. Until we have enough facts, Occam's Razor isn't very useful, but it would seem to exclude government-backed weirdness. At 10:37 AM 2/9/2000 -0800, you wrote: >It would make one hell of an excuse for those wishing more government(s) >involvement/control....

3 2

Data Center design.
by foo 09 Feb '00

09 Feb '00

I'm wondering if there are any mailing lists or other resources concerning building, designing, and maintaining Data Centers. I've found some vaguely helpful resources from netsearches, but so far I've been pretty disappointed with the amount and level of the available information. Are there any books? Any respected "authorities"? Is everyone learning as they go, or are all of the new Internet DC's being built by old-school mainframe/datawarehouse types? Any related information would be appreciated. Use private email unless you enjoy being spanked by the nanog.police (I'm sure someone will think Data Centers have nothing to do with network operations). -Brian

1 0

Re: Yahoo offline because of attack (was: Yahoo network outage)
by George Herbert 09 Feb '00

09 Feb '00

Scott Crowby wrote: >George Herbert wrote: >> Assume there's 40k of data in the homepage. >> How many bytes of SYN-SYNACK-ACK-GET / HTTP/1.0\n does it take >> to do a TCP connect and request? I just tested, I show 160 bytes. >> That's a 250:1 leverage for the attacker. To fill 1 GBPS worth >> of outbound trunking you only need to generate 4 MBPS (32 Mbps) >> worth of input. 50ish systems with T-1 connectivity gets there >> with margins. > >I don't have posting privledges on NANOG, so forward if you think it is >appropriate... But this is false, >Yes, you can send 160 bytes and the HTTPD will attempt to send 40kb, but >the TCP stack won't actually send it all unless it gets ACK's from the >reciever, which means that the reciever has to be able to accept at least >some of that traffic. If there is sufficient congestion to keep the >traffic from arriving and ACK's being sent, the sender will slowdown. >So this type of attack would be throttled on the initiator's side through >TCP slowdown and missed ACK's. I missed this when I origionally posted last night, but not completely. If attacker has raw socket or TCP stack manipulation on the attacking box then they can "cheat" and pre-send ACKs for data not actually received yet once the connection opens up. This is explained in detail in several articles in the ACM SIGCOMM journal over the last year and other sources. It requires a bit more work by the attacker but forces the victim to send all the data (most of which is then discarded silently by routers somewhere upstream of the attacker due to congestion, and not noticed by the victim because of the faked ACKs). In reality the technique hits statistical limits due to that congestion losing the SYN/SYNACK/ACK/HTTP GET packets needed to set up the connections in the first place, although all of those are re-sent if not properly acknowledged the throughput of TCP drops through the floor as loss rates increase as high as they will when doing this type of attack. But if bigger packets are more likely to get dropped (typical attack total packet 60 bytes, response 1k) then you can get a fair leverage out of it even so. -george william herbert gherbert(a)crl.com

1 0

RE: Yahoo offline because of attack (was: Yahoo network outage)
by Declan McCullagh 09 Feb '00

09 Feb '00

At 10:37 2/9/2000 -0800, Patrick Greenwell wrote: >It would make one hell of an excuse for those wishing more government(s) >involvement/control.... Even though I live in DC, I'm not that conspiratorial. Though I do note that the attack started the same day the president introduced his budget, which has a big increase in "cyberterrorism" defense and a HUGE increase in wiretappability funding :) More: http://www.wired.com/news/politics/0,1283,34164,00.html -Declan

1 0

etrade+zdnet reported attacks
by Jared Mauch 09 Feb '00

09 Feb '00

cnn.com reports more attacks. are folks locking down their source-filtering this week? please do. I understand this will not help with all attacks, but it should continue to help. - jared -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine. END OF LINE |

1 0

Congestion or regression testing DDoS
by Sean Donelan 09 Feb '00

09 Feb '00

After finding out more about the current round of denial of service attacks, I think I have an answer for several of the periods of congestion different providers experienced during the last couple of weeks of January. In January there were several reports of unusually large amounts of traffic. This caused congestion problems at several different places, but no provider or company made any public reports. With 20/20 hindsight it appears someone was testing how well their DDoS tool worked on less noticable sites. The engineers I spoke with indicated they saw heavy congestion on certain links for a few hours, but it would stop on its own accord. Later, they would see the same congestion, and again it would stop. If you think of it as "congestion" instead of a DoS, are there any tools we use to control congestion which could be adapted to lessen the effects of a DoS? Would RED(and RED variations), rate limiting, or any of the many QoS knobs help?

3 2