GroupStudy.com GroupStudy.com - A virtual community of network engineers
 Home  BookStore  StudyNotes  Links  Archives  StudyRooms  HelpWanted  Discounts  Login
RE: ICMP Flooding vs SMURF Attack---THE BRIANS AND SCOTT posted 08/23/2006
[Chronological Index] [Thread Index] [Top] [Date Prev][Date Next] [Thread Prev][Thread Next]


True, but wouldn't you want to prevent that from happening on the way in?
:)

But yes, you could look at ACLs both directions.  Certainly no harm in that.
It may also be worth asking the proctor about.  While over-configuration
isn't penalized, there's no point in wasting unnecessary time either!

 
Scott Morris, CCIE4 (R&S/ISP-Dial/Security/Service Provider) #4713, JNCIE
#153, CISSP, et al.
CCSI/JNCI-M/JNCI-J
IPExpert VP - Curriculum Development
IPExpert Sr. Technical Instructor
smorris@xxxxxxxxxxxx
http://www.ipexpert.com
 
 

-----Original Message-----
From: David Mitchell [mailto:david.mitchell@xxxxxxxxxxxxxxxxxxxx] 
Sent: Wednesday, August 23, 2006 1:32 PM
To: Scott Morris; Aamir Aziz
Cc: Chris Broadway; Peter Plak; Victor Cappuccio; Dusty; David Redfern (AU);
ccielab@xxxxxxxxxxxxxx
Subject: RE: ICMP Flooding vs SMURF Attack---THE BRIANS AND SCOTT

If my understanding of Smurf attacks is correct, your strategy would succeed
in stopping you from being the REFLECTOR, but not the VICTIM.

If you are the VICTIM of a Smurf attack, the packets you will be seeing will
be unicast icmp echo-reply packets sourced from the REFLECTOR to your
address.  This would be because the attacker spoofed your address range and
sent the icmp echo-requests to the reflector's broadcast address, resulting
in the reflector responding with the echo-reply's to your addresses.

If my understanding is correct, you would need to filter out icmp echo-reply
packets on the edge to stop this.

Hopefully I understand this properly.  So far I'm a two-time Security lab
failure!!

- Dave
         	

-----Original Message-----
From: nobody@xxxxxxxxxxxxxx [mailto:nobody@xxxxxxxxxxxxxx] On Behalf Of
Scott Morris
Sent: Wednesday, August 23, 2006 12:17 PM
To: 'Aamir Aziz'
Cc: 'Chris Broadway'; 'Peter Plak'; 'Victor Cappuccio'; 'Dusty'; 'David
Redfern (AU)'; ccielab@xxxxxxxxxxxxxx
Subject: RE: ICMP Flooding vs SMURF Attack---THE BRIANS AND SCOTT

If you are looking to stop an attack TO a router, I'd use:
 
no ip directed-broadcast  (on each interface) no service udp-small-servers
(which will shut down those udp ports)
 
I believe both may be defaults now (Cisco is occasionally nice).
 
If you have to filter on an edge, which makes more sense, I believe both
Brian and I have offered multiple methods of accomplishing this.  One is not
necessarily better than another.  Below, I lay out the port numbers for you,
so build an ACL matching each of those in udp as well as ICMP echo coming
in.
 
Building the ACL shouldn't be a difficult exercise as you know the
information below.  In the middle of your exam (IMHO) you won't be required
to memorize the multiple ports that a Fraggle attack may go after unless it
is mentioned someplace on the DocCD.   So build away!  Come up with one
and
let's see what you got!
 
 
Scott Morris, CCIE4 (R&S/ISP-Dial/Security/Service Provider) #4713, JNCIE
#153, CISSP, et al.
CCSI/JNCI-M/JNCI-J
IPExpert VP - Curriculum Development
IPExpert Sr. Technical Instructor
smorris@xxxxxxxxxxxx
http://www.ipexpert.com
 

  _____  

From: Aamir Aziz [mailto:aamiraz77@xxxxxxxxx]
Sent: Wednesday, August 23, 2006 10:09 AM
To: swm@xxxxxxxxxx
Cc: Chris Broadway; Peter Plak; Victor Cappuccio; Dusty; David Redfern (AU);
ccielab@xxxxxxxxxxxxxx
Subject: Re: ICMP Flooding vs SMURF Attack---THE BRIANS AND SCOTT


Dear Mr.Brian & Mr.Scott,
 
Thank you for the valuable input, i think it was really helpfull but
lets
say in the exam if they clearly mention that it is a SMURF/Fraggle
attack
and we need to stop it using ACL then in your expert opinion what ACL
should
we use on the router? 
 
Thanks
Aamir

 
On 8/22/06, Scott Morris <swm@xxxxxxxxxx> wrote: 

Well, look at the two attacks and what they are first.

Smurf is an ICMP-based attack.  Typically the echo-request packets are
sent 
TO the subnet-broadcast address.  This is simply stopped (and by
default)
with "no ip directed-broadcast" on a LAN.  Or you can filter on an edge
router closer to the Internet link using an extended ACL. 

Being that most Smurf attacks are also from spoofed addresses, "ip
verify
unicast reverse-path" or "ip verify unicast source reachable via any"
could
help. (<--RFC 2267) You could also rate-limit the information, but this 
isn't the best solution!

Fraggle is the same type of attack, except that it involves UDP packets
instead of ICMP ones.  Typically it's directed at common unix-based echo
ports (7, 13, 17, 19).  So the same methods will protect you. 

For TCP SYN attacks, that usually involves a bunch of embryonic
(half-open)
connections going on.  Short of your router(s) monitoring the number of
initial TCP open requests that come in, there's not many good ways to do

this!  Firewalls (including CBAC) are certainly the best ways, but not
on
the R&S exam!!!

You may have TCP Intercept on your exam covered by some of the more
generic
security features listed on the Blueprint!  Look in the same security 
command reference where the RPF information is at, and you'll see "ip
tcp
intercept" for some information on that.

While you could rate-limit with an acl matching "tcp any any syn".  Like

many things which thing you choose as your solution may depend on
requirements of the lab!

Just my thoughts...


Scott Morris, CCIE4 (R&S/ISP-Dial/Security/Service Provider) #4713,
JNCIE
#153, CISSP, et al. 
CCSI/JNCI-M/JNCI-J
IPExpert VP - Curriculum Development
IPExpert Sr. Technical Instructor
smorris@xxxxxxxxxxxx
http://www.ipexpert.com  <http://www.ipexpert.com> 



-----Original Message-----
From: nobody@xxxxxxxxxxxxxx [mailto:nobody@xxxxxxxxxxxxxx] On Behalf Of
Chris Broadway 
Sent: Tuesday, August 22, 2006 11:21 AM
To: Peter Plak
Cc: Victor Cappuccio; Dusty; David Redfern (AU); Aamir Aziz;
ccielab@xxxxxxxxxxxxxx
Subject: Re: ICMP Flooding vs SMURF Attack---THE BRIANS AND SCOTT 

Group,

Can we get the "Brians" and/or Scott to give us their opinion on the
definitive ACL to log smurf, fraggle, and TCP syn attacks?  I think
everyone
has an opinion but have not heard from the ones I consider to be the
most 
trusted sources.

-Broadway

_______________________________________________________________________
Subscription information may be found at:
http://www.groupstudy.com/list/CCIELab.html
<http://www.groupstudy.com/list/CCIELab.html> 

_______________________________________________________________________
Subscription information may be found at: 
http://www.groupstudy.com/list/CCIELab.html