Subject: RE: Need your opinion of this.

From: "Turk, Doughan A." <[email-masked]>
Date: Fri, 26 Jul 2002 21:24:20 -0400

I am using BGP to help stopping DoS and DDoS traffic. BGP can send updates
quickly and route-maps can translate communities to stop traffic destined to
a certain destination. TCP is not the issue here. Attackers usually relay on
the fact that most routers out there do destination based routing without
checking the validity of the source address in case it is spoofed.

DT

-----Original Message-----
From: PamSri [mailto:[email-masked]] 
Sent: Friday, July 26, 2002 9:08 PM
To: Turk, Doughan A.
Subject: RE: Need your opinion of this.

Hi Turk ,
         Just started to read through your doc. I have
a question :
BGP is an application from the perspective of TCP. Why
do you see the need for provding such security at the application level than
TCP ? Do you think the security features in TCP as inadequate ? It would be
really a good idea to provide security at the underlying layers than at this
layer. 

sri

--- "Turk, Doughan A." <[email-masked]> wrote:
> Benjamin,
>  
> BGP will be used to alter next-hop address for a
> particular destination
> address (representing a customer under attack) on
> selected Routers. Instead
> of using BGP to announce a different next-hop for
> the destination address
> everywhere in your network. we can use communities
> to make it selective.
> once that is achieved, your next hop can be a null
> interface or a Tunnel
> interface where the traffic is then pulled to the
> sinkhole router.
>  
> Based on Attack signature you could do various
> packet lever filtering ( with
> hardware as a constrain),  simply rate limit the
> flow or send it out through
> a shared media (Ethernet) for sniffing after you
> pull it to a sinkhole
> router.
>  
> As for overheads on routers in the network, there is
> hardly any since you're
> only altering next-hop on border routers or edge
> routers. MPLS tunnel are
> what I used in my lab. as for the sinkhole router,
> one can invest in a high
> performance line card. The sinkhole router should be
> powerful enough to
> handle whatever filtering or policing you deem
> required to massage the flow.
> 
>  
> Scalability is high in my opinion. the route maps on
> the borders can be a
> part of your template. announcing the destination
> address with the special
> community would have to be done on only one router
> (sinkhole is a good
> idea).
>  
> As for where to place the route maps or policy
> statements, IMHO, this should
> be applied anywhere a large attack can enter from.
> (I.e Transit links or to
> Peers with large number of subscribers) I wouldn't
> apply it on a customer
> interface since a customer is in my reach and can be contacted 
> immediately in case of an attack initiated by him. Another place
> to apply it on is at
> peering interfaces where an access-list or policing
> statement might bring
> down interface performance. at this point traffic
> can be pulled in the
> sinkhole router for the policies to be applied.
>  
> This technique can be used in high volume attacks
> where source based
> filtering is not possible because of spoofing or
> high number of source IP
> addresses. In many cases ISP's are forced to kill
> traffic destined to a
> single /32 to relief the rest of the customer
> network from suffering from
> the high volume of traffic. I would also use this in
> cases of attacks
> targeting infrastructure.
>  
> As for the last question, yes I have built this in a
> large lab and got the
> result I expected.
>  
> Hope this answers your questions.
>  
> Regards
> DT
>  
> 
> -----Original Message-----
> From: Abarbanel, Benjamin [mailto:[email-masked]]
> Sent: Friday, July 26, 2002 4:55 PM
> To: 'Turk, Doughan A.'; [email-masked]
> Subject: RE: Need your opinion of this.
> 
> 
> Doughan:
>   Let me see if I understand the fundamental point
> of your draft. You want
> BGP via communities to be the big MAGNET that
> catches all the denial of
> service attack routes and shoves them through some
> sink hole router that
> will keep statistics and knowledge of the source of
> the attack and be able
> to report it to the operator?
>  
> Did I summarize it properly?
>  
> My first reaction, is what kind of overhead will
> these techniques impose on
> the routers and the sink hole one? 
>  
> Will it be scallable? 
>  
> Can this be done only on border routers, Router
> Reflectors? To minimize the
> processing load needed?
>  
> What real life cases have you seen where this
> mechanism was needed?
>  
> Have you prototyped this idea and gotten some
> empirical data?
>  
> Ben
> 
> -----Original Message-----
> From: Turk, Doughan A. [mailto:[email-masked]]
> Sent: Friday, July 26, 2002 4:09 PM
> To: [email-masked]
> Cc: Turk, Doughan A.
> Subject: Need your opinion of this.
> 
> 
> Folks, 
>  
> I would like to get some discussion started on a
> draft I wrote. It was
> suggested to me to have the draft worked on under
> this group. I appreciate
> any constructive comments and pointers. In summary,
> the draft could be
> classified as an operational one. It is an
> enhancement of a technique that
> already exists but relying more on BGP as a protocol
> to help in network
> security issues.
>  
> A copy of the draft could be found at
>
http://www.ietf.org/internet-drafts/draft-turk-ertb-00.txt
<http://www.ietf.org/internet-drafts/draft-turk-ertb-00.txt>
> 
>  
> Regards
> Doughan Turk
>  
>   _____  
> 
> 
>  <http://www.bell.ca/> Bell Canada Logo
> 
> Doughan Turk, M.Eng., CCIE#7274
> Bell Canada, IP Engineering
> Flr 3, 100 Wynford Dr. 
> Toronto M3C 1K4
> 
> Voice: (416) 353-0368
> Fax: (416) 445-9893
> Pager: (416) 685-0590
>  <http://www.bell.ca/> Bell Canada
> 
>  Cisco Certified Internetwork Expert
> <http://www3.sympatico.ca/doughan/ccie_large.gif> 
> 
>          "To Engineer and Integrate world class
>                               IP Services and
> Technologies for BCE" 	
>  
> 
> 

__________________________________________________
Do You Yahoo!?
Yahoo! Health - Feel better, live better
http://health.yahoo.com

---

From: Justin Fletcher <[email-masked]>
Date: 26 Jul 2002 18:10:55 -0700

> checking the validity of the source address in case it is spoofed.

Is BGP the place to do this?  Note this section from RFC1812:

5.3.8 Source Address Validation
   
   A router SHOULD IMPLEMENT the ability to filter traffic based on a
   comparison of the source address of a packet and the forwarding table
   for a logical interface on which the packet was received.  If this
   filtering is enabled, the router MUST silently discard a packet if
   the interface on which the packet was received is not the interface
   on which a packet would be forwarded to reach the address contained
   in the source address.  In simpler terms, if a router wouldn't route
   a packet containing this address through a particular interface, it
   shouldn't believe the address if it appears as a source address in a
   packet read from this interface.

--
Justin Fletcher
Proficient Networks, Inc.