- NANOG - lists.nanog.org

Re: What's going on?
by George Herbert 19 Apr '97

19 Apr '97

Well, this discussion is sliding into paranoia and fear rapidly enough. Let me start out by stating that, while I have started recommending direct action of an appropriate sort against AGIS as they are harboring a significant abuser of the net as a whole, illegal acts of any sort are inappropriate and I condemn them. My idea of appropriate is termination of BGP connectivity, AGIS customers leaving for more responsible providers, cutting off news feeds and access, firewalling their networks, etc. This is based on AGIS cheerfully providing enough bandwidth to Cyberpromo (and now, Nancynet) for each and every Internet user to get on the order of 5-10 email spams each and every day from Cyberpromo alone, who appear ready and willing to do so as they improve their mail sending software. However, if I find any information indicating that anti-spammers attacked AGIS in violation of applicable laws, I will turn them in. Bad guys on my side isn't something I approve of. Some providers on this list are complaining that they don't feel it's fair to get blamed if they provide, say, web service to someone who's spamming via another provider. Let's look at the situation from two viewpoints. Viewpoint one is a strictly interpreted AUP: if you abuse the net from my site or via my site, you get shut down. Viewpoint two is that of many end users, which is that an abuser should be disconnected from the net everywhere and stop abusing end users, rather than strictly looking just at which AUP got violated in the abuse. Viewpoint one is the minimal one for friendly cooperation as a responsible internet provider these days. But a lot of people feel that spam is rapidly becoming enough of a problem that it's irresponsible for anyone anywhere to knowingly provide spammers with any sorts of services on the net. If a hypothetical Spammer is sending a zillion messages a day via various accounts at dialup providers (which are getting turned off regularly), but all point to a web site you run, if you let them keep the site forever you are effectively saying that spamming is ok as long as it's done somewhere else. Which is, in my opinion, not a great attitude. Even if you do have that attitude, you must understand that a large number of upset spam victims will not agree with you and will hold you responsible. Fears of government regulation are probably wise, but there are ways to approach this problem that don't cause unnecessary headaches. One is to explicitly extend 47 USC 227 (the anti-junk-fax law) to cover email, without adding any extraneous language. There is an effort underway right now to actually write the language to do so and present it to Congress and try and get the Internet Caucus members to sponsor the legislation. This extension will impose a $500 fine on spammers per mail, but won't hold providers responsible or open the door to further unreasonable regulation. In a way, it's sort of the Sanford Wallace Memorial USC... the junk fax law came about because he was junk faxing right and left. Now, the extension to cover email is being proposed because he's doing email spamming right and left. Telcos can live with 47 USC 227 (it doesn't affect them at all). So can ISPs with the extension we're talking about. -george william herbert gherbert(a)crl.com

1 0

Re: What's going on?
by Sanjay Dani 18 Apr '97

18 Apr '97

>AGIS/Net99 (NETBLK-NET99-BLK4) NET99-BLK4 205.198.0.0 - 205.199.255.0 >Cyber Promotions Inc (NETBLK-CYBERPROMO-205-199) CYBERPROMO-205-199 > 205.199.212.0 - 205.199.212.255 >Nothing comes without a price. >just speculating I must say regardless of what might have caused this attack, AGIS don't deserve that. I've encountered some anti-spammers who would do half- assed investigations, declare an ISP guilty, then spread the word on private mailing lists shared by all sorts of hackers, who are apparently looking for an excuse to have fun and feel good about it. Despite our policy of not allowing spams from our network, we were labeled spammer friendly not too long ago and a minor break-in happened the same night. Just speculating, too. Sanjay. --------------------------------------------------------------- Web Professionals, Inc. 20370 Town Center Lane, Suite 245 +1 408-865-0899 Cupertino CA 95014 USA http://web.professionals.com ---------------------------------------------------------------

4 3

What's going on?
by Eric D. Madison 18 Apr '97

18 Apr '97

What's going on with the Routing Table? Seems like everyone is melting down. 27000 routes flapping????? What is everyone else seeing?? Eric _______________________________________________________ Eric D. Madison - Senior Network Engineer - ACSI - Advanced Data Services - ATM/IP Backbone Group 24 Hour NMC/NOC (800)291-7889 Email: noc(a)acsi.net

8 9

Re: What's going on?
by Eric D. Madison 17 Apr '97

17 Apr '97

It seems to be stable now, but the amount of history/dampened paths was very high about 30 minutes ago. Looking at our routers at both MAE's, we were getting about 5000/1700 paths. Digex (Nitrous) was as many as 28000/3000 at SprintNap and Mae-West. Weird thing was the fact it wasn't just one source. Most of the big players all had history/dampened paths. If you look at the Merit Realtime the amount of instablity was very high too.. jumped from 20k to 120k in just a few minutes. Eric On Thu, 17 Apr 1997, Craig A. Huegen wrote: > On Thu, 17 Apr 1997, Eric D. Madison wrote: > > ==>What's going on with the Routing Table? Seems like everyone is melting > ==>down. 27000 routes flapping????? > ==> > ==>What is everyone else seeing?? > > OH NO! THE GIGALAPSE! > > I'm not seeing any problems: > > Dampening enabled. 2085 history paths, 452 dampened paths > Dampening enabled. 418 history paths, 30 dampened paths > > /cah > >

1 0

Recent AGIS problems
by Phil Lawlor 17 Apr '97

17 Apr '97

Dear Customer: Unfortunately, we must inform you that AGIS has suffered a concentrated and systematic attack of our network. At this time we cannot provide any further details, except to inform you that a federal investigation is underway, and, that AGIS is fully cooperating in every facet of this investigation. We empathize with your frustration in communicating with AGIS as of late. If our corporate communications have seemed insufficient, it is not a reflection our customer service policy or technical competence. Please understand, over the last few weeks we have been under specific disclosure restrictions pursuant to the investigation. Further, we want to assure you that increased security measures have been implemented and no private information was comprised. Regards, Phil Lawlor President AGIS Voice - 313-730-1130 Fax - 313-563-6119

1 0

VitalSigns: Event Report: (Server, Slow or failed connection, red) (fwd)
by Dean Gaudet 17 Apr '97

17 Apr '97

I can't believe this. This piece of software has a spam^H^H^H^Hmail the webmaster button to tell the webmaster of the site you're "testing" that things are too slow. Dean ---------- Forwarded message ---------- Date: Tue, 15 Apr 1997 15:19:54 -0400 (EDT) From: XXX@YYY To: webmaster(a)ZZZ.com Subject: VitalSigns: Event Report: (Server, Slow or failed connection, red) I would like to inform you about a potential problem I've experienced with your service. To assist you in understanding or remedying the problem, I have included below a brief description and report of the conditions I have experienced. I have frequently noticed that establishing a connection to your server takes a long time. You may find the following information useful. Subsystem: Server Event: Slow or failed connection Status: Failure to perform operation. Date and Time of Occurrence: Mon Apr 14 19:25 Client Hostname: XXX.XXX.XXX Client IP Address: A.B.C.D URL: Browser: (Netscape Navigator 3.0) OS Platform: Windows 95 User Name: Joe Luser Email Address: XXX@YYY Phone Number: 555-555-5555 Some of the information above has been provided by Net.Medic from VitalSigns Software. To learn more about how Net.Medic gathers information about on-line activity and how to interpret the information provided above, please visit the technical support room at http://www.vitalsigns.com. Net.Medic from VitalSigns Software uses analysis techniques which calculate performance measurements as accurately as practical within the limits of the Microsoft Windows and Internet environments. Because of these limits, and because Net.Medic was designed to minimize diagnostic traffic over the Internet, the results calculated by Net.Medic are close approximations, not absolute measurements.

6 5

Re: info
by Paul G. Donner 16 Apr '97

16 Apr '97

At 10:37 PM 4/11/97 -0400, Robert J. Fehn Sr. wrote: >OK, OK, I'm sorry... <G> Can't blame the trend toward less informed personel >on the personel... At least he is seeking out information on his own. Afterall, look at it this way, it takes a lot of guts to ask a basic question on this list. Besides, the sooner we inform him the faster he'll be up to speed. By the the same token, the aquatic thread has been providing some needed refreshment. > > >>> these days? A pulse...? >> >>Come on, I spoke with Tony and explained...give him a break. He's only >>looking for information. >> >>-ron >> >> >> >> > >Robert J. Fehn Sr.,President and CEO >Jersey Cape Information Systems Inc. >609-390-0061 www.jerseycape.net > > > >

2 1

Re: info
by fehnb＠jerseycape.net 16 Apr '97

16 Apr '97

Just what are the qualifications for employment at Sprint's Networking Division these days? A pulse...? >Hi, > My name is Tony Radzwon I am a new employee at Sprint Internet >Services. I have recieved a report that was sent to called CIDR. I am >trying to get all the information about this report that I can find. I >was thinking you may have some information about this you could share >with me.If so please e--mail me or page me at 1-800-sprint1 pin#3828941. >Thank you for your time. > >P.S. I am also curious what merit.com is. > > Thank You > > Tony Radzwon > Sprint Internet Services > > Robert J. Fehn Sr.,President and CEO Jersey Cape Information Systems Inc. 609-390-0061 www.jerseycape.net

4 3

ARIN Discussion from Feb NANOG Notes on line
by sob＠academ.com 16 Apr '97

16 Apr '97

Check http://www.academ.com/nanog/feb1997/ARIN.html. -- Stan | Academ Consulting Services |internet: sob(a)academ.com Olan | For more info on academ, see this |uucp: {mcsun|amdahl}!academ!sob Barber | URL- http://www.academ.com/academ |Opinions expressed are only mine.

1 0

Re: MCI outage
by Michael H. Lambert 16 Apr '97

16 Apr '97

>Often most of the major carriers will be using the same set of pipes >across >bridges and railway/highway overpasses. AT&T was advertising their >"redundant path" network where they supposedly made some effort to avoid >this. They were passing out maps and photos of spots with signs from >all the major carriers. > >Power, gas, etc. are often on those same bridges. So if the New Madrid fault were to let loose today with the Big One, how much transcontinental bandwidth would remain? Michael ----- Michael H. Lambert, Pittsburgh Supercomputing Center 4400 Fifth Avenue, Pittsburgh, PA 15213 Phone: +1 412 268-4960 Fax: +1 412 268-8200

1 0