DoS tracking service

[Jeremy Porter]

Just forwarding this for a friend.

------- Forwarded Message

Date:    Wed, 22 Apr 1998 11:16:48 -0700
From:    "Steve Uurtamo" <uurtamo@AZStarNet.com>
To:      jerry@fc.net
Subject: Re: Filtering ICMP (Was Re: SMURF amplifier block list)

> Okay, so it's clear that we need to come up with some sort of sol'n
> to these kinds of problems.
> 
> Here's my two cents:
> 
> Don't block all of ICMP.  Block pings and traceroutes if you think that
> it's going to make your life better, but please don't break anything else.
> 
> We need a low-pain protocol to allow provider NOCs to check out a
> few salient things on their upstream provider's/peers routers --
> e.g. which interface a particular spoofed packet is coming from, the IP
> address of the remote-side interface, etc., etc., all the way back
> to the source.  This would allow provider NOCs to track this stuff
> down themselves.  No more 6 hour phone calls to people with various
> degrees of clue/time/energy for a problem that may only occur for
> 15 minutes at a time, every 4 hours.
> 
> It wouldn't be hard to jimmy this protocol (in case people care) such that
> you would ONLY be able to track back to a particular NOC's router if all
> of the inbetween-routers had "signed off" on the fact that what you're lookin
g
> for (specific dst/src or packet type) had actually SHOWN UP on them as well.
> It wouldn't have to continuously check this -- just check once and PK-encrypt
> the timestamp into the signature on the authentication packet.  Various
> timeouts could be configured by individual NOCs.  (Yes, each NOC could have
> its own PK value -- but there would only have to be one per AS).
> 
> Before everyone gets all hot and bothered about the suggestion that I'm
> making -- I'm not talking about arbitrary packet sniffing -- I'm talking
> about sniffing HEADERS on packets whose dst address (or packet type or 
> whatever everyone agrees is significant) is inside the domain of the dst 
> provider.  Not a big deal.  I really don't think that it's that
> much to give up -- hell, digex already allows me to dump their entire BGP
> table anytime I want -- i'm just talking about some very minimal tracking
> ability.
> 
> Some companies, such as sprint, who may have hundreds of customers plugged
> into a single router, may not want to do this.  But frankly, without this,
> we're all dependent upon the clue/time/energy of some guy who's busy doing
> his own thing, and we aren't guaranteed timely and accurate information.
> 
> Actually, now that I think of it, you could almost jimmy this out of a
> few hours of PGP-wrapped SNMP-calling perl scripts listening to some
> fixed socket at some fixed (and published) IP address of each network
> provider.  No reason to dick with the router code if no need to.
> 
> 
> What say ye?  
> 
> 
> 
> steve



------- End of Forwarded Message