- Test - lists.nanog.org

Re: source filtering
by Havard.Eidnes＠runit.sintef.no 12 Jan '99

12 Jan '99

> > 2) Using the "ip verifiy unicast reverse-path" Cisco feature > > (it's in 11.1CC images when you use CEF, so I don't get a flood > > of e-mails) > > I'm sure far more people would source filter if Cisco put this > in CPE routers. If I'm not terribly mistaken that'll happen (or has happened, depending on your view) with 12.0. Note that in 12.0, Cisco defaults to "no ip directed-broadcast", a good thing IMHO. - Håvard

1 0

Re: Huge smurf attack
by Dalvenjah FoxFire 12 Jan '99

12 Jan '99

On Tue, Jan 12, 1999 at 05:12:22PM +0000, Michael Shields put this into my mailbox: > In article <19990111101351.04195(a)dragonlair.dal.net>, > Dalvenjah FoxFire <dalvenjah(a)DAL.NET> wrote: > > Much as I hate to say it, this seems to be one area where industry > > self-regulation has utterly failed. I don't know what would be a better > > solution; I hate to suggest government regulation. But I'm at a loss here. > > Civil liability? Possibly. I don't know of anyone who's tried suing over a smurf attack. If I could afford the lawyer and the court time I'd do it myself. All we really need is one or two good cases to establish some case law; then the rest of us can have some legal precedent to point to and say "If you don't fix your networks, you're screwed." -dalvenjah -- Dalvenjah FoxFire (aka Sven Nielsen) "Thy wit is as quick as the greyhound's Founder, the DALnet IRC Network mouth - it catches." e-mail: dalvenjah(a)dal.net WWW: http://www.dal.net/~dalvenjah/ whois: SN90 Try DALnet! http://www.dal.net/

2 1

Classfull registration in RAdb.
by batz 12 Jan '99

12 Jan '99

I am currently registering routes for the company I work for and I am wondering whether I should register customers classfull space. In getting a list of our route assignments by comparing global BGP table route origins with ARIN SWIP information, I came across a number of class-B's that belong to customers that are not doing BGP with us. All the blocks are portable space, and I am wondering whether it would be correct to create route objects with our ASN as the "origin:" or to require them to register their space and use our ASN in the "origin:" attribute of the route object. Though I understand responsibility for route registration lies with the maintainer of the block, if they choose not to create a maintainer object, other sites will not get the customers routes from the RAdb if they are generating access-lists using our policy object. If the address space is portable, but they do not have an ASN, who has the authority to regsiter the route object to a particular ASN? Thanks to Gerald Andrew Winters from Merit for his previous assistance in helping me with the policy here. I just thought that I'd bring these issues up in a public forum as they don't seem to be documented. -j -- jamie.reid | Spare Parts for the Human Appliance Chief Reverse Engineer | www.vapour.net Defective Technologies |

2 1

Re: Solution: Re: Huge smurf attack
by danderson＠lycos.com 12 Jan '99

12 Jan '99

I'm not sure what the big issue here is with the smurf attacks. If you set up some kind of access list that disables incoming icmp traffic, then turn directed broadcasts off on the interfaces, that's it. In most cases, you can't even get a packet into my AS unless its bound for dns machines or our website frontends. For those of you using Cisco gear, a simple 'no ip directed broadcast' in the interface subset will turn them off. In my mind, this takes care of all but two scenarios: 1. Your smurf attack is coming from someone within your organization, doing a broadcast while directly connected to the network. In this case, you should be able to get their ip address just by a snoop (at least on a sun box) and then you may processed to visit the offender with the clue-by-four. I once had someone who though that was a good way to inventory the machines on a network. 2. You are using some vendor who doesn't support any way of turning off directed broadcasts. From a statistics point of view, since Cisco has 87.5% of the market, most people won't find this to be a problem. I understand that only certain code revisions carry this ability on Bay gear (I want to say 11 or higher, but I could be wrong and I can't remember the code train). If you've got Torrent or something else, I don't' know but its a safe bet that if the feature isn't supported at all (doesn't matter if it is a default or not) this isn't equipment you want in your AS. Speaking from my standpoint, I sure wouldn't use it. Devin Anderson Network Engineer Lycos, Inc. Brandon Ross <bross(a)mindspring.net> on 01/12/99 02:05:02 AM To: nanog(a)merit.edu cc: (bcc: Devin Anderson/Lycos) Subject: Re: Solution: Re: Huge smurf attack On Mon, 11 Jan 1999, Daniel Senie wrote: > The proper answer to this is to disable directed broadcasts on the > routers themselves. It'd be helpful if routers came out of the box with > this feature disabled by default. Perhaps folks should talk with their > router vendors of choice and ask for this change. I have submitted a > draft into the IETF process to require this change, updating RFC 1812 > (router requirements). I'm happy to say that progress is being made in this area. When a vendor comes to us for the first time, one of things I tell them is that we will not buy their hardware until they ship with directed broadcast disabled by default. We've had a lot of success in this area, we'd have even more if others would do the same. Brandon Ross Network Engineering 404-815-0770 800-719-4664 Director, Network Engineering, MindSpring Ent., Inc. info(a)mindspring.com ICQ: 2269442 Stop Smurf attacks! Configure your router interfaces to block directed broadcasts. See http://www.quadrunner.com/~chuegen/smurf.cgi for details.

4 3

Exodus name servers broke?
by Jon Mansey 12 Jan '99

12 Jan '99

Maybe this is why so many people have trouble reaching hotmail? Try it for youself. Just a tiny little . out of place....... $nslookup www.hp.com ns.exodus.net Server: ns.exodus.net Address: 206.79.230.10 Name: www.hp.com.mydomain.net Served by: - K.GTLD-SERVERS.net 195.8.99.11 net - F.GTLD-SERVERS.net 207.159.77.18 net - A.ROOT-SERVERS.net 198.41.0.4 net - H.ROOT-SERVERS.net 128.63.2.53 net - B.ROOT-SERVERS.net 128.9.0.107 net - C.ROOT-SERVERS.net 192.33.4.12 net - D.ROOT-SERVERS.net 128.8.10.90 net - E.ROOT-SERVERS.net 192.203.230.10 net - I.ROOT-SERVERS.net 192.36.148.17 net - F.ROOT-SERVERS.net 192.5.5.241 net

3 2

Re: Exodus name servers broke?
by Lawrence A. Deleski 12 Jan '99

12 Jan '99

>--jhawk > [who will admit that the wisdom of posting this here is low, > but thinks the probability of beating other people is high, > and it's been a while since a deserving message has gotten a good > stern rebuff...] Yes, just about a week and a half... :) /lad

1 0

Re: Huge smurf attack
by Phil Howard 12 Jan '99

12 Jan '99

Christopher X. Candreva wrote: > Maybe the person who was attacked from that address can do a trace to it ? > Obviously THEY have a route to it. No, you don't have to have a route (back) to A.B.C.D to have a packet arrive with a source address of A.B.C.D. It might be nice if that were the case in every router, but smurf can be effective just because this is _not_ the case (as applies to the originating echo requests). -- -- *-----------------------------* Phil Howard KA9WGN * -- -- | Inturnet, Inc. | Director of Internet Services | -- -- | Business Internet Solutions | eng at intur.net | -- -- *-----------------------------* philh at intur.net * --

1 0

eBay
by Paul Ferguson 11 Jan '99

11 Jan '99

Does anyone know who the director of networking is at eBay? Please respond privately. Thanks, - paul

1 0

NANOG 15 Hotel
by Pam Ciesla 11 Jan '99

11 Jan '99

I just spoke with the hotel regarding availability of rooms. There are still rooms available (not many on Saturday/Sunday). Be sure to mention the NANOG room rate. If you have any problems getting the rate let me know. The attendee list has been update through 1/10. Thanks Pam Pam Ciesla Merit Network,Inc. 734-936-0172 - phone 4251 Plymouth Road 734-647-3185 Bldg.I, Suite C pam(a)merit.edu Ann Arbor, MI 48107

1 0

Net Flows and Analysis tools
by alex＠nac.net 11 Jan '99

11 Jan '99

I am looking for some real-time net flow and analysis tools. If anyone has any pointers, I'd appreciate it. Something like Cisco Netflow, but that doesn't require a Cisco Router to capture (ie, a Unix box with promiscuous ethernets instead). Thanks -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- Atheism is a non-prophet organization. I route, therefore I am. Alex Rubenstein, alex(a)nac.net, KC2BUO, ISP/C Charter Member Father of the Network and Head Bottle-Washer Net Access Corporation, 9 Mt. Pleasant Tpk., Denville, NJ 07834 Don't choose a spineless ISP; we have more backbone! http://www.nac.net -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --

4 3