- NANOG - lists.nanog.org

RE: Fun new policy at AOL
by McBurnett, Jim 28 Aug '03

28 Aug '03

-On Thursday, August 28, 2003 4:18 PM, Matthew Crocker <matthew(a)crocker.com> -wrote: -> -> Shouldn't customers that purchase IP services from an ISP use the ISPs -> mail server as a smart host for outbound mail? - -At least here in DE there are resellers of DTAG which offer DSL connections -without any SMTP relay. If you want relaying you also have to order a domain -via them. More funny: you cannot deliver mails to DTAG (actually T-Online) -as the resellers use address space of DTAG and hence the DTAG servers -believe you are a customer of them and should use the internal relays ... - -Arnold I wouldn't say that the answer is to use a relay.. I have had the problem, and due to the business we are in, we sometimes are forced to email proofs that can be as big at 10 Meg, zipped.... Don't think many would allow us to realy that...... J

1 0

Re: GLBX ICMP rate limiting (was RE: Tier-1 without their own backbone?)
by Robert Boyle 28 Aug '03

28 Aug '03

At 09:26 AM 8/28/2003, you wrote: >It takes some education to the customers, but after they understand why, >most are receptive. > >Especially when they get DOS'ed. We have been rate limiting ICMP for a long time, however, it is only recently that the percentage limit has been reached and people have started to see "packet loss" as a result. However, the fact that customers stay up and are not affected by the latest DOS attacks and real traffic makes it to the proper destination makes a slight increase in support calls well worth it. -Robert Tellurian Networks - The Ultimate Internet Connection http://www.tellurian.com | 888-TELLURIAN | 973-300-9211 "Good will, like a good name, is got by many actions, and lost by one." - Francis Jeffrey

1 0

Re: Fun new policy at AOL
by Jonathan Hunter 28 Aug '03

28 Aug '03

> Sometime mid last week, one of my clients--a state chapter of > a national > association--became unable to send to all of their AOL > members. Assuming > it was simply that AOLs servers were inundated with infected emails, I > gave it some time. The errors were simply "delay" and "not > delivered in > time specified" errors. AOL appear to have recently changed their MX receiving policies, see the following demon.announce post: http://groups.google.com/groups?selm=xVIP4XA5f7M%24EwzW%40demon.net&oe=UTF-8 &output=gplain --- cut here --- One such scheme uses a list of "end user" IP addresses on the basis that such users will only be sending legitimate email via their own ISP's "smarthost" email server. The idea is that the blocklist will be able to block non-legitimate email because it arrives directly. In particular it should block "spam" sent via insecure systems or virus/worm infections. We have recently been in discussion with AOL who are, at a future date, planning to implement just such a scheme as they have found, working with many ISPs around the world, that it significantly impacts their incoming spam volumes. --- cut here --- Regards, Jonathan

1 0

Re: Max TNT ping thing
by Matthew Crocker 28 Aug '03

28 Aug '03

On Wednesday, August 27, 2003, at 11:10 PM, Edward Murphy wrote: > Is anyone having this problem on a unit with the mad-2 cards? > > We are not experiencing the reboots/lock ups on our APX 8000. We are using the Ethernet card with the dongle. E-100-V I think. We are using the Channelized DS-3 card We are using 96 port madd2 modem cards (5 modem cards, 480 modems) Our APX is not even close to 25% capacity. admin> show Controller { left-controller } ( PRIMARY ): Reqd Oper Slot Type { right-controller } UP UP ( SECONDARY ) { shelf-1 slot-34 0 } UP UP madd2-card { shelf-1 slot-35 0 } UP UP madd2-card { shelf-1 slot-36 0 } UP UP madd2-card { shelf-1 slot-37 0 } UP UP madd2-card { shelf-1 slot-38 0 } UP UP madd2-card { shelf-1 slot-39 0 } UP UP t3-card { shelf-1 slot-40 0 } UP UP ether3-card admin> admin> list [in SLOT-INFO/{ shelf-1 slot-39 0 }] slot-address* = { shelf-1 slot-39 0 } serial-number = 1038406179 software-version = 10.0 software-revision = 2 software-level = "" hardware-level = " K" software-release = "" admin> read slot-info {1 40 } SLOT-INFO/{ shelf-1 slot-40 0 } read admin> list [in SLOT-INFO/{ shelf-1 slot-40 0 }] slot-address* = { shelf-1 slot-40 0 } serial-number = 10516825 software-version = 10.0 software-revision = 2 software-level = "" hardware-level = " C" software-release = "" admin> ls ls Flash card 1: /: current/ 0 Fri Sep 29 11:36:36 2000 /current: tntt3.ffs 416034 Mon Dec 16 19:47:20 2002 Version 10.0.2 tntmadd.ffs 1726366 Mon Dec 16 19:51:10 2002 Version 10.0.2 tntenet3.ffs 446882 Mon Dec 16 19:48:22 2002 Version 10.0.2 apxsr.ffs 3031819 Mon Dec 16 19:46:34 2002 Version 10.0.2

1 0

bgp route-map
by Haesu 28 Aug '03

28 Aug '03

Hi all, Wondering if anyone would know whether such feature in IOS exists or not... Most of the time, people use route-maps on bgp neighbors or peer-groups to set an attribute,etc on a prefix that is being announced OUTbound or INbound. However: On prefixes being announced to me INBOUND, is there a feature to set in route-map so that it checks whether the advertised prefix is already existing in local RIB? Like for example, I am one of the users who receive bogon advertisements from Rob's route-server. Now, when I receive prefixes either from my upstream AS or my customers doing bgp with me, I can setup a route-map on the neighbor so that it compares the prefix being announced by neighborAS with existing Rob's bogon prefix in the RIB with bogon route-server community 65333:888. If the prefix being announced gets a match with existing prefix with 65333:888 already in the router, the route-map would cause a DENY. Thus, making Rob's bogon announcement from his route-server, a bogon route filtering list for me to use on my customers/peers.. If you are not understanding what I am saying, feel free to yell at me to clear up.. This would make it much easier to create dynamic bgp-based route filtering list in my opinion... I am not here to discuss the feasibility of whether doing or inventing this dynamic method of filtering bgp routes; I am rather asking this question to see if anyone is doing something similar to this as it may be useful. Thanks! -hc -- Sincerely, Haesu C. TowardEX Technologies, Inc. WWW: http://www.towardex.com E-mail: haesu(a)towardex.com Cell: (978) 394-2867

26 47

Re: Re[2]: relays.osirusoft.com
by George William Herbert 28 Aug '03

28 Aug '03

>> returning 127.0.0.2 for everything would be an ugly way to bow out. > >yes, but it's been done before. Someone has been in contact with Joe via phone and posted to another mailing list That Zhall Not Be Named that exactly that is happening. The zone is dead, he's put *.*.*.* in, he's asking people not to use it anymore. It may be back in the future with a new network setup, but right now consider it down. We're working on getting him to send out a public announcement. Yes, this is due to a massive DDOS. At least three of the spamfilter BLs have been so attacked this week. Some of the networks represented here have not been as timely about helping the BL providers with the DDOSes as they could be. Please keep in mind that without dynamic BLs anti-spam folks will fall back to sending out static block maps, which getting your IP space out of will be difficult if not impossible. IT IS VERY MUCH IN NETWORK OPERATORS BEST INTEREST THAT THIS NOT HAPPEN. Please take what measures are necessary to help ensure that your customers are not intentionally or neglegently DDOSing the BLs. -george william herbert gherbert(a)retro.com

8 8

Re: Cross-country shipping of large network/computer gear?
by Brian Dickson 28 Aug '03

28 Aug '03

Various war-story authors wrote: > > My experience is a 40% damage rate when shipping Cisco 7507 > > and 7513 routers via FedEx Heavy. Here are some pictures from back > > when I was at AboveNet: http://www.seastrom.com/fedex/ > > > >You aren't alone: > >http://www.16paws.com/FedEx/ > > Although this is a small item, I believe it wins the contest for "Most thoroughly damaged shipment". > http://colofinder.net/gallery/view_album.php?set_albumName=album18 While I sadly no longer have the image, sometimes words paint a more vivid picture... We had a 7505 which could have won, simultaneously, awards for: "Most Blantant Disregard For Shipment Contents" "Least Excusible or Fathomable Damage Mode" "Failure To Note Packing Material Damage - Outstand Achievement" "Shipper Rules Weaseling - Special Mention" "Vendor Sudden Observance Of Fine Print" "One *Tough* Box" We shipped the 7507 in its original packing material, including crimped straps, to a colo site. The site contact received it, signed for it, and discarded the packing material, all without noticing the damage. What damage, you ask? UPS had driven a forklift tine through its side. As in, straight in, through packing material, and *pierced* the chassis, right in the center of the side, ie into the card cage. Without the packing material, UPS wouldn't pay damages. Cisco wouldn't RMA the chassis. Not a pleasant situation at all. However, the router only had a couple of cards, which were installed (luckily) next to the power supplies, and at the opposite end from the gaping 3/4" x 2.5" hole. The site tech suggested seeing if it would boot. Sure enough, it did. And ran fine. And to the best of my knowledge, is still in service. It's a good thing the airflow wasn't too badly disrupted by the hole. It's the last time we used UPS... -- Brian Dickson Email: briand(a)cineclix.com http://www.cineclix.com Tel : +1 604 688 2339

1 0

Re: Cross-country shipping of large network/computer gear?
by Eric Kuhnke 28 Aug '03

28 Aug '03

http://colofinder.net/gallery/view_album.php?set_albumName=album18 Although this is a small item, I believe it wins the contest for "Most thoroughly damaged shipment". :-) > My experience is a 40% damage rate when shipping Cisco 7507 > and 7513 routers via FedEx Heavy. Here are some pictures from back > when I was at AboveNet: http://www.seastrom.com/fedex/ > > >You aren't alone: > >http://www.16paws.com/FedEx/

2 1

Tier-1 without their own backbone?
by Rick Ernst 28 Aug '03

28 Aug '03

We are sending out feelers for adding an additional DS-3, or possibly frac OC-3. One of the responses came back with "we won't be competive with <provider> because they don't have their own backbone. Is there a cross-reference for provider vs network backbone, or is this just something that we have to ask each provider for? I "assume" that UU, Sprint, and AT&T are self-owned backbones, but others... ? One of the providers we are looking at is Level-3. Any comments good/bad on reliability and clue? We already have UU, Sprint, and AT&T. I also realize that the "they suck less" list changes continuously... :) Thanks, Rick

6 5

Re: Sobigf + BGP
by guy 28 Aug '03

28 Aug '03

> 'vuln'dev', and besides I wouldn't think that any > one here would do something malicious with any idea > that actually worked for the worse. Assuming that everyone subscribed to the list has the best of intentions, what about people that can scan the publicly accessible archives? Or even the search engines that have nanog archives indexed? There's nothing wrong with kicking ideas like this around with the intention of coming up with a strategy on how to combat them, but perhaps a more discreet forum would be appropriate? I didn't get a chance to look at your idea very closely, but there are interesting possibilities brought up. Guy

7 6