- NANOG - lists.nanog.org

New cflowd bits
by Daniel McRobb 23 Jan '97

23 Jan '97

Hi folks. I just posted a new version of cflowd at: http://engr.ans.net/cflowd/index.html The new version (1.2-alpha) has a rewritten raw flow module using memory-mapped I/O. For those of you that have used it, you can now turn on raw flow logging and not thrash your machine with flow->disk I/O. The new version also has a bug fix for remote client connections; this is an old fix I never got around to posting. The code is still based on some old beta Cisco bits which include AS numbers in flow-export. I don't know the status of getting that code into ELC, but I'll try to find out (Paul? Dave? Anyone?). In about 5 minutes, I'll be deploying this new code on a few ANS machines and leaving raw flow logging turned on. Who knows, maybe I'll have a silly SYN flood story for San Francisco. I do have about 3 month's worth of AS matrix data (5-minute polling intervals) on-line and have a lot of charts. I'll put up some of my slides at the site above soon. Daniel ~~~~~~ P.S. - I've only tested the latest on AIX 3.2.5... in fact I've only *compiled* it on AIX 3.2.5. Hopefully it'll still compile/run fine on the platforms targetted in the original version. You can send bugs to me just like before; I make no guarantees I'll reply or have time to fix anything, but I do promise to at least tuck away the mail until I have a chance to look at it or I need the disk space back. ;-)

1 0

Power outage in San Francisco
by Rob Liebschutz 23 Jan '97

23 Jan '97

There is a power outage in San Francisco affecting a large area South of Market Street, including China Basin. The outage begain shortly after 12:00am PST Wednesday and was caused by flooding of an underground PG&E transformer. Current estimated restoral of power by PG&E is around 6:00pm Wednesday. (Prior estimates were for 12:00 noon). Whole Earth Networks has was down all night. We've been coming up slowly as we pull in power feeds from mobile generators. The China Basin complex where we are located has been quite a scene, with cables running out the to roof and down the side of the building to generators running in the courtyard below. There's been alot of cooperation amoungst providers with Sprint and TCG sharing spare power capacity on the generators and pulling wires to other providers in the building. MFS has also been helping their customers with power restoral. MCI has a big mobile generator in the courtyard as well. The power for the emergency lighting in the complex (multiple 6 story buildings) lasted only a few hours and we're all running around in the halls with flashlights. A big lesson to be learned by all. Rumor has it that we now have approval now for the purchase of our own generator. Rob

3 2

Re: random thoughts on how I can prevent spammers from using my net
by Barry Shein 22 Jan '97

22 Jan '97

We have had a similar pricing policy for years and have collected on it, a few times in the $1000 range. On January 20, 1997 at 17:07 dorn(a)atlanta.net (ALAN DORN HETZEL, Jr.) wrote: > Great idea. > > How many people have you collected on? :) > > - Jared > > > None yet. Haven't gotten contract language written > for it yet. That's why I'm bouncing it around here > before I go to that stage... > > > -Dorn -- -Barry Shein Software Tool & Die | bzs(a)world.std.com | http://www.std.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989

1 0

Re: Suggestion for NANOG Meeting
by Sean Donelan 21 Jan '97

21 Jan '97

>As a carrier, we at ACSI have issued a statement that we cannot be >responsible for customer traffic. I know that legally we cannot filter >any customer traffic, but I am really getting sick of getting emails >about customers that continue to send unsolicited emails. We as a >community need to come up with a common carrier policy on how to handle >such customers and how to deal with complaints. Talk to you company lawyer about what you legally can and can not do. Even common carriers have a lot of leeway writing their tariffs. Yes, tariff writing is a business decision. Common carriers write the darndest things in their tariffs. And even more amazing, if you had a smart lawyer write the right things, you can get a court to enforce those darndest things too. Personally, I would be happy if the IETF-RUN group put out a document on the right and wrong way to complain. Spamming your complaint about spam is a bit hippocritical. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

2 1

Just from curiosity....
by Brian Tackett 21 Jan '97

21 Jan '97

Anyone have any insights on what causes the following interesting data from a traceroute? 10 cpe1-fddi4-0.Reston.mci.net (204.70.176.102) 39 ms 36 ms 38 ms 11 * cpe1-fddi4-0.Reston.mci.net (204.70.176.102) 36 ms * 12 cpe1-fddi4-0.Reston.mci.net (204.70.176.102) 38 ms * * 13 cpe1-fddi4-0.Reston.mci.net (204.70.176.102) 41 ms * * 14 cpe1-fddi4-0.Reston.mci.net (204.70.176.102) 194 ms * * 15 cpe1-fddi4-0.Reston.mci.net (204.70.176.102) 36 ms * * 16 cpe1-fddi4-0.Reston.mci.net (204.70.176.102) 36 ms * 37 ms 17 * cpe1-fddi4-0.Reston.mci.net (204.70.176.102) 37 ms * 18 cpe1-fddi4-0.Reston.mci.net (204.70.176.102) 37 ms * 35 ms

6 5

Re: Bay Networks in bed with commie censors?
by Vadim Antonov 21 Jan '97

21 Jan '97

Ah, finally. Somebody from Bay. Do you care about an official statement clarifying the story? >What makes you all think that we were the only people competing for this >business? I have no way to know that. I know people who refused business in similar situations. >Do you think that if we did not win that our competitors would not have >trumpeted their accomplishments? They'd better anticipate the potential for negative publicity? --vadim

2 1

random thoughts on how I can prevent spammers from using my net
by ALAN DORN HETZEL JR 21 Jan '97

21 Jan '97

I have been trying to figure out ways to prevent spammers from using my net as a sending location (even once). If most spam is sent from throwaway dialup accounts, how would a daily limit of #arbitrary-number of emails sent, with a charge of $0.05 (or other number) per excess e-mail...? The arbitrary-number might be 1000 or so, plenty for most legitimate uses. Since we get credit card numbers from our dialuo customers, if we do get a spammer, and they send, say 100,000 emails in a month, we subtract their allowance of 30K or so and bill them $3,500 (70K * $0.05) for excess.... If we make the terms and conditions obvious, and get a signature before activating the account, it won't take very many occurrences before word would get around that SPAM can ocst as much as paper junk mail to send Thoughts? -Dorn

3 2

Re: Bay Networks in bed with commie censors?
by Vadim Antonov 21 Jan '97

21 Jan '97

Ronald Barron Yokubaitis <rony(a)texas.net> wrote: >MMMMMMMMmmmmmmmmmm...........Do the same considerations apply to >BUYING from the PRC? Please. The original speech was not about trade with PRC which is unquestionably good and desireable; but about cooperation with an organization whose _proclaimed_ goal is to build a politically censored version of Internet, and make uncensored networks completely illegal in PRC. --vadim

6 5

Re: random thoughts on how I can prevent spammers from using my net
by Dave O'Shea 21 Jan '97

21 Jan '97

---------- > From: ALAN DORN HETZEL JR <dorn(a)atlanta.net> > To: NANOG(a)merit.edu > Cc: dorn(a)atlanta.net > Subject: random thoughts on how I can prevent spammers from using my net > Date: Monday, January 20, 1997 2:55 PM > > > I have been trying to figure out ways to prevent spammers from using my > net as a sending location (even once). If most spam is sent from > throwaway dialup accounts, how would a daily limit of #arbitrary-number > of emails sent, with a charge of $0.05 (or other number) per excess > e-mail...? The arbitrary-number might be 1000 or so, plenty for most > legitimate uses. Since we get credit card numbers from our dialuo > customers, if we do get a spammer, and they send, say 100,000 emails > in a month, we subtract their allowance of 30K or so and bill them > $3,500 (70K * $0.05) for excess.... One of the simplest steps that can be taken is to throw a couple simple filters in the router handling the dialup server, permitting TCP 25 only to your "approved" mailhost. This step, combined with some rudimentary procmail work, would put all but the most determined spammer out of business. As for zapping their credit card, all they have to do is dispute the charge. The trick then is convincing your corporate legal department that some unemployable snotbag from Staten Island is worth the trouble of slapping with a $25k default judgement. > > If we make the terms and conditions obvious, and get a signature before > activating the account, it won't take very many occurrences before word > would get around that SPAM can ocst as much as paper junk mail to send > One thing I've considered, (get your rotten vegetables ready, people, this is a stinker!) would be to set up a "post office"-ish authority, which would be the only place that you would "accept" mail from. Persons wishing to have a message "forwarded" by the post office would have to establish credit, in advance, for some small sum - perhaps a couple of pennies. Granted, this leaves all kinds of problems, such as mailing lists and the like, but it's a thought. There are hundreds of small ISP's around the country, and the odds of every one of them implementing junk-mail filters is somewhere between slim and none. I think the only possible source for a true solution comes in limiting, to a very high degree, who you will accept mail from.

1 0

Re: Suggestion for NANOG Meeting
by Bill Woodcock 20 Jan '97

20 Jan '97

Mike Leber <mleber(a)he.net> writes: > Using "ask to be taken off their list" as an indicator indicates > a naive understanding of how serious spam servers (for lack of a > better term) operate. > The primary reason that a well written spam includes a way "to > get off the list" are it gives recipients an action to take, > thus reducing complaints. > You can ask to be removed from the scam artist's lists all you > want, but you will never be removed from the spam server's > master list. I can confirm this. The reply-to address of a good deal of the spam out there is <someusername>@domain.com, the example address, so the "remove-request" just gets a reply from the example address mailbot and is then trashed. We're currently seeing about 20mb/day of these misaddressed remove-requests. -Bill

1 0