New Denial of Service Attack on Panix

Kent W. England kwe at 6SigmaNets.com
Tue Sep 17 20:42:40 UTC 1996


At 11:02 AM 9/17/96 -0400, Guy T Almes wrote:
>Nathan,
>  I'm afraid that Kent is right about this one.
>
I wish that it were not so, but after reading the clever and insightful
approaches to tracking down the denial-of-service perps, I am pessimistic
about our ability to stay ahead in the escalation of this counter-counter-
measure warfare. I think that if we were able to trace the Panix attacker
that a future attacker would hit simultaneously from a half-dozen free
dial-up connections with a real random number generator and synthetic
SYNs to fool the router stat collector (or whatever it takes). I think we 
are on the short end of the technology stick here.

If the fit hits the shan and the attacks begin to escalate, we need to be 
ready to cooperate on source address filtering at the periphery. It's one 
of those cases of hang together or hang separately. Should we wait, like 
the cell phone industry did with the cloning fiasco, until this gives us 
a black eye? It's just too inviting to expect that we don't have plenty of
folks out there ready to pull this trigger on us.

We need a general consensus in order for any one of us to justify the effort
required to install source address filters. That means that representatives
from major backbone ISPs must announce that they will install filters (not 
at the MAEs) in response to this new threat and that they expect that their 
peers will too. I'm not one of those major backbone ISP network 
engineers, but I would hope that for the sake of all of us, that those who 
are will roll their eyes heavenward, take a deep breath, and do what needs 
to be done. I know it's easy for me to say, but nevertheless ...

This is an excellent example of what the NANOG and IEPG are really good for.

--Kent






More information about the NANOG mailing list