- Test - lists.nanog.org

Re: Peering versus Transit
by Barney Wolff 04 Oct '96

04 Oct '96

> Date: Mon, 30 Sep 1996 09:01:14 +0100 > From: "Alex.Bligh" <amb(a)xara.net> > > > And of course, to be in a position to "dump data" on a router at an > > exchange, one must have one's own router there peering with *somebody*, > > right? > > You needn't peer with anyone > > ip route 0.0.0.0 0.0.0.0 w.x.y.z > > will do the trick nicely if you aren't carrying full routing. Er, why did the exchange operator let you put a router on their switching fabric if you're not peering there with somebody? Are there actual cases of people with routers at NAPs/MAEs/xIXs who don't peer with anyone? Barney Wolff <barney(a)databus.com>

6 8

BSDI announcement about defense against syn-flooding attacks
by Rob Liebschutz 04 Oct '96

04 Oct '96

They've made a big announcement about it, but the code doesn't yet appear to be on their ftp site. The announcement does not describe what approach they took to solving the problem (presumably something more then their existing patch for the larg PCB hash table). See http://www.bsdi.com/press/19961002.html for the full announcement. It scares me to think how much effort has gone into defense against this one denial of service attack when there are endless possibilities for other ones. ______________________________________________________________________________ Colorado Springs, CO (October 2, 1996) -- Berkeley Software Design, Inc. (BSDI) anounced today its enhancements to its BSD/OS and BSDI Internet Server that are designed to protect against the recent wave of "SYN-flooding" denial-of-service attacks. Beginning this week, BSDI will make the source code for these enhancements available at no charge via the Internet to BSDI customers as well as all interested operating system suppliers, system administrators, and software developers.

3 2

Re: New Denial of Service Attack on Panix
by Jeff Weisberg 03 Oct '96

03 Oct '96

Avi writes: | > But of course. The problem is that SYN_RCVD is a transient state in the | > TCP automaton, and it requires some resources allocation. The life | > might have been a little bit different if servers weren't forced | > to track this state. Something like a signed ticket accompanying the | > second SYN and the following ACK. | > | > Dima | | That's the idea of making the iss a ticket that includes mss info and | a hash of the other info plus a security ticket. | | I had hoped to work on that but it looks like someone else local is almost | done and claims that ignoring window size and any data with the SYN(s) | is harmless... "someone else local" :-) has thrown the initial implementation up on his ftp server; sun3 & sun4 .o's and a back-port to Net/2 src code (note though, I have not tested the Net/2 port): ftp.op.net:/pub/src/syn-prophylactica/ I have been able to withstand a ~600+ syn/sec attack with no noticable problems (slightly increased load, but no dropped connections). --jeff

2 1

RE: BSDI announcement about defense against syn-flooding attacks
by William Sommers 03 Oct '96

03 Oct '96

On Thu, 3 Oct 96 16:35:13 PDT Rob Liebschutz wrote: > They've made a big announcement about it, but the code doesn't yet > appear to be on their ftp site. The announcement does not describe > what approach they took to solving the problem (presumably something > more then their existing patch for the larg PCB hash table). See > http://www.bsdi.com/press/19961002.html for the full announcement. > > It scares me to think how much effort has gone into defense against > this one denial of service attack when there are endless possibilities > for other ones. Actually, they released a number of patches all at once, including (quoting the notice just sent out by polk(a)bsdi.com) The remainder of the patches (K210-021, K210-022, and U210-025) add support for IP source checking, and for reducing and/or eliminating problems associated with SYN attacks, IP fragment attacks, and some other denial of service/looped server attacks. Unfortunately, these are available only for BSD/OS 2.1 -- nothing for prior releases. William Sommers San Francisco Online Televolve, Inc. sommers(a)sfo.com

2 1

'show ip bgp' musings and a useful script
by Michael Dillon 03 Oct '96

03 Oct '96

---------- Forwarded message ---------- Date: Thu, 3 Oct 1996 07:26:46 -0700 From: Rahul Dhesi <dhesi(a)rahul.net> Reply-To: inet-access(a)earth.com To: inet-access(a)earth.com Subject: 'show ip bgp' musings and a useful script Resent-Date: Thu, 3 Oct 1996 08:27:01 -0600 (MDT) Resent-From: inet-access(a)earth.com I wanted to see if the global Internet was receiving routing announcements for one of my netblocks, and wished there were several strategic places, all over the Internet, where one could do the equivalent of Cisco's 'show ip bgp'. Similar to remote traceroutes that can be done at a number of URLs, such as http://www.getnet.com/cgi-bin/trace. People might not jump at the chance of letting the rest of the world access their routers, but I am going to try to make it real easy for them. To this end I have written and made available a perl5 script that will telnet to your Cisco router, log in with the non-enable password, and do 'show ip bgp' for selected networks. I think it's reasonably secure. Point your web browser towards http://www.rahul.net/dhesi/ and follow the links to 'show ip bgp'. Then -- please -- set it up somewhere where you get a significant set of routes, so the rest of us can get some debugging benefit. -- Rahul Dhesi <dhesi(a)rahul.net> "please ignore Dhesi" -- Mark Crispin <mrc(a)CAC.Washington.EDU> ============================== ISP Mailing List ============================== Email ``unsubscribe'' to inet-access-request(a)earth.com to be removed. Because this is a restricted list -- DO NOT CROSS POST TO OTHER LISTS.

1 0

Re: New Denial of Service Attack on Panix
by Paul Ferguson 03 Oct '96

03 Oct '96

At 06:43 PM 10/3/96 EDT, Daniel W. McRobb wrote: > >I think Tim was using the assumption (which I consider quite valid) that >once vendors release patches, those being attacked are likely to apply a >patch quite quickly. It's a motivaton issue... people are much more >motivated to save their own butts in a hurry before trying to save >everyone else's. ;-) > Well, I would tend to agree with you here. Incentive comes in different flavors. In any event, and being a realist, I don't envision either one to be implemented with blazing speed. - paul >I think most folks in this forum are good netizens and want to do the >Right Thing(s) for everyone. Others, especially those not privy to all >the fuss about this issue, are less likely to take action and will >probably be hosting these attacks for a while, possibly w/o knowing it >until someone tracks it down and yells at them and/or they're attacked >themselves (in which case they'll probably reach for things to protect >themselves before trying to protect others). >

1 0

Re: New Denial of Service Attack on Panix
by Daniel W. McRobb 03 Oct '96

03 Oct '96

> At 03:08 PM 10/3/96 -0400, Tim Bass wrote: > > > > >The TCP fix and possibly and ICMP fix (and more work on > >kernel hackers part) will, I can safely predict, the > >faster short term solution than trying to coordinate > >the world into doing filters. > > > >Random Drop, is not a panacea, as you say Paul, but it > >is a very big, big step in the right direction and > >I predict that within 30 days and at the latest 60 > >days (because people are busy) that the SYN attack > >much less 'troublesome'. > > > > Hm. And how quickly do you think all of the reachable hosts in the > world are patched? I would suggest that ingress filtering is, by far, > less resource intensive, since the numbers of routers v. hosts are > much, much smaller. I think Tim was using the assumption (which I consider quite valid) that once vendors release patches, those being attacked are likely to apply a patch quite quickly. It's a motivaton issue... people are much more motivated to save their own butts in a hurry before trying to save everyone else's. ;-) I think most folks in this forum are good netizens and want to do the Right Thing(s) for everyone. Others, especially those not privy to all the fuss about this issue, are less likely to take action and will probably be hosting these attacks for a while, possibly w/o knowing it until someone tracks it down and yells at them and/or they're attacked themselves (in which case they'll probably reach for things to protect themselves before trying to protect others). Daniel ~~~~~~

1 0

Re: DoS, ICMP, proxies, SYNDefender
by Leonid Egoshin 03 Oct '96

03 Oct '96

>From: Tim Bass <bass(a)linux.silkroad.com> > >> Tim, unfortunately ICMP UNREACHABLE can be sent some intermediate >> router during routing flip process. For this reason some customer >> prefer cut off this sort of ICMP - it would break running TCP connection. > >Understood, however the conditions to terminate the connection >is not just as simple as UNREACHABLE. A few possible conditions: >(1) UNREACHABLE && TCP_SYN_STATE >(2) UNREACHABLE && TCP_SYN_STATE && sk->time_in_state I am not shure that it is in _ALL_ host types. Experience gave me that some time I had problem with uninterraptable service up to I configure router to cut off ICMP UNREACHABLE from outside. - Leonid Yegoshin, LY22

1 0

Re: New Denial of Service Attack on Panix
by Paul Ferguson 03 Oct '96

03 Oct '96

At 03:08 PM 10/3/96 -0400, Tim Bass wrote: > >The TCP fix and possibly and ICMP fix (and more work on >kernel hackers part) will, I can safely predict, the >faster short term solution than trying to coordinate >the world into doing filters. > >Random Drop, is not a panacea, as you say Paul, but it >is a very big, big step in the right direction and >I predict that within 30 days and at the latest 60 >days (because people are busy) that the SYN attack >much less 'troublesome'. > Hm. And how quickly do you think all of the reachable hosts in the world are patched? I would suggest that ingress filtering is, by far, less resource intensive, since the numbers of routers v. hosts are much, much smaller. In any event, I believe ingress filtering is certainly a Good Thing. Also, what progress has been made in hardening OS's for UDP flooding? - paul

1 0

Re: DoS, ICMP, proxies, SYNDefender
by Leonid Egoshin 03 Oct '96

03 Oct '96

>From: Tim Bass <bass(a)linux.silkroad.com> > >I feel like a cheerleader 'Give me an U N R E A C H A B L E' >wha-at-ya-got ......... Tim, unfortunately ICMP UNREACHABLE can be sent some intermediate router during routing flip process. For this reason some customer prefer cut off this sort of ICMP - it would break running TCP connection. - Leonid Yegoshin, LY22

2 1