- NANOG - lists.nanog.org

Re: Crazy flying netbios packets
by crh＠ubiqx.mn.org 01 Oct '98

01 Oct '98

I'm not on this list, but a friend pointed me at the thread and I wanted to add my 2cents. Hope you don't mind. : There is a very popular WWW log analysis program by the name of : WebTrends. It is run on a Win32 platform and when processing : GIGs of www access-logs, it will uni-cast for WINS resolution to : every foreign IP if finds for WINS name resolution, fail, : and then use DNS for resolution. : : My fear (uneducated on the matter) is that it is not WebTrends but : Microsoft's gethostbyaddr() call which would mean that this type of : crazy 137/udp WINS resolution traffic is more commonly mis-used than : we think. It's not actually WINS that you're dealing with here. WINS is Microsoft's name for their NetBIOS Name Server (RFC1001, 1002). WebTrends cannot know the address of the WINS server, if any, that the assumed Windows PC used so it would have to send the query directly to the IP in the log. Urq. If the PC was on a dial-up or other dynamic IP address, then any reply will most certainly be wrong. Also, what you'd get back is a set of NetBIOS names. This is almost completely useless unless you share the same WINS server or are within the same broadcast domain. The suggestion that this totally nasty behavior is SOP for Microsoft's gethostbyaddr() is disturbing. In my experience, the folks in Redmond don't clearly understand the difference between a NetBIOS name and a DNS name. Chris Hertel Samba Team -- "I'm thirty-seven. I'm not old." -----(- Christopher R. Hertel -- Dennis the Peasant to King Arthur, 787 AD -)----- crh(a)ubiqx.mn.org

1 0

Re: Is the .to (Tonga) domain completely rogue and should be removed?
by Adam D. McKenna 01 Oct '98

01 Oct '98

Apparently you've never seen www.nunames.nu? It made quite a lot of news when it came out. This has been going on for quite a while, it's odd that you should bring it up now. You might also want to check out http://www.nic.cc. I'm sure a host of others will be springing up in no time. BTW I happen to think those .to forwarder domains are ultra cool, I found http://easy.to/remember the other day and I thought it was an exteremely good idea... --Adam adam(a)flounder.net adam(a)mckenna.to?? (I was thinking about it.. .nu is cheaper though :) -----Original Message----- From: Barry Shein <bzs(a)world.std.com> To: Andy Walden <andy(a)enigma.mtco.com> Cc: nanog(a)merit.edu <nanog(a)merit.edu> Date: Thursday, October 01, 1998 3:25 AM Subject: Re: Is the .to (Tonga) domain completely rogue and should be removed? On September 30, 1998 at 15:14 andy(a)enigma.mtco.com (Andy Walden) wrote: > > > I have a legit .to domain. I paid $100 for it like any .com domain, > which of course has no porn sites. > > or something... By "legit" do you mean its purpose is to operate a business or other entity organized within the Kingdom of Tonga? -- -Barry Shein Software Tool & Die | bzs(a)world.std.com | http://www.world.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo*

1 0

Multi-Homed Swamp Space (was: Your class 'B' address space)
by William Allen Simpson 01 Oct '98

01 Oct '98

Catching up on NANOG, I could not resist responding here: > Date: Tue, 29 Sep 1998 10:08:34 -0700 (PDT) > From: Michael Dillon <michael(a)memra.com> > If the registries would start allocating address space that has been > recovered from the swamp to this sort of company, then the problem would > be solved. If a company needs multihoming capability but will never use > more than a /23 then what is wrong with reusing swamp space? > I just tried 2 weeks ago to reuse one of my own old swamp blocks (192.138.173.0) that had been out of production for a number of years. Upstreams are MCI and eSpire. Got it in the RR via MCI. Seems to have propagated into many other nets by the following day. But for some odd reason, SprintLink had problems and AOL never worked. After calling them, SprintLink began to route it, but it went away again the next morning. Access to AOL servers from dial-in equipment in that /24 block never completed a TCP handshake, despite that a traceroute seems to work (although it's hard to tell, as the AOL servers didn't respond on the last hop). After a few days, had to move into another MCI /24 block. Customers seem to want to talk to AOL, and vice versa.... :-( Anyway, looks like using swamp space for multi-homed nets and servers doesn't work. Too much hand configuration. WSimpson(a)UMich.edu Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32

1 0

Re: Is the .to (Tonga) domain completely rogue and should be removed?
by Dean Anderson 01 Oct '98

01 Oct '98

At 03:08 PM 9/30/98 -0500, Sam Hayes Merritt, III wrote: >On Wed, 30 Sep 1998, Barry Shein wrote: > >> We've been having increasing problems with one or more porn sites in >> the .to domain promoting itself by massive spamming of AOL customers >> using one of our domains in their From: header thus causing both >> complaints to us and thousands of bounces from AOL due to bad AOL >> addresses in their spam lists. About a year ago, I asked Vixie if he would RBL porn sites. I might have supported the RBL if there were a moral high ground. He said no. --Dean P.S. Barry, I do feel sorry for you. Perhaps you should just refuse spam complaints, and try to get them to stop using your domains. Instead of stealing a domain, all the spammers need to do is change their addresses to uucp style addresses, and their mail will likely be accepted, and bounces shouldn't leave the system. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 1

Re: Is the .to (Tonga) domain completely rogue and should be removed?
by Steven J. Sobol 01 Oct '98

01 Oct '98

[ In reply to a private message from Jeremy Porter. ] > Maybe you should post a clarification that you do not feel RBL is > the same a terriorism. That is certainly the appearance you gave. > In all the messages in the thread posted to nanog my was the only > replace that suggested solutions, and it was on topic. Done. Yes, when I mentioned the T-word, I was not refering to the RBL. The RBL is voluntary and allows people to deny others access to THEIR OWN machines. It has nothing to do with people trying to deny others access to machines the perpetrators do NOT own - that is what I take issue with. > Your accusations of terrorism, stupidity and your pity are not > needed on Nanog, perhaps on other mailing lists such comments are > reasonable. I see absolutely no call for you to be advocating denial of service attacks anywhere - and ESPECIALLY not on NANOG, where everyone *knows better anyhow*. The knife cuts both ways. I hope no one using an nstc.com account, or an account at my upstream, ever even comes close to getting you upset because it sounds like in a situation like that, you would advocate a DoS attack against the network involved. I'm sorry, but I am not retracting my statement that that IS terrorism, and there is absolutely no call for it, and if you commit a DoS attack you deserve whatever sanctions you get hit with, either by your upstream or the law. Period. -- Anyone who spams me will be subject to torture by Jake, my killer attack hedgehog, and/or Lizzy and Junior, my man-eating iguanas.

2 2

Re: Is the .to (Tonga) domain completely rogue and should be removed?
by Dean Anderson 01 Oct '98

01 Oct '98

>The simple question here is: who are you to tell a sovereign country what >it can and what it cannot do? hahhahshhahahhaha!! Well put. Anti-spammers make up whatever laws or exemptions to laws they have to. Thats all they need. Thats why they can't be trusted. Fire your anti-spammers before they do something you'll regret... Anyway, I'm laughing too hard (rolling in my chair, knocked the keyboard on the floor) to contribute anything more without endangering safety or equipment... --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 0

InterNIC modification
by william＠pacific.net.ph 01 Oct '98

01 Oct '98

Hi all! Is it Internic becoming slower in their modifications? We have sent a modification request twice and until now - nothing has happened.... William ---------- Forwarded message ---------- Date: Thu, 24 Sep 1998 20:24:48 -0400 (EDT) From: Domain Registration Role Account <domreg(a)internic.net> To: armand(a)shell.egis.net Subject: Re: [NIC-980924.46494] Re: MODIFY DOMAIN dwrt.com Your request NIC-980924.46494 for [NIC-980924.46494] Re: MODIFY DOMAIN dwrt.com. could not be automatically processed. The request has been queued for manual processing. It will be processed within 5 business days. InterNIC Registration Services email hostmaster(a)internic.net voice (703) 742-4777 ============================================================ >From armand(a)shell.egis.net Thu Sep 24 16:48:22 1998 >Received: from opsmail.internic.net (opsmail.internic.net [198.41.0.91]) > by mail-hub.internic.net (8.9.1/8.9.1) with ESMTP id QAA04873 > for <hostmaster(a)mail-hub.internic.net>; Thu, 24 Sep 1998 16:48:21 -0400 (EDT) >Received: from biprrs3.lb (biprrs3.lb.internic.net [192.168.120.41]) > by opsmail.internic.net (8.9.1/8.9.1) with SMTP id QAA16745 > for <hostmaster(a)internic.net>; Thu, 24 Sep 1998 16:47:54 -0400 (EDT) >Received: (qmail 23915 invoked from network); 24 Sep 1998 05:58:06 -0000 >Received: from unknown (HELO shell.egis.net) (202.163.235.6) > by 192.168.119.41 with SMTP; 24 Sep 1998 05:58:06 -0000 >Received: by shell.egis.net (Smail3.1.29.1 #57) > id m0zMFSJ-001SlLC; Thu, 24 Sep 98 13:45 EDT >Date: Thu, 24 Sep 1998 13:45:27 -0400 (EDT) >From: Armand Hernandez <armand(a)shell.egis.net> >To: hostmaster(a)internic.net >Subject: [NIC-980924.46494] Re: MODIFY DOMAIN dwrt.com >In-Reply-To: <199809240552.BAA17662(a)rrs2.lb.internic.net> >Message-ID: <Pine.LNX.3.90.980924134523.9387A-100000(a)shell.egis.net> >MIME-Version: 1.0 >Content-Type: TEXT/PLAIN; charset=US-ASCII >X-MTS-Ticket: 980924.46494 >X-MTS-Type: Domain >X-MTS-Mode: Modify >X-MTS-Priority: Normal >X-MTS-Status: Open >X-MTS-Timestamp: 980924164822 > > > > >On Thu, 24 Sep 1998 hostmaster(a)internic.net wrote: > >> ---------------------------------------------------- >> This is the Domain Name Registration Agreement you >> recently created. >> In order to complete this modification, >> >> YOU MUST E-MAIL THIS FORM TO: hostmaster(a)internic.net >> >> After you e-mail this form, you should receive an auto-reply >> with a tracking number. You must use that number in the >> Subject of any future messages you send regarding >> this registration action. >> Once this registration action is completed you will receive >> a notification via e-mail. >> >> [ URL http://rs.internic.net/cgi-bin/domain ] [ 03/98 ] >> [ URL ftp://rs.internic.net/templates/domain-template.txt ] [ 03/98 ] >> >> ******* Please DO NOT REMOVE Version Number or Sections A-Q ******** >> >> Domain Version Number: 4.0 >> >> ******* Email completed agreement to hostmaster(a)internic.net ******* >> >> NETWORK SOLUTIONS, INC. >> >> DOMAIN NAME REGISTRATION AGREEMENT >> >> >> A. Introduction. This domain name registration agreement >> ("Registration Agreement") is submitted to NETWORK SOLUTIONS, INC. >> ("NSI") for the purpose of applying for and registering a domain name >> on the Internet. If this Registration Agreement is accepted by NSI, >> and a domain name is registered in NSI's domain name database and >> assigned to the Registrant, Registrant ("Registrant") agrees to be >> bound by the terms of this Registration Agreement and the terms of >> NSI's Domain Name Dispute Policy ("Dispute Policy") which is >> incorporated herein by reference and made a part of this Registration >> Agreement. This Registration Agreement shall be accepted at the >> offices of NSI. >> >> B. Fees and Payments. >> >> 1) Registration or renewal (re-registration) date through March 31, 1998: >> Registrant agrees to pay a registration fee of One Hundred United States >> Dollars (US) as consideration for the registration of each new domain >> name or Fifty United States Dollars (US) to renew (re-register) an >> existing registration. >> 2) Registration or renewal date on and after April 1, 1998: Registrant >> agrees to pay a registration fee of Seventy United States Dollars (US) >> as consideration for the registration of each new domain name or the >> applicable renewal (re-registration) fee (currently Thirty-Five United >> States Dollars (US)) at the time of renewal (re-registration). >> 3) Period of Service: The non-refundable fee covers a period of two (2) >> years for each new registration, and one (1) year for each renewal, >> and includes any permitted modification(s) to the domain name record >> during the covered period. >> 4) Payment: Payment is due to Network Solutions within thirty (30) >> days from the date of the invoice. >> >> C. Dispute Policy. Registrant agrees, as a condition to >> submitting this Registration Agreement, and if the Registration >> Agreement is accepted by NSI, that the Registrant shall be bound by >> NSI's current Dispute Policy. The current version of the Dispute >> Policy may be found at the InterNIC Registration Services web site: >> "http://www.netsol.com/rs/dispute-policy.html". >> >> D. Dispute Policy Changes or Modifications. Registrant agrees >> that NSI, in its sole discretion, may change or modify the Dispute >> Policy, incorporated by reference herein, at any time. Registrant >> agrees that Registrant's maintaining the registration of a domain name >> after changes or modifications to the Dispute Policy become effective >> constitutes Registrant's continued acceptance of these changes or >> modifications. Registrant agrees that if Registrant considers any such >> changes or modifications to be unacceptable, Registrant may request >> that the domain name be deleted from the domain name database. >> >> E. Disputes. Registrant agrees that, if the registration of its >> domain name is challenged by any third party, the Registrant will be >> subject to the provisions specified in the Dispute Policy. >> >> F. Agents. Registrant agrees that if this Registration Agreement >> is completed by an agent for the Registrant, such as an ISP or >> Administrative Contact/Agent, the Registrant is nonetheless bound as a >> principal by all terms and conditions herein, including the Dispute >> Policy. >> >> G. Limitation of Liability. Registrant agrees that NSI shall have >> no liability to the Registrant for any loss Registrant may incur in >> connection with NSI's processing of this Registration Agreement, in >> connection with NSI's processing of any authorized modification to the >> domain name's record during the covered period, as a result of the >> Registrant's ISP's failure to pay either the initial registration fee >> or renewal fee, or as a result of the application of the provisions of >> the Dispute Policy. Registrant agrees that in no event shall the >> maximum liability of NSI under this Agreement for any matter exceed >> Five Hundred United States Dollars (US). >> >> H. Indemnity. Registrant agrees, in the event the Registration >> Agreement is accepted by NSI and a subsequent dispute arises with any >> third party, to indemnify and hold NSI harmless pursuant to the terms >> and conditions contained in the Dispute Policy. >> >> I. Breach. Registrant agrees that failure to abide by any >> provision of this Registration Agreement or the Dispute Policy may be >> considered by NSI to be a material breach and that NSI may provide a >> written notice, describing the breach, to the Registrant. If, within >> thirty (30) days of the date of mailing such notice, the Registrant >> fails to provide evidence, which is reasonably satisfactory to NSI, >> that it has not breached its obligations, then NSI may delete >> Registrant's registration of the domain name. Any such breach by a >> Registrant shall not be deemed to be excused simply because NSI did >> not act earlier in response to that, or any other, breach by the >> Registrant. >> >> J. No Guaranty. Registrant agrees that, by registration of a >> domain name, such registration does not confer immunity from objection >> to either the registration or use of the domain name. >> >> K. Warranty. Registrant warrants by submitting this Registration >> Agreement that, to the best of Registrant's knowledge and belief, the >> information submitted herein is true and correct, and that any future >> changes to this information will be provided to NSI in a timely manner >> according to the domain name modification procedures in place at that >> time. Breach of this warranty will constitute a material breach. >> >> L. Revocation. Registrant agrees that NSI may delete a >> Registrant's domain name if this Registration Agreement, or subsequent >> modification(s) thereto, contains false or misleading information, or >> conceals or omits any information NSI would likely consider material >> to its decision to approve this Registration Agreement. >> >> M. Right of Refusal. NSI, in its sole discretion, reserves the >> right to refuse to approve the Registration Agreement for any >> Registrant. Registrant agrees that the submission of this Registration >> Agreement does not obligate NSI to accept this Registration Agreement. >> Registrant agrees that NSI shall not be liable for loss or damages >> that may result from NSI's refusal to accept this Registration >> Agreement. >> >> N. Severability. Registrant agrees that the terms of this >> Registration Agreement are severable. If any term or provision is >> declared invalid, it shall not affect the remaining terms or >> provisions which shall continue to be binding. >> >> O. Entirety. Registrant agrees that this Registration Agreement >> and the Dispute Policy is the complete and exclusive agreement between >> Registrant and NSI regarding the registration of Registrant's domain >> name. This Registration Agreement and the Dispute Policy supersede all >> prior agreements and understandings, whether established by custom, >> practice, policy, or precedent. >> >> P. Governing Law. Registrant agrees that this Registration >> Agreement shall be governed in all respects by and construed in >> accordance with the laws of the Commonwealth of Virginia, United >> States of America. By submitting this Registration Agreement, >> Registrant consents to the exclusive jurisdiction and venue of the >> United States District Court for the Eastern District of Virginia, >> Alexandria Division. If there is no jurisdiction in the United States >> District Court for the Eastern District of Virginia, Alexandria >> Division, then jurisdiction shall be in the Circuit Court of Fairfax >> County, Fairfax, Virginia. >> >> Q. This is Domain Name Registration Agreement Version >> Number 4.0. This Registration Agreement is only for registrations >> under top-level domains: COM, ORG, NET, and EDU. By completing >> and submitting this Registration Agreement for consideration and >> acceptance by NSI, the Registrant agrees that he/she has read and >> agrees to be bound by A through P above. >> >> Authorization >> 0a. (N)ew (M)odify (D)elete.........: M >> 0b. Auth Scheme.....................: >> 0c. Auth Info.......................: >> >> 1. Comments........................: >> >> 2. Complete Domain Name............: dwrt.com >> >> Organization Using Domain Name >> 3a. Organization Name................: 99.5 RT >> 3b. Street Address..................: 14/F JAKA (Royal Match) Bldg., 6780 Ayala Avenue >> 3c. City............................: Makati >> 3d. State...........................: MM >> 3e. Postal Code.....................: 1200 >> 3f. Country.........................: PH >> >> Administrative Contact >> 4a. NIC Handle (if known)...........: JRL17 >> 4b. (I)ndividual (R)ole?............: Individual >> 4c. Name (Last, First)..............: >> 4d. Organization Name...............: >> 4e. Street Address..................: >> 4f. City............................: >> 4g. State...........................: >> 4h. Postal Code.....................: >> 4i. Country.........................: >> 4j. Phone Number....................: >> 4k. Fax Number......................: >> 4l. E-Mailbox.......................: >> >> Technical Contact >> 5a. NIC Handle (if known)...........: JRL17 >> 5b. (I)ndividual (R)ole?............: Individual >> 5c. Name(Last, First)...............: >> 5d. Organization Name...............: >> 5e. Street Address..................: >> 5f. City............................: >> 5g. State...........................: >> 5h. Postal Code.....................: >> 5i. Country.........................: >> 5j. Phone Number....................: >> 5k. Fax Number......................: >> 5l. E-Mailbox.......................: >> >> Billing Contact >> 6a. NIC Handle (if known)...........: JRL17 >> 6b. (I)ndividual (R)ole?............: Individual >> 6c. Name (Last, First)..............: >> 6d. Organization Name...............: >> 6e. Street Address..................: >> 6f. City............................: >> 6g. State...........................: >> 6h. Postal Code.....................: >> 6i. Country.........................: >> 6j. Phone Number....................: >> 6k. Fax Number......................: >> 6l. E-Mailbox.......................: >> >> Prime Name Server >> 7a. Primary Server Hostname.........: NS1.PACIFIC.NET.PH >> 7b. Primary Server Netaddress.......: 210.23.234.33 >> >> Secondary Name Server(s) >> 8a. Secondary Server Hostname.......: NS2.PACIFIC.NET.PH >> 8b. Secondary Server Netaddress.....: 210.23.234.65 >> >> >> END OF AGREEMENT >> >> >> For instructions, please refer to: >> "http://rs.internic.net/help/instructions.txt" >> >>

7 9

.cc domain spam
by Jon Lewis 30 Sep '98

30 Sep '98

Are others being spammed on their NIC contact addresses by domainspace.com trying to sell .cc domains? Received: from domainspace.com ([209.203.244.14]) by yoda.fdt.net with ESMTP id UAA01623 for <jlewis(a)FDT.NET>; Fri, 25 Sep 1998 20:19:03 -0400 ------------------------------------------------------------------ Jon Lewis <jlewis(a)fdt.net> | Spammers will be winnuked or Network Administrator | drawn and quartered...whichever Florida Digital Turnpike | is more convenient. ______http://inorganic5.fdt.net/~jlewis/pgp for PGP public key____

14 20

Fiber outage for BBN 29 Sep
by Andy McConnell 30 Sep '98

30 Sep '98

Curious - no one seemed to mention BBN Planet's "major" fiber cut yesterday. Their trouble system "shortcutted" calls to an automated message saying there were two major cuts in the Texas and Washington DC area. their ticket was #273439. As a BBN customer, we had trouble getting out of BBN all morning, and by early afternoon things were fine. Did anyone on the list see this sort of trouble? -Andy -- Andy McConnell アンディマッコネル Network Architect, NTT Multimedia Communications Laboratories Freedom means that, in time of war, good men and women will be asked to risk their lives because we think it better to die free than to live as slaves.

2 1

1997 Fiber Deployment Update Report Available
by Simon Leinen 30 Sep '98

30 Sep '98

FYI, I just noticed that this had been put on the FCC Web server earlier this month, see http://www.fcc.gov/Bureaus/Common_Carrier/Reports/FCC-State_Link/infra.html -- Simon.

1 0