Top Banner
ppp-exp Matsuzaki ‘maz’ Yoshinobu <[email protected]> JANOG43 [email protected] 1
38

Matsuzaki ‘maz’ Yoshinobu  · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

May 29, 2020

Download

Documents

dariahiddleston
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

ppp-exp����������

Matsuzaki ‘maz’ Yoshinobu<[email protected]>

JANOG43 [email protected] 1

Page 2: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

ppp-exp - https://www.attn.jp/ppp/

• 2018=7�)4��IIJJPNIC�!$����• JPNIC�IPv43/�>9BA��6�5-• �%������,C01• RPKI ROA AS0�BA

•,C01����prefix�*�� �" ���+�2����(�'<��

→������&A�����8:• .8�@23?IPv4��#��&A;

JANOG43 [email protected] 2

Page 3: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

������•/�3��)2�-����@A•,;��D��!��$"#���• (C�*?����• .=�:4�+���• � �B<��%�"#�04��A�$"#&������

•�B<��%�"#�>7�����,�' �$"#������=6�����9158����

JANOG43 [email protected] 3

Page 4: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

���������������•,+�(������• "��$!�• ���

•.*�0�����• "��$!�• ip spoofing�1/�'%�.*����

•) ��������� �������&��#�����������-���

JANOG43 [email protected] 4

Page 5: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

��������•�� �������������

���

JANOG43 [email protected] 5

Page 6: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

��������•��������IP��� ����������������

���

���IP��� ppp-expIP���

���

JANOG43 [email protected] 6

Page 7: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

���������• ICMP echo� ���87�51•(+TCP�#���&3�)*��'2TCP!��������87�51• SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc.

• UDP������&3�)*��'2UDP!��������87�51•0��-�•��,.��������"$�%/��� ���56�����4�

JANOG43 [email protected] 7

Page 8: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

������������•83.�%4����������$*�0���� ����/3 �$2�'1���� �59��•+,• ��<=�AB�IP ����A>���

•��$&��� �59• ��"#�%4 ������• )( ����?- ������• @�,7���������• :��6;�!�� ������

JANOG43 [email protected] 8

Page 9: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

��������• NICTERWEB2.0������������������

JANOG43 [email protected] 9

Page 10: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

ppp-exp��������• 2019/01/10 00:00~24:00���• #23"IPv4����� ��#6�� ��• 2758packets/���/!

•�����pcap���������

JANOG43 [email protected] 10

Page 11: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

����TCP����

TCP 95% (577340492) UDP 4% (26945104)ICMP 1% (3897454) IP6 0% (2153)

JANOG43 [email protected] 11

Page 12: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

TCP flag�����SYN

SYN 98% (563062001) SYN-ACK 2% (12229116) OTHER 0% (2049375)

JANOG43 [email protected] 12

Page 13: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

���TCP flag�����• SYN 563062001

• SYN-ACK 12229116

• SYN-ECE-CWR 941603

• RST 555637

• RST-ACK 293503

• ACK 106575

• SYN-ACK-ECE 52175

• SYN-ACK-ECE-CWR 44801

• FIN-SYN-RST-PSH-ACK-URG 21745

• SYN-ACK-CWR 10423

• PSH-ACK 9532

• FIN-PSH-ACK 4434

• SYN-RST 4258

• FIN-ACK 2817

• RST-ECE 502

• RST-ECE-CWR 445

• RST-CWR 433

• SYN-PSH 364

• none 63

• RST-PSH 32

• FIN 17

• PSH 6

• PSH-ACK-URG-CWR 3

• FIN-SYN-RST-ACK-URG-CWR 2

• FIN-RST-PSH-ACK-URG-CWR 1

• SYN-PSH-CWR 1

• CWR 1

• FIN-SYN-RST-PSH-ACK-URG-CWR 1

• RST-PSH-ACK-ECE-CWR 1

JANOG43 [email protected] 13

Page 14: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

����������

TCP-SYN�����• 23 73958566• 52869 34724310• 8545 14738763• 22 13507821• 445 11378107• 80 10794925• 8080 9323605• 4776 7615618• 4784 7602022• 1433 5755354

UDP�����• 389 2445405• 4776 2381843• 4784 2354203• 1900 2287302• 50328 1191988• 50592 1190070• 50336 1188298• 50584 1180976• 11211 1064441• 19 754180

JANOG43 [email protected] 14

Page 15: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

���������������

���IP������ ���

� ���������

����������

JANOG43 [email protected] 15

Page 16: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

������ ����$%. . # % b8 b%, #% #% #,# $ , b1b %%#%#%%#% # .b@5 b LT ZOb%$

$]$$$$.bb $b$$, b Kb $$$b $%%b $ %bIK Mb $,bb6### ;2#$# #####

$]$$%$.bbK $%b$II%b K b% ,b$$ $b b %b %bb######### #K%.

$]$$ $.bb b b b $ b M $b$L b ,bM%L bbK .PK $.U # C ##

$]$$ $.bbL, MbM%% b I MbIL $b , bK MLb b Lbb##### ##]### .PT

$]$$ $.bb Mb M ,b % b , b $ b M $b$L%Mb % bbMU O O $.U ## A

$]$$ $.bbI, Lb%$,,bI$L,bI b I Lb$M $b M b %bb#a#####.DT#$##L%

$]$$ $.bb %b b b Mb $ b b %b bb.W . LZ LLX %.Z

$]$$ $.bb b b % b b b $%b$% %b bb .#4%.[ .: ##%.

$]$$,$.bb % b % bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb%.WL

$%. . # ,%%b8 b%, #% #% #,# $ , b1b %%#%#%%#% # .b@5 b LT ZOb $

$]$$$$.bb $b$$ $b $ b $$$b $%%b L MbIK Mb $,bb6##$ #2#$#T ####

$]$$%$.bbK $%b$II%b K b% ,b$$% bIL%$b %$$b L bb############3#T#

$]$$ $.bb,KL b b$$$$b$$$$b$$$$b$$$$b % b$$$$bb##_ ######## ###

$%. . $# , b8 b%, #% #% #,# , %$b1b %%#%#%%#% # .b7 bD>F b LW%, %% b¥PTb bU ZPUT bDS % , <9 >b[ , bL X $ TU ¥ Lb F b

LT ZOb$

$]$$$$.bb $$b$$ b I b $$$b $$ b M KbIK Mb $,bb6##0 2#$##F####

$]$$%$.bbK $%b$II%bIKL b% ,bMK Lb b$$$$b$$$$bb#########T######

$]$$ $.bb $$ bMMMM K b$$$$b$ $ b$ ,b$ $ b$,$ bb####FP##########

$]$$ $.bb$$ bM I b$$$$b$$$$b$%$ b$ $ bbbbbbbbbbbb# ##########

$%. . %#,% %b8 b%, #% #% #,# , %$b1b %%#%#%%#% # .b7 bD>F b LW%, %% b¥PTb bU ZPUT bDS % , <9 >b[ bL X $ TU ¥ Lb F b

LT ZOb$

$]$$$$.bb $$b$$ b I b $$$b $$ b M bIK Mb $,bb6##0 2#$##E####

$]$$%$.bbK $%b$II%bIKL b% ,bMK Lb b$$$$b$$$$bb#########T######

$]$$ $.bb $$ bMMMM K$ b$$$$b$ $ b$ ,b$ $ b$,$ bb####F###########

$]$$ $.bb$$ bM %Ib$$$$b$$$$b$%$ b$ $ bbbbbbbbbbbb# ##########

UDP������������� �����TCP������

��BitTorrentJANOG43 [email protected] 16

Page 17: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

�����p2p���-/7/07/4+./3204vEKv./2+43+3.+.65+20142v;v/.6+.-.+..2+/-/+4337vNAK)vd]f_k`v145

-n----7vv12--v-.^Yv3Z-¥v1---v03..v[¥Y0v4¥1[v0¥[3vvB+++c+=+3+++rH:+

-n--.-7vv¥Z32v40[Yv¥-]0v-/^]v-.]3v]1]Yv155¥vY¥05vv+]j+++++++++D++5

-n--/-7vv[/.Yv3.]/v[.50v[11]v^.3/v[..6v665¥v¥/34vv++Y++++J+Z+++++_

-n--0-7vv20]Yv¥2Z[v4456vZ[^6v]0Z2v.Y.1v34--v/566vvL+++m+++++++_+&+

-n--1-7vv0..0v2155v-][6v4/0]v15/]v[][6v66.Zv-^^2vv.+M+++i;D+++++++

-n--2-7vv--45v1¥3^v464/v]53[v2¥^.v5¥Z-v¥/-.v.5[/vv+nIgoi+dU+++++++

-n--3-7vv..05v5-]4v4.¥2v[1Y1v[-Z]v/Z0^vY0Z]vZ[]¥vv+5++h+++++(<++++

9t ;

-n-.5-7vv]6Z.v-165v.-/6v¥]43v¥2^4v4ZZ¥v.[..v-Y1/vv+++++'+l++q++++?

-n-.6-7vv-[Y3vZ]Z2v266[v2¥^Yv/¥Z-v5Y54v3]3^v2]24vv++++ +U+ +++fgVP

-n-.Y-7vvY-]-v3^/^v551¥vY12¥v[06]v662]v/]Y/vY-0Yvv++g,+I+U+++V+++7

-n-.Z-7vv[4¥¥v3]6^v^51Yv.Y/2v4Y/0v/Z]4v./-5vZ]Z.vv++f++F+# !(+++++

-n-.[-7vv34/¥v¥^]]v^5-0v[Y0ZvY.30v66[]v51Z5v54[Zvv_ +++++8+[++++++

-n-.¥-7vv62^1v3Y5¥vZ]-0v0.05v/32Zv.^04v3/2[v3415vv++b+++.5$S+4ZT_D

-n-.]-7vv-513v03^^v[44^v0Z]4v3.20v0331v-ZZ[v/^6^vv+C3+++8+YL3¥++,+

-n-.^-7vv0..6vYZ]]v.Z¥Zv/3Z^v03[0vvvvvvvvvvvvvvvvv.+++++$+3+

-/7/0714+245.55vEKv.4.+03+10+5+0-501v;v/.6+.-.+..2+/-/+4337vNAK)vd]f_k`v15/

-n----7vv12--v-.^]v3Z-^v1---v00..vZ250vYZ/1v/Z-5vvB+++c+=+0++++"(+

-n--.-7vv¥Z32v40[Yv454/v-/^]v-.]Yv//.Zv3]5]vZ/34vv+]j+ni++++ +f++_

-n--/-7vv]^]3v¥Z-¥v¥6/3v6[54v/5[6v31Y1v61]3v^.[^vv+++++$++&+¥+++++

-n--0-7vv]]3-v3623v5[¥2v3].4v.11Yv204]v5/Y4v.2[6vv+ a ++f++FLs++++

-n--1-7vv40¥5v3ZY3v[Z[]v¥0[6v0^1/vZ6Z1v01[4v^..[vvj+c+++++<?++1+++

-n--2-7vv6/03v3./4v3[4Yv344.v.¥]0vY/Y.v6Z^[vZ651vv+3Y%d _h++++++++

-n--3-7vv-^/2v0113v¥Z1¥v04-1v[610v45Y5vZ244v0^^[vv+#1C+I4++@n++m<+

9t ;

-n-.5-7vv]¥^4v35]Zv[¥Y6vZ-4/v[3[.vY//.v322]v0--4vv++`++++i+++ ]V-+

-n-.6-7vv6]¥0v[023v]/.Yv0Z.Zv^641v[61.v]¥2^v]Y2Yvv+++ ++8++k+>+W+

-n-.Y-7vv¥220v[1/0v^Z41v.1[/vZ2Z2v3/66v.06.v6^Z-vv+L+!+k++++Z+++++

-n-.Z-7vv]03/v-3[3v^Y1.v3-^1v01Y5v02Y-v53/-v^Y2[vv+Z+++> +1+2++++T

-n-.[-7vv^.Z]v^¥3[vZ/..vY¥]3v[2.-v4^24v/-6¥v-450vv+++d+++++++P++++

-n-.¥-7vv^^5Zv1646v1Z/5v3¥4^v[^//v.^23v[-65v0.Z.vv++Eo &e++ + ++.+

-n-.]-7vv¥3/]v6[-5v0]1Yv]¥5/v¥53[v¥5^4v-6¥]v^654vv++++;F+++d++++++

-n-.^-7vv]5[.v-.01v]5][v0/Z5v5¥[^v5¥1¥v35Z¥vvvvvvv+++1++/++++I`+

JANOG43 [email protected] 17

Page 18: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

������ ����• p2p".2$�%13��95��-�*EW�R����6SI�?�• ������-�*����F �JM!C��• ;��=V�p2p".2$�%13ZYD��QO�4G���

• ��95��-�*EW�����• N��KP!95�����• N��p2pX�:�-�*EW!U A���><!B7����

• '�#,()�8L� �@V0+�#/&)H��@V�p2pZYDH�T[������

JANOG43 [email protected] 18

Page 19: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

� ���������•����IP (31609992 packets)• TCP-SYN������1025-10000����

•���IP (10793632 packets)• TCP-SYN�TCP/52869�

•��� �IP (10572421 packets)• TCP-SYN�TCP/52869�

•���IP (7330971 packets)• TCP-SYN�TCP/3031�����546�����

•������8IP (�� 51607564packets)• TCP-SYN������53601-60800����

JANOG43 [email protected] 19

Page 20: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

TCP/23����������� �

���IP���������

��������

JANOG43 [email protected] 20

Page 21: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

�������������� ����������

•���������•���� �!������� ���������� ������

JANOG43 [email protected] 21

Page 22: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

�����IP6���9:48:48.468512 IP (tos 0x0, ttl 244, id 34048, offset 0, flags [none], proto IPv6 (41), length 68)

131.193.34.220 > 150.41.208.128: IP6 (hlim 255, next-header ICMPv6 (58) payload length: 8) fe80::200:5efe:83c1:22dc > fe80::200:5efe:9629:d080: [icmp6 sum ok] ICMP6, router solicitation, length 8

0x0000: 4500 0044 8500 0000 f429 3449 83c1 22dc E..D.....)4I..".

0x0010: 9629 d080 6000 0000 0008 3aff fe80 0000 .)..`.....:.....

0x0020: 0000 0000 0200 5efe 83c1 22dc fe80 0000 ......^...".....

0x0030: 0000 0000 0200 5efe 9629 d080 8500 ae76 ......^..).....v

0x0040: 0000 0000 ....

%$ �������� �(&�)�#�*��HTTP���������������)→www134.cs.uic.edu

���'"�!�����

JANOG43 [email protected] 22

Page 23: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

����������

JANOG43 [email protected] 23

Page 24: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

��������

JANOG43 [email protected] 24

����

������������ ���

���2758/host����

�������� �����

Page 25: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

��� ����������������� �������BitTorrent���p2p������

JANOG43 [email protected] 25

����

��IP�������� ����IP�������� �

Page 26: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

����������

JANOG43 [email protected] 26

Page 27: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

NICT���IoT�����

• 59%4�IPv4�����0+�22/TCP(SSH)�23/TCP(Telnet)�80/TCP(HTTP)���/���0����������('������8-1�����.�":��2&�$����• ����8-1�����0�����,7��)3�$������*; �����,7�! *6��-#2&�$����

JANOG43 [email protected] 27

Page 28: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

���������• 2018/11/15 14:59���"����� %• (%����41626�,• IP TTL0&�����!• ppp-exp'*�10����//-.�������

• 2018/11/16 14:41���#�1�• (%�����#�)�

•�!��+$TCP���• 22, 23, 80, 81, 2323, 5555, 8000, 8080, 23023, 52869

JANOG43 [email protected] 28

Page 29: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

IP6 �6to4����(,1'.1')&(-..)-]8 ] ' '$] ),($]KF]((0-)$] ]'$] CI ] 57 $] T ]8 X-] ( $]PI ]0)

(0)& &00&(]2](, &)''& )& 1]8 -] CD ' ).-- $] KO () $]P CF T] 4 ] - ]C[ CF] PI 1] ) ]) ' 1- ''1 '',1 '011)'' & ]2])'')10 E 1)')E110 E 1)')E&-,)- 1]

7 CI ] & $]E O ' )-E(] E TT E $] S ')(),-'.$]CE ]).,00,.,(,$] KP]).)''$] K P ]O ( -'$P $P $ CE :9$P $ EC ] $] PI ]'

' ''''1 ,'']'',E]) DC] '''] D)0]- .']E', ]- '( 6&&@&&3&& P &>E&

' ''('1 0 E ])')E]-'')].-- ]'')']'-.E]) ' ]- '' &&&$ &XP&&&¥ & &

' '')'1 '',]' '0]'''']'''']''''])'' ])'')]0 E 3&&&&&&&&&&&&&&&

' '' '1 )')E]'''']'''']'''']0 E ])')E]'(DD] &$&&&&&&&&&$&&&&

' '' '1 (. .] ).]C (]0E'D] '()]-C '])-E(]'''' &&& &&&&&& 3 &&&

' '','1 ')' ]',,']'('(]' ')]'(' ]' ' &&& &&&&&&&&

JANOG43 [email protected] 29

Page 30: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

6to4������•������ppp-exp����6to4��� ��������������

���

ppp-exp��� ����6to4���

���6to4 relay

JANOG43 [email protected] 30

Page 31: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

6to4������•+������ �• .1%#� 4�-/�($�6to4�5)����

6to4&6�������� ����• IPv6 SYN-flooding*'�6to43"�,�

•0��6to4��!��7�ICMP6 TTL expired�2�����

JANOG43 [email protected] 31

Page 32: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

�������

•���IP����300Mbps��•�����IP������ • UDP�src/dst�����high port• Don’t fragment, 1052 bytes

JANOG43 [email protected] 32

Page 33: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

��������• p2p*�!$���#&�)��(�4• packet dump�0����1-� ��'.�+���• ���� "� ���

•� ,��/���• UDP�"�%��3�/����• ��������2

JANOG43 [email protected] 33

Page 34: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

������������� ����������

pdf docx

jpg m4apptx

JANOG43 [email protected] 34

Page 35: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

���UDP��� �������������

������UDP����

JANOG43 [email protected] 35

Page 36: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

��������•0����&�#?�ED�+,$*• -9�+,$*�&�#�������• 3��=7�.8���

•�:@DoS64��• 1�!�)"�����$� (%'-��• -9�2/� �

•<5• >;�CB�A����DoS64�������

JANOG43 [email protected] 36

Page 37: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

��������- - , 45 , 0 , - 625 D I

- , < > > < 9 9< 3 E 8

- <: ;9 < 9 9 > 11

- > < ; ; 1111 ;< I

- > > ; ; ;< 9 D ;

/P 0

- : < I>I .

- : I>I . >I

- < < > , < I 9DED

- > < > , < > E 9DED E

- < 5

- >I >

- : I . >I

- I>I I>I

, - 9 >I

;< I ;< 9 D ;< DI ;< EEI ;< .

I II - 777 :AD .

; E< :AD .

:AD .

I>I 777 ; I I>I .

; E< I>I .

I>I .

I>I I>I 777.

; E< I>I .

I>I .

>I I 9DED E 9DED E 5 777>I >I .

>I I>I I>I >I

JANOG43 [email protected] 37

Page 38: Matsuzaki ‘maz’ Yoshinobu <maz@iij.ad.jp> · 2019-01-24 · •ICMP echo 87 51 •(+TCP # &3 )* '2TCP! 87 51 •SYN, ACK, FIN, FIN+ACK, FIN+PSH+URG, etc. •UDP &3 )* '2UDP!

������•+��!�� ,�(��SIP����• SIPVicious��

•�#%�IP��$����2-1/ ���UDP/3395 #%�"�����.���4�• UDP/443 DNS'*������0��4�• CH TXT version.bind. �3�)�

• UDP/443 UDP/28746��&�0��4�4 5 .54444 54444 4444 4444 4444

4 4444 4444 .5 5 54444 1 *50 *0 3

4 0 .52220 2 5 * *5 5 5 5 **

JANOG43 [email protected] 38