September 2003 - NANOG - lists.nanog.org

Re: ISPs blocking port 53? (was Re: Annoying dynamic DNS updates)
by Michael.Dillon＠radianz.com 29 Sep '03

29 Sep '03

> but no matter how good an >idea it is, my complaint is still that sending e-mail toward the whois >contact for a network or AS# should elicit a clueful reply, and if it >doesn't, then the key word we're looking for is "cost shifting". (and >that, in case y'all wondered, is why this is relevant to nanog@.) It's also relevant to the upcoming ARIN meeting in Chicago right after NANOG. There is a policy proposal to change the whois directory so that it only contains contact info for people who are ready, willing and able to act as contacts for an address block or AS number. Right now whois is a cesspool with too many people who are unable to do anything about network issues or who don't understand network issues or who have moved on and no longer exist. If we clean this up, then it is entirely reasonable for you to ask the community to give a higher priority to complaints from someone who is also listed as a whois contact. But right now I don't see any good way to systematically identify clueful complainers. --Michael Dillon

1 0

Re: Annoying dynamic DNS updates (was Re: someone from attbi please contact me ...)
by Michael.Dillon＠radianz.com 29 Sep '03

29 Sep '03

>Unfortunately, telling end users to disable a default setting is >rather difficult these days. Not if it's done the right way using the right language. For instance... ------------ Did you realize that your computer is probably wasting precious bandwidth and slowing down your Internet connection because of the wrong default setting? You can fix this problem and take back control of your connection with this small utility which resets the dynamic DNS settings to stop wasting your bandwidth. Go to http://0xdeadbeef.example.com/noddns.html and start surfing free. And don't forget to tell your friends too! ------------- In other words, Windows users don't typically change settings themselves but they do download small utilities that do nothing other than change one or two registry keys. >Back in beta days, the official explanation given was that the DNS >updating was a "value add" and that it would never be disabled as >a default as a courtesy to corporate customers. Corporate customers are smart enough to tick off a DDNS option during install or to automate the entire install process with a custom install script for their site. But MS is so big that the people making this decision probably had no idea how their product is really used in the real world. > larger ISPs ought >to include this "fix" as an option with their installation CDs. Alas, >we get back to the ongoing debate: adjust user prefs for them, for >their own good... or get the vendor to cooperate? Both. Create and distribute a tool that fixes the problem. Make sure the tool can run windowless as part of an ISP or corporate install script. Then sit back and watch while MS assimilates the functionality of this new tool in a later release. --Michael Dillon

1 0

Re: ISPs blocking port 53? (was Re: Annoying dynamic DNS updates)
by Paul Vixie 29 Sep '03

29 Sep '03

> whats disturbing is how many contact addresses for both whois and AS#'s > bounce sure, i agree, that's disturbing. however, it's a different problem than having mail get ignored or ignorebotted and then depref'd so low that nobody even bothers to call you or let you know whether a human ever say the message. when it's a spammer then i can understand that there might be money lost if the isp disco's them. that's evil and rude, but i understand it. when it's unwanted packet-level traffic, though, there is no revenue stream to be protected by the simple expedient of ignoring complaints -- ddos'ers do not pay for their outgo. what's happening in this case is simply that there isn't enough staff to deal with every issue that affects outside complainers. it turns out that this lack scales nicely, creating the same lack elsewhere, due to competitive pressure, general apathy toward whole classes of problems, and so forth. branding program. we need a branding program. is there still an isp consortium in existence or did they all just die like cix? we need a "better netkeeping seal of approval" stamp before the worseness goes through its next geometric progression.

2 1

Unauthorized DNS updates
by Lou Katz 29 Sep '03

29 Sep '03

Is there a way to configure bind so that when an **unauthorized** update comes in it enstates an address of the owner's choice? -- -=[L]=-

2 1

Re: ISPs blocking port 53? (was Re: Annoying dynamic DNS updates)
by Paul Vixie 28 Sep '03

28 Sep '03

> How should an ISP tell the difference between "good" DNS packets and "bad" > DNS packets? the bad ones are the ones people complain about. > You aren't complaining about your dynamic update packets or even all > dynamic updates. You are complaining about someone sending you packets > you don't want. And more precisely, you are complaining that Comcast is > failing to send you other packets you want to receive, i.e. a response to > your e-mail packets. yup. where "packets i do not want" could as easily be ddos ("zwil") or spam. > I've been thinking how to use ICMP to signal different types of > responses; and even how "smart" edges on both ends of a communication > could establish and enforce policies. Most of these are non-malicious > communications involving misconfigured systems. Edge communications > avoids problems with the host system, but has problems with multi-path > communications and source validation. the whole end-to-end argument depends on uniform clue distribution for scale.

2 1

OT: CPAN hacked or fubar'd?
by Eric Germann 28 Sep '03

28 Sep '03

Anyone know whats up with CPAN? http://www.cpan.org points to http://www.netcetera.dk Pointers would be appreciated and also if we can trust the CPAN module to install modules. ========================================================================== Eric Germann CCTec ekgermann(a)cctec.com Van Wert OH 45891 http://www.cctec.com Ph: 419 968 2640 Fax: 603 825 5893 "The fact that there are actually ways of knowing and characterizing the extent of one’s ignorance, while still remaining ignorant, may ultimately be more interesting and useful to people than Yarkovsky" -- Jon Giorgini of NASA’s Jet Propulsion Laboratory

2 2

address harvesting analysis idea
by Peter Galbavy 28 Sep '03

28 Sep '03

While sitting here watching bad TV, I had a thought(tm). Has anyone set-up a generic web-page, not linked from anywhere useful, which autogenerates a "contact e-mail" address (like deadbeef(a)example.com) and logs which IP reads what address (even using the remote IP as the username to provide) and then waits for the address to be used for SPAM ? Is there any use in doing this (to try to identify who is harvesting) ? Maybe I should go and eat some food, cool my head down. Peter

4 3

Did cambrian go to "business hours only" contact/noc numbers?
by alex＠yuriev.com 28 Sep '03

28 Sep '03

Hello, If anyone has a contact number at Cambrian which does not believe that the service that they are providing are supposed to have trouble-reporting capabilities outside 9-5 EDT hours on weekdays, I would greatly appreciate hearing about it. Alex

1 0

Re: Any way to P-T-P Distribute the RBL list
by Stewart, William C (Bill), RTSLS 28 Sep '03

28 Sep '03

Distributing an RBL list is the easy part. There are a variety of methods in place that can provide sufficient reliability and are sufficiently anonymous or difficult to attack, such as Usenet and Freenet and Gnutella and probably Kazaa, and it's not too hard to develop efficient data formats for baseline and incremental update and detail records (easier for IPv4 blocking than IPv6 :-), and you can use PGP or other digital signatures to protect the integrity of the transmission. SMOP... There are some problems with broadcasting the list as opposed to doing transactional interaction - a list of "mis-configured open relays or proxies with updates" is not much different from the spamware spammers' products of list of new still-usable open relays. (It's a bit less useful, because they know that some people are blocking them, but they also know that lots of people aren't.) The other half of the communications process is harder - getting the information on spammers to the list maintainer without exposing the list maintainer to attack. A simple usenet group or IRC channel can be flooded, and email can be mailbombed, and the obvious way to do it is with bogus spam reports to reduce the integrity of the information. And some of it's an arms race, e.g. spammer submits a purported open relay to list-manager the list-manager's tester tests the "relay", and the "relay" captures the tester's IP address for DDOSing. There are spam-reporting reputation systems - Cloudmark and Vipul's Razor do some of that, if imperfectly, or simple subscriber-only systems can stay below the radar (even though they'll have some spammers subscribing...) and you could probably build one that was P2P for a bit more safety.

3 2

RE: Italy: the latest member of the blackout club
by Baldwin, James 28 Sep '03

28 Sep '03

http://news.bbc.co.uk/2/hi/in_depth/3146136.stm James Baldwin > -----Original Message----- > From: Sean Donelan [mailto:sean@donelan.com] > Sent: Saturday, September 27, 2003 11:44 PM > To: nanog(a)merit.edu > Subject: Italy: the latest member of the blackout club > > > > Joining the Northeast parts of the United States and Canada, parts of > Denmark and Sweden; Italy is the latest country to experience widespread > power failure of the electrical grid. > > According to the Italian national electric company ACEA, power is out > in almost the entire country. > > The cause is not known. > >

1 0