- NANOG - lists.nanog.org

Anyone from NeuLeve.bizl listening?
by Drew Linsalata 11 Dec '03

11 Dec '03

Given that there are no phone numbers anywhere on the NeuLevel (.biz registrar) site and email to support(a)neulevel.biz is going unanswered, I'll ask here. If anyone has real contact info for these folks, or anyone from NeuLevel is listening, please drop me a note off-list. A cracker/spammer has decided to list one of our customer servers as a secondary nameserver for a bunch of spam domains and we're getting hammered with spam complaints that really have nothing to with us. Thanks! -- Drew Linsalata The Gotham Bus Company, Inc. Colocation and Dedicated Access Solutions http://www.gothambus.com

3 2

Re: Anyone from NeuLeve.bizl listening?
by Joe St Sauver 11 Dec '03

11 Dec '03

As a number of folks have mentioned, there was a typo in the URL I just provided; the corrected URL is: http://www.syllabus.com/news_article.asp?id=8618&typeid=153 Sorry about that, Joe

1 0

Whitelisting mechanism in SORBS.
by Matthew Sullivan 11 Dec '03

11 Dec '03

Hi All, My appologies for the public post, I'd have rather replied to the individuals who mailed me in response of a previous post, however time has passed and I have a huge inbox, and of course I would like to solicit more entries from those interested and just waiting to see what it is. The whitelisting system previously discussed is now nearly complete..... The database and administration interface are indeed complete. I am therefore inviting those who wanted to whitelist to submit the following information to me off list: - ISP Name. - Email address of primary ISP/company contact incase of issues (bounced alerts for your company will go here along with any communication from SORBS). - Out facing IP addresses of your outgoing mailservers (last hop in the headers). - Netblocks you wish to receive reports/alerts for. (Plain text CIDR format list Minimum /32 maximum /8) - A list of email addresses where you wish the alerts to go to. The system works as follows: For the mailservers: When spam is received at a spamtrap (automated and/or manual) you will have your server listed with a 1 hour TTL, you will be sent a coded URL to the nominated alert email addresses. Using that coded URL you can delist your server immediately from the SORBS spam DB (no fine etc). The coded URL will timeout after 48 hours, if you have not used the URL by this time you will not be able to automatically remove yourself and the listing TTL will revert to the default (6 hours for an automated listings and 48 hours for a manual listings). You will receive no more than 1 URL per hour per IP address. The full headers (minus desitination email addresses of all spams received relating to a particular URL) will be available using the coded URL. Using the URLs to view the headers will not acknowledge the termination of the spammer - there is an extra step similar to that in spamcop. Each whitehat entry has a 'whiteness' value - each expired URL will make your whiteness decrease by 1, each time you use a valid URL it will go up 1. If further spam is received from an address to an automated spamtrap within 1 hour *after* you have used the URL, and acknowledged termination, for that IP your whiteness will decrease by 5. Using the URL and acknowledgement indicates you have identified and stopped the flow of spam, if you choose to delist yourself before you stop the flow that is considered not whitehat - hence the peanlty when you get caught (mail queuing in our system has been thought of and taken care of). You can get a maximum whiteness of 9 and a minimum of -9, for anything below 1 (ie -8 through 0 inclusive) you will be treated as not whitehat and will still get keys and be subject to normal TTLs (6 & 48). If you get to -9 you will be considered blackhat and removed from the system. For the network lists: Same principles as the mailserver IP however URLs will expire after 7 days, and TTLs are 6 hours by default. Anyone caught listwashing will be removed. Minimum entry is owning your own /24 (as found in public whois ;-)) Initial 'whiteness' will be 3. Note: The whitelist/whitehat system is completely independant of the ISP reporting system which will provide weekly reports to ISPs/companies requesting them. Yours Matthew

1 0

RoadRunner contact
by Brian Bruns 11 Dec '03

11 Dec '03

Hello all, I dont suppose anyone here might have a direct contact for the people at Road Runner in regards to DNS management and/or their abuse desk? Contact me off-list please. Thanks. -- Brian Bruns The Summit Open Source Development Group Open Solutions For A Closed World / Anti-Spam Resources http://www.sosdg.org The AHBL - http://www.ahbl.org

1 0

Google contact
by Jeff Nelson 11 Dec '03

11 Dec '03

If someone from Google could contact me, I would appreciate it (or someone give up a good one). Thanks, -- Jeff Nelson Rackspace Managed Hosting Office: (210) 892 4025 x1601 GnuPG KeyID: 0x7DE7C4E0 @pgp.mit.edu AS Caretaker: 10532 15395 25897 27357 30099

1 0

RE: Authority
by Michel Py 11 Dec '03

11 Dec '03

> Michael.Dillon(a)radianz.com > I may not agree with everything that William does > or how he goes about it, but I do think that his > approach is worthwhile. Indeed; I like the "economy of ideas" concept myself and in this case it might be the only valid initial approach, see below. > It gives us a chance to see a prototype of > something that could be either incorporated > into ARIN or commercialized in the future. Exactly. Besides, if ARIN or IANA were to start something like this out of the blue, they would likely get stalled by the few trolls that don't like the idea and what would scream about it, probably questioning the legitimacy of ARIN/IANA in the first place and other BS. OTOH, with William and Rob doing their thing on their own behalf only, should it be incorporated into something bigger later it would have acquired the legitimacy of being field-tested and approved prior to the "standardization" effort. Rob and William have my support, and it's not because they're my co-authors. They're my co-authors because they have ideas and work towards making them better. If someone does not like what they're doing, just don't look at it and don't use it. I do, because I find value in it, as do many other participants. Michel.

1 0

Authority
by Blaxthos 11 Dec '03

11 Dec '03

hello, i've been reading nanog-l/inet-access for many many years (just a shadow, i don't post). i am just curious... do you have any authority/commission from arin (or anyone else)? or is yours a rogue vigilante mission? does anyone ask you to undertake the battles you feel justified in engaging in? this is certainly not flame bait, but it is an honest question. you're very self-righteous, and although you may have valid points (i withold judgement) i really want to know what gives you the right/authority to say the things you say about others. /blaxthos

12 15

RE: MTU path discovery and IPSec
by cproctor＠epik.net 10 Dec '03

10 Dec '03

The problem is described pretty clearly at http://www.cisco.com/warp/public/105/56.html. The issue I have experienced is that fragmentation can lead to performance impacts that are unacceptable. I wish we could start a clue campaign informing people why ICMP should not be summarily dumped at the firewall. Chris Proctor EPIK Communications > -----Original Message----- > From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] > Sent: Wednesday, December 03, 2003 11:39 AM > To: jgraun(a)comcast.net > Cc: nanog(a)merit.edu > Subject: Re: MTU path discovery and IPSec > > On Wed, 03 Dec 2003 16:05:39 GMT, jgraun(a)comcast.net said: > > > 1) I assume MTU path discovery has to been in enabled on > each router in the path in order for it work correctly?! > > Actually, no. All that's required is that: > > a) The router handle the case of a too-large packet with the > DF bit set by > sending back an ICMP 'Dest Unreachable - Frag Needed' packet. > I've never > actually encountered a router that didn't get this part > right. (Has anybody ever > seen a router botch this, *other* than a config error covered > in (b) below?) > > b) said ICMP makes it back to the originating machine. This > is where all the > operational breakage I've ever seen on PMTU Discovery comes > from. And in almost > all cases, one of two things is at fault. Either some > bonehead firewall admin > is "blocking all ICMP for security" (fixable by reconfiguring > the firewall to > let ICMP Frag Needed error messages through), or some > bonehead network provider > numbered their point-to-points from 1918 space and the ICMP > gets ingress/egress > filtered (this one is usually not fixable except with a baseball bat). > >

11 20

Re: Authority (fwd)
by Owen DeLong 10 Dec '03

10 Dec '03

I apologize for further troll feeding, but, I think this warrants some clarification... > I take issue with anyone who publicly accuses another entity of wrongdoing > beyond his scope of authority. > You can take issue, but, there is no scope of authority for accusations. Anyone can make an accusation against anyone else at any time. At least in the united States. It's part of what is known as free speech. > If people are speeding in my neighborhood, I can not go and take down > their pictures, personal information, license plate numbers, etc., post > them pupubliclyand accuse them of breaking the law (even if they did!). > That's liabel, and it is illegal (and wrong). It is no less wrong just > because it is up to the victim of the post to take corrective/punative > action in a civil forum (ie lawsuit). > Actually, you can. There is no law against it. The word you were looking for is Libel, not Liabel, and, for a claim to be libelous, it must meet the following criteria: 1. It must be published 2. It must be provably false 3. It must cause harm Legally, you can take pictures of anything in a public place and publish them. Legally, you can write down a license number observed in a public place. Further, unless the person can claim that your statement they were speeding is false by preponderance of the evidence, they are unlikely to succeed in suing you for libel. You can take issue with it all you want. Whether it is right or wrong to do so is a separate issue. However, it is most definitely _NOT_ illegal at least not under the libel laws. > The correct action would be to lobby the authorities (police in the > example, arin in this situation) to take enforcement measures, NOT to > demand that the "criminals" justify their actions to you (specifically > speaking to whom my email was originally addressed). There are fiscal and > legal ramifications to what is being done here. > I suggest you do some further study before making legal claims. What you have done here is merely demonstrate an ignorance of the law. I don't always agree with William, but, I haven't seen him do anything illegal yet. Owen -- If it wasn't crypto-signed, it probably didn't come from me.

1 0

4.5 magnitude earthquake in VA
by JC Dill 10 Dec '03

10 Dec '03

http://earthquake.usgs.gov/recenteqsww/Quakes/uscdbf.htm

2 1