September 2010 - NANOG - lists.nanog.org

Re: What must one do to avoid Gmail's retarded non-spam filtering?
by Erik L 29 Sep '10

29 Sep '10

Google appears to have blacklisted our domain. From the edge MTA, I sent three messages, differing only in the From header: 1. valid email @klssys.com 2. valid email @caneris.com 3. abc123(a)caneris.com 1 not spam; 2 & 3 spam Return-Path of all three was still another address @caneris.com and the two SPF passed headers were still there. The body & subject of all messages was simply "testing5". The recipient even clicked on "not spam" on #2 prior to #3 being sent. At least it explains why all the other standard stuff we all looked at didn't explain the issue. The next (and last) question is: does anyone have a clueful Google mail ops contact? Thanks again for all the help and sorry for the OT noise. Erik ----- Original Message ----- From: "Erik L" <erik_list(a)caneris.com> To: "William Pitcock" <nenolod(a)systeminplace.net> Cc: nanog(a)nanog.org Sent: Tuesday, September 28, 2010 7:17:45 PM Subject: Re: What must one do to avoid Gmail's retarded non-spam filtering? Hi William, I do so for our entire IP space on a regular basis. The edge MTA I mentioned in the reply to Bill shows up as "Neutral" there. Thanks Erik ----- Original Message ----- From: "William Pitcock" <nenolod(a)systeminplace.net> To: "Erik L" <erik_list(a)caneris.com> Cc: nanog(a)nanog.org Sent: Tuesday, September 28, 2010 6:06:49 PM Subject: Re: What must one do to avoid Gmail's retarded non-spam filtering? Hi, Have you checked the IronPort reputation scores for your mailserver IPs? Google uses this data as part of it's spam detection method. William On Tue, 2010-09-28 at 16:15 -0400, Erik L wrote: > I realize that this is somewhat OT, but I'm sure that others on the > list encounter the same issues and that at least some folks might have > useful comments. > > An increasingly large number of our customers are using Gmail or > Google Apps and almost all of our OSS/BSS mail is getting spam > filtered by Google. Among others, these e-mails include invoices, > order confirmations, payment notifications, customer portal logins, > and tickets. Almost anything we send to customers on Google ends up in > their spam folder. This results in a lot of calls and makes much of > our automation pointless, never mind all the lost sales. > > The problem is compounded by those who use mail clients and do not log > in to the webmail at all, since they would never see the contents of > the Google spam folder. > > We have proper A+PTR records on the edge MTAs, proper SPF records for > the originating domain, proper Return-Path and other headers, and so > on. There isn't anything that I can think of other than the content > itself which would be abnormal, and obviously the content is > repetitive and can't be changed much. Is there something obvious which > we've missed? > > Aside from the following clearly impractical solutions, what can we > do? 1. Asking everyone (including those we don't even know yet) to > whitelist all of our addresses, to check their spam folders, and to > click on "this is not spam" > 2. Providing our own free e-mail service to everyone (including those > we don't even know yet) and putting up "don't use Google" ads on all > of our customer-facing systems > > At least this isn't Hotmail where mail is just silently deleted with > no NDR after it's accepted by their MTAs. > > The call volume has been going up instead of down lately and it's > gotten to the point where we're sending MTA log extracts to people to > prove to them that we really did e-mail them. > > Would greatly appreciate any advice. > > Erik >

3 2

Software-based Border Router
by Nathanael C. Cariaga 29 Sep '10

29 Sep '10

Hi All! Just want to ask if anyone here had experience deploying software-based routers to serve as perimeter / border router? How does it gauge with hardware-based routers? Any past experiences will be very much appreciated. I wanted to know because we've been asked if we want to assume full control of the internet link (up to the router). By assuming control up to the router, we still want to configure iBGP with our parent network so that we can take advantage of some routes available to the parent network's gateway. The saddest part is presently we do not have the router to serve as our gateway this is why we are considering the use of software-based routers. Thank you.

18 26

Randy in Nevis
by Rudolph Daniel 29 Sep '10

29 Sep '10

Dont know if this may assist, but here is another from St Vincent...lime network. Sunday 19th sep. 2010 http://n1.netalyzr.icsi.berkeley.edu/summary/id=43ca253f-6714-b0f7e7b0-d08e… RD

16 25

AS10392 -- Hijacked?
by Ronald F. Guilmette 29 Sep '10

29 Sep '10

Evidence strongly suggests that AS10392 together with all of the IPv4 space it is currently announcing routes for, i.e.: 192.171.64.0/19 204.137.224.0/19 205.164.0.0/20 205.164.16.0/20 205.164.32.0/20 205.164.48.0/20 have all been hijacked. I will be reporting this formally to ARIN today, via their helpful fraud reporting web form. In the meantime, while this case is being carefully adjudicated by ARIN, some folks may wish to blackhole the above. (The IP space appears to be in use by some sort of snowshoe spamming operation.) Regards, rfg P.S. Connectivity for AS10392 appears to come from only one place: http://www.robtex.com/as/as10392.html#graph

1 0

tagged vs. untagged VLAN
by Jay Nakamura 29 Sep '10

29 Sep '10

In a SP environment, you need to hand off two VLANs to a customer, is there any advantage or disadvantage in doing the following two setups? - One untagged and one tagged VLAN - Two tagged VLAN and no untagged VLAN I can't think of anything other than some equipment may not let you have no untagged VLAN. But it's bugging me that something could go wrong by not having untagged native VLAN that I can't think of.

3 2

Online games stealing your bandwidth
by Rodrick Brown 29 Sep '10

29 Sep '10

I think most people are aware that the Blizzard "World of WarcCraft" patcher distributes files through Bittorrent, however apparently a number of other MMO companies (LotR, Lego) are apparently doing something similar but aren't as upfront about it, and are installing Windows services which seed whenever the computer is online. Game Companies Should Play Fair With P2P | TorrentFreak<http://torrentfreak.com/game-companies-should-play-fair-with-p2p-100901/> If you follow the links in the article people are complaining that the LotR process has served 70gb in a week, others are complaining that the service is resulting in 300ms pings, and unusable connections. This is a very grey area it will be interesting how this issue unfolds in the long run. -- [ Rodrick R. Brown ] http://www.rodrickbrown.com http://www.linkedin.com/in/rodrickbrown

16 19

Requesting assistance from Telia netop (Fwd: Prefix Preference at Level3)
by Jeffrey Lyon 29 Sep '10

29 Sep '10

We're trying to help a downstream customer with an issue and require assistance from a clued Telia netop. The customer is running a GRE tunnel from Los Angeles to Brazil for international transit and needs to avoid carrying local traffic over the tunnel. He is requesting a pref of > 150 for Level3 prefixes. We sent a request to carrier-csc(a)teliasonera.com and here is the response we received: > We do not manipulate the prefixes that comes to us from peers. Customer may configure this on their side, but peers are always set to 150. > Please do not hesitate to contact us is you have any questions, we will close our ticket in 4 hours. Hoping to get ahold of someone at Telia with a much higher degree of awesome than this. -- Jeffrey Lyon, Leadership Team jeffrey.lyon(a)blacklotus.net | http://www.blacklotus.net Black Lotus Communications - AS32421 First and Leading in DDoS Protection Solutions

1 0

Re: LISP Works - Re: Facebook Issues/Outage in Southeast?
by Scott Weeks 29 Sep '10

29 Sep '10

On Sep 23, 2010, at 5:50 PM, "Scott Weeks" <surfer(a)mauigateway.com> wrote: > --- jared(a)puck.nether.net wrote: > It's working over LISP: > > http://www.lisp4.facebook.com/ > ------------------------------------- > > LISP as in Locator/ID Separation Protocol? ------------------------------------------- --- jared(a)puck.nether.net wrote: From: Jared Mauch <jared(a)puck.nether.net> Yes. --------------------------------- Wow, that's cool. I didn't know LISP had progressed that far... scott

3 3

Re: Online games stealing your bandwidth
by Richard Barnes 28 Sep '10

28 Sep '10

There's some standardization work being done in the IETF ALTO working group. They're looking at ways ISPs can inform P2P clints about which peers are "better", I.e., topologically nearby. http://tools.ietf.org/wg/alto/ I'm less familiar with DECADE, but I believe they're working on more directly cache-related stuff. http://tools.ietf.org/wg/decade/ On Sep 25, 2010 4:44 PM, "Matthew Walster" <matthew(a)walster.org> wrote: On 25 September 2010 21:16, Rodrick Brown <rodrick.brown(a)gmail.com> wrote: > I think most people are... <snip> I once read an article talking about making BitTorrent scalable by using anycasted caching services at the ISP's closest POP to the end user. Given sufficient traffic on a specified torrent, the caching device would build up the file, then distribute that direct to the subscriber in the form of an additional (preferred) peer. Similar to a CDN or Usenet, but where it was cached rather than deliberately pushed out from a locus. Was anything ever standardised in that field? I imagine with much of P2P traffic being (how shall I put this...) less than legal, it's of questionable legality and the ISPs would not want to be held liable for the content cached there? M

6 12

Re: AS11296 -- Hijacked?
by Heath Jones 28 Sep '10

28 Sep '10

He blocked google mail? WTF? ---------- Forwarded message ---------- From: Mail Delivery Subsystem <mailer-daemon(a)googlemail.com> Date: 28 September 2010 20:49 Subject: Delivery Status Notification (Failure) To: hj1980(a)gmail.com Delivery to the following recipient failed permanently: rfg(a)tristatelogic.com Technical details of permanent failure: Google tried to deliver your message, but it was rejected by the recipient domain. We recommend contacting the other email provider for further information about the cause of this error. The error that the other server returned was: 550 550 5.7.1 <mail-qy0-f176.google.com[209.85.216.176]>: Client host rejected: Domain google.com BLACKLISTED - Use http://www.tristatelogic.com/contact.html (state 14). ----- Original message ----- MIME-Version: 1.0 Received: by 10.224.62.217 with SMTP id y25mr308053qah.193.1285703359508; Tue, 28 Sep 2010 12:49:19 -0700 (PDT) Received: by 10.229.226.204 with HTTP; Tue, 28 Sep 2010 12:49:12 -0700 (PDT) In-Reply-To: <63619.1285701703(a)tristatelogic.com> References: <63619.1285701703(a)tristatelogic.com> Date: Tue, 28 Sep 2010 20:49:12 +0100 Message-ID: <AANLkTi=qX7cX4F3Y_AZ803WdPmKMTC_hZZPsmdqS1v3r(a)mail.gmail.com> Subject: Re: AS11296 -- Hijacked? From: Heath Jones <hj1980(a)gmail.com> To: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> Cc: nanog(a)nanog.org Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Out of curiosity, what led you to this conclusion? > Evidence strongly suggests that AS11296 together with all of the IPv4 > space it is currently announcing routes for, i.e.: > have all been hijacked. I will be reporting this formally to ARIN today, > via their helpful fraud reporting web form.

2 1