5 ms·

Black listing the source IP's is NOT going to help. The attacker can just spoof any IP, he doesn't care about actually connecting he just wants to tie-up your

Black listing the source IP's is NOT going to help. The attacker can just spoof any IP, he doesn't care about actually connecting he just wants to tie-up your server http://en.wikipedia.org/wiki/SYN_flood http://en.wikipedia.org/wiki/SYN_flood

axod 18y ago
As far as I'm aware (Correct me if I'm wrong anyone in the know), the process for any spoofed source address flood would be: * Determine which upstream provider it's coming from * Contact that provider, and ask them to investigate * They do the same thing * If a provider finds out the source is local, then they block it / contact the person(s) responsible etc Of course it gets harder if it's a botnet or some other system that is distributed over a large number of sources.
- blhack 18y ago
  I think that, if we're talking about the level of traffic that I think we're talking about here, it would almost HAVE to be a botnet. either that, or somebody at one of the bandwidth providers got really <i>really</i> pissed off at you...if the later is the case the guy (or girl...they can be vindictive as hell) has probably already been fired since, you know, they sortof monitor these sorts of things.
  - xal 18y ago
    Yea its a botnet and the traffic is spoofed. we never get the same IP twice. Unfortunately it's so much traffic that the firewalls just collapse. Even if you blackhole all traffic they still jump into the blender as soon as they acquire the main ip.
    - tptacek 18y ago
      If it's all spoofed, you (meaning AT&T or Verizon) can stop it with a SYN proxy.
lsc 18y ago
depends on how smart your attacker is. the source IPs must not respond or the attack won't work, so potentially you could block enough bogons. Also the first syn flood attacks came from a fixed source IP. You have OpenBSD firewalls... have you checked out OpenBSD SynProxy? I haven't used it, but it was designed for just your case. http://www.openbsd.org/faq/pf/filter.html#synproxy http://www.openbsd.org/faq/pf/filter.html#synproxy
daveungerer 18y ago
Makes you wonder why ISPs are not discarding packets with spoofed addresses, instead of letting them escape into the greater internet. Is it too expensive to do? My knowledge is a bit rusty, but isn't this a common router function?
- ericwaller 18y ago
  There's no way to know the address is spoofed without replying to it. It's the same idea as "spoofing" the return address on a letter.
  - lsc 18y ago
    this guy is suggesting that the mailman check the return address when he picks up the mail. It's actually a good idea (and fairly common amongst competent ISPs.) the wikipedia explains it well, I think: http://en.wikipedia.org/wiki/Ingress_filtering http://en.wikipedia.org/wiki/Ingress_filtering
  - daveungerer 18y ago
    Sorry, that's not what I meant, and I may have forgotten some terminology, so let me attempt to make myself clearer: The first edge router that a packet encounters, coming from the source, knows what the valid addresses are. The router simply needs to ask itself: "If I were to receive a return packet destined for the claimed return address, would I know what to do with it?" If invalid ones were dropped, then you can at most spoof another address in the same network. But either way, it can be traced back to the correct edge router. I'm looking for someone experienced in these matters to explain why this theory isn't / can't be put into practice.
    - lsc 18y ago
      It's called BCP38 and decent ISPs and competent network admins do it. I do it on the port level for all my IPv4 addresses (that is, all packets leaving a xen vps of mine are dropped unless they come from the address I assigned them.) and I will do it for IPv6 when I build out the routing infrastructure for my new location. It's really pretty easy to do... especially just edge level like you are talking about. The problem is that it costs me some time/money (even if it's only a little) to do it, and it mostly benefits other people. So some ISPs still don't do it. http://www.faqs.org/rfcs/bcp/bcp38.html http://www.faqs.org/rfcs/bcp/bcp38.html but it's really easy. on my router I look at all outgoing packets, and I ask "Does this IP have a source address that is reasonable? (one of my IPs, or an IP of someone for whom I am carrying traffic.)" If my router sees a outgoing packet with a source address not associated with me, it's obviously spoofed, so it drops the packet. If everyone did this, spoofing would only be possible within your own network. Every time an ISP does this, the world becomes a little better for all of us. But spoofing will still be a problem until all ISPs do this, and that probably won't happen for a while. (you also do this to incoming packets, if it is an incoming packet coming in from the internet and it has a source of one of my IP addresses, something has obviously gone horribly wrong. drop the packet. but this only protects you from the most obvious spoofs. It is very important if you do IP based security.)
tptacek 18y ago
That's not strictly true. On the very high end, in products sold pretty much only to ISPs, you can get source address filtering for hundreds of thousands of sources for established connections, and you can get SYN proxying to have the head-end complete the 3WH before your downstream connection ever sees those SYNs.
- lsc 18y ago
  openbsd has synproxy http://www.openbsd.org/faq/pf/filter.html#synproxy http://www.openbsd.org/faq/pf/filter.html#synproxy and urpf http://www.openbsd.org/faq/pf/filter.html#urpf http://www.openbsd.org/faq/pf/filter.html#urpf which sounds a lot like the features you describe.
  - tptacek 18y ago
    Yes, now do that at several million packets per second.
    - lsc 18y ago
      ah. sorry. I was under the impression that this was a sub 100Mbps attack.
- lsc 18y ago
  From my experience at ISPs they tend to be very cost conscious, and far more likely to use a NIX box to do this sort of thing. ISPs are generally competing in a comparatively low-margin market. Usually it's the large corporations with less NIX knowledge (and someone else's money to spend) where I see the really high end firewall/proxy/load balancer gear.
  - tptacek 18y ago
    Your experience conflicts sharply with mine; maybe you're thinking about a different tier of ISP.

axod 18y ago

As far as I'm aware (Correct me if I'm wrong anyone in the know), the process for any spoofed source address flood would be: * Determine which upstream provider it's coming from * Contact that provider, and ask them to investigate * They do the same thing * If a provider finds out the source is local, then they block it / contact the person(s) responsible etc Of course it gets harder if it's a botnet or some other system that is distributed over a large number of sources.

blhack 18y ago
I think that, if we're talking about the level of traffic that I think we're talking about here, it would almost HAVE to be a botnet. either that, or somebody at one of the bandwidth providers got really <i>really</i> pissed off at you...if the later is the case the guy (or girl...they can be vindictive as hell) has probably already been fired since, you know, they sortof monitor these sorts of things.
- xal 18y ago
  Yea its a botnet and the traffic is spoofed. we never get the same IP twice. Unfortunately it's so much traffic that the firewalls just collapse. Even if you blackhole all traffic they still jump into the blender as soon as they acquire the main ip.
  - tptacek 18y ago
    If it's all spoofed, you (meaning AT&T or Verizon) can stop it with a SYN proxy.

lsc 18y ago

depends on how smart your attacker is. the source IPs must not respond or the attack won't work, so potentially you could block enough bogons. Also the first syn flood attacks came from a fixed source IP. You have OpenBSD firewalls... have you checked out OpenBSD SynProxy? I haven't used it, but it was designed for just your case. http://www.openbsd.org/faq/pf/filter.html#synproxy http://www.openbsd.org/faq/pf/filter.html#synproxy

daveungerer 18y ago

Makes you wonder why ISPs are not discarding packets with spoofed addresses, instead of letting them escape into the greater internet. Is it too expensive to do? My knowledge is a bit rusty, but isn't this a common router function?

ericwaller 18y ago
There's no way to know the address is spoofed without replying to it. It's the same idea as "spoofing" the return address on a letter.
- lsc 18y ago
  this guy is suggesting that the mailman check the return address when he picks up the mail. It's actually a good idea (and fairly common amongst competent ISPs.) the wikipedia explains it well, I think: http://en.wikipedia.org/wiki/Ingress_filtering http://en.wikipedia.org/wiki/Ingress_filtering
- daveungerer 18y ago
  Sorry, that's not what I meant, and I may have forgotten some terminology, so let me attempt to make myself clearer: The first edge router that a packet encounters, coming from the source, knows what the valid addresses are. The router simply needs to ask itself: "If I were to receive a return packet destined for the claimed return address, would I know what to do with it?" If invalid ones were dropped, then you can at most spoof another address in the same network. But either way, it can be traced back to the correct edge router. I'm looking for someone experienced in these matters to explain why this theory isn't / can't be put into practice.
  - lsc 18y ago
    It's called BCP38 and decent ISPs and competent network admins do it. I do it on the port level for all my IPv4 addresses (that is, all packets leaving a xen vps of mine are dropped unless they come from the address I assigned them.) and I will do it for IPv6 when I build out the routing infrastructure for my new location. It's really pretty easy to do... especially just edge level like you are talking about. The problem is that it costs me some time/money (even if it's only a little) to do it, and it mostly benefits other people. So some ISPs still don't do it. http://www.faqs.org/rfcs/bcp/bcp38.html http://www.faqs.org/rfcs/bcp/bcp38.html but it's really easy. on my router I look at all outgoing packets, and I ask "Does this IP have a source address that is reasonable? (one of my IPs, or an IP of someone for whom I am carrying traffic.)" If my router sees a outgoing packet with a source address not associated with me, it's obviously spoofed, so it drops the packet. If everyone did this, spoofing would only be possible within your own network. Every time an ISP does this, the world becomes a little better for all of us. But spoofing will still be a problem until all ISPs do this, and that probably won't happen for a while. (you also do this to incoming packets, if it is an incoming packet coming in from the internet and it has a source of one of my IP addresses, something has obviously gone horribly wrong. drop the packet. but this only protects you from the most obvious spoofs. It is very important if you do IP based security.)

tptacek 18y ago

That's not strictly true. On the very high end, in products sold pretty much only to ISPs, you can get source address filtering for hundreds of thousands of sources for established connections, and you can get SYN proxying to have the head-end complete the 3WH before your downstream connection ever sees those SYNs.

lsc 18y ago
openbsd has synproxy http://www.openbsd.org/faq/pf/filter.html#synproxy http://www.openbsd.org/faq/pf/filter.html#synproxy and urpf http://www.openbsd.org/faq/pf/filter.html#urpf http://www.openbsd.org/faq/pf/filter.html#urpf which sounds a lot like the features you describe.
- tptacek 18y ago
  Yes, now do that at several million packets per second.
  - lsc 18y ago
    ah. sorry. I was under the impression that this was a sub 100Mbps attack.
lsc 18y ago
From my experience at ISPs they tend to be very cost conscious, and far more likely to use a NIX box to do this sort of thing. ISPs are generally competing in a comparatively low-margin market. Usually it's the large corporations with less NIX knowledge (and someone else's money to spend) where I see the really high end firewall/proxy/load balancer gear.
- tptacek 18y ago
  Your experience conflicts sharply with mine; maybe you're thinking about a different tier of ISP.