- NANOG - lists.nanog.org

Average case performance vs. Worst-case guarantee
by Harsha Narayan 25 Sep '03

25 Sep '03

Hi, I have this question to which I have not been able to get a conclusive answer (I have heard different things). When an ISP buys a router does it want a worst-case guarantee about the router's capabilities? Or will it buy a router which can give better performance in the average case (it may drop some packets if the traffic pattern changes suddenly)? Assuming both cost the same. Could you please give your opinion? Harsha.

1 0

Re: Increase in tcp traffic from spoofed source to bogon?
by Mike Tancsa 25 Sep '03

25 Sep '03

Is it all to 135 ? I drop lots of that at my border. Each time I traced it back to the customer, it was some infected machine that was not being natted for various reasons. e.g. Deny TCP 172.16.4.1:4616 192.100.103.4:135 We also see the odd ntp request. Is it bogon as in RFC 1918 or bogon as in not yet allocated / routed ? ---Mike At 05:26 PM 25/09/2003, Mark Segal wrote: >While cleaning the narchi virus icmp traffic.. I noticed a lot of tcp >traffic (it seems to be increasing) from spoofed address to bogon space? >Any ideas on what virus or worm this is? Is it new? > >Regards, >Mark > >-- >Mark Segal >Director, Network Planning >FCI Broadband >Tel: 905-284-4070 >Fax: 416-987-4701 >http://www.fcibroadband.com > >Futureway Communications Inc. is now FCI Broadband

1 0

Increase in tcp traffic from spoofed source to bogon?
by Mark Segal 25 Sep '03

25 Sep '03

While cleaning the narchi virus icmp traffic.. I noticed a lot of tcp traffic (it seems to be increasing) from spoofed address to bogon space? Any ideas on what virus or worm this is? Is it new? Regards, Mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband

1 0

Re: williams spamhaus blacklist
by Kai Schlichting 25 Sep '03

25 Sep '03

On 9/25/2003 at 3:04 PM, "Susan Harris" <srh(a)merit.edu> wrote to me: > This is the third time I've contacted you concerning violations of the > NANOG list AUP. Your message below focuses on spam/blacklists, issues > that are not considered operational and are therefore off-topic for the > list. This is your last warning - if subsequent messages violate any > terms of the NANOG list, we'll need to remove your posting privileges from > the list. > Please refer to the AUP: > http://www.nanog.org/aup.html > Susan Harris, Ph.D. > Merit Network/Univ. of Mich. (above is a template, btw) oops - too late - been busy writing the next post that is SUPPOSEDLY off topic, and I hit 'send' before seeing this one. Now tell me: why are you not posting this notice to the list to kill the thread, if that is the desired effect? bye,Kai

1 0

Re: williams spamhaus blacklist
by jlewis＠lewis.org 25 Sep '03

25 Sep '03

On Wed, 24 Sep 2003, Leo Bicknell wrote: > What you're missing in my argument is that it doesn't matter. I > have no idea who Eddy Marin is, nor do I care. Blocking wcg's > corporate mail servers is not the solution. Sure, it may get > someone's attention at wcg, but it may also harm a lot of "innocent" > communications, sales talking to clients, other wiltel customers > requesting support, heck, the secretary ordering lunch to be > delivered. But it's ok when AboveNet does it?...or actually does much worse by secretly and arbitrarily blackholing various networks at will, while advertising connectivity to those networks to their BGP customers and peers? This means anyone connected to AboveNet will be unable to reach those blackholed victims if the routes to those destinations propogated by AboveNet appear to be their "best route" to the affected networks. This breaks connectivity even though we have multiple other transit providers. This is much worse than a Spamhaus (or any other DNSBL) listing since anyone using such services does so by choice and can decide for themself what action to take, if any, for listed addresses. With AboveNet blackhole routing, our only option, once we're aware of the problem, is to make changes to our routing policy and force traffic away from AboveNet and onto one of our other transit providers. We only find out about such AboveNet blackhole routes when we open a ticket with AboveNet to ask why your network is broken when our customers complain of networks they can't reach when using our service (i.e. banks that can't reach their staff training web sites), but they can reach from other service providers, so they inform us that our network is broken. Who's attention is AboveNet trying to get? Anyone taking BGP routes from AboveNet, or worse yet, single homed to AboveNet, ought to be aware of this policy. At the very least, you should make sure whoever does your BGP is aware of it and knows how to reroute traffic when the "best route" doesn't actually work. You also might bring it up with your sales person when it's time to renew. The central image on www.above.net boasts of "Unconstrained Information Exchange". I wish that were true. ---------------------------------------------------------------------- Jon Lewis *jlewis(a)lewis.org*| I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

3 2

RE: What about joe-jobs?
by Darren Foo 25 Sep '03

25 Sep '03

>Speaking of joe-jobs, what's the "proper" proceedure > for >dealing with such? The company I work for is > currently >undergoing an admitedly minor joe-job. > (about 300 or so >bounces that I've seen since mid > last week or so.) > > Any suggestions for dealing with this? What domains are you seeing the joe-jobs from? We > see alot of joe jobbing attacks from the large webmail providers eg. yahoo.com, hotmail.com, aol.com, netscape.net, etc. A promising response that we've been following is Sender Permitted From http://spf.pobox.com . It's basically a reverse RBL. The owner of a domain identifies ip's that are allowed to send mail for that domain in a TXT DNS record. The rest are tagged with a wildcard deny or probably softdeny initially. If yahoo.com, hotmail.com etc alone just added the DNS records, we'd all be able to identify joe-jobbers of these domains. It won't help their own spam situation but it'd help our massive attacks of spoofed email. Spammers seem to use these big providers since blocking all of hotmail.com or yahoo.com is tough for other providers.

3 3

RE: Re[2]: williams spamhaus blacklist
by netadm 25 Sep '03

25 Sep '03

>> Ehm, that was because you, infolink.com WERE the spam outfit, of >> course we block your 'entire network', it was an entire network of >> spammers with no real customers. You can pretend Infolink is an >> 'EyeEshPee' all you like Mr Leary but what we see is this, from your >> ROKSO record: >> This is exactly the problem with certain e-mail block lists (i.e. www.spamhaus.org) A few zealots who control this particular block list have made a decision based on inaccurate information. Mr. Linford has listed (in his block list) 48 /24s allocated to Infolink (yes we are a real ISP with real customers) for 2 customers we are working to terminate. In addition, as previously mentioned, Mr. Linford refuses to remove listings once we notify him of the termination. Given the above, it is imprudent for any network operator (North American or Other) to use Mr. Linford's SBL to restrict the delivery of e-mail. Dynamic block lists such as Spamcop will be much more effective at blocking spam, while allowing normal e-mail to flow as it should. Jon Ham/Infolink Network Administration Toll Free (USA) +1 877 293 2095 ext. 1422 Tel. +1 305 324 1616 ext. 1422 www.infolink.com

2 1

Experience with McLeodUSA
by Carrara, Richard 25 Sep '03

25 Sep '03

I am looking into a point-to-point DS3 from McLeodUSA in the Dallas/Ft. Worth area and was wondering what type of experience anyone on the list has had with them? Customer service, billing, response to issues, etc. Any information would be greatly appreciated! Thanks, Richard

1 0

Re: VeriSign SMTP reject server updated
by Gregory Hicks 25 Sep '03

25 Sep '03

> Date: Thu, 25 Sep 2003 11:12:05 -0400 (EDT) > From: Gerald <gcoon(a)inch.com> [...snip...] > > Ugh...sucked in. Can we get back to network operation discussions. Someone > make a Verisign gripe/commiserate list. I'll sign up. nanog-offtopic(a)lists.blank.org ...? Regards, Gregory Hicks > > G > > - How are ya? Never been better, ... Just once I'd like to be better. ------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer Cadence Design Systems | Direct: 408.576.3609 555 River Oaks Pkwy M/S 6B1 | Fax: 408.894.3400 San Jose, CA 95134 | "The trouble with doing anything right the first time is that nobody appreciates how difficult it was." When a team of dedicated individuals makes a commitment to act as one... the sky's the limit. Just because "We've always done it that way" is not necessarily a good reason to continue to do so... Grace Hopper, Rear Admiral, United States Navy

1 0

Nothing like viruses with bugs in them (Swen)
by Mark Radabaugh 25 Sep '03

25 Sep '03

Seems like this virus/worm has a bug where it will occasionally send out 1 byte attachments rather than the correct worm payload. Since the virus is not truly attached it tends to pass through e-mail virus scanners. It's causing a fair amount of end user confusion today -- lots of 'why is your/my virus scanner not working?' questions. Mark Radabaugh Amplex (419) 720-3635

7 7