February 2004 - NANOG - lists.nanog.org

XO contact.
by John Obi 20 Feb '04

20 Feb '04

Hello, I need someone in XO with clue to contact me off list regarding hacking/exploiting issues. All my mails to noc@ and abuse@ didn't make anything. Thanks, -J __________________________________ Do you Yahoo!? Yahoo! Mail SpamGuard - Read only the mail you want. http://antispam.yahoo.com/tools

1 0

Istanbul / Turkey Area
by frank＠try-us.de 19 Feb '04

19 Feb '04

Hello nanogers, I'm looking for an ISP in the greater area of Istanbul / Turkey with DSL or E1 capabilities. Please contact me off list. Thanks in advance -- Best regards, Frank Kuempel mailto:frank@try-us.de If it's there and you can see it - it's REAL If it's there and you can't see it - it's TRANSPARENT If it's not there and you can see it - it's VIRTUAL If it's not there and you can't see it - it's GONE

1 0

Re: Clueless service restrictions (was RE: Anti-spam System Idea)
by Dr. Jeffrey Race 19 Feb '04

19 Feb '04

On Wed, 18 Feb 2004 13:06:05 -0500, Valdis.Kletnieks(a)vt.edu wrote: >Any real solution is going to have to deal with the fact that properly >administered systems are in the distinct minority. You shut the mal-administered systems of from the internet until they are no lnger a threat to the internet, just as you quarantine ill persons who are dangers to the community. Solving the spam and security problems requires nothing more, and nothing less. The identities of chronically mal-administered systems are well know. There are some practical implementation problems at the margin but for (I am guessing) 95% of the cases, it is trivially easy. Jeffrey Race

2 1

Equinix 350 E. Cermak - Contact Please
by Eric Kuhnke 19 Feb '04

19 Feb '04

Will an employee of the Equinix corporation please contact me off-list? This is regarding equipment delivery issues at 350 E. Cermak.

2 1

Anti-spam System Idea
by Tim Thorpe 19 Feb '04

19 Feb '04

I wanted to run this past you to see what you thought of it and get some feedback on pro's and cons of this type of system. I have been thinking recently about the ever increasing amount of spam that is flooding the internet, clogging mail servers, and in general pissing us all off. I think it time to do something about it. very few systems are effective at blocking spam at the server level, and the ones that exist have a less then stellar reputation and are not very effective on top of that. 95% of spam comes through relays and its headers are forged tracking an E-mail back that you've received is becoming next to impossible, its also very time consuming and why waste your time on scumbags? my idea; a DC network that actively scans for active relays and tests them, it compiles a list on a daily basis of compromised IP addresses (or even addresses that are willingly allowing the relay) making this list freely available to ISPs via a secure and tracked site. to test a relay you actually have to send mail through it, I have a solution for this as well, the clients are set to e-mail a certain address that changes daily the E-mails are signed with a crypto key to verify authenticity (that way spammers can't abuse the address if it doesn't have the key, it get canned) work with ISP's to correct issues on their network help completely black list IP's from their network that are operating as an open relay and redirect to a page that alerts them of the compromise and solutions to fix the problem. the only way people are going to become aware of security issues such as this is if something happens that wakes them up, if they can't access a % of the web it would hopefully clue them in. because these scans only need to take place once per IP per day and over a large distribution of computers performing the tests, I don't see network load becoming a big issue, no bigger then it currently is. the only way to fight spammers is to squeeze them out of hiding, and that's what I hope this system would be designed to do. I do not have the coding knowledge to do this I will need coders, I do have the PR skills to work with ISPs. I am also working with my congresswoman to pave the way for legal clearance for this program. I would greatly appreciate your input on this and anything I may have overlooked. I would also like to know if this would be a DC program you would run. a lot of people argue the practical application of DC. although we know differently this project would show them what DC can do for them and wake them up to perhaps other DC projects.

36 65

80/udp floods?
by Scott Call 19 Feb '04

19 Feb '04

I apologize for the potentially obvious question, but I've been through sf, google, etc and can't find anything. I have a customer that is currently getting several hundred thousand packets per second sent to them on 80/udp. /etc/services lists 80/udp as IANA assigned for http but I've never seen a udp implementation of http so I'm assuming it's a sneaky DOS/DDOS of some kind. ACL's seem to work to catch it but I'm curious if anyone has seen this specific attack (80/udp) before. Thanks -Scott -- Scott Call Router Geek, ATGi, home of $6.95 Prime Rib I make the world a better place, I boycott Wal-Mart VoIP incoming: +1 360-382-1814

4 3

firstam.com contact
by Jonathan Nichols 19 Feb '04

19 Feb '04

Greetings, Could someone from First American get in touch with me off list? There seems to be a malfunctioning mail server in the firstam.com domain.. Thanks, Jonathan

1 0

Cogeco Cable listening?
by Christopher Chin 18 Feb '04

18 Feb '04

Howdy, If someone from Cogeco.net (AS7992) is onboard, please contact me off-list. Thanks, - Christopher ======================

1 0

Problems on ATDN this evening?
by Chris Horry 18 Feb '04

18 Feb '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Could a clueful person at ATDN (I've totally given up on Tech Support who seem to think it's an Internet Explorer issue...) tell me who I'm to call to get sensible technical support? :) I don't think this is an issue clearning my IE cache will resolve: Sample traceroute: traceroute to www.yahoo.akadns.net (216.109.118.67), 30 hops max, 38 byte packets: ~ 1 [censored] ~ 2 10.104.208.1 (10.104.208.1) 33.261 ms 19.641 ms 9.481 ms ~ 3 pos0-1.orldfldltn-rtr1.cfl.rr.com (24.95.226.113) 10.082 ms 7.719 ms 7.483 ms ~ 4 srp2-0.orldflwrpk-rtr2.cfl.rr.com (24.95.224.73) 17.200 ms 10.182 ms 12.921 ms ~ 5 srp4-0.orldfldvsn-rtr4.cfl.rr.com (24.95.224.10) 32.796 ms 21.182 ms 23.678 ms ~ 6 pop1-tby-P0-2.atdn.net (66.185.136.173) 17.532 ms 16.125 ms 17.136 ms ~ 7 bb1-tby-P0-2.atdn.net (66.185.136.164) 30.288 ms 14.761 ms 16.735 ms ~ 8 bb2-atm-P7-0.atdn.net (66.185.152.245) 46.710 ms 32.990 ms 32.029 ms ~ 9 pop1-atm-P4-1.atdn.net (66.185.150.3) 34.682 ms 34.601 ms 32.156 ms 10 CandW-atm.atdn.net (66.185.150.14) 563.166 ms 546.645 ms 533.035 ms 11 dcr1-so-4-3-0.Atlanta.cw.net (208.172.75.109) 554.113 ms 545.217 ms 560.184 ms . . . . . 17 p4.www.dcn.yahoo.com (216.109.118.67) 576.579 ms 528.573 ms 547.647 ms Apologies to the list if this is off topic. Chris - -- Chris Horry "Winter is the season in which people zerbey(a)wibble.co.uk try to keep the house as warm as it was PGP: DSA/2B4C654E it was in the summer, when they complained Amateur Radio: KG4TSM about the heat" --Author Unknown -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFAMrkYnAAeGCtMZU4RAlP2AJ9Qfps4HpsPAFmZVRuauS75Aa2fZwCeMI2I TZ+vJ/w404jwLAqL9IVzfew= =T8HW -----END PGP SIGNATURE-----

2 1

BGP - weight
by Sven Huster 18 Feb '04

18 Feb '04

Hello Dumb question: If I apply a equal weight to all our transit/peers, will that affect route announcements to iBGP or eBGP peers anyhow? We got a very simple setup: - 2 routers on the border to transit/peers (that's were i want to set the weight) - 1 edge router to customers - core router running BGP as well What I want to achieve is that traffic leaves through the border router it arrived, rather than have it bounced around. We had some recent issues were it looks like the core got "out of sync" with the border (looks more like a sw issue than just convergence delay) and packets bounced back and forth between them. I know this doesn't solve the cause but the before digging for the initial reason I want a quick workaround. Cheers Sven

4 10