Re: [WISPA] DOS attack

[jp]

If you use squirrelmail, add the restric_senders plugin. Stops the 
spammers quick by setting normal reasonable limits to the numbers of 
recipients per time period. They'll go elsewhere.

On Mon, Aug 02, 2010 at 10:56:39PM -0700, Gary Garrett wrote:
>  Lately I have had some Pfishers get passwords to users E-mail and start 
> sending out from their Webmail accounts.
> I have taken to blocking the entire /8 . about 16 million addresses 
> each.
> Really cuts down on the incoming spam also.  No complaints yet.
>
>
>
>
>> Well, I believe in this case it was all Asia IP space, Mostly from the 
>> same hand full of subnets. So they dropped the associated /24's
>>
>

> 
> 
> 
> WISPA Wants You! Join today!
> http://signup.wispa.org/
> 
>  
> WISPA Wireless List: wireless@wispa.org
> 
> Subscribe/Unsubscribe:
> http://lists.wispa.org/mailman/listinfo/wireless
> 
> Archives: http://lists.wispa.org/pipermail/wireless/

-- 
/*
Jason Philbrook   |   Midcoast Internet Solutions - Wireless and DSL
KB1IOJ|   Broadband Internet Access, Dialup, and Hosting 
 http://f64.nu/   |   for Midcoast Mainehttp://www.midcoast.com/
*/



WISPA Wants You! Join today!
http://signup.wispa.org/

 
WISPA Wireless List: wireless@wispa.org

Subscribe/Unsubscribe:
http://lists.wispa.org/mailman/listinfo/wireless

Archives: http://lists.wispa.org/pipermail/wireless/

Re: [WISPA] DOS attack

[Gary Garrett]

 Lately I have had some Pfishers get passwords to users E-mail and 
start sending out from their Webmail accounts.
I have taken to blocking the entire /8 . about 16 million addresses 
each.

Really cuts down on the incoming spam also.  No complaints yet.




Well, I believe in this case it was all Asia IP space, Mostly from the 
same hand full of subnets. So they dropped the associated /24's







WISPA Wants You! Join today!
http://signup.wispa.org/

 
WISPA Wireless List: wireless@wispa.org

Subscribe/Unsubscribe:
http://lists.wispa.org/mailman/listinfo/wireless

Archives: http://lists.wispa.org/pipermail/wireless/

Re: [WISPA] DOS attack

[Scott Lambert]

On Mon, Aug 02, 2010 at 10:09:04AM -0500, Jon Auer wrote:
> I see a lot of replies about what to do if *you* are the target of a
> DOS attack but not many about how to tell if your upstream is getting
> slammed.
> 
> Really a DOS attack on a upstream should have symptoms of any other
> upstream capacity issue that you want to know about, just it will
> probably have a sudden onset.

While you are having issues, you can run MTR to various places.  If
you show latency jumps at a particular hop, you pretty much know
who is having the problem and can start calling folks in that
direction.

-- 
Scott LambertKC5MLE   Unix SysAdmin
lamb...@lambertfam.org




WISPA Wants You! Join today!
http://signup.wispa.org/

 
WISPA Wireless List: wireless@wispa.org

Subscribe/Unsubscribe:
http://lists.wispa.org/mailman/listinfo/wireless

Archives: http://lists.wispa.org/pipermail/wireless/

Re: [WISPA] DOS attack

[Scott Lambert]

On Mon, Aug 02, 2010 at 09:56:01AM -0500, Matt wrote:
> >to 1.2Gb/s if I recall correctly. At first we were getting crazy
> >packet loss because the upstream router was getting hammered.
> >
> >After that they put in a few rules to drop the traffic and that made
> >it stable, But latency was like +140ms going into it.
>
> What rules can really help a DOS attack?  I just see it as hard to
> block since usually its coming from thousands of different IP's.  I
> imagine it could look like TCP, UDP or etc.  How can a router tell
> whats legitimate and not?

You get your upstream to block the traffic.  If they overwhelm your
upstream, your upstream gets their neighbor(s) to block the traffic.
Lather, Rinse, Repeat.

If you are speaking BGP to your upstream, they may have communities
you can use to automagically direct them to blackhole the target
IP, or the source IPs if the source is that limited.   The IP they
are attacking is probably going down from the Internet's perspective
either way.  The difference is if the rest of your space is able
to remain online.

Announce the community; then call your provider(s) to see if there
are better mitigation methods.  Luckily, we haven't had that problem
here for a long time.

-- 
Scott LambertKC5MLE   Unix SysAdmin
lamb...@lambertfam.org




WISPA Wants You! Join today!
http://signup.wispa.org/

 
WISPA Wireless List: wireless@wispa.org

Subscribe/Unsubscribe:
http://lists.wispa.org/mailman/listinfo/wireless

Archives: http://lists.wispa.org/pipermail/wireless/

Re: [WISPA] DOS attack

[Mike Hammett]

  Correction:  A DDoS comes from thousands of IPs, a DOS from a few or 
singular.  (Distributed being the difference.)

-
Mike Hammett
Intelligent Computing Solutions
http://www.ics-il.com



On 8/2/2010 9:56 AM, Matt wrote:
>> to 1.2Gb/s if I recall correctly. At first we were getting crazy packet loss 
>> because the upstream router was getting hammered.
>> After that they put in a few rules to drop the traffic and that made it 
>> stable, But latency was like +140ms going into it.
> What rules can really help a DOS attack?  I just see it as hard to
> block since usually its coming from thousands of different IP's.  I
> imagine it could look like TCP, UDP or etc.  How can a router tell
> whats legitimate and not?
>
> Matt
>
>
> 
> WISPA Wants You! Join today!
> http://signup.wispa.org/
> 
>
> WISPA Wireless List: wireless@wispa.org
>
> Subscribe/Unsubscribe:
> http://lists.wispa.org/mailman/listinfo/wireless
>
> Archives: http://lists.wispa.org/pipermail/wireless/



WISPA Wants You! Join today!
http://signup.wispa.org/

 
WISPA Wireless List: wireless@wispa.org

Subscribe/Unsubscribe:
http://lists.wispa.org/mailman/listinfo/wireless

Archives: http://lists.wispa.org/pipermail/wireless/

Re: [WISPA] DOS attack

[Nick White]

http://staros.tog.net/wiki/List_of_APNIC_IP_Blocks

There is a more up to date list somewhere, but at a previous company I 
worked for we ended up blocking lots of APNIC. Saw way too many 
scans/hack-attempts/DOS from them. Occasionally had a customer (twice in 
five years) complain about no access to their Russian/Asian bride sites 
- in those cases we track down the server's IP or subnet and unblock.


Nick


On 8/2/2010 8:10 AM, Jeremie Chism wrote:

Thanks.  I am looking into all of that now.

On Mon, Aug 2, 2010 at 9:44 AM, Glenn Kelley > wrote:


Jeremie

there are a few ways to investigate a suspect DOS attack.
First and foremost you want to take a peek at your incoming
connections.

Do you see a large influx of incoming traffic?
If so - are you able to identify where it is coming from?

Chances are if you know where it is coming from you can simply ask
your provider to null route the traffic ahead of you.


Commands like netstat -na  can be a great friend in these cases if
you have the ability to place something in between the connections.

I personally love PFSense for this reason.   PFSense can operate
as a transparent firewall (and many other things... )   But for
Free - it is an excellent tool -  loads on virtually any x86
system with 2 NIC cards.

Anyhow - Folks that do Dos  or DDos (Distributed Denial of
Service) generally attack port 80 as well as mail ports.
Many WISPs will keep port 80 open to the general public so they
can reach the radio's configuration windows.

While it is not something I would suggest - for a variety of
reasons - chances are the port 80 of a customers radio is what is
getting wacked.

Generally dDos come in as udp packets to other ports - simply
because of how UDP works - it does not cause them as much of an
issue as it would you.

So - a few commands might help here.

netstat -lpn | grep :80 | awk '{print $5}'|cut -d: -f 1|sort|uniq
-c|sort -nk 1


you can change the 80 above to any port you wish such as 25 for
smtp, 53 for dns/named , etc etc etc...

This should show you the # of connections from a specific IP.
If you have a small # of connections from very large numbers of IP
addresses - then chances are you might be under DDOS.

If there are a very large # of connections from just a few ip's
than it should be simple enough to ask the ISP to block or null
route those IP addresses.

One last note -

You might want to check the IP's against nslookup or use the
DNSStuff.com  toolset.
I have helped a few through these over the years and when they
block the DNS servers many folks use like 208.67.222.222 or
8.8.8.8 it really stinks for folks... for sure.

So you want to make sure you are blocking the right thing of course.

Are you running anything like NTOP ?  There are a few simple
things to have in place to watch incoming traffic when needed vs
hoping that it goes away...

Kick back to me if your lost - and we can go off list for some help

Glenn



On Aug 2, 2010, at 9:56 AM, Jeremie Chism wrote:


I noticed on Friday that everything I had seemed very slow. I
went through checking the usual things and found no problem.
 After digging into everything I could put my hands on, I
resorted to calling my upstream to see if they noticed any
problems.  They of course said no.  At 430 that afternoon I got a
call from one of their "engineers" stating that they had
experienced a DOS attack that was affecting certain customers.
 They made some changes and it actually seemed to work better
than before.  Even my latency times had dropped.  Today the
problem seems to be creeping back to the same way it was Friday.
 My question is, is there a way to determine in the future that
this is happening.  Is there something specific that would lead
me to the conclusion that in fact that is what is going on.

-- 
Jeremie Chism

TritonDataLink




WISPA Wants You! Join today!
http://signup.wispa.org/



WISPA Wireless List: wireless@wispa.org 

Subscribe/Unsubscribe:
http://lists.wispa.org/mailman/listinfo/wireless

Archives: http://lists.wispa.org/pipermail/wireless/



_
*Glenn Kelley | Principle | HostMedic |www.HostMedic.com
 *
Email: gl...@hostmedic.com 
Pplease don't print this e-mail unless you really need to.






WISPA Wants Y

Re: [WISPA] DOS attack

[Jeremie Chism]

Thanks.  I am looking into all of that now.

On Mon, Aug 2, 2010 at 9:44 AM, Glenn Kelley  wrote:

> Jeremie
>
> there are a few ways to investigate a suspect DOS attack.
> First and foremost you want to take a peek at your incoming connections.
>
> Do you see a large influx of incoming traffic?
> If so - are you able to identify where it is coming from?
>
> Chances are if you know where it is coming from you can simply ask your
> provider to null route the traffic ahead of you.
>
>
> Commands like netstat -na  can be a great friend in these cases if you
> have the ability to place something in between the connections.
>
> I personally love PFSense for this reason.   PFSense can operate as a
> transparent firewall (and many other things... )   But for Free - it is an
> excellent tool -  loads on virtually any x86 system with 2 NIC cards.
>
> Anyhow - Folks that do Dos  or DDos (Distributed Denial of Service)
> generally attack port 80 as well as mail ports.
> Many WISPs will keep port 80 open to the general public so they can reach
> the radio's configuration windows.
>
> While it is not something I would suggest - for a variety of reasons -
> chances are the port 80 of a customers radio is what is getting wacked.
>
> Generally dDos come in as udp packets to other ports - simply because of
> how UDP works - it does not cause them as much of an issue as it would you.
>
>
> So - a few commands might help here.
>
> netstat -lpn | grep :80 | awk '{print $5}'|cut -d: -f 1|sort|uniq -c|sort
> -nk 1
>
>
> you can change the 80 above to any port you wish such as 25 for smtp, 53
> for dns/named , etc etc etc...
>
> This should show you the # of connections from a specific IP.
> If you have a small # of connections from very large numbers of IP
> addresses - then chances are you might be under DDOS.
>
> If there are a very large # of connections from just a few ip's than it
> should be simple enough to ask the ISP to block or null route those IP
> addresses.
>
> One last note -
>
> You might want to check the IP's against nslookup or use the 
> DNSStuff.comtoolset.
> I have helped a few through these over the years and when they block the
> DNS servers many folks use like 208.67.222.222 or 8.8.8.8 it really stinks
> for folks... for sure.
>
> So you want to make sure you are blocking the right thing of course.
>
> Are you running anything like NTOP ?  There are a few simple things to have
> in place to watch incoming traffic when needed vs hoping that it goes
> away...
>
> Kick back to me if your lost - and we can go off list for some help
>
> Glenn
>
>
>
> On Aug 2, 2010, at 9:56 AM, Jeremie Chism wrote:
>
> I noticed on Friday that everything I had seemed very slow. I went through
> checking the usual things and found no problem.  After digging into
> everything I could put my hands on, I resorted to calling my upstream to see
> if they noticed any problems.  They of course said no.  At 430 that
> afternoon I got a call from one of their "engineers" stating that they had
> experienced a DOS attack that was affecting certain customers.  They made
> some changes and it actually seemed to work better than before.  Even my
> latency times had dropped.  Today the problem seems to be creeping back to
> the same way it was Friday.  My question is, is there a way to determine in
> the future that this is happening.  Is there something specific that would
> lead me to the conclusion that in fact that is what is going on.
>
> --
> Jeremie Chism
> TritonDataLink
>
>
>
> 
> WISPA Wants You! Join today!
> http://signup.wispa.org/
>
> 
>
> WISPA Wireless List: wireless@wispa.org
>
> Subscribe/Unsubscribe:
> http://lists.wispa.org/mailman/listinfo/wireless
>
> Archives: http://lists.wispa.org/pipermail/wireless/
>
>
>
> _
> *Glenn Kelley | Principle | HostMedic |www.HostMedic.com *
>   Email: gl...@hostmedic.com
> Pplease don't print this e-mail unless you really need to.
>
>
>
>
>
> 
> WISPA Wants You! Join today!
> http://signup.wispa.org/
>
> 
>
> WISPA Wireless List: wireless@wispa.org
>
> Subscribe/Unsubscribe:
> http://lists.wispa.org/mailman/listinfo/wireless
>
> Archives: http://lists.wispa.org/pipermail/wireless/
>



-- 
Jeremie Chism
TritonDataLink



WISPA Wants You! Join today!
http://signup.wispa.org/

 
WISPA Wireless List: wireless@wispa.org

Subscribe/Unsubscribe:
http://lists.wispa.org/mailman/listinfo/wireless

Archives: http://lists.wispa.org/pipermail/wir

Re: [WISPA] DOS attack

[Jon Auer]

I see a lot of replies about what to do if *you* are the target of a
DOS attack but not many about how to tell if your upstream is getting
slammed.

Really a DOS attack on a upstream should have symptoms of any other
upstream capacity issue that you want to know about, just it will
probably have a sudden onset.

We use smokeping ( http://oss.oetiker.ch/smokeping/ ) to watch latency
to our upstream and key points on the internet. If your provider gets
congested you will see latency and packet loss go up. Depending on
your monitoring point selection you can see which of your upstream's
upstream links are congested, or all of them.

It is also a good way to keep a eye on network performance if you are
concerned about VoIP quality.

On Mon, Aug 2, 2010 at 8:56 AM, Jeremie Chism  wrote:
> I noticed on Friday that everything I had seemed very slow. I went through
> checking the usual things and found no problem.  After digging into
> everything I could put my hands on, I resorted to calling my upstream to see
> if they noticed any problems.  They of course said no.  At 430 that
> afternoon I got a call from one of their "engineers" stating that they had
> experienced a DOS attack that was affecting certain customers.  They made
> some changes and it actually seemed to work better than before.  Even my
> latency times had dropped.  Today the problem seems to be creeping back to
> the same way it was Friday.  My question is, is there a way to determine in
> the future that this is happening.  Is there something specific that would
> lead me to the conclusion that in fact that is what is going on.
>
> --
> Jeremie Chism
> TritonDataLink
>
>
>
> 
> WISPA Wants You! Join today!
> http://signup.wispa.org/
> 
>
> WISPA Wireless List: wireless@wispa.org
>
> Subscribe/Unsubscribe:
> http://lists.wispa.org/mailman/listinfo/wireless
>
> Archives: http://lists.wispa.org/pipermail/wireless/
>



WISPA Wants You! Join today!
http://signup.wispa.org/

 
WISPA Wireless List: wireless@wispa.org

Subscribe/Unsubscribe:
http://lists.wispa.org/mailman/listinfo/wireless

Archives: http://lists.wispa.org/pipermail/wireless/

Re: [WISPA] DOS attack

[Nick Olsen]

Well, I believe in this case it was all Asia IP space, Mostly from the same 
hand full of subnets. So they dropped the associated /24's

Nick Olsen
Network Operations
(321) 205-1100 x106



From: "Matt" 
Sent: Monday, August 02, 2010 10:56 AM
To: "WISPA General List" 
Subject: Re: [WISPA] DOS attack

>to 1.2Gb/s if I recall correctly. At first we were getting crazy packet 
loss because the upstream router was getting hammered.
>After that they put in a few rules to drop the traffic and that made it 
stable, But latency was like +140ms going into it.

What rules can really help a DOS attack?  I just see it as hard to
block since usually its coming from thousands of different IP's.  I
imagine it could look like TCP, UDP or etc.  How can a router tell
whats legitimate and not?

Matt



WISPA Wants You! Join today!
http://signup.wispa.org/



WISPA Wireless List: wireless@wispa.org

Subscribe/Unsubscribe:
http://lists.wispa.org/mailman/listinfo/wireless

Archives: http://lists.wispa.org/pipermail/wireless/




WISPA Wants You! Join today!
http://signup.wispa.org/

 
WISPA Wireless List: wireless@wispa.org

Subscribe/Unsubscribe:
http://lists.wispa.org/mailman/listinfo/wireless

Archives: http://lists.wispa.org/pipermail/wireless/

Re: [WISPA] DOS attack

[Matt]

>to 1.2Gb/s if I recall correctly. At first we were getting crazy packet loss 
>because the upstream router was getting hammered.
>After that they put in a few rules to drop the traffic and that made it 
>stable, But latency was like +140ms going into it.

What rules can really help a DOS attack?  I just see it as hard to
block since usually its coming from thousands of different IP's.  I
imagine it could look like TCP, UDP or etc.  How can a router tell
whats legitimate and not?

Matt



WISPA Wants You! Join today!
http://signup.wispa.org/

 
WISPA Wireless List: wireless@wispa.org

Subscribe/Unsubscribe:
http://lists.wispa.org/mailman/listinfo/wireless

Archives: http://lists.wispa.org/pipermail/wireless/

Re: [WISPA] DOS attack

[Glenn Kelley]

Jeremie

there are a few ways to investigate a suspect DOS attack.
First and foremost you want to take a peek at your incoming connections.  

Do you see a large influx of incoming traffic? 
If so - are you able to identify where it is coming from?

Chances are if you know where it is coming from you can simply ask your 
provider to null route the traffic ahead of you.


Commands like netstat -na  can be a great friend in these cases if you have the 
ability to place something in between the connections. 

I personally love PFSense for this reason.   PFSense can operate as a 
transparent firewall (and many other things... )   But for Free - it is an 
excellent tool -  loads on virtually any x86 system with 2 NIC cards. 

Anyhow - Folks that do Dos  or DDos (Distributed Denial of Service) generally 
attack port 80 as well as mail ports. 
Many WISPs will keep port 80 open to the general public so they can reach the 
radio's configuration windows. 

While it is not something I would suggest - for a variety of reasons - chances 
are the port 80 of a customers radio is what is getting wacked. 

Generally dDos come in as udp packets to other ports - simply because of how 
UDP works - it does not cause them as much of an issue as it would you.   

So - a few commands might help here. 

netstat -lpn | grep :80 | awk '{print $5}'|cut -d: -f 1|sort|uniq -c|sort -nk 1


you can change the 80 above to any port you wish such as 25 for smtp, 53 for 
dns/named , etc etc etc... 

This should show you the # of connections from a specific IP. 
If you have a small # of connections from very large numbers of IP addresses - 
then chances are you might be under DDOS. 

If there are a very large # of connections from just a few ip's than it should 
be simple enough to ask the ISP to block or null route those IP addresses. 

One last note - 

You might want to check the IP's against nslookup or use the DNSStuff.com 
toolset. 
I have helped a few through these over the years and when they block the DNS 
servers many folks use like 208.67.222.222 or 8.8.8.8 it really stinks for 
folks... for sure. 

So you want to make sure you are blocking the right thing of course. 

Are you running anything like NTOP ?  There are a few simple things to have in 
place to watch incoming traffic when needed vs hoping that it goes away... 

Kick back to me if your lost - and we can go off list for some help 

Glenn 



On Aug 2, 2010, at 9:56 AM, Jeremie Chism wrote:

> I noticed on Friday that everything I had seemed very slow. I went through 
> checking the usual things and found no problem.  After digging into 
> everything I could put my hands on, I resorted to calling my upstream to see 
> if they noticed any problems.  They of course said no.  At 430 that afternoon 
> I got a call from one of their "engineers" stating that they had experienced 
> a DOS attack that was affecting certain customers.  They made some changes 
> and it actually seemed to work better than before.  Even my latency times had 
> dropped.  Today the problem seems to be creeping back to the same way it was 
> Friday.  My question is, is there a way to determine in the future that this 
> is happening.  Is there something specific that would lead me to the 
> conclusion that in fact that is what is going on.  
> 
> -- 
> Jeremie Chism
> TritonDataLink
> 
> 
> 
> WISPA Wants You! Join today!
> http://signup.wispa.org/
> 
> 
> WISPA Wireless List: wireless@wispa.org
> 
> Subscribe/Unsubscribe:
> http://lists.wispa.org/mailman/listinfo/wireless
> 
> Archives: http://lists.wispa.org/pipermail/wireless/

_
Glenn Kelley | Principle | HostMedic |www.HostMedic.com 
  Email: gl...@hostmedic.com
Pplease don't print this e-mail unless you really need to.




WISPA Wants You! Join today!
http://signup.wispa.org/

 
WISPA Wireless List: wireless@wispa.org

Subscribe/Unsubscribe:
http://lists.wispa.org/mailman/listinfo/wireless

Archives: http://lists.wispa.org/pipermail/wireless/

Re: [WISPA] DOS attack

[Nick Olsen]

Well, if its not hitting YOU then its not to easy to tell.
If its hitting your routers you should see it. But if your upstream is 
getting attacked that's a whole different story.

We share a upstream router with a datacenter a few cities over. They got 
hit hard from china asia a year or two ago, Like busting to 1.2Gb/s if I 
recall correctly. At first we were getting crazy packet loss because the 
upstream router was getting hammered. After that they put in a few rules to 
drop the traffic and that made it stable, But latency was like +140ms going 
into it.
Long story short, If you see latency climbing up, More so then normal for 
peak time, It could be an attack. Even dropping packets takes CPU time. And 
if you have that many, It can really slow things down.

Nick Olsen
Network Operations
(321) 205-1100 x106



From: "Jeremie Chism" 
Sent: Monday, August 02, 2010 10:04 AM
To: "WISPA General List" 
Subject: [WISPA] DOS attack

I noticed on Friday that everything I had seemed very slow. I went through 
checking the usual things and found no problem.  After digging into 
everything I could put my hands on, I resorted to calling my upstream to 
see if they noticed any problems.  They of course said no.  At 430 that 
afternoon I got a call from one of their "engineers" stating that they had 
experienced a DOS attack that was affecting certain customers.  They made 
some changes and it actually seemed to work better than before.  Even my 
latency times had dropped.  Today the problem seems to be creeping back to 
the same way it was Friday.  My question is, is there a way to determine in 
the future that this is happening.  Is there something specific that would 
lead me to the conclusion that in fact that is what is going on.  

-- 
Jeremie Chism
TritonDataLink




WISPA Wants You! Join today!
http://signup.wispa.org/

 
WISPA Wireless List: wireless@wispa.org

Subscribe/Unsubscribe:
http://lists.wispa.org/mailman/listinfo/wireless

Archives: http://lists.wispa.org/pipermail/wireless/

[WISPA] DOS attack

[Jeremie Chism]

I noticed on Friday that everything I had seemed very slow. I went through
checking the usual things and found no problem.  After digging into
everything I could put my hands on, I resorted to calling my upstream to see
if they noticed any problems.  They of course said no.  At 430 that
afternoon I got a call from one of their "engineers" stating that they had
experienced a DOS attack that was affecting certain customers.  They made
some changes and it actually seemed to work better than before.  Even my
latency times had dropped.  Today the problem seems to be creeping back to
the same way it was Friday.  My question is, is there a way to determine in
the future that this is happening.  Is there something specific that would
lead me to the conclusion that in fact that is what is going on.

-- 
Jeremie Chism
TritonDataLink



WISPA Wants You! Join today!
http://signup.wispa.org/

 
WISPA Wireless List: wireless@wispa.org

Subscribe/Unsubscribe:
http://lists.wispa.org/mailman/listinfo/wireless

Archives: http://lists.wispa.org/pipermail/wireless/