- Test - lists.nanog.org

Re: Yahoo offline because of attack (was: Yahoo network outage)
by George Herbert 09 Feb '00

09 Feb '00

Roeland wrote: >I smell denial here. The compromised systems (only 52?) had to have access >to pipes at least 1 Gbps in size, in order to carry out this attack (do the >math yourself). Either there were many more systems participating (in itself >a scarey thought) or many of these large and professionally run systems are >owned and their operators don't know it. The only other alternative is the >conspiracy theory from hell. No, they don't. Assume there's 40k of data in the homepage. How many bytes of SYN-SYNACK-ACK-GET / HTTP/1.0\n does it take to do a TCP connect and request? I just tested, I show 160 bytes. That's a 250:1 leverage for the attacker. To fill 1 GBPS worth of outbound trunking you only need to generate 4 MBPS (32 Mbps) worth of input. 50ish systems with T-1 connectivity gets there with margins. [Note that this is an a priori analysis; I haven't bothered to find the attack codes in question and see if that's what they're doing, nor am I involved in any of the current operational response] Back in Nov 1996 when Sun was pushing WebNFS initially with the Solaris 2.6 release, I wrote up a vulnerability analysis white paper using the UDP NFS functionality and this leverage approach and sent it in to Sun. I suspect the ultimate inability to secure against it was one reason WebNFS died on the vine. With full HTTP, you need more request bytes and a valid origionating IP address since it's TCP... you need the SYN, SYNACK, ACK to work before you send the request. But there's enough leverage anyways with modern pagesizes (8k was big then, it's nothing now... 40k worth of html is typical) for it to work anyways. The only downside to doing it in HTTP is that all the attacking systems are clearly identified since they have to use real routed IP addresses. -george william herbert gherbert(a)crl.com

3 2

Re: NANOG meeting subject of attack? Hmmmm....
by Paul Ferguson 09 Feb '00

09 Feb '00

At 01:25 AM 02/09/2000 -0500, Bino Gopal wrote: >Also note that the link that Paul gave to the cnet story doesn't mention >anything about NANOG (for those who were looking). That only came later >tonight, by 8:30pm with this story: I was attempting humor. The linkage was Exodus, who hosted this NANOG (and they did a great job of noth connectivity at NANOG, as well as mitigating the DDoS attacks on ther customers). - paul

1 0

NANOG meeting subject of attack? Hmmmm....
by Paul Ferguson 09 Feb '00

09 Feb '00

See: http://news.cnet.com/news/0-1007-200-1544910.html?dtn.head - paul

7 7

RE: Yahoo! Lessons Learned
by Ron Buchalski 09 Feb '00

09 Feb '00

Ken writes: >From: "K. Graham" <kgraham(a)ican.net> >To: nanog(a)merit.edu >Subject: RE: Yahoo! Lessons Learned >Date: Tue, 08 Feb 2000 09:47:58 -0700 > <snip> >It was mentioned that this was a co-ordinated attack. That meant a bit of >planning and access to various machines. As to the number of attackers >only Yahoo's internal people may know. Even then it may have only been one >individual with a script that accessed many locations at one time and >initiated the commands. There is the ability to do such an attack. It's an interesting coincidence that, at roughly the same time that the attack was taking place, we were sitting in the NANOG meeting listening to a presentation on Distributed Denial of Service attacks. It's definitely a major threat... -rb ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

2 1

Strange announcements for www.cisco.com
by Neil J. McRae 09 Feb '00

09 Feb '00

To QWEST NOC PEOPLE Folks, You appear to be announcing 198.133.219.0, which is the network that www.cisco.com lives on, whats strange is that you are then transiting this route onto GTEI [AS1] to deliver the traffic. This is fairly sub-optimal and I'm sure incorrect. kenny>sh ip bgp 198.133.219.25 BGP routing table entry for 198.133.219.0/24, version 23258497 Paths: (4 available, best #1, advertised over IBGP) 3356 209 209.244.160.57 from 209.244.160.57 (209.244.2.210) Origin IGP, metric 4401, localpref 100, valid, external, best 3356 209, (received-only) 209.244.160.57 from 209.244.160.57 (209.244.2.210) Origin IGP, metric 4401, localpref 100, valid, external 1 109 4.1.74.105 from 4.1.74.105 (4.0.4.8) Origin IGP, metric 11340, localpref 100, valid, external Dampinfo: penalty 492, flapped 1 times in 00:00:23 1 109, (received-only) 4.1.74.105 from 4.1.74.105 (4.0.4.8) Origin IGP, metric 11340, localpref 100, valid, external kenny>traceroute www.cisco.com Type escape sequence to abort. Tracing the route to www.cisco.com (198.133.219.25) 1 serial4-0-3.hsa1.nyc1.Level3.net (209.244.160.57) [AS 3356] 0 msec 0 msec 0 msec 2 hsipaccess2.Denver1.Level3.net (209.244.2.61) [AS 3356] 48 msec 48 msec 48 msec 3 hsipaccess2.Seattle1.Level3.net (209.244.2.23) [AS 3356] 76 msec 72 msec 76 msec 4 209.0.227.130 [AS 3356] 76 msec 200 msec 148 msec 5 sea-core-01.inet.qwest.net (205.171.26.53) [AS 209] 76 msec 72 msec 76 msec 6 sfo-core-02.inet.qwest.net (205.171.5.105) [AS 209] 84 msec 84 msec 84 msec 7 sjo-core-01.inet.qwest.net (205.171.5.121) [AS 209] 80 msec 80 msec 80 msec 8 sjo-edge-05.inet.qwest.net (205.171.22.46) [AS 209] 84 msec 84 msec 80 msec 9 a5-0-1.sanjose1-nbr1.bbnplanet.net (4.24.145.1) [AS 1] 84 msec 84 msec 84 msec 10 p4-0.paloalto-nbr2.bbnplanet.net (4.0.1.1) [AS 1] 84 msec 84 msec 84 msec 11 p0-0-0.paloalto-cr18.bbnplanet.net (4.0.3.86) [AS 1] 84 msec 84 msec 84 msec 12 * * * 13 pigpen.cisco.com (192.31.7.9) [AS 109] 88 msec 88 msec 88 msec 14 www.cisco.com (198.133.219.25) [AS 209] 88 msec 84 msec 88 msec A fix/explanation would be useful. Regards, Neil. -- Neil J. McRae C O L T I N T E R N E T neil(a)COLT.NET

1 0

Re: MAE-East Problems?
by NANOG Mailing List 09 Feb '00

09 Feb '00

Ahem: > > No problems getting to MAE-East. Just getting things THROUGH it. I'm reporting 20% loss THROUGH the MAE, not *TO* the MAE. On Tue, 8 Feb 2000, Adam Rothschild wrote: > Hi, > > I'm a bit confused here. You're reporting 20% packet loss, and then > pasted ping output indicating zero packet loss. What's the dilly? > > -adam > > On Tue, Feb 08, 2000 at 02:38:19PM -0500, NANOG Mailing List wrote: > > > > > > Is anyone else having problems with packet-loss through MAE-EAST? We're > > down 20% to MAE-E and I'm almost certain it is as result of packet-loss. > > > > No problems getting to MAE-East. Just getting things THROUGH it. > > > > core1-Col>en > > Password: > > core1-Col#term length 20 > > core1-Col#ping > > Protocol [ip]: > > Target IP address: vie1 > > Translating "vie1"...domain server (206.183.224.8) [OK] > > > > Repeat count [5]: 250 > > Datagram size [100]: > > Timeout in seconds [2]: > > Extended commands [n]: > > Sweep range of sizes [n]: > > Type escape sequence to abort. > > Sending 250, 100-byte ICMP Echoes to 206.183.226.36, timeout is 2 seconds: > > !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! > > !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! > > !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! > > !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! > > Success rate is 100 percent (250/250), round-trip min/avg/max = 20/25/36 > > ms > > > > > > John Fraizer > > EnterZone, Inc > > >

3 2

Re: multicast stream
by Paul Thornton 08 Feb '00

08 Feb '00

Hi, Its "just started working"! FYI, I'm using vic and I'm on 216.33.132.41. The quality is breaking up a bit but I suspect thats just a roomful of notebooks all hammering the wavelan kit :-) On Tue, 8 Feb 2000, Joel Jaeggli wrote: > you're at the meeting? what tool and what ip do you have? are you using > I'd be interested to see if I can see you joined. > > joelja > > On Tue, 8 Feb 2000, Paul Thornton wrote: > > > > > Is anyone else failing to get the H261 stream? I had it yesterday afternoon > > but have been able to get it from the meeting net all morning... > > > > -- > > Paul > > > > > > -------------------------------------------------------------------------- > Joel Jaeggli joelja(a)darkwing.uoregon.edu > Academic User Services consult(a)gladstone.uoregon.edu > PGP Key Fingerprint: 1DE9 8FCA 51FB 4195 B42A 9C32 A30D 121E > -------------------------------------------------------------------------- > It is clear that the arm of criticism cannot replace the criticism of > arms. Karl Marx -- Introduction to the critique of Hegel's Philosophy of > the right, 1843. > > > -- Paul -= Paul Thornton, 2 Durnford Way, Cambridge, CB4 2DP, UK. +44 1223 575384 =-

1 0

RE: junk fax
by Robert Cannon 08 Feb '00

08 Feb '00

You may be interested in the following webpages: ** What you can do about unsolicited telephone marketing phone calls and faxes http://www.fcc.gov/ccb/consumer_news/unsolici.html Telephone Consumer Protection Act(TCPA) http://www.fcc.gov/ccb/consumer_news/tcpa.html FTC Telemarketing Webpage http://www.ftc.gov/bcp/menu-tmark.htm SEC Cold Calling Rules http://www.sec.gov/enforce/alerts/coldcall.htm -Robert Cannon ------Original Message------ From: Randy Bush <randy(a)psg.com> To: nanog(a)merit.edu Sent: February 4, 2000 7:00:12 PM GMT Subject: junk fax to where does one submit formal complaints of junk fax? ______________________________________________ FREE Personalized Email at Mail.com Sign up at http://www.mail.com?sr=mc.mk.mcm.tag001

1 0

Re: MAE-East Problems?
by rs＠seastrom.com 08 Feb '00

08 Feb '00

Since you don't provide an origin adress or a traceroute, it's not exactly easy to help you. That said, FNSI and I are both on giga4 (81b) and have symmetric routing via mae-e, and are suffering no packet loss. ---rob

1 0

multicast stream
by Paul Thornton 08 Feb '00

08 Feb '00

Is anyone else failing to get the H261 stream? I had it yesterday afternoon but have been able to get it from the meeting net all morning... -- Paul

1 0