- Test - lists.nanog.org

Re: SYN floods (was: does history repeat itself?)
by Justin W. Newton 13 Sep '96

13 Sep '96

At 04:37 AM 9/13/96 -0400, Alexis Rosen wrote: >Alex.Bligh writes: >> I think you are talking about filtering inbound packets to your >> router and restricting them to BGP announcements (I don't >> think Avi was - see below). This would be done on the destination >> address (checking it was within your announced route set) and >> thus doesn't help protect against spoofed source addresses. > >No, Justin's talking about filtering _customers'_ packets at Justin's >border with the customer. No BGP involved. This assumes customers that >are not providers (ie, no transit for other nets through the customer). >Good enough if all providers do the right thing (or if almost all do). > >What Justin meant about his BGP announcements was that a customer's >packet is legal IFF Justin's announcing that packet's net by BGP (on >_behalf_ of the customer, not _to_ the customer). Again, customer means >a site that's not a BGP peer. Actually what Justin was talking about is as follows... Justin will only allow packets out of his border routers /to/ peers if they are packets with a source address inside the ranges of addresses he announces via BGP. I.e. if I announce 192.1.1.0 0.0.0.255 I would allow a packet with an address of 192.1.1.1 out of my network into "the net at large" but not if the packets source address was 192.1.2.1. I will allow any packet which I allow to enter my network into a customer's network. Their filtering is their problem. Justin Newton Internet Architect Erol's Internet Services

3 2

Some interesting aggregates
by Tony Bates 13 Sep '96

13 Sep '96

I'm slowly putting back the Top-20 report I used to do a couple of years back. Here's a list of some possibly interesting aggregates. Some may be legit and I make no comment either way. Criteria is an aggregate not made up as a set of classful routes. However, thought you might find it interesting. Love those /32's by the way. --Tony P.S. thanks to Lyndon Levesley <lol(a)xara.net> for giving me access to the real world again. P.P.S I still have a slight problem with AS to description mapping for some reason so some of the UNKNOWNs may be legit. List of possibly interesting aggregates --------------------------------------- aggregate origin-AS AS Description 4.0.64.0/25 AS1 BBN Planet backbone 4.0.68.0/24 AS1 BBN Planet backbone 9.2.0.0/16 AS1747 IBM Watson, Yorktown Heights, 9.20.0.0/17 AS2686 OpenNet-Europe 9.67.0.0/19 AS3561 MCI 24.0.0.0/14 AS6172 @Home Corp 24.48.0.0/18 AS1677 ANS Hartford - CNSS 53 24.64.0.0/19 AS6327 Shaw Fiberlink Ltd. 24.64.32.0/19 AS6327 Shaw Fiberlink Ltd. 24.96.0.0/18 AS6541 GTE Intelligent Network Servic 24.112.0.0/18 AS6463 Rogers Network Services 24.113.0.0/18 AS6177 UNKNOWN 24.124.0.0/18 AS3561 MCI 24.128.0.0/18 AS7015 UNKNOWN 24.129.0.0/18 AS7017 UNKNOWN 24.131.0.0/18 AS7016 UNKNOWN 38.231.198.0/24 AS3951 ICONNET 57.12.0.0/16 AS5384 Emirates Internet 128.145.228.0/24 AS174 Performance Systems Internatio 128.188.1.0/24 AS560 BBN Planet, New England Region 128.193.0.0/19 AS4201 UNKNOWN 129.181.216.0/22 AS517 Xlink 130.168.105.0/24 AS1270 EUnet Germany 130.168.115.0/24 AS1270 EUnet Germany 130.168.125.0/24 AS1270 EUnet Germany 130.188.2.0/24 AS565 VTT autonomous system 130.188.3.0/24 AS565 VTT autonomous system 130.188.150.0/24 AS565 VTT autonomous system 130.188.170.0/24 AS565 VTT autonomous system 130.188.252.0/24 AS565 VTT autonomous system 130.205.64.0/18 AS3561 MCI 130.252.178.0/24 AS1321 ANS San Francisco - DNSS 11 131.114.192.0/18 AS2598 Consiglio Nazionale delle Rice 131.115.211.0/24 AS3301 TeliaNet Sweden 131.117.0.0/17 AS559 SWITCH, Swiss Academic and Res 131.119.63.0/24 AS201 BBN BARRNET, Inc. 131.192.1.0/24 AS560 BBN Planet, New England Region 131.192.2.0/24 AS560 BBN Planet, New England Region 131.192.4.0/24 AS560 BBN Planet, New England Region 131.192.5.0/24 AS560 BBN Planet, New England Region 131.192.6.0/30 AS560 BBN Planet, New England Region 131.192.9.0/24 AS560 BBN Planet, New England Region 131.192.13.0/24 AS560 BBN Planet, New England Region 131.192.15.0/24 AS560 BBN Planet, New England Region 131.192.17.0/24 AS560 BBN Planet, New England Region 131.192.18.0/24 AS560 BBN Planet, New England Region 131.192.20.0/24 AS560 BBN Planet, New England Region 131.192.21.0/24 AS560 BBN Planet, New England Region 131.192.23.0/24 AS560 BBN Planet, New England Region 131.192.24.0/24 AS560 BBN Planet, New England Region 131.192.25.0/24 AS560 BBN Planet, New England Region 131.192.27.0/24 AS560 BBN Planet, New England Region 131.192.31.0/30 AS560 BBN Planet, New England Region 131.192.32.0/30 AS560 BBN Planet, New England Region 131.192.42.0/24 AS560 BBN Planet, New England Region 131.192.50.0/24 AS560 BBN Planet, New England Region 131.192.51.0/24 AS560 BBN Planet, New England Region 131.192.55.0/24 AS560 BBN Planet, New England Region 131.192.56.0/30 AS560 BBN Planet, New England Region 131.192.57.0/28 AS560 BBN Planet, New England Region 131.192.64.0/24 AS560 BBN Planet, New England Region 131.192.70.0/30 AS560 BBN Planet, New England Region 131.192.74.0/24 AS560 BBN Planet, New England Region 131.192.76.0/24 AS560 BBN Planet, New England Region 131.192.78.0/24 AS560 BBN Planet, New England Region 131.192.84.0/24 AS560 BBN Planet, New England Region 131.192.86.0/30 AS560 BBN Planet, New England Region 131.192.87.0/24 AS560 BBN Planet, New England Region 131.192.89.0/24 AS560 BBN Planet, New England Region 131.192.93.0/24 AS560 BBN Planet, New England Region 131.192.94.0/24 AS560 BBN Planet, New England Region 131.192.115.0/24 AS560 BBN Planet, New England Region 131.192.116.0/24 AS560 BBN Planet, New England Region 131.192.125.0/24 AS560 BBN Planet, New England Region 131.192.128.0/24 AS560 BBN Planet, New England Region 131.192.138.0/24 AS560 BBN Planet, New England Region 131.192.139.0/24 AS560 BBN Planet, New England Region 131.192.140.0/24 AS560 BBN Planet, New England Region 131.192.142.0/24 AS560 BBN Planet, New England Region 131.192.143.0/24 AS560 BBN Planet, New England Region 131.192.148.0/30 AS560 BBN Planet, New England Region 131.192.149.0/29 AS560 BBN Planet, New England Region 131.192.152.0/30 AS560 BBN Planet, New England Region 131.192.156.0/30 AS560 BBN Planet, New England Region 131.192.165.0/24 AS560 BBN Planet, New England Region 131.192.166.0/24 AS560 BBN Planet, New England Region 131.192.167.0/24 AS560 BBN Planet, New England Region 131.192.168.0/24 AS560 BBN Planet, New England Region 131.192.170.0/24 AS560 BBN Planet, New England Region 131.192.176.0/24 AS560 BBN Planet, New England Region 131.192.179.0/24 AS560 BBN Planet, New England Region 131.192.182.0/24 AS560 BBN Planet, New England Region 131.192.188.0/24 AS560 BBN Planet, New England Region 131.192.193.0/24 AS560 BBN Planet, New England Region 131.192.195.0/24 AS560 BBN Planet, New England Region 131.192.198.0/24 AS560 BBN Planet, New England Region 131.192.201.0/24 AS560 BBN Planet, New England Region 131.192.204.0/24 AS560 BBN Planet, New England Region 131.192.205.0/24 AS560 BBN Planet, New England Region 131.192.206.0/24 AS560 BBN Planet, New England Region 131.192.211.0/24 AS560 BBN Planet, New England Region 131.192.213.0/24 AS560 BBN Planet, New England Region 131.192.214.0/24 AS560 BBN Planet, New England Region 131.192.223.0/24 AS560 BBN Planet, New England Region 131.192.234.0/24 AS560 BBN Planet, New England Region 131.192.237.0/24 AS560 BBN Planet, New England Region 131.192.240.0/24 AS560 BBN Planet, New England Region 131.192.241.0/24 AS560 BBN Planet, New England Region 131.192.242.0/24 AS560 BBN Planet, New England Region 131.192.244.0/24 AS560 BBN Planet, New England Region 131.192.245.0/24 AS560 BBN Planet, New England Region 131.192.246.0/24 AS560 BBN Planet, New England Region 131.192.250.0/24 AS560 BBN Planet, New England Region 131.192.253.0/24 AS560 BBN Planet, New England Region 131.192.254.0/24 AS560 BBN Planet, New England Region 132.235.204.0/24 AS3561 MCI 134.33.100.0/24 AS701 Alternet 134.241.109.0/24 AS560 BBN Planet, New England Region 135.14.65.0/24 AS3111 Internet Direct Inc. (ASN-DIRE 136.140.9.0/24 AS3561 MCI 137.62.197.0/24 AS1794 SprintLink Pennsauken NJ 138.95.80.0/24 AS701 Alternet 138.108.100.0/24 AS3561 MCI 138.182.252.0/24 AS5855 Secretary of the Navy 138.182.254.0/24 AS5855 Secretary of the Navy 139.46.35.0/24 AS560 BBN Planet, New England Region 139.61.102.0/24 AS3111 Internet Direct Inc. (ASN-DIRE 139.61.103.0/24 AS3111 Internet Direct Inc. (ASN-DIRE 139.162.128.0/17 AS1136 Unisource Internet Service NL 140.188.86.0/24 AS174 Performance Systems Internatio 140.188.129.0/24 AS174 Performance Systems Internatio 140.188.198.0/24 AS174 Performance Systems Internatio 140.222.27.0/24 AS690 ANSNET (the former NSFNET back 140.222.43.0/24 AS690 ANSNET (the former NSFNET back 140.222.96.0/24 AS690 UNKNOWN 140.231.44.0/24 AS3561 MCI 140.250.41.0/24 AS560 BBN Planet, New England Region 141.227.111.0/24 AS2529 Demon Internet Ltd 142.77.19.0/24 AS813 UUNET Canada (ASN-UUNETCA-AS1) 142.77.248.0/24 AS813 UUNET Canada (ASN-UUNETCA-AS1) 143.93.32.0/19 AS517 Xlink 143.222.116.0/24 AS3407 Interpath 143.252.80.0/24 AS2856 BTnet UK Regional network 144.192.181.0/24 AS4200 AGIS (Apex Global Information 144.199.161.0/24 AS1238 ICM Malaysia (MIMOS) connectee 144.224.11.0/24 AS1239 SprintLink Backbone 144.224.12.0/24 AS1239 SprintLink Backbone 144.224.13.0/24 AS6176 UNKNOWN 144.224.14.0/24 AS6176 UNKNOWN 144.224.15.0/24 AS6176 UNKNOWN 144.224.16.0/24 AS6176 UNKNOWN 144.224.21.0/24 AS1239 SprintLink Backbone 144.224.22.0/24 AS1239 SprintLink Backbone 144.224.23.0/24 AS6175 UNKNOWN 144.224.24.0/24 AS6175 UNKNOWN 144.224.25.0/24 AS6175 UNKNOWN 144.224.26.0/24 AS6175 UNKNOWN 144.228.23.0/24 AS1790 SprintLink Washington D.C. 144.228.25.0/24 AS1790 SprintLink Washington D.C. 144.228.29.0/24 AS1790 SprintLink Washington D.C. 144.228.37.0/24 AS1791 SprintLink Fort Worth TX 144.228.38.0/24 AS1791 SprintLink Fort Worth TX 144.228.39.0/24 AS1791 SprintLink Fort Worth TX 144.228.41.0/24 AS1239 SprintLink Backbone 144.228.44.0/24 AS1239 SprintLink Backbone 144.228.47.0/24 AS1792 SprintLink Stockton CA 144.228.48.0/24 AS1792 SprintLink Stockton CA 144.228.49.0/24 AS1792 SprintLink Stockton CA 144.228.54.0/24 AS1239 SprintLink Backbone 144.228.55.0/24 AS1793 SprintLink Chicago IL 144.228.57.0/24 AS1793 SprintLink Chicago IL 144.228.58.0/24 AS1793 SprintLink Chicago IL 144.228.59.0/24 AS1793 SprintLink Chicago IL 144.228.63.0/24 AS1794 SprintLink Pennsauken NJ 144.228.64.0/24 AS1794 SprintLink Pennsauken NJ 144.228.65.0/24 AS1794 SprintLink Pennsauken NJ 144.228.66.0/24 AS1794 SprintLink Pennsauken NJ 144.228.67.0/24 AS1794 SprintLink Pennsauken NJ 144.228.68.0/24 AS1794 SprintLink Pennsauken NJ 144.228.69.0/24 AS1794 SprintLink Pennsauken NJ 144.228.73.0/24 AS1795 SprintLink Anaheim CA 144.228.74.0/24 AS1795 SprintLink Anaheim CA 144.228.75.0/24 AS1795 SprintLink Anaheim CA 144.228.76.0/24 AS1795 SprintLink Anaheim CA 144.228.77.0/24 AS1795 SprintLink Anaheim CA 144.228.78.0/24 AS1795 SprintLink Anaheim CA 144.228.79.0/24 AS1795 SprintLink Anaheim CA 144.228.83.0/24 AS6174 UNKNOWN 144.228.84.0/24 AS6174 UNKNOWN 144.228.85.0/24 AS6174 UNKNOWN 144.228.91.0/24 AS1239 SprintLink Backbone 144.228.93.0/24 AS6177 UNKNOWN 144.228.94.0/24 AS6177 UNKNOWN 144.228.95.0/24 AS6177 UNKNOWN 144.228.96.0/24 AS6177 UNKNOWN 144.228.103.0/24 AS1239 SprintLink Backbone 144.228.104.0/24 AS1239 SprintLink Backbone 144.228.120.0/24 AS1790 SprintLink Washington D.C. 144.228.121.0/24 AS1790 SprintLink Washington D.C. 144.228.122.0/24 AS1790 SprintLink Washington D.C. 144.228.123.0/24 AS1790 SprintLink Washington D.C. 144.228.124.0/24 AS1790 SprintLink Washington D.C. 144.228.125.0/24 AS1790 SprintLink Washington D.C. 144.228.126.0/24 AS1790 SprintLink Washington D.C. 144.228.127.0/24 AS1790 SprintLink Washington D.C. 144.228.128.0/24 AS1790 SprintLink Washington D.C. 144.228.130.0/24 AS1791 SprintLink Fort Worth TX 144.228.131.0/24 AS1791 SprintLink Fort Worth TX 144.228.132.0/24 AS1791 SprintLink Fort Worth TX 144.228.133.0/24 AS1791 SprintLink Fort Worth TX 144.228.134.0/24 AS1791 SprintLink Fort Worth TX 144.228.135.0/24 AS1791 SprintLink Fort Worth TX 144.228.140.0/24 AS1792 SprintLink Stockton CA 144.228.141.0/24 AS1792 SprintLink Stockton CA 144.228.142.0/24 AS1792 SprintLink Stockton CA 144.228.144.0/24 AS1792 SprintLink Stockton CA 144.228.145.0/24 AS1792 SprintLink Stockton CA 144.228.146.0/24 AS1792 SprintLink Stockton CA 144.228.147.0/24 AS1792 SprintLink Stockton CA 144.228.148.0/24 AS1792 SprintLink Stockton CA 144.228.150.0/24 AS1793 SprintLink Chicago IL 144.228.151.0/24 AS1793 SprintLink Chicago IL 144.228.152.0/24 AS1793 SprintLink Chicago IL 144.228.153.0/24 AS1793 SprintLink Chicago IL 144.228.154.0/24 AS1793 SprintLink Chicago IL 144.228.155.0/24 AS1239 SprintLink Backbone 144.228.156.0/24 AS1793 SprintLink Chicago IL 144.228.157.0/24 AS1793 SprintLink Chicago IL 144.228.158.0/24 AS1793 SprintLink Chicago IL 144.228.159.0/24 AS1793 SprintLink Chicago IL 144.228.160.0/24 AS1794 SprintLink Pennsauken NJ 144.228.161.0/24 AS1239 SprintLink Backbone 144.228.162.0/24 AS1794 SprintLink Pennsauken NJ 144.228.163.0/24 AS1794 SprintLink Pennsauken NJ 144.228.164.0/24 AS1794 SprintLink Pennsauken NJ 144.228.165.0/24 AS1794 SprintLink Pennsauken NJ 144.228.166.0/24 AS1792 SprintLink Stockton CA 144.228.166.0/24 AS1794 SprintLink Pennsauken NJ 144.228.214.0/24 AS1792 SprintLink Stockton CA 145.17.100.0/24 AS2856 BTnet UK Regional network 145.72.32.0/19 AS5484 BTnet Netherlands Regional Ser 145.72.64.0/19 AS5484 BTnet Netherlands Regional Ser 145.246.16.0/24 AS2856 BTnet UK Regional network 145.246.17.0/24 AS2856 BTnet UK Regional network 145.248.112.0/24 AS2706 HKSUPER 145.248.155.0/24 AS2706 HKSUPER 145.248.157.0/24 AS2706 HKSUPER 145.248.159.0/24 AS2706 HKSUPER 145.248.161.0/24 AS2706 HKSUPER 145.248.165.0/24 AS2706 HKSUPER 146.75.253.0/24 AS1257 SWIPnet Swedish IP Network 146.75.254.0/24 AS3301 TeliaNet Sweden 146.188.254.0/24 AS1849 PIPEX, Public IP EXchange 147.85.21.0/24 AS3951 ICONNET 147.85.25.0/24 AS3951 ICONNET 147.85.39.0/24 AS3951 ICONNET 147.85.44.0/24 AS3951 ICONNET 147.85.51.0/24 AS3951 ICONNET 147.85.115.0/24 AS3951 ICONNET 147.160.0.0/17 AS3561 MCI 147.160.128.0/18 AS3561 MCI 147.160.192.0/20 AS3561 MCI 147.160.208.0/20 AS3561 MCI 147.160.224.0/20 AS3561 MCI 147.160.224.0/19 AS3561 MCI 147.206.20.0/24 AS3561 MCI 148.59.5.0/24 AS2015 Msen, Inc. 148.59.15.0/24 AS2015 Msen, Inc. 148.59.16.0/24 AS2015 Msen, Inc. 148.59.221.0/24 AS2015 Msen, Inc. 148.59.224.0/24 AS2015 Msen, Inc. 148.59.228.0/24 AS2015 Msen, Inc. 148.59.229.0/24 AS2015 Msen, Inc. 148.59.231.0/24 AS2015 Msen, Inc. 148.59.232.0/24 AS2015 Msen, Inc. 148.59.234.0/24 AS2015 Msen, Inc. 148.59.241.0/24 AS2015 Msen, Inc. 148.59.242.0/24 AS2015 Msen, Inc. 148.59.245.0/24 AS2015 Msen, Inc. 148.59.246.0/24 AS2015 Msen, Inc. 148.59.247.0/24 AS2015 Msen, Inc. 148.94.210.0/24 AS5714 UNKNOWN 148.185.45.0/24 AS1849 PIPEX, Public IP EXchange 148.185.45.0/24 AS3851 SCS-NV 148.252.1.0/24 AS1849 PIPEX, Public IP EXchange 149.20.64.0/24 AS701 Alternet 149.212.64.0/20 AS1759 Telecom Finland iNET 150.185.128.0/18 AS1800 ICM-Atlantic 150.185.192.0/18 AS1800 ICM-Atlantic 151.185.7.0/24 AS279 SURAnet Southern AS 151.185.10.0/24 AS279 SURAnet Southern AS 152.129.186.0/24 AS4478 UNKNOWN 152.158.0.0/17 AS2686 OpenNet-Europe 152.158.192.0/24 AS2687 OpenNet-AP 152.158.192.0/18 AS2687 OpenNet-AP 152.158.192.16/28 AS2687 OpenNet-AP 152.158.192.32/27 AS2687 OpenNet-AP 152.158.192.81/32 AS2687 OpenNet-AP 152.158.208.1/32 AS2687 OpenNet-AP 152.158.212.1/32 AS2687 OpenNet-AP 152.158.212.2/32 AS2687 OpenNet-AP 152.158.212.16/28 AS2687 OpenNet-AP 152.158.212.32/28 AS2687 OpenNet-AP 152.158.212.64/32 AS2687 OpenNet-AP 152.158.212.65/32 AS2687 OpenNet-AP 152.158.212.66/32 AS2687 OpenNet-AP 152.158.212.67/32 AS2687 OpenNet-AP 152.158.212.68/32 AS2687 OpenNet-AP 152.158.212.69/32 AS2687 OpenNet-AP 152.158.212.70/32 AS2687 OpenNet-AP 152.158.212.71/32 AS2687 OpenNet-AP 152.158.212.72/32 AS2687 OpenNet-AP 152.158.212.80/32 AS2687 OpenNet-AP 152.158.212.89/32 AS2687 OpenNet-AP 152.158.212.90/32 AS2687 OpenNet-AP 152.158.212.93/32 AS2687 OpenNet-AP 152.158.215.1/32 AS2687 OpenNet-AP 152.158.244.1/32 AS2687 OpenNet-AP 152.158.245.1/32 AS2687 OpenNet-AP 152.158.247.1/32 AS2687 OpenNet-AP 152.158.248.0/24 AS2687 OpenNet-AP 152.158.248.1/32 AS2687 OpenNet-AP 152.158.248.2/32 AS2687 OpenNet-AP 152.158.248.16/28 AS2687 OpenNet-AP 152.158.248.32/27 AS2687 OpenNet-AP 152.158.248.103/32 AS2687 OpenNet-AP 152.158.254.1/32 AS2687 OpenNet-AP 152.163.193.64/26 AS2056 AOL-AS 152.163.199.0/24 AS2056 AOL-AS 152.163.200.0/28 AS2056 AOL-AS 152.163.200.0/24 AS2056 AOL-AS 152.163.231.0/24 AS2056 AOL-AS 152.163.232.0/23 AS2056 AOL-AS 152.163.234.0/23 AS2056 AOL-AS 152.175.0.0/17 AS1668 UNKNOWN 152.176.0.0/17 AS1333 ANS Atlanta - DNSS 107 152.176.128.0/17 AS1330 ANS St. Louis - DNSS 83 152.177.0.0/17 AS1332 ANS Denver - DNSS 99 152.177.128.0/17 AS1328 ANS Houston - DNSS 67 152.178.0.0/18 AS1328 ANS Houston - DNSS 67 152.178.64.0/18 AS1335 ANS Honolulu - CNSS 120 152.178.128.0/17 AS1322 ANS Los Angeles - DNSS 19 152.179.0.0/17 AS1321 ANS San Francisco - DNSS 11 152.179.128.0/17 AS1326 ANS Hartford - DNSS 51 152.180.0.0/17 AS-set UNKNOWN 152.180.128.0/17 AS-set UNKNOWN 152.181.0.0/18 AS1329 ANS Greensboro - DNSS 75 152.181.128.0/17 AS-set UNKNOWN 152.181.184.0/22 AS1667 UNKNOWN 152.181.240.0/26 AS1670 ANS-BLK AS 152.182.0.0/17 AS1323 ANS Chicago - DNSS 27 152.183.0.0/17 AS1331 ANS Seattle - DNSS 91 152.183.128.0/17 AS1334 ANS Albuquerque - CNSS 112 152.184.0.0/17 AS1333 ANS Atlanta - DNSS 107 152.184.128.0/17 AS1330 ANS St. Louis - DNSS 83 152.185.0.0/17 AS1332 ANS Denver - DNSS 99 152.185.128.0/17 AS1328 ANS Houston - DNSS 67 152.186.0.0/18 AS1328 ANS Houston - DNSS 67 152.186.64.0/18 AS1335 ANS Honolulu - CNSS 120 152.186.128.0/17 AS1322 ANS Los Angeles - DNSS 19 152.187.0.0/17 AS1321 ANS San Francisco - DNSS 11 152.187.128.0/17 AS1326 ANS Hartford - DNSS 51 152.188.0.0/17 AS-set UNKNOWN 152.188.128.0/17 AS-set UNKNOWN 152.189.0.0/18 AS1329 ANS Greensboro - DNSS 75 152.189.128.0/17 AS1327 ANS Washington D.C. - DNSS 59 152.189.184.0/22 AS1667 UNKNOWN 152.190.0.0/17 AS1323 ANS Chicago - DNSS 27 152.191.0.0/17 AS1331 ANS Seattle - DNSS 91 152.191.128.0/17 AS1334 ANS Albuquerque - CNSS 112 153.39.129.0/24 AS701 Alternet 153.39.130.0/24 AS701 Alternet 153.39.132.0/24 AS701 Alternet 153.39.192.0/24 AS701 Alternet 153.39.193.0/24 AS701 Alternet 153.39.236.0/24 AS701 Alternet 153.39.237.0/24 AS701 Alternet 153.39.238.0/24 AS701 Alternet 153.39.239.0/24 AS701 Alternet 153.39.240.0/24 AS701 Alternet 153.39.241.0/24 AS701 Alternet 153.39.242.0/24 AS701 Alternet 153.39.244.0/24 AS701 Alternet 153.39.245.0/24 AS701 Alternet 153.39.246.0/24 AS701 Alternet 153.39.247.0/24 AS701 Alternet 153.39.248.0/24 AS701 Alternet 153.39.249.0/24 AS701 Alternet 153.39.251.0/24 AS701 Alternet 153.39.252.0/24 AS701 Alternet 153.39.253.0/24 AS701 Alternet 153.96.80.0/21 AS517 Xlink 153.96.92.0/24 AS517 Xlink 153.96.188.0/22 AS517 Xlink 153.96.230.0/24 AS517 Xlink 155.39.191.0/24 AS2685 IGN OpenNet - US 155.134.60.0/24 AS701 Alternet 155.140.124.0/24 AS1849 PIPEX, Public IP EXchange 155.203.254.0/24 AS3561 MCI 155.229.176.0/22 AS7045 UNKNOWN 156.46.0.0/17 AS4550 Alpha.net Corporation (ASN-AN- 156.46.128.0/17 AS4550 Alpha.net Corporation (ASN-AN- 156.51.204.0/24 AS3301 TeliaNet Sweden 156.114.200.0/24 AS2529 Demon Internet Ltd 157.25.64.0/23 AS1887 NASK 157.25.98.0/24 AS1887 NASK 157.184.150.0/24 AS1330 ANS St. Louis - DNSS 83 157.232.100.0/24 AS3561 MCI 158.43.200.0/24 AS701 Alternet 158.118.51.0/24 AS701 Alternet 158.155.24.0/22 AS1221 AARNET-AS 158.174.254.0/24 AS2856 BTnet UK Regional network 159.24.7.0/24 AS4286 UNKNOWN 159.87.34.0/24 AS200 BBN Planet Western Region 159.179.0.0/24 AS3561 MCI 159.197.158.0/23 AS2529 Demon Internet Ltd 159.245.84.0/22 AS1849 PIPEX, Public IP EXchange 159.245.104.0/22 AS1849 PIPEX, Public IP EXchange 160.92.0.0/17 AS3215 RAIN 160.92.128.0/24 AS3215 RAIN 160.92.129.0/24 AS2917 OLEANE - PIPEX International 160.92.130.0/23 AS3215 RAIN 160.92.132.0/22 AS3215 RAIN 160.92.136.0/21 AS3215 RAIN 160.92.144.0/20 AS3215 RAIN 160.92.160.0/19 AS3215 RAIN 160.92.192.0/18 AS3215 RAIN 161.51.224.0/20 AS1849 PIPEX, Public IP EXchange 161.52.192.0/19 AS2845 SUNET-LUND 161.120.6.0/24 AS3561 MCI 161.223.220.0/22 AS1 BBN Planet backbone 161.223.224.0/24 AS1 BBN Planet backbone 162.81.141.0/24 AS3561 MCI 163.12.0.0/23 AS3576 PREPnet-EAST 163.12.5.0/24 AS3576 PREPnet-EAST 163.12.16.0/22 AS3576 PREPnet-EAST 163.12.21.0/24 AS3576 PREPnet-EAST 163.12.22.0/24 AS3576 PREPnet-EAST 163.12.23.0/24 AS3576 PREPnet-EAST 163.12.24.0/21 AS3576 PREPnet-EAST 163.12.32.0/19 AS3576 PREPnet-EAST 163.12.64.0/20 AS3576 PREPnet-EAST 163.12.81.0/24 AS3576 PREPnet-EAST 163.12.84.0/22 AS3576 PREPnet-EAST 163.12.88.0/21 AS3576 PREPnet-EAST 163.12.96.0/19 AS3576 PREPnet-EAST 163.12.128.0/21 AS3576 PREPnet-EAST 163.12.136.0/22 AS3576 PREPnet-EAST 163.12.144.0/20 AS3576 PREPnet-EAST 163.12.160.0/19 AS3576 PREPnet-EAST 163.12.192.0/21 AS3576 PREPnet-EAST 163.12.240.0/20 AS3576 PREPnet-EAST 163.49.131.0/24 AS3561 MCI 163.49.132.0/22 AS3561 MCI 163.49.136.0/22 AS3561 MCI 163.49.140.0/23 AS3561 MCI 163.49.142.0/24 AS3561 MCI 163.168.212.0/24 AS3303 Unisource Business Networks (S 163.249.43.0/24 AS3739 NEWNET 163.249.53.0/24 AS3739 NEWNET 163.249.54.0/24 AS3739 NEWNET 163.249.57.0/24 AS3739 NEWNET 163.249.140.0/22 AS3739 NEWNET 163.249.160.0/21 AS3739 NEWNET 163.249.168.0/24 AS3739 NEWNET 163.249.169.0/24 AS3739 NEWNET 163.249.170.0/24 AS3739 NEWNET 164.99.56.192/26 AS2041 CRL-GATE 164.100.64.0/20 AS3561 MCI 164.100.80.0/24 AS3561 MCI 164.100.81.0/24 AS3561 MCI 164.100.82.0/23 AS3561 MCI 164.100.84.0/22 AS3561 MCI 164.100.88.0/21 AS3561 MCI 164.100.96.0/19 AS3561 MCI 164.100.128.0/17 AS3561 MCI 164.100.167.0/24 AS3561 MCI 164.100.199.0/24 AS3561 MCI 164.103.3.0/24 AS3561 MCI 164.131.247.0/24 AS3215 RAIN 164.131.248.0/24 AS3215 RAIN 165.113.197.0/24 AS6006 UNKNOWN 165.113.198.0/24 AS6006 UNKNOWN 165.113.199.0/24 AS6006 UNKNOWN 165.113.211.0/24 AS6006 UNKNOWN 165.113.219.0/24 AS6006 UNKNOWN 165.166.123.0/24 AS3561 MCI 165.215.64.0/18 AS4183 Compuserve 165.215.191.0/24 AS5090 UNKNOWN 166.38.40.0/24 AS3561 MCI 166.147.0.0/18 AS3561 MCI 166.147.64.0/18 AS3561 MCI 166.147.128.0/18 AS3561 MCI 166.147.192.0/18 AS3561 MCI 166.150.0.0/18 AS3561 MCI 166.150.64.0/18 AS3561 MCI 166.150.128.0/18 AS3561 MCI 166.150.192.0/18 AS3561 MCI 166.151.0.0/18 AS3561 MCI 166.151.64.0/18 AS3561 MCI 166.151.128.0/18 AS3561 MCI 166.151.192.0/18 AS3561 MCI 167.79.70.0/24 AS1790 SprintLink Washington D.C. 167.79.91.0/24 AS1790 SprintLink Washington D.C. 167.170.6.0/23 AS3313 I.Net S.p.A. 167.170.32.0/23 AS3313 I.Net S.p.A. 168.14.1.0/24 AS3561 MCI 168.14.2.0/23 AS3561 MCI 168.14.4.0/22 AS3561 MCI 168.14.8.0/21 AS3561 MCI 168.14.16.0/20 AS3561 MCI 168.29.0.0/17 AS3492 ATLANTA 168.175.70.0/24 AS3561 MCI 168.175.170.0/24 AS3561 MCI 168.175.171.0/24 AS3561 MCI 168.175.172.0/24 AS3561 MCI 168.224.128.0/24 AS2856 BTnet UK Regional network 168.247.253.0/24 AS174 Performance Systems Internatio 168.247.254.0/24 AS174 Performance Systems Internatio 169.132.80.0/24 AS5000 IDT Corporation 169.200.1.0/24 AS3561 MCI 170.115.249.0/24 AS4969 Net Access 170.194.51.0/24 AS1849 PIPEX, Public IP EXchange 170.215.192.0/20 AS5650 Electric Lightwave Inc, 801-52 171.25.128.0/20 AS3301 TeliaNet Sweden 171.25.144.0/21 AS3301 TeliaNet Sweden 171.25.152.0/21 AS3301 TeliaNet Sweden 171.30.170.0/24 AS2856 BTnet UK Regional network 192.103.70.0/26 AS1673 UNKNOWN 192.103.74.0/27 AS1673 - 192.231.184.4/32 AS174 Performance Systems Internatio 192.233.87.0/26 AS560 NEARNET-EXT-AS 194.23.1.36/30 AS3305 Internet Service Provider back 194.51.28.152/30 AS1667 - 194.178.245.32/28 AS5417 Demon Internet Ltd 195.212.2.0/28 AS2686 Autonomous System number for I 195.212.6.0/26 AS2686 Autonomous System number for I 195.212.48.0/27 AS2686 Autonomous System number for I 195.212.69.0/26 AS2686 Autonomous System number for I 195.212.74.0/27 AS2686 Autonomous System number for I 195.212.78.0/28 AS2686 Autonomous System number for I 195.212.106.0/26 AS2686 Autonomous System number for I 195.212.110.0/27 AS2686 Autonomous System number for I 195.212.226.0/28 AS2686 Autonomous System number for I 198.83.24.0/26 AS1673 - 198.83.47.0/26 AS1673 - 198.83.195.0/26 AS1673 - 198.83.209.0/26 AS1673 - 198.83.210.0/26 AS1673 - 199.99.247.32/27 AS174 Performance Systems Internatio 199.221.28.0/26 AS1673 - 199.221.38.0/27 AS1673 - 199.221.47.0/25 AS1673 - 199.222.34.0/26 AS1673 - 200.229.224.8/29 AS2685 IGN OpenNet - US 200.229.224.16/29 AS2685 IGN OpenNet - US 200.229.229.64/26 AS2685 IGN OpenNet - US 200.229.229.128/26 AS2685 IGN OpenNet - US 200.229.231.16/28 AS2685 IGN OpenNet - US 200.229.231.32/28 AS2685 IGN OpenNet - US 200.229.234.0/25 AS2685 IGN OpenNet - US 202.50.137.64/27 AS2687 OpenNet-AP 202.135.0.0/26 AS2687 OpenNet-AP 202.135.0.64/26 AS2687 OpenNet-AP 202.135.0.128/26 AS2687 OpenNet-AP 202.135.0.192/26 AS2687 OpenNet-AP 202.135.1.0/26 AS2687 OpenNet-AP 202.135.1.64/26 AS2687 OpenNet-AP 202.135.1.128/26 AS2687 OpenNet-AP 202.135.1.192/26 AS2687 OpenNet-AP 202.135.2.64/26 AS2687 OpenNet-AP 202.135.4.0/26 AS2687 OpenNet-AP 202.135.4.64/26 AS2687 OpenNet-AP 202.135.4.128/26 AS2687 OpenNet-AP 202.135.4.192/26 AS2687 OpenNet-AP 202.135.17.0/30 AS2687 OpenNet-AP 202.135.17.8/30 AS2687 OpenNet-AP 202.135.17.12/30 AS2687 OpenNet-AP 202.135.18.0/28 AS2687 OpenNet-AP 202.135.18.16/28 AS2687 OpenNet-AP 202.135.18.32/28 AS2687 OpenNet-AP 202.135.18.48/28 AS2687 OpenNet-AP 202.135.18.64/28 AS2687 OpenNet-AP 202.135.18.96/28 AS2687 OpenNet-AP 202.135.20.0/26 AS2687 OpenNet-AP 202.135.20.128/26 AS2687 OpenNet-AP 202.135.22.0/26 AS2687 OpenNet-AP 202.135.22.64/26 AS2687 OpenNet-AP 202.135.22.128/26 AS2687 OpenNet-AP 202.135.22.192/26 AS2687 OpenNet-AP 202.135.40.16/28 AS2687 OpenNet-AP 202.135.40.32/27 AS2687 OpenNet-AP 204.117.90.128/25 AS3491 CAIS-ASN 204.137.135.0/28 AS3830 Net99 204.146.30.25/32 AS2686 Autonomous System number for I 204.148.62.0/26 AS1673 - 204.148.68.0/26 AS1673 - 204.150.183.0/25 AS1667 - 204.151.106.0/26 AS1673 - 204.151.152.0/26 AS1673 - 204.157.1.0/30 AS3830 Net99 204.157.228.0/30 AS3830 Net99 205.156.223.176/28 AS2702 INTERSERVE

1 0

SYN attack makes NandO Times as well...
by Michael A. Patton 13 Sep '96

13 Sep '96

The NandO Times also has an article, from The Associated Press, on this. <URL:http://www.nando.net/newsroom/ntn/nation/091396/nation8_825.html>

4 3

Apologies for that spam of my message...
by Dalvenjah FoxFire 13 Sep '96

13 Sep '96

I'd like to express my apologies for that mail getting sent to the list 4+ times (what I've been told). For some reason, sendmail on my end never registered it as having gotten to the list, despite having run the queue a whole bunch of times since it was written. I wonder if it had to do with the sprint problems or no, but oh well. Again, I apologize for this mistake. -dalvenjah Dalvenjah FoxFire, the Teddy Dragon (also known as Sven Nielsen to some :) dalvenjah(a)dal.net --- dalvenjah on IRC Remember: if you're not on DALnet, you're on the wrong IRC server!! (/serv irc.dal.net 7000 or telnet telnet.dal.net to try it out) -- ____ _ _ _ "I had the dagger in my hand, and he has | _ \ __ _| |_ _____ _ _ (_)__ _| |_the indecency to start dying on his own!" | |_) / _` | \ V / -_) ' \ | / _` | ' \ --Ambassador G'kar, Babylon 5 |____/\__,_|_|\_/\___|_||_|/ \__,_|_||_| FoxFire -- dalvenjah(a)dal.net -- (SN90) |__/

1 0

Re[4]: SYN floods (was: does history repeat itself?)
by pcalhoun＠usr.com 13 Sep '96

13 Sep '96

Curtis, As I stated in my previous e-mail, we could do this by adding this to our release notes in our product, describing the problem and advising against not taking measures. However, this would only apply to our customers, which I would venture to say that most already do understand the problem :). However, if there is anything that I can do to help, please let me know since I take the threat of the "imminent death of the internet" very seriously. Pat R. Calhoun e-mail: pcalhoun(a)usr.com Project Engineer - Lan Access R&D phone: (847) 933-5181 US Robotics Access Corp. ______________________________ Reply Separator _________________________________ Subject: Re: Re[2]: SYN floods (was: does history repeat itself?) Author: Curtis Villamizar <curtis(a)ans.net> at Internet Date: 9/12/96 1:44 PM In message <233128C0.3000(a)usr.com>, Pat Calhoun writes: > This is a Mime message, which your current mail reader > may not understand. Parts of the message will appear as > text. To process the remainder, you will need to use a Mime > compatible mail reader. Contact your vendor for details. > > --IMA.Boundary.388702248 > Content-Type: text/plain; charset=US-ASCII > Content-Transfer-Encoding: 7bit > Content-Description: cc:Mail note part > > Perry, > > This is actually quite simple to implement on Dial Access Routers, > and obviously this is the best place to add the filtering. > > > Pat R. Calhoun e-mail: pcalhoun(a)usr.com > Project Engineer - Lan Access R&D phone: (847) 933-5181 > US Robotics Access Corp. I agree with you completely -- sort of. Only problem is there are thought to be some 3,000 dial access providers. Many of them barely know what a TCP SYN is, let alone why they need to block ones with random source addresses and how. Unless of course you are volunteering to explain it and help them. Thanks in advance. :-) Curtis > ______________________________ Reply Separator ______________________________ > ___ > Subject: Re: SYN floods (was: does history repeat itself?) > Author: "Perry E. Metzger" <perry(a)piermont.com> at Internet > Date: 9/9/96 1:19 PM > > > > Re: SYN floods > > PANIX, a large public access provider in New York, was badly hit with > SYN flood attacks from random source addresses over the last few > days. It nearly wrecked them. > > I think its time for the larger providers to start filtering packets > coming from customers so that they only accept packets with the > customer's network number on it. > > Yes, its a load on routers. Yes, its nasty for the mobile IP weenies. > Unfortunately, the only known way to stop this. Many TCPs go belly up > as soon as they get SYN flooded -- its a defect in the protocol > design, and other than Karn style anti-clogging tokens ("cookies") > being put into a TCP++ and mass implemented worldwide soon, the only > reasonable way to stop this sort of terrorism is provider filtering. > > Perry > --IMA.Boundary.388702248 > Content-Type: text/plain; charset=US-ASCII; name="RFC822 message headers" > Content-Transfer-Encoding: 7bit > Content-Description: cc:Mail note part > Content-Disposition: attachment; filename="RFC822 message headers" > > Received: from usr.com (mailgate.usr.com) by robogate2.usr.com with SMTP > (IMA Internet Exchange 2.02 Enterprise) id 233028F0; Sun, 8 Sep 96 12:29:51 > -0500 > Received: from merit.edu by usr.com (8.7.5/3.1.090690-US Robotics) > id MAA17658; Mon, 9 Sep 1996 12:33:14 -0500 (CDT) > Received: from localhost (daemon@localhost) by merit.edu (8.7.5/merit-2.0) wi > th > SMTP id NAA17064; Mon, 9 Sep 1996 13:20:33 -0400 (EDT) > Received: by merit.edu (bulk_mailer v1.5); Mon, 9 Sep 1996 13:19:08 -0400 > Received: (from daemon@localhost) by merit.edu (8.7.5/merit-2.0) id NAA16987 > for > nanog-outgoing; Mon, 9 Sep 1996 13:19:08 -0400 (EDT) > Received: from jekyll.piermont.com (jekyll.piermont.com [206.1.51.15]) by > merit.edu (8.7.5/merit-2.0) with ESMTP id NAA16982 for <nanog(a)merit.edu>; Mon > , 9 > Sep 1996 13:19:05 -0400 (EDT) > Received: from localhost (perry@localhost) by jekyll.piermont.com (8.7.5/8.6. > 12) > with SMTP id NAA24855 for <nanog(a)merit.edu>; Mon, 9 Sep 1996 13:19:02 -0400 > (EDT) > Message-Id: <199609091719.NAA24855(a)jekyll.piermont.com> > X-Authentication-Warning: jekyll.piermont.com: Host perry@localhost didn't us > e > HELO protocol > To: nanog(a)merit.edu > Subject: Re: SYN floods (was: does history repeat itself?) > In-reply-to: Your message of "Mon, 09 Sep 1996 12:47:13 EDT." > <199609091647.MAA01458(a)tomservo.mindspring.com> > Reply-To: perry(a)piermont.com > X-Reposting-Policy: redistribute only with permission > Date: Mon, 09 Sep 1996 13:19:02 -0400 > From: "Perry E. Metzger" <perry(a)piermont.com> > Sender: owner-nanog(a)merit.edu > --IMA.Boundary.388702248--

1 0

Re[4]: SYN floods (was: does history repeat itself?)
by pcalhoun＠usr.com 13 Sep '96

13 Sep '96

John, This sort of feature could be easily added into a NAS, but I question your implementation details. If this filter was turned on by default, then this could "break" other types of services which may require source ip addresses other than the one which was negotiated to the user. This would mean that a customer could perform a flash upgrade and find that their service no longer operates (a technical support nightmare). Would you be willing to consider such a feature where it would have to be enabled (and is disabled by default) and a very well explained document with the release notes to service providers advising them of the risk of not enabling this switch?? Pat R. Calhoun e-mail: pcalhoun(a)usr.com Project Engineer - Lan Access R&D phone: (847) 933-5181 US Robotics Access Corp. ______________________________ Reply Separator _________________________________ Subject: Re: Re[2]: SYN floods (was: does history repeat itself?) Author: "John G. Scudder" <jgs(a)ieng.com> at Internet Date: 9/12/96 2:33 PM At 1:44 PM -0400 9/12/96, Curtis Villamizar wrote: >I agree with you completely -- sort of. Only problem is there are >thought to be some 3,000 dial access providers. Many of them barely >know what a TCP SYN is, let alone why they need to block ones with >random source addresses and how. Unless of course you are ^^^^^^^^^^^^^^^^^^^^^^^^ >volunteering to explain it and help them. Thanks in advance. :-) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Curtis, this is a great point. USR and other NAS vendors are actually in a great position to do exactly this, by changing their boxes to block random addresses *by default* on dial-up ports. This is of course exactly the point Vadim and others keep making, and of course as they point out there ought to be a knob to disable it if desired. Insofar as guys who "barely know what a TCP SYN is" are unlikely to twist the knobs, defaulting filtering to "block spoofed addresses" seems like the best and maybe only way to get them to do it. How about it, USR &al? --John -- John Scudder email: jgs(a)ieng.com Internet Engineering Group, LLC phone: (313) 669-8800 122 S. Main, Suite 280 fax: (313) 669-8661 Ann Arbor, MI 41804 www: http://www.ieng.com

1 0

Re[4]: SYN floods (was: does history repeat itself?)
by pcalhoun＠usr.com 13 Sep '96

13 Sep '96

Joel, If I understand what you are stating is that the filtering which I have described could work for dial-up users, but not for customers which have a dedicated "leased" line into the network. You state that this is not possible due to the CPU overhead that the filtering of each packet creates. Out of curiosity, what would the CPU usage be on a typical router in your installation??? Also, do we know what the overhead is for a single filter at the ingress on a router such as a Cisco??? Pat R. Calhoun e-mail: pcalhoun(a)usr.com Project Engineer - Lan Access R&D phone: (847) 933-5181 US Robotics Access Corp. ______________________________ Reply Separator _________________________________ Subject: Re: Re[2]: SYN floods (was: does history repeat itself?) Author: Joel Gallun <joel(a)linux.wauug.org> at Internet Date: 9/12/96 2:52 PM What you propose is a Good Thing (tm), but I don't think it's sufficient. It still doesn't protect the 'net from antisocial behavior perpetrated by someone who has penetrated a system with dedicated access to the 'net. It seems like it would still be necessary for anyone selling dedicated access to install Good Neighboor (tm) anti-spoofing filters on their inbound interfaces (which probably requires MIPS that the routers in the field don't have). Regards, Joel On Thu, 12 Sep 1996, John G. Scudder wrote: > At 1:44 PM -0400 9/12/96, Curtis Villamizar wrote: > >I agree with you completely -- sort of. Only problem is there are > >thought to be some 3,000 dial access providers. Many of them barely > >know what a TCP SYN is, let alone why they need to block ones with > >random source addresses and how. Unless of course you are > ^^^^^^^^^^^^^^^^^^^^^^^^ > >volunteering to explain it and help them. Thanks in advance. :-) > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > > Curtis, this is a great point. USR and other NAS vendors are actually in a > great position to do exactly this, by changing their boxes to block random > addresses *by default* on dial-up ports. This is of course exactly the > point Vadim and others keep making, and of course as they point out there > ought to be a knob to disable it if desired. > > Insofar as guys who "barely know what a TCP SYN is" are unlikely to twist > the knobs, defaulting filtering to "block spoofed addresses" seems like the > best and maybe only way to get them to do it. > > How about it, USR &al? > > --John > > -- > John Scudder email: jgs(a)ieng.com > Internet Engineering Group, LLC phone: (313) 669-8800 > 122 S. Main, Suite 280 fax: (313) 669-8661 > Ann Arbor, MI 41804 www: http://www.ieng.com > >

1 0

[fwd] Cracker Attack Paralyzes Panix
by Paul Ferguson 13 Sep '96

13 Sep '96

FYI: Edupage excerpt of a WSJ article. - paul >Date: Thu, 12 Sep 1996 17:18:14 -0400 (EDT) >From: Edupage Editors <educom(a)elanor.oit.unc.edu> >To: "EDUCOM Edupage Mailing List" <edupage(a)elanor.oit.unc.edu> >Subject: Edupage, 12 September 1996 > >CRACKER ATTACK PARALYZES PANIX >Repeated attacks by a computer cracker have virtually shut down New York's >Public Access Networks Corp., better known as Panix. The attacks have >overwhelmed the computers' capacity to respond to requests for an >"electronic handshake" by sending as many as 150 bogus requests a second. >"This is the first major attack of a kind that I believe to be the final >Internet security problem," says a Lucent Technologies Internet security >expert, who says he "has been waiting" for just such an event. Internet >computers have no quick way of distinguishing these bogus requests from real >ones, and even when security software is upgraded to ease the problem, the >crackers could respond with even more intense assaults. "There's going to >be the usual arms race," predicts the Lucent security expert, between >improved security measures and crackers' ability to disable them. (Wall >Street Journal 12 Sep B1) >

2 1

Re: SYN floods continue
by Vadim Antonov 13 Sep '96

13 Sep '96

Vern Paxson <vern(a)ee.lbl.gov> wrote: >In my Internet end-to-end routing study I found that fully 50% of the pairs >of paths through the Internet had a major asymmetry at the end of 1995. Sure, but where the asymmetry is? Certainly not on tail circuits of single-homed customers :) Moreover, multi-homed non-transit networks still announce all routes to all places; i.e. the filtering i was talking about will still work. It breaks on transit networks, i.e. the backbones; but people who run backbones are presumeably clueful enough to disable the filtering on backbone links, and leave it on on customer tail links. >"Major" meaning: visited at least one different city in the two directions. >(30% visited at least one different AS.) This was a significant increase >over the same figure for the end of 1994, 30%. So it may be quite hard to >make and keep Internet routing symmetric. Routing *must* be symmetrical within IGP only networks if metrics in different directions are symmetrical. When the packets leave the routing domain, that's another story. Again, the rule is "dont accept packets from an interface if there's no route for their source addresses pointing back to the same interface". Note that that route does not have to be the best one -- just that the router gets it from somewhere. --vadim

3 2

Re: SYN floods - possible solution? (fwd)
by Michael Dillon 13 Sep '96

13 Sep '96

Now here is something that could be used by sites to protect against SYN flood attacke assuming that they can build a special custom box with enough RAM to buffer the sockets for 30 seconds or more. How high a rate can SYN floods come in at? I've heard of 1,000 per sec which implies that this box needs to hold open 30,000 to 75,000 potential sockets. Is there any problem within IPv4 (seq #'s?) that would make this inherently impossible? Michael Dillon - ISP & Internet Consulting Memra Software Inc. - Fax: +1-604-546-3049 http://www.memra.com - E-mail: michael(a)memra.com ---------- Forwarded message ---------- Date: Fri, 13 Sep 1996 01:36:54 -0400 (EDT) From: "Roderick Murchison, Jr." <murchiso(a)vivid.newbridge.com> To: firewall-1(a)applicom.co.il Cc: firewalls(a)GreatCircle.COM Subject: Re: SYN floods - possible solution? On Thu, 12 Sep 1996, Blast wrote: > This problem has kept me awake more than coffee. :-) Ditto... I just woke up *again* with a kludgy but potential defense... sorry if this is totally out of whack, but I'm really beat! Ok. say you have a firewall between your network and you Internet connection. If that firewall could detect and *detain* a segment with the SYN option set, then see if the set source IP answers an ICMP echo request, we could effectively determine whether or not the SYN could be dropped at the firewall and not sent through to spam our hosts. If the source responds, release the SYN and let it pass through to the intended host. If it does not, trash the SYN and log the failure. Some moderate tracking and aging methods could be employed to intelligently quick drop sources we know are recently offline, and lessen the amount of echo requests we send out. Could this be a potential defense? If so, what products would be best suited to implement this? hope this helps, -r Roderick Murchison, Jr. murchiso(a)vivid.newbridge.com Newbridge Networks, Inc. office: (703) 708-5930 Product Manager - VIVID ACS fax: (703) 708-5937 Herndon, VA 22070-5241 http://www.vivid.newbridge.com

7 7