- Test - lists.nanog.org

Re: New Denial of Service Attack ...
by Barney Wolff 25 Sep '96

25 Sep '96

Ok, I'm confused. Quoting from Vernon's message: > Date: Wed, 18 Sep 1996 14:32:14 -0600 > From: vjs(a)mica.denver.sgi.com (Vernon Schryver) > Subject: SYN bombing defense > > I've just hacked IRIX 6.3 to do random-drop when sonewconn() in > tcp_input.c fails. It works great! An IP22 receiving 1200 bogus > SYN's per second directed to port 23 continues to answer requests > for new telnet as if nothing is happening. > ... > As I figure it, as long as the length of the queue is longer than RTT > of the real telnet client times the rate of bogus SYNs, the real > clients have an excellent probability of getting through on their > first attempt. For example, at 1200 bogus SYNs/sec and the IRIX 6.3 > telnet listen queue of 383, there should be no trouble with peers > with RTT up to about 300 milliseconds. I've tested with a telnet > client 250 milliseconds away while simultaneously bombing the machine > from nearby with ~1200 SYNs/sec, and see no telnet TCP retransmissions. Because the queue is always full, you must have been doing 1200 random- drops per second, also. A telnet client 250ms away is therefore on average exposed to 300 random-drops, each of which has a chance of 1/383 of killing it. Its probability of survival is (1-1/383)^300, or .456, not so good. It would be different if it were oldest-drop, but random- drop is what's stated. Lacking evidence, I won't argue with the experimental finding that the problem goes away - but if so, what's wrong with my computation? Barney Wolff <barney(a)databus.com>

1 0

Re: New Denial of Service Attack ...
by postel＠ISI.EDU 25 Sep '96

25 Sep '96

----- Begin Included Message ----- Subject: Re: FW: Latest attacks.... Date: Thu, 19 Sep 1996 08:39:02 +0100 From: Jon Crowcroft <J.Crowcroft(a)cs.ucl.ac.uk> problem solved: this just in on your trusty end2end research group's list (sorry, i know some of you may already read it) this guy is usually technically excellent, so i think we can trust that this solution is valid, will propagate, and is deployable for server sites that worry (you only need kernel reconfig rights for unix to add this - NT and MAC servers may have a tad more of a problem:-). cheers jon ------- Forwarded Message Date: Wed, 18 Sep 1996 14:32:14 -0600 From: vjs(a)mica.denver.sgi.com (Vernon Schryver) Subject: SYN bombing defense As reported here, in article <vxjiv9hkmcb.fsf_-_(a)dominator.eecs.harvard.edu> in comp.protocols.tcp-ip, Robert Morris <rtm(a)dominator.eecs.harvard.edu> wrote: >Perhaps TCP's listen queue should use random early drop (RED), a >technique used by routers to prevent any one source from monopolizing >a queue. See http://www-nrg.ee.lbl.gov/floyd/abstracts.html#FJ93 or >rfc1254. > ... I've just hacked IRIX 6.3 to do random-drop when sonewconn() in tcp_input.c fails. It works great! An IP22 receiving 1200 bogus SYN's per second directed to port 23 continues to answer requests for new telnet as if nothing is happening. I don't think that random <<Early>> drop is necessary or desirable. It is not as if we're trying to drop packets early to trigger slow start in the sources. As I figure it, as long as the length of the queue is longer than RTT of the real telnet client times the rate of bogus SYNs, the real clients have an excellent probability of getting through on their first attempt. For example, at 1200 bogus SYNs/sec and the IRIX 6.3 telnet listen queue of 383, there should be no trouble with peers with RTT up to about 300 milliseconds. I've tested with a telnet client 250 milliseconds away while simultaneously bombing the machine from nearby with ~1200 SYNs/sec, and see no telnet TCP retransmissions. Vernon Schryver, vjs(a)sgi.com ------- End of Forwarded Message ----- End Included Message -----

3 3

Re: New Denial of Service Attack ...
by Leonid Egoshin 25 Sep '96

25 Sep '96

>From: postel(a)ISI.EDU >From: vjs(a)mica.denver.sgi.com (Vernon Schryver) > >>Perhaps TCP's listen queue should use random early drop (RED), a >>technique used by routers to prevent any one source from monopolizing >>a queue. See http://www-nrg.ee.lbl.gov/floyd/abstracts.html#FJ93 or >>rfc1254. >> ... > >As I figure it, as long as the length of the queue is longer than RTT ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >of the real telnet client times the rate of bogus SYNs, the real >clients have an excellent probability of getting through on their >first attempt. For example, at 1200 bogus SYNs/sec and the IRIX 6.3 >telnet listen queue of 383, there should be no trouble with peers >with RTT up to about 300 milliseconds. I've tested with a telnet >client 250 milliseconds away while simultaneously bombing the machine >from nearby with ~1200 SYNs/sec, and see no telnet TCP retransmissions. As I understand it is the decision based on truncation long distance clients to fit in host resources under attack. And the more SYNs flood volume shrink more the service area. But why we use ten seconds in TCP as max RTT instead of hundreds milliseconds ? (see rfc1122) - Leonid Yegoshin, LY22

1 0

Re: New Denial of Service Attack ...
by rja＠cisco.com 25 Sep '96

25 Sep '96

I'll concur with Jon Postel and Jon Crowcroft. Vernon is usually right and in this case I've worked the analysis myself and fully concur with him. I understand that some versions of UNIX are already headed down the path Vernon has suggested. Ran rja(a)cisco.com --

1 0

Re: SYN flood messages flooding my mailbox
by Vadim Antonov 24 Sep '96

24 Sep '96

Curtis Villamizar <curtis(a)ans.net> wrote: >I guess you missed what I proposed earlier. It was similar though the >Fib was used so it only worked for single homed connections. The >advantage was simplicity. All that needed to be changed was the >forwarding code. Your proposal involves the AdjRibIn which would >require BGP code changing flags on the forwarding entries. A bit more >work for the router developers but covers more cases. We both >proposed turning this on by default with cluefull people who knew >routing would be assymetric turning it off. Good. We finally agreed on something :) Did i hear that you volunteered to write an I-D amending requirements for gateways? :) --vadim

1 0

Re: SYN flood messages flooding my mailbox
by Vadim Antonov 24 Sep '96

24 Sep '96

>Basing this on the AdjRibIn is a more work than just reversing the >sense of the Fib but it does cover quite a few more cases. Though not >all of them. No, not of course; but more than enough to be practical. A _lot_ more practical than manually (or semi-automatically) maintained access lists which do not provide any "visible" benefit. >The transit providers still need to be able to trace attacks after the >fact since there is no filter that covers these cases... Absolutely. When other things do not help :) >and filters at >the fringes will be spotty deplomyments. That's why i want reverse-route verification to be _default_ behaviour of routers. A person who knows how to use asymmetric routing would know how to turn the feature off. A person who is clueless or simply doesn't care will leave default as is. --vadim

2 1

More press on attacks
by Paul Ferguson 24 Sep '96

24 Sep '96

Pointer: http://www.news.com/News/Item/0,4,3710,00.html Complete with cute little Java applet of attack. ;-) - paul

2 1

Crypto callback (was: New Denial of Service Attack on Panix)
by Leonid Egoshin 24 Sep '96

24 Sep '96

Hi, I can propose yet another decision of SYNs flood attack on the site under attack. Unfortunatly I had no time to verify it in real live, but it is seemed as correct. Also it is not elegant decision, but ... 1). It is need to measure the available TCP control blocks resource and switch on to this strategy then host is under attack (for exam then number of free TCP blocks is less 1/3 of all TCP blocks). And switch back after it is seens that attack ended. The strategy consist of 2). Then host receive SYN, it calculate cryptographic initial TCP sequence depended from IP address [+ probably port] of another TCP side, answer by SYN-ACK with it and forget it. 3). Then host receive ACK which havn't IPs and ports of any already established or closing TCP session, then host verify answer-sequence in it and if it is correct - create TCP block and set it to established state and run as normal. Cryprographic calculation and verification. 4) Take the negative current time in the 4ms units (see RFC793) and add to it some cryptographic constant which is calculated from other part IP [+port] on the base of secret site key. 5) During checking subtract this cryptographic constant and verify time - it must be in range of 2 max segment live time from current time. ( More accurate strategy would be to increment "time" with any established TCP session, record the real time of each such increment and remove old values which is older than 2MSL.) 6) What it is need to do with MSS option ? - take the default (I said that it is non-elegant decision !) Advantages: - Callback allow the only non-falsified host connection. - Cryptographic sum on the base of IP [+port] deny SYNs flood also as another spoofing - the other part must answer with this callback key. (It is already used in many UNIX systems). The probability of success SYN flood attack is 1 for 80000 SYN packets. The same is for ordinary ACKs flood attack. Disadvantages/problems: - What would be after unexpected (!) reboot of server ? It is looks like one of 80000 nonclosed connection which haven't keepalive option and stay passive during reboot and long time before reboot can be accepted as new without notification of client. But if we take in account more accurate strategy of "time" calculation the probability of it can be significantly lower. - Some perfomance degradation due to MSS loss from initial SYN. But some system send MSS during first ACK also and eliminate this problem for it. - It is need to have source code of server system and some programming efforts to implement it :-) - Leonid Yegoshin, LY22

3 2

Re: SYN flood messages flooding my mailbox
by Vadim Antonov 24 Sep '96

24 Sep '96

Curtis Villamizar <curtis(a)ans.net> wrote: >I guess a picture would help: > > AS X R1 ------ AS Y R3 > | | > | | > AS X R2 ------ AS Y R4 > >If the route learned at AS Y R4 is preferred, AS Y R3 may get packets >although the forwarding entry (Fib) points toward AS Y R4, the LocRib >does not contain the entry (no preferred), only the AdjRibIn contains >the entry. If the filter must be set according to AdjRibIn, That's what i meant. >you now have a filter list **in the forwarding path** considerably longer than >the current routing table. Won't scale at the very least. Not. Every entry in the filter contains the following data: [Prefix] [Prefix Length] [Bitmask] where bitmask has a bit per every interfaces, so the bit if set if packet matching the prefix is allowed from that interface. Since in practically all cases all prefixes (NOT routes!) found in all RIBs are also found in FIB (exceptions are proxy aggregation and/or restricted end-to-end reacheability) the size of the list is the same as size of FIB. In fact, you don't even need to keep a separate table. Just add a bitmask field to the FIB entries. (On customer-access routers with many interfaces each allowing only very small portion of routes in it may be more economical to implement explicit per-interface lists than to add fields to FIB). > >Or if the "known route" goes through an AS that uses YOU as their best > >route but the reverse traffic goes a different way.. > > So what? The assumption is that multi-homed AS announces all its > routes to all exits (maybe with different "metrics"). >In this case: AS a R1 ------ AS b R2 ------ AS d R4 | | | | | | +----------- AS c R3 -----------+ >In this case AS c prefers AS a. AS d prefers AS c. AS b prefers the >routes it hears from AS b. AS a prefers some route through AS d that >it hears from AS b over the route it hears from AS c. Therefore AS d >has no Fib, LocRib, or even AdjRibIn from AS b R2, but will get >legitimate traffic from R2 that is dstined for places that is >reachable through AS d but for which AS d uses AS c for the return path. ASes a and d are transit. I clearly stated that the reverse-route filtering technique is inapplicable for transit AS-es. Fortunately, the number of transit ASes is very small (two years ago i measured it as 170-something), and they generally form a backbone. On the other hand, practically all customer AS-es or intra-AS tail links are not transit. >The first case is clearly less scalable than the current routing table >(consider putting all AdjRibIn entries at a NAP into your filters on >the forwarding card). Er. That statement is just plain wrong. >The second just plain doesn't work. It is exactly within the restriction i stated beforehand. You don't want to do packet filtering on backbone in any case. --vadim

2 1

Re: Bob Metcalfe: Infoworld Sept 23 page 46 Which young brat?
by Avi Freedman 24 Sep '96

24 Sep '96

> On Mon, 23 Sep 1996, Christopher Sevcik wrote: > > > In his excellent article in the Info world which I received today, he > > referred to a young ISP brat. > > > > Who's he referring to? He appears to be talking about me. I sent him e-mail explaining that I was mis-quoted. What I *said* was "Some say that Metcalfe ...". What was printed was something like "Freedman says that Metcalfe ...". Though, given the gigacollapse predictions which he made - combined with the fact that it's extraordinarily difficult to believe that he actually *believed* them - the quote might have started "Metcalfe has become a journalist, more interested in gaining readership than in using his formidable experience to help with the operational and architectural problems that the Internet community is facing..." if I had been asked for a quote about Metcalfe. Which I wasn't... > Didn't the print version give the URL of thie document containing this: > > Avi sums it up: "Metcalfe has become an elder statesman and > > ... to read the rest go to > http://www.forbes.com/asap/gilder/telecosm18.html > > Michael Dillon - ISP & Internet Consulting Anyway: wow, I can't believe it. I might have surpassed Sean Doran as the official Brat-boy of the ISP/ NSP community. Maybe I'll get Sean to pen my letter to the editor in reply to his brat comments... Avi

1 0