- NANOG - lists.nanog.org

Re: DNS DOS increasing?
by Steven M. Bellovin 02 Feb '02

02 Feb '02

In message <24810615.1012581411(a)[172.25.106.112]>, Mike Batchelor writes: > >Stop allowing the world to recurse through your authoritative servers. >This invites abuse. > >Provide a separate set of servers for your customers to recurse through, >which serve no authoritative data and which have access restricted to your >own network and your customers'. > >--On Saturday, January 19, 2002 1:59 PM -0500 Matt Martini ><martini(a)invision.net> wrote: > >> >> -----BEGIN PGP SIGNED MESSAGE----- >> >> I've been seeing some strange problems in DNS lately (named 8.2.4-REL) >> where the nameserver stops resolving certain sites. During investigation >> I noticed that my query rate is way up. Many more DNS requests than >> normal are hitting my servers. Is anyone else seeing anything like this? You might be the intermediary in a DNS reflector attack (see http://www.icir.org/vern/papers/reflectors.CCR.01/index.html for details) --Steve Bellovin, http://www.research.att.com/~smb Full text of "Firewalls" book now at http://www.wilyhacker.com

1 0

DNS DOS increasing?
by Matt Martini 02 Feb '02

02 Feb '02

-----BEGIN PGP SIGNED MESSAGE----- I've been seeing some strange problems in DNS lately (named 8.2.4-REL) where the nameserver stops resolving certain sites. During investigation I noticed that my query rate is way up. Many more DNS requests than normal are hitting my servers. Is anyone else seeing anything like this? Matt __________________________ http://www.invision.net/ _______________________ Matthew E. Martini, PE InVision.com, Inc. (631) 543-1000 x104 Chief Technology Officer matt(a)invision.net (631) 864-8896 Fax _______________________________________________________________________pgp_ -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.1i iQEVAwUBPEnCFmtXn16/JS7ZAQHZnAf9HUy+AtG7xOhKoHvPvjtESVdLLtw8ZKto xRkvSvzLIFUep77vi7w/CXQ7RBpoOrHMp1y1WFRMdwaVp4WWGk5qdiqcrtQiAyWn vmzP+VbaW3TT0jdRAdz98O1bW98GCZwLa9WR/xdO0bSQOvtCFuqV0P3XqGmTO0Jl fI7TViUzF6LpOcGGrTKxxj+A7rlOVVjCRozilZsMDKG9QVGZwdSG7/u8K+3U9mIq keyZKGRla1tFbVp4VXEaC6P0zdxh2OHqMTZSdd9nETQEFf9vUjR/ZUfXQfK5l3A9 4GCyAQ3VjhCFdt+xWBww2zh0c0F531eMrFCrrrU4jue4E+0Wuih89g== =+eIJ -----END PGP SIGNATURE-----

4 3

Re: RE: OT: Interesting email I received
by Gregory Hicks 01 Feb '02

01 Feb '02

I may have jumped the gun a bit - although the name is suggestive... It looks like CnS Systems, Inc is a business in NC... Gregory > Date: Fri, 1 Feb 2002 15:15:40 -0800 (PST) > From: Gregory Hicks <ghicks> > > > Date: Fri, 1 Feb 2002 17:37:04 -0500 > > From: John Neiberger <neiby(a)ureach.com> > > > > > > Hmm...I'm still able to reach that site as of 3:30 Mountain > > time. Perhaps his service hasn't been discontinued after all. > > We can only hope, though. Surely Qwest won't continue to let > > this bonehead use their network. > > > > Perhaps this is actually a Qwest front company and they're > > trying to lure people into using their bulkmailing services. > > By doing this they can get a lot of the bulk mails to at least > > have the same set of source IP addresses making them easier to > > filter for the rest of us. :-) Sort of like a honey pot for > > idiots, because in this case they'd even be paying to use it. > > Actually, I don't believe that it *is* a front for quest. One of the > responses I got from whois indicated that the name is owned by > "CnS Systems, Inc" ... > > Can anyone say "Cantor and ..." The people that brought the art of > spam to its current unloved height? > > Regards, > Gregory Hicks > > > > > ---- On Fri, 1 Feb 2002, Joe Blanchard (jblanchard(a)wyse.com) > > wrote: > > > > > I just had to call that number on his web page > > > and ask if it was some sort of joke, The guy > > > there "Paul" didn't have any idea that his > > > services were disrupted, and he even seemed > > > excited at the prospect of doing some Bulk/Spam > > > Email for me. > > > > > > When I mentioned I couldn't get to his webpage > > > He seemed surprised. I ended the convo with > > > "You should really read the TOS with your ISP" <click> > > > > > > hahaha. I would love to hear the conversation between him > > > and Qwest Tech/Support. > > > > > > Cheers! > > > -Joe > ------------------------------------------------------------------- > Gregory Hicks | Principal Systems Engineer > Cadence Design Systems | Direct: 408.576.3609 > 555 River Oaks Pkwy M/S 6B1 | Fax: 408.894.3479 > San Jose, CA 95134 | Internet: ghicks(a)cadence.com > > "The trouble with doing anything right the first time is that nobody > appreciates how difficult it was." > > When a team of dedicated individuals makes a commitment to act as > one... the sky's the limit. > > "There is no limit to what a man can do or how far he can go if he > doesn't mind who gets the credit." - Robert Woodruff > > ------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer Cadence Design Systems | Direct: 408.576.3609 555 River Oaks Pkwy M/S 6B1 | Fax: 408.894.3479 San Jose, CA 95134 | Internet: ghicks(a)cadence.com "The trouble with doing anything right the first time is that nobody appreciates how difficult it was." When a team of dedicated individuals makes a commitment to act as one... the sky's the limit. "There is no limit to what a man can do or how far he can go if he doesn't mind who gets the credit." - Robert Woodruff

1 0

PGP keysigning in Miami!
by bmanning＠karoshi.com 01 Feb '02

01 Feb '02

We will be holding a PGP Key signing party at the NANOG meeting in Miami. We have been scheduled to meet at 22:30 on 11 Feb 2002 in the Trade Room of the conference hotel. The procedure we will use is the following: o People who wish to participate should email an ASCII extract of their PGP public key to <bmanning(a)karoshi.com> by noon on Monday 11 February, 2002. Please include a subject line of "NANOG PGP KEY", and please avoid MIME-encrypting your e-mail. (I will be running the entire mail folder file through PGP, and PGP-keys that are base-64 encoded will get ignored unless I take manual action to fix things. I will try do the manual fixup, but I make no guarantees about catching all of them.) The method of generating the ASCII extract under Unix is: pgp -kxa my_email_address mykey.asc (pgp 2.6.2) pgpk -xa my_email_address > mykey.asc (pgp 5.x) gpg --export -a my_email_address > mykey.asc (gpg) If you're using Windows or Macintosh, hopefully it will be Intuitively Obvious (tm) using the GUI interface how to generate an ASCII armored key that begins "-----BEGIN PGP PUBLIC KEY BLOCK-----". o By 6pm on Monday, you will be able to fetch complete key ring from the following URL with all of the keys that were submitted: http://www.ep.net/nanog23.pgp o At 10:30pm, come prepared with the PGP Key fingerprint of your PGP public key; we will have handouts with all of the key fingerprints of the keys that people have mailed in. o In turn, readers at the front of the room will recite people's keys; as your key fingerprint is read, stand up, and at the end of reading of your PGP key fingerprint, acknowledge that the fingerprint as read was correct. o Later that evening, or perhaps when you get home, you can sign the keys corresponding to the fingerprints which you were able to verify on the handout; note that it is advisable that you only sign keys of people when you have personal knowledge that the person who stood up during the reading of his/her fingerprint really is the person which he/she claimed to be. o Submit the keys you have signed to the PGP keyservers. A good one to use is the one at MIT: simply send mail containing the ascii armored version of your PGP public key to <pgp(a)pgp.mit.edu>. Note that you don't have to have a laptop with you; if you don't have any locally trusted computing resources during the key signing party, you can make notes on the handout, and then take the handout home and sign the keys later. - bill

1 0

OT: Interesting email I received
by Daniel Lark 01 Feb '02

01 Feb '02

Geez... Can they paint a bigger target on themselves? Has anyone else gotten this? -dan -----Original Message----- From: National ISP [mailto:admin@national-isp.org] Sent: Friday, February 01, 2002 3:13 PM To: dlark(a)elmresources.com Subject: Bulk email ISP National ISP Co. is a business class bulk email friendly ISP. We are dedicated to supporting your company with your email advertising program. Have the "Peace of Mind", knowing that you will not be shut down by your present ISP. our website address is >> WWW.NATIONAL-ISP.ORG please call our office for more information and prices. Phone: 336.841.5156 and ask for Paul or Len. ask about our referral program if you wish to be removed from our mailing list please write "remove" on the subject line and return to us.

9 14

Re: RE: OT: Interesting email I received
by John Neiberger 01 Feb '02

01 Feb '02

Hmm...I'm still able to reach that site as of 3:30 Mountain time. Perhaps his service hasn't been discontinued after all. We can only hope, though. Surely Qwest won't continue to let this bonehead use their network. Perhaps this is actually a Qwest front company and they're trying to lure people into using their bulkmailing services. By doing this they can get a lot of the bulk mails to at least have the same set of source IP addresses making them easier to filter for the rest of us. :-) Sort of like a honey pot for idiots, because in this case they'd even be paying to use it. John ________________________________________________ Get your own "800" number Voicemail, fax, email, and a lot more http://www.ureach.com/reg/tag ---- On Fri, 1 Feb 2002, Joe Blanchard (jblanchard(a)wyse.com) wrote: > > I just had to call that number on his web page > and ask if it was some sort of joke, The guy > there "Paul" didn't have any idea that his > services were disrupted, and he even seemed > excited at the prospect of doing some Bulk/Spam > Email for me. > > When I mentioned I couldn't get to his webpage > He seemed surprised. I ended the convo with > "You should really read the TOS with your ISP" <click> > > hahaha. I would love to hear the conversation between him > and Qwest Tech/Support. > > Cheers! > -Joe > > > ---------- > > From: Daniel Lark[SMTP:dlark@elmresources.com] > > Reply To: dlark(a)elmresources.com > > Sent: Friday, February 01, 2002 2:04 PM > > To: 'Christopher A. Woodfield'; 'Dan Hollis' > > Cc: nanog(a)merit.edu > > Subject: RE: OT: Interesting email I received > > > > > > Guess Qwest already yanked 'em. Yay!!! > > > > -dan > > > > traceroute to 65.114.61.35 (65.114.61.35), 30 hops max, 38 byte > packets > > 1 host1.elmresources.com (208.253.213.1) 0.588 ms 0.558 ms 0.474 > ms > > 2 958.Serial1-1.GW6.SCL1.ALTER.NET (157.130.213.173) 10.282 ms > 9.652 > > ms 13.142 ms > > 3 168.at-5-0-0.XR4.SCL1.ALTER.NET (152.63.52.54) 9.691 ms 10.168 > ms > > 9.997 ms > > 4 0.so-1-0-0.XL2.SCL1.ALTER.NET (152.63.55.97) 9.978 ms 10.341 ms > > 9.870 ms > > 5 0.so-6-0-0.XL2.SAC1.ALTER.NET (152.63.54.142) 15.447 ms 16.494 > ms > > 15.253 ms > > 6 0.so-3-0-0.XR2.SAC1.ALTER.NET (152.63.54.2) 14.642 ms 15.195 ms > > 14.934 ms > > 7 184.ATM7-0.BR3.SAC1.ALTER.NET (152.63.50.197) 15.544 ms 14.990 > ms > > 15.905 ms > > 8 sjo-brdr-04.inet.qwest.net (205.171.4.97) 28.136 ms 27.808 ms > > 27.985 ms > > 9 sjo-core-01.inet.qwest.net (205.171.22.118) 29.459 ms 28.163 ms > > 27.818 ms > > 10 sjo-core-02.inet.qwest.net (205.171.22.2) 28.376 ms 27.821 ms > > 28.014 ms > > 11 iah-core-01.inet.qwest.net (205.171.5.145) 68.262 ms 68.128 ms > > 68.277 ms > > 12 iah-core-02.inet.qwest.net (205.171.31.2) 68.851 ms 69.238 ms > > 69.663 ms > > 13 atl-core-02.inet.qwest.net (205.171.5.194) 101.938 ms 103.496 ms > > 101.837 ms > > 14 atl-edge-14.inet.qwest.net (205.171.21.182) 94.106 ms 93.772 ms > > 93.874 ms > > 15 * * * > > -----Original Message----- > > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf > Of > > Christopher A. Woodfield > > Sent: Friday, February 01, 2002 2:56 PM > > To: Dan Hollis > > Cc: Daniel Lark; nanog(a)merit.edu > > Subject: Re: OT: Interesting email I received > > > > > > Given the latency on the last two hops, I'll bet this is a DSL line, > or > > someone's > > taken it upon themselves to render whatever circuit they have > useless... > > > > -C > > > > On Fri, Feb 01, 2002 at 12:43:10PM -0800, Dan Hollis wrote: > > > > > > On Fri, 1 Feb 2002, Daniel Lark wrote: > > > > -----Original Message----- > > > > From: National ISP [mailto:admin@national-isp.org] > > > > Sent: Friday, February 01, 2002 3:13 PM > > > > To: dlark(a)elmresources.com > > > > Subject: Bulk email ISP > > > > National ISP Co. is a business class bulk email friendly ISP. > > > > We are dedicated to supporting your company with your > > > > email advertising program. > > > > Have the "Peace of Mind", knowing that you will not be > > > > shut down by your present ISP. > > > > our website address is >> WWW.NATIONAL-ISP.ORG > > > > > > Tracing the route to NATIONAL-ISP.ORG (65.114.61.35) > > > [...] > > > 15 atl-edge-14.inet.qwest.net (205.171.21.182) [AS 209] 132 msec > 100 > > msec 144 msec > > > 16 208.47.124.58 [AS 209] 388 msec 852 msec 608 msec > > > 17 NATIONAL-ISP.ORG (65.114.61.35) [AS 209] 524 msec 584 msec 268 > > msec > > > > > > Well, qwest *is* bulk-friendly... > > > > > > -Dan > > > -- > > > [-] Omae no subete no kichi wa ore no mono da. [-] > > > > > > > -- > > --------------------------- > > Christopher A. Woodfield rekoil(a)semihuman.com > > > > PGP Public Key: > > http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xB887618B > > > > > > > > <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> > <HTML> > <HEAD> > <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = > charset=3DUS-ASCII"> > <META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version = > 5.5.2653.12"> > <TITLE>RE: OT: Interesting email I received</TITLE> > </HEAD> > <BODY> > > > I just had to call = > that number on his web page > and ask if it was = > some sort of joke, The guy > there = > "Paul" didn't have any idea that his > services were = > disrupted, and he even seemed > excited at the = > prospect of doing some Bulk/Spam > Email for me. = > > > > When I mentioned I = > couldn't get to his webpage > He seemed = > surprised. I ended the convo with > "You should = > really read the TOS with your ISP" <click> > > > hahaha. I would love > = > to hear the conversation between him > and Qwest = > Tech/Support. > > > Cheers! > - Joe > > <UL> > ---------- > From: � = > Daniel = > Lark[SMTP:dlark@elmresources.com] > Reply To: = > �� Serif">dlark(a)elmresources.com > Sent: � = > Friday, February 01, 2002 2:04 = > PM > To: = > �� 'Christopher = > A. Woodfield'; 'Dan Hollis' > Cc: = > �� Serif">nanog(a)merit.edu > Subject: = > �� Serif">RE: OT: Interesting email I received > > > > Guess Qwest already yanked 'em. = > Yay!!! > > > -dan > > > traceroute to 65.114.61.35 = > (65.114.61.35), 30 hops max, 38 byte packets > �1� host1.elmresources.com = > (208.253.213.1)� 0.588 ms� 0.558 ms� 0.474 ms > �2� = > 958.Serial1-1.GW6.SCL1.ALTER.NET (157.130.213.173)� 10.282 = > ms� 9.652 > ms� 13.142 ms > �3� = > 168.at-5-0-0.XR4.SCL1.ALTER.NET (152.63.52.54)� 9.691 ms� = > 10.168 ms > 9.997 ms > �4� = > 0.so-1-0-0.XL2.SCL1.ALTER.NET (152.63.55.97)� 9.978 ms� = > 10.341 ms > 9.870 ms > �5� = > 0.so-6-0-0.XL2.SAC1.ALTER.NET (152.63.54.142)� 15.447 ms� = > 16.494 ms > 15.253 ms > �6� = > 0.so-3-0-0.XR2.SAC1.ALTER.NET (152.63.54.2)� 14.642 ms� = > 15.195 ms > 14.934 ms > �7� = > 184.ATM7-0.BR3.SAC1.ALTER.NET (152.63.50.197)� 15.544 ms� = > 14.990 ms > 15.905 ms > �8� = > sjo-brdr-04.inet.qwest.net (205.171.4.97)� 28.136 ms� 27.808 = > ms > 27.985 ms > �9� = > sjo-core-01.inet.qwest.net (205.171.22.118)� 29.459 ms� = > 28.163 ms > 27.818 ms > 10� sjo-core- 02.inet.qwest.net = > (205.171.22.2)� 28.376 ms� 27.821 ms > 28.014 ms > 11� iah-core- 01.inet.qwest.net = > (205.171.5.145)� 68.262 ms� 68.128 ms > 68.277 ms > 12� iah-core- 02.inet.qwest.net = > (205.171.31.2)� 68.851 ms� 69.238 ms > 69.663 ms > 13� atl-core- 02.inet.qwest.net = > (205.171.5.194)� 101.938 ms� 103.496 ms > 101.837 ms > 14� atl-edge- 14.inet.qwest.net = > (205.171.21.182)� 94.106 ms� 93.772 ms > 93.874 ms > 15� * * * > -----Original Message----- > From: owner-nanog(a)merit.edu = > [<A = > HREF=3D"mailto:owner-nanog@merit.edu">mailto:owner- nanog(a)merit.edu</A></= > FONT>] On Behalf Of > Christopher A. Woodfield > Sent: Friday, February 01, 2002 2:56 = > PM > To: Dan Hollis > Cc: Daniel Lark; = > nanog(a)merit.edu > Subject: Re: OT: Interesting email I = > received > > > > Given the latency on the last two = > hops, I'll bet this is a DSL line, or > someone's > taken it upon themselves to render = > whatever circuit they have useless... > > > -C > > > On Fri, Feb 01, 2002 at 12:43:10PM = > -0800, Dan Hollis wrote: > > > > On Fri, 1 Feb 2002, Daniel Lark = > wrote: > > > -----Original = > Message----- > > > From: National ISP = > [<A = > HREF=3D"mailto:admin@national-isp.org">mailto:admin@national- isp.org</A>= > ] > > > Sent: Friday, February 01, = > 2002 3:13 PM > > > To: = > dlark(a)elmresources.com > > > Subject: Bulk email = > ISP > > > National ISP Co. is a = > business class bulk email friendly ISP. > > > We are dedicated to = > supporting your company with your > > > email advertising = > program. > > > Have the "Peace of = > Mind",� knowing that you will not be > > > shut down by your present = > ISP. > > > our website address = > is� >>� WWW.NATIONAL-ISP.ORG > > > > Tracing the route to = > NATIONAL-ISP.ORG (65.114.61.35) > > [...] > >� 15 = > atl-edge-14.inet.qwest.net (205.171.21.182) [AS 209] 132 msec > 100= > > msec 144 msec > >� 16 208.47.124.58 [AS 209] = > 388 msec 852 msec 608 msec > >� 17 NATIONAL-ISP.ORG = > (65.114.61.35) [AS 209] 524 msec 584 msec 268 > msec > > > > Well, qwest *is* = > bulk-friendly... > > > > -Dan > > -- > > [-] Omae no subete no kichi wa = > ore no mono da. [-] > > > > > -- > --------------------------- > Christopher A. = > Woodfield�� = > �� rekoil(a)semihuman.com > > > PGP Public Key: > <A = > HREF=3D"http://pgp.mit.edu:11371/pks/lookup? op=3Dget&search=3D0xB887618B= > " = > TARGET=3D"_blank">http://pgp.mit.edu:11371/pks/lookup? op=3Dget&search=3D= > 0xB887618B</A> > > > </UL> > </BODY> > </HTML> > >

2 1

RE: OT: Interesting email I received
by Joe Blanchard 01 Feb '02

01 Feb '02

I just had to call that number on his web page and ask if it was some sort of joke, The guy there "Paul" didn't have any idea that his services were disrupted, and he even seemed excited at the prospect of doing some Bulk/Spam Email for me. When I mentioned I couldn't get to his webpage He seemed surprised. I ended the convo with "You should really read the TOS with your ISP" <click> hahaha. I would love to hear the conversation between him and Qwest Tech/Support. Cheers! -Joe > ---------- > From: Daniel Lark[SMTP:dlark@elmresources.com] > Reply To: dlark(a)elmresources.com > Sent: Friday, February 01, 2002 2:04 PM > To: 'Christopher A. Woodfield'; 'Dan Hollis' > Cc: nanog(a)merit.edu > Subject: RE: OT: Interesting email I received > > > Guess Qwest already yanked 'em. Yay!!! > > -dan > > traceroute to 65.114.61.35 (65.114.61.35), 30 hops max, 38 byte packets > 1 host1.elmresources.com (208.253.213.1) 0.588 ms 0.558 ms 0.474 ms > 2 958.Serial1-1.GW6.SCL1.ALTER.NET (157.130.213.173) 10.282 ms 9.652 > ms 13.142 ms > 3 168.at-5-0-0.XR4.SCL1.ALTER.NET (152.63.52.54) 9.691 ms 10.168 ms > 9.997 ms > 4 0.so-1-0-0.XL2.SCL1.ALTER.NET (152.63.55.97) 9.978 ms 10.341 ms > 9.870 ms > 5 0.so-6-0-0.XL2.SAC1.ALTER.NET (152.63.54.142) 15.447 ms 16.494 ms > 15.253 ms > 6 0.so-3-0-0.XR2.SAC1.ALTER.NET (152.63.54.2) 14.642 ms 15.195 ms > 14.934 ms > 7 184.ATM7-0.BR3.SAC1.ALTER.NET (152.63.50.197) 15.544 ms 14.990 ms > 15.905 ms > 8 sjo-brdr-04.inet.qwest.net (205.171.4.97) 28.136 ms 27.808 ms > 27.985 ms > 9 sjo-core-01.inet.qwest.net (205.171.22.118) 29.459 ms 28.163 ms > 27.818 ms > 10 sjo-core-02.inet.qwest.net (205.171.22.2) 28.376 ms 27.821 ms > 28.014 ms > 11 iah-core-01.inet.qwest.net (205.171.5.145) 68.262 ms 68.128 ms > 68.277 ms > 12 iah-core-02.inet.qwest.net (205.171.31.2) 68.851 ms 69.238 ms > 69.663 ms > 13 atl-core-02.inet.qwest.net (205.171.5.194) 101.938 ms 103.496 ms > 101.837 ms > 14 atl-edge-14.inet.qwest.net (205.171.21.182) 94.106 ms 93.772 ms > 93.874 ms > 15 * * * > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of > Christopher A. Woodfield > Sent: Friday, February 01, 2002 2:56 PM > To: Dan Hollis > Cc: Daniel Lark; nanog(a)merit.edu > Subject: Re: OT: Interesting email I received > > > Given the latency on the last two hops, I'll bet this is a DSL line, or > someone's > taken it upon themselves to render whatever circuit they have useless... > > -C > > On Fri, Feb 01, 2002 at 12:43:10PM -0800, Dan Hollis wrote: > > > > On Fri, 1 Feb 2002, Daniel Lark wrote: > > > -----Original Message----- > > > From: National ISP [mailto:admin@national-isp.org] > > > Sent: Friday, February 01, 2002 3:13 PM > > > To: dlark(a)elmresources.com > > > Subject: Bulk email ISP > > > National ISP Co. is a business class bulk email friendly ISP. > > > We are dedicated to supporting your company with your > > > email advertising program. > > > Have the "Peace of Mind", knowing that you will not be > > > shut down by your present ISP. > > > our website address is >> WWW.NATIONAL-ISP.ORG > > > > Tracing the route to NATIONAL-ISP.ORG (65.114.61.35) > > [...] > > 15 atl-edge-14.inet.qwest.net (205.171.21.182) [AS 209] 132 msec 100 > msec 144 msec > > 16 208.47.124.58 [AS 209] 388 msec 852 msec 608 msec > > 17 NATIONAL-ISP.ORG (65.114.61.35) [AS 209] 524 msec 584 msec 268 > msec > > > > Well, qwest *is* bulk-friendly... > > > > -Dan > > -- > > [-] Omae no subete no kichi wa ore no mono da. [-] > > > > -- > --------------------------- > Christopher A. Woodfield rekoil(a)semihuman.com > > PGP Public Key: > http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xB887618B > >

3 2

Re: representativeness of flow data based on samples
by Peter Phaal 01 Feb '02

01 Feb '02

On Wed Jan 30 14:04:40 2002, Joe Abley wrote: >There are a few vendors who now provide traffic export from high-speed >interfaces by sampling those interfaces at a particular rate, and >using the sampled packets to populate the per-flow counters, rather >than looking at every packet. >Does anybody here know of recent research with real internet traffic >which compares different sample rates wrt the representativeness of >the resulting flow data? On Wed Jan 30 23:50:11 2002, Fred True replied: | You might find this related talk useful: | http://www.research.att.com/~duffield/pubs/usage-imw2001.pdf While the Duffield talk mentions packet sampling, it is primarily concerned with sampling flow records in order to reduce the post-processing overhead (i.e. it addresses the accuracy of sampling exported netflow records, rather than the accuracy of netflow records generated using packet sampling). Here are a few references that address the issue of packet sampling accuracy: http://www.inmon.com/PDF/sFlowBilling.pdf http://www.hpl.hp.com/techreports/92/HPL-92-35.html http://www.caida.org/outreach/papers/1993/asmw/ I don't know of any other published studies. However, I have been involved in a number of unpublished tests in which sampling was demonstrated to produce valid results with sufficient accuracy (provided that suitable sampling rates and aggregation periods are selected). Peter

1 0

RE: Re[2]: OT: Interesting email I received
by Joe Blanchard 01 Feb '02

01 Feb '02

Of course, perhaps its a way for Qwest to increase revenue. As follows from Qwest's TOS page, section 3 http://www.qwest.net/nav4/acct_tools/con/account.html Among other things, the AUP prohibits sending unsolicited e-mail messages including bulk commercial advertising or informational announcements ("Spam") and Qwest will immediately terminate any account which it believes, in its sole discretion, is transmitting or is otherwise connected with any Spam. In addition, because damages are often difficult to quantify, if actual damages cannot be reasonably calculated then you agree to pay Qwest liquidated damages of five dollars ($5.00) for each piece of spam or unsolicited bulk e-mail transmitted from or otherwise connected with your account, otherwise you agree to pay Qwest's actual damages, to the extent such actual damages can be reasonably calculated. 5 Bucks a pop, and if your sending 1000's of em lol Cheers -Joe > ---------- > From: Daniel Lark[SMTP:dlark@elmresources.com] > Reply To: dlark(a)elmresources.com > Sent: Friday, February 01, 2002 1:51 PM > To: 'Christopher Schulte'; 'Richard Welty'; nanog(a)merit.edu > Subject: RE: Re[2]: OT: Interesting email I received > > > Looks like SPAMHAUS has 'em. RBL and MAPS have 'em too. > > I just love it when all come together as a community ;-). > > -dan > >

1 0

RE: OT: Interesting email I received
by Joe Blanchard 01 Feb '02

01 Feb '02

I'm wondering if the originator of the email was "trying" to set QWest/National up by sending this email out, that is, someone simply spammed it in hopes National-isp got the boot/warning from their peer for violating TOS. Do the headers indicate its origin? Just my 2¢s -Joe > ---------- > From: Daniel Lark[SMTP:dlark@elmresources.com] > Reply To: dlark(a)elmresources.com > Sent: Friday, February 01, 2002 12:56 PM > To: 'mike harrison'; 'Dan Hollis' > Cc: nanog(a)merit.edu > Subject: RE: OT: Interesting email I received > > > Oh they're definitely off of qwest: > > Registrant: > CnS Systems, Inc. (NATIONALISP11-DOM) > 4304 Hunter Oaks Dr. > High Point, NC 27265 > US > > Domain Name: NATIONAL-ISP.ORG > >

2 1