- NANOG - lists.nanog.org

Re: AS11296 -- Hijacked?
by Ronald F. Guilmette 29 Sep '10

29 Sep '10

Heath Jones <hj1980(a)gmail.com> wrote: >Out of curiosity, what led you to this conclusion? A number of factors, actually. Although I had started to type up a lengthy and elaborate response to your eminently reasonable question, on second thought, I don't think that I actually want to go into detail on this case, as anything I might say as regards to how I detected this would just allow future hijackers to evade me that much more effectively. So I'm sorry to be giving you a non-answer, but actually, I think that's best for now. In any case, further discussion of this particular case now appears to be moot. As of now, it appears that AS11296 is no longer announcing any routes at all, so I'm assuming that Nishant Ramachandran (Xeex/AS27524) and/or whoever else may have been involved in this has now been adequately spanked. (And my personal thanks go out to whoever did that.) Regards, rfg P.S. Yes, I actually _am_ blocking inbound e-mail from google/gmail. Too much spam from there, and far too little action to correct the abundant problem(s). (Can you spell E-V-I-L?) Also blocked here: Yahoo and Hotmail, for the same reasons. (To big to fail? No. Just too big to care. They don't need me, and I sure as hell don't need them.) I guess you don't have a real mail server of your own that you can use. For that, you have my sympathies.

12 16

Re: What must one do to avoid Gmail's retarded non-spam filtering?
by Erik L 29 Sep '10

29 Sep '10

Thanks, this is a possibility. However, that customer IP has been dealt with and hasn't been spamming for more than 60 hours at most (it's actually part of a dynamic DSL pool where port 25 outbound was supposed to have been blocked). Our problem appears to have started before the 27th. Earlier today I noticed that the SPF record had "a" and "ptr" in it and changed it to "mx" only, as it should be in our case. What I find most peculiar is none of these having problems: 1. Competitors over 10 times our size (similar % of gmail users), with invalid SPF records, no DKIM, who don't do *ANY* of what anyone here or off-list has suggested, who have PTRs for their DSL customers similar to ours (and didn't have a port 25 block), who've been blasting maintenance notices for years 2. Amazon, eBay, PayPal, Dell, etc. 3. Facebook with their ***user-generated content, in HTML*** ----- Original Message ----- From: "Joe Sniderman" <joseph.sniderman(a)thoroquel.org> To: nanog(a)nanog.org Sent: Wednesday, September 29, 2010 3:29:10 PM Subject: Re: What must one do to avoid Gmail's retarded non-spam filtering? On 09/29/2010 12:05 AM, Erik L wrote: > Google appears to have blacklisted our domain. From the edge MTA, I > sent three messages, differing only in the From header: 1. valid > email @klssys.com 2. valid email @caneris.com 3. abc123(a)caneris.com > > 1 not spam; 2 & 3 spam Ok, so its the domain not the IP. You're a DSL provider, right? IP's assigned to customers have PTR's in caneris.com, right? [..snip..] > ----- Original Message ----- From: "Erik L" <erik_list(a)caneris.com> > To: "William Pitcock" <nenolod(a)systeminplace.net> Cc: > nanog(a)nanog.org Sent: Tuesday, September 28, 2010 7:17:45 PM Subject: > Re: What must one do to avoid Gmail's retarded non-spam filtering? > > Hi William, > > I do so for our entire IP space on a regular basis. The edge MTA I > mentioned in the reply to Bill shows up as "Neutral" there. Ok, but there are a couple customer IP's that show up as "Poor" there, with rDNS in caneris.com not in klssys.com. One of those is on CBL (and XBL) and PSBL, and is spamming using your domain: http://psbl.surriel.com/evidence?ip=199.19.168.33&action=Check+evidence Its not PBL listed even though its a dynamic IP it seems: http://www.spamhaus.org/query/bl?ip=199.19.168.33 That would be an SPF pass as well, because of: caneris.com. 3600 IN TXT "v=spf1 a mx ptr -all" So, from the receiving end it could easily look like its one of caneris.com's outbound servers.. But not one of klssys.com's servers. Maybe this has something to do with the problem. HTH, Joe -- Joe Sniderman

1 0

Re: What must one do to avoid Gmail's retarded non-spam filtering?
by Erik L 29 Sep '10

29 Sep '10

Google appears to have blacklisted our domain. From the edge MTA, I sent three messages, differing only in the From header: 1. valid email @klssys.com 2. valid email @caneris.com 3. abc123(a)caneris.com 1 not spam; 2 & 3 spam Return-Path of all three was still another address @caneris.com and the two SPF passed headers were still there. The body & subject of all messages was simply "testing5". The recipient even clicked on "not spam" on #2 prior to #3 being sent. At least it explains why all the other standard stuff we all looked at didn't explain the issue. The next (and last) question is: does anyone have a clueful Google mail ops contact? Thanks again for all the help and sorry for the OT noise. Erik ----- Original Message ----- From: "Erik L" <erik_list(a)caneris.com> To: "William Pitcock" <nenolod(a)systeminplace.net> Cc: nanog(a)nanog.org Sent: Tuesday, September 28, 2010 7:17:45 PM Subject: Re: What must one do to avoid Gmail's retarded non-spam filtering? Hi William, I do so for our entire IP space on a regular basis. The edge MTA I mentioned in the reply to Bill shows up as "Neutral" there. Thanks Erik ----- Original Message ----- From: "William Pitcock" <nenolod(a)systeminplace.net> To: "Erik L" <erik_list(a)caneris.com> Cc: nanog(a)nanog.org Sent: Tuesday, September 28, 2010 6:06:49 PM Subject: Re: What must one do to avoid Gmail's retarded non-spam filtering? Hi, Have you checked the IronPort reputation scores for your mailserver IPs? Google uses this data as part of it's spam detection method. William On Tue, 2010-09-28 at 16:15 -0400, Erik L wrote: > I realize that this is somewhat OT, but I'm sure that others on the > list encounter the same issues and that at least some folks might have > useful comments. > > An increasingly large number of our customers are using Gmail or > Google Apps and almost all of our OSS/BSS mail is getting spam > filtered by Google. Among others, these e-mails include invoices, > order confirmations, payment notifications, customer portal logins, > and tickets. Almost anything we send to customers on Google ends up in > their spam folder. This results in a lot of calls and makes much of > our automation pointless, never mind all the lost sales. > > The problem is compounded by those who use mail clients and do not log > in to the webmail at all, since they would never see the contents of > the Google spam folder. > > We have proper A+PTR records on the edge MTAs, proper SPF records for > the originating domain, proper Return-Path and other headers, and so > on. There isn't anything that I can think of other than the content > itself which would be abnormal, and obviously the content is > repetitive and can't be changed much. Is there something obvious which > we've missed? > > Aside from the following clearly impractical solutions, what can we > do? 1. Asking everyone (including those we don't even know yet) to > whitelist all of our addresses, to check their spam folders, and to > click on "this is not spam" > 2. Providing our own free e-mail service to everyone (including those > we don't even know yet) and putting up "don't use Google" ads on all > of our customer-facing systems > > At least this isn't Hotmail where mail is just silently deleted with > no NDR after it's accepted by their MTAs. > > The call volume has been going up instead of down lately and it's > gotten to the point where we're sending MTA log extracts to people to > prove to them that we really did e-mail them. > > Would greatly appreciate any advice. > > Erik >

3 2

Software-based Border Router
by Nathanael C. Cariaga 29 Sep '10

29 Sep '10

Hi All! Just want to ask if anyone here had experience deploying software-based routers to serve as perimeter / border router? How does it gauge with hardware-based routers? Any past experiences will be very much appreciated. I wanted to know because we've been asked if we want to assume full control of the internet link (up to the router). By assuming control up to the router, we still want to configure iBGP with our parent network so that we can take advantage of some routes available to the parent network's gateway. The saddest part is presently we do not have the router to serve as our gateway this is why we are considering the use of software-based routers. Thank you.

18 26

Randy in Nevis
by Rudolph Daniel 29 Sep '10

29 Sep '10

Dont know if this may assist, but here is another from St Vincent...lime network. Sunday 19th sep. 2010 http://n1.netalyzr.icsi.berkeley.edu/summary/id=43ca253f-6714-b0f7e7b0-d08e… RD

16 25

AS10392 -- Hijacked?
by Ronald F. Guilmette 29 Sep '10

29 Sep '10

Evidence strongly suggests that AS10392 together with all of the IPv4 space it is currently announcing routes for, i.e.: 192.171.64.0/19 204.137.224.0/19 205.164.0.0/20 205.164.16.0/20 205.164.32.0/20 205.164.48.0/20 have all been hijacked. I will be reporting this formally to ARIN today, via their helpful fraud reporting web form. In the meantime, while this case is being carefully adjudicated by ARIN, some folks may wish to blackhole the above. (The IP space appears to be in use by some sort of snowshoe spamming operation.) Regards, rfg P.S. Connectivity for AS10392 appears to come from only one place: http://www.robtex.com/as/as10392.html#graph

1 0

tagged vs. untagged VLAN
by Jay Nakamura 29 Sep '10

29 Sep '10

In a SP environment, you need to hand off two VLANs to a customer, is there any advantage or disadvantage in doing the following two setups? - One untagged and one tagged VLAN - Two tagged VLAN and no untagged VLAN I can't think of anything other than some equipment may not let you have no untagged VLAN. But it's bugging me that something could go wrong by not having untagged native VLAN that I can't think of.

3 2

Online games stealing your bandwidth
by Rodrick Brown 29 Sep '10

29 Sep '10

I think most people are aware that the Blizzard "World of WarcCraft" patcher distributes files through Bittorrent, however apparently a number of other MMO companies (LotR, Lego) are apparently doing something similar but aren't as upfront about it, and are installing Windows services which seed whenever the computer is online. Game Companies Should Play Fair With P2P | TorrentFreak<http://torrentfreak.com/game-companies-should-play-fair-with-p2p-100901/> If you follow the links in the article people are complaining that the LotR process has served 70gb in a week, others are complaining that the service is resulting in 300ms pings, and unusable connections. This is a very grey area it will be interesting how this issue unfolds in the long run. -- [ Rodrick R. Brown ] http://www.rodrickbrown.com http://www.linkedin.com/in/rodrickbrown

16 19

Requesting assistance from Telia netop (Fwd: Prefix Preference at Level3)
by Jeffrey Lyon 29 Sep '10

29 Sep '10

We're trying to help a downstream customer with an issue and require assistance from a clued Telia netop. The customer is running a GRE tunnel from Los Angeles to Brazil for international transit and needs to avoid carrying local traffic over the tunnel. He is requesting a pref of > 150 for Level3 prefixes. We sent a request to carrier-csc(a)teliasonera.com and here is the response we received: > We do not manipulate the prefixes that comes to us from peers. Customer may configure this on their side, but peers are always set to 150. > Please do not hesitate to contact us is you have any questions, we will close our ticket in 4 hours. Hoping to get ahold of someone at Telia with a much higher degree of awesome than this. -- Jeffrey Lyon, Leadership Team jeffrey.lyon(a)blacklotus.net | http://www.blacklotus.net Black Lotus Communications - AS32421 First and Leading in DDoS Protection Solutions

1 0

Re: LISP Works - Re: Facebook Issues/Outage in Southeast?
by Scott Weeks 29 Sep '10

29 Sep '10

On Sep 23, 2010, at 5:50 PM, "Scott Weeks" <surfer(a)mauigateway.com> wrote: > --- jared(a)puck.nether.net wrote: > It's working over LISP: > > http://www.lisp4.facebook.com/ > ------------------------------------- > > LISP as in Locator/ID Separation Protocol? ------------------------------------------- --- jared(a)puck.nether.net wrote: From: Jared Mauch <jared(a)puck.nether.net> Yes. --------------------------------- Wow, that's cool. I didn't know LISP had progressed that far... scott

3 3