- NANOG - lists.nanog.org

Re: Mailserver requirements
by Roman Volf 05 Apr '04

05 Apr '04

He isn't saying it needs a reverse address. He's saying that the reverse address needs an MX record. Roman Volf Keystreams Internet Solutions volfman(a)keystreams.com Mike Walter wrote: >Arnold, > I am surprised you don't have problems sending to AOL as well. >They don't accept email from servers that do not have reverse addresses. >I don't accept email from severs without reverse addressing. > >Mike Walter, MCP >3z.net a PCD Company ><http://www.3z.net> >"When Success is the Only Solution t h i n K 3z.net" > > >-----Original Message----- >From: Arnold Nipper [mailto:arnold@nipper.de] >Sent: Monday, April 05, 2004 5:03 PM >To: NANOG >Subject: Mailserver requirements > > > >Today I run across a MTA which refused to accept mail because it could >not detect an MX record for the reverse mapping of the IP address of the >server which tried to deliver mail. Is this correct? > >Or: if A is the IP Address of server trying to deliver mail, does >mx(reverse(A)) have to exist? > > > >-- Arnold > > > -- Roman Volf Keystreams Internet Solutions volfman(a)keystreams.com

1 0

NANOG 31 Meeting Information
by Carol Wadsworth 05 Apr '04

05 Apr '04

Registration is now open for NANOG 31, May 23-25, 2004, in San Francisco. The meeting will be hosted by CNET Networks. For additional meeting information, please see: http://www.nanog.org/ See you there!

1 0

RE: IANA IPv4 allocations and bogon update: 85/8, 86/8, 87/8, 88/8
by Michel Py 04 Apr '04

04 Apr '04

> Rob Thomas wrote: > The numerous Team Cymru bogon projects have been updated as of 01 APR > 2004 to reflect the following IANA allocation made on 01 APR 2004: > 85/8 Apr 04 RIPE NCC > 86/8 Apr 04 RIPE NCC > 87/8 Apr 04 RIPE NCC > 88/8 Apr 04 RIPE NCC And the amount of time it took me to update my bogon filters is.... Zero. Zip. Because I use Team Cymru's bogon route servers :-) Michel.

4 3

NANOG list reverse DNS handling
by Iljitsch van Beijnum 03 Apr '04

03 Apr '04

A couple of days ago I moved my mail server, and inadvertently mistyped its name in the reverse DNS. After this, I noticed a message wasn't making it to the list. Investigation showed: rcpt to: nanog(a)nanog.org 450 Client host rejected: cannot find your hostname [83.149.65.1] info at: http://www.merit.edu/cgi-bin/mn/reversednsinfo Ok, so far so good. But when I visited the URL mentioned in the rejection message, I just got a web form saying "Please enter your e-mail address and select your organization from the list below". Obviously this is meant to do _something_, but it's entirely unclear what and why. After this the page I think should have been referred in the first place comes up: http://www.merit.edu/mn/support/reversedns.html There is also a link to a DNS checking tool. However, this tool is pretty much useless in situations such as the one in which I found myself, as it doesn't answer the real question: what is the TTL for the offending DNS information.

3 2

.mil contact information
by German Martinez 03 Apr '04

03 Apr '04

Hello, Could somebody from any .mil network contact me offline ? Thanks German --- "Discouragement is an enemy of your perseverance. If you don't fight against discouragement you will become pessimistic first, and lukewarm afterwards. Be an optimist" -- St. JoseMaria Escriva (1902 - 1975) Opus Dei's Founder

2 1

RE: Spam with no purpose?
by Michel Py 03 Apr '04

03 Apr '04

> Deepak Jain wrote: > Can someone explain to me (publicly or privately) why someone > would send spam with no product to sell, no position to pitch, > nothing except text designed to get by a spam filter -- without > even HTML to KNOW it got by a spam filter.. Likely two different goals here: 1. Reduce the efficiency of Bayesian-like filters: Trouble with this kind of email is that they are a) of sufficient length b) contain only "real" words c) contain none of the words regularly used by spammers such as the v. word. It's a lose-lose situation for the spam engine: - If this message is marked as spam, it increases the likeliness of false positives, as the message shares different common points with real email in spam-measuring metrics such as length, percentage of real words, etc. - If this message is marked as legit, it reduces the catching abilities of the spam engines as it shares similar patterns with a spam that would be essentially the same text altered to a spam content. You can bet that it won't be long until we see such messages that not only use only dictionary words, but furthermore are constructed with a valid grammar (and still mean nothing). One of the next fronts in spam detection is based on grammatical correctness. What we are looking at is the eternal battle between the shield and the weapon: as soon as someone invents a new shield, someone else develops a new weapon that will pierce it. 2. It might a statistical probe spam: Spammer xyz has a list of 1 million addresses, out of which 500,000 are invalid and bounce. By using a return address that is actually not bogus, the spammer can indirectly measure the efficiency of Bayesian outsmarting strategies. First the spammer send a spam that will be blocked by the majority of spam-detection engines (even the dumber ones) by including correctly spelled well-knows spam words in both subject and text. You know, the stuff that promises to put a foot in your pants that features "always-on" service. Let's say that our spammer gets 150,000 bounces out of this one, the math is simple: out of 500,000 potential bounces they got only 150,000 which means that 350,000 have been blocked by spam engines prior to the non-existing-user bounce. Then, our spammer sends the kind of email you referred to the same list and measures the bounce rate one more time. If this time he gets 450,000 bounces, it means that only 50,000 out of the 500,000 potential bounces have been blocked by spam engines, which in turns mean that the same email slightly alter will reach a large part of its targets. This is a simplified view, as bounce rate alone is not a valid measurement of outsmarting strategies, but correlating two or three of that kind of metric gives a reasonably precise of which spamming techniques still work, and which have become a waste of bandwidth. Michel. When someone dies, it's a tragedy. When millions die, it's a statistic. -- Josef Stalin --

3 2

IANA IPv4 allocations and bogon update: 85/8, 86/8, 87/8, 88/8
by Rob Thomas 02 Apr '04

02 Apr '04

Hi, team. [ Apologies to those who receive this post in multiple forums. ] The numerous Team Cymru bogon projects have been updated as of 01 APR 2004 to reflect the following IANA allocation made on 01 APR 2004: 85/8 Apr 04 RIPE NCC 86/8 Apr 04 RIPE NCC 87/8 Apr 04 RIPE NCC 88/8 Apr 04 RIPE NCC IANA allocations change over time, so please check regularly to ensure you have the latest filters if you are not using the bogon BGP feed(s). We do announce updates to the bogon projects to sundry lists, such as the bogon-announce list. We can not stress this point strongly enough - these allocations change. If you do not adjust your filters, you will be unable to access perhaps large portions of the Internet. Worse yet, you may end up blocking access for people who transit through you. Please do not blindly apply any filters or blocks to your network without carefully considering the ramifications of doing so. As a point of reference, the Team Cymru master Bogon Reference Page can be found here: <http://www.cymru.com/Bogons/> A quick summary of the documents and projects that have been updated include the following: HTTP The Bogon List - <http://www.cymru.com/Documents/bogon-list.html> The Text Bogon Lists - <http://www.cymru.com/Documents/bogon-bn-nonagg.txt> - <http://www.cymru.com/Documents/bogon-bn-agg.txt> Secure BIND Template - <http://www.cymru.com/Documents/secure-bind-template.html> Secure IOS Template (Cisco) - <http://www.cymru.com/Documents/secure-ios-template.html> Secure BGP Template (Cisco) - <http://www.cymru.com/Documents/secure-bgp-template.html> Secure JUNOS Template (Juniper) - <http://www.qorbit.net/documents/junos-template.pdf> Secure JUNOS BGP Template (Juniper) - <http://www.qorbit.net/documents/junos-bgp-template.pdf> Ingress Prefix Filter Templates, Loose and Strict (Cisco) - <ftp://ftp-eng.cisco.com/cons/isp/security/Ingress-Prefix-Filter-Templates/> Ingress Prefix Filter Template, Loose (Juniper) - <http://www.qorbit.net/documents/junos-isp-prefix-filter-loose.pdf> Ingress Prefix Filter Template, Strict (Juniper) - <http://www.qorbit.net/documents/junos-isp-prefix-filter-strict.pdf> BGP Bogon route-server for AUTOMATED updates of bogon filters - All bogon route-server peers have already received the appropriate BGP prefix updates. - <http://www.cymru.com/BGP/bogon-rs.html> RADb fltr-unallocated fltr-martian fltr-bogons - <http://www.cymru.com/Bogons/index.html#radb> DNS Bogon (bogons.cymru.com) zone - <http://www.cymru.com/Bogons/index.html#dns> Monitoring Bogon prefix monitoring - <http://www.cymru.com/BGP/robbgp-bogon.html> Please feel free to contact Team Cymru <team-cymru(a)cymru.com> with any comments, questions, or concerns. Thanks! Rob, for Team Cymru. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

1 0

RE: Mail with no purpose?
by Michel Py 02 Apr '04

02 Apr '04

>> Michel Py wrote: >> In other words: if you're already to the point where >> you are using a text-mode mail client or disabling >> HTML and/or other stuff in a GUI client, you are no >> loss to the spammer if your email does not confirm >> as valid (because you would not even read it nor buy >> any of their crud in the first place). > Iljitsch van Beijnum wrote: > So what you're saying is that these validation schemes > are a good thing? I was not thinking in terms of being good or not, as these schemes exist and will likely continue whether we like it or not. Trying to answer the question anyway: It is clear that there is room for improvement in making these address validation schemes less efficient. I will let the reader make their own opinion whether this would be a good thing or not. It would be a good thing in the sense that it would reduce the spammer's ability to focus spam on known existing email addresses. It would be a bad thing in the sense that in order to reach the same number of valid targets the spammer would then send a lot more email, knowing that large numbers are invalid. The lesser of two evils: let's say that potentially we could force spammers to send 100 times more emails for the same result. Some will. Are we ready to bounce 99% of email traffic? Michel.

1 0

OT: Need Network Consultants for Focus Group
by jm 02 Apr '04

02 Apr '04

Seeking 10-25 individuals who are either freelance network consultants or operations managers who make use of freelance consultants to evaluate and improve a new web based service designed with the telecom industry in mind. We're offering two forms of compensation for your time: 1) If you will take 10 minutes to look at our website and give us feedback about it, we'll offer free 1yr seller subscriptions to the site. 2) If you will spend an hour with the site, we'll pay you your regular hourly consulting fee plus other financial considerations for ongoing recommendations. For this option, we're looking for people with 5+ yrs network freelancing experience and who are willing to engage us in a professional way to help us achieve our goals. To participate, send an email to thinkerteams(a)runbox.com with the following information: Name: Email Subject Line: Focus Group Brief summary of experience: (1-2 sentences) Choose option (1) or (2) above and include your fee if applicable. We're not expecting billions of responses to this potentially boring exercise but in the event several more than we can handle do respond, we will obviously limit participation to the best qualified who suit our budget. :-) We will respond to everyone who expresses interest and make selections in 3-5 days. Apologies in advance if the content of this email irks you due to it's remote relationship to operational matters. However, the decision to post here was made in light of past topics discussed at length on the list. The purpose of this email is not to promote anything--we simply seek to make contact with the demographic represented by the list and we're willing to pay people for their time. (Note that this email does *not* contain URL links, obnoxious Sig files or even an email address indicating our domain name.) Thanks, jm

1 0

RE: Mail with no purpose?
by Michel Py 02 Apr '04

02 Apr '04

> William Leibzon wrote: > But I really dont see how this would be any different then just > logging with cgi, it'll result in positive logging for exactly > same set of people. > For example as I'm using PINE from unix shell, all those html > images are not referenced in any way, nor are there requests > set for them in dns. Although this is true, the relevance of it is low. From the smart spammer's prospective, sending spam to people that use Pine makes no sense in the first place: people that use Pine are 1,000 times less gullible than the general population WRT to spam, therefore having their email addresses not confirm with cgi or whatever does not change the big scheme of things. I don't know about you, but the volume coming to my various "postmaster" or "administrator" is decreasing, as the ROI of spam sent to these must obviously be very low. In other words: if you're already to the point where you are using a text-mode mail client or disabling HTML and/or other stuff in a GUI client, you are no loss to the spammer if your email does not confirm as valid (because you would not even read it nor buy any of their crud in the first place).

2 1