Subject: Re: [DNSOP] Anycast was Re: Cache poisoning on DNSSEC

From: Ralf Weber <[email-masked]>
Date: Mon, 1 Sep 2008 16:12:10 +0200

Moin!

On Aug 30, 2008, at 22:48 , Dean Anderson wrote:
>> While I get paid for that it does work four our customers, so this
>> obviously this is my first concern.
>
> I doubt that many of your customers use TCP DNS.
Correct, but we do see in total an average of 5 to 10 TCP clients per  
second. So something must be using it.

> You only *think* it
> works, because you didn't do adequate testing to see it doesn't work.
> That isn't the same as 'works for our customers'.
Well we tested it as good as we could in our small lab and we did test  
tcp and we did have problems with it in one setup as described  
earlier. We did overcome this problems in the lab and now we are  
actively monitoring it (tcp connection to anycast ips). And we didn't  
got tickets of customers having problems with DNS TCP connection so far.

> Are your resolvers public?
Of course not, I think there is a paper floating around here that this  
is a bad idea ;-).

>  Would it be OK if I test them?
Yeah will send you an separate mail about that.

So long
-Ralf
---
Ralf Weber
Platform Infrastructure Manager
Colt Telecom GmbH
Herriotstrasse 4
60528 Frankfurt
Germany
DDI: +49 (0)69 56606 2780 Internal OneDial: 8 491 2780
Fax: +49 (0)69 56606 6280
Email: [email-masked]
http://www.colt.net/

Data | Voice | Managed Services

*****************************************
COLT Telecom GmbH, Herriotstraße 4, 60528 Frankfurt/Main, Deutschland *
Tel +49 (0)69 56606 0 * Fax +49 (0)69 56606 2222 *
Geschäftsführer: Albertus Marinus Oosterom (Vors.), Rita Thies *
Amtsgericht Frankfurt/Main HRB 53898 * USt.-IdNr. DE 220 772 475

_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

---

From: Ralf Weber <[email-masked]>
Date: Mon, 1 Sep 2008 16:12:10 +0200

Moin!

So long
-Ralf
---
Ralf Weber

---

From: Dean Anderson <[email-masked]>
Date: Mon, 1 Sep 2008 20:57:30 -0400 (EDT)

On Mon, 1 Sep 2008, Ralf Weber wrote:

> Well we tested it as good as we could in our small lab 

Ahh. This is where your engineers are supposed to consider theory, in
this case RFC1546 and RFC1812.  Did you tell your senior management that
RFC1546 explicitly states that Anycast isn't suitable for TCP? Did you
inform your senior management that the Anycast TCP promoters are mostly
operations people (as opposed to credible engineers)? Did you tell them
that the Anycast promoters have financial conflicts of interest for
making their claims, and that they have no theoretical backing for their
assertions?  Or did you leave all that out?

> and we did test tcp and we did have problems with it in one setup as
> described earlier. We did overcome this problems in the lab and now we
> are actively monitoring it (tcp connection to anycast ips). And we
> didn't got tickets of customers having problems with DNS TCP
> connection so far.

So you don't see the same source IP addresses repeated at multiple
anycast servers within a few minutes?  You must have a very unique
setup.

> Of course not, I think there is a paper floating around here that this  

Surprisingly, that paper is promoted by the same people promoting
Anycast DNS... There is no harm in public resolvers.

> Yeah will send you an separate mail about that.

Will do.

		--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000

---

From: Dean Anderson <[email-masked]>
Date: Mon, 1 Sep 2008 20:57:30 -0400 (EDT)

Will do.

		--Dean

---

From: Joe Abley <[email-masked]>
Date: Tue, 2 Sep 2008 09:02:58 -0400

Dean,

On 1 Sep 2008, at 20:57, Dean Anderson wrote:

> mostly operations people (as opposed to credible engineers)?

If av8.net starts selling t-shirts, I'll take one with that phrase.

> There is no harm in public resolvers.

Not to the people running the resolvers, usually, no.

Joe

---

From: Joe Abley <[email-masked]>
Date: Tue, 2 Sep 2008 09:02:58 -0400

Dean,

Joe

---

From: Dean Anderson <[email-masked]>
Date: Tue, 2 Sep 2008 11:04:57 -0400 (EDT)

> If av8.net starts selling t-shirts, I'll take one with that phrase.

Perhaps a t-shirt should have this quote from Paul Vixie: describing the
IETF as "self-selected rabble and trolls"
http://www.ietf.org/mail-archive/web/ietf/current/msg25874.html Or later
in the same message, Vixie says "it's hard to commit acts of leadership
inside a burning movie theatre."  Which is just wrong. Its quite easy to
commit acts of leadership during an emergency. (the emergency being
spam) The problem was that Vixie was himself a spammer, false teaming
with anti-spammers and misleading network operators.  Of course, there
will be no such t-shirt, you are just using the notion of t-shirt to
misrepresent something I said.

I don't mean to say that network operators aren't credible, as you seem
to imply.  I definitely appreciate the craft skills very much. But craft
skills don't generally imply knowledge of theory and mathematics; actual
engineering.  I mean that Network operations staff have a history of
being easily misled by emotional appeals such as "the war won't be over
until the last spammer's head is stuck onto a spear at the city
limits."--Paul Vixie, Sept 1997. Although this really fired-up network
operations staff, it was later discovered that Vixie was a spammer.
Network operations staff however gave Vixie (MAPS/SORBS/SPAMHAUS)
anti-spam From [email-masked]  Tue Sep  2 08:05:43 2008
Date: Tue, 2 Sep 2008 11:04:57 -0400 (EDT)
From: Dean Anderson <[email-masked]>
To: Joe Abley <[email-masked]>
Cc: "Blacka, David" <[email-masked]>, Ralf Weber <[email-masked]>,
	"[email-masked] WG" <[email-masked]>
Subject: Re: [DNSOP] Reflectors are Evil was Re: Anycast was Re: Cache
 poisoning on DNSSEC
Sender: [email-masked]

> If av8.net starts selling t-shirts, I'll take one with that phrase.

Perhaps a t-shirt should have this quote from Paul Vixie: describing the
IETF as "self-selected rabble and trolls"
http://www.ietf.org/mail-archive/web/ietf/current/msg25874.html Or later
in the same message, Vixie says "it's hard to commit acts of leadership
inside a burning movie theatre."  Which is just wrong. Its quite easy to
commit acts of leadership during an emergency. (the emergency being
spam) The problem was that Vixie was himself a spammer, false teaming
with anti-spammers and misleading network operators.  Of course, there
will be no such t-shirt, you are just using the notion of t-shirt to
misrepresent something I said.

I don't mean to say that network operators aren't credible, as you seem
to imply.  I definitely appreciate the craft skills very much. But craft
skills don't generally imply knowledge of theory and mathematics; actual
engineering.  I mean that Network operations staff have a history of
being easily misled by emotional appeals such as "the war won't be over
until the last spammer's head is stuck onto a spear at the city
limits."--Paul Vixie, Sept 1997. Although this really fired-up network
operations staff, it was later discovered that Vixie was a spammer.
Network operations staff however gave Vixie (MAPS/SORBS/SPAMHAUS)
anti-spainformation on Whitehat's competition, while Whitehat was able
to avoid spam-traps; none of this would have been possible without the
support of the misled network operations staff. This draft is a similar
emotional appeal with insufficient basis in fact of number of attacks,
or in theory.

> Not to the people running the resolvers, usually, no.

There is "usually" no harm to anyone from open resolvers. No one has
reported any further attacks since this draft was conceived.  I note
that there have been no substantive answers to any of the questions I
raised, just platitudes and personal attacks.

> Has there been any subsequent attacks since the motivating attack was
> reported?
>
> Given that we now have some high-profile DNSSEC test zones (thanks to
> David Conrad), there is now no reason at all to use a recursor in a
> DDOS attack. One would merely make DNSSEC queries against a
> high-profile authority server.
>
> One can conduct attacks on well-known high-profile authority servers
> without the risk of exposure inherent in searching out reflectors.
>
> And I note that Paul Wouters previously asserted that 100:1
> amplification is a non-issue. If so, then certainly reflector attacks
> are also a non-issue for the same reason.
>
> So, this draft is in search of a problem to solve. However, closing
> open recursors may promote the sales of DNS servers to people who
> didn't need them before, so I wonder about that.  And can we expect to
> see people selling 'reflector blacklist' products to ISPs to block DNS
> to open recursors, merely because the recursors are open?  Will we see
> 'reflector blacklist' people scanning for open recursors?

m information on Whitehat's competition, while Whitehat was able
to avoid spam-traps; none of this would have been possible without the
support of the misled network operations staff. This draft is a similar
emotional appeal with insufficient basis in fact of number of attacks,
or in theory.

> Not to the people running the resolvers, usually, no.

There is "usually" no harm to anyone from open resolvers. No one has
reported any further attacks since this draft was conceived.  I note
that there have been no substantive answers to any of the questions I
raised, just platitudes and personal attacks.

> Has there been any subsequent attacks since the motivating attack was
> reported?
>
> Given that we now have some high-profile DNSSEC test zones (thanks to
> David Conrad), there is now no reason at all to use a recursor in a
> DDOS attack. One would merely make DNSSEC queries against a
> high-profile authority server.
>
> One can conduct attacks on well-known high-profile authority servers
> without the risk of exposure inherent in searching out reflectors.
>
> And I note that Paul Wouters previously asserted that 100:1
> amplification is a non-issue. If so, then certainly reflector attacks
> are also a non-issue for the same reason.
>
> So, this draft is in search of a problem to solve. However, closing
> open recursors may promote the sales of DNS servers to people who
> didn't need them before, so I wonder about that.  And can we expect to
> see people selling 'reflector blacklist' products to ISPs to block DNS
> to open recursors, merely because the recursors are open?  Will we see
> 'reflector blacklist' people scanning for open recursors?

---

From: Joe Abley <[email-masked]>
Date: Tue, 2 Sep 2008 11:47:55 -0400

On 2 Sep 2008, at 11:04, Dean Anderson wrote:

> reported any further attacks since this draft was conceived.

That is not true. It's possible that the forums in which such attacks  
are discussed are not available to you, of course. I say that not as  
some kind of thinly-veiled attack, but merely as an observation that  
security ops forums tend not to be public.

> I note

Oh, I didn't notice any questions. In any case, I was only responding  
to what I saw as factual errors. And I was serious about the t-shirt,  
if the price is reasonable. XXL, thanks.

Joe

---

From: Joe Abley <[email-masked]>
Date: Tue, 2 Sep 2008 11:47:55 -0400

Joe

---

From: Danny McPherson <[email-masked]>
Date: Tue, 2 Sep 2008 10:47:24 -0600

> security ops forums tend not to be public.

I'd note that this 2008 Infrastructure Security Survey collection
is about done, and the largest reported attack over the past
12 months was just north of 40 Gbps (yes, I meant to type "forty")
and employed DNS-based reflective amplification vectors.

Others reported these attacks well above 10 Gbps in the past
12 months as well..

Report to be publish in next month or two.

-danny

---

From: Danny McPherson <[email-masked]>
Date: Tue, 2 Sep 2008 10:47:24 -0600

-danny

---

From: Joao Damas <[email-masked]>
Date: Tue, 2 Sep 2008 18:54:40 +0200

> Anycast DNS... There is no harm in public resolvers.

actually, the paper was done on request by the dnsop wg, with a clear  
content charter put together by the wg chairs based on input from the  
wg. The editors were just the means to bring the paper into existence.

Joao

---

From: Joao Damas <[email-masked]>
Date: Tue, 2 Sep 2008 18:54:40 +0200

Joao

---

From: Dean Anderson <[email-masked]>
Date: Tue, 2 Sep 2008 13:43:54 -0400 (EDT)

> security ops forums tend not to be public.

Really? Your position is that there are attacks but all these attacks
are somehow being kept secret?  People talked about ping floods, syn
floods, and an uncountable slew of other attacks. Incredible. 

If these attacks were indeed happening, someone, somewhere would be
talking about specific attacks.

> > I note that there have been no substantive answers to any of the
> > questions I raised, just platitudes and personal attacks.
> 
> to what I saw as factual errors.

But you don't have any factual counter-evidence to offer to refute the
alleged factual errors.  Incredible.

> And I was serious about the t-shirt, if the price is reasonable. XXL,
> thanks.

Then you should know that this isn't a proper forum to be soliciting me
about t-shirts.

		--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
wwwFrom [email-masked]  Tue Sep  2 10:44:52 2008
Date: Tue, 2 Sep 2008 13:43:54 -0400 (EDT)
From: Dean Anderson <[email-masked]>
To: Joe Abley <[email-masked]>
Cc: "Blacka, David" <[email-masked]>, Ralf Weber <[email-masked]>,
	"[email-masked] WG" <[email-masked]>
Subject: Re: [DNSOP] Reflectors are Evil was Re: Anycast was Re: Cache
 poisoning on DNSSEC
Sender: [email-masked]

> security ops forums tend not to be public.

Really? Your position is that there are attacks but all these attacks
are somehow being kept secret?  People talked about ping floods, syn
floods, and an uncountable slew of other attacks. Incredible. 

If these attacks were indeed happening, someone, somewhere would be
talking about specific attacks.

> > I note that there have been no substantive answers to any of the
> > questions I raised, just platitudes and personal attacks.
> 
> to what I saw as factual errors.

But you don't have any factual counter-evidence to offer to refute the
alleged factual errors.  Incredible.

> And I was serious about the t-shirt, if the price is reasonable. XXL,
> thanks.

Then you should know that this isn't a proper forum to be soliciting me
about t-shirts.

		--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.a.av8.net         faster, more reliable, better service
617 344 9000   

v8.net         faster, more reliable, better service
617 344 9000

---

From: Dean Anderson <[email-masked]>
Date: Tue, 2 Sep 2008 14:44:30 -0400 (EDT)

> Report to be publish in next month or two.

I find this hard to believe from three standpoints:

1) the expected number of open DNS recursors and their collective
bandwidth doesn't seem to be large enough to support a 40Gbps attack.

2) Why would anyone capble of programming bother searching for open
recursors (with often small connection speeds) when they can use 100+
root servers with large amplification factors and high bandwidth
connections at key exchange points?

3) Why aren't these attacks being prosecuted? Someone searching for open
recursors is bound to be noticed.  The only people I know of searching
for open recursors is UltraDNS and a scientific group at Cornell.

I'll wait to see the report.  It will also be interestiFrom [email-masked]  Tue Sep  2 11:44:33 2008
Date: Tue, 2 Sep 2008 14:44:30 -0400 (EDT)
From: Dean Anderson <[email-masked]>
To: Danny McPherson <[email-masked]>
Cc: "[email-masked] WG" <[email-masked]>
Subject: Re: [DNSOP] Reflectors are Evil was Re: Anycast was Re: Cache
 poisoning on DNSSEC
Sender: [email-masked]

> Report to be publish in next month or two.

I find this hard to believe from three standpoints:

1) the expected number of open DNS recursors and their collective
bandwidth doesn't seem to be large enough to support a 40Gbps attack.

2) Why would anyone capble of programming bother searching for open
recursors (with often small connection speeds) when they can use 100+
root servers with large amplification factors and high bandwidth
connections at key exchange points?

3) Why aren't these attacks being prosecuted? Someone searching for open
recursors is bound to be noticed.  The only people I know of searching
for open recursors is UltraDNS and a scientific group at Cornell.

I'll wait to see the report.  It will also be interestingng to find out
who was surveyed. If it turns out to be primarilly NANOG (the source of
the original reports), I'll be more dubious.  Mr. McPherson is
associated with NANOG, attending 18 meeting as of NANOG 42; Only 46
people have attended more NANOG meetings than Mr. McPherson. Comparing
NANOG participation with ARIN membership shows that NANOG makes up a
very small portion of internet service providers.  NANOG has also been
the scene for other deceptions of the internet community. See
http://www.iadl.org/nanog/nanog-story.html for more information.

Perhaps what is needed is a clearinghouse for reporting and stopping DNS
scanners; besides preventing abuse, such a clearinghouse could be useful
in identifying and prosecuting the abusers. Scan detection and abuse
complaint is what drove open relay abusers out of business.  A useful
technique for scan detection is a non-production special "server".  
Scanners show up in the logs; no one else does. Dnscache, BIND, and
PowerDNS all have necessary the logging capabilities.

		--Dean

 to find out
who was surveyed. If it turns out to be primarilly NANOG (the source of
the original reports), I'll be more dubious.  Mr. McPherson is
associated with NANOG, attending 18 meeting as of NANOG 42; Only 46
people have attended more NANOG meetings than Mr. McPherson. Comparing
NANOG participation with ARIN membership shows that NANOG makes up a
very small portion of internet service providers.  NANOG has also been
the scene for other deceptions of the internet community. See
http://www.iadl.org/nanog/nanog-story.html for more information.

Perhaps what is needed is a clearinghouse for reporting and stopping DNS
scanners; besides preventing abuse, such a clearinghouse could be useful
in identifying and prosecuting the abusers. Scan detection and abuse
complaint is what drove open relay abusers out of business.  A useful
technique for scan detection is a non-production special "server".  
Scanners show up in the logs; no one else does. Dnscache, BIND, and
PowerDNS all have necessary the logging capabilities.

		--Dean

---

From: Joe Abley <[email-masked]>
Date: Tue, 2 Sep 2008 15:46:48 -0400

> floods, and an uncountable slew of other attacks. Incredible.

My point is that there are a large number of distributed denial of  
service attacks happening every day, on a scale large enough to  
involve multiple providers and cross-organisational teams for  
mitigation.

When new attack techniques emerge, sometimes they make the news. The  
fiftieth DNS reflection attack on any particular day, years after the  
technique was first described, is unlikely to be newsworthy. The fact  
that alarm bells are not sounding in the streets doesn't mean that  
people continue to work to mitigate such attacks, however, nor that  
such attacks no longer happen.

The existence of closed, operational forums for the discussion and  
mitigation of denial of service attacks is no great secret to  
operators. If you're unaware, and you're an operator, feel free to  
drop me a private note. I would be very happy to let you know about  
the subscription procedures and attendant vetting by peers that would  
be required for you to participate (at least, in the forums I am aware  
of). I imagine discussions of your applicability would be entertaining.

At a higher level, you seem to be seeking some measure of proof  
regarding the existence of something. My aim was not to provide proof  
of anything, since as far as I know this is not a court of law, a  
philosophy class nor a distillery. Apologies if that was not clear.

> talking about specific attacks.

And my point is that they are. Your point is that you don't believe  
me. I might make the point that I don't care who believes me.  
Regardless, I will continue not to lose sleep.

> Then you should know that this isn't a proper forum to be soliciting  

Shame. Perhaps someone else will do the right thing and start selling  
av8 t-shirts with such pithy catchphrases, given your documented lack  
of interest in exploiting this no-doubt lucrative opportunity.

Joe

---

From: Joe Abley <[email-masked]>
Date: Tue, 2 Sep 2008 15:46:48 -0400

Joe

---

From: Danny McPherson <[email-masked]>
Date: Tue, 2 Sep 2008 14:21:05 -0600

> bandwidth doesn't seem to be large enough to support a 40Gbps attack.

Really?  With trivial amplification vectors 20 low-speed broadband
connected bots can generate nearly 1.5 Gbps of attack traffic.  So,
that'd put you around 500 or so bots, and any number of open resolvers,
to generate such an attack, which is low-hanging fruit these days.  Of
course, the reported amplification vector was higher than this, the
number of bots lowers.

> connections at key exchange points?

We'll leave that an exercise for the reader...

> for open recursors is UltraDNS and a scientific group at Cornell.

Searching for open recursors and launching an attack are
two entirely different things.  And launching spoofed-based
attacks makes finding the attacking sources more difficult.  And
given that they're most always botted, you then have to find a
C&C, and then an attacker stepping stone, etc.., etc.,  No need
for rehashes of this here, methinks.

> I'll wait to see the report.  It will also be interesting to find out
> the original reports), I'll be more dubious.

No, there's quite a wide distribution of responses, but mostly
*OG types in various regions.

>  Mr. McPherson is
> people have attended more NANOG meetings than Mr. McPherson.

Interesting tidbit, I had no idea.  Useless, but interesting :-)

-danny

---

From: Danny McPherson <[email-masked]>
Date: Tue, 2 Sep 2008 14:21:05 -0600

-danny

---

From: Mark Andrews <[email-masked]>
Date: Wed, 03 Sep 2008 09:04:44 +1000

> connections at key exchange points?

	Because there are much better amplification factors available
	than those you can produce using the root servers.  The
	roots still only send unfragmented UDP responses.

	Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]
_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

---

From: Mark Andrews <[email-masked]>
Date: Wed, 03 Sep 2008 09:04:44 +1000

Mark

---

From: Kevin Darcy <[email-masked]>
Date: Tue, 02 Sep 2008 20:07:10 -0400

Dean Anderson wrote:
> A useful
http://en.wikipedia.org/wiki/Honeypot_(computing)

- Kevin

---

From: Kevin Darcy <[email-masked]>
Date: Tue, 02 Sep 2008 20:07:10 -0400

- Kevin

---

From: Dean Anderson <[email-masked]>
Date: Wed, 3 Sep 2008 01:08:27 -0400 (EDT)

> such attacks no longer happen.

Significant problems are always newsworthy, or at least
discussion-worthy on various network forums that I do monitor. There has
been no further discussion of these attacks since the two very small
motivating attacks were discussed on NANOG some time ago.  I don't see
any evidence that there have been more than two such attacks.

> of). I imagine discussions of your applicability would be

I never said the existance of forums were secret.  Indeed, the genuine
forums are usually for coordination between major carriers' operations
groups, and so are only appropriate to the operations employees of those
few major carriers.  The rest of the (somewhat dubious) forums are
groups more or less like blackhat; groups basically training bad guys
and/or sharing techniques amoung bad guys, or else amoung dilettantes.  
Because I am not currently employed in the operations department of a
large major carrier myself, I would be unable to actually mitigate any
in-progess attacks. Moreover, I've always worked for major carriers in
engineering, not operations. So I can't imagine why I would ever want to
be in genuine forum, nor would I want to be in any dubious forum. I note
that you aren't employeed by any of the major carriers, either. In
anycase, I doubt that I would need your assistance with any application.

However, not participating in the actual mitigation efforts doesn't mean
that attacks aren't discussed post-mortem.  These discussions are
usually more widespread and are more public. But you have no evidence of
such discussion, nor evidence of any actual attacks whatsoever after the
motivating attacks. 

> philosophy class nor a distillery. Apologies if that was not clear.

I guessed that your aim was not to provide proof of your assertions.  
However, for your claims to be credible, there needs to be some evidence
that this is a problem that needs to be solved, that the costs are
justified. You have no evidence of there being a problem and your claims
are not credible because of the lack of evidence. The costs imposed on 
legitimate open recursors are unjustified.

> Regardless, I will continue not to lose sleep.

The people who don't believe you won't lose sleep either when we
collectively decide you don't have a genuine problem to be solved, or
don't have any evidence of a genuine problem.

> of interest in exploiting this no-doubt lucrative opportunity.

Then I guess they'll learn about the law on trademark infringement.

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Wed, 3 Sep 2008 01:08:27 -0400 (EDT)

--Dean

---

From: Dean Anderson <[email-masked]>
Date: Wed, 3 Sep 2008 01:51:10 -0400 (EDT)

On Tue, 2 Sep 2008, Danny McPherson wrote:

> connected bots can generate nearly 1.5 Gbps of attack traffic.  

It isn't the case that many open recursors are on low-speed broadband 
connections; That is a residential service, while recursors are usually 
run by businesses or ISPs, which changes a number of things.

I also suppose you expect that 20 * 384kbps * 100x = 1.5Gbps.
 (384kbs upload speed)
 (100x amplification factor)

The error in your estimate is that you assume if there are bots to send
demand, that there are recursors to handle the load. This just isn't the
case.

The estimate is an ideal maximum, assuming a lot of things are true that
aren't true. For example, one never has ideal bandwidth available to any
host.  And one must still have enough recursors to can handle the
offered load.  But there aren't enough recursors to provide the load.  
There are only about 20k or so recursors, and most don't sit on high
bandwidth connections.  Many don't support EDNSO, so can't get more than
about 10x amplification, anyway.

Most businesses and ISPs would probably soon notice their participation
in a DDOS attack due to their own bandwidth consumption and block the
(spoofed) source address without damage as a result of the block, or an
upstream carrFrom [email-masked]  Tue Sep  2 22:51:12 2008
Date: Wed, 3 Sep 2008 01:51:10 -0400 (EDT)
From: Dean Anderson <[email-masked]>
To: Danny McPherson <[email-masked]>
Cc: "[email-masked] WG" <[email-masked]>
Subject: Re: [DNSOP] Reflectors are Evil was Re: Anycast was Re: Cache
 poisoning on DNSSEC
Sender: [email-masked]

On Tue, 2 Sep 2008, Danny McPherson wrote:

> connected bots can generate nearly 1.5 Gbps of attack traffic.  

It isn't the case that many open recursors are on low-speed broadband 
connections; That is a residential service, while recursors are usually 
run by businesses or ISPs, which changes a number of things.

I also suppose you expect that 20 * 384kbps * 100x = 1.5Gbps.
 (384kbs upload speed)
 (100x amplification factor)

The error in your estimate is that you assume if there are bots to send
demand, that there are recursors to handle the load. This just isn't the
case.

The estimate is an ideal maximum, assuming a lot of things are true that
aren't true. For example, one never has ideal bandwidth available to any
host.  And one must still have enough recursors to can handle the
offered load.  But there aren't enough recursors to provide the load.  
There are only about 20k or so recursors, and most don't sit on high
bandwidth connections.  Many don't support EDNSO, so can't get more than
about 10x amplification, anyway.

Most businesses and ISPs would probably soon notice their participation
in a DDOS attack due to their own bandwidth consumption and block the
(spoofed) source address without damage as a result of the block, or an
upstream carrieier would block the spoofed source, also without collateral
damage.  

Furthermore, its relatively easy to change the IP address of a
recursor. Abusers need to keep scanning.

> So, that'd put you around 500 or so bots, and any number of open
> resolvers, to generate such an attack, which is low-hanging fruit
> these days.  

Really? Recursors are "low hanging fruit'? By what measure?

> Of course, the reported amplification vector was higher
> than this, the number of bots lowers.

Higher than what?  You can't get more than about 100x from DNS under 
ideal conditions. 

> We'll leave that an exercise for the reader...

Let's not, since its important to consider the alternatives available to
the attacker and the costs of this proposal.  Significantly, the abuser
has an option that doesn't expose them to discovery by their scanning
efforts, and the other attack isn't very easy to mitigate. It doesn't
require the effort of scanning, or of distributing a payload of
recursors to the bots. Quite a lot easier to do.  This seems to make the
other attack much more attractive. Something about low-hanging fruit???

> > 3) Why aren't these attacks being prosecuted? Someone searching for
> > open recursors is bound to be noticed.  The only people I know of
> > searching for open recursors is UltraDNS and a scientific group at
> > Cornell.
> 
> two entirely different things.  

Yes. One must precede the other. Scanning comes first.  And abusers need
to keep scanning, which puts them at a disadvantage for this attack.

> And launching spoofed-based attacks makes finding the attacking
> sources more difficult.  And given that they're most always botted,
> you then have to find a C&C, and then an attacker stepping stone,
> etc.., etc., No need for rehashes of this here, methinks.

Finding the C&C for a botnet that must keep scanning to conduct abuse
should be easier than for a botnet that doesn't need to scan. You find
the person scanning and you found the person involved in the C&C.

Also, one doesn't need to find the attacking source with recursor abuse.  
Its a very mitigatable attack. Just like open proxy abuse, one can
usually block the recursor without collateral damage.  

Significantly, one can't easily mitigate the other attack (ala DNSSEC
responses) of roots, TLDs, major domain's authority servers. Blocking
authority servers generally does significant damage; roots, TLDs, major
domains in particular can't be blocked.

> *OG types in various regions.

Ahh. Figured as much.

> Interesting tidbit, I had no idea.  Useless, but interesting :-)

Useless to you perhaps. Not so useless to everyone.  But its interesting
that you aren't concerned by the association with the other improper
activities. I guess you know about those, so it comes as no surprise.

		--Dean

r would block the spoofed source, also without collateral
damage.  

Furthermore, its relatively easy to change the IP address of a
recursor. Abusers need to keep scanning.

> So, that'd put you around 500 or so bots, and any number of open
> resolvers, to generate such an attack, which is low-hanging fruit
> these days.  

Really? Recursors are "low hanging fruit'? By what measure?

> Of course, the reported amplification vector was higher
> than this, the number of bots lowers.

Higher than what?  You can't get more than about 100x from DNS under 
ideal conditions. 

> We'll leave that an exercise for the reader...

Let's not, since its important to consider the alternatives available to
the attacker and the costs of this proposal.  Significantly, the abuser
has an option that doesn't expose them to discovery by their scanning
efforts, and the other attack isn't very easy to mitigate. It doesn't
require the effort of scanning, or of distributing a payload of
recursors to the bots. Quite a lot easier to do.  This seems to make the
other attack much more attractive. Something about low-hanging fruit???

> > 3) Why aren't these attacks being prosecuted? Someone searching for
> > open recursors is bound to be noticed.  The only people I know of
> > searching for open recursors is UltraDNS and a scientific group at
> > Cornell.
> 
> two entirely different things.  

Yes. One must precede the other. Scanning comes first.  And abusers need
to keep scanning, which puts them at a disadvantage for this attack.

> And launching spoofed-based attacks makes finding the attacking
> sources more difficult.  And given that they're most always botted,
> you then have to find a C&C, and then an attacker stepping stone,
> etc.., etc., No need for rehashes of this here, methinks.

Finding the C&C for a botnet that must keep scanning to conduct abuse
should be easier than for a botnet that doesn't need to scan. You find
the person scanning and you found the person involved in the C&C.

Also, one doesn't need to find the attacking source with recursor abuse.  
Its a very mitigatable attack. Just like open proxy abuse, one can
usually block the recursor without collateral damage.  

Significantly, one can't easily mitigate the other attack (ala DNSSEC
responses) of roots, TLDs, major domain's authority servers. Blocking
authority servers generally does significant damage; roots, TLDs, major
domains in particular can't be blocked.

> *OG types in various regions.

Ahh. Figured as much.

> Interesting tidbit, I had no idea.  Useless, but interesting :-)

Useless to you perhaps. Not so useless to everyone.  But its interesting
that you aren't concerned by the association with the other improper
activities. I guess you know about those, so it comes as no surprise.

		--Dean

---

From: Danny McPherson <[email-masked]>
Date: Wed, 3 Sep 2008 07:38:27 -0600

Dean,
I'm not going to argue this point by point with you, I simply
provided data points on what folks who do this as part of their
day job have observed and reported.  You can choose to
accept this, or not.

As for bots and C&Cs and what's done in practice today
and what's not, well, I know a little about that, as well as
many other folks here on the list.  If you have pointers to
any empirical or even anecdotal evidence I'd love to consider
that in the future, but conjecture provides little value.

>> *OG types in various regions.

Out of curiosity, who do you believe should respond to a
security operations surveys - beyond those in security ops
positions, that is?

> activities. I guess you know about those, so it comes as no surprise.

I've been to twice as many IETF meetings, and here, just like there,
I've learned over the years that there's cruft everywhere and the key
is being able to apply appropriate filters based on one's personal
experiences and opinions.

-danny

---

From: Danny McPherson <[email-masked]>
Date: Wed, 3 Sep 2008 07:38:27 -0600

Dean,

-danny

---

From: Dean Anderson <[email-masked]>
Date: Wed, 3 Sep 2008 11:42:27 -0400 (EDT)

On Wed, 3 Sep 2008, Danny McPherson wrote:

> Dean, I'm not going to argue this point by point with you, I simply
> provided data points on what folks who do this as part of their day
> job have observed and reported.  You can choose to accept this, or
> not.

I choose to report on why this data is not credible and should not be
accepted by the DNSOP WG.

> >> No, there's quite a wide distribution of responses, but mostly *OG
> >> types in various regions.
> >
> > Ahh. Figured as much.
> 
> Out of curiosity, who do you believe should respond to a security
> operations surveys - beyond those in security ops positions, that is?

Perhaps a reasonable spectrum of the internet service providers, rather
than a selection of discredited operations staff.  NANOG does not
represent such a spectrum, but it rather a very tiny minority.  Most
people who attend NANOG never return:
 2 in 3 never returned after 2 meetings
 4 in 5 never returned after 3 meetings
 7 in 8 never returned after 4 meetings
 9 in 10 never returned after 5 meetings

One can see a pattern developing.  However, after about eight to ten
meetings things change. By ten meetings there is an solid core of about
200 or so people who continue come to meeting after meeting after
meeting, and attendence of this core group drops off much more slowly.
These 200 people have overseen a lot of bad things: Telling operations
staff for example that the ECPA doesn't apply to network operators (so
that they would reveal spam traffic information to MAPS), telling them
that the Computer Fraud and Abuse Act didn't apply to ISPs.  Indeed,
most of the people documented on IADL.ORG were NANOG participants when
they did their discredited acts.

Anticipating what you argue below, NANOG indeed maintains editorial
control of its mailing list, and has silenced myself (for asserting
correctly that the above laws apply to ISPs and for publishing 3rd party
statistics critical of SORBS and for disputing Anycast claims); NANOG
silenced Jay Ashworth (for arguing that NANOG was appropriate for
emergency coordination after a hurricane), and NANOG silenced Richard
Steenbergen (for reasons unknown to me).  What NANOG filters is what
really discredits as a reputable source.

> experiences and opinions.

The difference is that as a senior core member of NANOG, NANOG's
disreputable activities reflect on you and discredit its surveys and
reports. NANOG doesn't reflect the ISPs of North America, as shown by
the 3000 or so members of ARIN versus the small number of core NANOG
participants.

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Wed, 3 Sep 2008 11:42:27 -0400 (EDT)

--Dean

---

From: Danny McPherson <[email-masked]>
Date: Wed, 3 Sep 2008 10:15:26 -0600

> accepted by the DNSOP WG.

I believe the WG has heard your position:

"There has been no further discussion of these attacks since the
two very small motivating attacks were discussed on NANOG some
time ago.  I don't see any evidence that there have been more than
two such attacks."

You don't see any evidence of attacks because you haven't read
about them on NANOG ["or various network forums that you do
monitor"] - duly noted, and comically ironic.

> the 3000 or so members of ARIN versus the small number of core NANOG

This survey has nothing to do with NANOG, and it's not in
any way supported or executed by NANOG.  I'm not sure why
you keep repeating this when I responded to your initial query
as such:

"No, there's quite a wide distribution of responses, but mostly
*OG types in various regions."

I'm tempted to take your bait and take offense to your comments
above, but instead, will get backFrom [email-masked]  Wed Sep  3 09:16:55 2008
From: Danny McPherson <[email-masked]>
To: "[email-masked] WG" <[email-masked]>
Date: Wed, 3 Sep 2008 10:15:26 -0600
Subject: Re: [DNSOP] Reflectors are Evil was Re: Anycast was Re: Cache
	poisoning on DNSSEC
Sender: [email-masked]

> accepted by the DNSOP WG.

I believe the WG has heard your position:

"There has been no further discussion of these attacks since the
two very small motivating attacks were discussed on NANOG some
time ago.  I don't see any evidence that there have been more than
two such attacks."

You don't see any evidence of attacks because you haven't read
about them on NANOG ["or various network forums that you do
monitor"] - duly noted, and comically ironic.

> the 3000 or so members of ARIN versus the small number of core NANOG

This survey has nothing to do with NANOG, and it's not in
any way supported or executed by NANOG.  I'm not sure why
you keep repeating this when I responded to your initial query
as such:

"No, there's quite a wide distribution of responses, but mostly
*OG types in various regions."

I'm tempted to take your bait and take offense to your comments
above, but instead, will get back doing something productive as
my points have been made.

Done wasting bandwidth on this discussion here,

-danny

 doing something productive as
my points have been made.

Done wasting bandwidth on this discussion here,

-danny

---

From: Paul Vixie <[email-masked]>
Date: Wed, 03 Sep 2008 18:05:43 +0000

[email-masked] (Danny McPherson) writes:

> Dean, I'm not going to argue this point by point with you, ...

how long is this community going to let a single person dominate its agenda?

i'm using kill-by-thread on dnsop now.  i have no idea how much i'm missing
of what's being posted, but what i really fear is what i'm missing by how much
is not being posted, because so many others have also been driven into similar
kill-by-thread exhaustion by the endless back and forth on the same small web
of interwoven topics by the same four or five people who just can't bear to
let foolish or silly or factually wrong statements go unchallenged.

an early and elementrary usenet discovery, back the low to mid 1980's, was
that some people will not change their views no matter what's said to them,
in fact they aren't really hoping for that, all they look for in replies to
their articles are hooks on which to hang a renewed restatement of whatever
they said before.  it is itinerant on all of us to not fall into the trap of
needing to set the record straight on a daily basis.  some things we don't
agree with can be left unchallenged, it won't affect the lense of history nor
the views of the silent majority of fence sitters watching the back & forth.

show some willpower, folks, please.
-- 
Paul Vixie
_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

---

From: Paul Vixie <[email-masked]>
Date: Wed, 03 Sep 2008 18:05:43 +0000

---

From: Paul Vixie <[email-masked]>
Date: Wed, 03 Sep 2008 18:36:33 +0000

> 	"the un-answered argument wins"

only if it's never answered.  that would cross the line.

answering it every day for the rest of all of our lives crosses the other line.

(not responding publically to the personal parts of what bill said to me.)
_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

---

From: Paul Vixie <[email-masked]>
Date: Wed, 03 Sep 2008 18:36:33 +0000

---

From: Dave CROCKER <[email-masked]>
Date: Wed, 03 Sep 2008 14:19:32 -0700

> how long is this community going to let a single person dominate its agenda?

+1

The benefit of an open process is its ability to obtain unexpected input that is 
useful.

The detriment is that it places an additional burden on everyone to filter out 
the noise.

Failure to do that adds more noise.

d/

ps. My own model is to wait to see postings of support from others.  Without 
supporting posts, there is... no support.  So whatever is being put forward has 
failed to gain traction and failed to be worth worrying about.
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

---

From: Dave CROCKER <[email-masked]>
Date: Wed, 03 Sep 2008 14:19:32 -0700

+1

d/

   Dave Crocker

---

From: Danny McPherson <[email-masked]>
Date: Wed, 3 Sep 2008 20:12:35 -0600

> Failure to do that adds more noise.

I agree with this sentiment generally speaking, but...

For the record, I made my points, I just choose not
to contribute to the extraneous noise.  If you read my
emails that should be obvious.

-danny

---

From: Danny McPherson <[email-masked]>
Date: Wed, 3 Sep 2008 20:12:35 -0600

-danny

---

From: Dean Anderson <[email-masked]>
Date: Thu, 4 Sep 2008 11:32:31 -0400 (EDT)

> monitor"] - duly noted, and comically ironic.

It is indeed comically ironic (telling, actually) that NANOG hasn't
discussed the issue.  But I fail to understand why YOU think that is
comically ironic. 

It is not merely that *I* don't see any evidence. It is that NO ONE has
presented ANY evidence of ANY FURTHER ATTACKS, despite being challenged
to provide some evidence.  Someday (after we approve this document I 
suppose) you promise to have "*OG types" report on this attack. 

> This survey has nothing to do with NANOG, and it's not in any way
> supported or executed by NANOG.  I'm not sure why you keep repeating
> this when I responded to your initial query as such:
> 
> "No, there's quite a wide distribution of responses, but mostly *OG
> types in various regions."

I never said the survey was sponsored by NANOG. But as you admit above,
it limited to the "*OG types", which I note have misled us in the past.
http://www.iadl.org/nanog/nanog-story.html

I'm not very surprised that Vixie and Crocker support this document by
personal attacks.  They try to use emotion rather than reason to get
what they want.  They've done that before with the result that the
Working Group and the public is deceived.

> how long is this community going to let a single person dominate its agenda?

The deception in this assertion is just incredible. I haFrom [email-masked]  Thu Sep  4 08:32:57 2008
Date: Thu, 4 Sep 2008 11:32:31 -0400 (EDT)
From: Dean Anderson <[email-masked]>
To: Danny McPherson <[email-masked]>, Paul Vixie <[email-masked]>,
	<[email-masked]>
Cc: "[email-masked] WG" <[email-masked]>
Subject: Re: [DNSOP] Reflectors are Evil was Re: Anycast was Re: Cache
 poisoning on DNSSEC
Sender: [email-masked]

> monitor"] - duly noted, and comically ironic.

It is indeed comically ironic (telling, actually) that NANOG hasn't
discussed the issue.  But I fail to understand why YOU think that is
comically ironic. 

It is not merely that *I* don't see any evidence. It is that NO ONE has
presented ANY evidence of ANY FURTHER ATTACKS, despite being challenged
to provide some evidence.  Someday (after we approve this document I 
suppose) you promise to have "*OG types" report on this attack. 

> This survey has nothing to do with NANOG, and it's not in any way
> supported or executed by NANOG.  I'm not sure why you keep repeating
> this when I responded to your initial query as such:
> 
> "No, there's quite a wide distribution of responses, but mostly *OG
> types in various regions."

I never said the survey was sponsored by NANOG. But as you admit above,
it limited to the "*OG types", which I note have misled us in the past.
http://www.iadl.org/nanog/nanog-story.html

I'm not very surprised that Vixie and Crocker support this document by
personal attacks.  They try to use emotion rather than reason to get
what they want.  They've done that before with the result that the
Working Group and the public is deceived.

> how long is this community going to let a single person dominate its agenda?

The deception in this assertion is just incredible. I haveven't prevented
anyone from discussing anything. This is an email list; Anyone can post
at any time.

Vixie/Crocker (calling me troll) are just engaging in namecalling, and
have added nothing but noise and emotion.

		--Dean

n't prevented
anyone from discussing anything. This is an email list; Anyone can post
at any time.

Vixie/Crocker (calling me troll) are just engaging in namecalling, and
have added nothing but noise and emotion.

		--Dean

---

From: "David W. Hankins" <[email-masked]>
Date: Fri, 5 Sep 2008 16:36:07 -0700

[For brevity, this is intended as a message in support of Joe's
 position.  I think my original got eaten in the earlier mail
 server event announced on ietf@, so apologies for any duplicates.]

> involve multiple providers and cross-organisational teams for  

For informational purposes, I'd like to point out that yesterday on
the NANOG mailing list, it was asserted that DNS Amplification attacks
are being observed by one security worker (Gadi Evron) on a seemingly
daily basis, frustrated by the lack of adoption of BCP 38 (which is
proposed as the root cause). [1]

Let me say that it is entirely right to suggest that in this case, if
you are engaged in a dialogue of logical deduction, then in the face
of the claim that something does not exist, the responsibility of
argument is to prove that thing does From [email-masked]  Fri Sep  5 16:36:34 2008
Date: Fri, 5 Sep 2008 16:36:07 -0700
From: "David W. Hankins" <[email-masked]>
To: DNSOP WG <[email-masked]>
Subject: Re: [DNSOP] Reflectors are Evil was Re: Anycast was Re:
	Cache	poisoning on DNSSEC
Sender: [email-masked]

[For brevity, this is intended as a message in support of Joe's
 position.  I think my original got eaten in the earlier mail
 server event announced on ietf@, so apologies for any duplicates.]

> involve multiple providers and cross-organisational teams for  

For informational purposes, I'd like to point out that yesterday on
the NANOG mailing list, it was asserted that DNS Amplification attacks
are being observed by one security worker (Gadi Evron) on a seemingly
daily basis, frustrated by the lack of adoption of BCP 38 (which is
proposed as the root cause). [1]

Let me say that it is entirely right to suggest that in this case, if
you are engaged in a dialogue of logical deduction, then in the face
of the claim that something does not exist, the responsibility of
argument is to prove that thing doeexist, on the basis that one
cannot reasonably prove non-existence of any physical object (or
event) with Aristotelian tenacity.

Which is problematic because such a proof (with Aristotelian tenacity)
in this case would require publishing of normally witheld and guarded
data in provably unaltered forms.  This may not even be possible.

This would appear then to be an impasse if the IETF required such
tenacity.

Fortunately, the IETF works on a basis of consensus among
practicioners, not on a basis of Aristotelian deductive proofs of
draft contents and volunteers' opinions.  I'm content to agree with
the other WG participants that DNS Amplification attacks do persist in
the modern day, and that it is useful to write and publish a document
that seeks mitigation.

I hope that the WG's consensus will be so measured by the chairs.

 [1] - http://www.merit.edu/mail.archives/nanog/msg11131.html

-- 
Ash bugud-gul durbatuluk agh burzum-ishi krimpatul.
Why settle for the lesser evil?	 https://secure.isc.org/store/t-shirt/
-- 
David W. Hankins	"If you don't do it right the first time,
Software Engineer		     you'll just have to do it again."
Internet Systems Consortium, Inc.		-- Jack T. Hankins
_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

---

From: Dean Anderson <[email-masked]>
Date: Fri, 5 Sep 2008 22:50:33 -0400 (EDT)

Gentlefolks,

I note that Gadi Evron was, until recently, employed by Afilias, the
same company as Joe Abley.  At present, acccording to another recent
NANOG controversy, Mr. Evron.  Mr Hankins is also not an independent
source, being part of ISC, Joao Damas' (document author)  employer.

Also, I do not think that we need to require aristotelian proof. The
basis of my objection isn't the lack of aristotelian proof.  Rather, it
seems reasonable to require _some_ evidence that this is a real problem,
especially in light of the contrived and exaggerated nature of the
claims; the fact that there are DNS attacks that are easier to conduct;
the fact that the alternative attack doesn't risk detection; the fact
that the alternative attack is harder to mitigate; as well as the
previously discredited source(s) of the claims [See
http://www.iadl.org/nanog/nanog-story.html and
http://www.iadl.org/maps/maps-story.html]

Given that the questioned sources form only a tiny part of even just the
North American ISPs, it shouldn't be very hard to find credible
sources---that is, if indeed this is a real problem that is widely
experienced by internet service providers and that this problem is
serious enough to justify the costs of closing open recursors.  But so
far, We've seen no direct evidence nor any indirect evidence.  
Anecdotes and personal assurances from a tiny group that has
collaborated (properly and improperly) in the past is insufficient to
justify the costs of implementing this change. 

I am also reminded of another point that hasn't been brought up
recently: BCP38 provides a complete and generaFrom [email-masked]  Fri Sep  5 19:50:41 2008
Date: Fri, 5 Sep 2008 22:50:33 -0400 (EDT)
From: Dean Anderson <[email-masked]>
To: "David W. Hankins" <[email-masked]>
Cc: DNSOP WG <[email-masked]>
Subject: Re: [DNSOP] Reflectors are Evil was Re: Anycast was Re:	Cache
 poisoning on DNSSEC
Sender: [email-masked]

Gentlefolks,

I note that Gadi Evron was, until recently, employed by Afilias, the
same company as Joe Abley.  At present, acccording to another recent
NANOG controversy, Mr. Evron.  Mr Hankins is also not an independent
source, being part of ISC, Joao Damas' (document author)  employer.

Also, I do not think that we need to require aristotelian proof. The
basis of my objection isn't the lack of aristotelian proof.  Rather, it
seems reasonable to require _some_ evidence that this is a real problem,
especially in light of the contrived and exaggerated nature of the
claims; the fact that there are DNS attacks that are easier to conduct;
the fact that the alternative attack doesn't risk detection; the fact
that the alternative attack is harder to mitigate; as well as the
previously discredited source(s) of the claims [See
http://www.iadl.org/nanog/nanog-story.html and
http://www.iadl.org/maps/maps-story.html]

Given that the questioned sources form only a tiny part of even just the
North American ISPs, it shouldn't be very hard to find credible
sources---that is, if indeed this is a real problem that is widely
experienced by internet service providers and that this problem is
serious enough to justify the costs of closing open recursors.  But so
far, We've seen no direct evidence nor any indirect evidence.  
Anecdotes and personal assurances from a tiny group that has
collaborated (properly and improperly) in the past is insufficient to
justify the costs of implementing this change. 

I am also reminded of another point that hasn't been brought up
recently: BCP38 provides a complete and general l solution for this and
other spoofing attacks.  Given BCP38, there is really no need for this
document.  BCP38 should protect many services that could potentially be
abused by spoofing, including the legitmate uses of open recursors.  
The efforts spent on this document (both in writing and in later
implementation) would be better applied to promoting and implementing
BCP38.

I might suggest a poll of ISPs, and if 5000 or so ISPs worldwide agree
that open recursors attacks are a current, serious problem that can't be
solved by BCP38, then its a problem that should be acted on.  However,
given past experiences with blacklists (particularly the proponents
association with disreputable blacklists), we should take care that the
proponents do not unduly solicit or threaten ISPs to obtain agreement.

Thanks,

		--Dean

On Fri, 5 Sep 2008, David W. Hankins wrote:

> argument is to prove that thing does exist, on the basis that one

solution for this and
other spoofing attacks.  Given BCP38, there is really no need for this
document.  BCP38 should protect many services that could potentially be
abused by spoofing, including the legitmate uses of open recursors.  
The efforts spent on this document (both in writing and in later
implementation) would be better applied to promoting and implementing
BCP38.

I might suggest a poll of ISPs, and if 5000 or so ISPs worldwide agree
that open recursors attacks are a current, serious problem that can't be
solved by BCP38, then its a problem that should be acted on.  However,
given past experiences with blacklists (particularly the proponents
association with disreputable blacklists), we should take care that the
proponents do not unduly solicit or threaten ISPs to obtain agreement.

Thanks,

		--Dean

On Fri, 5 Sep 2008, David W. Hankins wrote:

> argument is to prove that thing does exist, on the basis that one