- NANOG - lists.nanog.org

Reminder: NANOG 40 presentation proposals due Thursday
by Steve Feldman 09 Apr '07

09 Apr '07

A reminder that proposals for presentations at NANOG 40 are due this Thursday, April 12. See http://www.nanog.org/mtg-0706/ callforpresent.html for more information. Also, meeting registration is now open, and hotel reservations are available. See the main NANOG site, http://www.nanog.org for details. Steve Feldman PC Chair

1 0

Slightly OT: Looking for an old domain for spam collection
by Ken Simpson 09 Apr '07

09 Apr '07

Hi There, Does anyone out there have an unused domain name that formerly received lots of email? I am looking for a source of "throw away" SMTP traffic. I don't need to own the domain -- just to have its MX'es redirected to our farm. Karma and humor will be gladly provided in exchange for your generosity. Thanks! Ken -- Ken Simpson, CEO MailChannels Corporation Reliable Email Delivery (tm) http://www.mailchannels.com

7 13

Localized Root Servers in Europe?
by Martin Hannigan 09 Apr '07

09 Apr '07

"Furthermore, at least one large ISP in Europe is doing the same thing, redirecting root server traffic to their own servers." http://www.circleid.com/posts/submit_comment/splitting_root_too_late/ "Furthermore, at least one large ISP in Europe is doing the same thing, redirecting root server traffic to their own servers. " Which large European operator has implemented this solution? I would love to see a talk at the next NANOG about how this works and how it performs. Best Regards, Martin (Note: Article quote slightly out of context. I tried to keep it to what may be on topic here..)

2 2

RE: Blocking mail from bad places
by Scott Weeks 08 Apr '07

08 Apr '07

--- michael.dillon(a)bt.com wrote:---------------- > Hey, you've just described the FUSSP! :-( Solution!? Since when is a description of one aspect of the problem, considered to be the solution. In a nutshell I said that the email SPAM problem is getting worse, not just measured by SPAM volumes or number of new SPAM techniques, but measured by the number of people turning to non-email communications channels. ------------------------------------------------- Part of what you said was this: > : Soon Internet email will be like IRC, a quaint > : service for Internet enthusiasts and oldtimers, > : but not a useful tool for businesses or ordinary > : individuals. What I meant was: when only a few folks use email, the spammers will go away. Like parasites on a dead animal body. The spammer-parasites will find something else to devour. Besides, it was just a joke. I should've turned my smiley around. ;-) scott

14 20

Re: Abuse procedures... Reality Checks
by Fergie 08 Apr '07

08 Apr '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Chris Owen <owenc(a)hubris.net> wrote: >On Apr 7, 2007, at 11:00 PM, Fergie wrote: > >> I would think that it's actually very easy to do when >> sub-allocations are SWIP'ed. > >Not that I'm really defending this policy, but sub-allocations are very often not SWIPed. I'd say 75% or more of the time I'm looking a problem IP address it is part of a /19 or larger block with no sub- allocation. > Please read what I wrote: "I would think that it's actually very easy to do when sub-allocations are SWIP'ed." I cannot, and will not, presuppose that in cases when they are not SWIP'ed that some kind of magic happens. :-) - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj8DBQFGGCw4q1pz9mNUZTMRAgEDAKCB4eiFluFcXcYlSj4EjleHpxy8PgCg26ei sZW4CKfCOm5H3KOGQsxYd8w= =ZoDl -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

3 2

RE: Abuse procedures... Reality Checks
by Frank Bulk 08 Apr '07

08 Apr '07

I guess our upstream provider is a nobody because they have lots of small sub-allocated blocks less than a /24 that they route to different member ISPs. =) What is the point of blocking a /24 on the basis of a /32 if the ISP manages dozens of other /24 or larger blocks? If you're going to do it, block *all* the IPs associated to the 'bad' ISP. Then at least you're consistent, otherwise expanding to a /24 is just a half (or 1%) job or laziness. Frank -----Original Message----- From: Frank Bulk Sent: Saturday, April 07, 2007 10:45 PM To: nanog(a)nanog.org Subject: Re: Abuse procedures... Reality Checks >> Sure, block that /29, but why block the /24, /20, or even /8? Since nobody will route less than a /24, you can be pretty sure that regardless of the SWIPs, everyone in a /24 is served by the same ISP. I run a tiny network with about 400 mail users, but even so, my semiautomated systems are sending off complaints about a thousand spams a day that land in traps and filters. (That doesn't count about 50,000/day that come from blacklisted sources that I package up and sell to people who use them to tune filters and look for phishes.) I log the sources, when a particular IP has more than 50 complaints in a month I usually block it, if I see a bunch of blocked IP's in a range I usually block the /24. Now and then I get complaints from users about blocked mail, but it's invariably from an individual IP at an ISP or hosting company that has both a legit correspondent and a spam-spewing worm or PHP script. It is quite rare for an expansion to a /24 to block any real mail. My goal is to keep the real users' mail flowing, to block as much spam as cheaply as I can, and to get some sleep. I can assure you from experience that any sort of automated RIR WHOIS lookups will quickly trip volume checks and get you blocked, so I do a certain number manually, typically to figure out how likely there is to be someone reading the spam reports. But on today's Internet, if you want to get your mail delivered, it would be a good idea not to live in a bad neighborhood, and if your ISP puts you in one, you need a better ISP. That's life. Regards, John Levine, johnl(a)iecc.com, Primary Perpetrator of "The Internet for Dummies", Information Superhighwayman wanna-be, http://www.johnlevine.com, ex-Mayor "More Wiener schnitzel, please", said Tom, revealingly.

1 0

Re: Abuse procedures... Reality Checks
by Fergie 08 Apr '07

08 Apr '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Chris Owen <owenc(a)hubris.net> wrote: >On Apr 8, 2007, at 2:51 AM, Fergie wrote: > >> Again, a simple recursive WHOIS will show you sub-allocations if they >> are properly SWIP'ed. > >Define "properly". The Cox addresses in my example are SWIPed. Are they "properly" SWIPed? How could you tell from whois? > Are is/are the exact prefix(es) in question? - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj8DBQFGGGJtq1pz9mNUZTMRAqEvAKDc2heZ5tTCZPkJXP1BkKiCQbjpwACg5+kA aMVT4/A79/VEZR8rKVv+AcY= =KafZ -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: Abuse procedures... Reality Checks
by Fergie 08 Apr '07

08 Apr '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Chris Owen <owenc(a)hubris.net> wrote: >On Apr 7, 2007, at 11:41 PM, Fergie wrote: > >> Please read what I wrote: >> >> "I would think that it's actually very easy to do when >> sub-allocations are SWIP'ed." >> >> I cannot, and will not, presuppose that in cases when they are >> not SWIP'ed that some kind of magic happens. :-) > >And how do you know the difference? The Cox IP address is SWIPed. Its even sub-allocated. The allocation is just a /19. > Again, a simple recursive WHOIS will show you sub-allocations if they are properly SWIP'ed. Not a big deal, really. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj8DBQFGGFiiq1pz9mNUZTMRArfSAJ9X5CMo0M+Tg0Tf1vN2UWytF3oB8gCg/TEH fP3GwH7aW3J7DeNpH3m/aeY= =VQ9W -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Re: Abuse procedures... Reality Checks
by Fergie 07 Apr '07

07 Apr '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Stephen Satchell <list(a)satchell.net> wrote: >It's *very* hard to do it with an automated system, as such automated look-ups are against the Terms of Service for every single RIR out there. > Exactly why is this hard to do? I would think that it's actually very easy to do when sub-allocations are SWIP'ed. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj8DBQFGGCKUq1pz9mNUZTMRAq6gAJ4ve8lc4IBU9nt0C5BEQDOfcPYZUgCgxExW Nio0yTd77qAjI10oOsv2Vh4= =d5Jd -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Re: Abuse procedures... Reality Checks
by Fergie 07 Apr '07

07 Apr '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "william(at)elan.net" <william(a)elan.net> wrote: >On Sat, 7 Apr 2007, Fergie wrote: > >> I would have to respectfully disagree with you. When network >> operators do due diligence and SWIP their sub-allocations, they >> (the sub-allocations) should be authoritative in regards to things >> like RBLs. > >Yes. But the answer is that it also depends how many other cases like >this exist from same operator. If they have 16 suballocations in /24 >but say 5 of them are spewing, I'd block /24 (or larger) ISP block. Why? When you can block on more specific prefixes? This just doesn't make sense to me. >The exact % of bad blocks (i.e. when to start blocking ISP) depends >on your point of view and history with that ISP but most in fact do >held ISPs partially responsible. Indeed -- your point of view. Which I would argue is unfair and not "due diligence". - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj8DBQFGGBv8q1pz9mNUZTMRAuufAKC+/0DwFmrVA15UZaNib02GgR25MgCdFlu3 45XhfZTvgE+Oaiij4LoLNh0= =MO1u -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0