SYN floods

Mailman List Mirror (Read Only)
1

Some part of the discussion involves the technical details of hardening OS
kernels as well as a couple of alternate solutions for defending against
the attacks involving either a SYN proxy or a machine feeding RST's. These
technical details belong on the firewalls list because the people on that
list work with building DEFENSIVE mechanisms.

Except that what we need are routers implementing traffic filtering on
ISP input ports rather than firewalls defending customer premises from attacks
coming from the ISPs. I think we are dealing with two different markets and
two different groups of people. I don't think that ISPs will protect themselves
from this denial of service attack with firewalls. This is a router requirement.

inet-access and other ISP mailing lists are most relevant for the
PREVENTION of SYN flood attacks. This is where we need to hammer home the
need for filtering outgoing routes.

Filtering incoming traffic against legitimate source addresses.

The most important point is that if we all decide that defense and tracing
are of limited utility and that filtering is the only way to stop these
attacks, then we need a few people who read the nanog and iepg lists
to stand up and say "I will filter and I expect you to do the same if you
want to peer with me." Otherwise, it will be difficult for any single ISP
to justify being the first to install peripheral filtering. We must have
a consensus to move on this issue. Call it "peer pressure". :slight_smile:

--Kent

2

>the attacks involving either a SYN proxy or a machine feeding RST's. These
>technical details belong on the firewalls list because the people on that
>list work with building DEFENSIVE mechanisms.

Except that what we need are routers implementing traffic filtering on
ISP input ports rather than firewalls defending customer premises from attacks
coming from the ISPs.

We need both.

I think we are dealing with two different markets and two different
groups of people. I don't think that ISPs will protect themselves from
this denial of service attack with firewalls. This is a router
requirement.

Whether you put the firewall capability in a router or a seperate box does
not matter. The firewalls list is for people who want to talk about
different defensive strategies and how to implement them.

The most important point is that if we all decide that defense and tracing
are of limited utility and that filtering is the only way to stop these
attacks, then we need a few people who read the nanog and iepg lists
to stand up and say "I will filter and I expect you to do the same if you
want to peer with me." Otherwise, it will be difficult for any single ISP
to justify being the first to install peripheral filtering. We must have
a consensus to move on this issue. Call it "peer pressure". :slight_smile:

You can also frighten people like so...

Copyright 1996 by Michael Dillon, All Rights Reserved

By now everyone is well aware of the exploits of the legendary hacker
Kevin Mitnick who broke into computers at the San Diego Supercomputer
Center administered by Tsutomu Shimomura by using a couple of techniques
known as source spoofing and SYN flooding. But few people are aware that
these techniques have now been mastered by many other hackers estimated to
be 20,000 strong in the USA alone. And surprisingly, few Internet sites
have protected themselves from such attacks by installing simple source
address filters on their routers. A variation on this type of attack shut
down a New York ISP for hours at a time over a four day period early in
September.

Anyone responsible for any services connected to the Internet should see
to it that basic source address filters are installed in their routers.
These filters will ensure that no packets can enter your network
pretending to be from a trusted machine inside your network. And they will
prevent packets from leaving your network unless they have proper local
source addresses on them. The incoming filters will protect you from
external spoofing attacks by hackers while the outgoing filters will
ensure that you cannot be used as a launching board for hacker attacks and
thus protect you from legal liability.

-----------------end of sample---------

Add some technical details on how to implement source address filtering
and you will get LOTS of sites to install these filters. The copyright
notice is up there because I intend to approach various magazine editors
regarding an article on the subject. But if somebody wants to take a
similar approach on a web page or a mailing list or at LISA or at NANOG or
wherever, I think this is an effective angle to take. You know what they
say; most people don't get the message until they read something for the
SEVENTH time.

Michael Dillon - ISP & Internet Consulting
Memra Software Inc. - Fax: +1-604-546-3049
http://www.memra.com - E-mail: michael@memra.com

3

It is also important to remember that the SYN attack is only one in a class
of one-way denial-of-service attacks. While hardening the servers on the
net against this kind of attack is important (and is the province of the
server/OS vendors, not the router or firewall vendors), the most effective
way to end a denial of service attack is to trace it to its source, and
terminate it there.

To be able to trace without doing a lot of link-by-link guesswork, the
edges of the network need to be filtered, such that no customer of any ISP
or NSP can inject packets into the Internet that are not part of the
customer's assigned address space. This will give us a first approximation
of an ability to figure out where this stuff comes from.

While it's harder to trace if we get less than 100% compliance, if we get
60%, we know were to start looking for the perps - the remaining 40%.

The other nice effect of this requirement is that, in the implementations
that I am aware of, it's cheaper to filter one big CIDR block than a
bazillion disjoint address spaces, thus adding one more thump to the
drumbeat for CIDR.

It is time for a Best Common Practice document.

  Erik Fair