Subject: RSVP packets from invalid address

From: Petri Helenius <[email-masked]>
Date: Sat, 31 Aug 1996 17:31:15 +0300 (EET DST)

Somebody is sending RSVP packets into the MBone with bogus IP source
addresses:
Aug 31 17:26:19.719: %SEC-6-IPACCESSLOGNP: list 122 denied 46 172.25.2.73 -> 239.27.1.58, 2 packets
Aug 31 17:27:19.732: %SEC-6-IPACCESSLOGNP: list 122 denied 46 172.25.2.73 -> 239.27.1.56, 2 packets

  Mtrace leads into somewhere in BT.

  In my opinion, it would be a good practise to filter DVMRP routes
from private-use-only networks. (which would then drop the traffic)

Pete

---

From: dave pratt <[email-masked]>
Date: Mon, 2 Sep 1996 14:25:42 +0100 (BST)

Petri, et al

I've changed the access list on our boundary to cover all 239.x.x.x groups,
where as previously it was stopping only 239.255.x.x groups. This should
prevent this leakage. Hopefully it wasn't too damaging. 

We will also look into why these were being sent with a global ttl.

Cheers
Dave P

ps Has it been decided yet which of these is the correct administrative
scoping ?
--------
WWW - doesn't that stand for "Wait a Week Word" ?
BEER - so much more than just a breakfast drink.
Dave Pratt      (tel: +44 1473 643840 )   
[email-masked]

On Sat, 31 Aug 1996, Petri Helenius wrote:
->
->  Somebody is sending RSVP packets into the MBone with bogus IP source
->addresses:
->Aug 31 17:26:19.719: %SEC-6-IPACCESSLOGNP: list 122 denied 46 172.25.2.73 -> 239.27.1.58, 2 packets
->Aug 31 17:27:19.732: %SEC-6-IPACCESSLOGNP: list 122 denied 46 172.25.2.73 -> 239.27.1.56, 2 packets
->
->  Mtrace leads into somewhere in BT.
->
->
->  In my opinion, it would be a good practise to filter DVMRP routes
->from private-use-only networks. (which would then drop the traffic)
->
->Pete
->

---

From: Petri Helenius <[email-masked]>
Date: Mon, 2 Sep 1996 19:03:40 +0300 (EET DST)

> We will also look into why these were being sent with a global ttl.
Sorry if my message was badly formed, but I just wanted to point out a
problem before it goes into
'Ciscos blow the MBone, Chapter III - The RSVP Incident' 1/2 :-)

Pete

---

From: Toerless Eckert <[email-masked]>
Date: Mon, 2 Sep 1996 18:30:24 +0200 (MET DST)

> 'Ciscos blow the MBone, Chapter III - The RSVP Incident' 1/2 :-)

They've still a long way to go if they want to become as
famous as sendmail's security holes...

Toerless

---

From: Petri Helenius <[email-masked]>
Date: Mon, 2 Sep 1996 19:57:01 +0300 (EET DST)

> famous as sendmail's security holes...
I think the fun stuff will just begin when we start talking about
reservation accounting and billing. Then patch in all security
concerned and you'll have fun.

So my guess is, they'll have their chances alright :-)

Pete

---

From: Toerless Eckert <[email-masked]>
Date: Mon, 2 Sep 1996 19:04:35 +0200 (MET DST)

> So my guess is, they'll have their chances alright :-)

I guess publishing current security protocols from banks on
accounting and billing would be much more fun because it would
concern so many peoplem, and those systems are very buggy.

Toerless

---

From: Petri Helenius <[email-masked]>
Date: Mon, 2 Sep 1996 20:09:40 +0300 (EET DST)

> concern so many peoplem, and those systems are very buggy.
I guess this is going well off the supposed topic here but I couldn't
resist :-/

The problem with fooling with banks is that they have damn good
auditing (required by law) that you cannot fool them and leave no
trace behind. Practically every executed transaction is logged ON
PAPER.

And around here they use strong cryptography-based authentication
schemes also so spoofing is also quite hard.

Pete