- Test - lists.nanog.org

Re: SMURF amplifier block list
by Hank Nussbacher 14 Apr '98

14 Apr '98

At 03:31 AM 4/14/98 -0600, Forrest W. Christian wrote: >On Tue, 14 Apr 1998, Hank Nussbacher wrote: > >> All outgoing pkts to 220.88.192.128/27 now should go to Null0. I am sure >> one can improve on the logic even more. > >Exactly. All OUTGOING packets. Not Incoming. Not the smurf attack >packets which are swamping your downstream customer, which have a source >address from 220.88.192.128/27. My textual mistake - this snippet is to send pkts to dev/null for all pkts *sourced* from 220.88.192.128/27. -Hank > >I will concede that shutting off connectivity to a site by a large enough >chunk of the net should get someone to fix stuff.... But part of the >advantage of the MAPS RBL BGP feed is that it helps to cut down spam >coming into your network. A BGP feed TODAY won't block a ping >amplification attack aimed at your network or a downstream. All it will >do is prevent your customers from using the ping amplification networks to >launch an attack. And, if you have the appropriate anti-spoofing filters >in place, they shouldn't be able to attack anything other than the valid >source addresses you have in your outbound filter set. > >- Forrest W. Christian (forrestc(a)imach.com) >---------------------------------------------------------------------- >iMach, Ltd., P.O. Box 5749, Helena, MT 59604 http://www.imach.com >Solutions for your high-tech problems. (406)-442-6648 >---------------------------------------------------------------------- > > >

1 0

Re: SMURF amplifier block list
by shields＠crosslink.net 14 Apr '98

14 Apr '98

In article <Pine.BSF.3.96.980414033154.4326B-100000(a)workhorse.iMach.com>, "Forrest W. Christian" <forrestc(a)iMach.com> wrote: > On another note, could someone please mention again which IOS has the cool > "drop all packets from an interface which we don't have a matching route > pointing the other direction" feature? 11.1CC. I think the command is `ip verify unicast reverse-path' in the interface config. It works on the CEF table, so you *must* enable CEF, or it will just drop all packets. -- Shields, CrossLink.

1 0

Re: the whole world disappeared?
by Michael K. Smith 14 Apr '98

14 Apr '98

Sean Donelan said on 4/13/98 10:23 PM > >Anyone else care to try their luck and schedule an appointment to tell >me how wonderfull their network is :-) > We should all tell you how wonderful all of the "SMURF Amplifier List" networks are. Much more time-efficient than writing BGP filters. Mike Michael K. Smith Senior Network Administrator - Northwest Link http://www.nwlink.com mksmith(a)nwlink.com 1-800-390-1270 Extension 103

1 0

Re: i hate nanog
by William Allen Simpson 14 Apr '98

14 Apr '98

I can understand it when they are using M$ Windows software, as that marks them as clueless newbies anyway. But the real shame is when it shows them using Pine, or even Eudora, that is perfectly capable of handling the trimming. > From: "Sean M. Doran" <smd(a)clock.org> > NANOG must die because nobody seems to know how to remove > the hundreds of quoted lines which follow their two lines of > "original content". > WSimpson(a)UMich.edu Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32

1 0

Re: SMURF amplifier block list
by Vadim Antonov 14 Apr '98

14 Apr '98

You're right, silly me. --vadim Forrest W. Christian <forrestc(a)iMach.com> wrote: On Mon, 13 Apr 1998, Vadim Antonov wrote: > Uh. Just modify BGP routes from that feed to have a next hop pointing > to a black hole. route-maps are sometimes useful. Could someone PLEASE explain to me how this is accomplished? Let's assume that you do use a route-map to set next hop to a null interface or a black hole or something for a prefix. AND set local pref appropriately so that route gets preferred. You now have a routing entry which essentially says: "forward packets DESTINED FOR the evil network to the black hole". What you really want is a routing entry which says: "forward packets FROM the evil network to the black hole". Now, if someone could enlighten me to a way which you can get BGP to make a routing/filter entry to do this second one, I'd be most grateful. BTW, I know you can do this with PERL or config scripts or whatever. The point is that I don't think that a RBL-like blackhole feed will fix a smurf attack from the "attacked" perspective, unless I have missed some knob somewhere. - Forrest W. Christian (forrestc(a)imach.com)

1 0

FYI on the Hyatt Regency
by Al Reuben 14 Apr '98

14 Apr '98

I just called the Hyatt Regency to make my reservations. Without tellthem anything (like, that I was a NANOG atendee), the rate for a room was $99. The NANOG website says $125. (!) FYI -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- Atheism is a non-prophet organization. I route, therefore I am. Alex Rubenstein, alex(a)nac.net, KC2BUO, ISP/C Charter Member Father of the Network and Head Bottle-Washer Net Access Corporation, 9 Mt. Pleasant Tpk., Denville, NJ 07834 Don't choose a spineless ISP! We have more backbone! http://www.nac.net -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --

1 0

Re: the whole world disappeared?
by Dustin Goodwin 13 Apr '98

13 Apr '98

All AT&T InterSpan North American frame services are down. Our 200 site WAN just went dark. No ETA for repair. - Dustin - ______________________________ Reply Separator _________________________________ Subject: the whole world disappeared? Author: Rob M VanHooren <rob(a)linkd.net> at sb-entsmtp Date: 4/13/98 5:21 PM Anyone have details on AT&T tkt# 841-302-457? Apparently 75% of all Canada/US cross-border just fell over and died. I've got Frame and T's *and* 800/888 voice circuits that just went for a nosedive. Nobody's saying squat. Anyone with a clue or ETA? Who dropped a bomb or something? Is it just AT&T? I tried Sprint and MCI's NOCs; they are both also "experiencing heavy call volume" and that might be a clue it's bigger than just one IXC. And I wanted to go home on time (ie. before midnight). Sheesh. I know, I know, it's my fault -- I chose this as a career :-)) Anyone with a clue, drop us a note? w/thx. --R. PS: yes, yes, this really should have gone to outage-discuss. Sorry... ~~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-.._..-*~ Rob M. VanHooren - Chief Plumber, +1 519 679-1155 x33 Packet Pusher, and Resident Mad Scientist(tm) Alarms to 646-4724 Network Engineering Services 171 Queens Avenue, Suite 320 Linkdata Communications Inc. London, CANADA

1 0

the whole world disappeared?
by Rob M VanHooren 13 Apr '98

13 Apr '98

Anyone have details on AT&T tkt# 841-302-457? Apparently 75% of all Canada/US cross-border just fell over and died. I've got Frame and T's *and* 800/888 voice circuits that just went for a nosedive. Nobody's saying squat. Anyone with a clue or ETA? Who dropped a bomb or something? Is it just AT&T? I tried Sprint and MCI's NOCs; they are both also "experiencing heavy call volume" and that might be a clue it's bigger than just one IXC. And I wanted to go home on time (ie. before midnight). Sheesh. I know, I know, it's my fault -- I chose this as a career :-)) Anyone with a clue, drop us a note? w/thx. --R. PS: yes, yes, this really should have gone to outage-discuss. Sorry... ~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-.._..-*~ Rob M. VanHooren - Chief Plumber, +1 519 679-1155 x33 Packet Pusher, and Resident Mad Scientist(tm) Alarms to 646-4724 Network Engineering Services 171 Queens Avenue, Suite 320 Linkdata Communications Inc. London, CANADA

4 3

[postmaster@mobilelogic.com: Undeliverable: SMURF amplifier block list]
by Jay R. Ashworth 13 Apr '98

13 Apr '98

Three copies of this to owner-nanog in the last week have gone undealt with. Perhaps this will solve the problem? -----Forwarded message from System Administrator <postmaster(a)mobilelogic.com>----- Received: from nomad.wiretel.com (firewall-user(a)nomad.wiretel.com [206.83.100.2]) by scfn.thpl.lib.fl.us (8.8.5/8.6.5) with ESMTP id QAA03143 for <JRA(a)SCFN.THPL.LIB.FL.US>; Mon, 13 Apr 1998 16:37:36 -0400 (EDT) Received: by nomad.wiretel.com; id PAA26731; Mon, 13 Apr 1998 15:31:40 -0600 (MDT) Received: from unknown(206.83.100.36) by nomad.wiretel.com via smap (3.2) id xma026729; Mon, 13 Apr 98 15:31:36 -0600 Received: by masai.wiretel.com with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.993.5) id <01BD66E9.D56E4A30(a)masai.wiretel.com>; Mon, 13 Apr 1998 14:38:33 -0600 Message-ID: <01BD66E9.D56E4A30(a)masai.wiretel.com> From: System Administrator <postmaster(a)mobilelogic.com> To: <JRA(a)SCFN.THPL.LIB.FL.US> Subject: Undeliverable: SMURF amplifier block list Date: Mon, 13 Apr 1998 14:38:33 -0600 X-Mailer: Microsoft Exchange Server Internet Mail Connector Version 4.0.993.5 Your message did not reach some or all of the intended recipients. To: DCHADWICK(a)mobilelogic.com Subject: SMURF amplifier block list Sent: 4/13/98 14:38:33 PM The following recipient(s) could not be reached: DCHADWICK(a)mobilelogic.com on 4/13/98 14:38:33 PM Recipient Not Found MSEXCH:IMC:WTI:MobileLogic:MASAI -----End of forwarded message----- <ahem> Cheers, -- jra -- Jay R. Ashworth jra(a)baylink.com Member of the Technical Staff Unsolicited Commercial Emailers Sued The Suncoast Freenet "Two words: Darth Doogie." -- Jason Colby, Tampa Bay, Florida on alt.fan.heinlein +1 813 790 7592 Managing Editor, Top Of The Key sports e-zine ------------ http://www.totk.com

1 0

SMURF amplifier block list
by Karl Denninger 13 Apr '98

13 Apr '98

The following networks and masks are banned from our network at the core due to being smurf amplifiers. When the folks who own these STOP THIS, we'll take them off the list. Contact me by TELEPHONE if you want to discuss this matter or what a Smurf is and why you should care. I'm going to start posting the blacklist here weekly in the hopes that peer pressure will cause people to clean up their acts. Until you DO clean up your act, you're not transiting our network - period. We're not going to accept this kind of vandalism and attractive nuisance any more. If you haven't disabled directed broadcast forwarding, you are a potential listee on this blacklist. DO IT NOW, or risk connectivity blockades. I urge all other network providers to block any identified smurf amplifier that they can verify, and to post their list as well. Only through public pressure can people be forced to CORRECTLY configure their networks to make these attacks impossible to launch. access-list 2 deny 128.118.0.0 0.0.255.255 access-list 2 deny 129.24.0.0 0.0.255.255 access-list 2 deny 129.111.0.0 0.0.255.255 access-list 2 deny 129.100.0.0 0.0.255.255 access-list 2 deny 128.40.0.0 0.0.255.255 access-list 2 deny 129.101.0.0 0.0.255.255 access-list 2 deny 203.64.0.0 0.0.255.255 access-list 2 deny 129.115.0.0 0.0.255.255 access-list 2 deny 203.108.225.0 0.0.0.255 access-list 2 deny 129.60.0.0 0.0.255.255 access-list 2 deny 137.79.0.0 0.0.255.255 access-list 2 deny 130.37.0.0 0.0.255.255 access-list 2 deny 130.70.0.0 0.0.255.255 access-list 2 deny 203.108.236.0 0.0.0.255 access-list 2 deny 132.169.0.0 0.0.255.255 access-list 2 deny 129.107.0.0 0.0.255.255 access-list 2 deny 129.49.0.0 0.0.255.255 access-list 2 deny 129.96.0.0 0.0.255.255 access-list 2 deny 130.65.0.0 0.0.255.255 access-list 2 deny 134.205.0.0 0.0.255.255 access-list 2 deny 129.29.0.0 0.0.255.255 access-list 2 deny 204.48.224.0 0.0.0.255 access-list 2 deny 205.177.49.0 0.0.0.255 access-list 2 deny 204.47.208.0 0.0.0.255 access-list 2 deny 204.242.172.0 0.0.0.255 access-list 2 deny 194.6.129.0 0.0.0.255 access-list 2 deny 206.31.78.0 0.0.0.255 access-list 2 deny 207.211.60.0 0.0.0.255 access-list 2 deny 206.27.242.0 0.0.0.255 access-list 2 deny 207.175.67.0 0.0.0.255 I'm sure there are more, but these are the ones blacklisted in our network configuration right now. -- -- Karl Denninger (karl(a)MCS.Net)| MCSNet - Serving Chicagoland and Wisconsin http://www.mcs.net/ | T1's from $600 monthly / All Lines K56Flex/DOV | NEW! Corporate ISDN Prices dropped by up to 50%! Voice: [+1 312 803-MCS1 x219]| EXCLUSIVE NEW FEATURE ON ALL PERSONAL ACCOUNTS Fax: [+1 312 803-4929] | *SPAMBLOCK* Technology now included at no cost

11 19