18 May
2017
18 May
'17
4:06 a.m.
I suspected at some point that there is a network
using 44 addresses
internally, had some leaks on them and that the garbage (DNS replies,
ICM rejects, IP fragments and such stuff) were the replies from hosts on
the internet receiving that traffic and sending replies back via the
ampr-gw.
I think that is not a legitimate use but an attack group that spoofs sender
addresses when sending their attacks and they use net-44 addresses as well.
To have that go down, more ISPs should implement BCP38 (source address filtering).
Unfortunately, there is little incentive for ISPs to do that, because it benefits
only others and not themselves.
Rob
18 May
18 May
4:22 a.m.
New subject: AMPRNet outage?
I still don't see how this is working, unless all routers on the way
implement connection tracking (which is certainly not the case).
So, they send out a spoofed package using a 44 address as origin and then
what? The reply will never get back to them. Instead it will be routed to
the proper real 44 endpoint, either directly for BGP-ed subnets, or via
44.0.0.1, to no end result.
That is why I rather suspect some network using internal 44 addresses as
"private" IPs, overlap our net and sometimes leak out via a non
source-filtered ISP.
I think that is not a legitimate use but an attack
group that spoofs
sender
addresses when sending their attacks and they use net-44 addresses as
well.
To have that go down, more ISPs should implement BCP38 (source address
filtering).
7:51 a.m.
New subject: AMPRNet outage?
On Thu, May 18, 2017 at 11:22:13AM +0300, marius(a)yo2loj.ro wrote:
I still don't see how this is working, unless all
routers on the way
implement connection tracking (which is certainly not the case).
So, they send out a spoofed package using a 44 address as origin and then
what? The reply will never get back to them. Instead it will be routed to
the proper real 44 endpoint, either directly for BGP-ed subnets, or via
44.0.0.1, to no end result.
One-way traffic appears to be used in DDoS attacks, where unanswered
traffic is not a hindrence - huge pings, TCP-opens, massive DNS queries,
router congestion, all of which use up resources on the victim computers
even though there is no expectation of a response.
Modern operating systems are much less vulnerable to such attacks, but they
still can affect a large number of the systems on the internet.
- Brian
4:40 a.m.
New subject: AMPRNet outage?
I suspected at
some point that there is a network using 44 addresses
internally, had some leaks on them and that the garbage (DNS replies,
ICM rejects, IP fragments and such stuff) were the replies from hosts on
the internet receiving that traffic and sending replies back via the
ampr-gw.
I think that is not a legitimate use but an attack group that spoofs sender
addresses when sending their attacks and they use net-44 addresses as well.
To have that go down, more ISPs should implement BCP38 (source address filtering).
Unfortunately, there is little incentive for ISPs to do that, because it benefits
only others and not themselves.
7:45 a.m.
New subject: AMPRNet outage?
On Thu, May 18, 2017 at 10:06:46AM +0200, Rob Janssen wrote:
I think that is not a legitimate use but an attack
group that spoofs sender
addresses when sending their attacks and they use net-44 addresses as well.
To have that go down, more ISPs should implement BCP38 (source address filtering).
Yes, that is what it is almost certainly. For more information, go to
www.caida.org and search for 'telescope'.
- Brian
2745
days inactive
2745
days old
5 comments
4 participants
participants (4)
-
Brian Kantor -
marius＠yo2loj.ro -
Rob Janssen -
Thomas Osterried