- NANOG - lists.nanog.org

RE: Paul Vixie did not spam you (this is an automated response)
by Ry Jones 06 Mar '97

06 Mar '97

These are the same guys that the WA state AG shut down for mail fraud. I'm suprised they have the nuts to pop up again; this topic was beat to death on Seattle.General about 5 or 6 months ago. ---------- From: Geoff White[SMTP:geoffw@precipice.v-site.net] Sent: Thursday, March 06, 1997 4:14 AM To: peter(a)demon.net Cc: Paul Vixie; geertj(a)ripe.net; nanog(a)merit.edu Subject: Re: Paul Vixie did not spam you (this is an automated response) On Thu, 6 Mar 1997, Peter Galbavy wrote: > cc'ed to nanog@ FYI > > Paul Vixie wrote: > > Today I started receiving a massive number of e-mail bounces and complaints > > about spam. I immediately realized that someone had abused the network in my > > name; sure enough, I shortly received the evidence shown below. I apologize > > for this form letter response, but I'm expecting another 10,000 complaints and > > I do not plan to send personalized replies to each one. > > [Posting from home, since thats where I get nanog@, but posting > with my work hat on - Reply-To: set to peter(a)demon.net] > > Please note that we were hit by the same spammer. The original > message went out, claiming it was from one of our customers (another > thread last week) when in actual fact it is from an address block > assigned the enterprise.net. We have also been hit by the same spammer, he is using exchangecurrency(a)forprofit.com as his reply-field (which is one of my clients) Apparently one of the people at forprofit.com send a message to on of the spammers "superiors" (I think he just sent the message to the NOC contact of the host on a reply field that was sent to him :) and shortly after that, their domain name was showing up in the reply field of the spam. I am flushing all mail heading for exchangecurrency(a)forprofit.com to /dev/null. I've done a little research, aparently the original postings were using a domain... precipice:{root}67-> whois moneyworld.com Financial Connections, Inc (MONEYWORLD-DOM) 2508 5th Ave, #104 Seattle, WA 98121 Domain Name: MONEYWORLD.COM Administrative Contact, Technical Contact, Zone Contact, Billing Contact: Williams, Bob (BW747) willie(a)MONEYWORLD.COM 206 269 0846 Record last updated on 13-Oct-96. Record created on 26-Oct-95. Domain servers in listed order: NSH.WORLDHELP.NET 206.81.217.6 NSS.MONEYWORLD.COM 205.227.174.9 No answer at the number and apparently non of these DNS machines are currently on the net... hmm. This guy is causing my mail queues to fill up with a ton of bounces and flames and I don't appreciate it one bit. The guys at forprofit have some friends at the FBI, but they say that everytime they try to go after these guys, the ISPs won't co-operate :) Geoff White Virtual Sites http://www.v-site.net (415)437-4600 fax (415)437-4601

2 1

Re: 03/05/97 Internet Routing Problems
by Paul Ferguson 06 Mar '97

06 Mar '97

At 03:00 PM 3/6/97 GMT, stats(a)merit.edu wrote: > >Reserved Network and Host Announcements >--------------------------------------- >0/0 at PacBell from MIBX (6218) ASPATH=6218 Incomplete >0/0 at PacBell from MIBX (6218) ASPATH=6218 Incomplete >10/8 at PacBell from MIBX (6218) ASPATH=6218 IGP FYI. This is a prinicpal example of why people should be filtering on both inbound & outbound announcements of default & RFC1918 address space. - paul

5 4

in-addr problems
by William S. Duncanson 06 Mar '97

06 Mar '97

> Has anyone noticed lately that there have been a lot of problems getting > in-addr information on ms.uu.net ip addresses? At first I thought it was a > problem with a.root-servers.net, but it appears to be on the MSN/UUNet > side. We've had numerous customers of theirs complain that they could not > get to some of our sites, or that it was taking a lot longer than usual. > We looked at the logs, and sure enough, we're getting "refused connect from > aaa.xxx.yyy.zzz: gethostbyaddr() failed" messages from the IP addresses > that they're coming from. So, the question is, should we disable this > temporarily, or just wait for UUNet/MSN to get their act together? > > William S. Duncanson > william(a)neosoft.com > NeoSoft Operations > (888) NEOSOFT or (713) 968-5800 >

1 0

Re: measurement
by Bill McCauley 06 Mar '97

06 Mar '97

Randy, >So who actually measures their network performance and how? We use a traffic flow monitoring system from Kaspia Systems. (www.kaspia.com) The Kaspia product collects all sorts of data from router ports and RMON probes, stores the data and performs various trend analysis. We collect traffic flow, router CPU usage and router memory information plus various errors. There is a data reduction process which runs once a day, and a very nifty web interface. The product isn't cheap, but the system definitely fills a void here. Maybe I should organize a talk on what we're doing with it for an upcoming NANOG? As an old instrumentation engineer, I think the basis of our use of the tool is pretty solid. Plus, I actually developed a means for calibration of the accuracy of the flow data. Haven't had time yet to work out a validation for the trends, but I'll get to it one of these decades. Also, the Kaspia people will give you a thirty day trial on their product at no charge. Regards, Bill McCauley

2 1

Re: measurement
by Alex Rubenstein 06 Mar '97

06 Mar '97

You are WAY too helpfu; At 10:46 PM 3/5/97 -0500, Todd Graham Lewis wrote: >On Wed, 5 Mar 1997, Randy Bush wrote: > >> So who actually measures their network performance > >Us. > >> and how? > >Numerically. > >__ >Todd Graham Lewis MindSpring Enterprises tlewis(a)mindspring.com > >

1 0

Re: MCI noc
by Danny McPherson 06 Mar '97

06 Mar '97

trouble(a)mci.net or 800-663-9932... > I work for the Network Operations Center for the Army Corps of > Engineers. We (ceap.net) are basically the ISP for the entire Corps. One > of our internet service gateways is provided by MCI and we are having a > hell of a time getting a service issue with them resolved. Some time at > about 1:00 pm PST that gateway went down. Apparently, someone in their > provisioning group has decided to administratively shut down their > interface to us. That much I gathered from talking to someone in their > Internet group. He couldn't give me a good reason why this was the case > and the vapid account managers can't even find a circuit id and can't get > their connections to the MCI noc to do anything. I haven't been able to > get a hold of any one from their Internet group since then. This is > absurd. Is there anyone from MCI here who might be able to give me a > hand? > > > -------------------------------------------- > Esteban Gutierrez > US Army Corps Of Engineers > CEAP Network Operations > (503) 326-6126 > noc(a)ceap.net > >

1 0

MCI noc
by E Gutierrez 06 Mar '97

06 Mar '97

Greetings- I work for the Network Operations Center for the Army Corps of Engineers. We (ceap.net) are basically the ISP for the entire Corps. One of our internet service gateways is provided by MCI and we are having a hell of a time getting a service issue with them resolved. Some time at about 1:00 pm PST that gateway went down. Apparently, someone in their provisioning group has decided to administratively shut down their interface to us. That much I gathered from talking to someone in their Internet group. He couldn't give me a good reason why this was the case and the vapid account managers can't even find a circuit id and can't get their connections to the MCI noc to do anything. I haven't been able to get a hold of any one from their Internet group since then. This is absurd. Is there anyone from MCI here who might be able to give me a hand? -------------------------------------------- Esteban Gutierrez US Army Corps Of Engineers CEAP Network Operations (503) 326-6126 noc(a)ceap.net

1 1

Re: karl and paul, expostulating
by Paul Traina 05 Mar '97

05 Mar '97

[back from the grave] paul(a)vix.com (Paul A Vixie) writes: > Filtering packets based on source address makes Ciscos go way slow on > every packet. Filtering based on destination address makes Ciscos go > very fast on most packets and a little slower on SYN-ACKs. While I agree with what you're trying to do, your statement about filtering packets on source addresses is not correct. It's exactly the same hit. Paul -- The streets will flow with the blood of non-believers.

1 0

Re: Firewall in Routers??
by William S. Duncanson 05 Mar '97

05 Mar '97

At 12:47 3/4/97 -0500, Robert Laughlin wrote: >> On Mon, 3 Mar 1997, Andrew Smith wrote: >> Anyone who has a 75XX and a single T1 needs to be taken out back and shot >> by their overly generous accounts payable division ;) > > >At a recent Cisco seminar aimed at corporate customers, Cisco was >specifying the 7500 be used in all the following situations: > >1. connecting a single mainframe computer to the campus backbone >2. connecting a large office to the campus backbone >3. connecting a remote office over frame relay at 512 kbs to the campus >backbone. But do not despair, if you are running at 256kb, you can drop >back to a 7200. > > >#3 implies we are over driving our 7500s. If the 7500 is intended to >handle a single serial line at 512kb, no wonder it seems to get overloaded >on the backbone. Wonder what they would recommend for a DS1 or a DS3, then. BFR, anyone?

4 4

Fw: "routing table slots" and the real problem
by garyz＠savvis.com 05 Mar '97

05 Mar '97

---------- > From: Gary Zimmerman <garyz(a)savvis.com> > To: Nathan Stratton <nathan(a)netrail.net> > Cc: Joseph T. Klein <jtk(a)titania.net>; nanog(a)merit.edu; Paul Ferguson <pferguso(a)cisco.com> > Subject: Re: "routing table slots" and the real problem > Date: Wednesday, March 05, 1997 7:29 AM > > Nathan, > > I know we have five 16 slot routers up and running to date and will go to > 19 soon. We have had some issues with adding pvc(s) . The new code should > be released soon, but it is not good, when you have to take other customers > down to add a new one. Like you we are very please with the gigarouter, > but they still have a way to go. Have you tried getting stats from hssi > cards? Have you tried to look at the bgp tables? Have you tried > communities and federations? > > Any way I am not upset with them, I know they have alot behind, the fact > that they are open is the main plus, that is why I am carring their flag, > but they really need to get behind scaling the product. What a problem, > sell more in one month than you sold in the first three years. > > Anyway, let's keep in touch. I am getting some code this week that should > really make a big difference. > > Gary Zimmerman > > ---------- > > From: Nathan Stratton <nathan(a)netrail.net> > > To: Gary Zimmerman <garyz(a)savvis.com> > > Cc: Joseph T. Klein <jtk(a)titania.net>; nanog(a)merit.edu; Paul Ferguson > <pferguso(a)cisco.com> > > Subject: Re: "routing table slots" and the real problem > > Date: Monday, March 03, 1997 3:16 PM > > > > On Mon, 3 Mar 1997, Gary Zimmerman wrote: > > > > > Has anyone looked at Ascend's (NetStar Gigarouter). We have and like > the > > > direction. If they continue to deliver, I think they are going in the > > > right direction. Still some parts missing, I hope we can hold on until > > > they get here, but the direction is right. I think the open idea is > the > > > only way to go on this issue. > > > > We have been using them for about 5 months now, and I like them a lot. We > > have worked with Ascend to fix a large numbers of problems. They are very > > stable now, and have a lot of people working to make them better. > > > > > > Nathan Stratton President, NetRail,Inc. > > ------------------------------------------------------------------------ > > Phone (888)NetRail NetRail, Inc. > > Fax (404)522-1939 230 Peachtree Suite 500 > > WWW http://www.netrail.net/ Atlanta, GA 30303 > > ------------------------------------------------------------------------ > > "Therefore do not worry about tomorrow, for tomorrow will worry about > > itself. Each day has enough trouble of its own." Matthew 6:34 > >

1 0