- NANOG - lists.nanog.org

Fwd: Re: Are AOL's MXs mass rejecting anyone else's emails?
by Andrew Paprocki 12 Aug '04

12 Aug '04

This message was sent to me offline after my post to the list. This apparently solved our problems. Just sending back to the list so anyone else searching for this issue can find an answer. Thanks NANOG! -Andrew > ----- Begin Forwarded Message ----- > > To: andrew(a)ishiboo.com > From: ajensen(a)ntsi.us > Subject: Re: Are AOL's MXs mass rejecting anyone else's emails? > Date: Wed, 11 Aug 2004 11:41:24 -0700 > > Andrew, > > I lurk on the NANOG list for interesting topics (can't currently post thru). I > started having this exact same problem in June with AOL. Spent an hour on the > phone with "Michael W" (linuxwolff(a)aol.com) and another couple hours doing > debuging via telnet to their servers before figuring it out. > > The problem in my case is that they seem to have put in place an email header > order filter (which gives back the 554 RLY:FA error if failed). Of course, the > web/mail masters didn;t seem to have any idea the mail admins did this. > > In my case, the problem is caused by the position of the "From:", "Mime:", and > "Content:" headers. The "From:" header MUST come before the other 2 in the > message flow, otherwise it is rejected. I don't know of any RFC which dictates > email header order... but apparently AOL is filtering on it... I forwarded this > info to them long ago and Michael said he would "add it to their notes". > > Below is the message I sent them with the details: > --- > >Date: Thu, 10 Jun 2004 12:22:35 -0700 > >From: ajensen(a)ntsi.us > >Subject: Bouncing email - believe to have found the problem > >To: linuxwolff(a)aol.com > > > > I think I have found the problem with the 554 RLY:FA error message. > > According > > to > > my logs, I have been able to successfully send you a few messages. > > > > The problem appears to lie in the processing of mail header order within the > > email message itself, not the SMTP "MAIL FROM" or "RCPT TO" commands. > > Previously when I sent out email, the headers of the email would look > > something > > like: > > > > Received from: <blah blah blah> > > To: <recipient@address> > > Subject: <subject> > > MIME-Version: 1.0 > > Content-type: text/html; charset=iso-8859-1 > > From: <tagged_sender@address> > > Message-Id: <20040610185105.88AD63B8114(a)www.ntsi.us> > > Date: <date string> > > > > <Message>... > > > > This was done through a PHP script using the "mail()" function, based on > > the > > example 4 in the PHP manual (http://www.php.net/manual/en/function.mail.php) > > (NOTE: in the example they have To/From/CC: and Bcc: headers following > > MIME/Content headers). This method still works fine through several other > > mail > > servers (cox.net, arizona.edu, af.mil) and had worked fine for the past year > > with aol.com. As of approximately Jun 9th, 4pm MST (or earlier, was working > > at > > 10am according to my logs), this no longer works with AOL servers. > > > > After some manipulation I have found that for the AOL servers, the From: > > header > > (regardless of the SMTP "MAIL FROM" command) MUST come before the MIME > > and/or > > Content headers within the email message. It appears that reordering the > > To/From/CC: headers does not affect the outcome, so long as the From: header > > precedes the MIME: and Content: headers of the message. > > > > Therefore, for a message to get through to an AOL user, the message must be > > formatted in the manner of: > > > > Received from: <blah blah blah> > > To: <recipient@address> > > Subject: <subject> > > From: <tagged_sender@address> > > MIME-Version: 1.0 > > Content-type: text/html; charset=iso-8859-1 > > Message-Id: <20040610185105.88AD63B8114(a)www.ntsi.us> > > Date: <date string> > > > > <Message>... > > > > > Adrian Jensen > ajensen(a)ntsi.us > Systems Administrator > National Traffic Safety Institute > Tucson, Az > > ---------------------------------------------------------------- > This mail was sent through webmail services for the > National Traffic Safety Institute and may contain > privileged and confidential information. Use or > interception by any intermediate agency or > individual is prohibited. > > > > ----- End Forwarded Message -----

1 0

RE: Legal intercept - 3550
by Burton, Chris 12 Aug '04

12 Aug '04

You could setup a Linux/Solaris (or other) device (It would need to be GigE capable) and span all of the data to that port and then use either iptables/ipchains to log the data and drop what don't need or use ethereal/tcpdump to capture the data using filters to weed out the information you do not need. Also as mentioned in a previous reply you could use the VLAN ACL features depending on your IOS version. There are several ways to achieve what you are looking to do; it just depends on your level of comfort with configuring the methods mentioned and of course cost. Chris Burton Network Engineer Walt Disney Internet Group: Network Services The information contained in this e-mail message is confidential, intended only for the use of the individual or entity named above. If the reader of this e-mail is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any review, dissemination, distribution or copying of this communication is strictly prohibited. If you have received this e-mail in error, please contact Walt Disney Internet Group at 206-664-4000. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Stefan Baltus Sent: Wednesday, August 11, 2004 12:05 PM To: nanog(a)merit.edu Subject: Re: Legal intercept - 3550 Thanks for all the replies. The best solution was by Boyan Krosnov who suggested the following: Configure the GE port where the traffic comes in from the fiber tap in a separate new vlan A, access mode. Configure fastethernet X to be in access mode for vlan A. Configure a static mac entry for vlan A pointing the destination mac address of the router where the traffic heads to to fastethernet X. Connect your sniffer on Fastethernet X. -- at this stage all traffic going to that router will be dumped to the sniffer. Not precisely what you want. -- now comes the trick Configure a VLAN access-map http://www.cisco.com/en/US/products/hw/switches/ps646/products_command_r eference_chapter09186a008021145c.html ip access-list ext acl1 permit ip host x.x.x.x any permit ip any host x.x.x.x vlan access-map alabala match ip address acl1 action forward vlan filter alabala vlan-list A This works for my case. Boyan: thanks a lot. Stefan On Wed, Aug 11, 2004 at 04:37:24PM +0200, Stefan Baltus wrote: > > Hi, > > We have a situation where we need to intercept certain IP traffic that > is somewhere within a link of 300Mbit/s of traffic (GigabitEthernet). > The setup that we built is as follows: > > router > ^ > | GE > | > fiber tap -------> cisco catalyst 3550 > | > | GE > v > switch > > > The catalyst 3350 is receiving the traffic from router to switch and > vice versa. Now, we'd like to filter all but certain IP's on the 3350 > and switch this traffic to a FE port on that same 3550. Currently > we've put the FE interface in SPAN mode, but that fills up the FE port > completely (obviously). Is there any way to accomplish this? > > Regards, > > Stefan > > -- > Stefan Baltus <stefan.baltus(a)xbn.nl> XB Networks B.V. > Manager Engineering Televisieweg 2 > telefoon: +31 36 5462400 1322 AC Almere > fax: +31 36 5462424 The Netherlands -- Stefan Baltus <stefan.baltus(a)xbn.nl> XB Networks B.V. Manager Engineering Televisieweg 2 telefoon: +31 36 5462400 1322 AC Almere fax: +31 36 5462424 The Netherlands

1 0

Datacenter
by Daniel Corbe 12 Aug '04

12 Aug '04

Hello, My company is looking to build a new Datacenter in the Ft. Lauderdale area of florida. This is my first such experience building one from scratch. Does anyone have or know of an available design guide? What kind of options are available for backup power? (IE low or midrange Diesel generators, Backup Battery Arrays, etc) Can someone recommend a good electrician that has experience with Datacenters? What about enviornmental controls? (IE A/C Systems, Fire Supression systems designed for datacenters, Humidity control, access control (key card/pad systems), etc) Anyone out there do raised flooring cheaply? :)

1 0

verizon postmaster contact?
by Brian Russo 11 Aug '04

11 Aug '04

Can someone with verizon mail/postmaster group get in touch with me. thanks, - bri -- Recursivity. Call back if it happens again.

1 0

Testing procedures for new network implementation?
by Wayne Chow 11 Aug '04

11 Aug '04

Hi All We are in the process of planning for the upgrade of a 3Com network. The new infrastructure will be comprised of 3Com 4950s with XRN and a dozen stacks of 4400s. What are the best practices of testing the new implementation? Any advices or suggestions would be greatly appreciated. The only software that we have is the 3Com Network Director. Thank you in advance. Wayne Chow Network Administrator Faculty of Dentistry, University of Toronto

4 4

Legal intercept - 3550
by Stefan Baltus 11 Aug '04

11 Aug '04

Hi, We have a situation where we need to intercept certain IP traffic that is somewhere within a link of 300Mbit/s of traffic (GigabitEthernet). The setup that we built is as follows: router ^ | GE | fiber tap -------> cisco catalyst 3550 | | GE v switch The catalyst 3350 is receiving the traffic from router to switch and vice versa. Now, we'd like to filter all but certain IP's on the 3350 and switch this traffic to a FE port on that same 3550. Currently we've put the FE interface in SPAN mode, but that fills up the FE port completely (obviously). Is there any way to accomplish this? Regards, Stefan -- Stefan Baltus <stefan.baltus(a)xbn.nl> XB Networks B.V. Manager Engineering Televisieweg 2 telefoon: +31 36 5462400 1322 AC Almere fax: +31 36 5462424 The Netherlands

5 5

Verizon Data (T1) Rep?
by Jonathan M. Slivko 11 Aug '04

11 Aug '04

Hello, Can a Verizon Data (T1) Rep. please call/contact me off list ASAP? Thanks! -- Jonathan -- Jonathan M. Slivko Invisible Hand Networks, Inc. 670 Broadway, Suite 302 New York, NY 10012 Phone: (212) 226-1422 x601 Fax: (212) 202-7640 jslivko(a)invisiblehand.net

1 0

Are AOL's MXs mass rejecting anyone else's emails?
by Andrew Paprocki 11 Aug '04

11 Aug '04

We're currently getting this from AOL MX servers: 64.12.138.57 failed after I sent the message. Remote host said: 554-: (RLY:FA) http://postmaster.info.aol.com/errors/554rlyfa.html 554 TRANSACTION FAILED Yet, after viewing their alleged reason for rejecting the mail, we can find nothing wrong with our mail headers. Wondering if this is a bug on AOL's side or if anyone else has encountered/fixed this issue to stop the bouncing mail? -Andrew

1 0

Floorspace / Power Possibilities - location independant
by Micah McNelly 11 Aug '04

11 Aug '04

Guys/Gals, I'm currently digging for cheap floorspace / power / network with no specific geographical region in mind. If you know of any well managed facilities with very low per square foot cost and cheap power (no hamsters please) please respond to me offlist. Should be carrier neutral but have bandwidth available. Thanks, /m

1 0

Re: That MIT paper
by Joe Shen 11 Aug '04

11 Aug '04

Hi, >The paper doesn't pass any judgement on types of lookups, but obviously >not all DNS lookups are equal from the end user perspective. In our observation, looking for IP address consists 70% of our cache server load, MX consists of 14% and PTR only occupies 5%. And, on the other hand, the coarse analysis of our network traffic shows, Web traffic occupies only 8% while stream meadia occupies the most part of traffic. So, the authors the conclusion may be correct as viewing film online does not rely on DNS so much as browsing web pages. But, to my understanding a too short TTL will do harm to cache server performance esp. the amount of RR cached is so large that BIND have to wait for swapping I/O and re-fetching those timeout RR again. >"In our follow-up measurement study, [we found] that DNSBL related > DNS lookups at CSAIL in February 2004 account for 14% of all DNS > lookups. In comparison, DNSBL related traffic accounted for merely > 0.4% of all DNS lookups at CSAIL in December 2000." Is these work published or available publicly? Any work done with performance tuning with cache server? > 1. almost nobody has time to invest in reading this kind of paper. > 2. almost everybody is willing to form a strong opinion regardless of that. > 3. people from #2 use the paper they didn't read in #1 to justify an opinion. people rely on their experience, but science tries to find on basis of analysis. Usually, we met problems which is caused by people replace scientific conclusion with their experience. Joe ---- Introducing Spymac MailPro: http://www.spymac.com/mailpro/

2 1