- NANOG - lists.nanog.org

SprintPCS spam policies
by Bruce Robertson 25 Jun '04

25 Jun '04

I just wanted to give everyone a heads-up on the antispam policies of SprintPCS, so that you will know what to expect if you start getting blocked by their mx.messaging.sprintpcs.com mail servers. Background: One of our customers was infected by one of the viruses that spams SprintPCS cell phones. Naturally we were blocked when this occurred, which is what I would expect. Once we detected the problem, we suspended the customer until they cleaned out the virus. Here's what we discovered from this: When you are blocked by SprintPCS, they simply disconnect the SMTP connection without an error of any kind. They provide no way to contact them on this. We had to have our Sprint Internet sales person find out who to contact. It would have been very helpful if there was contact information displayed on an SMTP banner before disconnecting. When a clueful person finally called me a week later, I was treated with suspicion. It was clear that he didn't believe me when I said a customer was infected by a virus, even though the existence of virii that have that behavior is clear with a quick Google search. He clearly considered me to be a spammer, rather than a responsible ISP. The SprintPCS person finally agreed to remove the block for my network, with the exception of the one mail server that my customer was using. He utterly refused to remove the block for that server, in spite of the fact that it hasn't sent them any spam for a week. This leaves me having to explain to my customers sending legitimate text pages why their email bounces occasionally. It also is ineffective, because I can easily change the IP address of the mail server they're blocking. If anyone has similar experience, I hope you fare better. -- Bruce Robertson, President/CEO +1-775-348-7299 Great Basin Internet Services, Inc. fax: +1-775-348-9412 http://www.greatbasin.net

5 4

RE: Attn MCI/UUNet - Massive abuse from your network
by Smith, Donald 25 Jun '04

25 Jun '04

Are you offering to finance ISP's legal battles against spammers? -----Original Message----- From: owner-nanog(a)merit.edu To: Ben Browning Cc: nanog(a)merit.edu Sent: 6/24/2004 9:16 PM Subject: Re: Attn MCI/UUNet - Massive abuse from your network On Thu, 24 Jun 2004 11:50:44 -0700, Ben Browning wrote: >Likewise, I imagine MCI could argue that the damage is to their core >product; namely, the trust of other ISPs and their willingness to exchange >traffic with MCI. This was Earthlink's argument in the case I cited in <http://www.camblab.com/nugget/spam_03.pdf>: their connectivity was jeopardized by the spammer's activity. As far as I know they prevailed. The point is, we have not seen MCI go down valiantly on the field of battle against the spammers in court or anywhere else. I proposed a complete open-and-shut legal case to MCI, with the perp's legal service address, and Neil Patel refused to take any action. The management's intention was clear: continue to profit rather than take the perps to court. All this talk about how difficult it would be blah blah blah is just a smokescreen for inaction Jeffrey Race

2 1

RE: Unplugging spamming PCs
by Joe Shen 25 Jun '04

25 Jun '04

Hi, >Mail servers should be registered just like domains and shutdown by a >registrar if they are misusing their registered services. This really >needs to be handled by a multi-lateral legal solution, industry will not >fix it alone. No, I don't think this is good solution First of all, we could not ask customers to register everything they planned with leased line without legal reasons. Second, if I hire DSL/leased_line service from ISP and set up domain name for myself, ISP could not ask me to tell them which port should be opened as I'm not taking a firewalling service, I'm not a member of my service provider. I should be able to do anything that are not perhibited by law or affact someothers. Blocking_port_25 indicates ISP pre-assume that customers will SPAM their network. But, SPAMmer is just a very small group of people. Maybe most of them comes from other countries ( what happens in China). To me, the proper way of anti-spam may ask cooperation between ISPs and Email service providers. Anyway, strengthening anti-spam ability in Email server is a must. regards Joe > >LP > >Best Regards, > >Larry Cool Things Happen When Mac Users Meet! Join the community in Boston this July: www.macworldexpo.com

1 0

Attn MCI/UUNet - Massive abuse from your network
by Ben Browning 25 Jun '04

25 Jun '04

(apologies to NANOG for only quasi-operational content of this message - I only post this here due to the fact that I am sure it is a problem on many of your networks) Attention UUNet, Regarding your continued unabated spam support, when do you plan to address the *189* issues outlined in the Spamhaus SBL (http://www.spamhaus.org/sbl/listings.lasso -> ISPs in the United States -> MCI.com )? Here's part of your AUP: Email: Sending unsolicited mail messages, including, without limitation, commercial advertising and informational announcements, is explicitly prohibited. A user shall not use another site's mail server to relay mail without the express permission of the site. What does your ethics department say about your blatant disregard for the internet in general and your complete and willful ignorance of your stated policies and procedures? Does UUNet *ever* plan on enforcing this AUP? I can't help but notice that several of these spammers are career hard-line operations- including Eddy Marin, G-Force Marketing, and Atriks to name a few. Are these customers operating under some form of undisclosed "Special Customer Agreement" ( http://global.mci.com/publications/service_guide/s_c_a/)? If so, how much do they pay for their pink contract? At this point I am just curious what the answers to these questions are. I have not (yet) widely blocklisted uunet, but if things don't change I fear such a measure may be the only way to stop the abuse spewing from your networks. Seeing such a large (and once-respected) network go as completely black-hat rogue as UUNet has is a sad thing. Any reply at all would be most welcome. ~Ben --- Ben Browning <benb(a)theriver.com> The River Internet Access Co. WA Operations Manager 1-877-88-RIVER http://www.theriver.com

23 51

RE: Teaching/developing troubleshooting skills
by Larry Pingree 24 Jun '04

24 Jun '04

Hi Pete, If you have a test lab, a good thing would be to setup a complete functional network. Show the engineer how it's configured. Then have them leave the room and then break it. Send them back in to look at what is wrong. As they move through the process, help them by guiding them through the troubleshooting process in a mentoring fashion, help them analyze and break apart the problem. LP Best Regards, Larry Larry Pingree "Visionary people, are visionary, partly because of the great many things they never get to see." - Larry Pingree -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Pete Kruckenberg Sent: Thursday, June 24, 2004 4:09 PM To: nanog(a)merit.edu Subject: Teaching/developing troubleshooting skills I'm working on trying to teach others in my group (usually less-experienced, but not always) how to improve their large-network troubleshooting skills (the techniques of isolating a problem, etc). It's been so long since I learned network troubleshooting techniques I can't remember how I learned them or even how I used to do it (so poorly). Does anyone have experience with developing a skills-improvement program on this topic? If you've tried such a thing, what worked/didn't work for you? Outside training? Books? Mentoring? Motivational posters? I'm particularly sensitive to the "I got my CCNA, therefore I know everything there is to know about troubleshooting" perspective, and how to encourage improving troubleshooting skills without making it insultingly basic. Thanks for your help. Pete.

1 0

RE: Attn MCI/UUNet - Massive abuse from your network
by Hannigan, Martin 24 Jun '04

24 Jun '04

> At 02:36 PM 6/24/2004, Christopher L. Morrow wrote: > >On Thu, 24 Jun 2004, Ben Browning wrote: > > [ SNIP ] > this discussion anyways, is access to the internet. When the > actions of a > downstream damage that product(IE more and more networks > nullroute UUNet > traffic), [ Operations content: ] Do you know of any ISP's null routing AS701? -M

1 0

RE: Homeland Security now wants to restrict outage notifications
by Scott McGrath 24 Jun '04

24 Jun '04

I did read the article and having worked for gov't agencies twice in my career a proposal like the one floated by DHS is just the camel's nose. I should hope the carriers oppose this. Now a call comes into our ops center "I cant reach my experiment at Stanford". Ops looks up the outages Oh yeah there's a fiber cut affecting service we will let you know when it's fixed. They check it's fixed they call the customer telling them to try it now. Under the proposed regime "We know its dead do not know why or when it will be fixed because it' classified information" This makes for absolutely wonderful customer service and it protects public safety how?. Scott C. McGrath On Thu, 24 Jun 2004, Tad Grosvenor wrote: > Did you read the article? The DHS is urging that the FCC drop the proposal > to require outage reporting for "significant outages." This isn't the DHS > saying that outage notifications should be muted. The article also > mentions: "Telecom companies are generally against the proposed new > reporting requirements, arguing that the industry's voluntary efforts are > sufficient." > > -Tad > > > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of > Scott McGrath > Sent: Thursday, June 24, 2004 12:58 PM > To: nanog(a)merit.edu > Subject: Homeland Security now wants to restrict outage notifications > > > > See > > http://www.theregister.co.uk/2004/06/24/network_outages/ > > for the gory details. The Sean Gorman debacle was just the beginning > this country is becoming more like the Soviet Union under Stalin every > passing day in its xenophobic paranoia all we need now is a new version of > the NKVD to enforce the homeland security directives. > > Scott C. McGrath > >

6 5

RE: Homeland Security now wants to restrict outage notifications
by Scott McGrath 24 Jun '04

24 Jun '04

I also believe that critical infrastructure needs to be protected and I am charged with protecting a good chunk of it. Also as a Ham operator I work in concert with the various emergency management organizations in dealing with possible worst case scenarios. No, not everyone who asks about some piece of infrastructure under my control gets an answer but for now we can still choose who receives an answer without you having to contact a govt agency and ask whether I can respond to a query from Joe Shmoe. Unfortunately information=power and control of information is power^2 and many people in the permanent bureaucracy are there only in pursuit of power over others and 9/11 was a wonderful excuse to extend their scope of control over people's everyday lives. Right now in Boston cameras are now illegal in the subway for 'security reasons' who hasnt had a picture taken with their friends on the way to/from a gathering on the subway. Back when I was younger the only places with restrictions like that were the countries Iron Curtain. In the 50's my family helped resettle refugees from Hungary in the aftermath of the failed Hungarian Revolution freedom is a valuable thing unfortunately we are losing it bit by bit. Scott C. McGrath On Thu, 24 Jun 2004, Harris, Michael C. wrote: > Scott McGrath said: > See > > http://www.theregister.co.uk/2004/06/24/network_outages/ > > for the gory details. The Sean Gorman debacle was just the > beginning this country > is becoming more like the Soviet Union under Stalin every > passing day in its xenophobic > paranoia all we need now is a new version of the NKVD to enforce > the homeland security directives. > > Scott C. McGrath > ------------------------------------------ > > Ask and you shall receive! Fresh from the DHS website yesterday morning. > > (quoting the end of the 4th paragraph below) > > "In addition, HSIN-CI network, in partnership with the FBI, provides a > reporting feature that allows the public to submit information about > suspicious activities through the FBI Tips Program that is then shared > with the Department's HSOC." > > Just call the party hotline and report your neighbors, coworkers and > friends... > > Don't get me wrong, I am a supporter of protecting critical > infrastructure. There are already programs, Infragard is an example, > that perform the same kind of information sharing by choice rather than > decree. Infragard is supported by public private and sectors both, with > similar support from the FBI. > > (yes, I am an Infragard member just to be 100% above board) > Mike Harris > Umh.edu > > ------------------------------------------ > http://www.dhs.gov/dhspublic/display?content=3748 > > Homeland Security Launches Critical Infrastructure Pilot Program to > Bolster Private Sector Security > - Dallas First of Four Pilot Communities Sharing Targeted Threat > Information > > For Immediate Release > Office of the Press Secretary > Contact: 202-282-8010 > June 23, 2004 > > Homeland Security Information Network - Critical Infrastructure > > The U.S. Department of Homeland Security in partnership with local > private sector and the Federal Bureau of Investigation, today launched > the first Homeland Security Information Network-Critical Infrastructure > (HSIN-CI) Pilot Program in Dallas, Texas with locally operated pilot > programs in Seattle, Indianapolis and Atlanta to follow. The pilot > program will operate throughout the course of this year to determine the > feasibility of using this model for other cities across the country. > > The HSIN-CI pilot program, modeled after the FBI Dallas Emergency > Response Network expands the reach of the Department's Homeland Security > Information Network (HSIN) initiative--a counterterrorism communications > tool that connects 50 states, five territories, Washington, D.C., and 50 > major urban areas to strengthen the exchange of threat information--to > critical infrastructure owners and operators in a variety of industries > and locations, first responders and local officials. As part of the > HSIN-CI pilot program, more than 25,000 members of the network will have > access to unclassified sector specific information and alert > notifications on a 24/7 basis. > > "The Homeland is more secure when each hometown is more secure," said > Secretary of Homeland Security Tom Ridge. "HSIN-CI connects our > communities - the government community to the private sector community > to the law enforcement community -- the better we share information > between our partners, the more quickly we are able to implement security > measures where necessary." > > The HSIN-CI network allows local and regional areas to receive targeted > alerts and notifications in real-time from Department's Homeland > Security Operations Center (HSOC) using standard communication devices > including wired and wireless telephones, email, facsimile and text > pagers. The network requires no additional hardware or software for > federal, state, or local participants. The technical capacity of the > network includes the ability to send 10,000 outbound voice calls per > minute, 30,000 simultaneous inbound calls through an information > "hotline," 5,000 simultaneous email messages and 3,000 simultaneous > facsimile transmissions in the event that information needs to be > communicated. In addition, HSIN-CI network, in partnership with the > FBI, provides a reporting feature that allows the public to submit > information about suspicious activities through the FBI Tips Program > that is then shared with the Department's HSOC. > > "We believe that the use of this program builds relationships that are > critical in providing a more secure environment for local communities > and the nation," said Zalami Azmi, Chief Information Officer, Federal > Bureau of Investigation. "This program expands the Department's efforts > to share information and build relationships that will be crucial in the > event of an emergency that is either a terrorist threat, man-made or > natural disaster." > > Homeland Security Information Network-Critical Infrastructure is > governed and administered by local experts from the private and public > sector with the support of Regional Coordinators. The four pilot > communities have also established Infrastructure Advisory Panels to > assist in the administration and overall governance of the program > locally; manage counter-terrorism and public safety information sharing; > and to review and validate HSIN-CI applications. The pilot program > allows local users to provide a unique perspective on the areas > vulnerabilities, activities and response plans along with the locally > known representatives from Agencies involved in incident management and > response. The HSIN-CI Pilot Program is part ongoing efforts by the > Department of Homeland Security and our federal partners to improve > information sharing and collaboration among all of those involved in > strengthening homeland security. > > For more information about the HSIN-CI pilot program visit > www.swern.gov. > > >

1 0

RE: Unplugging spamming PCs
by Larry Pingree 24 Jun '04

24 Jun '04

Hi John, I'm not taking it to extremes. I'm talking about the middle of the road, and certainly spam is the on the top of the scales on everyone's statistics. I'm certainly not condoning or suggesting that the government control everything, and I'm not for absolutely no government involvement either. A balanced approach is most appropriate just as with anything.... there also can be regional registries similar to how ARIN is setup that allow inter-continental and inter-country registration. Unless someone can come up with a better idea, I see no other choice. FYI, we do already license IP's, through ARIN, APNIC, etc so that's already been done :) LP Best Regards, Larry Larry Pingree "Visionary people, are visionary, partly because of the great many things they never get to see." - Larry Pingree -----Original Message----- From: John Payne [mailto:john@sackheads.org] Sent: Thursday, June 24, 2004 11:40 AM To: Larry Pingree Cc: nanog(a)nanog.org Subject: RE: Unplugging spamming PCs --On Thursday, June 24, 2004 11:17 AM -0700 Larry Pingree <lpingree(a)juniper.net> wrote: > > Hi Joe, > > If only those who are approved email senders are allowed to be > accepted, this allows police, FBI, or DHS to go after only those who are > registered and abusing it. It's for the same purpose that we administer > car registrations, so that at the end of the day, someone is responsible > for the car. In this case, someone can be responsible for the domain and > mail server. In its current state, we are left way in the open. I don't > disagree that government control is un-desirable, but remember, at least > in my mind, even though it may be undesirable, it may be a necessary > action. Anyone know why we have to get a drivers license? How about a > passport? What about a SSN? All of these things are ways in which we > can have accountability. Without accountability we will remain in > anarchy. All that government does is bridge a gap when corporations, > which only do things for profit, will not collaborate on an appropriate > solution to a problem, even though one exists. But why stop at email servers? spam is only one of the unsociable and illegal acts happening on the Internet. Why not license ownership of every IP capable device? That'll stop all forms of DoS (DDoS and otherwise too). Just to make sure, let's require that all vendors both inspect the license from their customers *and* notify the government on every purchase or upgrade. Hmm. Which government though? Better to be safe... you can't be sure which country the device is being installed in, or which country the packets flowing through the device will also visit. So let's require licenses from every country... and vendors to notify every government on every purchase or upgrade. Yep, that'll do the trick.

2 1

Homeland Security now wants to restrict outage notifications
by Scott McGrath 24 Jun '04

24 Jun '04

See http://www.theregister.co.uk/2004/06/24/network_outages/ for the gory details. The Sean Gorman debacle was just the beginning this country is becoming more like the Soviet Union under Stalin every passing day in its xenophobic paranoia all we need now is a new version of the NKVD to enforce the homeland security directives. Scott C. McGrath

2 1