- NANOG - lists.nanog.org

Unauthorized DNS updates
by Lou Katz 29 Sep '03

29 Sep '03

Is there a way to configure bind so that when an **unauthorized** update comes in it enstates an address of the owner's choice? -- -=[L]=-

2 1

Re: ISPs blocking port 53? (was Re: Annoying dynamic DNS updates)
by Paul Vixie 28 Sep '03

28 Sep '03

> How should an ISP tell the difference between "good" DNS packets and "bad" > DNS packets? the bad ones are the ones people complain about. > You aren't complaining about your dynamic update packets or even all > dynamic updates. You are complaining about someone sending you packets > you don't want. And more precisely, you are complaining that Comcast is > failing to send you other packets you want to receive, i.e. a response to > your e-mail packets. yup. where "packets i do not want" could as easily be ddos ("zwil") or spam. > I've been thinking how to use ICMP to signal different types of > responses; and even how "smart" edges on both ends of a communication > could establish and enforce policies. Most of these are non-malicious > communications involving misconfigured systems. Edge communications > avoids problems with the host system, but has problems with multi-path > communications and source validation. the whole end-to-end argument depends on uniform clue distribution for scale.

2 1

OT: CPAN hacked or fubar'd?
by Eric Germann 28 Sep '03

28 Sep '03

Anyone know whats up with CPAN? http://www.cpan.org points to http://www.netcetera.dk Pointers would be appreciated and also if we can trust the CPAN module to install modules. ========================================================================== Eric Germann CCTec ekgermann(a)cctec.com Van Wert OH 45891 http://www.cctec.com Ph: 419 968 2640 Fax: 603 825 5893 "The fact that there are actually ways of knowing and characterizing the extent of one’s ignorance, while still remaining ignorant, may ultimately be more interesting and useful to people than Yarkovsky" -- Jon Giorgini of NASA’s Jet Propulsion Laboratory

2 2

address harvesting analysis idea
by Peter Galbavy 28 Sep '03

28 Sep '03

While sitting here watching bad TV, I had a thought(tm). Has anyone set-up a generic web-page, not linked from anywhere useful, which autogenerates a "contact e-mail" address (like deadbeef(a)example.com) and logs which IP reads what address (even using the remote IP as the username to provide) and then waits for the address to be used for SPAM ? Is there any use in doing this (to try to identify who is harvesting) ? Maybe I should go and eat some food, cool my head down. Peter

4 3

Did cambrian go to "business hours only" contact/noc numbers?
by alex＠yuriev.com 28 Sep '03

28 Sep '03

Hello, If anyone has a contact number at Cambrian which does not believe that the service that they are providing are supposed to have trouble-reporting capabilities outside 9-5 EDT hours on weekdays, I would greatly appreciate hearing about it. Alex

1 0

Re: Any way to P-T-P Distribute the RBL list
by Stewart, William C (Bill), RTSLS 28 Sep '03

28 Sep '03

Distributing an RBL list is the easy part. There are a variety of methods in place that can provide sufficient reliability and are sufficiently anonymous or difficult to attack, such as Usenet and Freenet and Gnutella and probably Kazaa, and it's not too hard to develop efficient data formats for baseline and incremental update and detail records (easier for IPv4 blocking than IPv6 :-), and you can use PGP or other digital signatures to protect the integrity of the transmission. SMOP... There are some problems with broadcasting the list as opposed to doing transactional interaction - a list of "mis-configured open relays or proxies with updates" is not much different from the spamware spammers' products of list of new still-usable open relays. (It's a bit less useful, because they know that some people are blocking them, but they also know that lots of people aren't.) The other half of the communications process is harder - getting the information on spammers to the list maintainer without exposing the list maintainer to attack. A simple usenet group or IRC channel can be flooded, and email can be mailbombed, and the obvious way to do it is with bogus spam reports to reduce the integrity of the information. And some of it's an arms race, e.g. spammer submits a purported open relay to list-manager the list-manager's tester tests the "relay", and the "relay" captures the tester's IP address for DDOSing. There are spam-reporting reputation systems - Cloudmark and Vipul's Razor do some of that, if imperfectly, or simple subscriber-only systems can stay below the radar (even though they'll have some spammers subscribing...) and you could probably build one that was P2P for a bit more safety.

3 2

RE: Italy: the latest member of the blackout club
by Baldwin, James 28 Sep '03

28 Sep '03

http://news.bbc.co.uk/2/hi/in_depth/3146136.stm James Baldwin > -----Original Message----- > From: Sean Donelan [mailto:sean@donelan.com] > Sent: Saturday, September 27, 2003 11:44 PM > To: nanog(a)merit.edu > Subject: Italy: the latest member of the blackout club > > > > Joining the Northeast parts of the United States and Canada, parts of > Denmark and Sweden; Italy is the latest country to experience widespread > power failure of the electrical grid. > > According to the Italian national electric company ACEA, power is out > in almost the entire country. > > The cause is not known. > >

1 0

Italy: the latest member of the blackout club
by Sean Donelan 28 Sep '03

28 Sep '03

Joining the Northeast parts of the United States and Canada, parts of Denmark and Sweden; Italy is the latest country to experience widespread power failure of the electrical grid. According to the Italian national electric company ACEA, power is out in almost the entire country. The cause is not known.

1 0

A list of (mostly) technical consequences of TLD wildcards
by Duane Wessels 27 Sep '03

27 Sep '03

I've been collecting a list of things that are broken, or might break, now that the two most populated TLDs have A and MX record wildcards. You can find the list at http://www.packet-pushers.net/tld-wildcards/ I'll be happy to receive any additions or corrections that you might have. Duane W.

3 4

Re: [OT] question on NANOG meetings
by Brandon Butterworth 27 Sep '03

27 Sep '03

> the it behaves well in varying network conditions, which cannot be said > from either WM or RM. Quality of the link from encoder to Real server is important, send garbage to the server and it has nothing to distribute. I get the impression it's done in band with other NANOG traffic and may be suffering against the warez traffic. Some details of that link and the server loading would be interesting, anyone got details from previous meetings? brandon

3 2