- Test - lists.nanog.org

Re: Ping flooding (fwd)
by Daniel W. McRobb 10 Jul '96

10 Jul '96

> | But please, let us not turn this into "my box is better than your > | box". > > Why not? I'm sure there are people who would LOVE to see > people buying up all the NSSes that ANS is throwing away. > > They're *fabulous*. > > Sean. Folks, that wasn't the point (at least not mine). The point was (from me anyway) that this kind of data collection can be very useful for network architecture, and I'd love to have it in all our routers (and I really couldn't care less who the vendor is; it just so happens we have a lot of Ciscos so that's just one where I'd like to have it). We've used the data quite a bit. Blurbs about the NSSes were just clarifications of what it is we'd like to have elsewhere (there are several things about the NSS collection of this data that are less-than-optimal in a world with lots of CIDR and subnetting, if that gives anyone a warm fuzzy :-)). I don't think ANS is alone here, but if so, I'll crawl back under my rock. ;-) I know there were folks at ISMA interested in this kind of data; maybe they've changed their minds. >From my perspective, it would be nice if we (as ISPs) actually had a reasonable consensus on what kinds of data we want from our routers that we can't currently get (whether due to no implementation, troublesome implementation, or just bad hair days). Just MHO, and possibly well outside nanog. I'm still curious about field experiences w/ running the flow-switching stuff on a busy router. Anyone out there doing it? Define busy however you'd like, as long as you clarify. Private email is fine. Daniel ~~~~~~

1 0

On another topic ... :-)
by John Scoggin 10 Jul '96

10 Jul '96

I ran across an interesting document on the FCC web site and was wondering if there was an Internet analog - or maybe there should be. Apparently, the FCC started a Network Reliability Council composed of IECs, LECs, CAPs, and vendors to compose a best practices manual. What makes it interesting is that they surveyed the various carriers five years later to determine which practices had been adopted, to what extent they had been implemented, and whether they were deemed cost effective. The results were rendered in a report from the Office of Engineering & Technology (FCC). I sent mail to the FCC folks yesterday trying to track down the original report to aid me in starting our carrier operations off on the right foot. Does something like this best practices document exist? If not, here is an opportunity for someone to make some money putting one together - I'd gladly pay a couple hundred bucks for one! gratituitous barb follows --> [maybe Metcalfe could write one :-) ] John K. Scoggin, Jr., Staff Technical Consultant, Advanced Technologies / Chief Technical Advisor, Telecom Infrastructure Services Delmarva Power (scoggin(a)delmarva.com) 302-451-5200

3 2

Re: Ping flooding (fwd)
by Daniel W. McRobb 10 Jul '96

10 Jul '96

> On Jul 9, 14:21, Curtis Villamizar <curtis(a)ans.net> wrote: > > The NSS routers allow us to do statistical sampling continuously and > > the occurance of a source address at an entry point where it does not > > usually enter can be detected and has in the past been used to > > followup these sort of attacks after the fact. Other routers are not > > capable of doing this but if the offense is repeated, successive > > monitoring can be set up until the source is isolated. > > > > We have requested the same sort of statistical sampling from Cisco and > > Bay (and BNR/NSC). It is a long ways back on the development schedule > > Maybe I'm missing something, but flow switching stats from Ciscos > should do exactly this: > > SrcIf SrcIPaddress DstIf DstIPaddress Pr DstP SrcP Pkts B/Pk Active > Se1/0 194.130.16.17 Se1/6 130.144.65.1 11 0035 0035 2 69 0.0 > Et0/2 193.122.198.1 Se1/1 128.218.14.87 06 0050 0FA3 2 40 0.0 > Se1/5 130.144.65.1 Se1/0 194.130.16.17 11 0035 0035 2 69 0.0 > Se1/1 153.36.40.52 Et0/1 193.74.242.1 06 0413 0050 4 44 9.6 > Se1/5 194.178.24.22 Se1/7 146.228.10.11 06 0407 0050 124 40 207.6 > Se1/7 146.228.10.11 Se1/6 194.178.24.22 06 0050 0405 648 550 673.4 > Se1/5 194.165.95.69 Se1/0 205.216.146.69 06 0430 0050 5 164 6.2 > > etc, etc. Dump, then grep. The sampling Curtis mentioned on the NSS routers is a bit different. For one, it doesn't really impact forwarding performance (and hopefully, if/when implemented on the Bay, will not impact forwarding performance). Secondly, there's a lot more information available if you need it (packet headers or even payload). But what we're specifically looking for in terms of continuous sampling (such as that we do on the NSS routers) is a net matrix... if you changed the Cisco flow switching stuff to use network numbers (and mask), you'd have something very much like what we're looking for in terms of continuous sampling. From there we build AS matrices, etc. The other thing about the flow-switching data that's different than the NSS (and probably what we'll get from Bay) is that there aren't really any nice ways of retrieving/storing the data automatically. As Curtis pointed out, the data is mostly used for capacity planning and other network architecture issues. I have not receieved a request to track down a cracker with this type of data in a very long time. Maybe I've just been lucky. :-) Daniel ~~~~~~

3 2

Re: Ping flooding (fwd)
by Daniel W. McRobb 10 Jul '96

10 Jul '96

> > 'tis also very important to know the route taken for a net when > > analyzing the data. Discrepancies here can be huge and completely > > invalidate any conclusions you might make about how much traffic is > > traversing a given path. > > For this we like combined interface stats; AS-based traffic matrices > are (from our point of view) mostly useful for end-to-end measurements. Forgot to answer this one point... Combined interface stats aren't very useful for a scenario we commonly entertain: what will happen if I move Big Customer A's ingress to ANSnet from ANS border router X to ANS border router Y? I need to know who they're talking to in order to answer that question. Typically large portions of the ANS mesh will be affected, and I need to know how. Daniel ~~~~~~

1 0

Re: Ping flooding (fwd)
by Daniel W. McRobb 10 Jul '96

10 Jul '96

> On Jul 9, 17:57, "Daniel W. McRobb" <dwm(a)ans.net> wrote: > > The sampling Curtis mentioned on the NSS routers is a bit different. > > For one, it doesn't really impact forwarding performance (and hopefully, > > if/when implemented on the Bay, will not impact forwarding performance). > > Not to pick nits, but what I quoted was a cache snapshot; caches > don't impact performance under normal circumstances, though their > construction may do so. When I asked Cisco about this (a while ago), they said flow-switching incurred a 20% overhead (which someone there called "minimal", which I didn't agree with). > > But what we're specifically looking for in terms of continuous sampling > > (such as that we do on the NSS routers) is a net matrix... if you > > changed the Cisco flow switching stuff to use network numbers (and > > mask), you'd have something very much like what we're looking for in > > terms of continuous sampling. From there we build AS matrices, etc. > > Yes ... but you shouldn't need anything special for that. We have > been doing the same for a long time, using regular IP accounting on > the edge routers, which is then summarised over a full routing table. > The only discrepancies that occur are if changes in routing occur > between the time of accounting and processing, but this tends not to > be a problem. 'tis very unwise to run IP accounting on a very busy router. We wouldn't dare turn it on for a core router w/ 40,000 routes. Some of our customers who have done so on border routers immediately turn arond and complain about performance problems. :-( And we're not talking about access products either. 'tis also very important to know the route taken for a net when analyzing the data. Discrepancies here can be huge and completely invalidate any conclusions you might make about how much traffic is traversing a given path. This is particularly true for busy end routers (like NAP peers) and core routers. > > The other thing about the flow-switching data that's different than the > > NSS (and probably what we'll get from Bay) is that there aren't really > > any nice ways of retrieving/storing the data automatically. > > This used to be true, but "probably" isn't true any longer. Maybe, maybe not. I can't imagine trying to get flow stat data from a router w/ 40,000 routes and (probably) a monstrous flow table via UDP. A lot of this boils down to granularity... for continuous collection on busy routers for network architecture purposes, host-level granularity is frivolous and overly consumptive of many resources. I also prefer measurements that won't potentially get dropped in transit (throwing a big unknown into confidence level of data). Is there an efficient means of retrieving flow data from a Cisco and not potentially dropping a bunch of it on the floor? Daniel ~~~~~~

2 1

Re: Ping flooding (fwd)
by Doug Stanfield 10 Jul '96

10 Jul '96

At 06:43 AM 7/9/96 +0000, you wrote: >Michael Dillon writes: >> >> On Tue, 9 Jul 1996, Daniel W. McRobb wrote: >> >> > There will likely never be a means for a single NSP to track down the >> > real source of spoofed packets using IPv4. Service providers won't be >> > letting other service providers track spoofed packets through their >> > network. >> >> Why not? Don't telcos do this? >> Or if your answer is that telcos only do it for the police and not for >> each other, then my question would be why can't we form an Internet >> equivalent, maybe affiliated with something like CERT, that can make these >> requests and with whom NSP's would cooperate. > >What sort of incentive or penalty do you think would enable this >cooperation? > > Nevin > These garbage packets are flooding through somebodies network to get to the target. I'd think it would benefit the intervening operators to eliminate traffic tthat is harmful, probably illegal, and wasting the resource they sell, bandwidth. Doug Stanfield "The significant problems we face cannot be solved Oceanic Cable at the same level of thinking we were at when we Project Engineer created them." - Albert Einstein dougs(a)oceanic.com (808) 625-8455 fax (808) 625-5888

2 1

Re: Ping flooding (fwd)
by Michael Dillon 10 Jul '96

10 Jul '96

Are there any procedures in place to track down this kind of network abuse. In particular, is it possible that it is a stealth attack? Before you answer, take note that this is going to appear in Bob Metcalfe's column next week. ---------- Forwarded message ---------- Date: Mon, 8 Jul 1996 15:30:43 -0600 (MDT) From: Kevin Rosenberg <kevin(a)cyberport.com> Reply-To: inet-access(a)earth.com To: inet-access(a)earth.com Subject: Re: Ping flooding Resent-Date: Mon, 8 Jul 1996 15:30:53 -0600 (MDT) Resent-From: inet-access(a)earth.com > Some months later we had an incident of massive amounts of forged email > from a site called SUNSETDIRECT.COM. For several weeks they sent forged We are currently undergoing a ping flood attack, though our upstream provider has filtered icmp from the host so the flood is no longer affecting our T1 line. The system administrator of the site that appears to be flooding us doesn't believe his site is the source of the attack. He states that he can't see the icmp packets, though I don't know how he is sniffing his wire. My questions are these: Is it possible for someone to forged the source IP address of an icmp packet? If so, do they have to be in some routing proximity, or can they forge the source address while they are connected from anywhere in the world? Thanks! -------------------------------------------------------------------- Kevin Rosenberg | CyberPort Station Chief System Administrator | The Finest Internet Service Possible! kevin(a)cyberport.com | http://www.cyberport.com Finger kevin(a)cyberport.com for PGP Public Key -------------------------------------------------------------------- ============================== ISP Mailing List ============================== Email ``unsubscribe'' to inet-access-request(a)earth.com to be removed. Do not post flames to the list -- if you must flame, use private email.

8 11

Re: Ping flooding (fwd)
by Sean Doran 09 Jul '96

09 Jul '96

| Is there an efficient means of retrieving flow data from a Cisco and | not potentially dropping a bunch of it on the floor? Will there be at | some point in the future? We'd use it if it was available. We'd even | pay for it, I imagine. :-) We are not a Cisco beta list nor are we a Cisco sales team. Please approach this kind of thing through your normal vendor channels. You may find that doing so will actually grant you your wish. Sean.

1 0

Re: Ping flooding (fwd)
by avg＠ncube.com 09 Jul '96

09 Jul '96

That's once again a matter of defaults -- routers should _by default_ discard all packets from interfaces which they won't use for forwarding those packets back. This rule works is 99.9% of cases preventing SA spoofing and some cases of transient loops, and can be disabled where asymmetrical routing is desired. I also have thought of some mechanism to allow destination host to quench sender forcefully, by telling the intermediate router(s) to disallow forwarding to some destination for some period of time (a minute would do nice to render flooding attacks ineffective), but there's a problem with authentication (i.e. there's a need for the router to "call back" to confirm that destination indeed wants to shut up somebody). Finally, routers could implement a kind of "reverse trace" ICMP with the following functionality: on receiption of RT ICMP message take the SA from the ICMP and send back reply message. After that install watchpoint to look for packets going to that address (the "watchpoint" may be implemented as a host route to some special interface). If watchpoint is triggered (i.e. we've got a packet going to the SA) send copy of the RT ICMP to the interface from which the offending packet came from and remove the watchpoint. If watchpoing wasn't triggrded for some time, remove it silently. That simple mechanism would allow to track down sources of forged (or mis-configured) SAs pretty quickly. However it is ineffectual if source-based routing with a large number of variant routes is used. But then, unrestricted SBR is very dangerous anyway (it allows to create artificial congestions by emitting relatively small streams of bogons with routes wound in tight loops). --vadim

2 1

Re: Ping flooding (fwd)
by Justin W. Newton 09 Jul '96

09 Jul '96

At 10:43 PM 7/8/96 -0400, Todd Graham Lewis wrote: >If you have a very restrictive security policy, then you might want to >place a packet filter on all outgoing traffic. If your network is >10.1.1.64/26, then you might have the following two rules: > >action source destination >------ ------ ----------- > >allow 10.1.1.64/26 * >deny * * > >Of course, no one does this, because it is very time consuming for your >router to examine every packet in this way. This translates into more >marginal cost on your hardware for very little return. > >Say that person X, the person who owns the network from which these pings >are apparently originating, did have such a filter. What does this do? >It proves that the packets are not originating on his network. Does it >stop anyone else from forging these packets? No. Actually it doesn't prove that. The filter would /allow/ the pavckets to pass through the router since they were coming from one of his networks. If everyone else on the planet had such a rule it would prove that it /was/ coming from him. Justin Newton Internet Architect Erol's Internet Services

3 2