10 Dec 2006 #0650.html

Netbot Denial of Services

. . .

Dear Family and Friends,

Welcome to this week's "Thoughtlet."

These words are my personal diary and a weekly review of ideas, beliefs, thoughts, or words that will hopefully be of some benefit to you: my children, my family, and my friends.

"I mentioned Marc Roulston came over to work on the Linux system last Saturday afternoon from about 2:00 until about 7:00 PM. Well it turns out this problem has dominated my week. Furthermore, it turns out to be a Netbot denial of services attack against www.walden3d.com. It is now the following Saturday, 09 December 2006, at 1:25 PM and Marc just called to say he is on his way over to attack the problem once again.

Monday night Marc arrived about 6:00 and worked until about 11:00. At one point he dowloaded 84 seconds worth of the messages pouring into www.walden3d.com. There were 9,283 connections attempts from over 2,400 unique IP addresses in 84 seconds. The web server has been hit that hard every second since sometime Friday morning. Somebody really does not like me, and really wants to get at my 100% owned company. They are doing it. I recognized the symptoms of a denial of services attack, because of being hacked back in 2001. In case you missed or forgot about that Thoughtlet (see ../0106.html) it includes:

'The hacker is probably in Europe. He is using the main system in a Japanese bank to get into my system. He has placed a program called spacheldraht, which is more commonly known as `denial of services.' This is part of a German family of hack programs called the `tribal flood network' and is what was used over the last few years to shutdown MicroSoft and Amazon.com. It appears my system was one of the systems used to do that attack. The hacker was using the system on Friday morning to attack a system at a consulting services firm in Germany. We called the FBI. Like a typical bureaucracy they had no idea how to handle the information we were giving them. In fact, they never called us back.'

One success is that this week I rereached the lowest weight I've had since I started to count swallows (0153.html and 0202.html), i.e. 235 pounds. Still about 40 pounds overweight (read that obese), and it is progress. So what did I modify. I went to a binary system several weeks before Thanksgiving. The system is a simple 'dinner' or 'no dinner' sign on Andrea's mirror, tied to whether I am at my goal weight when I wake up in the morning. I was almost down to 235 before Thanksgiving and I came back from Thanksgiving with Paul, Kate, Grant, Ella, and Matt (0648.html) 11 pounds over the goal I was at when we left. Oh well! And so there have been no dinners for several weeks. Because I was at 235 on Tuesday, Wednesday, and Saturday I celebrated a little yesterday, and was back up to 238 Sunday morning, 10 December 2006. Oh well! However, I reprinted my swallow sheets this morning, and reset the goal, so I expect I will get dinner every once in a while this next week. Controlling our appetites is not easy. So one thing I will do this week is to describe what I ate for lunch each day. I won't describe how hungry I was each night when I went to sleep. Monday was leftovers from the Sunday afternoon feast. It included chicken, wrapped with bacon and stuffed with herbs, yams, pinenuts, and an apple. Although I was busy all week at work, the work was pretty boring, and writing about food provides an opportunity to make the week sound more interesting.

Tuesday I had an artichoke and cheese salad. I'm getting pretty good at making good tasting salads without any salad dressing. If you put salad dressing on lettuce in the morning, the lettuce has gone all funny by lunch time. Because Marc and I had worked on the netbot denial of services on Monday evening, eventually turning off port 25 (the reason I switched from Earthlink to AT&T), hoping the netbot would loose interest in attacking www.walden3d.com, I spent time on the phone with Network Solutions, who provide me my domain name, and conferenced their technical guy into the AT&T technical support group. A possible solution came out of this discussion, namely to change the IP address on AT&T's MX record for oak.walden3d.com, which is the mail IP address. However, the AT&T technical support guy did not have the authority to make this change, and wanted me to fill out an abuse form. I filled out the form, and waited for a response. Nothing happened, and every night when I came home, the lights on the Netopia and the wireless modem were blinking at the same saturation rate. Oh well!

Wednesday my notes say I had an avocado crouton salad. I don't remember there being avacado's at home this week. Guess it shows how no matter how accurate you attempt to make notes, a diary, or a thoughtlet, there is still issues of human frailty entering the equation, and everything is slanted by our personal views. I guess I could write a little about what is going on at work. Prestack Depth Migration, which is what I am charged with learning about, is a function of how well the seismic wave velocities are interpreted. There are a lot of tools to interpret seismic velocities. The last time I spent a long time picking seismic velocities was for Don Palmer (?), a Texas A&M graduate, who was my supervisor for 3 or 4 months of the Mobil training program in 1975. The work was in the Cook Inlet in Alaska. There were hundreds of semblance plots, contours of how well seismic amplitudes stack at a specific travel time and velocity, which I interpreted. I put them up all along the halls of the office, and connected the various time-velocity picks to make sure it followed the anticipated geology. I was never so bored at Mobil, and swore I would never do seismic processing or velocity picking again. So now I'm pre-stack depth migrating (PSDM) a large 3-D seismic survey in the deep water Green Canyon area of the Gulf of Mexico which has thousands of semblance plots. History has a habit of repeating itself. Oh well!

Thursday lunch was special: sushi and flatbread with hummus. Andrea did a special party/dinner for her Japanese 2 students after they finished the final exam. And I got a hot dog sized sushi. She got the materials at a store that sells flatbread and hummus, and so there was some of that to go with the sushi. I've found that if I eat a bowl of oatmeal with honey and milk on it (microwaved for 2 minutes) and a glass of orange juice, then eat half of my lunch at about 9:00, and the other half of my lunch after walking 54 flights of stairs, that I'm OK until I get home. The exceptions are when I start to fall asleep because the work is so boring, and then I drink a diet coke to wake me up. It does a good job, especially since I attempt to limit how often I do this.

Friday I ate the last of the pine nuts, along with a dried banana cheese salad. Aunt Sara is very good at sending me a bag of pine nuts every year for my birthday. This year she sent two bags: one from Nevada and one from Iron County. The Nevada pine nuts were sweeter and I liked them better. However they all molded before I got them boiled, and the taste difference might have been related to the mold. Others at work tasted the pine nuts, including one guy who chewed one up and swallowed the shells and the meat (he did not want to try any more). However, no one likes them like I do. That's fine with me. I like them. Thanks Sara. Since I had not heard anything back from AT&T about the netbot denial of services abuse report, I called them about 10:30, and was on the phone with them until noon (all the while picking velocities on semblance curves) forcing them to give me a new IP address on my MX record. They finally did. I was kind of burned out when I got home. We had already seen the episode of 'Numb3rs' that was showing. So Andra and I ended up going to a 7:05 playing of a new movie named 'Deja Vu.' I expect Roice, Ben & Sarah, and Paul would really like it. It is about a government group which has a device that creates a wormhole into a time 4 days earlier, and how this device is used to fight a terrorist attack in New Orleans, where a 'patriot' blows up a ferry and kills over 500 sailors and other passengers. Too bad there is so much violence or sex in everything today. And I'd still say this is a pretty good movie for adults.

Saturday morning I worked on Thoughtlets, geting #0627 in the mail to Matt before Andrea and I left for choir practice for the joint LDS-Epiphany concert. The practice was pretty scattered. I'm glad I have not been asked to coordinate or manage or direct something like this. After practice we went to HEB to buy cheese for my Primary Class. We bought stuff for my salads, and also a fresh roasted chicken. I ate too much on Saturday, and the scales showed it this morning. Oh well! We also picked up Sara's African quilt, which had been quilted at a quilt shop, and which Andrea needs to put the outside hem on and build a couple of pillows for Sara's Christmas present (I can write this because it won't be posted until just before Christmas, and then there will be too much for anyone to read and to find this sentence.) As mentioned above, Marc came by to work on the system and to connect the new IP numbers to the system about 2:00 in the afternoon. He only worked on the system for a couple of hours. However, during that time I learned that the plural of Netbot is Botnet. Interesting flip of letters. I also learned that www.walden3d.com is getting a transfer rate of 1.646 mega-bits per second (Mbps) downlink, and a 350.20 kilobits per second (Kbps) uplink. Downlink is when something comes to my computer, and uplink is when the computer send something to someone else. The fact that these two speeds are different from each other means we have an asynchronous connection (the speeds coming and going are different). This is one of the problems we are facing with directly attacking the botnet denial of services attack. The messages are coming in at over 100 messages per second, which exceeds the DSL downlink speed. The computer, although it is fast and a 64-bit machine, can not push answers specifying receipt of a packet as fast as the request to leave a packet arrive. Big companies like Google wrap a bunch of T1 lines together, and so they can download pretty much whatever is sent at them, then they filter out the spam, and respond to the non-spam. It might turn out that walden3d.com will have to let another company, with this type of bandwidth and tools act as a buffer for mail to xyz@walden3d.com. My preference is to retain control of this option, and it might not be possible. Hopefully we will find out next week (0651.html). After Marc left I wrote a response to comments from Paul and Melanie, with a cover note for #0627. I won't quote any of these e-mails, nor the responses, as I've already done more than enough to create animosity and drama (Unintended consequences of independent decisions!). Maybe an oil field story, which came in the mail on Saturday as minutes from the last POPS meeting, which I missed, is appropriate here:

'Our history subject today is of relatively recent vintage and many will remember it as a unique event in the oil business. The event occurred exactly 26 years ago today on November 20, 1980 and involved the drilling of a well and flooding of a nearby salt mine. The 1980 setting is the Jefferson isle salt dome, 12 miles west of New Iberia, La. Most of the dome lies below Lake Peigneur, a nearly circular shallow depression about 1 1/2 miles in diameter. Depth of the lake ranged from 4 to 15 feet. The Delcambre canal crosses one side of the lake leading to the Intracoastal canal and the Gulf of Mexico. Mining salt from the dome began at the 800 ft level in 1922 and by 1980 had reached 1500 ft. The top of the dome had a history of instability above 1300 ft as noted by an engineering study in 1971 and a water leak occurred at the 1500-ft level in 1976. Diamond Crystal Salt Co. operated the mine and Texaco held drilling rights for oil and gas. The dome also supported a popular tourist-oriented tropical garden and nursery known as Live Oak Gardens, which also contained private residences. In Nov. 1980, Texaco spudded two wells in and adjacent to the lake. Its P-20 exploratory test in the lake was being drilled by Wilson Brothers Drilling Corp. of Lafayette, using a land rig installed on a wooden piled platform Marine transportation limitations imposed by lift bridges and the Delcambre canal prevented use of a barge rig. Well P-35, being drilled by Grafton Drilling Co. of New Iberia, was 1200 ft southeast of P-20 and 400 ft inland from the lake shore. Both holes were targeted for 8,000 ft TD (total depth). The detailed P-20 well plan, which called for the hole to pass from 50 to 165 ft from the dome, was reviewed by numerous government agencies and permits were approved. Cargo barges containing the platform rig mud system, drill pipe and casing, a BJ pump truck and three tractor trailers of bulk cement were moored at the platform rig when well P-20 spudded at 6 PM on Nov. 18. At 4:40 AM on Nov. 20, pipe was stuck. Hookland increased slowly beyond the 78,000 # weight of the drill string and by 5:45 had increased to a startling 400,000 #, baffling one and all. The platform then tilted three ft on one corner and the rig crew was subsequently ordered to shore. At 7:25, onlookers were astonished to see the derrick fall and the platform and rig disappear into the water supposed to be 11 ft deep. Shortly thereafter, the lake began to drain and a whirlpool formed over the well, increasingly slowly to 1500 ft in diameter with these consequences: * Eleven 120-ft to 200-ft cargo barges, including those with the rig mud system, pipe, etc and others with BJ cementing equipment aboard, disappeared into the crater. * As the lake drained, the crewboat evacuating the crew was caught in the suction, but was able to run aground, where one and all bailed out and slopped and crawled through mud to shore. A 14-ft aluminum boat with fishermen Leonce Viator and his nephew got stuck in the mud, which was too deep to walk in. After somehow maneuvering their boat into deeper water towards the crater, Leonce jacked his throttle wide open and zipped through the edge of the whirlpool at top speed to the far shore where he tied it to a large pecan tree, only to see boat, tree and much of the lakeshore disappear down the crater. Leonce later said he now buys his fish instead of trying to catch them. * Some 65 acres of Jefferson isle slid into the draining lake. This destroyed the onshore Grafton rig drilling well P-35, much of the botanical gardens, the home of the land owner, his swimming pool, several greenhouses, a house trailer, trucks, tractors, a parking lot, numerous 150-pecan trees and a barge loading dock. Ground movement also ruptured casing of a gas well in the lake, which proceeded to catch on fire, but fortunately bridged later. In three hours, almost all the lake had drained into the crater and salt mine, allowing the Gulf of Mexico to begin backflowing up the Delcambre canal into the lake and down the crater. A tug boat in the canal, unable to overcome the current, was abandoned by its terrified crew and was swept down the hole. ON the plus side, the backflow deepened the canal from 2-4 ft; created a 150 ft waterfall, the highest ever recorded in Louisiana; enlarged the lake by 65 acres and deepened it from 15 ft to 1300 ft.; and converted the lake from freshwater to saltwater, where red fishing is now reported to be very good. Finally, when the lake refilled, nine of the eleven cargo barges popped back up out of the crater like corks, but without their equipment and supplies. And now to the salt mine. Just before 7 AM on Nov. 20, 48 miners and three visitors from LSU, who obviously later must have questioned their timing for a visit, entered the mine. A few maintenance miners stopped at the 1300 ft level and all the rest debarked at 1500 ft. At 8 AM, weird banging noises and a knee-deep stream of muddy water flowing along the floor of the 1400-ft level alerted Junius Gaddison, a mine electrician, who gave the alarm all was not well. To make a lengthy story short, Diamond Crystal had an excellent evacuation plan, which allowed everyone in the mine to escape safely. Subsequently, some 3 1/2 billion gallons of water filled the mine, destroying it and the jobs of 297 employees. Then came the lawyers. The very next day, Diamond Crystal sued Texaco for loss of its mine; Texaco sued Diamond for unsafe mining practices; Wilson Bros. sued Texaco and Diamond for the loss of its rig; the mine employees sued Texaco and Wilson Bros. for $100 million to cover their job loss - one of them also sued both companies for $1.45 million for bruised ribs incurred during the evacuation; and Live Oak Gardens sued Texaco and Diamond for its loss of land, buildings and equipment. Final disposition of all litigation wasn't available, but ultimately, Texaco settled with Diamond for $32 million and Live Oak Gardens for $12.8 million - which may have been a hasty decision. An August 1981 report of an extensive investigation by the Labor Department's Mine Safety & Health Administration concluded that it was impossible to determine whether it was the drilling of the well or mine failure that caused the disaster, since all the evidence was now 1300 feet below ground in the inaccessible flooded salt mine. Finally, given the many opportunities, it was miraculous that no human lives were lost during the event even though virtually all involved were almost scared to death.' Sources: "The Jefferson isle mine inundation," U.S. Department of Labor, Mine Safety & Health Administration, Aug. 1981; "Who pulled the plug on Lake Peigneur, Michael Gold," Science, Nov. 1981, p. 112; "Lake Peigneur: The swirling vortex of doom," Allen Bellows, damninteresting.com, Sept. 6, 2005; "And away goes the lake down the drain," members.tripod.com. - Bob Scott

Andrea and I watched 'It's a beautiful life' and 'The Bourne Identity' on TV, and I worked on creating a database of worldwide giant oil and gas fields. I had finished the Christmas card, was printing them out during the shows, and Andrea put labels and stamps on them while watching TV. Even though I am so far behind on Thoughtlets, this seemed like an acceptable diversion from the emotions of the week, including the netbot denial of services."

Since the 38th week of 1996 I have written a weekly "Thoughtlet" (little statements of big thoughts which mean a lot to me). Until the 43rd week of 2004 I sent these out as an e-mail. They were intended to be big thoughts which mean a lot to me. Over time the process evolved into a personal diary. These notes were shared with my family because I know how important the written word can be. Concerned about how easy it is to drift and forget our roots and our potential among all of distractions of daily life, I thought this was a good way to reach those I love. It no longer feels right to send out an e-mail and "force" my kids and my family to be aware of my life and struggles.

Everyone has their own life to lead, and their own struggles to work through. I will continue this effort, and will continue to make my notes publicly accessible (unless I learn of misuse by someone who finds out about them, and then will aggressively pursue a legal remedy to copyright infringement and I will put the Thoughtlets behind a password).

The index to download any of these Thoughtlets is at http://www.walden3d.com/thoughtlets, or you can e-mail me with questions or requests at rnelson@walden3d.com (note if you are not on my e-mail "whitelist" you must send 2 e-mails within 24 hours of each other in order for your e-mail to not be trashed).

With all my love,
Dad
(H. Roice Nelson, Jr.)

. . .

Copyright © 2006 H. Roice Nelson, Jr.