- NANOG - lists.nanog.org

RE: Unplugging spamming PCs
by Larry Pingree 24 Jun '04

24 Jun '04

Mail servers should be registered just like domains and shutdown by a registrar if they are misusing their registered services. This really needs to be handled by a multi-lateral legal solution, industry will not fix it alone. LP Best Regards, Larry Larry Pingree Partner Engineering Juniper Networks, Inc. 408-543-2190 "Visionary people, are visionary, partly because of the great many things they never get to see." - Larry Pingree Juniper Networks Logo -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Petri Helenius Sent: Wednesday, June 23, 2004 1:15 PM To: Sam Hayes Merritt, III Cc: nanog(a)merit.edu Subject: Re: Unplugging spamming PCs Sam Hayes Merritt, III wrote: > >Proactive would be blocking port 25 except to comcast.net's mail servers, >at least on retail users without static IPs, and then opening it up if >the customer cannot work around it by using comcast's mail server to send >out. Thats what responsible ISPs have done. > > No, that would be punishing before the crime happened. Responsible would be to punish swiftly after the fact, but not before. Pete

5 4

Suggestion: identify and thread trouble tickets
by Colm MacCarthaigh 24 Jun '04

24 Jun '04

Many network operators have Trouble Ticket systems (as per RFC1297) which send mails notifying customers, peers and other interested parties of network problems, events and so on. Many of these mails cross my desk, so I thought it might be useful to make two small suggestions to trivially increase the functionality of these mails ... use the mail headers cleverly. Firstly, a lot of us receive a lot of tickets and to ease the workload we filter them into seperate mailboxes. To assist this process, rather than making us all use unreliable filters based on a sender address or a particular format to the subject, consider including a custom X-header, here at HEAnet we use: X-HEAnet-TicketID: [ticket id] X-HEAnet-Ticket-Distribution: [public|noc|personal ..] But only one is really neccessary (though I guess it depends on how easy you want to make subfiltering), and it should be committed to. No matter what you do to your trouble ticketing system the X header should remain. This would avoid the situation of breaking filtering on people when you change whatever unique subtlety they happen to be relying upon. Now secondly, after you've made it easy for people to distuingish your tickets from those of others, consider making it easy for people to distinguish your tickets from each other. For 1 year now, HEAnet have been issueing tickets with Message-ID's generated by our ticketing system, for example: To: noc@wherever From: Colm MacCarthaigh <colm.maccarthaigh@wherever> Subject: HEA-NOC/20040519-11 [OPEN] IPv6 packet loss on backbone X-HEAnet-TicketID: 20040519-11 X-HEAnet-Ticket-Distribution: public Message-ID: <20040519-11-1(a)cyclops.heanet.ie> And then subsequent updates to the ticket have headers such as: To: noc@wherever From: Colm MacCarthaigh <colm.maccarthaigh@wherever> Subject: HEA-NOC/20040519-11 [UPDATE] IPv6 packet loss on backbone X-HEAnet-TicketID: 20040519-11 X-HEAnet-Ticket-Distribution: public In-Reply-To: <20040519-11-1(a)cyclops.heanet.ie> References: <20040519-11-1(a)cyclops.heanet.ie> Message-ID: <20040519-11-2(a)cyclops.heanet.ie> I'm sure everyone can predict that the next mail would look like: To: noc@wherever From: Colm MacCarthaigh <colm.maccarthaigh@wherever> Subject: HEA-NOC/20040519-11 [UPDATE] IPv6 packet loss on backbone X-HEAnet-TicketID: 20040519-11 X-HEAnet-Ticket-Distribution: public In-Reply-To: <20040519-11-2(a)cyclops.heanet.ie> References: <20040519-11-2(a)cyclops.heanet.ie> Message-ID: <20040519-11-3(a)cyclops.heanet.ie> This simple feature has the effect of enabling mails concerning the same ticket to be threaded/grouped (and whatever gmail is calling it these days) in the users mail client, if their mail-client supports threaded viewing. We all know what it looks like :). If a user wants to see them chronologically instead, just turning the threaded viewing off is enough. We've had no reports of problems and many people have found it useful, and personally I find TT mails substantially more manageable in this form. If tickets are logged to a HTML archive, threaded mails can help there also by allowing a nice way to see all ticket updates relevant to a single issue. I would imagine that all ticketing systems already have a unique number per ticket (the ticket id) and incrementing a counter for each update/close is not hard, so it's a simple enough feature to add (though making sure the message ID's are in fact unique is critical). It's probably not a new idea, and it has almost certainly been implemented before but none of the trouble tickets I get implement it. So, my humble suggestion is to consider adding it in the next rewrite of your ticketing system, or requesting it as a feature from your TT system vendor. There may be problems we have not encountered in operation or I have not considered, if so - comments welcome. -- Colm

1 0

RE: Can a customer take IP's with them?
by John Neiberger 24 Jun '04

24 Jun '04

>Let me try to give you a hypothetical to show you why ARIN is irrelevent. >Suppose I am a member of the Longshoreman's assocation and you have a >contract to buy shrimp for $8/pound provided you only resell it to members >of the LA. You then enter into a contract with me to sell me shrimp for >$10/pound. But then I leave the LA. Ooops, now you can no longer resell me >the shrimp. So you break our contract and I sue you. Does your contract with >your shrimp provider matter? If you continue to sell me shrimp even though >I'm not in the LA, who does your shrimp supplier sue? You or me? Is this analogy really accurate? In your analogy, the person who initially purchases the shrimp actually *owns* the shrimp at that point. With IP address space, the ISP does not own the space that it allocates. It's really just sub-letting the space already allocated to it. IANAL, but it appears that from a contractual perspective it is clear that ARIN retains all 'ownership' rights to the address space. They subdivide it to those who are willing to contractually agree to their conditions, but the ownership is never transferred. I would think that that is an important distinction to make. Perhaps not. John --

6 10

RE: Unplugging spamming PCs
by Larry Pingree 24 Jun '04

24 Jun '04

Hi Peter, I agree with you it's a hard problem to solve. But unless there is mandatory cooperation within mail server software (which can be monitored) to interface with a registry of acceptable/registered sites, then this model could work. Is it perfect, no. And so far, I've not seen any technology that will solve this problem. So I default and say it's a problem that must be solved with agreements between countries that can provide registries that all (valid) mail servers must register. Then at least our spammer enforcement is dwindled down to those who go through some sort of process, that can be validated physically, i.e. Address, Company name, etc, etc... And then enforcement can be done only to those who misbehave that are validated and authenticated. Can you suggest another method that would have more accuracy? I think it's ridiculous that every service on the internet is provided without any authentication and integrity services, if we allowed anyone to call from anywhere within the telephone network, you'd have rampant falsification, which is what we have today. LP Best Regards, Larry Larry Pingree "Visionary people, are visionary, partly because of the great many things they never get to see." - Larry Pingree -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Peter Corlett Sent: Wednesday, June 23, 2004 4:11 PM To: nanog(a)nanog.org Subject: Re: Unplugging spamming PCs Larry Pingree <lpingree(a)juniper.net> wrote: > Mail servers should be registered just like domains and shutdown by > a registrar if they are misusing their registered services. This > really needs to be handled by a multi-lateral legal solution, > industry will not fix it alone. Yes, that's just what we need. More unworkable legislation that nobody'll bother to enforce in the intended manner anyway. It's not as if many of the things one has to do to spam effectively isn't already good for a few years behind bars, yet I don't exactly see prisons bulging with spammers. Let's suppose mail servers are registered like domains. What mechanism is there going to be in place to shut down the mail server if it starts misbehaving? Sending in the Marines? And again, much of this comes down to enforcement. When was the last time you heard of a spammer's domain being pulled? How about the last time you saw a spammer be even remotely bothered by having their domain pulled? Do you think they'll really care less about losing a mail server when they've got another dozen lined up ready and waiting? -- PGP key ID E85DC776 - finger abuse(a)mooli.org.uk for full key

3 2

whois.arin.net dead again
by Jon Lewis 24 Jun '04

24 Jun '04

What's going on? whois.arin.net is not accepting connections and the whois search via www.arin.net is dead again. ---------------------------------------------------------------------- Jon Lewis | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

2 1

Re: Attn MCI/UUNet - Massive abuse from your network
by Christopher L. Morrow 24 Jun '04

24 Jun '04

On Tue, 22 Jun 2004, Myke Place wrote: > Can you then explain why there are 189 Spamhaus complaint against > UUnet/MCI which haven't been dealt with? I answered ben already (a few minutes ago) but I'll answer you as well. I said I'd look into the listings and see what's known or being done about them.

1 0

Re: Attn MCI/UUNet - Massive abuse from your network
by Ben Browning 23 Jun '04

23 Jun '04

At 10:45 PM 6/22/2004, Tim Thorne wrote: >Not so long ago I took a long look at the SBL for MCI and I came to >the conclusion that the data is mostly out of date and therefore >inaccurate. The folks at the SBL posting in NANAE said this may be the >case, but its up to the MCI folks to clean up the SBL database. MCI does not want to "legitimize" blacklists by helping clean up their own records. Any company or network that afraid of accountability obviously must have its reasons. I am sure they have seen the many many times some provider has said "We removed Spammer A" and the antispam community has responded with "Great, how about spammers B through Z?". That's a question they don't and won't answer beyond the token "Email to abuse@ does get read". Maybe it does- I am not MCI, so I don't know. Regardless of whether the mail does get read, the spammers remain connected. Why? One can only come to the conclusion that it is either due to technical ineptitude or protection of their revenue stream. Likewise, they have no doubt noticed that providers that lie about canning spammers are quickly outed, and their blocklist listings(and no doubt private firewall rules, which are much harder to escape) tend to expand greatly. So, MCI has (correctly) identified that their options as A) clean up their network B) try to lie or C) do nothing. Given that A involves loss of revenue and a (short term) increase in labor and B will cause them even more problems, C is their obvious recourse. > >As an example, I see a posting that says emailtools.com was alive on > >206.67.63.41 in 2000. They aren't there any more... But now: > >Emailtools.com aren't spammers, but they sell spamware. That subtle >difference is enough to keep them on the MCI network. This may be true, but Atriks is still there, and they are one of the most technically malicious spammers in the game today. Spam support is spam support, whether you are hosting the website, DNS, proxy mining operation, or a drop-box. Any provider that is OK with hosting software that does this: "Email Marketing 98 is our high-end email marketing tool. It is one of the best extractors on the market while remaining price competitive. At the push of a button, Email Marketing 98 will retrieve Email addresses of all the posters on an Internet news group or a series of groups. Then it will send your Email message to any or all of those addresses." may as well be sending the spam themselves, IMO. >If you want rid >of sites like this that are based in Florida, then you best get >Florida to change their laws. Wouldn't *that* be lovely. --- Ben Browning <benb(a)theriver.com> The River Internet Access Co. WA Operations Manager 1-877-88-RIVER http://www.theriver.com

1 0

Unplugging spamming PCs
by Hank Nussbacher 23 Jun '04

23 Jun '04

http://www.cnn.com/2004/TECH/internet/06/22/tech.spam.reut/index.html "Consumers who allow their infected computers to send out millions of "spam" messages could be unplugged from the Internet under a proposal released Tuesday by six large e-mail providers." -Hank

8 8

re: Enterasys Matrix Switching Product
by Wayne Chow 23 Jun '04

23 Jun '04

Hi all, Anyone had any positive/negative experience with the Enterasys switching products, especially the Matrix E1/N7? How is their reliability and service support? Any thoughts and comments would be greatly appreciated. Thanks Wayne Chow Network Administrator Faculty of Dentistry, University of Toronto 124 Edward Street, Suite 458 Toronto, Ontario M5G 1G6 (416) 979-4900 Ext. 4620 (416) 979-4936 Fax

1 0

RE: Can a customer take IP's with them?
by Chris Ranch 23 Jun '04

23 Jun '04

Hello Alex, > > In other words, customer is asking a court to rule whether > > or not IP space should be portable, when an industry- > > supported organization (ARIN) has made policy that the > > space is in fact not portable. It can be further argued that > > the court could impose a TRO that would potentially negatively > > affect the operation of my network. > > A court will likely decide this based upon the terms of > your contract and what the court thinks is fair. They will > likely give very little consideration to common practice or > ARIN's rules. That's the crux of the biscuit. Your case depends on whether you provided for this in your contract with the customer. If its missing, you have a big challenge on your hands. No RFC or ARIN policy is a binding legal document. If its there, your chances are much better. So, do you discuss non-portable address space assignment in your contract? Where was this case filed? NJ or federal court? Do let us know how it turns out. This will establish a key legal precedent. Chris

3 2