- NANOG - lists.nanog.org

TE Panel in SF
by Susan Harris 06 Apr '04

06 Apr '04

Greetings - we're hoping to present a panel on "Approaches to TE" at the next NANOG meeting, to be held May 23-25 in San Francisco. Potential topics include: - Layer two-based approaches (e.g., ATM) - Explicit routing-based approaches (e.g., MPLS-TE) - Other approaches (e.g., IGP ECMP) If you're using one of these techniques and would like to tell us about your experiences, send a detailed outline or abstract to nanog-support(a)nanog.org. Abstracts for the TE panel are due April 14. Thanks!

1 0

Re: Anti-Spam Router -- opinions?
by Joe St Sauver 06 Apr '04

06 Apr '04

Hi, #Let's assume that 75% of spam is sent via hijacked zombie machines. This #would mean that to get 7.5 billion spams/day at 20 msgs/day/zombie, #you'd need several hundred million compromised machines. 20 messages/day/zombie is way too low an estimate (by multiple orders of magnitude). #And even though the average machine is woefully insecure, there's not THAT #many zombies. I'm currently tracking right around 2.5 million listed open proxies/spam zombies. Data I'm receiving from typical mid sized ISPs includes 300K or so unique blocked dotted quads/week, of which maybe half are listed on one or more of the open proxy/spam zombie DNSBLs I track. So take the number from that you like best: -- 2.5 million listed open hosts -- 300K unique blocked dotted quads/week -- 150K or so of those unique blocked dotted quads which are listed on DNSBLs I see no indication that the number of compromised hosts seen per week is decreasing, and of course, because compromised hosts are not getting cleaned and taken off the air in many cases, the total pool of compromised hosts is steadily increasing. (And those "old timer"/"well known" compromised hosts, while blocked from sending email to most sites that use DNSBLs, still represent a source of potential attack traffic, etc.) #On the other hand, 20K msgs/day/zombie is only about 1 ever 4 seconds, #not enough to make the average cablemodem user notice - and reduces the #number of zombies down to several million - a much more plausible number. As a lower bound, assume modem-like throughput of 40Kbps, and typical spam message size of what, maybe 5K? That would amount to a message a second, or 86,400/day/host assuming an around-the-clock uniform distribution (probably not a valid assumption, but then again, upstream throughput from broadband connected hosts will generally exceed 40Kbps). If you wanted to deliver 7,500,000,000 pieces of spam a day at that rate, that would imply use of order(~100,000) freshly compromised hosts at any given time, a figure which I find quite plausible/conservative/consistent with the data I'm seeing. (And in fact, you can model the release of new virii/worms (intended to create new batches of compromised hosts) based on compromised host "harvest requirements," just like forecasting the demand for soybeans or steel or any other commodity) Spam's a big business, and compromised hosts are a fundamental input which are being efficiently supplied by the market as far as I can tell. Regards, Joe

1 0

Mailserver requirements
by Arnold Nipper 06 Apr '04

06 Apr '04

Today I run across a MTA which refused to accept mail because it could not detect an MX record for the reverse mapping of the IP address of the server which tried to deliver mail. Is this correct? Or: if A is the IP Address of server trying to deliver mail, does mx(reverse(A)) have to exist? -- Arnold

5 4

Wide Outage at DSL.net
by Drew Linsalata 06 Apr '04

06 Apr '04

For those with an operational interest, DSL.net is reporting multi-LATA outages impacting over 10,000 customers. Seems that things started dropping at about 6:15 AM EDT. -- Drew Linsalata The Gotham Bus Company, Inc. Colocation and Dedicated Access Solutions http://www.gothambus.com

1 0

RE: Mailserver requirements
by Mike Walter 06 Apr '04

06 Apr '04

Arnold, I am surprised you don't have problems sending to AOL as well. They don't accept email from servers that do not have reverse addresses. I don't accept email from severs without reverse addressing. Mike Walter, MCP 3z.net a PCD Company <http://www.3z.net> "When Success is the Only Solution t h i n K 3z.net" -----Original Message----- From: Arnold Nipper [mailto:arnold@nipper.de] Sent: Monday, April 05, 2004 5:03 PM To: NANOG Subject: Mailserver requirements Today I run across a MTA which refused to accept mail because it could not detect an MX record for the reverse mapping of the IP address of the server which tried to deliver mail. Is this correct? Or: if A is the IP Address of server trying to deliver mail, does mx(reverse(A)) have to exist? -- Arnold

8 10

RE: Spam with no purpose?
by Michel Py 06 Apr '04

06 Apr '04

>> Michel Py wrote: >> Indeed; notice I did write "Bayesian-like" and not "Bayesian" and >> never mentioned anything about good ones or not-as-good ones. > Paul Jakma wrote: > Right, but if we're going to talk about bayesian filtering > in general, there's little sense in constraining the > discussion to "not-as-good" bayesian filters. The not-as-good > filters are obviously doomed to extinction, if they do not > improve and become good ones. Paul, I hope you forgive my bluntness, but this is the worst argument you have ever made in the hundreds of postings I had the privilege to exchange with you on other mailing lists over the years. Especially on _this_ mailing list, if you were right, Microsoft would be extinct. Michel.

2 1

RE: Spam with no purpose?
by Michel Py 06 Apr '04

06 Apr '04

>> Michel Py wrote: >> 1. Reduce the efficiency of Bayesian-like filters: Trouble >> with this kind of email is that they are a) of sufficient >> length b) contain only "real" words c) contain none of the >> words regularly used by spammers such as the v. word. > Paul Jakma wrote: > Good bayesian filters do not score on single words alone, > they also score on "phrases" (ie multiple words). Random > strings of words will result in neutral scores (presuming > those words are also used in non-spam), while the phrases > will be slightly higher. Re-used gibberish (ie apparently > random) strings of words will result in "phrases" from > that gibberish having high scores. Indeed; notice I did write "Bayesian-like" and not "Bayesian" and never mentioned anything about good ones or not-as-good ones. > Also, a good bayesian filter should prune its database > regularly of phrases (including one word phrases) that > have not had their score updated recently, further > reducing "pollution" by random words and phrases. > noise is just noise. the spam specific stuff will > still be statistically significant, hopefully. I understand this too. However, I think the point you are missing here is the difference between "what could be done" and "what people have". The fact of the matter is that spam messages including a bunch of random dictionary words have had and still have a much higher penetration rate than messages that don't feature it. The proof is in the pudding. And as I said earlier, expect the "bunch of dictionary words" to mutate into a more sophisticated animal that includes correct grammar. What you and I do or could do (on a small scale) in terms of spam filtering is largely irrelevant. If spammers were smart they would not send us (collectively) spam to begin with, as the only thing it achieves is to get us pissed and implement more filtering. In the end, the only thing that matters is not what we could do about filtering neither how much spam _we_ get, but how many spams joe-six-pack gets per day. WRT this, although it is true that we have made tremendous progress in terms of filtering, it is equally true that the spammers have made tremendous progress in defeating our counter-measures, resulting in end-users getting unprecedented and still increasing amounts of spam. The measuring metric here is _not_ that we successfully filter 90% or 95% or 99.99% of spam; this is meaningless. The meaningful metric is: how many spams does joe-six-pack get a day. There is no difference between a) joe-six-pack getting 50 spams a day and us canceling 450 a day and b) joe-six-pack getting 50 spams a day and us canceling 9950 a day. Actually, there might be one: the spammers laughing their bottoms off thinking that filtering 9950 spams per day per user costs us 100 times more than it takes them to send 10000 spams per user per day. Michel.

3 2

RE: Spam with no purpose?
by Michel Py 06 Apr '04

06 Apr '04

>> Michel Py wrote: >> ... And as I said earlier, expect the "bunch of >> dictionary words" to mutate into a more >> sophisticated animal that includes correct grammar. > Tony Hain wrote: > So the useful content of lists like this one would be > filtered. Maybe this is really just a ploy by the tech > writers of the world for full-employment... ;) Or a ploy by some software vendor to force everyone to use a spell and grammar checker :-) Note that I'm not saying it's good, simply that I see it coming. > Todd Vierling wrote: > This has already happened; there is some well known spam that > consists of HTML "content" or an image-based ad, with snippets > of recent AP newswire stories in the plaintext body section. Indeed, and between AP newswire, good random generators and quotations borrowed from the zillion pages of text available on the web, it's going to take a really, really smart software to make the difference between spam and real email. Michel.

4 3

he.net or other ipv6 tunnelbroker service?
by Suresh Ramasubramanian 06 Apr '04

06 Apr '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi This has been facing periodic downtime for a day or two at a time quite a few times over the past few months. Probably related to http://ipv6.he.net/forum/read.php?f=1&i=717&t=717 where Mike Tindle of he.net described a situation where they were facing capacity issues on their router, setting up CEF ... and another situation where there are so many tunnels, it's not fitting into nvram on the tunnelbroker router but was being loaded off / written to a pcmcia disk. Right now current downtime has been about two or three days. http://ipv6.he.net/forum/read.php?f=1&i=787&t=787 I know, it is a free service and I really shouldn't be bitching. I'd consider upgrading to a paid tunnel, but their paid service offers only v6 colo at their facility and leased lines (T1 all the way to OC48). My personal colo is at another facility nearby (Sherman Oaks CA) and all I need is a simple v6 tunnel. Anybody else around nearby who offers a tunnelbroker (I think the only other free one on the same continent is Viagenie / freenet6, in Canada, which gives you 6bone IPs) srs - -- srs (postmaster|suresh)(a)outblaze.com // gpg : EDEDEFB9 manager, outblaze.com security and antispam operations -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) iD8DBQFAcL1/RB4r9e3t77kRAhWAAKDAH+WXOapP3oKMB9HMyijxFG8bFACg6uim q72yIY4BlTuKQCqI2vGyjO4= =hp59 -----END PGP SIGNATURE-----

2 2

RE: Mailserver requirements
by kwallace＠pcconnection.com 05 Apr '04

05 Apr '04

Hi Arnold- Whether or not you will accept mail from an address without a (matching?) reverse record is usually an option on your mailserver software. In terms of outbound mail, AOL, for example will no longer accept mail unless the reverse is present. Some providers insist that it match, which makes things a little dicey if your mail server is handling multiple domains. I've gotten around that by wasting an ip address for each domain, and setting up the reverse records accordingly. Also, lots of folks are now verifying the validity of the sender to try to prevent spoofing the mailfrom. (although the spammers only have to spoof a valid email address to get around that) -Keith -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] Sent: Monday, April 05, 2004 5:03 PM To: NANOG Subject: Mailserver requirements Today I run across a MTA which refused to accept mail because it could not detect an MX record for the reverse mapping of the IP address of the server which tried to deliver mail. Is this correct? Or: if A is the IP Address of server trying to deliver mail, does mx(reverse(A)) have to exist? -- Arnold

1 0