🚀 go-pugleaf

Crossposted to bc.general; followups there.

In article <199612181921.LAA15645@arbutus.netcom.ubc.ca>,
Mike Bluett <mbluett@netcom.ubc.ca> wrote:
>Last Sunday at around 6:30pm, BCNet was alerted to a SYNC attack on 
>a website (Web Communications -  www.webcom.com) in the USA.
>[...]
>An attempt was made to put a filter in place to eliminate packets 
>coming from the source network, but before this could be completed 
>the attack had ceased.

A few questions, Mike.

The news article reported that it took PSI approximately 14 hours to
determine the packets entered via MCI, and MCI required an undisclosed
amount of time to point a finger at BCNet.  The attack was filtered
27 hours after starting, and was halted 4 hours later.  Was it MCI
dropping CA*Net after 27 hours, or BCNet filtering the college?
In any case, it's disturbing that it took that long to determine
the source.

Contrary to the current hype surrounding this attack, the problem has
been known about for quite some time.  It's not unusual for a major
server to catch requests from unroutable hosts simply because of
normal networking problems... I've seen this myself, particularly on
the SMTP port.  It became mainstream some time last summer, after which
CERT issued an advisory warning the net about the possibility of
malicious attack and steps which should be taken to prevent it
(namely filtering outgoing packets with unknown source addresses).
For reference, read alert CA-96.21 published on Sept 19th.
I believe this advisory was posted in bc.bcnet at that time.  See:

  ftp://info.cert.org/pub/cert_advisories/CA-96.21.tcp_syn_flooding

>BCNet contacted the network manager for this site Monday morning and
>worked with the site to implement a filtering solution that would reduce
>the possibility of another similar attack.

Has BCNet now applied appropriate filters on the link to CA*Net?  Has
CA*Net done the same down to MCI?

Tom
-- 
Tom Klok                                              Tom.Klok@iSTAR.ca
Network Administration                               iSTAR internet inc.
Opinions expressed are personal; I do not speak for my employers.