2006.02.14 talk 4 Flooding attacks Jianhong Xia A new talk added right before lunch by Randy Bush will push us to 12:25. Two talks coming up about DoS attacks against control information Flooding Attacks by exploiting persistent forwarding loops. Introduction: routing determines forwarding path. Transient forwarding loops happen all the time during convergence; that's normal. But this focuses on persistent fowarding loops. why would persistent loops exist? Example on neglecting pull-up routes. Router announces 18.0/16 to internet router A has default pointing to B router A uses 18.0.0/24 only Any traffic to 18.0.1.0-18.0.255.255 will enter the forwarding loop between A and B Risk of persistent forwarding loops can amplify based on ttl of packets injected into the looping pair of routers. Can create a denial of service by flooding the upstream links between routers in front of host they want to knock off. any other hosts behind that link are "imperiled addresses" Measurement Design: balancing granularity and overhead samples 2 addresses in each /24 IP block Addresses space collection addresses covered by RouteView table de-aggregate prefixes into /24 prefixes fine-grained prefixes data traces traceroute to 5.5 million fine-grained prefixes measurement lasts for 3 weeks in sept 2005 Almost 2.5% of routable addresses have persistent forwarding loops Almost .8% of routable addresses are imperiled addresses. Validating these persistent forwarding loops from multiple places from asia, europe, west and east cost of US 90% of shadowed prefixes consistently have persistent forwading loops Validation to multiple addresses in shadowed prefixes sampling 50 addresses in each shadowed prefix 68% of shadowed prefixes shows that... Properties of the loops How long are the loops? 86.6% of loops are 2 hops long 0.4% are more than 10 hops long some are more than 15 hops location 82.2% of persistent loops happen within destination domain implications significantly amplify attacking traffic can be exploited from different places. (oops. Matt gets paged out to deal with issue, so no more notes for a while).