- NANOG - lists.nanog.org

SF Bay Area: Email Administrator Usability Study
by Kristyn Greenwood 22 Sep '04

22 Sep '04

I've been informed that the members of this list would be interested in a usability study being conducting on the activities of Email Administrators. If you are not an email administrator but know of someone who might be interested please feel free to forward this message. I am looking for email administrators in the San Francisco Bay Area and Sacramento to participate in a usability study. We are looking for individuals whose primary role is to administer and maintain their organization's electronic mail system; regardless of the type of email system administered or the tools used. Participants may be system administrators, database administrators, network administrator as long as 50% of their time is spent working on the electronic mail systems. As a thank you for participating in the study, we are providing $20 Starbucks gift certificates to the participant, a $5 Starbucks gift certificate to their manager/VP(s), and a $5 Starbucks gift certificate to the individual who referred them. The purpose of the study is to identify the types of tasks that email administrators typically perform, and the tools that they use. It involves no travel as we would like to visit email administrators at their place of work and observe a typical day. If you are an email administrator who would like to participate, please contact me at the address below and provide a name and phone number where you can be reached. If you know of an email administrator who might be interested, please forward this message to them. Thanks for your assistance, Kristyn Greenwood Principal Usability Engineer kristyn.greenwood(a)oracle.com

1 0

RE: FW: The worst abuse e-mail ever, sverige.net
by Kathryn Kessey 22 Sep '04

22 Sep '04

I don't want to add to this bash-fest, but maybe a little context and a laugh helps... the original posting sounds like utter frustration, something I'm sure a few people are familiar with if you've ever worked for a bunch of sociopathic conartists using their service provider business to steal from people in order to support their prostitution/drug/gambling habit and/or perpetuation of their cult... Like my previous employer. If you work for someone who allows you to subject sales to any sort of screening, like asking "Is your mail server RFC2505 compliant?", luckily you aren't working for clowns who would sell to anyone (and actually say things like "spammers are a great sales channel!"), refer to themselves as "pirates of telecommunications" (seriously), and refuse to support any implementation of known good technical practices if it A) costs > 0.01 or B) inconveniences any spammer (I mean, customer.) And the aftermath of not implementing reasonable technical practices, is of course, all your fault (like all of your superblocks being RBLed for consistently selling service to notorious spammers)... People who treat their engineers with utter disdain and contempt, as if they are just a sinkhole for their sales dollars. Luckily for me, I could just walk away and hand them my two word resignation letter (thats right: FO). Not everyone can, esp during the recession. I'm just posting this because if you have never worked in these conditions, its hard to comprehend the frustration level, I certainly didn't before experiencing it myself. And maybe we should find ways of putting scourge like this out of business. glad to be back from the dark side, working for a real company again... Kathy -----Original Message----- From: John Curran [mailto:jcurran@mail.com] Sent: Wednesday, September 22, 2004 10:37 AM To: Lars-Johan Liman Cc: nanog Subject: Re: FW: The worst abuse e-mail ever, sverige.net At 10:16 AM +0200 9/22/04, Lars-Johan Liman wrote: >I cannot agree to the "block port 25" line of action. You block port 25 until a customer says that they're claim to have setup a responsible mail submission agent and demonstrate the necessary clue density. This can be readily determined by having customer support mail a short form with relevant questions such as "Is your mail server RFC2505 compliant?", "Please list the mechanism used to secure mail submission to your server?", and "Are you prepared to handle SPAM reports for all email originated or relayed?" No problem for someone who knows what they're doing but enough to deter the random end user. /John

1 0

FW: The worst abuse e-mail ever, sverige.net
by Daniel Golding 22 Sep '04

22 Sep '04

On 9/21/04 1:00 PM, "james edwards" <hackerwacker(a)cybermesa.com> wrote: > >> Sheesh. Get over /yourself/. Your network is rude by its very existence, >> if it lets spammers relay crud by way of it. Your own arrogance in >> thinking it's not your problem to fix is astounding. > > I did no say it is not my problem, we have a 10 year history of being > very pro-active for all abuse issues and have a dedicated staff person to > deal with these issues. Slaming my mail admin because a dial up user has a > virus > is rude, period. Our dial up address space is listed, if people choose to > block > mail from that space. > > james > To shift this to a more operational tone... Networks make choices. One choice is to declare their dynamic space and put the duty of ignoring emails from dialups users on the receiving networks. Another choice is to filter port 25. Filtering port 25 has its own costs - some users are offended/bothered by this, since they can't use their own corporate mail servers, in some cases. If a network makes the choice of putting the duty of filtering on the receiving party, they need to accept that this will upset some of those receivers. Today's security environment means that spam-sending viruses are common. The only responsible thing to do is filter port 25, smarthost for your users, and inform them about using the alternate submission port with authenticated SMTP in order to work with enterprise mail servers - or IPSec VPNs, for that matter. This is simply the best practice, at this point in time. Using humans ("dedicated staff person") to stop spam isn't scalable - automated processes are sending this stuff, we need systematic ways to fight it - black/white lists, SPF, port 25 filtering, bayesian filtering and other tools. -- Daniel Golding Network and Telecommunications Strategies Burton Group

7 8

RE: NYSE
by Temkin, David 22 Sep '04

22 Sep '04

And let's not forget that if you use that 3rd party provider, especially to connect to SIAC, you pay a premium to have someone to blame other than the actual data provider. > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Michael.Dillon(a)radianz.com > Sent: Wednesday, September 22, 2004 5:36 AM > To: nanog > Subject: Re: NYSE > > > > I would prefer not to use a third party provider because of the IP > > backbone. My experience has been witht eh third party providers is > > that there is not enough responsiveness (packet loss issues) to > > burstable traffic at market open and close. > > Unfortunately when the third party networks were designed > there was no > > forethought into the need for market data traffic or multicast. > > Hmmm... well I happen to work in Engineering at Radianz. > > I can assure that our network was designed for multicast so > that there are two resilient low latency paths for multicast > traffic throughout our network in spite of the tendency of IP > to have a single best path. And our basic design rules for > network capacity worldwide are to allow for the bursts that > happen at U.S. Market Open. > > The advice to go to a 3rd party provider who specializes in > the financial services industry is a good one because we and > our competitors tend to understand the special needs of > companies in that industry. If you want to discuss this > further with one of our technical sales support people, then > send me an email and I'll put you in touch. > > --Michael Dillon > > IMPORTANT: The information contained in this email and/or its attachments is confidential. If you are not the intended recipient, please notify the sender immediately by reply and immediately delete this message and all its attachments. Any review, use, reproduction, disclosure or dissemination of this message or any attachment by an unintended recipient is strictly prohibited. Neither this message nor any attachment is intended as or should be construed as an offer, solicitation or recommendation to buy or sell any security or other financial instrument. Neither the sender, his or her employer nor any of their respective affiliates makes any warranties as to the completeness or accuracy of any of the information contained herein or that this message or any of its attachments is free of viruses.

1 0

Reston agenda topics (so far)
by Susan Harris 22 Sep '04

22 Sep '04

Hi everyone - here are the agenda topics we've lined up so far for NANOG 32 in Reston. More talks will be added, so keep an eye on the web: www.nanog.org/mtg-0410/topics.html Our hotel block expires on Tuesday, Oct. 28, so please register soon to save $$: www.nanog.org/mtg-0410/hotel.html And don't forget to register for ARIN, which meets just after NANOG from Oct. 20-22: www.arin.net See you in a few weeks. ----------------------------------------------------------------------------------- NANOG 32, October 17-19 Reston, Virginia SUNDAY TUTORIALS ---------------- - Options for Blackhole and Discard Routing Joe Soricelli, Juniper Level: Intermediate - BGP Multihoming Techniques Philip Smith, Cisco Level: Introductory/Intermediate - Internet Number Resource Management and Administration Ray Plzak/Richard Jimmerson, ARIN Level: Introductory - IPv6 Deployment and Case Studies Salman Asadullah and Ciprian Popoviciu, Cisco Level: Introductory/Intermediate MONDAY-TUESDAY GENERAL SESSION ------------------------------ - Botnets John Kristoff, Northwestern University - Optical Switching, a Great Tool in Platform Migration at AMS-IX Romeo Zwart, Amsterdam Internet Exchange - 802.1X: Deployment Experiences and Obstacles to Widespread Adoption Terry Simons, University of Utah/open1x.org Jon Snyder, Portland State University - DNSSEC Deployment: Big Steps Forward; Several Steps to Go Steve Crocker, Shinkuro - DNS Anomalies and Their Impact on DNS Cache Servers Katsuyasu Toyama, Keisuke Ishibashi, Tsuyoshi Toyono, Katsuyasu Toyama, NTT Labs; Masahiro Ishino, Chika Yoshimura, NTT Communcations; Kazunori Fujiwara, JPRS - Best Data Practices for Online Service Providers from the Electronic Frontier Foundation, Tim Pozar, EFF - Tracking Global Threats with the Internet Motion Sensor Michael Bailey, Evan Cooke, University of Michigan Danny McPherson, Arbor Networks - Detecting Inconsistent Advertisements from Neighboring ASes Nick Feamster, MIT, Z. Morley Mao, University of Michigan Jennifer Rexford, AT&T Research - aflow - a Network Analysis Tool Dan Ardelean, ARIN/Purdue University - Impressions: An Overview of the Global IPv6 Routing Table Gert Doering, SpaceNet AG, author; Cathy Wittbrodt, presenter RESEARCH FORUM -------------- - Sizing Router Buffers Guido Appenzeller, Stanford University - Performing BGP Experiments on a Semi-Realistic Internet Environment Ke Zhang, Soon-Tee Teoh, Shih-Ming Tseng, Chen-Nee Chuah, Kwan-Liu Ma, and Felix Wu, University of California, Davis BOFs ---- - ISP Security and NSP-SEC BOF VII Danny McPherson, Arbor, and Merike Kaeo, Double Shot Security, moderators - Optimizing Operational Input to ARIN: What Is Needed and How Do We Get It? ARIN staff, moderators

1 0

Managing ACL's
by Carl W.Kalbfleisch 22 Sep '04

22 Sep '04

Hi, This is a follow-up to a message I sent a week or so ago. I am trying to get a reading on how big a problem people are having managing Access Control Lists. Do you have software to help you manage this today? If so, what? If not, is it something you want? Any operational experience you can share in this area would be greatly appreciated. Thanks, Carl -- Carl W. Kalbfleisch www.kalbfleisch.us

1 0

Re: NYSE
by Alen Capalik 22 Sep '04

22 Sep '04

My advice to you is to use a third party provider like Radianz, TNS or Sector (SIAC owned company). They can take a lot of headaches away from this. David is right, you can't connect to SIAC directly any more, that's a legacy network (called so by SIAC) and are phasing it out. Again, if you are in CA then use one of the above mentioned providers. It's cost effective and faster then if you were dealing with SFTI directly. BTW, to everybody, please don't write back saying that third party providers are NO GOOD or that you had bad experiences with them. I'm well aware of all this and don't need a lecture on it. My opinion (and I have been dealing with all of them extensivly for a long time) if you are in CA, use them it takes away lot of headaches (make sure you're redundant with them) and gets you up and running fast. My prefered way of connecting would either be Radianz or Sector, I don't like TNS (to all TNS guys outthere, sorry). Hope this helps. AC On Tue, Sep 21, 2004 at 06:01:36AM -0700, Philip Lavine wrote: > I am assuming this means that I have a POP on the East > Coast. I am Burbank California, currently. > > --- Alen Capalik <alen(a)wiretapnetworks.com> wrote: > > > > > > > On Mon, Sep 20, 2004 at 10:36:16AM -0700, Philip > > Lavine wrote: > > > > > > If I where to connect to SIAC thru a SONNET ring > > who's > > > would it be? Is it private or public? > > > > They use any provider (Verizon, MCI, AT&T and ConEd > > Comm.), however > > ConED Comm. is their primary backbone provider. So, > > here's how you go > > about it. You order a line (DS-1, DS-3, 100Mb/s, > > Gig, whatever) from > > any of the providers you use (if I were you I would > > use either Verizon > > or ConEd Comm, I can give you the number for ConEd > > Comm. head sales > > person). You contact SIAC, and you start the > > paperwork to get your > > network connected into their backbone SONET. Once > > you get permit > > numbers, you have the provider drop a line into one > > of 5 data centers > > around NY area, and SIAC gives you a port on one of > > their Juniper > > Routers. They also give you a VLAN setup > > requirements so you can > > configure your border switch/router. The line is > > owned by you. SIAC > > only gives you a port on their routers. NOTE: NEVER > > ORDER ONE LINE. > > ORDER TWO OR MORE LINES TO DIFFERENT SIAC DATA > > CENTERS. The cost for one > > port (one line) is as follows: > > > > MRC (Monthly Reaccuring Cost): $4,400.00 > > NRC (Non-Reaccuring Cost i.e. one time fee): $8,800 > > > > > > Any line you drop at SIAC will cost you that amount, > > and that's on top > > of the line costs from the provider. That's it. > > Hope this helps. Like > > I said it's a very long and tedious process getting > > the line up and > > running with SIAC. They are practically a > > government institution, and > > they don't move too fast for anybody. > > > > > > > > --- "R. Benjamin Kessler" <rbk(a)midwestnsg.com> > > wrote: > > > > > > > I've setup a highly-redundant connection for one > > of > > > > my clients (equipment in > > > > two different access-centers in two different > > > > cities). > > > > > > > > What are you looking to do? > > > > > > > > - Ben > > > > > > > > ~~~~~~~~~~ > > > > R. Benjamin Kessler > > > > Sr. Network Consultant > > > > CCIE #8762, CISSP, CCSE > > > > Midwest Network Services Group > > > > Email: rbk(a)midwestnsg.com > > > > http://www.midwestnsg.com > > > > Phone: 260-625-3273 > > > > > > > > -----Original Message----- > > > > From: owner-nanog(a)merit.edu > > > > [mailto:owner-nanog@merit.edu] On Behalf Of > > > > Philip Lavine > > > > Sent: Friday, September 17, 2004 2:38 PM > > > > To: nanog(a)merit.edu > > > > Subject: NYSE > > > > > > > > > > > > Does anyone have experience in setting up a > > direct > > > > connection with NYSE, specifically SIAC or SFTI? > > > > > > > > > > > > > > > > > > __________________________________ > > > > Do you Yahoo!? > > > > Read only the mail you want - Yahoo! Mail > > SpamGuard. > > > > http://promotions.yahoo.com/new_mail > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > __________________________________ > > > Do you Yahoo!? > > > New and Improved Yahoo! Mail - Send 10MB messages! > > > http://promotions.yahoo.com/new_mail > > > > -- > > Alen Capalik > > CTO > > Wiretap Networks Inc. > > > > Tel: (310)497-3512 > > Email: alen(a)wiretapnetworks.com > > Website: http://www.wiretapnetworks.com > > > > /* > > * Anything that is considered impossibility, > > * will in fact occur with absolute certainty. > > */ > > > > > __________________________________________________ > Do You Yahoo!? > Tired of spam? Yahoo! Mail has the best spam protection around > http://mail.yahoo.com -- Alen Capalik CTO Wiretap Networks Inc. Tel: (310)497-3512 Email: alen(a)wiretapnetworks.com Website: http://www.wiretapnetworks.com /* * Anything that is considered impossibility, * will in fact occur with absolute certainty. */

3 2

Re: RE: RE: RE: NYSE
by sgorman1＠gmu.edu 22 Sep '04

22 Sep '04

Backhoes are not the threat I was worried about - no need to beat a dead horse though or continue this in a public forum. The difference between viewing the world at layer 1 vs layer 3. ----- Original Message ----- From: "R. Benjamin Kessler" <rbk(a)midwestnsg.com> Date: Tuesday, September 21, 2004 12:38 pm Subject: RE: RE: RE: NYSE > My understanding is that the way the SFTI network is built the > loss of an > entire ring between Site A and Site B wouldn't cause an outage > because Site > B would also have a ring between it and Site C and Site A would be > connectedto Site n. > > I can't speak to how the fibers were procured and whether or not > they're in > their own rights-of-way (as another poster suggested; I'd guess > that they're > using previously dark fiber in existing bundles). > > Based-on the drawings I've seen (unfortunately, they don't appear > to be on > SFTI's web site so they must be considered proprietary) the > multiple rings > are separated in some places by several hundred miles to prevent > the single > back hoe incident. > > Aside from the $$ and the joy of dealing with SIAC (they tend to > be a bit > inflexible at times), the infrastructure has been quite stable in > the 18 > months that my client has been using it. > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of > sgorman1(a)gmu.edu > Sent: Tuesday, September 21, 2004 10:31 AM > To: Temkin, David > Cc: Alen Capalik; Philip Lavine; nanog > Subject: Re: RE: RE: NYSE > > > > So, that would be a another conduit sitting in the same right of > way, and > this is supposed to make it "completely independent". Last time I > checked a > backhoe treated all conduits the same. Not trying to shoot the > messangerjsut trying to make a point. > > Points of entry is different than the number of pipes. The > biggest single > problem in the security of these networks is physical diversity, > at least in > my biased point of view. There are six different sets of right of > ways in > Manhattan and forty something fiber providers, but no one seems to > fess up > when they are not offering redundancy but just another pipe in the > sameconduit. Do the math and you see the problem. It is not just > a SFTI > problem but a generic problem. Just worrisome that it appears > that SFTI > does not see it as a problem, or worse view at as a problem they > have solved > by laying new pipe in the same conduits. > > The problem rears it head in several examples where effeciency and > costsavings trumps true diversity. > > ----- Original Message ----- > From: "Temkin, David" <temkin(a)sig.com> > Date: Tuesday, September 21, 2004 11:11 am > Subject: RE: RE: NYSE > > > It's my understanding that > > A) The providers of the actual ring did install "Separate" fiber for > > SFTI but I have no idea whether or not they're in new rights of > > way - > > I'm willing to bet not > > > > B) Reducing the points of entry into the ring reduces complexity and > > makes it much easier to recover the ring in the event of a disaster. > > Understanding that SIAC has thousands and thouands of customers > > connecting at the DS-3+ level to get data that's generated from one > > place means that you need to keep the distribution uniform. > > Basically,it boils down to them being able to say "Our ring is > up, > > if your > > connectivity to our ring is down it's your problem" in order to > > maintainfairness between Trading firm A that has 10 people and > > Trading firm B > > that has 10,000 people. > > > > When they were maintaining separate interfaces for each customer > they> could potentially run into issues where they'd get certain > larger > > firmsback able to trade sooner than smaller ones and then you > > create unfair > > market disadvantages. > > > > > -----Original Message----- > > > From: sgorman1(a)gmu.edu [mailto:sgorman1@gmu.edu] > > > Sent: Tuesday, September 21, 2004 10:40 AM > > > To: Temkin, David > > > Cc: Alen Capalik; Philip Lavine; nanog > > > Subject: Re: RE: NYSE > > > > > > > > > There are a few things about the SFTI set up that are a bit > > > baffling to me. From their website: > > > > > > SFTI carries IP traffic over a topology of redundant, > > > self-healing fiber-optic rings, completely independent of all > > > other telco circuits and conduits. SFTI's design is > > > straightforward, consolidating traffic into fewer pipes, > > > which minimizes complexity and reduces the number of > > > potential points of failure. > > > > > > What does "completely independent of all other telco circuits > > > and conduits" mean? Did they get their very own "new" right > > > of ways dug out. A certain government report listed their > > > physical fiber provider, and they certainly are not new right > > > of ways. Further, I'm a bit baffled how reducing the number > > > of pipes reduces the number of potential points of failure. > > > Usually fewer pipes means less diversity. A ring is nice > > > till someone hits it in two places. I also wonder how many > > > of these rings are collapsed in a single conduit. I hope > > > someone over there is asking tough questions and are > > > following up on getting a second physical fiber provider. > > > I'd recommend not advertising who it this time either. > > > > > > ----- Original Message ----- > > > From: "Temkin, David" <temkin(a)sig.com> > > > Date: Tuesday, September 21, 2004 9:45 am > > > Subject: RE: NYSE > > > > > > > > > > > You can no longer order "direct" lines to SIAC unless you > have > > an > > > > extremely compelling reason. Nowadays you must order a > > > line to "SFTI" > > > > which is their Disaster-Recovery-centric service. You are > > correct > > > > aboutthe connection method, but he will need to be specific > > and > > > > understandthat he wants to connect to SFTI and not just "SIAC" > > > > directly anymore. > > > > > > > > See: https://sfti.siac.com/sfti/index.jsp for more details. > > > > > > > > > > > > > > > > > -----Original Message----- > > > > > From: owner-nanog(a)merit.edu > > > [mailto:owner-nanog@merit.edu] On Behalf > > > > > Of Alen Capalik > > > > > Sent: Monday, September 20, 2004 10:20 PM > > > > > To: Philip Lavine > > > > > Cc: nanog > > > > > Subject: Re: NYSE > > > > > > > > > > > > > > > > > > > > On Mon, Sep 20, 2004 at 10:36:16AM -0700, Philip Lavine wrote: > > > > > > > > > > > > If I where to connect to SIAC thru a SONNET ring who's > > > > > would it be? Is > > > > > > it private or public? > > > > > > > > > > They use any provider (Verizon, MCI, AT&T and ConEd > > > Comm.), however > > > > > ConED Comm. is their primary backbone provider. So, > > > here's how you > > > > > go about it. You order a line (DS-1, DS-3, 100Mb/s, Gig, > > > whatever) > > > > > from any of the providers you use (if I were you I would > > > use either > > > > > Verizon or ConEd Comm, I can give you the number for ConEd > > Comm. > > > > > head sales person). You contact SIAC, and you start the > > > paperwork > > > > > to get your network connected into their backbone SONET. > > > Once you > > > > > get permit numbers, you have the provider drop a line > > > into one of 5 > > > > > data centers around NY area, and SIAC gives you a port on > > one of > > > > > their Juniper Routers. They also give you a VLAN setup > > > requirements > > > > > so you can configure your border switch/router. > > > > > The line is owned by you. SIAC only gives you a port on > > their > > > > > routers. NOTE: NEVER ORDER ONE LINE. > > > > > ORDER TWO OR MORE LINES TO DIFFERENT SIAC DATA CENTERS. > The > > cost > > > > > for one port (one line) is as follows: > > > > > > > > > > MRC (Monthly Reaccuring Cost): > > > > > $4,400.00 > > > > > NRC (Non-Reaccuring Cost i.e. one time fee): $8,800 > > > > > > > > > > Any line you drop at SIAC will cost you that amount, and > > > that's on > > > > > top of the line costs from the provider. That's it. Hope > > this > > > > > helps. Like I said it's a very long and tedious process > > > getting the > > > > > line up and running with SIAC. > > > > > They are practically a government institution, and they > > > don't move > > > > > too fast for anybody. > > > > > > > > > > > > > > > > > --- "R. Benjamin Kessler" <rbk(a)midwestnsg.com> wrote: > > > > > > > > > > > > > I've setup a highly-redundant connection for one of my > > > > clients > > > > > > > (equipment in two different access-centers in two > > > > > different cities). > > > > > > > > > > > > > > What are you looking to do? > > > > > > > > > > > > > > - Ben > > > > > > > > > > > > > > ~~~~~~~~~~ > > > > > > > R. Benjamin Kessler > > > > > > > Sr. Network Consultant > > > > > > > CCIE #8762, CISSP, CCSE > > > > > > > Midwest Network Services Group > > > > > > > Email: rbk(a)midwestnsg.com > > > > > > > http://www.midwestnsg.com > > > > > > > Phone: 260-625-3273 > > > > > > > > > > > > > > -----Original Message----- > > > > > > > From: owner-nanog(a)merit.edu > > > > > > > [mailto:owner-nanog@merit.edu] On Behalf Of Philip Lavine > > > > > > > Sent: Friday, September 17, 2004 2:38 PM > > > > > > > To: nanog(a)merit.edu > > > > > > > Subject: NYSE > > > > > > > > > > > > > > > > > > > > > Does anyone have experience in setting up a direct > > > > > connection with > > > > > > > NYSE, specifically SIAC or SFTI? > > > > > > > > > > > > > > > > > > > > > > > > > > > > __________________________________ > > > > > > > Do you Yahoo!? > > > > > > > Read only the mail you want - Yahoo! Mail SpamGuard. > > > > > > > http://promotions.yahoo.com/new_mail > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > __________________________________ > > > > > > Do you Yahoo!? > > > > > > New and Improved Yahoo! Mail - Send 10MB messages! > > > > > > http://promotions.yahoo.com/new_mail > > > > > > > > > > -- > > > > > Alen Capalik > > > > > CTO > > > > > Wiretap Networks Inc. > > > > > > > > > > Tel: (310)497-3512 > > > > > Email: alen(a)wiretapnetworks.com > > > > > Website: http://www.wiretapnetworks.com > > > > > > > > > > /* > > > > > * Anything that is considered impossibility, > > > > > * will in fact occur with absolute certainty. > > > > > */ > > > > > > > > > > > > > > > > > IMPORTANT: The information contained in this email and/or > its > > > > attachments is confidential. If you are not the intended > > recipient, > > > > please notify the sender immediately by reply and > > > immediately delete > > > > this message and all its attachments. Any review, use, > > > reproduction, > > > > disclosure or dissemination of this message or any > attachment > > by an > > > > unintended recipient is strictly prohibited. Neither this > > > message nor > > > > any attachment is intended as or should be construed as an > > offer, > > > > solicitation or recommendation to buy or sell any security > or > > other > > > > financial instrument. Neither the sender, his or her > > > employer nor any > > > > of their respective affiliates makes any warranties as to > the > > > > completeness or accuracy of any of the information > > > contained herein or > > > > that this message or any of its attachments is free of viruses. > > > > > > > > > > > > > > > IMPORTANT: The information contained in this email and/or its > > attachments is confidential. If you are not the intended > > recipient, please notify the sender immediately by reply and > > immediately delete this message and all its attachments. Any > > review, use, reproduction, disclosure or dissemination of this > > message or any attachment by an unintended recipient is strictly > > prohibited. Neither this message nor any attachment is intended > > as or should be construed as an offer, solicitation or > > recommendation to buy or sell any security or other financial > > instrument. Neither the sender, his or her employer nor any of > > their respective affiliates makes any warranties as to the > > completeness or accuracy of any of the information contained > > herein or that this message or any of its attachments is free of > > viruses. > > > >

1 0

New Improved Worm nonsense
by J. Oquendo 22 Sep '04

22 Sep '04

I've managed to get more information should anyone care to take peek at what one machine I ran into had. Quickie (ugly) write up/dissection includes two irclogs stored on the infected machine, parsed infected machine IP addresses (good to check if your network is spewing worm/virus traffic), and to get an overall assessment of this annoyance. Cross posted this to UNISog http://infiltrated.net/setver32-variables.html =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D lynx -dump 0xD1.0x5E.0x7B.0x9B/fatal|sed '1!G;h;$!d;s/\#/ /g;s/\+/ /g sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net "How can we account for our present situation unless we believe that men high in this government are concerting to deliver us to disaster?" Joseph McCarthy "America's Retreat from Victory"

1 0

Re: The worst abuse e-mail ever, sverige.net
by james edwards 22 Sep '04

22 Sep '04

> The port 25 blocking seemed like a real good idea. > > -M I disagree. Port blocking does not change user behavior & it is user behavior that is causing this problem. Blocking just hides it. I used to believe in port blocking as the solution to many user problems but now I have 3 and 4 page ACL's on my border routers. This does not scale. Yes, I could push this out via radius to the NAS but again this does not solve the problem. I feel blocking just pushes us closer to ports loosing their uniqueness, as we have seen with PTP filesharing. The solution I am working toward is quickly identifying user infections. We are almost there. I collect and record all traffic from the users going to dark space and am almost finished with the system that will identify who held that IP at a specific time. It is all in SQL so that is easy. We already have a system in place where users, after multiple virus problems, must obtain protection software prior to being re-enabled. Ramping up the amount of proof we have at hand will allow us to enforce our existing AUP. The key to changing a behavior is to create consequences to this behavior. I have noticed we never have problems getting a user to get virus/firewall software after they pay to have their box disinfected. Hit the users first with e-mails, then phone contact, ending with being shut off should create the consequences needed to change their behavior. james

2 1