- NANOG - lists.nanog.org

InterNIC "whois server <handle>" broke?
by Jeffrey Haas 22 Dec '98

22 Dec '98

Has anyone else noted that "whois server <handle>" no longer seems to be working at the InterNIC? -- Jeffrey Haas "Denial of Spamming is not a crime." elezar(a)pfrc.org -- Russell Nelson <nelson(a)crynwr.com>

7 15

ARIN & re-using some /24s
by Daniel.MacKay＠Dal.Ca 22 Dec '98

22 Dec '98

Howdy. I have a number of portable /24s which had been deployed in the early days of the Internet to customers who do not use 'em any more. Of course we're supposed to turn in unused /24s and ask our transport providers for whatever space we need, but for a variety of reasons I'd like to re-use these blocks, and I'd sort of like the ARIN info to be correct on them -- not indicating they're in use by a company that went out of business years ago for instance. The last time I tried this, I got so much flack from ARIN that I gave up and left the block registered to the wrong organization, but persistence does usually pay off with them. If you have had any experience re-registering blocks to totally different organizations, that is, changing -all- of the info associated with a net block, I'd like to hear from you- experiences and the procedure you followed. Please reply directly. I'll summarize and post here next week. -- Daniel.MacKay(a)Dal.Ca Network Operations Centre Manager 902 494-danm Dalhousie University, Halifax, Nova Scotia, Canada.

1 0

Re: ** Forged spamming going on
by George Herbert 22 Dec '98

22 Dec '98

Dean, it's this simple: AOL is not *sending* the mail. They are not *relaying* the mail. They don't qualify as a RBLable party because of that, in this incident. The proper description for "they're bouncing it back to me because the headers were forged to say it came from me but it didn't, and they're just the site where the targeted customers reside" is neither "sender" nor "relayer", nor generally considered an abusing party in a spam situation though it may cause some third-party forgery victim some pain. This seems perfectly obvious to me. It should be perfectly obvious to anyone who understands net mail and has read the RBL website. Why are you going on and on about it? -george william herbert gherbert(a)crl.com I speak for myself only.

2 1

SPAM from NetScape and AOL
by John M. Brown 22 Dec '98

22 Dec '98

Gotta love those NetScape NetCenter people. When I register with some site I use an Email address that tells me if they send me junk and where it came from. I know that I explicatly click DON"T SENT ME ANYTHING buttons. Looks like NetCenter just got a mailing list from AOL and there AOL Chat app. Thanks AOL for violating my privacy request, Thanks NetScape for sending me SPAM. If anyone wants the headers I'll forward them. AOL and Netscape are hereby BLOCKED. jmbrown

1 0

Re: ** Forged spamming going on
by Robert Tarrall 22 Dec '98

22 Dec '98

alex(a)nac.net wrote: -> some luser off of AT&T DIalup is using mailme.com (my domain) for relaying -> mail: -> Received: from mailme.com (146.st-louis-71-72rs.mo.dial-access.att.net -> [...] -> He is sending thousands of emails to AOL users, who is then bouncing them -> to me. -> [...] -> Thinking about this, there is no solution; here are my options: -> -> 1) blackhole AT&T, which does nothing, since the mail is bounces coming -> from AOL. -> -> 2) blackhole AOL, which would fix my attack, but would break all -> legitimate mail from/to AOL. -> -> 3) temporarily blackhole mailme.com, which would prevent me from getting -> the bounces, but then I can't send/get legit mail. You forgot: 4) Deny relaying, which sendmail 8.9.1a will do by default (has worked great for us so far), and 5) Deny access to dial-access.att.net (and dialsprint.net, da.uu.net, pub-ip.psi.net, etc) which is what we're doing here just because we get so much spam directly from such dialup accounts these days. Anyone have a list of legitimate outgoing SMTP servers for the big dialup companies (UUnet, PSI, Concentric, AT&T, Sprint, etc)? So far I haven't had any complaints about blocking stuff like da.uu.net, but I'd like to make sure that legitimate email can still get through. -Robert Tarrall.- System/Network Admin E Central

5 4

Re: ** Forged spamming going on
by Dean Anderson 22 Dec '98

22 Dec '98

At 11:29 AM 12/21/1998 -0800, Paul Vixie wrote: >"Won't" in this context has to mean "makes no effort". AOL makes an effort. >Several of AOL's mail relays were blackholed in the first six months of the >MAPS RBL project, but AOL has been a model network citizen since then. So basically, if they sign up to use the RBL, then you won't blackhole them? But doesn't NetSol use the RBL? Why should they be threatened with Blackholing then? --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 1

AT&T crap performance!
by Chris Cappuccio 22 Dec '98

22 Dec '98

Hey, I've been using AT&T's network for a while now, and I have a lot of very poor performance issues like this for a long time. The easy answer would be to trash AT&T but we've got a contract with them that hasn't expired yet. Since these are network related issues, I'm wondering if anyone on NANOG has a clue as to what is going on/the best people to approach. I've been calling folks at AT&T for several months to get answers that amount to "we are upgrading this link to an OC3" and even after the upgrade, the performace still sucks. dqc:chris {107} traceroute lycaeum.org traceroute to lycaeum.org (207.66.171.40), 64 hops max, 40 byte packets 1 enet-IP4-de1-gw.bend2.EmpireNet.net (12.7.103.1) 0.440 ms 0.759 ms 0.375 ms 2 fe0-0.c7206.EmpireNet.net (12.7.96.1) 1.169 ms 1.71 ms 1.13 ms 3 12.127.193.109 (12.127.193.109) 18.43 ms 17.241 ms 21.98 ms 4 gr1-a3100s3.sffca.ip.att.net (192.205.35.1) 21.828 ms 32.112 ms 23.714 ms 5 att-gw.sf.cw.net (192.205.31.78) 473.411 ms 464.849 ms 494.304 ms 6 bordercore2.Seattle.cw.net (166.48.208.1) 482.713 ms 501.263 ms 511.764 ms 7 semaphore-corporation.Seattle.cw.net (166.48.208.6) 361.175 ms 368.1 ms 381.595 ms 8 fe0-0-0.sea2.semaphore.net (209.221.128.2) 383.171 ms 380.497 ms 447.556 ms 9 wolfe-gw-n-E12-3.semaphore.net (207.17.119.21) 677.106 ms 592.674 ms * 10 fci-sea-cr0-fa-0-0-0.flyingcroc.com (204.157.111.18) 573.205 ms 490.200 ms 454.482 ms 11 shaman.lycaeum.org (207.66.171.40) 493.69 ms 487.742 ms 487.732 ms lycaeum{101}% traceroute dqc.org traceroute to dqc.org (12.7.119.10), 30 hops max, 40 byte packets 1 * fci-sea-cr0.flyingcroc.com (204.157.104.1) 1.823 ms 0.986 ms 2 204.157.111.17 (204.157.111.17) 1.723 ms 1.649 ms 1.172 ms 3 wolfe-gw-f-E12-3.semaphore.net (207.17.119.22) 1.818 ms 2.196 ms 8.317 ms 4 903.Hssi5-0.GW1.SEA1.ALTER.NET (137.39.136.21) 8.787 ms 2.265 ms 1.847 ms 5 103.ATM3-0.XR1.SEA1.ALTER.NET (146.188.200.42) 2.692 ms 6.655 ms 5.883 ms 6 295.ATM2-0.TR1.SEA1.ALTER.NET (146.188.200.106) 2.518 ms 2.821 ms 2.922 ms 7 110.ATM7-0.TR1.CHI4.ALTER.NET (146.188.136.165) 50.112 ms 53.411 ms 48.689 ms 8 299.ATM7-0.XR1.CHI4.ALTER.NET (146.188.208.221) 46.940 ms 52.094 ms 47.992 ms 9 195.ATM8-0-0.BR1.CHI1.ALTER.NET (146.188.208.1) 47.254 ms 47.534 ms 48.252 ms 10 137.39.23.50 (137.39.23.50) 50.224 ms 49.393 ms 50.897 ms 11 gr1-a340s1.cgcil.ip.att.net (192.205.31.113) 74.123 ms 68.746 ms 94.304 ms 12 br2-a350s3.cgcil.ip.att.net (192.205.31.106) 1019.882 ms 977.420 ms 958.934 ms 13 br1-h31.sffca.ip.att.net (12.127.14.110) 292.712 ms 91.461 ms 79.426 ms 14 ar1-a300s1.sffca.ip.att.net (12.127.1.133) 322.673 ms 417.481 ms 385.498 ms 15 12.127.193.102 (12.127.193.102) 367.061 ms 374.838 ms * 16 lightwave-2-GW1.bend1.EmpireNet.net (12.7.96.4) 422.924 ms 420.412 ms 419.702 ms 17 dqc.org (12.7.119.10) 461.522 ms 465.937 ms 452.014 ms -- Keep Cool, but Don't Freeze - Hellman's Mayonnaise

2 1

Re: ** Forged spamming going on
by Dean Anderson 21 Dec '98

21 Dec '98

At 02:13 PM 12/21/1998 -0500, Steven J. Sobol wrote: >The domain was flowers.com, the ISP was Zilker Internet Park in Texas, and >the judge found for the plaintiff. Yeah, right. The "judge" was a county magistrate who found the (california) spammer guilty of "creating a nuiscance" in that county in Texas. (If the spammer had bothered, they would have likely demonstrated that a Texas County Magistrate has no jurisdiction in California) The spammer didn't show, and Zilker won by default. In legal terms, this means the case cannot be used as "case law" or as a precedent in other cases. In laymans terms, it means that the case has no legal usefulness. It didn't prove anything, and I don't think even now, a couple years later, that Zilker ever collected anything, or ever will. If a spammer can be sued for relaying, this particular case does not demonstrate how to do it. Nor should it be used as an example where a spammer was sued for money and lost. This does not mean there is no recourse against relaying. Just that this particular approach isn't it. This was a BS example a year and a half ago, when I pointed out its flaws to you. Yet you keep using it even though you know its BS. The "Just keep spewing" strategy seems to place limits your credibility. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 1

Re: ** Forged spamming going on
by Dean Anderson 21 Dec '98

21 Dec '98

At 02:16 PM 12/21/1998 -0500, Steven J. Sobol wrote: >On Mon, Dec 21, 1998 at 12:38:01PM -0500, Dean Anderson wrote: > >> Actually, I think this might qualify AOL for the RBL, since they are >> sending unsolicited mail and won't stop. Thats supposed to be the only >> qualifier, right? > >I'm going to assume you're kidding... No. It is the only qualification. They do meet the qualification. I'm asking for them to be added since they meet the requirements as specified for Network Solutions. I don't seriously expect that they will added. I expect that the requirements for the RBL will change instead. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 1

** Forged spamming going on
by alex＠nac.net 21 Dec '98

21 Dec '98

some luser off of AT&T DIalup is using mailme.com (my domain) for relaying mail: Received: from mailme.com (146.st-louis-71-72rs.mo.dial-access.att.net [12.75.28.146]) by atom.ntgi.net (8.8.8/8.8.7) with SMTP id XAA23473; Sat, 19 Dec 1998 23:27:18 -0500 (EST) (envelope-from You4Me2C(a)mailme.com) He is sending thousands of emails to AOL users, who is then bouncing them to me. I am not please, to say the least. AT&T's security dept is non-existent, as far as I am concerned. I wish vixie would RBL 12/8. Thinking about this, there is no solution; here are my options: 1) blackhole AT&T, which does nothing, since the mail is bounces coming from AOL. 2) blackhole AOL, which would fix my attack, but would break all legitimate mail from/to AOL. 3) temporarily blackhole mailme.com, which would prevent me from getting the bounces, but then I can't send/get legit mail. I wish AT&T and other huge dialup organizations could control the users they have; there should be a licensing process.. -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- Atheism is a non-prophet organization. I route, therefore I am. Alex Rubenstein, alex(a)nac.net, KC2BUO, ISP/C Charter Member Father of the Network and Head Bottle-Washer Net Access Corporation, 9 Mt. Pleasant Tpk., Denville, NJ 07834 Don't choose a spineless ISP; we have more backbone! http://www.nac.net -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --

4 3