Subject: first widely published relay as a dos issue

From: Randy Bush <[email-masked]>
Date: Sat, 12 Jul 2003 14:05:02 +0200

From: Alexander Gall <[email-masked]>
To: [email-masked]
Subject: [6bone] DoS attacks through 6to4 anycast relay
Date: Thu, 10 Jul 2003 11:43:42 +0200

We (SWITCH) are running one of the (still few) 6to4 anycast relays.
Normally, traffic rates are very low (last month's average input was a
little over 200kbps) but there were some spikes of several Mbps in the
past week.  On Tuesday and Wednesday, the traffic was enough to
severely disrupt our 7206VXR that serves as relay and terminates some
6bone tunnels as well.

We are currently testing an IOS image with IPv6 netflow support on
that router, so I was able to see what was going on yesterday evening
(17:00 - 18:30 UTC+2).  The number of active flows climbed to almost
3000 (from a normal 100-300).  This was due to short UDP flows with
random source and destination ports from 2002:3ED3:10C:: to
3FFE:8171:61::11 like these

SrcAddress        InpIf    DstAddress       OutIf    Prot SrcPrt DstPrt Packets
2002:3ED3:10C::   Tu2      3FFE:8171:61::11 Gi4/0    0x11 0x203D 0x8032 150
2002:3ED3:10C::   Tu2      3FFE:8171:61::11 Gi4/0    0x11 0x043D 0x9432 180
2002:3ED3:10C::   Tu2      3FFE:8171:61::11 Gi4/0    0x11 0xAA89 0x8A8E 60
2002:3ED3:10C::   Tu2      3FFE:8171:61::11 Gi4/0    0x11 0xCE89 0xDE8E 160
2002:3ED3:10C::   Tu2      3FFE:8171:61::11 Gi4/0    0x11 0xF289 0x328E 160

Netflow made this easy to spot but the large number of flows is
probably also the main reason why the router performed very badly
during the event :-(

Traffic peaked at 18Mbps before I blocked packets from 62.211.1.12 to
192.88.99.1 at the upstream router.

The source points to

inetnum:      62.211.1.0 - 62.211.1.255
netname:      TIN
descr:        Telecom Italia S.p.A
descr:        [email-masked] ADSL service OSPF Area 1
descr:        Wholesale service for ISP
country:      IT
admin-c:      BS104-RIPE
tech-c:       BS104-RIPE
status:       ASSIGNED PA
remarks:      Please send abuse notification to [email-masked]
notify:       [email-masked]
mnt-by:       TIWS-MNT
changed:      [email-masked] 20020801
source:       RIPE

but that may well be spoofed.

The destination resloves to an interesting name (with only a AAAA RR):
rootk.it :-)

I take this as a good sign that IPv6 is finally catching on ;-)

--
Alex
SWITCH-NOC

---

From: "Christian Huitema" <[email-masked]>
Date: Sat, 12 Jul 2003 08:49:12 -0700

> But still, I think there's something to learn from this case.  For
> example:

Absolutely!

> - even relatively low traffic counts can harm at least some of the
> deployed base
 
Yes, that looks like a real problem. It may be due to the relative newness of some of the implementations.  Maybe we need to have published benchmarks... 

> - (not mentioned here, but an issue in some other scenarios) IPv6 traffic
> may be free (for some), but IPv4 is not.  So, some operators may be
> hesitant to deploy or at least advertise a 6to4 relay -- this could mean
> they'd get in the harm's way because 6to4 relay would be doing
> encapsulation (esp. if it would be a full fledged relay)
 
Using the anycast address makes your relay harder to target -- the attacker does not know with certainty which relay will be hit! However, it seems that we operators only have a limited control on who can use their relay. Basically, the only real control is whether or not to advertise a route in BGP. Once a relay is advertised to some neighbor AS, there is no real mechanism to prevent re-advertisement. We may want to study some solution.

> -  the fewer 6to4 relays there are, the more probable it is *your* relay
>   gets in the way of a DoS attack.. :-/

We certainly need to deploy many more relays! 
-- Christian Huitema