- NANOG - lists.nanog.org

Re: Complaint of the week: Ebay abuse mail (slightly OT)
by neil＠DOMINO.ORG 05 Aug '03

05 Aug '03

> And so we should do nothing? Absolutely not, and perhaps I should have been clearer in that respect. There needs to be more of an understanding of why people spam and what can be done to tackle that issue head on, its a social/educational issue. Do you think the people spamming the Nigerian scam do it because its a good laugh? No they do it because they think they will make money from it, some of the are succesful, even to this day, but its now such a common message that its almost a net legend. Education of these people to show them the err of their ways would deal with the problem. And typically thats a more expensive problem to solve and requires resolve from politicians and lawmakers, who unfortunately are overwhelemed with other "more important" issues. Until there is a much more hand in hand joint social / technical attack on the root causes then we will always have spam. I've tried many of the technical solutions and they end up shooting you in the foot more times than they are worth, although I do agree a more stronger mail transfer protocol should be developed but not just to deal with spam issues alone. Its akin to the way that most [all?] governments have abysmally failed to make any progress on dealing with illegal narcotics. The publicilty campaign formally known as "The war on drugs" was focused on attacking the suppliers and the manufacturers, when the root cause of the problem is with the demand of the people who use the drugs in the first place. We're now off topic and you don't need to send me an email Susan! Regards, Neil.

1 0

Humidity ranges?
by Steve Francis 05 Aug '03

05 Aug '03

We have sensors in our datacenters that report, among other things, humidity. One data center is exceeding the predefined humidity alerts of the devices, but given that cisco says the operating humidty of routers is 10% to 85%, I dont know if humidity of, say, 65% is anything to worry about. Anyone know if increased humidity correlates with decreased MTBF? And reasonable thresholds that I can tolerate, and when I should complain to the datacenter operators? (References I can point to would be nice.) Thanks

7 6

Re: Complaint of the week: Ebay abuse mail (slightly OT)
by Michael.Dillon＠radianz.com 04 Aug '03

04 Aug '03

>we all knew that profitable large network owners would change the landscape >compared to merely ebitda-positive large network owners, and here's an >example of how "big company" cost management practices can go up against >"reasonable and customary internet behaviour" and pretty much ignore it. Having an abuse@ email address may be customary Internet behavior but it is no longer reasonable. The fact is that SMTP email has outlived its usefulness and needs to be replaced with something that provides a chain of authentication that certifies the sender's identity. Once email senders are no longer able to falsify their identity, then it will again be economically feasible for companies to accept abuse@ email from anyone. Instead of working to prevent email relaying, we should be working to encourage it along with certification of the sender's identity. If we had a web of ISP mail servers that trust each other to certify the sender's identity, then people would be happy to accept any and all email relayed through that web. The web of trusted email servers would use a new and improved mail transfer protocol (NIMTP) that would only be used to exchange email between trusted servers. Users could continue to use authenticated SMTP to initiate the sending of email, but nobody would accept any unauthenticated SMTP servers any more. --Michael Dillon

5 4

Re: Complaint of the week: Ebay abuse mail (slightly OT)
by Richard D G Cox 04 Aug '03

04 Aug '03

Valdis Kletnieks <Valdis.Kletnieks(a)vt.edu> wrote: > 1) What *immediate* benefits do you get if you are among the first to > deploy? (For instance, note that you can't stop accepting "plain old > SMTP" till everybody else deploys). The immediate benefit (as sender) is that you reduce the (now ever-increasing) risk of your mail being rejected by filtration processes and will be trusted on arrival; the benefit for the recipient is of course less junk! However you CAN stop accepting "plain old SMTP" right away, because you can delegate that to a filtration service that hosts your old-style MX, applies ever-increasingly stringent filtration rules, and then forwards to you using the new protocol. Several such filtrations services may well appear when the time is right. > 2) Who bears the implementation cost when a site deploys, and who gets > the benefit? (If it costs *me* to deploy, but *you* get the benefit, > why do I want to do this?) Both parties get benefits which seriously outweigh the costs! > 3) What percentage of sites have to deploy before it makes a real > difference, and what incremental benefit is there to deploying before that? To some extent the concept is already here, and deployed, whether using in-house filters or remote-MX, to subject the unauthenticated mail - which of course is currently ALL the mail - to appropriate filtering. > (For any given scheme that doesn't fly unless 90% or more of sites do it, > explain how you bootstrap it). That is a very valid point that most people don't address. I define any new scheme as unworkable unless someone can describe the present, albeit unsatisfactory, arrangements that it offers to replace as a "special case" of the new scheme for which there is clearly-defined correct handling. > 4) Does the protocol still keep providing benefit if everybody deploys it? That depends entirely on the contactual relationships that may exist between mail-exchanging sites. Just implementing an authenticating protocol on its own will NOT help. There will be a prima-facie need for a selection of "trust-authorities" who specify what is acceptable for their trusted-senders to send. Recipients then get to choose which criteria are closest to their requirements (including whitelisting if needed on a per-site basis). > (This is a common problem with SpamAssassin-like content filters - if most > sites filter phrase "xyz", spammers will learn to not use that phrase). That goes for any precautions taken - not just content filters. That is WHY the contractual relationships are absolutely essential for any new scheme. And there, too, lies the bulk of the work needed - the technical issues do not place any great demands on the networking community. > If you have a *serious* proposal that actually passes all 4 questions > (in other words, it provides immediate benefit to early adopters, and > still works when everybody does it), bring it on over to 'asrg(a)ietf.org'. Heh. The noise-to-signal level *there* is far worse than in NANOG - by at least 12dB last time I looked ;-) -- Richard Cox RC1500-RIPE

2 1

AS announcement question (easy)
by Mike Donahue 04 Aug '03

04 Aug '03

Hi, sorry for this low-level question, but at least I'm not posting in html. :) My company owns a class C, and we're switching ISPs. The "new" provider is telling us that they can start announcing, without us having to tell the old provider to stop announcing. I.e., a 2-3 day period where both are announcing our class C. This conflicts with my extremely (admittedly)limited knowledge. Can someone let me know if this is OK/not OK? Thanks in advance, Mike Michael Donahue WATG (949) 574-8500 x261

5 4

RE: AS announcement question (easy)
by Pete Templin 04 Aug '03

04 Aug '03

Is it a class C, or a /24? Regardless, longest match wins. If old provider is announcing your space as part of a larger announcement, you'll be a bad netizen for a few days because you're violating the RFCs concerning inconsistent AS, but your traffic will swing almost entirely over to new provider, and rather quickly. Traffic originating in old provider's network will likely still come in on your old link. (I've done this for three new customers in the past month.) If your old provider is specifically announcing your space as a /24, standard BGP path selection processes will take place all over the 'Net, and YMMV on the traffic balance. On or before disconnecting the link to old provider (if they are specifically announcing your /24), be sure to have them stop announcing that /24. Pete Templin Senior Staff Engineer TexLink Communications (210) 892-4183 pete.templin(a)texlink.com -----Original Message----- From: Mike Donahue [mailto:mdonahue@WATG.com] Sent: Monday, August 04, 2003 1:22 PM To: 'nanog(a)merit.edu' Subject: AS announcement question (easy) Hi, sorry for this low-level question, but at least I'm not posting in html. :) My company owns a class C, and we're switching ISPs. The "new" provider is telling us that they can start announcing, without us having to tell the old provider to stop announcing. I.e., a 2-3 day period where both are announcing our class C. This conflicts with my extremely (admittedly)limited knowledge. Can someone let me know if this is OK/not OK? Thanks in advance, Mike Michael Donahue WATG (949) 574-8500 x261

1 0

RE: North America not interested in IP V6
by McBurnett, Jim 04 Aug '03

04 Aug '03

Jack Bates Wrote: >In the US, the pipe is limited in any number of ways in attempts to >limit how many people share their broadband with their neighbor at a >reduced rate. > >Another issue is that handing out IP addresses to the home at this point >is foolish. User's, in general, can't protect themselves. EXACTLY-- I wish there was some kind of regulatory something or other that made a cable/dsl router mandatory... HMMM -- Wonder is Lieberman would sponsor a bill? ;) Jim

3 3

RE: AS announcement question (easy)
by H. Michael Smith, Jr. 04 Aug '03

04 Aug '03

If the old provider is advertising the prefix based on your advertisement to them (you're running BGP), then their advertisement should cease shortly after your link to them goes down. Likewise, the new provider would only propagate the advertisement after you advertise it to them. Michael H. Michael Smith, Jr. Network Services and Security Manager Clark Atlanta University -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Mike Donahue Sent: Monday, August 04, 2003 2:22 PM To: 'nanog(a)merit.edu' Subject: AS announcement question (easy) Hi, sorry for this low-level question, but at least I'm not posting in html. :) My company owns a class C, and we're switching ISPs. The "new" provider is telling us that they can start announcing, without us having to tell the old provider to stop announcing. I.e., a 2-3 day period where both are announcing our class C. This conflicts with my extremely (admittedly)limited knowledge. Can someone let me know if this is OK/not OK? Thanks in advance, Mike Michael Donahue WATG (949) 574-8500 x261

1 0

RE: [operations] FW: abuse case management
by Damian Gerow 04 Aug '03

04 Aug '03

On Mon, 4 Aug 2003, William Devine, II wrote: > I used RT a looong time ago around 1998 & 1999 and liked it, but OTRS, > compared to THEN features is superior. I haven't tried RT yet, although I > did start installing it and I know I gave up on RT once when trying to > install it but got OTRS up and running rather easily, so I can't say about > their new things. > I do know that there is a feature article this month in Linux journal, Linux > review or one of the Linux related mags that states that OTRS is used by one > national British ISP that pumps 20,000 tickets per DAY through it, and one > business that has around 2,000 CSR's using OTRS for customer support > services, both using MySQL as the database backend. I thought that was a > pretty good testament as well. We have been using RT for some time now, and it's incredibly easy to get up and running (especially with a ports system). It's not even close to processing 20k tickets/day, but it definitely handles what we give it. RT has its quirks, but Jesse Vincent is a good guy, and it's mindbogglingly easy to customize it. There's more testemonials in the NANOG archives I believe. And getting back to the original post... Mikael Abrahamsson asked: > Is there an abuse case management system as freeware somewhere, something > like all the ticket/case handling packages out there, but more > specifically aimed at abuse/complaint handling. I googled some but couldnt > find any. I haven't checked it out yet, but Jesse's written an interface to RT specifically for Abuse desks - it's called RTIR. Look through http://www.bestpractical.com/ and http://www.fsck.com/pub/ for mote details. - Damian

1 0

RE: [operations] FW: abuse case management
by William Devine, II 04 Aug '03

04 Aug '03

I used RT a looong time ago around 1998 & 1999 and liked it, but OTRS, compared to THEN features is superior. I haven't tried RT yet, although I did start installing it and I know I gave up on RT once when trying to install it but got OTRS up and running rather easily, so I can't say about their new things. I do know that there is a feature article this month in Linux journal, Linux review or one of the Linux related mags that states that OTRS is used by one national British ISP that pumps 20,000 tickets per DAY through it, and one business that has around 2,000 CSR's using OTRS for customer support services, both using MySQL as the database backend. I thought that was a pretty good testament as well. william -----Original Message----- From: ODHIAMBO Washington [mailto:wash@wananchi.com] Sent: Monday, August 04, 2003 8:32 AM To: operations(a)wananchi.com Cc: William C. Devine II; nanog(a)nanog.org Subject: Re: [operations] FW: abuse case management This is for William Devine and the nanog staff: I have a question. Have any of you had the chance to try out RT (Request Tracker) available at http://www.bestpractical.com/ and compared it with OTRS??? I would be interested in the comparison of features, but if I have to install OTRS to compare, then I will spare some time to try it out in due course. -Wash * Joseph Mucheru <mucheru(a)wananchi.com> [20030803 09:49]: wrote: > > > ------ Forwarded Message > From: "William Devine, II" <william(a)smartguys.net> > Date: Fri, 1 Aug 2003 06:06:51 -0500 > To: <nanog(a)nanog.org> > Subject: RE: abuse case management > > > I started using OTRS (Open Ticket Request System) a month or so ago and LOVE > IT. You can setup pre-canned response templates and have multiple users > login and maintain various queues. It's open source and works VERY well. > > http://www.otrs.org/ > > william > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of > Mikael Abrahamsson > Sent: Friday, August 01, 2003 4:08 AM > To: nanog(a)nanog.org > Subject: abuse case management > > > Is there an abuse case management system as freeware somewhere, something > like all the ticket/case handling packages out there, but more > specifically aimed at abuse/complaint handling. I googled some but couldnt > find any. > > My idea is that it should provide functions to do the following flow: > > Abuse complaint comes in via email, is scanned if it's in a certain > format, if it is, put it directly into the case handling system. > > If not, This email is presented to the handler on a web page. The handler > looks at the email and decides whether the email has enough information in > it to be a complete abuse complaint. > > If NO, press button to send back a form to the one who complained stating > what information is needed and that they can either fill in the email form > and return the email, or go to a web page and fill it in (the link should > go to their original complaint so they can add information). > > If YES, the handler puts complaint IP adress, time and type of complaint > in some web fields and then presses another button to put the complaint > (now categorized) into the case handling system. > > This, coupled to a customer IP database, will enable daily reporting on > top customers who get complained about, bundling of complaints per > customer etc, plus it makes the process of cases without enough > information take 5-10 seconds to handle. > > This is a variation on the telia web way that was complained about a month > back or so, in that it enables the same categorization by a handler in an > efficiant (?) way. > > It was mentioned in the earlier discussion that we should have a > standardized way of reporting abuse via email. Was anything ever done > about this, or should we try to just make a de facto form that might > spread if more ISPs adopt it? Do the spamcop etc people have any > suggestions on how to handle the huge amount of complaints they generate? > > Any suggestions welcome. > > -- > Mikael Abrahamsson email: swmike(a)swm.pp.se > > > ------ End of Forwarded Message > > -------------------------------------------------------------- > <Internal> discussion forum for Wananchi Online Operations Dept. > operations(a)wananchi.com Best regards, Odhiambo Washington Wananchi Online Ltd. ___W_A_N_A_N_C_H_I__O_N_L_I_N_E__L_T_D___The People's Choice______ Wananchi Head Office |*| Tel: +254 2 313 985-9 1st Flr Loita, Loita St.|*| Fax: +254 2 313 922 10286-GPO, NAIROBI, KE |*| e-mail: <wash at wananchi dot com> ------------------------------------------------------------------ ++ Micros~1 : For when quality, reliability and security just aren't that important!

1 0