April 2005 - NANOG - lists.nanog.org

Re: Schneier: ISPs should bear security burden
by Fergie (Paul Ferguson) 27 Apr '05

27 Apr '05

And you're a network engineer. What's your point? - ferg -- Mark Newton <newton(a)internode.com.au> wrote: On Tue, Apr 26, 2005 at 10:38:00PM -0700, Owen DeLong wrote: > So much for any sort of journalistic ethic, fact checking, or, unbiased > reporting. Schneier isn't a journalist or reporter; He's a security vendor. - mark -- Mark Newton Email: newton(a)internode.com.au (W) Network Engineer Email: newton(a)atdot.dotat.org (H) Internode Systems Pty Ltd Desk: +61-8-82282999 "Network Man" - Anagram of "Mark Newton" Mobile: +61-416-202-223 -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Re: Schneier: ISPs should bear security burden
by Fergie (Paul Ferguson) 27 Apr '05

27 Apr '05

Oh, come on Jerry, you're beginning to sound like part of the problem. Stop being a knee-jerking crumudgeon for a moment and thhink about what Schneier is _really_ saying. Being vague, and obfuscating the issue with vague answers doesn't do due diligence. - ferg Jerry Pasker <info(a)n-connect.net> wrote: >I've been there -- I know how I feel about it -- but I'd love >to know how ISP operations folk feel about this. > It means 10 different things to 10 different people. The article was vague. "Security" could mean blocking a few ports, simple Proxy/NAT, blocking port 25 (or 139... or 53.. heh heh) or a thousand different things. There is a market for this, it's called "managed services." ISPs do this type of thing all the time. And customers pay for it. Maybe he means "broadband home users". News flash... home users will get it wherever it's cheap. And cheap means no managed services. To the author of the article: Should ISPs be *REQUIRED* to do it? Just try it and see what happens.... try to pass a law and regulate the internet, I dare you... :-) (I double-dog-dare you to get the law makers to understand it first!) Every security appliance ven-duh on the planet would be in there, trying to have laws written that would require the use of their own proprietary solutions to the "problem." (and the proposed problem would differ depending upon the "solutions" that the particular ven-duh offered) Wait a second... this article was FROM security ven-duhs... all offering solutions to these problems...uh-oh.... this is probably their first move in getting a law..... step 1) cause a public outcry....... so it's starting already. I think we've all seen this act before......... Some days, the world really annoys me. :-( -Jerry -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

NPR program: "The Internet as a public utility"
by Frank Coluccio 27 Apr '05

27 Apr '05

NPR program: "The Internet as a public utility" Talking heads (audio only) http://www.npr.org/templates/story/story.php?storyId=4618769 A worthy listen, imo, focused primarily on municipal wireless nets. With thanks to Tom Hertz of Fiber utilities of Iowa who posted to the Cook Report discussion list. --- Frank A. Coluccio DTI Consulting Inc. New York

1 0

Re: Port 25 - Blacklash
by dlr＠bungi.com 26 Apr '05

26 Apr '05

[In the message entitled "Re: Port 25 - Blacklash" on Apr 26, 17:50, Daniel Golding writes:] > > Do all of Comcast's markets block port 25? Is there a correlation between > spam volume and the ones that do (or don't)? No. Yes. The ones that don't block port 25 emit more spam than the ones that do. > In any event the malware is already ahead of port 25 blocking and is > leveraging ISP smarthosting. SMTP-Auth is the pill to ease this pain/ Correct. And/or rate limiting, by understanding which customers are using which IP addresses (more or less tying the networking infrastructure to the email infrastructure, which is something that many ISP are not yet doing). --

1 0

Re: Port 25 - Blacklash
by dlr＠bungi.com 26 Apr '05

26 Apr '05

[In the message entitled "Re: Port 25 - Blacklash" on Apr 26, 16:30, Valdis.Kletnieks(a)vt.edu writes:] > Comcast.net has 31,923 addresses listed at the moment. > > Do they have 30,000 zombies, or 30,000 customers that post to popular mailing > lists? Quite possibly at least partly the latter, as 24.22.118.199 ranks a 3.0 > and isn't (as far as I know) a spam zombie, but a frequent poster to the > linux-kernel list. Meanwhile, of those 31,923, only 1,969 have a monthly > magnitude of 4.7 or more, the 4.8 cutoff is at 1,567, and the last 4.9 is at > 1,012. And that 4.9 is (roughly) twice as much as I generate... > They have approximately 40,000 zombies (as mesured over all of their ASNs, from 01-JAN to yesterday). Total 277646 7207 1731415 36396 --

2 1

RE: Port 25 - Blacklash
by Hannigan, Martin 26 Apr '05

26 Apr '05

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Paul Ryan > Sent: Tuesday, April 26, 2005 11:11 AM > To: Nanog Mailing list > Subject: FW: Port 25 - Blacklash > Importance: High > > For any educational institutions on this list - what has been > the impact on > your mail services once your ISP started blocking port 25 - > what if any was > the backlash - and how difficult was it to provide > alternatives ...587,465 > etc ... Why would an ISP block port 25 for .edu customers? The universities I'm familiar with have PI space vs PA. Comparatively, that should be the boundary to determine whether to block 25 or not, IMO. -M<

2 1

RE: Port 25 - Blacklash
by Hannigan, Martin 26 Apr '05

26 Apr '05

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Adam Jacob Muller > Sent: Tuesday, April 26, 2005 2:18 PM > To: Eric Gauthier > Cc: Paul Ryan; Nanog Mailing list > Subject: Re: Port 25 - Blacklash > > > > The fact that most people did not complain is not likely due to the > fact that they were not annoyed by the change, but rather > it's easier > to simply get around it than it is to bother complaining to network > admins. > > For example, about 2 months ago, comcast decided to block outgoing > port 25 from my entire neighborhood. I called comcast, and while > sitting on hold I had the idea to setup a ssh tunnel to a machine at > work and viola problem solved before anyone from comcast even > answered the phone. And comcast will happily allow this to be your employers problem i.e. owned, infected, or spamming. Paul was asking about ILG's and the political backlash of blocking off-campus port 25 where the ILG is using an ISP other than their school. (thanks SD, EG, MG, DD) -M<

1 0

Anyone from Verizon familiar with physical plant in PHL
by alex＠yuriev.com 26 Apr '05

26 Apr '05

If, by a fluke of nature, there is a person from Verizon or someone who knows a person from Verizon that can answer a question "Where does this line go?" in a former Bell Atlantic plant in Philadelphia, I would really appreciate an off-list email. Thanks, Alex

1 0

RE: Problems with NS*.worldnic.com
by Graeme Clark 26 Apr '05

26 Apr '05

>I saw some mention of this in a previous thread. Is anyone else still >experiencing problems? We're seeing general slowness and the use of the >truncate bit in responses, forcing to TCP mode. We're still having a wack of issues with all names on NSI nameservers. Poking around at other service provider nameservers out there I'm amazed at how many places things are still resolving, something to be said for ignoring DNS TTLs. :) It's been over 3 days now, so I think I'm going to move what I've still got left with them somewhere else. I'm getting a roughly 10% response rate from their nameservers, and that's probably optimisticly high. Graeme graeme clark | leader, network technologies and services | lavalife corp. toronto | tel 416 263 6300 x 3658 | fax 416 263 6303

7 8

Re: Problems with NS*.worldnic.com
by Christopher L. Morrow 26 Apr '05

26 Apr '05

On Tue, 26 Apr 2005, Brett Frankenberger wrote: > On Tue, Apr 26, 2005 at 01:22:41PM +0000, Christopher L. Morrow wrote: > > > > On Tue, 26 Apr 2005, Simon Waters wrote: > > > > > The worldnic.com and worldnic.net appear to use the YYYYMMDDVV convention for > > > SOA serial numbers, and so it would appear nothing has changed their end in > > > > Interesting, I thought the worldnic.com servers were NSI's 'free hosting > > for domains you registered through us' servers, which would imply they get > > changed 'frequently' no? > > I think he's talking about the worldnic.com and worldnic.net zones > themselves. Those wouldn't need to change unless new names were added yup, this was clarified off-list :( I'll take my pre-coffee lumps on that one :( where is that coffee pot?

1 0