- NANOG - lists.nanog.org

Re: I got a live one! - Spam source
by Michael Peddemors 27 Nov '09

27 Nov '09

> > Could you elaborate on what constitutes correct swip information? > Sure, you just opened the door to my opinions on this :) -- WRONG -- OrgName: FortressITX OrgID: FORTR-5 Address: 100 Delawanna Ave City: Clifton StateProv: NJ PostalCode: 07014 Country: US Found a referral to rwhois.fortressitx.com:4443. Timeout. -- ----------------- The argument that whois information should not be made public, is ridiculous. I here people saying that they don't publish whois information because they don't want the email's made public. Okay, at least the registered company name, or individual who presented the ID should be there. -- WRONG -- OrgName: Peer 1 Dedicated Hosting OrgID: P1DH-1 Address: 101 Marietta Street Address: Suite 500 City: Atlanta StateProv: GA PostalCode: 30303 Country: US NetRange: 216.150.0.0 - 216.150.31.255 CIDR: 216.150.0.0/19 ------------------------------ Okay, you REALLY want people to get tired of playing whack a mole? This is why many list operators block large ranges.. according to this listing, one responsible party for the whole list.. (oh, and don't get me started on reporting.. the quote i heard here was .. 'Oh, we don't do anything about spammers unless it affects other customers') So, how big a range should you block when you start seeing a pattern? Remember, organizations like UCE-PROTECT tend to base a reputation on /24 This is probably because in a lot of cases, you cannot tell does the person own the whole range, or just the top /25 -- RIGHT -- OrgName: Network Operations Center Inc. OrgID: NOC Address: PO Box 591 City: Scranton network:Network-Name:NET-96.9.145.224/28 network:IP-Network:96.9.145.224/28 network:Organization;I:org--6898 network:Org-Name:ServerPlaceNet c/o Network Operations Center, Inc. -------------- Simple, if the IP's reflect some behavior we don't like, we know exactly which ranges should be affected. Basically, if you absolve yourself of the responsibility for the conduct of part of your networks, to a 3rd party.. you should SWIP it. Some hosting companies are really good about this, even as far as SWIP'ing down to the /32. There is a chain of responsbilitly, and when a hosting company has a known offender using portion(s) of their space, it makes it much easier to decide how much of that space should be blocked. Should we block the whole /24 or only a portion? Say you see... 66.104.246.36: mail1.clubdelivery.net 66.104.246.37: mail1.deliverydirect.info 66.104.246.38: mail1.deliverymobile.net 66.104.246.39: mail1.deliveryonline.info 66.104.246.40: mail1.deliveryrama.net 66.104.246.41: mail1.deliveryusa.net 66.104.246.42: mail1.deliveryzilla.net 66.104.246.43: mail1.godelivery.info 66.104.246.44: mail1.instantdelivery.info 66.104.246.45: mail1.date-meet.net 66.104.246.46: mail1.uchatfree.net 66.104.246.47: mail1.secureeasypay.net 66.104.246.48: mail1.idevelopthings.com 66.104.246.49: mail1.whocanvote.com 66.104.246.50: mail1.freedvdz.net 66.104.246.51: mail1.freecybercam.com 66.104.246.53: mail2.clubdelivery.net 66.104.246.54: mail2.deliverydirect.info 66.104.246.55: mail2.deliverymobile.net 66.104.246.56: mail2.deliveryonline.info 66.104.246.57: mail2.deliveryrama.net 66.104.246.58: mail2.deliveryusa.net 66.104.246.59: mail2.deliveryzilla.net 66.104.246.60: mail2.godelivery.info 66.104.246.61: mail2.instantdelivery.info 66.104.246.62: mail2.date-meet.net It's listed as.. network:Organization;I:Precision Technology, Inc (286563-1) network:IP-Network:66.104.244.0/22 Well, we don't have to affect the whole XO block.. but who is the operator responsible for the activities of these servers? The SWIP should reflect that. Also, it makes it easier to see relevant activities from other ranges that the customer might own.. Like older IP Ranges... -- Precision Technology INC mycouponsavingsmailcom MYCOUPONSAVINGSMAILCOM 24.155.144.16 - 24.155.144.31 # 24.155.144.16/28 Guess business was good.. but now of course, with proper SWIP, we know that those IP's are no longer controlled by the same party . (we hope) Of course, it can still be abused.. if the hosting provider is in colusion.. changes the SWIP regularly to hide that it is the same operator.. but even then, we will see such patterns.. if a hosting company 'constantly' gets a new 'problem customer' <sic> then we can see that as well. -- -- "Catch the Magic of Linux..." ------------------------------------------------------------------------ Michael Peddemors - President/CEO - LinuxMagic Products, Services, Support and Development Visit us at http://www.linuxmagic.com ------------------------------------------------------------------------ A Wizard IT Company - For More Info http://www.wizard.ca "LinuxMagic" is a Registered TradeMark of Wizard Tower TechnoServices Ltd. ------------------------------------------------------------------------ 604-589-0037 Beautiful British Columbia, Canada This email and any electronic data contained are confidential and intended solely for the use of the individual or entity to which they are addressed. Please note that any views or opinions presented in this email are solely those of the author and are not intended to represent those of the company.

4 5

Re: Happy Thanksgiving
by chaim.rieger＠gmail.com 26 Nov '09

26 Nov '09

Paul, have a stiff one . Sent via BlackBerry from T-Mobile

1 0

Happy Thanksgiving
by Shane Ronan 26 Nov '09

26 Nov '09

Happy Thanksgiving <eom>

1 0

Who has AS 1712?
by Stephane Bortzmeyer 26 Nov '09

26 Nov '09

% whois -h whois.ripe.net AS1712 aut-num: AS1712 as-name: FR-RENATER-ENST descr: Ecole Nationale Superieure des Telecommunications, descr: Paris, France. descr: FR % whois -h whois.arin.net AS1712 OrgName: Twilight Communications City: Wallis StateProv: TX Country: US And, yes, AS 1712 is actually used by both and announced :-(

26 59

I got a live one! - Spam source
by Russell Myba 26 Nov '09

26 Nov '09

Looks like of our customers has decided to turn their /24 into a nice little space spewing machine. Doesn't seem like just one compromised host. Reverse DNS for most of the /24 are suspicious domains. Each domain used in the message-id forwards to a single .net which lists their mailing address as a PO box an single link to an unsubscribe field. I've contacted at least three known contacts for the customer about the abuse without a single response. It would seem there are many layers to this entity: The domains are registered to one business Our billing information for the customer has one name, they colo with another person (whom the cross connect reaches) Our customer has an IT solutions person working for them (Strange since our customer and their colo provider are "IT solutions" people themselves. Abuse handle phone #s are supposedly incorrect (I called it) Besides the obvious of me at the minimum filtering port tcp/25 is their an organization that tracks businesses like these who seem like they are building a web of insulation in which to move? I think this case might interest them.

11 14

Multicast LDP or P2MP RSVP & LDP
by devang patel 26 Nov '09

26 Nov '09

Hi All, I just want to know about the deployment of Multicast LDP or P2MP RSVP and LDP is available from any vendor or they are still in draft status? Also it will be great if some one can give me an idea of Multicast VPN deployment in service providers; are they deployed with draft Rosen GRE based solution or BGP auto discovery mechanism? Thanks in advance for help... regards, Devang

2 2

AUTO: Lumír Srch ml. is out of office
by Lumir Srchlm 26 Nov '09

26 Nov '09

I am out of the office until 30.11.2009. Na Vas e-mail odpovim co nejdrive. V pripade urgentnich problemu prosim kontaktujte helpdesk. I will answer your e-mail as soon as possible. Your e-mail will not be forwarded. Please contact helpdesk for urgent issues. Dekuji za pochopení Lumir Srch ml. Note: This is an automated response to your message "Re: I got a live one! - Spam source" sent on 26.11.09 1:16:53. This is the only notification you will receive while this person is away.

1 0

fight club :) richard bennett vs various nanogers, on paid peering
by ops.lists＠gmail.com 25 Nov '09

25 Nov '09

http://gigaom.com/2009/11/22/how-video-is-changing-the-internet/ Does the FTC's question 106 hurt paid peering or not? 88 comments. Makes real interesting reading, I must say. srs

14 25

<Help --> Having trouble trying to activate a GigE connection>
by Michael Ruiz 25 Nov '09

25 Nov '09

Group, I am having an issue with activating a Gige interface between a Cisco 7206 VXR w/IO-1GE module to a 7606 w/sup720-3bxls connecting to a line module WS-X6416-GBIC. I have verified that the GBIC-MMF have good light reading and the MMF fiber jumper are not reversed. The GigE connection comes up briefly for about a few seconds, takes a burst of errors and goes down. I have tried to set the speed to nonegotiate on both ends, set one end to speed auto. No dice. Here is the copy of the configuration. On my 7606 I show that the GigE interface is up/up but on the 7206vxr I show down/down. Any help will be greatly appreciated. Thanks! This is the Cisco 7206VXR configuration. interface GIabitEthernet0/0 no ip address duplex full speed 1000 media-type gbic no negotiation auto This is the Cisco 7606 configuration. interface GigabitEthernet1/8 description AR4-DLLSTXHW-GE0/0 no ip address speed nonegotiate Michael Ruiz Network Engineer

4 5

iGlass CMTS monitoring solution
by Eric J Esslinger 25 Nov '09

25 Nov '09

We've been looking at the iGlass's cable system monitoring solution for monitoring our cable system; It integrates with billing to give the ability, at a csr level, to allow them to directly lookup the status of a customer's cable modem (for example, online, offline, negotiationg, flapping), history, and also integrates with the CMTS and will make SNMP polls of the modems to see signal levels, CPE's attached, configured speed vs current actual speed, etc. I was wondering if anyone had any comments for or against them, or of alternative companies or even open source alternatives. I'm perfectly fine with 'roll your own' but Nagios/cacti type monitoring really just doesn't cut it where this is concerned. We're < 10k customers. Contacting me offlist is fine. Thanks. __________________________ Eric Esslinger Information Services Manager - Fayetteville Public Utilities http://www.fpu-tn.com/ (931)433-1522 ext 165 ________________________________ This message may contain confidential and/or proprietary information and is intended for the person/entity to whom it was originally addressed. Any use by others is strictly prohibited.

1 0