- NANOG - lists.nanog.org

Re: Attn MCI/UUNet - Massive abuse from your network
by Jeff Shultz 25 Jun '04

25 Jun '04

** Reply to message from Brad Knowles <brad.knowles(a)skynet.be> on Fri, 25 Jun 2004 18:14:43 +0200 > At 8:44 AM -0700 2004-06-25, Jeff Shultz wrote: > > > At least if someone in this "clearing house" sells it to the > > terrorists, they will have had to work for it a bit, instead of having > > us hand it to them on a silver platter, as the FCC seems to want. > > Not true. If the information is forced to be completely in the > open, then everyone knows it's not insecure and no one depends on the > fact that it was supposed to be kept secret. This is a case where > you are more secure the more open the information is -- indeed, as we > are in most cases, which is why we have the age-old security mantra > of "security through obscurity is not secure". > Do you realize that the basic element of security, the password, is based on the entire premise you just dismissed? And yet we still use them - and depend on the fact that they are supposed to be kept secret. The problem with being totally open about infrastructure is that there are some vulnerabilities that simply cannot or will not be fixed - wires sometimes have to run across bridges, redundant pumping stations are too expensive... in these cases is it not better to hide where these vulnerabilities are? The problem with your point is that even if the information is forced to be completely in the open, that is no guarantee that it will be fixed, and people _do_ depend on this stuff, regardless of its reliability or security. Do you really think that if we publish all the insecurities of the Internet infrastructure that anyone is gonna stop using it, or business, government, and private citizens are going to quit depending on it? Security through obscurity is not secure - but sometimes it's all you have. -- Jeff Shultz A railfan pulls up to a RR crossing hoping that there will be a train.

4 3

RE: Unplugging spamming PCs
by Larry Pingree 25 Jun '04

25 Jun '04

What I am proposing is have a registry that you must register with before other mail servers will accept mail from you. Similar to how MAPS RBL works, but the mail server itself, enforces it, rather than a firewall or a ancillary device ACL. This could be made a standard of SMTP. LP Best Regards, Larry Larry Pingree 408-543-2190 "Visionary people, are visionary, partly because of the great many things they never get to see." - Larry Pingree -----Original Message----- From: Joe Shen [mailto:jshen@spymac.com] Sent: Thursday, June 24, 2004 6:36 PM To: Larry Pingree Cc: nanog(a)merit.edu Subject: RE: Unplugging spamming PCs Hi, >Mail servers should be registered just like domains and shutdown by a >registrar if they are misusing their registered services. This really >needs to be handled by a multi-lateral legal solution, industry will not >fix it alone. No, I don't think this is good solution First of all, we could not ask customers to register everything they planned with leased line without legal reasons. Second, if I hire DSL/leased_line service from ISP and set up domain name for myself, ISP could not ask me to tell them which port should be opened as I'm not taking a firewalling service, I'm not a member of my service provider. I should be able to do anything that are not perhibited by law or affact someothers. Blocking_port_25 indicates ISP pre-assume that customers will SPAM their network. But, SPAMmer is just a very small group of people. Maybe most of them comes from other countries ( what happens in China). To me, the proper way of anti-spam may ask cooperation between ISPs and Email service providers. Anyway, strengthening anti-spam ability in Email server is a must. regards Joe > >LP > >Best Regards, > >Larry Cool Things Happen When Mac Users Meet! Join the community in Boston this July: www.macworldexpo.com

3 3

Weekly Routing Table Report
by Routing Table Analysis 25 Jun '04

25 Jun '04

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 26 Jun, 2004 Analysis Summary ---------------- BGP routing table entries examined: 142373 Prefixes after maximum aggregation: 85321 Unique aggregates announced to Internet: 68213 Total ASes present in the Internet Routing Table: 17497 Origin-only ASes present in the Internet Routing Table: 15162 Origin ASes announcing only one prefix: 7068 Transit ASes present in the Internet Routing Table: 2335 Transit-only ASes present in the Internet Routing Table: 73 Average AS path length visible in the Internet Routing Table: 4.9 Max AS path length visible: 26 Illegal AS announcements present in the Routing Table: 8 Non-routable prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 19 Number of addresses announced to Internet: 1314051868 Equivalent to 78 /8s, 82 /16s and 215 /24s Percentage of available address space announced: 35.5 Percentage of allocated address space announced: 58.2 Percentage of available address space allocated: 60.9 Total number of prefixes smaller than registry allocations: 65586 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 27046 Total APNIC prefixes after maximum aggregation: 14017 Prefixes being announced from the APNIC address blocks: 25273 Unique aggregates announced from the APNIC address blocks: 13910 APNIC Region origin ASes present in the Internet Routing Table: 2069 APNIC Region origin ASes announcing only one prefix: 614 APNIC Region transit ASes present in the Internet Routing Table: 335 Average APNIC Region AS path length visible: 4.9 Max APNIC Region AS path length visible: 16 Number of APNIC addresses announced to Internet: 150449920 Equivalent to 8 /8s, 247 /16s and 175 /24s Percentage of available APNIC address space announced: 68.7 APNIC AS Blocks 4608 - 4864, 7467 - 7722, 9216 - 10239 17408 - 18431, 23552 - 24575 APNIC Address Blocks 58/7, 60/7, 202/7, 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 81982 Total ARIN prefixes after maximum aggregation: 49940 Prefixes being announced from the ARIN address blocks: 63077 Unique aggregates announced from the ARIN address blocks: 21940 ARIN Region origin ASes present in the Internet Routing Table: 9279 ARIN Region origin ASes announcing only one prefix: 3303 ARIN Region transit ASes present in the Internet Routing Table: 909 Average ARIN Region AS path length visible: 4.7 Max ARIN Region AS path length visible: 17 Number of ARIN addresses announced to Internet: 225859360 Equivalent to 13 /8s, 118 /16s and 87 /24s Percentage of available ARIN address space announced: 74.8 ARIN AS Blocks 1 - 1876, 1902 - 2042, 2044 - 2046, 2048 - 2106 2138 - 2584, 2615 - 2772, 2823 - 2829, 2880 - 3153 3354 - 4607, 4865 - 5119, 5632 - 6655, 6912 - 7466 7723 - 8191, 10240 - 12287, 13312 - 15359 16384 - 17407, 18432 - 20479, 21504 - 23551 25600 - 26591, 26624 - 27647, 29695 - 30719 31744 - 33791 ARIN Address Blocks 24/8, 63/8, 64/6, 68/7, 70/8, 198/7, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 26020 Total RIPE prefixes after maximum aggregation: 18441 Prefixes being announced from the RIPE address blocks: 22802 Unique aggregates announced from the RIPE address blocks: 15175 RIPE Region origin ASes present in the Internet Routing Table: 5606 RIPE Region origin ASes announcing only one prefix: 3018 RIPE Region transit ASes present in the Internet Routing Table: 973 Average RIPE Region AS path length visible: 5.5 Max RIPE Region AS path length visible: 26 Number of RIPE addresses announced to Internet: 165059392 Equivalent to 9 /8s, 214 /16s and 155 /24s Percentage of available RIPE address space announced: 57.9 RIPE AS Blocks 1877 - 1901, 2043, 2047, 2107 - 2136, 2585 - 2614 2773 - 2822, 2830 - 2879, 3154 - 3353, 5377 - 5631 6656 - 6911, 8192 - 9215, 12288 - 13311, 15360 - 16383 20480 - 21503, 24576 - 25599, 28672 - 29695 30720 - 31743 RIPE Address Blocks 62/8, 80/5, 88/8, 188/8, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 6167 Total LACNIC prefixes after maximum aggregation: 2247 Prefixes being announced from the LACNIC address blocks: 5797 Unique aggregates announced from the LACNIC address blocks: 3556 LACNIC Region origin ASes present in the Internet Routing Table: 379 LACNIC Region origin ASes announcing only one prefix: 110 LACNIC Region transit ASes present in the Internet Routing Table: 75 Average LACNIC Region AS path length visible: 5.3 Max LACNIC Region AS path length visible: 16 Number of LACNIC addresses announced to Internet: 15110656 Equivalent to 0 /8s, 230 /16s and 146 /24s Percentage of available LACNIC address space announced: 45.0 LACNIC AS Blocks 26592 - 26623, 27648 - 28671 LACNIC Address Blocks 200/7 Emerging AfriNIC Region Analysis Summary ---------------------------------------- Prefixes being announced by AfriNIC Region ASes: 1155 Total AfriNIC prefixes after maximum aggregation: 676 Prefixes being announced from the AfriNIC address blocks: 782 Unique aggregates announced from the AfriNIC address blocks: 584 AfriNIC Region origin ASes present in the Internet Routing Table: 91 AfriNIC Region origin ASes announcing only one prefix: 23 AfriNIC Region transit ASes present in the Internet Routing Table: 12 Average AfriNIC Region AS path length visible: 5.0 Max AfriNIC Region AS path length visible: 16 Number of AfriNIC addresses announced to Internet: 1886720 Equivalent to 0 /8s, 28 /16s and 202 /24s Percentage of available AfriNIC address space announced: 11.2 AfriNIC AS Blocks <none> AfriNIC Address Blocks 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 1221 846 1075 614 Telstra Pty Ltd 4134 792 3664 146 Data Communications Bureau 4766 494 2896 264 Korea Internet Exchange for " 9583 460 38 98 Satyam Infoway Ltd., 4755 374 134 55 Videsh Sanchar Nigam Ltd. Aut 9443 353 69 78 Primus Telecommunications 2907 349 1840 327 SINET Japan 17676 341 5084 33 XTAGE CORPORATION 17557 337 23 165 Pakistan Telecom 703 327 359 256 UUNET 9929 322 156 33 China Netcom Corp. 2764 294 259 241 connect.com.au pty ltd 7474 263 268 206 Optus Communications Pty Ltd 9942 230 71 127 COMindico Australia 9800 224 369 62 CHINA UNICOM 9498 216 48 48 BHARTI BT INTERNET LTD. 10036 198 18 179 C&M Communication Co. Ltd. 4837 186 2019 105 chinanet IDC center beijing n 17974 184 51 99 PT TELEKOMUNIKASI INDONESIA 9304 174 161 25 Hutchison Telecom (HK) ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1448 6892 1002 AT&T 701 1297 8485 924 UUNET Technologies, Inc. 1239 939 2981 633 Sprint 6347 926 400 100 SAVVIS Communications Corpora 3356 899 10935 681 Level 3 Communications, LLC 557 769 63 15 University of Maine System Co 4323 740 555 204 Time Warner Communications, I 18566 724 192 8 Covad Communications 6197 707 525 276 BellSouth Network Solutions, 209 616 3469 508 Qwest 6198 575 439 221 BellSouth Network Solutions, 20115 562 373 288 Charter Communications 852 514 1142 402 Telus Advanced Communications 7843 511 661 128 Adelphia Corp. 7132 455 7872 341 Southwestern Bell Internet Se 2386 425 565 227 AT&T Data Communications Serv 721 393 13171 289 DLA Systems Automation Center 22909 393 825 26 Comcast Cable Corporation 4355 391 323 101 EarthLink, Inc. 705 390 128 266 UUNET Technologies, Inc. RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 647 2039 540 UUNET - Commercial IP service 3320 298 2468 236 Deutsche Telekom AG 3301 295 1098 268 TeliaNet Sweden 8220 271 428 259 COLT Internet - International 1257 247 497 195 SWIPnet Swedish IP Network 680 244 2025 239 DFN-IP service G-WiN 13083 216 51 8 Mannesmann Datenverarbeitung 3246 211 477 208 Song Networks 5515 199 843 144 Sonera Solution Autonomous Sy 8708 186 112 173 Romania Data Systems S.A. 3215 182 895 69 France Telecom Transpac 719 180 288 102 LANLINK autonomous system 25186 174 156 115 France Telecom Transpac's Tra 786 173 1778 173 The JANET IP Service 6746 156 29 127 Dynamic Network Technologies, 5400 144 205 120 BT Ignite European Backbone 3269 134 1099 64 TELECOM ITALIA 3303 133 611 132 Swisscom Ltd 12302 128 18 32 MobiFon S.A. 8866 126 14 11 Bulgarian Telecommunication C LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 11172 356 96 58 Servicios Alestra S.A de C.V 6140 343 140 67 ImpSat 8151 270 373 128 UniNet S.A. de C.V. 16814 203 13 7 NSS, S.A. 6147 181 82 21 Telefonica Del Peru 7303 146 53 30 Telecom Argentina Stet-France 6505 134 90 92 Global One Communicaoes Ltda 6503 131 202 89 AVANTEL, S.A. 11992 89 9 29 Integrated Systems 11556 87 57 24 Cable-Wireless Panama 6535 80 5 17 Chilesat Servicios Empresari 14420 77 5 27 ANDINATEL S.A. 14535 76 6 5 Techtel S.A. 15311 75 19 37 Telefonica Empresas 11311 73 7 20 Sinectis S.A. 5639 72 8 8 Telecommunications Services o 4270 71 18 9 Red de Interconexion Universi 14117 69 5 4 Telefonica del Sur S.A. 14259 67 4 5 GTD Internet S.A. 10292 66 6 25 TELECOMMUNICATIONS OF JAMAICA AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 253 632 220 The Internet Solution 5536 111 16 4 Internet Egypt Network 2018 94 297 92 Tertiary Education Network 2905 90 276 80 The Internetworking Company o 11845 38 9 11 Data Pro Business Online 24835 31 18 6 RAYA Telecom - Egypt 9129 28 3 4 UUNET Kenya 8524 25 2 4 AUCEGYPT Autonomous System 12455 25 4 2 Jambonet Autonomous system 16637 25 9 18 Johnnic e-Ventures 5713 24 125 23 Telkom SA Ltd 6713 24 38 9 Itissalat Al-MAGHRIB 14988 24 16 1 Botswana Telecommunications C 10798 18 1 12 Standard Bank of South Africa 15706 16 2 3 Sudatel Internet Exchange Aut 12258 15 3 10 Vodacom Internet Company 8346 13 6 12 SONATEL-AS Autonomous System 17148 13 1 7 First National Bank 21280 13 2 3 Swift Global Kenya Ltd.Is an 2609 12 26 4 Tunisia BackBone AS Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 6347 926 826 SAVVIS Communications Corpora 557 769 754 University of Maine System Co 18566 724 716 Covad Communications 4134 792 646 Data Communications Bureau 4323 740 536 Time Warner Communications, I 6197 707 431 BellSouth Network Solutions, 7843 511 383 Adelphia Corp. 701 1297 373 UUNET Technologies, Inc. 22909 393 367 Comcast Cable Corporation 5668 384 367 Century Telephone 9583 460 362 Satyam Infoway Ltd., 27364 376 357 Armstrong Cable Services 6198 575 354 BellSouth Network Solutions, 22773 388 332 Cox Communications, Inc. Atla 4755 374 319 Videsh Sanchar Nigam Ltd. Aut 17676 341 308 XTAGE CORPORATION 1239 939 306 Sprint 11172 356 298 Servicios Alestra S.A de C.V 4355 391 290 EarthLink, Inc. 9929 322 289 China Netcom Corp. List of Unregistered ASNs (Global) ---------------------------------- Bad AS Designation Network Transit AS Description 18416 UNALLOCATED 61.56.96.0/24 9919 New Century InfoComm 18416 UNALLOCATED 61.56.96.0/20 9919 New Century InfoComm 18416 UNALLOCATED 61.56.97.0/24 9919 New Century InfoComm 18416 UNALLOCATED 61.56.98.0/24 9919 New Century InfoComm 65501 PRIVATE 66.60.187.0/24 14051 Roseville Telephone 65501 PRIVATE 66.60.188.0/22 14051 Roseville Telephone 1877 UNALLOCATED 192.108.199.0/24 1876 Southern Methodist U 18412 UNALLOCATED 211.77.0.0/19 9674 Far EastTone Telecom Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 132.0.0.0/10 568 DISO-UNRRA 137.0.0.0/13 721 DLA Systems Automation Center 156.154.16.0/22 7786 Lockheed Martin IMS 158.0.0.0/13 721 DLA Systems Automation Center 164.234.0.0/18 721 DLA Systems Automation Center 164.234.0.0/16 721 DLA Systems Automation Center 192.43.230.0/24 4738 South Australian Academic Res 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.83.16.0/20 5515 Sonera Solution Autonomous Sy 192.83.32.0/19 5515 Sonera Solution Autonomous Sy 192.83.96.0/22 5515 Sonera Solution Autonomous Sy 192.83.100.0/24 5515 Sonera Solution Autonomous Sy 192.84.205.0/24 719 LANLINK autonomous system 192.119.135.0/24 270 NASA 192.135.50.0/24 7018 AT&T 192.136.79.0/24 719 LANLINK autonomous system 192.172.0.0/19 568 DISO-UNRRA 192.172.11.0/24 721 DLA Systems Automation Center Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:3 /10:6 /11:15 /12:59 /13:124 /14:301 /15:519 /16:7884 /17:2073 /18:3639 /19:9480 /20:9958 /21:7314 /22:10367 /23:11886 /24:77349 /25:373 /26:387 /27:347 /28:173 /29:15 /30:68 /31:0 /32:14 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 557 736 769 University of Maine System Co 18566 707 724 Covad Communications 6347 702 926 SAVVIS Communications Corpora 7018 563 1448 AT&T 6197 536 707 BellSouth Network Solutions, 3356 504 899 Level 3 Communications, LLC 6198 405 575 BellSouth Network Solutions, 702 395 647 UUNET - Commercial IP service 1239 372 939 Sprint 701 366 1297 UUNET Technologies, Inc. 27364 364 376 Armstrong Cable Services 5668 335 384 Century Telephone 4766 313 494 Korea Internet Exchange for " 9583 309 460 Satyam Infoway Ltd., 20115 297 562 Charter Communications 9929 255 322 China Netcom Corp. 14824 254 278 NewSouth Communications Corp. 3320 247 298 Deutsche Telekom AG 690 246 282 Merit Network 25844 244 244 Skadden, Arps, Slate, Meagher Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:3 12:826 13:1 15:5 16:2 17:3 20:8 24:750 32:65 33:1 38:72 40:53 44:4 55:1 56:3 57:15 61:451 62:507 63:1858 64:2028 65:2046 66:2595 67:326 68:500 69:584 70:64 80:531 81:323 82:181 83:92 84:3 128:148 129:176 130:77 131:187 132:21 133:1 134:182 135:17 136:182 137:54 138:167 139:37 140:215 141:124 142:118 143:57 144:100 145:41 146:308 147:77 148:410 149:119 150:96 151:71 152:165 153:64 154:2 155:122 156:60 157:60 158:145 159:147 160:52 161:64 162:383 163:76 164:180 165:159 166:100 167:217 168:228 169:161 170:286 171:8 192:5563 193:2781 194:2046 195:1371 196:555 198:3694 199:3105 200:3552 201:8 202:4675 203:5639 204:3110 205:2098 206:2308 207:2536 208:2218 209:3019 210:1425 211:557 212:993 213:1175 214:66 215:30 216:3734 217:943 218:169 219:112 220:232 221:30 222:40 End of report

1 0

Looking Glass Wiki
by Janet Sullivan 25 Jun '04

25 Jun '04

Since I've been hitting a lot of looking glass sites on traceroute.org lately that no longer worked, I decided to make my own list in wiki form. That way, as links drop off the face of the earth, or as new looking glass pages turn up, the community can edit the wiki page to keep it current. If anyone is interested, its at http://www.bgp4.net/cgi-bin/bgp4wiki.cgi?Looking_Glasses_Wiki and currently lists well over 200 looking glasses.

3 3

RE: Attn MCI/UUNet - Massive abuse from your network
by Smith, Donald 25 Jun '04

25 Jun '04

I am not a lawyer. I am not aware of the law that requires uunet to go to court to prevent spammers who are not their direct customers from using their network. Spammers use many differnt means to send their spam. Most ISPs use AUP's to prevent spamming but afaik no isp has successfully sued a spammer and recovered any reasonable percentage of their expenses in fighting this same spam. When that becomes a method to pay for combating spam I am sure most ISPs will pursue it. This is a money issue. NSP/ISP have shareholders who desire a return on their investment. When I notify the abuse team at uunet of a spammer they act promptly shutting down any account that I can show is being used for spam. Chris is a very trusted and active member of the NSP community, to his credit is a detailed document on blackhole filtering one of the primary tools used by other NSP/ISP's for stopping bad traffic. AFAIK he can not authorize legal action against spammers. donald.smith(a)qwest.com my opinions are mine and do not reflect qwest policy. -----Original Message----- From: Dr. Jeffrey Race To: Smith, Donald Cc: nanog(a)merit.edu Sent: 6/24/2004 9:40 PM Subject: RE: Attn MCI/UUNet - Massive abuse from your network On Thu, 24 Jun 2004 19:26:10 -0600, Smith, Donald wrote: >Are you offering to finance ISP's legal battles against spammers? No, it's their network and their legal responsibility to keep it clean. However I did voluntarily prepare a case for Neil Patel to file on behalf of UUNET under the Va computer crimes act, and he refused. I would have been a witness. At this point (esp when he said the matter lay with "Mr Ebbers", who is now up on other criminal charges) it became obvious what was the ethical level of this firm's management. Jeffrey Race

7 8

AOL Orders the Spam Special
by Henry Linneweh 25 Jun '04

25 Jun '04

And just when things looked dismal this had to happen to make it more so.... http://www.washingtonpost.com/wp-dyn/articles/A1898-2004Jun24.html?referrer… -Henry

3 2

Re: Teaching/developing troubleshooting skills
by John Neiberger 25 Jun '04

25 Jun '04

>>> Pete Kruckenberg <pete(a)kruckenberg.com> 6/24/04 5:09:19 PM >>> >It's been so long since I learned network troubleshooting >techniques I can't remember how I learned them or even how I >used to do it (so poorly). > >Does anyone have experience with developing a >skills-improvement program on this topic? I find that it's helpful to teach troubleshooting in two stages: 1) Define the problem. 2) Isolate the problem For stage one, teach them the basic skillset needed to define the issue in a general way based on available information. Is a circuit obviously down? Are certain destinations unreachable? Are *all* destinations unreachable? Is network access slow? You get the picture. Once the nature of the problem is determined, I find that a layered approach to troubleshooting is helpful and that is what I teach to others. The exact order of steps might changed based on information learned in step one, but generally I work my way up the OSI model. If the problem could possibly be caused by a physical layer issue, try to determine such. Check the circuits for errors, bouncing links, indications of mismatched clocking configurations, faulty CSU/DSUs, faulty router interfaces, or bad cabling. If all of that appears to be okay then I consider the datalink layer. Could the problem defined in step one be caused by a datalink layer issue? Was the encapsulation changed on a router interface? If frame relay, is the router seeing LMI from the frame relay switch? Is there evidence of dropped frames completely within the cloud (granted, that's not necessarily datalink layer, but it is a separate 'administrative' layer if it's out of your control.) I'm sure you can think of a number of other examples. Could the problem defined in step one be the results of a network layer issue? Is there evidence of a routing loop? Do the devices involved have routing tables that appear to be correct? What do traceroutes and pings show? Teach them to go hop-by-hop and verify that everything appears as it should, starting with the device closest to the problem if it's possible to narrow it down that far. If routing is determined to be correct, could this be a transport layer issue? Is it possible that an access list or firewall somewhere is blocking only certain types of traffic? Does the problem only involve HTTP? SMTP? Is there policy routing involved that might be redirecting certain types of traffic to the wrong destination? Where there *any* recent configuration changes? If so, what were they? Find out, because they might be the cause of the problem. This is the general framework I use for troubleshooting and that's how I've taught the people that work with me. It's constantly evolving and, of course, the specific steps taken depend on the nature of the issue, but I find that it helps to have a good foundational troubleshooting framework. John --

1 0

RE: Attn MCI/UUNet - Massive abuse from your network
by Smith, Donald 25 Jun '04

25 Jun '04

Michael, I agree totally. Every ISP I know of is working to combat spam. They all have a staffed abuse desk. They all coordinate with other ISP's that is one of the reasons I joined this list. I believe its time to move this to the next level. Follow the money. When you see spam report it to the abuse team for the isp the spam came from AND report the advertiser (follow the link in the spam) to their ISP. Getting the advertiser ($$$) site shutdown will be more effective then getting the trojaned/botted/infected pc disabled. When spam is no longer a profitable method of advertisement then it will end. Till then we will continue to see virii and worms add proxy ports to allow the spammers 1000's of points to bounce their spam off of. Donald.Smith(a)qwest.com GCIA I reserve the right to be wrong but don't exercise it too often. > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Michael Painter > Sent: Friday, June 25, 2004 4:11 AM > To: nanog(a)merit.edu > Subject: Re: Attn MCI/UUNet - Massive abuse from your network > > > > ----- Original Message ----- > From: "Dr. Jeffrey Race" <jrace(a)attglobal.net> > To: "Smith, Donald" <Donald.Smith(a)qwest.com> > Cc: <nanog(a)merit.edu> > Sent: Thursday, June 24, 2004 6:22 PM > Subject: RE: Attn MCI/UUNet - Massive abuse from your network > > > > > > On Thu, 24 Jun 2004 21:39:26 -0600, Smith, Donald wrote: > > > > >I am not a lawyer. I am not aware of the law that requires uunet to > > >go to court to prevent spammers who are not their direct > customers from using > > their network. > > > > > > Doctrine of attractive nuisance > > When I worked for IBM back in the '60s, on many occasions > during my 7 years there I heard > upper management say that they were proud to be with a > company that tried to be a "Good Corporate Citizen ". > One branch manager had a cube on his desk which had printed > on each side the(ir) manifesto of Corporate Social Responsibility. > > From the AOL theft article: > "The revelations come as AOL and other Internet providers > have ramped up their efforts to track down the purveyors of > spam, which > has grown into a maddening scourge that costs consumers and > businesses billions of dollars a year." > > Perhaps those Corporate Citizens who can do something to > ensure the viability of E-mail, should. > > --Michael > > > > >

1 0

The Cidr Report
by cidr-report＠potaroo.net 25 Jun '04

25 Jun '04

This report has been generated at Fri Jun 25 21:43:33 2004 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 18-06-04 138004 95920 19-06-04 138130 95941 20-06-04 138165 95988 21-06-04 138209 96029 22-06-04 138290 96187 23-06-04 138373 95506 24-06-04 137840 95574 25-06-04 137983 95562 AS Summary 17400 Number of ASes in routing system 7055 Number of ASes announcing only one prefix 1420 Largest number of prefixes announced by an AS AS7018 : ATTW AT&T WorldNet Services 54042880 Largest address span announced by an AS (/32s) AS721 : DNIC DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 25Jun04 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 138030 95564 42466 30.8% All ASes AS6347 926 162 764 82.5% SAVV SAVVIS Communications Corporation AS18566 724 8 716 98.9% CVAD Covad Communications AS4134 740 160 580 78.4% CHINANET-BACKBONE No.31,Jin-rong Street AS4323 738 205 533 72.2% TWTC Time Warner Telecom AS7018 1420 978 442 31.1% ATTW AT&T WorldNet Services AS7843 511 128 383 75.0% ADELPH-13 Adelphia Corp. AS6197 704 324 380 54.0% BNS-14 BellSouth Network Solutions, Inc AS701 1275 913 362 28.4% UU UUNET Technologies, Inc. AS22909 393 34 359 91.3% CMCS Comcast Cable Communications, Inc. AS9583 460 120 340 73.9% SATYAMNET-AS Satyam Infoway Ltd., AS27364 376 38 338 89.9% ARMC Armstrong Cable Services AS6198 568 232 336 59.2% BNS-14 BellSouth Network Solutions, Inc AS22773 388 64 324 83.5% CXAB Cox Communications Inc. Atlanta AS1239 949 642 307 32.3% SPRN Sprint AS11172 353 56 297 84.1% Servicios Alestra S.A de C.V AS17676 339 50 289 85.3% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS4355 381 99 282 74.0% ERSD EARTHLINK, INC AS9929 314 33 281 89.5% CNCNET-CN China Netcom Corp. AS6478 320 53 267 83.4% ATTW AT&T WorldNet Services AS6467 289 36 253 87.5% ACSI e.spire Communications, Inc. AS14654 239 6 233 97.5% WAYPOR-3 Wayport AS25844 243 16 227 93.4% SASMFL-2 Skadden, Arps, Slate, Meagher & Flom LLP AS6140 387 165 222 57.4% IMPSA ImpSat AS3356 899 681 218 24.2% LEVEL3 Level 3 Communications AS4766 479 264 215 44.9% KIXS-AS-KR Korea Telecom AS2548 362 165 197 54.4% ATCW Allegiance Telecom Companies Worldwide AS2386 425 229 196 46.1% ADCS-1 AT&T Data Communications Services AS5668 385 196 189 49.1% CIH-12 CenturyTel Internet Holdings, Inc. AS6327 218 34 184 84.4% SHAWC-2 Shaw Communications Inc. AS14824 278 103 175 62.9% NCC-105 NewSouth Communications Corp. Total 16083 6194 9889 61.5% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 AHSICHCL Andara High Speed Internet c/o Halifax Cable Ltd. 24.246.0.0/17 AS7018 ATTW AT&T WorldNet Services 24.246.128.0/18 AS7018 ATTW AT&T WorldNet Services 64.46.4.0/22 AS11711 TULARO TULAROSA COMMUNICATIONS 64.46.12.0/24 AS7850 IHIGHW iHighway.net, Inc. 64.46.27.0/24 AS8674 NETNOD-IX Netnod Internet Exchange Sverige AB 64.46.34.0/24 AS3408 64.46.63.0/24 AS7850 IHIGHW iHighway.net, Inc. 66.114.0.0/19 AS16526 BIRCHT Birch Telecom, Inc. 69.26.32.0/19 AS17307 VIRTEL-15 Virtela Communications 132.0.0.0/10 AS568 DISOUN DISO-UNRRA 137.0.0.0/13 AS721 DNIC DoD Network Information Center 138.136.0.0/13 AS721 DNIC DoD Network Information Center 158.0.0.0/13 AS721 DNIC DoD Network Information Center 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.30.127.0/24 AS719 LANLINK Elisa Oyj 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.43.230.0/24 AS4738 SAARDNET-AS South Australian Academic Research and Development Network 192.44.0.0/19 AS702 AS702 MCI EMEA 192.81.182.0/24 AS719 LANLINK Elisa Oyj 192.81.183.0/24 AS719 LANLINK Elisa Oyj 192.81.184.0/24 AS719 LANLINK Elisa Oyj 192.119.135.0/24 AS270 NASA National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS4004 GLOBALONE-EQUANT-UK Equant UK & Greece Autonomous System 192.135.50.0/24 AS7018 ATTW AT&T WorldNet Services 192.136.71.0/24 AS719 LANLINK Elisa Oyj 192.136.79.0/24 AS719 LANLINK Elisa Oyj 192.153.144.0/21 AS721 DNIC DoD Network Information Center 192.172.0.0/19 AS568 DISOUN DISO-UNRRA 192.188.208.0/20 AS721 DNIC DoD Network Information Center 192.243.32.0/23 AS2044 PALINA Palin Aquisitions Inc. 198.23.26.0/24 AS4390 BELLAT-7 Bell Atlantic, Inc. 198.97.72.0/21 AS568 DISOUN DISO-UNRRA 198.97.80.0/20 AS568 DISOUN DISO-UNRRA 198.97.88.0/24 AS89 NUSC-1 Naval Underwater Systems Center 198.97.240.0/20 AS568 DISOUN DISO-UNRRA 198.97.247.0/24 AS3475 DEPART-52 Department of the Navy 198.101.4.0/22 AS568 DISOUN DISO-UNRRA 198.136.32.0/20 AS19329 MCBCC Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY CityNet, Inc. 198.161.87.0/24 AS6539 GTGR GT Group Telecom Services Corp. 198.161.165.0/24 AS852 AGTA Telus Advanced Communications 198.163.155.0/24 AS684 MRN Manitoba Regional Network 198.167.0.0/16 AS7456 INS-51 Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 UU UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASK SaskTel 198.232.133.0/24 AS23075 SKOTOS Skotos Tech, Inc 199.10.0.0/16 AS568 DISOUN DISO-UNRRA 199.60.0.0/20 AS271 UBC-3 University of British Columbia 199.84.0.0/16 AS701 UU UUNET Technologies, Inc. 199.114.0.0/18 AS568 DISOUN DISO-UNRRA 199.114.0.0/21 AS568 DISOUN DISO-UNRRA 199.114.128.0/18 AS568 DISOUN DISO-UNRRA 199.114.130.0/24 AS721 DNIC DoD Network Information Center 199.114.132.0/24 AS721 DNIC DoD Network Information Center 199.114.136.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.138.0/24 AS721 DNIC DoD Network Information Center 199.114.140.0/24 AS3544 DISAUN DISA/UNRRA 199.114.142.0/24 AS721 DNIC DoD Network Information Center 199.114.144.0/24 AS721 DNIC DoD Network Information Center 199.114.148.0/24 AS721 DNIC DoD Network Information Center 199.114.150.0/24 AS721 DNIC DoD Network Information Center 199.114.152.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.154.0/24 AS1733 ADP-41 AF DDN PMO 199.114.156.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.160.0/24 AS1733 ADP-41 AF DDN PMO 199.120.32.0/19 AS16582 NXLI NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS568 DISOUN DISO-UNRRA 199.123.0.0/18 AS568 DISOUN DISO-UNRRA 199.123.16.0/20 AS568 DISOUN DISO-UNRRA 199.123.80.0/21 AS568 DISOUN DISO-UNRRA 199.189.32.0/19 AS7332 IQUEST IQuest Internet 199.197.8.0/22 AS21814 PARSON-18 Parsons Corp. 199.202.0.0/16 AS701 UU UUNET Technologies, Inc. 202.47.1.0/24 AS7491 PI-PH-AS-AP PI-PHILIPINES 202.56.160.0/20 AS10199 DISHNET-AS-AP DishnetDSL Limited 202.70.0.0/20 AS4658 NETFRONT-AS NETFRONT I.T. LIMITED (HONG KONG) 202.70.28.0/24 AS4515 ERX-STAR Star Internet Services Ltd. 202.73.128.0/22 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.123.96.0/20 AS9288 COMCEN-AS-AP Com-Cen Pty Ltd 202.133.3.0/24 AS9335 CIP-JAPAN-AS-AP ATT IPlus 202.136.128.0/20 AS10199 DISHNET-AS-AP DishnetDSL Limited 202.141.160.0/24 AS9237 HUTCHCA-AS BTN Access Limited 202.141.190.0/24 AS10026 ANC Asia Netcom Corporation 202.164.224.0/19 AS7599 IPXC-AS-AP IP Exchange 203.32.4.0/23 AS7617 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.84.145.0/24 AS4637 REACH Reach Network Border AS 203.84.146.0/24 AS4637 REACH Reach Network Border AS 203.132.107.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.188.16.0/21 AS4755 VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System 204.69.144.0/22 AS5668 CIH-12 CenturyTel Internet Holdings, Inc. 204.154.125.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBI Exobit Networks Inc. 205.150.0.0/15 AS701 UU UUNET Technologies, Inc. 205.159.72.0/24 AS1660 ANSCOM-5 ANS Communications 206.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 206.167.57.0/24 AS376 RISQR-3 Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 206.251.69.0/24 AS27429 TIL-33 Telesat International Ltd. 206.253.190.0/23 AS8123 POLYBA Polybase 207.231.96.0/19 AS11194 NUNETI NuNet Inc 208.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 209.169.219.0/24 AS189 LVLT Level 3 Communications, Inc. 209.169.223.0/24 AS189 LVLT Level 3 Communications, Inc. 209.172.0.0/18 AS7770 TRTI Triton Technologies, Inc. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.213.32.0/19 AS10629 INS-52 Inter-Pacific Network Services 209.213.50.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.51.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.55.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.56.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.222.137.0/24 AS27429 TIL-33 Telesat International Ltd. 209.251.0.0/19 AS11036 SISCOM-1 SISCOM, Inc 216.96.128.0/18 AS7018 ATTW AT&T WorldNet Services 216.145.130.0/24 AS11937 TRXI TRX Inc. 216.145.132.0/24 AS11937 TRXI TRX Inc. 216.145.133.0/24 AS11937 TRXI TRX Inc. 216.145.134.0/24 AS11937 TRXI TRX Inc. 216.145.135.0/24 AS11937 TRXI TRX Inc. 216.145.152.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.156.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.158.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.176.0/21 AS20304 JIS-32 JVLNET Internet Services 216.145.177.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.178.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.184.0/21 AS10758 INWAVE INWave Internet, Inc 216.145.200.0/21 AS20304 JIS-32 JVLNET Internet Services 216.186.151.0/24 AS3356 LEVEL3 Level 3 Communications 216.186.152.0/21 AS3356 LEVEL3 Level 3 Communications 216.186.160.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.164.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.192.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.198.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.248.0/23 AS3356 LEVEL3 Level 3 Communications Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org swinog(a)swinog.ch

1 0

Re: Attn MCI/UUNet - Massive abuse from your network
by Dr. Jeffrey Race 25 Jun '04

25 Jun '04

On Thu, 24 Jun 2004 16:27:32 +0200, Brad Knowles wrote: >> It is the same way credit reporting works: you mess up, you get no>> credit. > Except then you can generate yet another fake credit card and go >on with your life. Do that a few thousand times a day, even -- no >problem. > The credit reporting scheme only works against people who are >willing to play by the rules. Even then, it only hurts the >legitimate credit card holders who don't know how to fight the system. >> Come on guys, you are all smart engineers. This is not rocket science. > > See above. Credit card fraud is a multi-billion dollar business. >When the credit card companies have figured out this problem, maybe >we can apply similar techniques to the spam problem. Please, this is trivial. You have to prove your personal identity. What many firms do is to require a bank to certify it. The credit card thievery to which you refer is done anonymously; not relevant here

1 0