On Mar 8, 2014 11:13 AM, "Stephen Wilcox" <steve.wilcox@ixreach.com> wrote:
Its not UDP's fault, its the amplifying effects of an open NTP server
thats the issue, and NTP servers are in all kinds of places and having a secure config not an end user easy experience. Even things like JunOS run ntp as open by default.
UDP is great for what its designed for, connectionless data exchanges...
and TCP SYN attacks can be pretty big, and back in the old days ICMP smurf attacks were all the rage. Its also just a matter of time before someone discovers theres a common IPv6 based hack and enough v6 nodes in the world to do some damage.
I'm also not convinced BCP38 will make the issue go away, it only takes a
small number of ISPs to either not be implementing it or accidentally stop filtering and modern server and home broadband connection speeds are fast enough that a handful of bots can generate very large amounts of traffic. I think ISPs and upstreams need to be more proactive in identifying open NTP servers in their customers networks.
If its not ntp today its chargen and dns tomorrow and snmp the day after that. http://www.internetsociety.org/doc/amplification-hell-revisiting-network-pro...
Steve
On 8 March 2014 22:48, Terrence <terrence.oconnor@gmail.com> wrote:
In short, yes.. Now to get the ISPs to implement it. I am still not a
fan of UDP.
- Terrence Sent from my iPhone please excuse any errors.
On Mar 8, 2014, at 12:52 PM, "Alain Hebert" <ahebert@pubnix.net> wrote:
Do I really have to go there again?
all week long I'm seeing ntp attacks on provider ips on my router. Enough of this bs, it's time to stand up and block this BS.... _______________________________________________ Outages mailing list Outages@outages.org https://puck.nether.net/mailman/listinfo/outages
_______________________________________________ Outages mailing list Outages@outages.org https://puck.nether.net/mailman/listinfo/outages
_______________________________________________ Outages mailing list Outages@outages.org https://puck.nether.net/mailman/listinfo/outages
_______________________________________________ Outages mailing list Outages@outages.org https://puck.nether.net/mailman/listinfo/outages