Subject: Non terminated traffic...

From: Franck Martin <[email-masked]>
Date: 11 Dec 2003 10:33:14 +1200

Another finding...

A solution?

I see that I receive a lot of non-terminated traffic. Meaning a packet
for an IP that does not exists (about 10% inbound)

Apart from setting up ingress(?) filtering to ensure that these packets
gets dropped before they go further, I need to communicate with my
upstream provider to ensure that he/she drops these packets too before
they go on my link. Is there a way to automatise that, so a soft can
talk to my upstream provider network system and automatically inform him
on which IPs are terminated? Routing protocol aggregates IPs, so I'm not
sure it may select only valid IP and not a range where some IPs are
valid...

Is something like that exists or a new RFC is needed?

Cheers

----
Franck Martin
[email-masked]
SOPAC, Fiji
GPG Key fingerprint = 44A4 8AE4 392A 3B92 FDF9  D9C6 BE79 9E60 81D9 1320
"Toute connaissance est une reponse a une question" G.Bachelard

---

From: "bill" <[email-masked]>
Date: Wed, 10 Dec 2003 15:48:47 -0800

So is your problem 
1) That you are seeing packets outside of your address range (x.y.z/24)
in which case the upstream router incorrectly routed a packet over your
link
Or
2) That you have x.y.z/24 assigned to you, AND you are only using 10 of
those address, and you are seeing packets for the other 245 addresses 

If it is 1) correct routing will eventually solve the problem.  If it is
2) that would be a very hard problem to solve, having to hook up various
servers to figure out WHAT addresses have endpoints attached to them.
What do you want to happen when one of your machines reboots - so for 3
minutes isn't an endpoint.  What do you expect to happen when a new
endpoint is brought up, hopefully with DHCP (the DHCP server can the the
"Endpoint survey Server" that a new host is configured), but without it
- it would be difficult (I guess the end point will eventually SEND a
packet that will hit the gateway and therefor it can be configured - but
there is a first packet problem)

Bill
-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Franck Martin
Sent: Wednesday, December 10, 2003 2:33 PM
To: [email-masked]
Subject: Non terminated traffic...

Another finding...

A solution?

Cheers

----
Franck Martin
[email-masked]
SOPAC, Fiji

---

From: Franck Martin <[email-masked]>
Date: 11 Dec 2003 12:04:45 +1200

Yes it is problem 2)

and yes I realise it is difficult to solve. This is why I suggested a
new RFC...

Basically we are starting to see viruses and hackers probing our
networks... What do we do about it to preserve the Internet badwidth?

Cheers

----
Franck Martin
[email-masked]
SOPAC, Fiji

---

From: Joe Abley <[email-masked]>
Date: Wed, 10 Dec 2003 19:35:16 -0500

> and yes I realise it is difficult to solve. This is why I suggested a  

Oh, maybe I misread. I thought you were talking about packets from  
bogus source addresses.

Numerous ASes support a blackhole community attribute which can be used  
to null-route customer traffic in the upstream. It's commonly used to  
stop denial-of-service traffic hitting the billable circuit, but it  
would work in this application too.

If supported by your provider, you could aggregate your unused space  
into a set of prefixes and advertise them to your provider with the  
corresponding community string attribute attached; traffic destined for  
those nets would be blackholed before they crossed the Pacific.

http://www.ietf.org/internet-drafts/draft-turk-bgp-dos-04.txt
http://www1.ietf.org/mail-archive/working-groups/routing-discussion/ 
current/msg00688.html

Joe

---

From: Joe Abley <[email-masked]>
Date: Wed, 10 Dec 2003 18:48:48 -0500

On 10 Dec 2003, at 17:33, Franck Martin wrote:

> gets dropped before they go further,

Google for "Unicast Reverse Path Filtering" (uRPF). The filter you 
describe above can be obtained by means of turning loose-mode uRPF on a 
border router that carries a full table (assuming you are happy to 
derive "the traffic source is valid" from "I receive a routing 
advertisement which covers the traffic source address"; i.e. I have a 
path back to that source).

> I need to communicate with my

You could encourage your providers to deploy similar filters to those 
above on their borders. They may be able to apply uRPF outbound on the 
interface that faces you, in fact. I've never actually added that 
config to a router, but it seems like it should work :-)

Joe

---

From: Simon Leinen <[email-masked]>
Date: Thu, 11 Dec 2003 16:30:35 +0100

Joe Abley writes:
> http://www1.ietf.org/mail-archive/working-groups/routing-discussion/current/msg00688.html

draft-marques-idr-flow-spec-00.txt seems to be sort-of a generalized
version of this (which doesn't necessarily mean that it's better).
-- 
Simon.

---

From: [email-masked]
Date: Fri, 12 Dec 2003 10:23:04 -0800

Obsession with security has broken a lot of things. 

In ICMP there are defined responses for "Network Unreachable" and "Host
Unreachable". Of course, today those responses are blocked and ignored -
even pings don't make it across some ISPs - like Earthlink! I suspect
pings are blocked to prevent traceroutes and timing statistics to be
collected.

Niket Patwardhan