4 ms·

This is probably a stupid question, why can't tier 1 providers (whom I suppose there are relatively few of and who I would expect to incorporate best practices)

This is probably a stupid question, why can't tier 1 providers (whom I suppose there are relatively few of and who I would expect to incorporate best practices) just decide to kill any NTP monlist UDP that ever crosses any of their NPUs? Why would that not solve a large part of the problem? Thank you in advance.

erichocean 13y ago
That seems like a great idea, although it could become a slippery slope.
kamkazemoose 13y ago
I'm not sure at what layer it would be visible that the packets are ntp monlists? The basic answer is probably that the providers just aren't filtering at that level, like if you need layer7 visibility, they don't want to do dpi on any packet that crosses their boundary. Even if you don't need L7 visibility, it would still require another element of processing and filtering that they might not be interested in doing since it will almost always result in some extra cost to run.
vidarh 13y ago
Cost. At typical backbone speeds there are problems enough dealing with basic routing at sufficient throughput already. "Nobody" at that level wants to also have to pattern match packets. Cisco, Juniper etc. who manufacture high end routers would certainly love it. A better alternative is to stop or limit source ip spoofing, because you can filter it on the interfaces connecting smaller providers and customers rather than the most resource-constrained routes to other backbone providers. And that's slowly happening (I'm saying, while looking at tcpdump output from a SYN attack that might very well use spoofed IPs). It's simpler because you "only" need a single lookup against a few bytes per packet per interface instead of potentially having a long list of patterns to check against the whole packet. > and who I would expect to incorporate best practices Don't bet on it. They will when it makes a big difference to them. But for many of these types of attack you'll see purely reactive reactions because it's often far cheaper (for them) vs. the costs of routing hardware etc. that can do enough processing per packet to be viable.
jlgaddis 13y ago
I don't work for a Tier 1 ISP but I do work for an ISP. As a customer, I don't want my ISP screwing with my traffic. As a provider, I don't want any customers complaining because we screw with their traffic. To block monlist and only monlist queries, we'd have to be looking into the layer 7 payload of IP traffic. I'd rather not do that. The brute-force method would be to block traffic to/from 123/UDP but that's gonna mess up a lot of stuff (including my own).
unethical_ban 13y ago
Many people have said it and I'll emphasize: To the extent possible, ISPs should not be doing layer 7/deep packet inspection. They carry traffic. They shouldn't filter. Not only is it unethical, but it's impractical for providers.
noselasd 13y ago
Stepping in and helping mitigate DDOS attacks such as this, by e.g. having the Tier-1s dropping traffic destined to the victim at their edges might be ok. However, Tier 1 providers should not in any way police the internet.

erichocean 13y ago

That seems like a great idea, although it could become a slippery slope.

kamkazemoose 13y ago

I'm not sure at what layer it would be visible that the packets are ntp monlists? The basic answer is probably that the providers just aren't filtering at that level, like if you need layer7 visibility, they don't want to do dpi on any packet that crosses their boundary. Even if you don't need L7 visibility, it would still require another element of processing and filtering that they might not be interested in doing since it will almost always result in some extra cost to run.

vidarh 13y ago

Cost. At typical backbone speeds there are problems enough dealing with basic routing at sufficient throughput already. "Nobody" at that level wants to also have to pattern match packets. Cisco, Juniper etc. who manufacture high end routers would certainly love it. A better alternative is to stop or limit source ip spoofing, because you can filter it on the interfaces connecting smaller providers and customers rather than the most resource-constrained routes to other backbone providers. And that's slowly happening (I'm saying, while looking at tcpdump output from a SYN attack that might very well use spoofed IPs). It's simpler because you "only" need a single lookup against a few bytes per packet per interface instead of potentially having a long list of patterns to check against the whole packet. > and who I would expect to incorporate best practices Don't bet on it. They will when it makes a big difference to them. But for many of these types of attack you'll see purely reactive reactions because it's often far cheaper (for them) vs. the costs of routing hardware etc. that can do enough processing per packet to be viable.

jlgaddis 13y ago

I don't work for a Tier 1 ISP but I do work for an ISP. As a customer, I don't want my ISP screwing with my traffic. As a provider, I don't want any customers complaining because we screw with their traffic. To block monlist and only monlist queries, we'd have to be looking into the layer 7 payload of IP traffic. I'd rather not do that. The brute-force method would be to block traffic to/from 123/UDP but that's gonna mess up a lot of stuff (including my own).

unethical_ban 13y ago

Many people have said it and I'll emphasize: To the extent possible, ISPs should not be doing layer 7/deep packet inspection. They carry traffic. They shouldn't filter. Not only is it unethical, but it's impractical for providers.

noselasd 13y ago

Stepping in and helping mitigate DDOS attacks such as this, by e.g. having the Tier-1s dropping traffic destined to the victim at their edges might be ok. However, Tier 1 providers should not in any way police the internet.