December 1998 - Test - lists.nanog.org

Re: ** Forged spamming going on
by George Herbert 22 Dec '98

22 Dec '98

Dean Anderson <dean(a)av8.com> >I'm not the only one concerned about coercion by the RBL. I know I'm not >the only one concerned that the use of this coercion is capricious and >unpredictable, and changes depending on Paul's moods and own interests. >This was demonstrated quite clearly with the abandonment of rules to >essentially blackmail NetSol into cooperation. If the rules were bent in the NetSol case, it was bent in NetSol's favor, not visa versa. Added tolerance in the system rather than added rigidity is almost always a positive step, and was in this case. >The bottom line is that the RBL is a powerful hammer, and the person in >control is inclined to act capriciously without concern for anyone else or >even follow his own rules about their "permitted activities" as he >originally defined them in the pages on qualification for the RBL. This opinion is unsupported by evidence. >Thats an operational problem. I think we either need to take the hammer >away from Paul and give it to someone more even handed and fair about the >application of the rules, or stop using the hammer altogether. The latter >alternative is unlikely. Which "we", Kemo Sabe? "we" have nothing to say about it. It's entirely between Paul and the RBL user community. They can always stop using it if Paul goes nuts. And undoubtedly would. You have no more legal or moral standing to intervene than a fish does, at this point. >I have argued in the past that the RBL will not acheive its desired goals. >And I don't think it will, or has. But I don't deny it certainly does have >effective power to coerce and influence the industry. It can clearly move >big players like earthlink and others. > >I can live by whatever rules as long as they are evenly applied to everyone >else. I can't live with a powerful instrument like the RBL which is >applied capriciously at Pauls apparent whim. I think others agree with this. If you could, in fact, live with that, you would have no problem with the RBL as it exists today. It is obvious by your repeated unsubstantiated hits on the RBL, Paul, and the RBL team that you have ulterior motives. Those underlying motives are fine: healthy skepticism about net interactions is a good thing. But you aren't expressing reasonable, healthy criticism. You keep trying to invent incidents of RBL abuse to justfy making RBL go away. This is, frankly, tiresome and immature. With the lack of substantiation, you're abusing nanog every time you bring it up again. Paul going nuts and breaking his own rules is not a current operational issue: it hasn't happened, and there is an obvious, well documented solution if it does. Until and unless that happens, all you're doing here is further wrecking your own reputation. -george william herbert gherbert(a)crl.com I speak for a fish, some leap years.

1 0

OFF TOPIC: Expert opinion needed for talk
by Derek Elder 22 Dec '98

22 Dec '98

Hi all. One of my co-workers is doing a presentation in Hong Kong on VoIP migration issues. He's looking for a couple ISP folks to get some insight for the talk. Anyone out there willing to give my buddy a hand? D E R E K E L D E R Associate Partner, CCIE# 4048 __________________________________________ USWeb/CKS http://www.uswebcks.com/ 120 Wood Ave, Suite 300 Iselin, NJ 08830 ph: 732-632-2778 fax: 732.321-3809 USWeb - A Strategic Partner for the Information Age

1 0

InterNIC "whois server <handle>" broke?
by Jeffrey Haas 22 Dec '98

22 Dec '98

Has anyone else noted that "whois server <handle>" no longer seems to be working at the InterNIC? -- Jeffrey Haas "Denial of Spamming is not a crime." elezar(a)pfrc.org -- Russell Nelson <nelson(a)crynwr.com>

7 15

ARIN & re-using some /24s
by Daniel.MacKay＠Dal.Ca 22 Dec '98

22 Dec '98

Howdy. I have a number of portable /24s which had been deployed in the early days of the Internet to customers who do not use 'em any more. Of course we're supposed to turn in unused /24s and ask our transport providers for whatever space we need, but for a variety of reasons I'd like to re-use these blocks, and I'd sort of like the ARIN info to be correct on them -- not indicating they're in use by a company that went out of business years ago for instance. The last time I tried this, I got so much flack from ARIN that I gave up and left the block registered to the wrong organization, but persistence does usually pay off with them. If you have had any experience re-registering blocks to totally different organizations, that is, changing -all- of the info associated with a net block, I'd like to hear from you- experiences and the procedure you followed. Please reply directly. I'll summarize and post here next week. -- Daniel.MacKay(a)Dal.Ca Network Operations Centre Manager 902 494-danm Dalhousie University, Halifax, Nova Scotia, Canada.

1 0

Re: ** Forged spamming going on
by George Herbert 22 Dec '98

22 Dec '98

Dean, it's this simple: AOL is not *sending* the mail. They are not *relaying* the mail. They don't qualify as a RBLable party because of that, in this incident. The proper description for "they're bouncing it back to me because the headers were forged to say it came from me but it didn't, and they're just the site where the targeted customers reside" is neither "sender" nor "relayer", nor generally considered an abusing party in a spam situation though it may cause some third-party forgery victim some pain. This seems perfectly obvious to me. It should be perfectly obvious to anyone who understands net mail and has read the RBL website. Why are you going on and on about it? -george william herbert gherbert(a)crl.com I speak for myself only.

2 1

SPAM from NetScape and AOL
by John M. Brown 22 Dec '98

22 Dec '98

Gotta love those NetScape NetCenter people. When I register with some site I use an Email address that tells me if they send me junk and where it came from. I know that I explicatly click DON"T SENT ME ANYTHING buttons. Looks like NetCenter just got a mailing list from AOL and there AOL Chat app. Thanks AOL for violating my privacy request, Thanks NetScape for sending me SPAM. If anyone wants the headers I'll forward them. AOL and Netscape are hereby BLOCKED. jmbrown

1 0

Re: ** Forged spamming going on
by Robert Tarrall 22 Dec '98

22 Dec '98

alex(a)nac.net wrote: -> some luser off of AT&T DIalup is using mailme.com (my domain) for relaying -> mail: -> Received: from mailme.com (146.st-louis-71-72rs.mo.dial-access.att.net -> [...] -> He is sending thousands of emails to AOL users, who is then bouncing them -> to me. -> [...] -> Thinking about this, there is no solution; here are my options: -> -> 1) blackhole AT&T, which does nothing, since the mail is bounces coming -> from AOL. -> -> 2) blackhole AOL, which would fix my attack, but would break all -> legitimate mail from/to AOL. -> -> 3) temporarily blackhole mailme.com, which would prevent me from getting -> the bounces, but then I can't send/get legit mail. You forgot: 4) Deny relaying, which sendmail 8.9.1a will do by default (has worked great for us so far), and 5) Deny access to dial-access.att.net (and dialsprint.net, da.uu.net, pub-ip.psi.net, etc) which is what we're doing here just because we get so much spam directly from such dialup accounts these days. Anyone have a list of legitimate outgoing SMTP servers for the big dialup companies (UUnet, PSI, Concentric, AT&T, Sprint, etc)? So far I haven't had any complaints about blocking stuff like da.uu.net, but I'd like to make sure that legitimate email can still get through. -Robert Tarrall.- System/Network Admin E Central

5 4

Re: ** Forged spamming going on
by Dean Anderson 22 Dec '98

22 Dec '98

At 11:29 AM 12/21/1998 -0800, Paul Vixie wrote: >"Won't" in this context has to mean "makes no effort". AOL makes an effort. >Several of AOL's mail relays were blackholed in the first six months of the >MAPS RBL project, but AOL has been a model network citizen since then. So basically, if they sign up to use the RBL, then you won't blackhole them? But doesn't NetSol use the RBL? Why should they be threatened with Blackholing then? --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 1

AT&T crap performance!
by Chris Cappuccio 21 Dec '98

21 Dec '98

Hey, I've been using AT&T's network for a while now, and I have a lot of very poor performance issues like this for a long time. The easy answer would be to trash AT&T but we've got a contract with them that hasn't expired yet. Since these are network related issues, I'm wondering if anyone on NANOG has a clue as to what is going on/the best people to approach. I've been calling folks at AT&T for several months to get answers that amount to "we are upgrading this link to an OC3" and even after the upgrade, the performace still sucks. dqc:chris {107} traceroute lycaeum.org traceroute to lycaeum.org (207.66.171.40), 64 hops max, 40 byte packets 1 enet-IP4-de1-gw.bend2.EmpireNet.net (12.7.103.1) 0.440 ms 0.759 ms 0.375 ms 2 fe0-0.c7206.EmpireNet.net (12.7.96.1) 1.169 ms 1.71 ms 1.13 ms 3 12.127.193.109 (12.127.193.109) 18.43 ms 17.241 ms 21.98 ms 4 gr1-a3100s3.sffca.ip.att.net (192.205.35.1) 21.828 ms 32.112 ms 23.714 ms 5 att-gw.sf.cw.net (192.205.31.78) 473.411 ms 464.849 ms 494.304 ms 6 bordercore2.Seattle.cw.net (166.48.208.1) 482.713 ms 501.263 ms 511.764 ms 7 semaphore-corporation.Seattle.cw.net (166.48.208.6) 361.175 ms 368.1 ms 381.595 ms 8 fe0-0-0.sea2.semaphore.net (209.221.128.2) 383.171 ms 380.497 ms 447.556 ms 9 wolfe-gw-n-E12-3.semaphore.net (207.17.119.21) 677.106 ms 592.674 ms * 10 fci-sea-cr0-fa-0-0-0.flyingcroc.com (204.157.111.18) 573.205 ms 490.200 ms 454.482 ms 11 shaman.lycaeum.org (207.66.171.40) 493.69 ms 487.742 ms 487.732 ms lycaeum{101}% traceroute dqc.org traceroute to dqc.org (12.7.119.10), 30 hops max, 40 byte packets 1 * fci-sea-cr0.flyingcroc.com (204.157.104.1) 1.823 ms 0.986 ms 2 204.157.111.17 (204.157.111.17) 1.723 ms 1.649 ms 1.172 ms 3 wolfe-gw-f-E12-3.semaphore.net (207.17.119.22) 1.818 ms 2.196 ms 8.317 ms 4 903.Hssi5-0.GW1.SEA1.ALTER.NET (137.39.136.21) 8.787 ms 2.265 ms 1.847 ms 5 103.ATM3-0.XR1.SEA1.ALTER.NET (146.188.200.42) 2.692 ms 6.655 ms 5.883 ms 6 295.ATM2-0.TR1.SEA1.ALTER.NET (146.188.200.106) 2.518 ms 2.821 ms 2.922 ms 7 110.ATM7-0.TR1.CHI4.ALTER.NET (146.188.136.165) 50.112 ms 53.411 ms 48.689 ms 8 299.ATM7-0.XR1.CHI4.ALTER.NET (146.188.208.221) 46.940 ms 52.094 ms 47.992 ms 9 195.ATM8-0-0.BR1.CHI1.ALTER.NET (146.188.208.1) 47.254 ms 47.534 ms 48.252 ms 10 137.39.23.50 (137.39.23.50) 50.224 ms 49.393 ms 50.897 ms 11 gr1-a340s1.cgcil.ip.att.net (192.205.31.113) 74.123 ms 68.746 ms 94.304 ms 12 br2-a350s3.cgcil.ip.att.net (192.205.31.106) 1019.882 ms 977.420 ms 958.934 ms 13 br1-h31.sffca.ip.att.net (12.127.14.110) 292.712 ms 91.461 ms 79.426 ms 14 ar1-a300s1.sffca.ip.att.net (12.127.1.133) 322.673 ms 417.481 ms 385.498 ms 15 12.127.193.102 (12.127.193.102) 367.061 ms 374.838 ms * 16 lightwave-2-GW1.bend1.EmpireNet.net (12.7.96.4) 422.924 ms 420.412 ms 419.702 ms 17 dqc.org (12.7.119.10) 461.522 ms 465.937 ms 452.014 ms -- Keep Cool, but Don't Freeze - Hellman's Mayonnaise

2 1

Re: ** Forged spamming going on
by Dean Anderson 21 Dec '98

21 Dec '98

At 02:13 PM 12/21/1998 -0500, Steven J. Sobol wrote: >The domain was flowers.com, the ISP was Zilker Internet Park in Texas, and >the judge found for the plaintiff. Yeah, right. The "judge" was a county magistrate who found the (california) spammer guilty of "creating a nuiscance" in that county in Texas. (If the spammer had bothered, they would have likely demonstrated that a Texas County Magistrate has no jurisdiction in California) The spammer didn't show, and Zilker won by default. In legal terms, this means the case cannot be used as "case law" or as a precedent in other cases. In laymans terms, it means that the case has no legal usefulness. It didn't prove anything, and I don't think even now, a couple years later, that Zilker ever collected anything, or ever will. If a spammer can be sued for relaying, this particular case does not demonstrate how to do it. Nor should it be used as an example where a spammer was sued for money and lost. This does not mean there is no recourse against relaying. Just that this particular approach isn't it. This was a BS example a year and a half ago, when I pointed out its flaws to you. Yet you keep using it even though you know its BS. The "Just keep spewing" strategy seems to place limits your credibility. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 1