- NANOG - lists.nanog.org

Re: mitigating botnet C&Cs has become useless
by Arjan Hulsebos 09 Aug '06

09 Aug '06

On Wed, 09 Aug 2006 10:10:21 -0600, Michael Loftis wrote: >Yup this is a social problem. Just like there's nothing actually stopping >any of us from beating up a guy on the street, we don't do it because it >isn't legal, doesn't make sense, etc. Some muggers do, the people in >control of the SPAM problem are the muggers....the people with infected >systems are just the ones who've been mugged. The ones who've been mugged don't start mugging other people, infected PCs will infect other PCs. That's the difference, and that's why an ISP should do something about that. Although it may be out of fashion, I'd like to see good netizenship. Gr, Arjan H

2 1

Re: mitigating botnet C&Cs has become useless
by Arjan Hulsebos 09 Aug '06

09 Aug '06

On Sat, 5 Aug 2006 17:17:27 -0400 (EDT), Sean Donelan typed: >Railroads have the railroad police. The Post Office has postal >inspectors. Do we want to give ISP security the power to arrest >people? We (ISPs) already do have that power, we can disconnect misbehaving subscribers. And in cases like this, we should keep them off the 'net until they've cleaned up their PC. And besides doing that, we should educate our subs on how to properly maintain their PC (installing and keeping up-to-date antivirus software, patch the OS on a regular basis, you know the drill). I don't think hunting down the botnet operator is going to solve the problem. If I were to setup a botnet, I'd have many layers of machines (in as many different countries as possible) and protocols between me and the drones that do my dirty work. So, yeah, it can be solved (OK, to a large extend) by manpower, but as someone else already mentioned, it's a case of ROI. And, as usual, security is only costing you money..... Gr, Arjan H

7 11

Re: mitigating botnet C&Cs has become useless
by Scott Weeks 08 Aug '06

08 Aug '06

----- Original Message Follows ----- From: Sean Donelan <sean(a)donelan.com> > arrest people for mail fraud. Where are the Internet > inspectors with the authority to arrest people? Thankfully, they're nowhere around! We need to figure this out without the creation of such, also. scott

1 0

AT&T routing
by Andrew D Kirch 08 Aug '06

08 Aug '06

Would a routing engineer from AS7132 (SBC/AT&T) please contact me off list to resolve a routing issue I've discovered on your network? -- Andrew D Kirch | Abusive Hosts Blocking List | www.ahbl.org Security Admin | Summit Open Source Development Group | www.sosdg.org Key fingerprint = 4106 3338 1F17 1E6F 8FB2 8DFA 1331 7E25 C406 C8D2

2 2

Re: SORBS Contact
by Stefan Hegger 08 Aug '06

08 Aug '06

If you are blacklisted due of SPAM, and this happens often when you are an ISP, there is not automatic process. Stefan On Tuesday 08 August 2006 11:36, Stephen Satchell wrote: > Stefan Hegger wrote: > > We have the same problem. We are blacklisted and I filled out the > > webform. I got an email regarding ticket number and account/password to > > track the ticket. But it seems that nobody is working on it. > > There has been extensive discussion on NANAE and NANABl newsgroups on > this issue. The bottom line: The SORBS ticket queue is handled by a > group of unpaid volunteers, and there is quite a backlog. That's why > there is the automatic de-listing system in place, which requires proper > host names and longer time-to-live (TTL) values in rDNS. > > Yes, it's a bit of work, but it beats waiting for someone to get around > to your ticket. > > No, I'm not associated in any way with SORBS, just an interested > observer and system administrator who has had to deal with listings myself. -- Stefan Hegger Internet System Engineer Stefan.Hegger(a)lycos-europe.com Tel: +49 5241 8071 334 Lycos Europe GmbH Carl-Bertelsmann Str. 29 Postfach 315 33311 Gütersloh

1 0

Anyone else lost power at Fisher Plaza this afternoon?
by Jonathan Claybaugh 07 Aug '06

07 Aug '06

If anyone else lost power at Internap's Fisher Plaza facility in Seattle this afternoon and have any info related to exact duration or cause please hit me back off-list. Cheers, Jonathan

5 7

Re: Ultradns using anycast?
by Martin Hannigan 07 Aug '06

07 Aug '06

>PIR is the TLD manager for .ORG. Afilias provides technical operations for the ORG registry on behalf of PIR; the ORG zone is >hosted today by Neustar Ultra Services (which is the more recent, correct name for UltraDNS following their acquisition) under >contract to Afilias. >If you have a problem with the technical operations of the ORG zone, registry or nameserver, then Afilias is an appropriate >organisation to contact. I don't have the NOC contacts to hand, but personal mail to me will cause things to happen, so long as >I'm not buried under a pile of other distractions (as I mentioned in private mail to Jeffrey). There's certainly nothing wrong with noting a problem with a GTLD here on NANOG. Whatever is going on is impacting at least tld2.ultranet.net hosted out of XO in IAD. That machine has been steadily degrading since last week and peaked out tonight at almost a full second for a resolution of anything. -M< -- Martin Hannigan (c) 617-388-2663 Renesys Corporation (w) 617-395-8574 Member of Technical Staff Network Operations hannigan(a)renesys.com

1 0

Re: small group seeks european IPv6 sceptic for good time
by Miquel van Smoorenburg 06 Aug '06

06 Aug '06

In article <cistron.1154721863.21019.26.camel(a)firenze.zurich.ibm.com>, Jeroen Massar <jeroen(a)unfix.org> wrote: >* = not even joking, but could somebody set up a free IPv6 p0rn service; >that should considerably raise the demand for IPv6 around the globe. I >have some nice statistics from users from a certain asian ISP who are >looking at some cosy pictures quite often, most likely using IPv6 as the >content is blocked over IPv4 as The Great Firewall doesn't support the >new protocol yet ;) news://newszilla6.xs4all.nl/ :) Mike.

2 1

Equinix / Servercentral.net / Micfo POC
by Mark Foster 05 Aug '06

05 Aug '06

Anyone from the above providers watching? I'm trying to draw attention to a phishing scam originating from 205.234.128.0/17 - 'Micfo.com LLC'. Their host / upstream appear to be servercentral.net and theres a reference to an Equinix datacentre in Chicago. The +1-866 number listed doesn't appear to be dialable from here, despite other 866's being accessible. I'll refrain from posting more details at this stage, however, anyone with any useful POC's please feel free to contact me offlist. Mark.

1 1

OT: Good list for VoIP
by Mike Callahan 05 Aug '06

05 Aug '06

Sorry for the OT post but I'm wondering if anyone can recommend a good list for ISP level VoIP discussion. On that's focus is on technical issues would be preferred. Thanks, M. Callahan

4 3