December 1998 - NANOG - lists.nanog.org

Re: ** Forged spamming going on
by Dean Anderson 21 Dec '98

21 Dec '98

At 02:16 PM 12/21/1998 -0500, Steven J. Sobol wrote: >On Mon, Dec 21, 1998 at 12:38:01PM -0500, Dean Anderson wrote: > >> Actually, I think this might qualify AOL for the RBL, since they are >> sending unsolicited mail and won't stop. Thats supposed to be the only >> qualifier, right? > >I'm going to assume you're kidding... No. It is the only qualification. They do meet the qualification. I'm asking for them to be added since they meet the requirements as specified for Network Solutions. I don't seriously expect that they will added. I expect that the requirements for the RBL will change instead. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 1

** Forged spamming going on
by alex＠nac.net 21 Dec '98

21 Dec '98

some luser off of AT&T DIalup is using mailme.com (my domain) for relaying mail: Received: from mailme.com (146.st-louis-71-72rs.mo.dial-access.att.net [12.75.28.146]) by atom.ntgi.net (8.8.8/8.8.7) with SMTP id XAA23473; Sat, 19 Dec 1998 23:27:18 -0500 (EST) (envelope-from You4Me2C(a)mailme.com) He is sending thousands of emails to AOL users, who is then bouncing them to me. I am not please, to say the least. AT&T's security dept is non-existent, as far as I am concerned. I wish vixie would RBL 12/8. Thinking about this, there is no solution; here are my options: 1) blackhole AT&T, which does nothing, since the mail is bounces coming from AOL. 2) blackhole AOL, which would fix my attack, but would break all legitimate mail from/to AOL. 3) temporarily blackhole mailme.com, which would prevent me from getting the bounces, but then I can't send/get legit mail. I wish AT&T and other huge dialup organizations could control the users they have; there should be a licensing process.. -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- Atheism is a non-prophet organization. I route, therefore I am. Alex Rubenstein, alex(a)nac.net, KC2BUO, ISP/C Charter Member Father of the Network and Head Bottle-Washer Net Access Corporation, 9 Mt. Pleasant Tpk., Denville, NJ 07834 Don't choose a spineless ISP; we have more backbone! http://www.nac.net -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --

4 3

RE: AT&T crap performance!
by Dean Anderson 21 Dec '98

21 Dec '98

Hmm. Looks ok now... --Dean odie# traceroute dqc.org. traceroute to dqc.org (12.7.119.10), 30 hops max, 40 byte packets 1 av8-bos-gw1 (198.3.136.1) 1.560 ms 1.181 ms 1.277 ms 2 637.Hssi2-0.GW2.BOS1.ALTER.NET (157.130.1.157) 3.509 ms 3.249 ms 2.960 ms 3 124.ATM2-0.XR1.BOS1.ALTER.NET (146.188.176.242) 2.696 ms 3.179 ms 2.805 m s 4 291.ATM3-0.XR1.NYC1.ALTER.NET (146.188.176.173) 7.254 ms 7.975 ms 7.348 m s 5 195.ATM8-0-0.BR1.NYC1.ALTER.NET (146.188.177.145) 7.741 ms 7.779 ms 7.658 ms 6 atm12-0.nyc-bb2.cerf.net (134.24.32.49) 8.999 ms 9.469 ms 9.529 ms 7 134.24.32.162 (134.24.32.162) 8.556 ms 9.799 ms 9.207 ms 8 br2-a3110s2.n54ny.ip.att.net (192.205.31.246) 13.389 ms 12.442 ms 13.199 ms 9 12.127.9.181 (12.127.9.181) 32.621 ms 35.601 ms 32.622 ms 10 br2-a3110s3.cgcil.ip.att.net (12.127.15.214) 34.991 ms 41.085 ms 32.979 m s 11 12.127.14.38 (12.127.14.38) 71.132 ms 71.495 ms 70.487 ms 12 ar1-a300s1.sffca.ip.att.net (12.127.1.133) 71.214 ms 110.304 ms 82.113 ms 13 12.127.193.110 (12.127.193.110) 95.569 ms 111.911 ms 90.023 ms 14 lightwave-2-GW1.bend1.EmpireNet.net (12.7.96.4) 100.559 ms 88.758 ms 88.6 06 ms 15 dqc.org (12.7.119.10) 89.701 ms 88.550 ms 92.692 ms odie# odie# traceroute concorde traceroute to concorde.av8.com (208.223.51.250), 30 hops max, 40 byte packets 1 av8-bos-gw1 (198.3.136.1) 1.183 ms 1.173 ms 1.142 ms 2 637.Hssi2-0.GW2.BOS1.ALTER.NET (157.130.1.157) 3.403 ms 3.010 ms 2.584 ms 3 empire-gw.customer.ALTER.NET (157.130.4.134) 8.481 ms 9.499 ms 9.643 ms 4 concorde (208.223.51.250) 8.413 ms 8.314 ms 12.349 ms ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 0

Re: ** Forged spamming going on
by Dean Anderson 21 Dec '98

21 Dec '98

At 10:57 AM 12/21/1998 -0800, J.D. Falk wrote: >On 12/21/98, Dean Anderson <dean(a)av8.com> wrote: > >> Actually, I think this might qualify AOL for the RBL, since they are >> sending unsolicited mail and won't stop. Thats supposed to be the only >> qualifier, right? > > Not quite, Dean, as you should know by now. > > http://maps.vix.com/rbl/candidacy.html#ByOrigination This page is out of date. I did just double check to make sure. It was updated by more recent statements by Paul Vixie on Nanog regarding the RBLing of Network Solutions which didn't happen due to negotiation by NetSol. In these statements, he says that anyone who sends unsolicited (even non-commercial) email and won't stop, will qualify to be blackholed. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 0

Re: ** Forged spamming going on
by Paul Vixie 21 Dec '98

21 Dec '98

I've got Dean listed in my procmail filters, but somebody sent me a copy of this separately, and so now you'll all have to wade through my answer: > >Still wouldn't fix it, as AOL is the one sending me the mails (bounces). > > Perhaps you can get AOL to stop sending. > > Actually, I think this might qualify AOL for the RBL, since they are > sending unsolicited mail and won't stop. Thats supposed to be the only > qualifier, right? "Won't" in this context has to mean "makes no effort". AOL makes an effort. Several of AOL's mail relays were blackholed in the first six months of the MAPS RBL project, but AOL has been a model network citizen since then. -- Paul Vixie <paul(a)vix.com>

1 0

RE: AT&T crap performance!
by Chris Mauritz 21 Dec '98

21 Dec '98

If your service has sucked for a long period of time, I would use that as a basis for premature cancellation. Are there any clauses in your contract with respect to their performance? I know that UUnet has such a clause. C Chris Mauritz Director, Systems Administration Rare Medium, Inc. chrism(a)raremedium.com -----Original Message----- From: Chris Cappuccio [mailto:chris@empnet.com] Sent: Monday, December 21, 1998 1:30 PM To: nanog(a)merit.edu Subject: AT&T crap performance! Hey, I've been using AT&T's network for a while now, and I have a lot of very poor performance issues like this for a long time. The easy answer would be to trash AT&T but we've got a contract with them that hasn't expired yet. Since these are network related issues, I'm wondering if anyone on NANOG has a clue as to what is going on/the best people to approach. I've been calling folks at AT&T for several months to get answers that amount to "we are upgrading this link to an OC3" and even after the upgrade, the performace still sucks. dqc:chris {107} traceroute lycaeum.org traceroute to lycaeum.org (207.66.171.40), 64 hops max, 40 byte packets 1 enet-IP4-de1-gw.bend2.EmpireNet.net (12.7.103.1) 0.440 ms 0.759 ms 0.375 ms 2 fe0-0.c7206.EmpireNet.net (12.7.96.1) 1.169 ms 1.71 ms 1.13 ms 3 12.127.193.109 (12.127.193.109) 18.43 ms 17.241 ms 21.98 ms 4 gr1-a3100s3.sffca.ip.att.net (192.205.35.1) 21.828 ms 32.112 ms 23.714 ms 5 att-gw.sf.cw.net (192.205.31.78) 473.411 ms 464.849 ms 494.304 ms 6 bordercore2.Seattle.cw.net (166.48.208.1) 482.713 ms 501.263 ms 511.764 ms 7 semaphore-corporation.Seattle.cw.net (166.48.208.6) 361.175 ms 368.1 ms 381.595 ms 8 fe0-0-0.sea2.semaphore.net (209.221.128.2) 383.171 ms 380.497 ms 447.556 ms 9 wolfe-gw-n-E12-3.semaphore.net (207.17.119.21) 677.106 ms 592.674 ms * 10 fci-sea-cr0-fa-0-0-0.flyingcroc.com (204.157.111.18) 573.205 ms 490.200 ms 454.482 ms 11 shaman.lycaeum.org (207.66.171.40) 493.69 ms 487.742 ms 487.732 ms lycaeum{101}% traceroute dqc.org traceroute to dqc.org (12.7.119.10), 30 hops max, 40 byte packets 1 * fci-sea-cr0.flyingcroc.com (204.157.104.1) 1.823 ms 0.986 ms 2 204.157.111.17 (204.157.111.17) 1.723 ms 1.649 ms 1.172 ms 3 wolfe-gw-f-E12-3.semaphore.net (207.17.119.22) 1.818 ms 2.196 ms 8.317 ms 4 903.Hssi5-0.GW1.SEA1.ALTER.NET (137.39.136.21) 8.787 ms 2.265 ms 1.847 ms 5 103.ATM3-0.XR1.SEA1.ALTER.NET (146.188.200.42) 2.692 ms 6.655 ms 5.883 ms 6 295.ATM2-0.TR1.SEA1.ALTER.NET (146.188.200.106) 2.518 ms 2.821 ms 2.922 ms 7 110.ATM7-0.TR1.CHI4.ALTER.NET (146.188.136.165) 50.112 ms 53.411 ms 48.689 ms 8 299.ATM7-0.XR1.CHI4.ALTER.NET (146.188.208.221) 46.940 ms 52.094 ms 47.992 ms 9 195.ATM8-0-0.BR1.CHI1.ALTER.NET (146.188.208.1) 47.254 ms 47.534 ms 48.252 ms 10 137.39.23.50 (137.39.23.50) 50.224 ms 49.393 ms 50.897 ms 11 gr1-a340s1.cgcil.ip.att.net (192.205.31.113) 74.123 ms 68.746 ms 94.304 ms 12 br2-a350s3.cgcil.ip.att.net (192.205.31.106) 1019.882 ms 977.420 ms 958.934 ms 13 br1-h31.sffca.ip.att.net (12.127.14.110) 292.712 ms 91.461 ms 79.426 ms 14 ar1-a300s1.sffca.ip.att.net (12.127.1.133) 322.673 ms 417.481 ms 385.498 ms 15 12.127.193.102 (12.127.193.102) 367.061 ms 374.838 ms * 16 lightwave-2-GW1.bend1.EmpireNet.net (12.7.96.4) 422.924 ms 420.412 ms 419.702 ms 17 dqc.org (12.7.119.10) 461.522 ms 465.937 ms 452.014 ms -- Keep Cool, but Don't Freeze - Hellman's Mayonnaise

1 0

Re: ** Forged spamming going on
by Dean Anderson 21 Dec '98

21 Dec '98

At 11:23 AM 12/21/1998 -0500, alex(a)nac.net wrote: >Still wouldn't fix it, as AOL is the one sending me the mails (bounces). Perhaps you can get AOL to stop sending. Actually, I think this might qualify AOL for the RBL, since they are sending unsolicited mail and won't stop. Thats supposed to be the only qualifier, right? Paul? --Dean (Color me amused if AOL is RBL'd ;-) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

3 2

Re: ** Forged spamming going on
by Dean Anderson 21 Dec '98

21 Dec '98

At 11:43 AM 12/21/1998 -0700, John Gonzalez/netMDC admin wrote: >On Mon, 21 Dec 1998, Dean Anderson wrote: > >-| At 11:23 AM 12/21/1998 -0500, alex(a)nac.net wrote: >-| >-| >Still wouldn't fix it, as AOL is the one sending me the mails (bounces). >-| >-| Perhaps you can get AOL to stop sending. >-| >-| Actually, I think this might qualify AOL for the RBL, since they are >-| sending unsolicited mail and won't stop. Thats supposed to be the only >-| qualifier, right? > >I doubt AOL would be put on the RBL unless they SERIOUSLY did something >wrong. Too much legit mail comes from them. Besides, it's not their fault. >In this instance, they are doing the sane thing. It's the spammer forging >the domain that must be stopped. Let's blame those who deserve the blame, >and not punish innocents. Well, this is somewhat tongue in cheek. I'm really poking at the problems with the definition of who gets RBL'ed. I would think that since Vixie has some experience with standards, he would be able to come up with a better definition. One perhaps that doesn't change day to day depending on who he wants to block at the moment. Although, perhaps that is what he means to do, in which case, look out AOL. I thought at least we could get an answer as to whether Vixie will RBL AOL for sending unsolicited mail and refusing to stop. I would hope for some sort of explanation about how they do or don't fit his current definition. I'm all for blaming spammers. We just found an unauthorized relay this morning. But I'll be pursuing them with federal prosescutors, not via vigilante operations. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 0

Re: ** Forged spamming going on
by Robert Tarrall 21 Dec '98

21 Dec '98

alex(a)nac.net wrote: -> Received: from mailme.com (146.st-louis-71-72rs.mo.dial-access.att.net [12.7 Agh. Nevermind my previous comment about denying relays - obviously not of much use in your case. Must remember to wait till the caffeine kicks in before sending email in the morning... I *would* still like to know if anyone has a list of legitimate SMTP servers for the big dialups though. Alex, seems like your ideal solution would be something that transparently redirects all the AOL bounces to AT&T's servers. Might be more likely to get their attention that way... -Robert Tarrall.- System/Network Admin E Central

2 1

Advance notice for 1q99 walk
by bmanning＠ISI.EDU 21 Dec '98

21 Dec '98

Hi, I appologize for duplicates. Its almost time for the next quarterly walk of the inverse tree of the DNS. For the last few quarters, I've been walking the in-addr tree looking for numbers of delegations, accurate delegations, and types and styles of error conditions. So... this is a heads up that you will be seeing zone transfers being generated by a couple of the collecter machines here. For those of you who utilize BINDs access controls, I'd appreciate your inclusion of the collector machines in allowed transfers. The expectation is that they will be the following IP addresses: 128.9.160.57 and 198.32.4.13 If there are any questions or concerns, I'd be happy to talk about them. Past data has been presented at IEPG, Apricot and RIPE meetings. The expectation is that future data will be presented in the same and similar forums. The expected start date is 01jan99 and it is expected to run through February 1999. The 4q98 and preliminary data for the 1q99 audits will be presented at Apricot99 in Singapore. www.apricot.net for details about this venue. The data will be available via http as well. www.isi.edu/div7/people/bmanning.home/in-addr-audit.html --bill

1 0