November 1997 - Test - lists.nanog.org

Re: AGIS Signing up New Spammers
by Kent W. England 21 Nov '97

21 Nov '97

At 08:56 AM 17-11-97 -0600, Joe Shaw wrote: > >If you decide to start filtering out SPAM by blocking it from the source, >do you end up becoming a content provider because you're controlling what >your customers have access to? This is why the spam issue has to be attacked as a theft of service issue. Spam is identified not by its content, per se, but by such things as: 1) unauthorized relaying 2) false Reply, From and To addresses 3) false Received headers 4) invalid domains and IP addresses 5) fradulent headers of other types 6) lack of unsubscribe capability 7) lack of explicit subscribe capability If you decide to block spam because it violates a standard for email headers and subscription policy, then you are not controlling content, only the proper addressing and routing of messages. If someone sets up a subscription mail list, solicits subscribers, and then sends out "make money fast" messages, that is not spam. This is where Jack Rickard is wrong in his defense of Phil Lawlor. Jack thinks that Phil is on the high moral ground when he says he cannot filter based on content, but that is wrong-headed. Spam is a theft of service issue related to the rules for the transfer of email and according to these rules, Lawlor and AGIS deserve to be crucified. Of course, AGIS should not filter based on content, but they should enforce rules for the proper addressing and delivery of email and the proper management of subscriber-initiated subscription to mailing lists. They should enforce this on their customers instead of trying to get them to follow some high minded collective nonsense-speak, all the while taking their dirty money. --Kent

3 2

Hardware
by Scott Stults 21 Nov '97

21 Nov '97

A gentleman at UUNet recommended that if I have any networking hardware for sale I could contact you. I hope this is correct because I'm trying to get rid of a Telebit NetBlazer 40. If you administer some sort of list, I would appreciate it if you'd let me know. Thank you, Scott Stults I/T Specialist IBM Direct Customer Access and Kiosk Solutions 6710 Rockledge Drive Bethesda, MD. 20817 (301) 803-1032

1 0

LAND attacks
by Matthew Silvey 21 Nov '97

21 Nov '97

Hello NANOG, The location of the article containing the C code is : http://www.geek-girl.com/bugtraq/1997_4/0339.html My initial tests of a cisco 7000 running IOS 11.2 show that it is not vulnerable to the attack. Matthew Silvey Network Engineer Thorn Communications, Inc. (212) 480-3680 / duncan(a)thorn.net

1 0

Re: OPS: SECURITY new packet of death
by Daniel.MacKay＠Dal.Ca 21 Nov '97

21 Nov '97

Here's the URL for those of you not on BUGTRAQ. http://www.geek-girl.com/bugtraq/1997_4/0348.html -- Daniel.MacKay(a)Dal.Ca Network Operations Centre Manager 902 494-danm Dalhousie University, Halifax, Nova Scotia, Canada.

1 0

Anyone planning to peer with these guys ?
by John R Levine 21 Nov '97

21 Nov '97

Showed up on a mailing list, reportedly sent by Walt Rines from a Hotmail account. If they set up their own network, that's A-OK with me unless, of course, someone foolishly connects it to the Internet. Regards, John Levine, postmaster(a)abuse.net, http://www.abuse.net, Trumansburg NY abuse.net postmaster --------- Cyber Promotions/Quantum Communications Press Release Spam Backbone Formed The "Spam King," Sanford Wallace, and Walt Rines Have incorporated their new bulk-email friendly backbone network For Immediate Release: Philadelphia 11/20/97-- Sanford Wallace, Walt Rines and an undisclosed third party have formed Global Technology Marketing, Inc. (GTMI). The new corporation will offer direct , high speed T-1 And T-3 Internet connections to companies that engage in mass commercial email. Currently, there are no other backbone providers that allow customers to send spam. GTMI will be offering connectivity contracts by the beginning of the next week. Sanford Wallace commented: "We are very excited about this new project. For the first time ever, Internet marketers will be encouraged to engage in direct advertising, a practice which is already accepted in the postal world." Walt Rines stated: "Finally, bulk emailers will have an opportunity to legitimize this new industry. We are going to prove that this explosive new market can be self-regulated." Technical Details: GTMI has established a national backbone which operates as a fully-meshed network operating at DS-3 speeds, and interconnecting, or "peering" with several other networks at undisclosed private peering points. Multiple Lucent 5E12 switches, capable of processing data using multiple protocols including Internet (IP) Protocol, will route the traffic through the network. Dr. Robert Elliot, Chief Technology Officer, was quoted as saying, "We are excited about employing the Lucent 5E12 switches in the new network architecture. It just proves that IP telephony is becoming a reality." More detailed information will follow within the week CONTACT INFO: Sanford Wallace: 215-628-9705 Walter Rines: 603-772-4096

9 11

Re: Geographic v. topological address allocation
by Sean M. Doran 20 Nov '97

20 Nov '97

Sean Donelan <SEAN(a)SDG.DRA.COM> writes: > What I was trying to postulate, unsuccessfully, there is no such > thing as an universal, optimal hierarchical addressing scheme. I > thought I had chosen examples from the opposite ends of the spectrum. > I guess I wasn't extreme enough in my examples. Perhaps I should > have used the ISBN hierarchy, a combination of language group, country > and publisher prefix. I'm going to publish a million books, so I > should get a 'big' publishers prefix. You are confusing transport address (describing a location in a topology) with an object name (a book, a computer, a process running on a computer). An object name like an ISBN does not need to be hierarchical because they do not describe discrete locations. Introducing hierarchy improves managability and efficiency of databasing. Many hierarchies can be imposed on object names. IPv4 addresses and anything like them need to be hierarchical in sufficiently large networks because they do describe the location of one or more objects, and because flat addresses are known not to scale in large networks. Hierarchical routing is the only known means of scaling IP addresses as they exist now, and therefore the only hierarchy that can be imposed on IP addresses is strictly topological. The canonical object-describing database that is the roughly the analogue of the ISBN database is the DNS. (I hate analogies I hate analogies I hate analogies please don't use them). The DNS is also manifestly hiearchical, and that hierarchy introduced efficiency compared to the former flat ARPA namespace. Note that the DNS works with suffixes rather than prefixes, which is a cosmetic difference unless one is interested in doing binary sorts or tree-based searces, and that the DNS is variable-length, which is not a cosmetic difference from the ISBN. If you are a big organization and plan to have lots of objects you need a sufficient swathe of DNS names to describe them all. These in turn should resolve into LOCATORS which describe where in the Internet topology (as opposed to the corporate topology or the geographical topology) the objects can be reached. For example, one hierarchy of Internet object names is clock.org. Although cesium.clock.org and solar.clock.org are siblings in that hierarchy, they have very different IP addresses because they are located in different parts of the Internet topology. They should NOT have the same IP prefix as any attempt at that would introduce unnecessary inefficiency into the routing system. Remember: at each level of naming there can be different and completely disjoint hierarchies. There are scalability implications in all of them, most notably when the names used have size limits or are distributed non-hierarchically (like ethernet addresses or the COM domain). However, the important thing is that when a name is used as a LOCATOR in a topology, in order to be scalable that name must be related to that topology and in large networks must lend itself to aggregation in order to reduce the amount of information needed to have that locator be used throughout the network. Sean.

2 1

Re: Proper procedure to change route advertisement
by tonyh＠noc.cbn.net.id 20 Nov '97

20 Nov '97

Thank you all for the help from ANS, MCI, BBN people. The trafic start flowing to/from ANS network. To recap my correspondense to them: the proper way to change route advertisement from /20 to /19: first add route object /19 to RADB advertise the new route /19 wait until it is propagated to the whole internet ( 3 days ) delete the old route object /20 stop advertise the old route /20 by doing this there should be minimal unreachable network. any comment, suggestion ? Thank you again for your help. Tony S. Hariman http://www.tsh.or.id Tel: +62(21)574-2488 Fax: +62(21)574-2481

1 0

Re: Anyone planning to peer with these guys ?
by Tony Li 20 Nov '97

20 Nov '97

> The "Spam King," Sanford Wallace, and Walt Rines > Have incorporated their new bulk-email friendly backbone network This is great. Finally, just what we wanted. All of it gone with a single AS path filter.... Just let us know which one. ;-) Tony

1 0

Re: Netflow IP accounting and IP protocol numbers
by brett watson 20 Nov '97

20 Nov '97

we complained about having to populate this info and i believe the netflow folks will release a fully populated protocols/ports file in v2.0 which is about 30 days away from release, i think. there will always be things like traceroute that use very high port numbers and increment them along the path, or custom aplications so you'll always have fairly large numbers of "other". at least that's been our experience. -brett > On Thu 20 Nov, steven hessing wrote: > > The other day we started using Cisco netflow accounting software > > together with IP flow export feature of recent Cisco IOS versions. > > > > What we found was that although we put a lot of protocols in the > > nfknown.protocols file of the accounting software (everywthing we > > could find in the /etc/services file of Solaris and Linux), there > > is still a lot of traffic under TCP-Other and UDP-Other. This > > indicated that traffic is going over our network using ports that > > the software doesn't know about. > > > > This could for example be Real-audio, Cuseeme, Pointcast, Backweb > > etc traffic. Unfortunately, I don't have a list of these newer > > protocols together with their port numbers. Has anyone compiled > > such a list? There's the Assigned numbers RFC but the last version > > of it is RFC 1700 of October 1994. > > Try, > > ftp://ftp.isi.edu/in-notes/iana/assignments/port-numbers > > It doesn't give a date it was last updated - but the list is bloody > long so should do you ;-) > > Cheers, > > aid > > -- > Adrian J Bool | mailto:aid@u-net.net > Network Operations | http://www.noc.u-net.net/ > U-NET Ltd, UK | tel://44.1925.484461/ >

1 0

Proper procedure to change route advertisement
by tonyh＠noc.cbn.net.id 20 Nov '97

20 Nov '97

Hi, What is the proper procedure to change route advertisement for example from /20 to /19 ? Currently I just update radb and mci routing database. Also I send email to our upstream provider about the change. But now we have some connectivity problem with ANS and ANS customer. Any hint would be appreciated. Thanks. Tony S. Hariman http://www.tsh.or.id Tel: +62(21)574-2488 Fax: +62(21)574-2481

2 1