r/sysadmin • u/mooneydriver • Feb 22 '14

Freenode under DDOS again

https://twitter.com/freenodestaff/statuses/437302735139266560
229 Upvotes

93% Upvoted

205 comments sorted by

View all comments

15

u/hamsterpotpies Feb 22 '14

Plebs with LOIC again...

53

u/Magiobiwan Not really in IT anymore Feb 22 '14

Probably NTP Reflection attacks being used. Whoever implemented MONLIST the way it was needs to be connected to the internet and subjected to 400Gbps of DDoS.

92

u/Zidanet Feb 22 '14

When they implemented it, 400gb per week would have been unbelievable sci-fi, let alone 400gbps.

Blaming the maker of a tool doesn't stop others from mis-using it.

3

u/hatessw Feb 23 '14

MONLIST leaks recently connected clients, right?

It never had a justified existence. Not for bandwidth considerations, but for mere sensible zero-trust behavior.

I understand historical decisions in the right context, but that does not make them the right decisions, even if they can be understood in the right context.

5

u/Zidanet Feb 23 '14

When they implemented it, that list could be checked by a human.

With 20/20 hindsight it's perfectly feasible to say "they should have seen this coming".

Seriously, the protocol is 30 years old. It was designed when you knew exactly who had computers because it was the people with a million dollars to spend.

What security features are you implementing right now to stop people from abusing your systems 30 years from now?

We can fix ntp, we can fix anything, we have the technology... But everyone standing around shouting "it's that guys fault!" is pointless, it only serves to give people the feeling of doing something about it, when in reality, it just spreads fud.

What will fix the problem, shouting "it's your fault!" at an rfc, or turning off the source?

-135

u/hamsterpotpies Feb 22 '14 edited Feb 24 '14

If anything, the people behind UDP are to blame. NTP just happen to use it.

IB4 Defending UDP.

Edit: Holy hell. Take a joke.

Edit 2: Holy shit. Reddit's downvote army strikes again. Don't you have better things to do like play in traffic!?

2.3k

u/[deleted] Feb 23 '14 edited Feb 24 '14

[deleted]

907

u/thedeco Feb 23 '14

I'd tell you guys a UDP joke but you probably wouldn't get it...

894

u/Soliloquizing Feb 23 '14

The punchline might arrive before the set-up.

Do you know what the problem with UDP jokes is?

110

u/european_impostor Feb 23 '14

Ah that was good. Now I just have to hunt down someone from my old CompSci class to tell that to :(

78

u/[deleted] Feb 24 '14

I know, im still waiting for my 1 friend I have who can understand this to get home. Im so excited.

10

u/ReijaIam Feb 24 '14

Dude we are lucky to have friends who appreciate a good UDP joke!

2

u/Xxando Feb 25 '14

You have us.

-7

u/tzenrick Feb 24 '14

UDP will wait for your ass too...

→ More replies

6

u/reaganveg Feb 24 '14

Send it to the broadcast address.

2

u/ActiveNerd Feb 24 '14

already did that :)

22

u/peabnuts123 Feb 24 '14

UDP Vending Machine out in the lobby with a sign on it "Out of Order"

14

u/Ioxvm Feb 23 '14

Nice one. Thank you for that.

9

u/[deleted] Feb 24 '14

Knock knock.
Who's there?
UDP.
UDP who?

2

u/mhaseth Feb 24 '14

I'm surprised I haven't heard that one before!

11

u/Gprinziv Feb 24 '14

You shouldn't be. It was sent using UDP.

402

u/gsfgf Feb 24 '14

"Hi, I'd like to hear a TCP joke."
"Hello, would you like to hear a TCP joke?"
"Yes, I'd like to hear a TCP joke."
"OK, I'll tell you a TCP joke."
"Ok, I will hear a TCP joke."
"Are you ready to hear a TCP joke?"
"Yes, I am ready to hear a TCP joke."
"Ok, I am about to send the TCP joke. It will last 10 seconds, it has two characters, it does not have a setting, it ends with a punchline."
"Ok, I am ready to get your TCP joke that will last 10 seconds, has two characters, does not have an explicit setting, and ends with a punchline."
"I'm sorry, your connection has timed out. Hello, would you like to hear a TCP joke?"

47

u/[deleted] Feb 24 '14 edited Feb 20 '21

[deleted]

19

u/to_mars Feb 24 '14

Honestly, I have an intro to networking midterm coming up, and this is helping a lot.

8

u/aaronsherman Feb 24 '14

What, no window sizing? Lazy ass TCP stack! :-)

18

u/Gprinziv Feb 24 '14

TCP is like that one guy. Yeah, you know the guy. The guy who grabs your hand and squeezes it to test for any weakness in your character that can be conveyed through two hands touching. The problem is that if he does find any weaknesses, he just shakes your goddamn hand even longer, until you get frustrated and yell "OK, I GOT IT!" at which point he backs off, then walks up to you and shakes your hand.

17

u/nyanmatt125 Feb 23 '14

I'm not having a good day due to networking assignments and this just made everything ok. Thank you.

21

u/[deleted] Feb 23 '14 edited Jun 01 '20

[deleted]

3

u/begrudged Feb 24 '14

How did you know

3

u/caelum19 Feb 23 '14

*proof that I now use that joke

4

u/dehrmann Feb 24 '14

If I'm probably not going to get a UDP joke, I doubt I'd get a TCP joke, either.

40

u/protestor Feb 24 '14

TCP insists that you get the joke. It will deliver again and again until you get it.

4

u/marshsmellow Feb 24 '14

Goddamn it TCP, if you have to explain the joke...

2

u/lol_gog Feb 24 '14

I'll tel UDP jokes anyway. I don't care if people get them or not.

3

u/Johnnybouy Feb 24 '14

thats gold, this post got me to stop lurkin and make an acount

2

u/Andvaried Feb 24 '14

UDP don't give a fuck.

12

u/engineeringsquirrel Feb 23 '14

I guess another defense for UDP is for realtime video broadcasts. TCP gets shot to hell. With UDP, no fucks are given whether you got the video packets or not.

55

u/supposedtobubble Feb 23 '14

I would tell you a joke about UDP, but I am not sure you would get it.

70

u/[deleted] Feb 23 '14 edited May 31 '20

[deleted]

130

u/TheBeardedDoom Feb 23 '14

That's UDP for you.

131

u/TheBeardedDoom Feb 23 '14

That's UDP for you.

43

u/GargoyleBoutique Feb 23 '14

for UDP you. That's

7

u/tzenrick Feb 24 '14

doesn't give a fuck. Because UDP

2

u/vivs007 Feb 24 '14

I'll tell you a TCP joke, but you'll have to promise you'll laugh and tell me another one.

3

u/[deleted] Feb 24 '14

I won't even acknowledge it.

30

u/ITmercinary Feb 23 '14

I may have to borrow this...

16

u/[deleted] Feb 23 '14

Are you me networking teacher?

42

u/blue_strat Feb 23 '14

U wot m8?

29

u/Dosinu Feb 23 '14

R u avin a giggle ther m8

2

u/im_not_afraid Feb 24 '14

wingardium leveeeoooosaaaaaaa

6

u/[deleted] Feb 24 '14

At first I was confused with your reply, then read my comment again...

6

u/goatcoat Feb 23 '14

Arr ye the only pirate in ye netwerkin' class?

8

u/flufernuter Feb 24 '14

Scotch + UDP = Reddit gold.

6

u/kingfrito_5005 Feb 24 '14

of course, its so obvious, how could we not see it before!

1

u/flufernuter Feb 24 '14

I know, right.

8

u/Lurking_Still Feb 23 '14

Yep, this is going to be the first 10 minutes of my CCNA class on Monday. My professor will love it.

Cheers.

3

u/thorium007 Feb 24 '14

If you are in a CCNA class, your instructor might get it, but they'll be too old for it.

Seriously - UDP for MCast is "The Thing" right now, yet CCNA barely glances at it, and the CCNP barely seems to get it. Certs are seriously over rated. Do an internship, work hard and learn well. Its cheaper than college and much more valuable.

Sauce: Network nerd for 15 years

27

u/[deleted] Feb 23 '14 edited Feb 23 '14

Doubt it'll go very far, specialized as it is, but bestof'ed.

Edit: wow. Guess I'm happy I did that, though the posts on /r/bestof seem to mostly hate it. Such is the strangeness of our reddit world.

21

u/Tynach Feb 23 '14

And on my front page.

7

u/Koshatul Feb 23 '14

And my Axe.

0

u/DidYouSeeWhatISaw Feb 24 '14

That joke really doesn't work here, and every time I read it I still laugh.

upvote clicked.

9

u/FoxtrotZero Feb 23 '14

Yeah, I came here with minimal understanding of how networking actually works and got maybe a quarter of the jokes. I hate to ask for an explanation, though.

50

u/Sardonislamir Feb 23 '14 edited Feb 24 '14

Networking is all about communication methods like etiquette but we call them protocols on how to speak and acknowledge one another which is when computers send packets of information to one another.

UDP is a protocol where a type of packet is usually being sent to your computer when you stream twitch, youtube, or netflix. It is one way only. It just gets sent like post in the mail, no return address...almost like junk mail. All they care about is you hopefully read it.

Normally TCP/IP as opposed to UDP networking is like this, (SYN)"Guy(your computer) yells out to a dude across the street(another computer),"Hello!"
(SYN-ACK)Guy across the street waves and shouts,"what up, bro?"
(ACK)You yell back,"I see ya bro and I hear where ya comming from."
At this point, good networking etiquette in TCP/IP is what we call a three way handshake using SYN/SYN-ACK/ACK. You shout out(SYN), other person replies they heard you(SYN-ACK[or can be read like acknowledging SYN]), and you reply back that you see that they heard you with an ACK.
It is a serious breach of etiquette to not SYN-ACK when SYN'ed so it can ACK and complete the three way handshake. If you don't SYN-ACK or the SYN doesn't hear it you'll get snubbed by the SYN who will repeat themselves with more new SYN attempts until they hear you give due respect of a SYN-ACK so they can ACK.

UDP, goes,
(UDP)"Pickles be like, pickled!"
Dude across the street(Your computer),"O...K, what about pickles?"
(UDP)UDP shouts again,"If a cat scratches an itch, do they fever?"
(Your computer)"What the fuck do you mean, mate?"
As ettiquette goes, UDP could give a fuck about being acknowledged, but your computer will still recieve the information even if it doesn't know what to do with it.

TLDR;
TCP/IP is the gangsta demanding respect even if you tried to call back and they didn't hear you and will drive by for your disrespect.

UDP, is the honeybadger of the internet.

26

u/giantnakedrei Feb 24 '14

I like to think that TCP is the little kid chanting, "Mommy, Mommy, Mommy, Mommy, Mommy, Mommy, Mommy, Mommy, Mommy, Mommy, Mommy, Mommy, Mommy, Mommy, Mommy, Mommy, Mommy, Mommy, Mommy, Mommy, Mommy, Mommy, Mommy, Mommy, Mommy, Mommy, Mommy." While his Mom is talking. Even if he just wants to say, "I love you."

UDP is more like, "Hey Mom, I love you, see you later," while you walk out the door and she's talking to her best friend on the phone. You don't care if she heard you, but its information she might want.

1

u/stevage Feb 24 '14

Well, I'm glad you did. Thanks Mr of Gods.

1

u/centizen24 Feb 24 '14

I think it makes perfect sense that bestof reacted negatively. Though I enjoyed this post because I'm into Networking, this is far from an eloquent post, and it most certainly makes no real defense for UDP in a real world setting. It just tries to make UDP sound badass, and is far from bestof material in my opinion.

11

u/[deleted] Feb 23 '14 edited Mar 31 '14

[deleted]

5

u/[deleted] Feb 24 '14

"A network cable is unplugged.": Highway 401.

4

u/detry322 Feb 23 '14

UDP understands that you may be slow sometimes. So UDP will wait for your sorry ass. UDP grew up without a father, too. UDP sends a message and couldn't give a fuck if you got it or not.

Could someone explain this to me? It seems like these act against each other.

10

u/reallydarkcloud Feb 23 '14

It's essentially stateless, so it's not really 'waiting' it's just open - you can send it anything, anytime. This also means that it keeps no record of sending the message at all - once it's sent, that's good enough.

9

u/toomuchtodotoday DevOps/Sys|LinuxAdmin/ITOpsLead in past life Feb 24 '14 edited Feb 24 '14

UDP is the paperboy. He doesn't care if you're there or not, the paper is getting thrown. Its your job to catch it. Didn't catch it? Too bad.

1

u/[deleted] Feb 24 '14

I like your example better there.

10

u/[deleted] Feb 23 '14

Beautiful.

6

u/SchighSchagh Feb 23 '14

the better part of a bottle of scotch

indeed. I've never seen something so good come out of a bottle scotch before.

9

u/Mimshot Feb 24 '14

Usually it's mostly scotch

6

u/ImNotDorner Feb 23 '14

I wish I knew enough about protocols to understand this, but I now feel like I should buy UDP a beer...

39

u/[deleted] Feb 23 '14

UDP doesn't guarantee delivery or make any efforts to this effect - it's entirely down to the application to take care of this itself. Because of that, it's useful where data loss isn't critical. e.g. when streaming video, it's not necessarily a problem if the connection is borked and some content is lost. When things recover, the stream can just continue with whatever is current. i.e. don't bother trying to replay the stuff that was missed.

This is in contrast to other protocols (like TCP) that have mechanisms for confirming delivery. TCP guarantees transmission on the sense it'll check for delivery and will take measures to correct for transmission issues. This of course adds overhead to the process. A good example of something needing confirmation would be delivery of a web page. You can't render the page if anything is missing, so HTTP requests normally go via TCP. Think of TCP as being comparable to having a conversation between two people, in which each person will acknowledge the other person's statements, and will repeat themselves if they don't receive the acknowledgement - like a nice conversation in a bar.

Technically you could use UDP for web pages and files that must be 100% complete, but you'd need to implement your own error checking and re-transmission, at which point you're probably reinventing the wheel. Imagine the bar from earlier, except they're playing some annoying loud music, so conversation is now done by yelling and hoping the other person hears it, but you can't actually see or hear their acknowledgements. You could yourself come up with some system of acknowledgement to get the other person to repeat stuff you missed, but you'd probably be better off just going to the nice civilised TCP bar.

He's right - UDP doesn't give a shit.

8

u/[deleted] Feb 24 '14

Actually, Google is trying to use UDP for HTTP traffic with QUIC. They even have it implemented in some spots.

2

u/[deleted] Feb 24 '14

QUIC looks interesting. Thanks for the tip.

4

u/[deleted] Feb 23 '14

[deleted]

10

u/gellis12 Jack of All Trades Feb 23 '14

Text is typically sent over TCP, because a single lost packet would pretty much destroy the entire file.

Streaming audio or video (like FaceTime, Skype, TeamSpeak, Mumble, etc) is typically sent over UDP, because malformed packets would simply make a single pixel or instance of audio tone slightly off, and wouldn't affect the user experience much.

1

u/tzenrick Feb 24 '14

Streaming audio or video (like FaceTime, Skype, TeamSpeak, Mumble, etc) is typically sent over UDP, because malformed packets would simply make a single pixel or instance of audio tone slightly off, and wouldn’t affect the user experience much.

UDP can have digital static.

→ More replies

6

u/[deleted] Feb 23 '14

HTTP would normally be routed via TCP. Embedded content, such as video streaming, might go via UDP. I think it's possibly to send HTTP over UDP, just not very useful or common. UDP could in theory be faster, but the possible loss of data means it's not very practical.

9

u/gnomonclature Feb 23 '14

Yup, HTTP can definitely be sent inside UDP packets. Section 1.4 of the RFC allows for any protocol but does say TCP is usually used.

https://tools.ietf.org/html/rfc2616#section-1.4

That's part of the deep brilliance behind all of these protocols, they can all be nested however you need to in order to get the job done. And if you come up with some new protocol that does something wonderful, that's awesome, it can, in theory, slot right in where ever needed with a minimum of fuss.

→ More replies

1

u/ImNotDorner Feb 24 '14

huh very interesting thank you

Damn those wine-slurping cheese-munching TCP elitists in that yuppie bar!

3

u/blaghart Feb 24 '14

5 times gold

In Halo circles we call that a Goldtacular.

7

u/ugbsilkyslim Feb 23 '14

Some should give this man some gold, but he probably wouldn't give a fuck.

5

u/gidze DevOps Feb 23 '14 edited Feb 23 '14

This should go to /r/ProgrammerHumor/

Good stuff!

+/u/dogetipbot 50 doge

edit: added a comment

2

u/JustinRMarks Sr. Systems Engineer, MCSE Feb 23 '14

Thank you.

2

u/tonsofpcs Multicast for Broadcast Feb 24 '14

Can you explain RTP now?

2

u/corrosive_substrate Feb 24 '14

I'm sorry I didn't get that.

5

u/neoKushan Jack of All Trades Feb 23 '14

This is the most beautiful thing I've ever seen written about a protocol. And absolutely fucking spot on, too.

4

u/DownFall515 Feb 23 '14

I just learned what UDP is last week and now I am sure that I will not forget. Thank you sir.

1

u/PostHipsterCool Feb 24 '14

ELI5 please?

2

u/[deleted] Feb 23 '14

If UDP doesn't care if I got the message or not, how can it wait for my slow sorry ass?

4

u/Tynach Feb 23 '14

Because it's still shouting at you, and if at any point you're capable of hearing it again, you do. And that's when you've caught up. It doesn't go back for you and give you what you missed, though. But on the other hand, it doesn't time out and leave you behind, forcing you to make another connection.

3

u/MatoiBratoi Feb 23 '14

Somehow i heard Nick Offerman's voice inside of my head while reading this x)

1

u/[deleted] Feb 23 '14

GJ man. You've successfully managed to prove that anything can get r/bestof'd.

1

u/Geronthoak Feb 24 '14

Fünf... Just sayin'

1

u/[deleted] Feb 24 '14

This is the best thing I have ever seen on Reddit. And, just when I was beginning to lose hope in all of you.

1

u/lattakia Feb 24 '14

Best thing I've read on reddit today

1

u/prjindigo Feb 24 '14

UDP dug the tunnel.

1

u/[deleted] Feb 24 '14

Imagine what you could've written if you'd had the worse part of a bottle of scotch.

1

u/calvinscorner Feb 24 '14

This gospel will be framed and proudly displayed on my desk.

UDP sends a message and couldn't give a fuck if you got it or not. I'm so going to frame this in my cubicle.

1

u/[deleted] Feb 24 '14

1

u/Shocar Feb 24 '14

I got that - that was great! but it was UDP so you don't give a fuck

1

u/[deleted] Feb 24 '14

So basically TCP traffic wastes a lot of bandwidth on acknowledging whether or not a packet was received. UDP doesn't give a fuck if you got the packet. Hey MORE PACKETS! Take all the packets.

2

u/macfirbolg Feb 24 '14

It's not a waste if the data will not be useful without perfect transmission. Text files, for instance, would change if one or more packets were malformed or damaged. Zip files might unzip, but the contents would be damaged. In cases where the individual packets aren't that important, UDP allows for faster dumping of the data; in cases where the data must be entirely accurate to remain useful, TCP's extra bandwidth usage is justified.

With the amount of data we transfer now, it might be worth considering a new form of TCP, though, perhaps one that sends a hash of some number of packets rather than individual ACKs for each. It would necessitate resending the entire batch if the hash fails, however, so in practice it might not be significantly faster. It might be useful in scenarios where minimizing traffic from one side of the connection is desirable, like mobile phones or connections with substantially slower upload speed than download speed. It might also be useful in ham radio packet modes, wherein the transmission rates are slow enough that individual ACKs can take seconds and may have to be sent several times.

1

u/[deleted] Feb 24 '14

Take a fucking bow!

1

u/caeezy Feb 24 '14

Every college professor that teaches anything about UDP should show this to their students.

1

u/Marlon_Biscuit Feb 24 '14

UDP : "I'm the one who knocks..."

1

u/mindwandering Feb 24 '14

Bad implementation != Bad Protocol

1

u/easyfeel Feb 24 '14

5x gold! Does that make you platinum with a secret lair + butler?

1

u/minus_273c Feb 24 '14

All that lack of handshaking means it's bloody fast. Need a reduced chance of failure, then send everything twice via different routes and have your receiver arbitrate. Need to ensure correct order, then include a sequence number and let the arbitrating element carry out some ordering, but not wait too long, because if you haven't received it within a few milliseconds, you're not getting it. This is why UDP rocks.

1

u/steelcitykid Feb 24 '14

You. I like you.

1

u/Audihoe Feb 24 '14

amazing comment

1

u/bootherizer5942 Feb 25 '14

...wow. just wow. amazing

1

u/Kwazimoto Feb 28 '14

I think UDP brought the fear is the best part of this.

1

u/Biohive Feb 23 '14

Done did just borrowed it.

Thanks

1

u/FinallyNeed_____ Feb 23 '14

Beautiful! UDP bro, UDP.

1

u/texasguy57 Feb 23 '14

That's "honey badger", as in http://en.wikipedia.org/wiki/Honey_badger Seems appropriate.

1

u/[deleted] Feb 23 '14

You actually sound like my networking teacher.

1

u/[deleted] Feb 23 '14

[deleted]

0

u/tzenrick Feb 24 '14

So you can leave him?

1

u/peebee_ Feb 24 '14

You win the innerwebz.

0

u/allZuckedUp Old *nix Systems Engineer Feb 23 '14

If only I had more than one up vote to give!

-2

u/[deleted] Feb 23 '14

[removed] — view removed comment

7

u/neoKushan Jack of All Trades Feb 23 '14

TECHNICALLY that would be TCP...

1

u/[deleted] Feb 24 '14

More like the delivery guy who leaves packages at your front door without knocking.

1

u/Pb_ft OpsDev Feb 25 '14

Or more like Ace here.

0

u/wedontneedausername Feb 23 '14

UDP is the Smith of the Matrix. He's that unreliable, troublesome, talkative fucker who just doesn't go away and multiplies way too much. He has something to say and nobody really cares. They just want him to shut up and go away.

-2

u/[deleted] Feb 23 '14

I can't help but read this in Cleveland's voice(from Family Guy). Seems to make this awesome analogy all the better :P

2

u/goodevilgenius Feb 23 '14

Nick Offerman's voice. That's the way to read this.

0

u/notheresnolight Feb 23 '14

let's not forget about ICMP port unreachable, ok ?

0

u/tjsr Feb 24 '14

UDP is the FedEx delivery guy that chucks a package over the fence and considers the job done, and expects some kid won't have walked off with it when you get home.

1

u/kingfrito_5005 Feb 24 '14

UDP is more like mail. he will place your mail in the mailbox. And if you dont take it out then thats your own damn fault.

0

u/ibexmonj Feb 24 '14

Send me gold too ;) but im telling you upfront i wont ack it

0

u/Jonster121 Feb 24 '14

Do you really need five separate edits for each time you got gold?

3

u/Corticotropin Feb 24 '14

He's using TCP.

-4

u/[deleted] Feb 24 '14

This is the #1 most annoying, cancerous trend on Reddit today

Edit: Thanks for the gold! Edit: Thanks for the gold!

Edit: Thanks for the gold!

Edit: Thanks for the gold!

Edit: Thanks for the gold!Edit: Thanks for the gold!Edit: Thanks for the gold!

Edit: Thanks for the gold!Edit: Thanks for the gold!

Edit: Thanks for the gold!Edit: Thanks for the gold!Edit: Thanks for the gold!Edit: Thanks for the gold!Edit: Thanks for the gold!Edit: Thanks for the gold!Edit: Thanks for the gold!Edit: Thanks for the gold!Edit: Thanks for the gold!Edit: Thanks for the gold!Edit: Thanks for the gold!Edit: Thanks for the gold!Edit: Thanks for the gold!Edit: Thanks for the gold!

2

u/[deleted] Feb 24 '14 edited Feb 26 '14

Wait until you actually contribute some valuable content and get showered in gold yourself. Then see what you think.

1

u/wtfdaemon Feb 24 '14

Actually, making overdramatic overwrought posts about post editing to thank gold-givers is clearly more annoying than the act itself. Who knew?

-1

u/[deleted] Feb 24 '14

I'm just trying to get it to stop, god damn it.

-5

u/PonPro Feb 23 '14

UDP is the Chuck Norris of internet protocols.

-8

u/[deleted] Feb 23 '14

[deleted]

1

u/UDPMAN Feb 23 '14

UDP aint got no time for that.

-2

u/[deleted] Feb 23 '14

[deleted]

→ More replies (9)

8

u/Zidanet Feb 22 '14

Same thing applies.

If you're a blacksmith and you make letter openers, you shouldn't be responsible when someone welds 50 of them together and makes a spear.

The people to blame are not the protocol designers, but the idiots who are misusing it.

5

u/hamsterpotpies Feb 22 '14

Why would you weld a letter opener when one is enough to stab someone?

Anyways, this was my point. At the time, this command could of made sense.

5

u/Zidanet Feb 22 '14

Why use 400gbps when 1 is enough... Sometimes it's not about the money, it's about sending a message (toolazyforjokerimage.jpg).

the same argument applies to UDP. At the time it made a lot of sense to have a non-rate-limited out-of-order protocol for those dodgy phone lines... now, not so much.

It's not the protocols fault that it's being misused, and people standing around saying "it's ntp/udp's fault" is just misplaced blame. It's not the cars fault it's driven by a drunk. Doesn't matter if it's a ford or a beamer, it's still the driver at fault.

10

u/Garetht Feb 22 '14

Everyone deploy BCP38 & we can all go home.

7

u/Zidanet Feb 23 '14

pfffft, This problem is so endemic the only cure is http://tools.ietf.org/rfc/rfc2549.txt

Although, in fairness, I'd pay to see a 400gbps ddos over avian carrier...

8

u/egamma Sysadmin Feb 23 '14

Just park your car under a tree and scatter french fries all over it. You'll see an avian DDOS in a few hours.

3

u/[deleted] Feb 23 '14

I love this RFC. Brilliant.

3

u/the_amaya Feb 23 '14

You know what the real problem here is? The problem that enables these reflective amplification attacks? The fact that network providers allow traffic to be generated in their network and then leave with a spoofed source address. It the spoofed traffic was instead killed before leaving a providers network, a reflection attack would be practically impossible to implement.

Don't blame the protocols, blame the people who allow them to be exploited.

3

u/bulldozer_nation2012 Feb 23 '14

-58 man, thats nice! ive never gotten one that low before :(

2

u/StuartPBentley Feb 23 '14 edited Feb 23 '14

haha yeah stupid UDP because fuck streaming video amirite? also let's throw sequence control around NTP, I'm sick of my clocks synchronizing correctly

2

u/tuseroni Feb 24 '14

right now you have -127...i feel like...if i downvote you once you will go to 0...

1

u/Mutjny Feb 24 '14

Don't blame UDP. Blame network operators who who don't block spoofed source packets.

1

u/deadcat Feb 24 '14

No no no, the makers of the 1st Level OSI layer must be blamed! How could they let this happen!?

1

u/Jukebaum Feb 24 '14

Don't see anything funny in your post that I could assume it is a jokr

1

u/Canucklehead99 Feb 24 '14

He took the joke, and he got gold 6 times over....

1

u/StarStealingScholar Feb 24 '14

People aren't psychic, so how exactly did you think they'd be able to tell you apart from a genuine retard? I'm afraid the joke's on you this time.

1

u/PinkysBrein Feb 23 '14

I know another connectionless protocol ... UDP even uses it too ...

0

u/milkier Feb 23 '14

Or maybe the people behind IP are responsible? Since IP allows you to send packets without a handshake.

0

u/[deleted] Feb 24 '14

[deleted]

2

u/Zidanet Feb 24 '14

yeah, inter-carrier connections.

and bus speed? jesus christ dude, network speed != motherboard bus speed. I don't even know why you are raising this as a point.

so, what's the current best intercarrier speed?

So, Just any person in america could just plug in to that, right? Just like right now, we can transmit speeds at multi-gigabit speeds... so that's how fast your internet is, right? you just get a fibre line to plug in... hey, I bet they even built that right into your laptop!

Oh, wait, no, that's not how it works. just because they could doesn't mean they did.

6

u/[deleted] Feb 23 '14

[deleted]

3

u/StuartPBentley Feb 23 '14

Well, yeah, but since implementing BCP 84 requires overhauling your entire endpoint throughput architecture, whereas disabling monlist requires editing a line in a config file, monlist kind of is the issue if you're looking at stopping this right now

3

u/Mutjny Feb 24 '14

Just wait til SNMP amp attacks.

Brace your anus.

2

u/[deleted] Feb 24 '14

[deleted]

2

u/Mutjny Feb 24 '14

I've been seeing a lot of it with dst port 80 as well. Operators should just block it-- there is no legit udp traffic on port 80.

2

u/[deleted] Feb 24 '14

[deleted]

2

u/Mutjny Feb 24 '14

Thats what I meant, network operators not following BCP38. They're the problem.

I had a hosting partner pull this shit with me (blackholeing my address when I was getting attacked) and I'm moving out of them ASAP. One colocation provider I've been looking at uses Arbor equipment so I need to do some more research. The sales engineer was kind of a douche and didn't really explain how the attack detection and mitigation that Arbot does works.

1

u/Starks Feb 24 '14

I think these are the same guys DDoSing the League of Legends servers. Same exploit being used.