April 2007 - NANOG - lists.nanog.org

Localized Root Servers in Europe?
by Martin Hannigan 09 Apr '07

09 Apr '07

"Furthermore, at least one large ISP in Europe is doing the same thing, redirecting root server traffic to their own servers." http://www.circleid.com/posts/submit_comment/splitting_root_too_late/ "Furthermore, at least one large ISP in Europe is doing the same thing, redirecting root server traffic to their own servers. " Which large European operator has implemented this solution? I would love to see a talk at the next NANOG about how this works and how it performs. Best Regards, Martin (Note: Article quote slightly out of context. I tried to keep it to what may be on topic here..)

2 2

RE: Blocking mail from bad places
by Scott Weeks 08 Apr '07

08 Apr '07

--- michael.dillon(a)bt.com wrote:---------------- > Hey, you've just described the FUSSP! :-( Solution!? Since when is a description of one aspect of the problem, considered to be the solution. In a nutshell I said that the email SPAM problem is getting worse, not just measured by SPAM volumes or number of new SPAM techniques, but measured by the number of people turning to non-email communications channels. ------------------------------------------------- Part of what you said was this: > : Soon Internet email will be like IRC, a quaint > : service for Internet enthusiasts and oldtimers, > : but not a useful tool for businesses or ordinary > : individuals. What I meant was: when only a few folks use email, the spammers will go away. Like parasites on a dead animal body. The spammer-parasites will find something else to devour. Besides, it was just a joke. I should've turned my smiley around. ;-) scott

14 20

Re: Abuse procedures... Reality Checks
by Fergie 08 Apr '07

08 Apr '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Chris Owen <owenc(a)hubris.net> wrote: >On Apr 7, 2007, at 11:00 PM, Fergie wrote: > >> I would think that it's actually very easy to do when >> sub-allocations are SWIP'ed. > >Not that I'm really defending this policy, but sub-allocations are very often not SWIPed. I'd say 75% or more of the time I'm looking a problem IP address it is part of a /19 or larger block with no sub- allocation. > Please read what I wrote: "I would think that it's actually very easy to do when sub-allocations are SWIP'ed." I cannot, and will not, presuppose that in cases when they are not SWIP'ed that some kind of magic happens. :-) - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj8DBQFGGCw4q1pz9mNUZTMRAgEDAKCB4eiFluFcXcYlSj4EjleHpxy8PgCg26ei sZW4CKfCOm5H3KOGQsxYd8w= =ZoDl -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

3 2

RE: Abuse procedures... Reality Checks
by Frank Bulk 08 Apr '07

08 Apr '07

I guess our upstream provider is a nobody because they have lots of small sub-allocated blocks less than a /24 that they route to different member ISPs. =) What is the point of blocking a /24 on the basis of a /32 if the ISP manages dozens of other /24 or larger blocks? If you're going to do it, block *all* the IPs associated to the 'bad' ISP. Then at least you're consistent, otherwise expanding to a /24 is just a half (or 1%) job or laziness. Frank -----Original Message----- From: Frank Bulk Sent: Saturday, April 07, 2007 10:45 PM To: nanog(a)nanog.org Subject: Re: Abuse procedures... Reality Checks >> Sure, block that /29, but why block the /24, /20, or even /8? Since nobody will route less than a /24, you can be pretty sure that regardless of the SWIPs, everyone in a /24 is served by the same ISP. I run a tiny network with about 400 mail users, but even so, my semiautomated systems are sending off complaints about a thousand spams a day that land in traps and filters. (That doesn't count about 50,000/day that come from blacklisted sources that I package up and sell to people who use them to tune filters and look for phishes.) I log the sources, when a particular IP has more than 50 complaints in a month I usually block it, if I see a bunch of blocked IP's in a range I usually block the /24. Now and then I get complaints from users about blocked mail, but it's invariably from an individual IP at an ISP or hosting company that has both a legit correspondent and a spam-spewing worm or PHP script. It is quite rare for an expansion to a /24 to block any real mail. My goal is to keep the real users' mail flowing, to block as much spam as cheaply as I can, and to get some sleep. I can assure you from experience that any sort of automated RIR WHOIS lookups will quickly trip volume checks and get you blocked, so I do a certain number manually, typically to figure out how likely there is to be someone reading the spam reports. But on today's Internet, if you want to get your mail delivered, it would be a good idea not to live in a bad neighborhood, and if your ISP puts you in one, you need a better ISP. That's life. Regards, John Levine, johnl(a)iecc.com, Primary Perpetrator of "The Internet for Dummies", Information Superhighwayman wanna-be, http://www.johnlevine.com, ex-Mayor "More Wiener schnitzel, please", said Tom, revealingly.

1 0

Re: Abuse procedures... Reality Checks
by Fergie 08 Apr '07

08 Apr '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Chris Owen <owenc(a)hubris.net> wrote: >On Apr 8, 2007, at 2:51 AM, Fergie wrote: > >> Again, a simple recursive WHOIS will show you sub-allocations if they >> are properly SWIP'ed. > >Define "properly". The Cox addresses in my example are SWIPed. Are they "properly" SWIPed? How could you tell from whois? > Are is/are the exact prefix(es) in question? - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj8DBQFGGGJtq1pz9mNUZTMRAqEvAKDc2heZ5tTCZPkJXP1BkKiCQbjpwACg5+kA aMVT4/A79/VEZR8rKVv+AcY= =KafZ -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: Abuse procedures... Reality Checks
by Fergie 08 Apr '07

08 Apr '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Chris Owen <owenc(a)hubris.net> wrote: >On Apr 7, 2007, at 11:41 PM, Fergie wrote: > >> Please read what I wrote: >> >> "I would think that it's actually very easy to do when >> sub-allocations are SWIP'ed." >> >> I cannot, and will not, presuppose that in cases when they are >> not SWIP'ed that some kind of magic happens. :-) > >And how do you know the difference? The Cox IP address is SWIPed. Its even sub-allocated. The allocation is just a /19. > Again, a simple recursive WHOIS will show you sub-allocations if they are properly SWIP'ed. Not a big deal, really. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj8DBQFGGFiiq1pz9mNUZTMRArfSAJ9X5CMo0M+Tg0Tf1vN2UWytF3oB8gCg/TEH fP3GwH7aW3J7DeNpH3m/aeY= =VQ9W -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Re: Abuse procedures... Reality Checks
by Fergie 07 Apr '07

07 Apr '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Stephen Satchell <list(a)satchell.net> wrote: >It's *very* hard to do it with an automated system, as such automated look-ups are against the Terms of Service for every single RIR out there. > Exactly why is this hard to do? I would think that it's actually very easy to do when sub-allocations are SWIP'ed. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj8DBQFGGCKUq1pz9mNUZTMRAq6gAJ4ve8lc4IBU9nt0C5BEQDOfcPYZUgCgxExW Nio0yTd77qAjI10oOsv2Vh4= =d5Jd -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Re: Abuse procedures... Reality Checks
by Fergie 07 Apr '07

07 Apr '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "william(at)elan.net" <william(a)elan.net> wrote: >On Sat, 7 Apr 2007, Fergie wrote: > >> I would have to respectfully disagree with you. When network >> operators do due diligence and SWIP their sub-allocations, they >> (the sub-allocations) should be authoritative in regards to things >> like RBLs. > >Yes. But the answer is that it also depends how many other cases like >this exist from same operator. If they have 16 suballocations in /24 >but say 5 of them are spewing, I'd block /24 (or larger) ISP block. Why? When you can block on more specific prefixes? This just doesn't make sense to me. >The exact % of bad blocks (i.e. when to start blocking ISP) depends >on your point of view and history with that ISP but most in fact do >held ISPs partially responsible. Indeed -- your point of view. Which I would argue is unfair and not "due diligence". - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj8DBQFGGBv8q1pz9mNUZTMRAuufAKC+/0DwFmrVA15UZaNib02GgR25MgCdFlu3 45XhfZTvgE+Oaiij4LoLNh0= =MO1u -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

RE: GoDaddy's abuse procedures [was: ICANNs role [was: Re: On-going ...]]
by Frank Bulk 07 Apr '07

07 Apr '07

While you have your friend's ear, ask him why they maintain a spam policy of blocking complete /24's when: a) the space has been divided into multiple sub-blocks and assigned to different companies, all well-documented and queryable in ARIN b) there have been repeated pleas to whitelist a certain IP in separate sub-block that is only being punished for the behavior of others in a different sub-block. Frank -----Original Message----- Sent: Tuesday, April 03, 2007 8:20 AM To: 'nanog(a)nanog.org' Cc: 'don(a)calis.blacksun.org' Subject: Re: ICANNs role [was: Re: On-going ...] >I think the shutdown of seclists.org by GoDaddy is a perfect example of >exactly why the registrars should NOT be making these decisions. I know the head abuse guy at Godaddy. He is a reasonable person. He turns off large numbers of domains but he is human and makes the occasional mistake. The fact that everyone cites the same mistake tells me that he doesn't make very many of them. If you demand that the shutdown process be perfect and never make any mistakes ever, even ones that involve peculiar e-mail failures are are fixed in a day or two, you're saying there can't be any shutdown process at all. >If you want a really simple, and probably very effective first step- >then stop domain tasting. It doesn't help anyone but the phishers. Actually, I have never seen any evidence that phishers use domain tasting. Phishers use stolen credit cards, so why would they bother asking for a refund? The motivation for tasting is typosquatting and "monetization", parking web pages full of pay per click ads on them. Tasting is a bad idea that should go away, but phishing isn't the reason. R's, John

5 6

RE: On-going Internet Emergency and Domain Names
by Frank Bulk 07 Apr '07

07 Apr '07

One of the reasons that registrars are slow to take down sites that are paid with a credit card is because there is little financial incentive to do so....they've lost money it already, why have a department whose priority is speed if you can hire a person to do it at their own pace and minimize the loss? For almost all things prudent and effective there needs to be a financial incentive. For those registrars who take stolen credit cards, it's the rates and fees they are charged to process credit card transactions. It appears the rates that are charged and the penalties assessed aren't enough to dissuade them from these fraudulent transactions, which means that the monetary externalities of DNS registration abuse (spam, phishing sites, etc) are not fully assessed by financial institutions. We have a similar parallel in the cost of gasoline and the impact on the environment. Frank -----Original Message----- Sent: Monday, April 02, 2007 9:36 PM To: David Conrad Cc: Joseph S D Yao; nanog Subject: Re: On-going Internet Emergency and Domain Names On Mon, 2 Apr 2007, David Conrad wrote: > > > On Apr 2, 2007, at 7:12 PM, Joseph S D Yao wrote: > > On Mon, Apr 02, 2007 at 05:33:08PM -0700, David Conrad wrote: > >> I think this might be a bit in conflict with efforts registries have > >> to reduce the turnaround in zone modification to the order of tens of > >> minutes. > > > > Why is this necessary? Other than the cool factor. > > I think the question is "why should the Internet be constrained to > engineering decisions made in 1992?" or victims of policy of that same 'vintage'... doing things faster isn't bad, doing it with less checks and balances and more people willing to abuse the lack of checks/balances seems like a bad idea. If you can get a domain added to the system fresh in 5min or less, why does it take +90 days to get it removed when all data about the domain is patently false and the CC used to purchase the domain was reported stolen 2+years ago? I don't mean to pick on anyone in particular, but wow, to me this seems like just a policy update requirement.

2 1