- NANOG - lists.nanog.org

Abuse desk software
by Drew Weaver 30 Oct '09

30 Oct '09

Howdy, Can anyone recommend a decent software package one can use to download e-mail sent to an abuse alias which then grabs IPs/hostnames out of the body of the email and makes nice actionable reports? Anything out there exist? thanks, -Drew

4 3

Re: dealing with bogon spam ?
by Church, Charles 30 Oct '09

30 Oct '09

This is puzzling me. If it's from non-announced space, at some point some router should report no route to it. How is the TCP handshake performed to allow a sync to turn into spam? Chuck Chuck Church Network Planning Engineer, CCIE #8776 Harris Information Technology Services DOD Programs 1210 N. Parker Rd. | Greenville, SC 29609 Office: 864-335-9473 | Cell: 864-266-3978 -------------------------- Sent using BlackBerry ----- Original Message ----- From: Jon Lewis <jlewis(a)lewis.org> To: Leslie <leslie(a)craigslist.org> Cc: NANOG <nanog(a)nanog.org> Sent: Tue Oct 27 21:08:12 2009 Subject: Re: dealing with bogon spam ? On Tue, 27 Oct 2009, Leslie wrote: > I failed to mention we're seeing this from an unallocated /20 whose parent /8 > is allocated to ARIN (and is partially in use) What /20 would that be? If you're sure it's unallocated, and see nothing but spam from it, block it at your border. ---------------------------------------------------------------------- Jon Lewis | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

10 17

incident registration
by nsosoc -G- 30 Oct '09

30 Oct '09

Hi guys, What would you recommend as a state-of-the-art web-based incident registration/warning tool for an enterprise size (multiple diverse wans) net? Thx Jack Jack Ryan National Railway Org. nsosoc(a)gmail.com

2 1

Interesting Point of view - Russian police and RIPE accused of aiding RBN
by ops.lists＠gmail.com 30 Oct '09

30 Oct '09

http://www.eweekeurope.co.uk/news/russian-police-and-internet-registry-accu… Some quotes from the article - Internet registry RIPE NCC turned a blind eye to cybercrime, and Russian police corruption helped the perpetrators get away with it, according to the UK Serious Organised Crime Agency [...] "RIPE was being paid by RBN for that service, for its IP allocation," he said. "Essentially what you have - and I make no apologies for saying this is - if you were going to interpret this very harshly RIPE as the IP allocation body was receiving criminal funds and therefore RIPE was involved in money laundering offences," said Auld. [...] "All we could get there was a disruption, we weren't able to get a prosecution in Russia," admitted Auld. "Our biggest concern is where did RBN go? Our information suggests that RBN is back in business but now pursuing a slightly different business model which is bad news." [...] "Where you have got LIRs (Local Internet Registries) set up to run a criminal business- that is criminal actvity being taken by the regional internet registries themselves. "So what we are trying to do is work with them to make internet governance a somewhat less permissive environment for criminals and make it more about protecting consumers and individuals," added Auld. RBN looked legitimate, says RIPE NCC In response to the comments that it could be accused of being involved in criminal activity, Paul Rendek, head of external relations and communications at RIPE NCC said that the organisation has very strict guidelines for dealing with LIRs. "The RBN was accepted as an LIR based on our checklists," he said." Our checklists include the provision of proof that a prospective LIR has the necessary legal documentation, which proves that a business is bona fide." etc

6 8

more ISP regulation for UK ?
by jul 30 Oct '09

30 Oct '09

After Nederlands, things may also move in UK against eCrime + apComms backs ISP cleanup activity http://www.lightbluetouchpaper.org/2009/10/17/apcomms-backs-isp-cleanup-act… Extract: The All Party Parliamentary Communications Group (apComms) recently published their report into an inquiry entitled “Can we keep our hands off the net?” They looked at a number of issues, from “network neutrality” to how best to deal with child sexual abuse images. Read the report for the all the details; in this post I’m just going to draw attention to one of the most interesting, and timely, recommendations: 51. We recommend that UK ISPs, through Ofcom, ISPA or another appropriate organisation, immediately start the process of agreeing a voluntary code for detection of, and effective dealing with, malware infected machines in the UK. 52. If this voluntary approach fails to yield results in a timely manner, then we further recommend that Ofcom unilaterally create such a code, and impose it upon the UK ISP industry on a statutory basis. Best regards, Julien

1 0

EdgeWater EdgeMarc 4610W
by Jaimie Livingston 30 Oct '09

30 Oct '09

Has anyone had any recent direct experience with the EdgeWater EdgeMarc 4610W multi-service appliance used as a CPE device? I was recently handed a sales sheet on this swiss-army knife appliance, but there doesn't seem to be much publically available review of the beastie at the moment. If it is as advertised, it would be a very handy device as a CPE option... Thanks, Jaimie L.

3 2

Avantel Contact Information
by William C 29 Oct '09

29 Oct '09

Does anyone have a technical or peering contact at Avantel who can address an apparent netblock hijacking issue? It seems that Avantel is advertising the 200.23.91.0/24 address space to their peers but they are unable to route to it for some reason. Level3's customers can though, and so can a whole bunch of the rest of the internet. Without posting all my traceroutes and route-views I'll just ask first as I'm sure there is a way to resolve this peacefully =] Any suggestions?

1 0

RBS Worldpay
by Richard Maynard / Wessex Networks 29 Oct '09

29 Oct '09

Hi NANOG, Long time lurker here - this is my first post. Is there anyone here from RBS Worldpay? I could do with a hand troubleshooting an HTTP POST timeout reported from their from their end causing trouble on a customer server during the payment stages. I can't figure out if this is a network or server issue. Regards, Richard Maynard Wessex Networks Linchmere Place Ifield Crawley West Sussex RH11 0EX www.wessexnetworks.com rjm(a)wessexnetworks.com T: 01293 542080 F: 01293 553849

1 0

Cox.net issues with their DNSBL
by Micheal Patterson 29 Oct '09

29 Oct '09

I'm not sure if this is the proper place to put this so I'll make this short. Cox.net is showing errors when I'm sending mail indicating that we're blocked by Invaluement, Cox error IPBL100. I've checked and my mx isn't listed. Attempts to contact the postmaster(a)cox.net address result in an autoresponder and then a bounce as that address is over quota. Is anyone else seeing this problem? Please feel free to contact me off list. -- Micheal Patterson Senior Communications Systems Engineer Southern Plains Medical Group 405-917-0600 Confidentiality Notice: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message

2 1

[NANOG-announce] Communications Committee (formerly Mailing List Committee) Nominations close today!
by Joe Provo 29 Oct '09

29 Oct '09

The nominations for the NANOG Committee (formerly known as the Mailing List Committee) close today, October 29. As Steve said in his last note, the new direction from the recent amendments means this is a chance to break new ground for NANOG and help define the future path for this team. If you are interested or know someone who is, please send the nomination to <nominations(a)nanog.org>. If you are being nominated, please be prepared to confirm your interest and provide some bio data and a statement of interest (like those up on http://www.nanog.org/governance/elections/2009elections/2009mlc_candidates.…) before the Steering Committee meets on 3 November. Cheers! Joe Provo -- RSUC / GweepNet / Spunk / FnB / Usenix / SAGE _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org http://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0