Digital Island sponsors DoS attempt

Mailman List Mirror (Read Only)
1

> ..., the broader standard of "unwelcome" is more
> widely applicable than the narrow standard of "illegal."

This is where we arrive at "Acceptable Use", which is why it is
required. But these policies need to be propogated and enforced at
smaller points of intervention.

That's vaporware at the moment. Until it's realized, senders must follow a
universal standard for determining whether their traffic will be welcomed
by receivers and intermediate systems whose AUP's aren't published in a
mechanised form and with whom the sender has no direct relationship, or
contract, or terms of service.

And unlike a direct relationship where it's safe to simply enumerate the
things which mustn't be done and then assert that, subject to revision of
that list, everything else is OK; in the indirect, transitive case where
the recipient is distant and their policy isn't known, it's only safe to
err on the side of extreme politeness: send what you know to be welcome,
and hold onto the rest.

2

The burden is on the sender? We'd better all turn off our hosts.
The sender (and in many cases the receiver as well) have no method
to verify all intermediate systems. The range of unwritten grey
is also huge. Consider:

1) If I request a web page without first asking permission, is that
   wrong?

1a) If I then immediately reload it fetching it twice, is that
    wrong?

1b) If I wget the whole site, is that wrong?

1c) wget it once an hour?

1d) Request web pages as fast as my system allows?

2) If I send e-mail to someone@pobox.com containing a picture of
   people in the office, which includes some women, and it happens
   to forward to a server in Afghanistan where women can't be seen
   without their face covered, is it my fault?

3) If someone wget's my web server downloading several hundred megs
   and I decide then to send a single ping back, and do a single
   DNS lookup, is that wrong?

3a) I ping every host in their netblock once, is that wrong?

3b) I leave a standard once-a-second ping running for a day to
    check them out?

3c) I flood ping them from all my hosts as fast as I can?

There is a long legal tradition in civil life that if you don't
want someone to do something, you must give them notice. Put a
sign that says 'no solicitations' on your door, and if someone
rings your doorbell to sell you something then you have a legitimate
complaint. If you hang no such sign, or if you put it on your back
door when everyone comes up to your front door then you have no
complaint, and your recourse is to ask them to leave. For the more
serious events, there is criminal law preventing them from bringing
200 people to your door (an illegal gathering) and the like.

The networking world is similar. Put up a web server and you can't
complain about someone downloading your web page once. Put up a
host, and someone pings you a small number of times, you can't
complain either. Make the front page of your web site say
'unauthorized access prohibited' and then someone gets the front
page and continues to spider the whole site, and you might have a
claim. If you filter pings, and someone still sends tons of them
your way, and you might have a claim. If someone SMURF floods you
that's a criminal matter as an attack, regardless.

Also important is the notion of transaction, which seems to have
been lost in this discussion. If a user requests a web page it is
quite possible that the web server may attempt to use a mechanism
other than HTTP to communicate with the client. In the simple
example, consider a web server that for each page downloaded pings
the client once and uses that data to improve the client experience.
In my opinion, that ping is part of the transaction of getting the
web page that the user requested, and as such cannot be considered
abusive. This is particularly true when the volume is high. I've
seen queries before from sites hosting thousands of users accessing
popular sites who complain that the site then sends back a couple
of hundred pings.

It amazes me that people think the Internet is going to be different
than the real world. I don't know about the rest of the people on
here, but I get my share of telephone soliciter and junk mail even
with using some of the junkbusters techniques. It's legal, and
the way the world works. The same thing happens in cyberspace.
When I receive the e-mail about how someone's IDS caught a user
sending a single traceroute to their site I have to wonder how this
person has so much free time as to investigate such things. If
you connect to the net you will get pinged from time to time.
Someone may traceroute to you. Heck, they might try to get a web
page from you. If you don't like it, block it. If they only try
once or twice and then go away, don't complain about it. They came
up, read the 'sign' as it were, and went away.

3

1) If I request a web page without first asking permission, is that
   wrong?

Is this a public page ? Are you trying to download my corporate directory?

1a) If I then immediately reload it fetching it twice, is that
    wrong?

Were you authorized to get it (if yes, then fetch away).

1b) If I wget the whole site, is that wrong?

Sure is, I've given you no right to pull down my site. Copyright law rules
here (depending on what the copyright of the site is).

1c) wget it once an hour?

You'll show up in my traffic logs, expect to be ACL'd.

1d) Request web pages as fast as my system allows?

If you're legitimately surfing, sure, if not, ACL once again.

2) If I send e-mail to someone@pobox.com containing a picture of
   people in the office, which includes some women, and it happens
   to forward to a server in Afghanistan where women can't be seen
   without their face covered, is it my fault?

They are not allowed to use the Internet in any case.

3) If someone wget's my web server downloading several hundred megs
   and I decide then to send a single ping back, and do a single
   DNS lookup, is that wrong?

Sure is, they have not authorized you to send such traffic. I've been
downloading data from your web page, there is no reason for you to send ICMP
traffic my way (one ICMP packet is one end of the extreme).

3a) I ping every host in their netblock once, is that wrong?

You bet ! I've given you no right to do so!

3b) I leave a standard once-a-second ping running for a day to
    check them out?

I will ACL you and possibly complain to your upstream for abuse.

3c) I flood ping them from all my hosts as fast as I can?

See 3b above.

There is a long legal tradition in civil life that if you don't
want someone to do something, you must give them notice. Put a

I don't need to tell anyone that they may not enter my hope and park their
arse on my sofa. The also cannot start walking through my house and opening
doors to see which rooms are occupied. I'd love to see someone take
portscannig and probing and use tresspass or break and enter laws to
prosecute.

Probing and scanning has a place, the discression as to what is allowed must
be
from the receiving end. You have no right to decide what traffic my network
is to receive.

The networking world is similar. Put up a web server and you can't
complain about someone downloading your web page once. Put up a
host, and someone pings you a small number of times, you can't
complain either. Make the front page of your web site say

Why not ! I have not authorized you to probe my network ! Does your
proposal scale ? What if I want to ping every host on the @Home network 100
times in a day (ooops thats 350 million ICMP packets that enter your
network, is it a problem NOW?).

'unauthorized access prohibited' and then someone gets the front
page and continues to spider the whole site, and you might have a
claim. If you filter pings, and someone still sends tons of them
your way, and you might have a claim. If someone SMURF floods you
that's a criminal matter as an attack, regardless.

Where is the line drawn between a SMURF and a legitimate probe ? Who gets
to draw the line ,the sender, I think not!

Also important is the notion of transaction, which seems to have
been lost in this discussion. If a user requests a web page it is
quite possible that the web server may attempt to use a mechanism
other than HTTP to communicate with the client. In the simple
example, consider a web server that for each page downloaded pings
the client once and uses that data to improve the client experience.
In my opinion, that ping is part of the transaction of getting the
web page that the user requested, and as such cannot be considered
abusive. This is particularly true when the volume is high. I've
seen queries before from sites hosting thousands of users accessing
popular sites who complain that the site then sends back a couple
of hundred pings.

I know of no standard that incorporates ICMP probes with HTTP transfers. If
I ask for HTTP data, thats all that I expect, nothing less, nothing more. I
am not opposed to such a standard, but am opposed to people trying such
schemes without my knowledge or permission.

person has so much free time as to investigate such things. If
you connect to the net you will get pinged from time to time.
Someone may traceroute to you. Heck, they might try to get a web
page from you. If you don't like it, block it. If they only try
once or twice and then go away, don't complain about it. They came
up, read the 'sign' as it were, and went away.

I've got much better things to do than enter millions of hosts into an ACL.
If one had to block all this traffic, routers would need hundreds of CPUs
and Terabytes of memory (going through an ACL that is thousands of lines
long takes a lot of power).

4

ICMP host/net/port unreachable, anybody? How about TCP ECN packets?

5

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

And unlike a direct relationship where it's safe to simply enumerate the
things which mustn't be done and then assert that, subject to revision of
that list, everything else is OK; in the indirect, transitive case where
the recipient is distant and their policy isn't known, it's only safe to
err on the side of extreme politeness: send what you know to be welcome,
and hold onto the rest.

What if everyone followed your principle? Digital Island and Akamai, Caida,
the Internet Weather report, and lots of other stuff (including spam) simply
could not exist. It is not practical to ask everyone permission before
proceeding. The only practical position to take is to proceed until someone
complains, and stop probing them when they do. Your position places an
unfair burden on the sender.

6

Sure is, they have not authorized you to send such traffic. I've been
downloading data from your web page, there is no reason for you to send ICMP
traffic my way (one ICMP packet is one end of the extreme).

> 3a) I ping every host in their netblock once, is that wrong?

You bet ! I've given you no right to do so!

Think of it as freedom of speech. I can say whatever I like, and you have
the option of listening.

ICMP is a standard protocol I can use to solicit packet responses from
hosts on the Internet. Until that changes, people will be sending you ICMP
packets, and lots of them.

I will ACL you and possibly complain to your upstream for abuse.

Have mercy.

I don't need to tell anyone that they may not enter my hope and park their
arse on my sofa. The also cannot start walking through my house and opening
doors to see which rooms are occupied. I'd love to see someone take
portscannig and probing and use tresspass or break and enter laws to
prosecute.

An analogy - how clever. But wait, your home is private property, and
your network is a public-access system. I can park my car in front of
your house, and my dog can crap by your mailbox.

Why not ! I have not authorized you to probe my network ! Does your
proposal scale ? What if I want to ping every host on the @Home network 100
times in a day (ooops thats 350 million ICMP packets that enter your
network, is it a problem NOW?).

Nothing to my knowledge is preventing you from sending ICMP echo requests
to every host on the @Home network 100 times a day. There would be little
they could do about it, other than politely ask you to stop, or filter
you.

Where is the line drawn between a SMURF and a legitimate probe ? Who gets
to draw the line ,the sender, I think not!

A smurf is an intentional denial of service, an ICMP echo request is not.

I know of no standard that incorporates ICMP probes with HTTP transfers. If
I ask for HTTP data, thats all that I expect, nothing less, nothing more. I
am not opposed to such a standard, but am opposed to people trying such
schemes without my knowledge or permission.

Yes they can. Its a Free Internet (tm).

I've got much better things to do than enter millions of hosts into an ACL.
If one had to block all this traffic, routers would need hundreds of CPUs
and Terabytes of memory (going through an ACL that is thousands of lines
long takes a lot of power).

You might consider upgrading your IOS, it looks like you are going to
need it.

7

> 1b) If I wget the whole site, is that wrong?

Sure is, I've given you no right to pull down my site. Copyright law rules
here (depending on what the copyright of the site is).

Yes, copyright law applies. But how is using wget to get the whole site different to me navigating the whole site... rights based on user agents? Hmm.

> 1c) wget it once an hour?

You'll show up in my traffic logs, expect to be ACL'd.

wget on the whole site, yes, probably not nice. wget on a single page?

> 1d) Request web pages as fast as my system allows?

If you're legitimately surfing, sure, if not, ACL once again.

How do you detect "legitimately surfind"?

> Also important is the notion of transaction, which seems to have
> been lost in this discussion. If a user requests a web page it is
> quite possible that the web server may attempt to use a mechanism
> other than HTTP to communicate with the client. In the simple
> example, consider a web server that for each page downloaded pings
> the client once and uses that data to improve the client experience.
> In my opinion, that ping is part of the transaction of getting the
> web page that the user requested, and as such cannot be considered
> abusive. This is particularly true when the volume is high. I've
> seen queries before from sites hosting thousands of users accessing
> popular sites who complain that the site then sends back a couple
> of hundred pings.

I know of no standard that incorporates ICMP probes with HTTP transfers. If
I ask for HTTP data, thats all that I expect, nothing less, nothing more. I
am not opposed to such a standard, but am opposed to people trying such
schemes without my knowledge or permission.

Funny, I seem to recall that the default for CERN and NCSA httpd's (yes, I know, years old) was to send an ident request back to the requesting host. If memory serves it's also trivially simple (and painfully dumb in most cases these days) to configure Apache to do so.

Am I right to assume that doing a reverse lookup on the requesting host is also bad? I'm not aware of any standard that states that's acceptable either...

8

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I've got much better things to do than enter millions of hosts
into an ACL.
If one had to block all this traffic, routers would need hundreds of CPUs
and Terabytes of memory (going through an ACL that is thousands of lines
long takes a lot of power).

Then you admit that your solution scales no better than the alternative. I
guess we should just pull the plug then, this Internet idea is obviously too
advanced for mere mortals.

9

Am I right to assume that doing a reverse lookup on the requesting
host is also bad? I'm not aware of any standard that states that's
acceptable either...

This will hit my DNS server and not the end host. I would not consider a
reverse lookup very intrusive.