February 2004 - NANOG - lists.nanog.org

Re: antivirus in smtp, good or bad?
by Daniel Senie 03 Feb '04

03 Feb '04

At 08:58 AM 2/3/2004, you wrote: >Hi, > When investigating our mail queue it seems we have quite a lot of mails > which >are stuck in transit... > >Whats happening is we're accepting the mail as the primary MX for the >domain but >the user has setup a forwarding to another account at another ISP, they have >antivirus service on that other account. So we get the mail, spool it and >try to >forward it but then we get a "550 Error: Suspected W32/MyDoom@MM virus" after >DATA and our server freezes the mail. Hmmm, well, we certainly kick back virus-laden stuff this way. The alternatives are: 1) kick it back during SMTP. 2) drop it on the floor. or, the third option, which is EXCEEDINGLY BROKEN, 3) send a bounce to the From: address in the email. Because of spoofed sender addresses, this then goes to the wrong person, freaks out innocent, non-infected people and raises everyone's support costs. >Surely this is an incorrect way to do this as there will be lots of >similar MXs >like ours backing this mail up? They should accept the mail and then >bounce it? Why must systems accept mail that's virus laden or otherwise not desired at a site? The "bounce" you refer to invariably ends up going to the wrong person(s), so that's an exceptionally BAD idea. Many viruses (most of the recent ones) forge the sender information. So either accepting and silently dropping, or rejecting the SMTP session with a 55x are the only viable choices.

5 8

Re: [OT] Need Comcast Contact
by Tim Wesemann 03 Feb '04

03 Feb '04

> Well sure, they are sent on a date that doesn't exist. Feb 31 can never > happen. Pardon, that should have read Sunday, Feb 01 2004 AD (Chinese year of the monkey). =] -- Tim Wesemann Voicenet Systems Administration

1 0

does your ISP need more peering?
by Matthew Kaufman 03 Feb '04

03 Feb '04

A nationwide ISP I work with has decided to switch to all-transit, no-peering. They are interested in finding someone to buy or take over: an AS number, routers (and in some cases rack space) at MAE ATM East, PAIX Virginia, NYIIX, AADS NAP, MAE ATM West, and PAIX Palo Alto, along with the existing peering that is up at those (close to 200 BGP sessions total). If you're interested, please contact me directly and I will forward your inquiry in the correct direction. Note that my mailbox is protected by TMDA. Matthew Kaufman matthew(a)eeph.com ps. Please also direct flames about this being non-operational content directly to me as well... there's just not a lot of lists where names of NAPs and the concept of existing peers makes sense to anyone.

1 0

[OT] Need Comcast Contact
by Tim Wesemann 03 Feb '04

03 Feb '04

Emails sent *from residential comcast subscribers* to any '@voicenet.com' address have been disappearing in the Comcast network since Sunday, Feb 31. There are no bounces or errors of any kind. Mail sent directly to other domains with the same MX record and even to individual machines within the MX record themselves work fine, it is only when the envelope recipient states /^.*(a)voicenet\.com$/ does the mail simply disappear (i.e. mail sent to "someuser(a)voicenet.com" disappears while mail sent to "someuser(a)mail##.voicenet.com" goes through fine as well as "someuser(a)voicenet.net"). My company as well as our customers and Comcast customers have together made many, many phone calls and sent many emails and we cannot get ahold of anyone with any semblance of a clue and nobody seeems to have the ability to put us in contact with anyone in your systems and/or network admins (level 1-3 techs, managers and even "case resolution specialists"). Can someone please contact me off-list in regards to this situation? Has anyone else had similar problems? Thanks. -- Tim Wesemann Voicenet Systems Administration

1 0

RE: Strange public traceroutes return private RFC1918 addresses
by Michael.Dillon＠radianz.com 03 Feb '04

03 Feb '04

>> A more important question is what will happen as we move out >> of the 1500 byte Ethernet world into the jumbo gigE world. It's >> only a matter of time before end users will be running gigE >> networks and want to use jumbo MTUs on their Internet links. >The performance gain achieved by using jumbo frames outside of very >specific LAN scenarios is highly questionable, Did I say anything about performance? In any case, a lot of packets on the Internet have to traverse LANs at either edge and if jumbo packets can help on the LAN then people will use them. >and they're still not standardized. Precisely my point. We can do jumbo MTUs of various sizes today but we need to discuss some standard ways of setting these MTUs so that we avoid MTU bottlenecks in the core. That way PMTUD will continue to be a non-issue. > Are "jumbo" Internet MTUs seen as a pressing issue by >ISPs and vendors these days? Some people like to do forward planning instead of waiting until an issue hits them in the face. By definition, forward planning will never be dealing with pressing issues. --Michael Dillon

1 0

Strange public traceroutes return private RFC1918 addresses
by Brian (nanog-list) 03 Feb '04

03 Feb '04

Any ideas how (or why) the following traceroutes are leaking private RFC1918 addresses back to me when I do a traceroute? Maybe try from your side of the internet and see if you get the same types of responses. It's really strange to see 10/8's and 192.168/16 addresses coming from the public internet. Has this phenomenon been documented anywhere? Connectivity to the end-sites is fine, it's just the traceroutes that are strange. (initial few hops sanitized) [brian@testbox1 /]# traceroute www.ibm.com traceroute: Warning: www.ibm.com has multiple addresses; using 129.42.17.99 traceroute to www.ibm.com (129.42.17.99), 30 hops max, 38 byte packets 1 (---.---.---.---) 2.481 ms 2.444 ms 2.379 ms 2 (---.---.---.---) 17.964 ms 17.529 ms 17.632 ms 3 so-1-2.core1.Chicago1.Level3.net (209.0.225.1) 17.891 ms 17.985 ms 18.026 ms 4 so-11-0.core2.chicago1.level3.net (4.68.112.194) 18.272 ms 18.109 ms 17.795 ms 5 so-4-1-0.bbr2.chicago1.level3.net (4.68.112.197) 17.851 ms 17.859 ms 18.094 ms 6 so-3-0-0.mp1.stlouis1.level3.net (64.159.0.49) 23.095 ms 22.975 ms 22.998 ms 7 ge-7-1.hsa2.stlouis1.level3.net (64.159.4.130) 23.106 ms 23.237 ms 22.977 ms 8 unknown.level3.net (63.20.48.6) 24.264 ms 24.099 ms 24.154 ms 9 10.16.255.10 (10.16.255.10) 24.164 ms 24.108 ms 24.105 ms 10 * * * [brian@testbox1 /]# traceroute www.att.net traceroute: Warning: www.att.net has multiple addresses; using 204.127.166.135 traceroute to www.att.net (204.127.166.135), 30 hops max, 38 byte packets 1 (---.---.---.---) 2.404 ms 2.576 ms 2.389 ms 2 (---.---.---.---) 17.953 ms 18.170 ms 17.435 ms 3 500.pos2-1.gw10.chi2.alter.net (63.84.96.9) 18.077 ms * 18.628 ms 4 0.so-6-2-0.xl1.chi2.alter.net (152.63.69.170) 18.238 ms 18.321 ms 18.213 ms 5 0.so-6-1-0.BR6.CHI2.ALTER.NET (152.63.64.49) 18.269 ms 18.396 ms 18.329 ms 6 204.255.169.146 (204.255.169.146) 19.231 ms 19.042 ms 18.982 ms 7 tbr2-p012702.cgcil.ip.att.net (12.122.11.209) 20.530 ms 20.542 ms 23.033 ms 8 tbr2-cl7.sl9mo.ip.att.net (12.122.10.46) 26.904 ms 27.378 ms 27.320 ms 9 tbr1-cl2.sl9mo.ip.att.net (12.122.9.141) 27.194 ms 27.673 ms 26.677 ms 10 gbr1-p10.bgtmo.ip.att.net (12.122.4.69) 26.606 ms 28.026 ms 26.246 ms 11 12.122.248.250 (12.122.248.250) 27.296 ms 28.321 ms 28.997 ms 12 192.168.254.46 (192.168.254.46) 28.522 ms 30.111 ms 27.439 ms 13 * * * 14 * * *

7 7

Re: updated root hints file
by Doug Barton 03 Feb '04

03 Feb '04

Randy Bush wrote: > let's face it. we should be looking at the front page > of the <http://iana.org/> site to find root hints. there > we find <http://www.iana.org/domain-names.htm>, which seems > to be missing a link to the signed root hints. > > iana, could you please fix that? thanks. Good idea. I had that in mind along with some other changes for later this quarter, but given the amount of attention this topic is generating, I'll try to get something up asap. Thanks, Doug -- Doug Barton General Manager, The Internet Assigned Numbers Authority

1 0

wildly successful
by bill 03 Feb '04

03 Feb '04

so... funding found. nanog bound. ... hotel sold out? wow! --bill

1 0

Unbelievable Spam.
by Ejay Hire 03 Feb '04

03 Feb '04

Personally, I don't like spam, but I tolerate the messages that slip through to my mailbox as a penalty for my own laziness in not tightening down my spam rules. Today I got one that I couldn't believe. --snip-- Spam Hosting - from 20$ per mounth. Fraud Hosting - from 30$ per mounth. Stoln Credit Cards, Fake ID, DL's. Spam For free only from 1.02.2004 to 5.02.2004. --snip-- It's just wrong in my opinion, and exacerbated by the fact that it was spammend to our abuse account. Their /24 just fell off of my piece of the internet. Have I just been blind to this all along, or are the spammers getting bolder? -Ejay

8 8

Re: Need abuse contact for Yahoo Hostinng
by Christopher X. Candreva 02 Feb '04

02 Feb '04

On Mon, 2 Feb 2004, Barnabas Toth wrote: > Maybe you should try to contact AOL abuse instead? I know, I know... Just > a though. Thanks to those who replied. I've been contacted directly by an AOL rep (who the site pretended to be), and an FBI agent. Interestingly not a peep from Yahoo. Sigh. ========================================================== Chris Candreva -- chris(a)westnet.com -- (914) 967-7816 WestNet Internet Services of Westchester http://www.westnet.com/

1 1