November 1999 - Test - lists.nanog.org

Re: ARIN whois
by Dean Anderson 29 Nov '99

29 Nov '99

I'm all for working with the community. Each time I have, it has turned out that we need to operate relays. Possibly, SMTP AUTH will make unauthenticated relaying unnecessary. I'm still looking into how widely deployed it is on email clients. Its the foolish people who ASSUME that all of the internet is composed of cable modems and the company email server, and the internal company modem bank, all behind a firewall and a VPN who think we don't need to operate relays. Try to take relaying out of sendmail, and see what happens. I'm just foolish enough to tell the junior antispammer league that relaying has a legitimate purpose, and can't be removed. Most other people aren't willing to waste the time with them. I was also foolish enough to think they could think something through without resorting to abusing our servers, and making posts to alt.2600. Yep. I know when I did something wrong. --Dean Around 07:03 PM 11/22/1999 -0500, rumor has it that Greg A. Woods said: >[ On Monday, November 22, 1999 at 17:26:08 (-0500), Dean Anderson wrote: ] >> Subject: Re: ARIN whois >> >> We're up to 80K and rising. 2 big ones. Some smaller ones over >> 5K. Most the rest are under $500. Unless we can pin them to one or a >> small group of people. Then all their attacks are summed. A number of >> small attacks over a short period can then be criminal. This amount >> interests both lawyers and collections companies. > >Dean you're being a libellous idiot. When the judge finds out you left >your front doors wide open with a big flashing neon sign above them >he'll no doubt have a very hard time controlling his laughter; if you >can ever get your case that far, that is. The *real* costs are only >those associated with closing your relays -- not some inflated price >list for services you've invented. > >If you'd try working *with* the community, instead of against it, you'd >be one hell of a lot further along. > >-- > Greg A. Woods > >+1 416 218-0098 VE3TCP <gwoods(a)acm.org> <robohack!woods> >Planix, Inc. <woods(a)planix.com>; Secrets of the Weird <woods(a)weird.com> > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

3 2

Re: ARIN whois
by Dean Anderson 29 Nov '99

29 Nov '99

Around 04:07 PM 11/22/1999 -0600, rumor has it that Joe Shaw said: >The FBI has recently stated that their computer crimes people are entirely >overworked and way behind. So, while they will look into the matter, my >previous experience with the FBI and computer crime shows a decided lack >of interest in crimes that don't involve a high dollar figure for damages >or stolen goods/services except for the purposes of profiling attacks and >doing trend analysis. Unless you're looking at a six figure loss, you >probably won't get far. Thats been my experience too. The problem right now though is most of the boston office is off on Egypt Air. (I didn't know what the agent meant by "newport" at first) Though I have no idea what they are really going to do about that. Tape is pretty clear cut. Everyone is dead. Whats there to figure out? >Your best bet is to find a solution to restrict access to your relays. Would. But there isn't/hasn't been one. Talking with Dan Senie offline about SMTP AUTH. Might be more widely deployed than I knew. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 1

Re: ARIN whois
by Dean Anderson 29 Nov '99

29 Nov '99

These are coming from Mass, Cleveland, Ohio, and Virginia. We use our relays for legitimate business purposes. They are not "accidentally left open". We are not going to close them. We are going to pursue abusers civilly and criminally. The FBI assures me that it does not matter criminally that access comes from international sources. Much of the activity appears to be comming from alleged ANTI-SPAMMERs such as Chris Neill, and Alan Brown and Ron Guillemette who have been inciting attacks against us, posting to alt.2600 and advertising our service. Inciting criminal acts is a criminal act too, I'm pretty sure. We make sure to mention them prominently. --Dean Around 11:18 PM 11/21/1999 -0500, rumor has it that Kai Schlichting said: > >At 09:16 PM 11/21/99 -0500, Dean Anderson wrote: > >>Can someone send me a list of *all* AOL netblocks? ARIN's whois only gives back a handful. >> >>I want to block _all_ AOL netblocks, but its tough to find out what they are. >> >>Thanks to a few malicious, radical antispammers (Chris Neill, Alan Brown, etc) we are getting hit with a large number of criminal mail relays. Mostly coming from AOL addresses. We have about a half dozen individual criminal complaints underway. > >Don't kid us, Dan. Close your fucking relays (not that any of them talk to >my hosts anyhow). If this has to be drummed into your bonehead again: THEY >WILL FIND YOUR RELAYS ON THEIR OWN, AND THEY WILL ABUSE THEM, NO MATTER >HOW LOUD YOU SCREAM. THEY SIT IN CHINA, PAKISTAN AND KOREA, AND THERE IS >NOTHING YOU CAN DO ABOUT THEM SHORT OF CALLING THE WHITEHOUSE AND GETTING >THESE PLACES INVADED. Alternatively, you could come to your senses and >shut the literal front door of your house now that you've finally noticed >the first unsavory characters passing by. A couple years after the rest >of us, no doubt. > >And they won't need ORBS or any other service to locate you, either. >Stop complaining. No more secrets (now that's from Scott Yelich's tagline). > >bye,Kai > >-- >kai(a)conti.nu "Just say No" to Spam Kai Schlichting >Palo Alto, New York, You name it Sophisticated Technical Peon >Kai's SpamShield <tm> is FREE! http://SpamShield.Conti.nu >| | >LeasedLines-FrameRelay-IPLs-ISDN-PPP-Cisco-Consulting-VoiceFax-Data-Muxes >WorldWideWebAnything-Intranets-NetAdmin-UnixAdmin-Security-ReallyHardMath > > > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

17 27

NANOG18 Call for Presentations
by Susan R. Harris 29 Nov '99

29 Nov '99

* * * * * * * * * * * * * * * * * CALL FOR PRESENTATIONS * * NANOG 18 * * San Jose, CA * * Feb. 6 - 8, 2000 * * * * * * * * * * * * * * * * * The North American Network Operators Group (NANOG) will hold its 18th meeting in San Jose, CA between February 6 - 8, 2000. NANOG conferences provide a forum for the coordination and dissemination of technical information related to large-scale (i.e., national/international) Internet backbone networking technologies and operational practices. NANOG meetings, held three times each year, include two days of short presentations, plus afternoon/evening tutorial sessions. Meetings are informal, with an emphasis on relevance to current backbone engineering practices. The conference draws around 500 participants, mainly consisting of engineering staff from large national service providers, and members of the research and education community. Now in its fifth year, NANOG evolved from the NSFNET "regional-techs" meetings, where technical staff from the regional networks met to discuss operational issues of common concern. With the emergence of the commercial Internet, NANOG meetings evolved to include a broader base of providers, network operators, and researchers. NANOG 18 will be hosted by Exodus Communications. For more information about NANOG, conference hotels, schedules, and logistics, see: http://www.nanog.org ------------------------------------------------------------------------------ CALL FOR PRESENTATIONS NANOG invites presentations on backbone engineering, coordination, and research topics. Presentations should highlight issues relating to technology already deployed or soon to be deployed in core Internet backbones and exchange points. Previous meetings have included presentations on: - Backbone traffic engineering - Coordination of inter-provider QoS - Deployment experience with queueing disciplines (CAR, RED) - Inter-provider security and routing protocol authentication - Routing scalability in backbone infrastructures - Security issues for the Internet core - Routing policy specification and backbone router configuration - Building large-scale measurement infrastructure - Cooperative inter-provider caching - Alternatives to hot-potato routing - Recommendations on queue management and congestion avoidance - Experience with differentiated services - Reports from next-generation networks (Internet2, CA*net, etc.) - Inter-domain multicast deployment - Backbone network failure analysis - Inter-exchange point updates Tutorials have covered topics such as: - BGP case studies - MPLS fundamentals - External route selection - IP multicast technologies - Distributed content caching in large IP networks ------------------------------------------------------------------------------ HOW TO PRESENT Submit an informal one- or two-paragraph abstract describing the presentation in email to nanog-support(a)nanog.org. The deadline for proposals is December 15, 1999. Abstracts will be accepted after December 15 on the basis of timeliness and quality of the presentation. Presenters will be notified of acceptance by January 10, 2000. ------------------------------------------------------------------------------

1 0

Re: What happened to the hosting infrastructure maps
by mpw＠anyweb.ch 29 Nov '99

29 Nov '99

Henry, try this: http://www.bbn.com/infrastructure/us_host.htm cheers Mike --------------------------------------------------------------------------- Mike Portworsnick Network Engineer AnyWeb AG CCIE# 4985 Switzerland mpw(a)anyweb.ch --------------------------------------------------------------------------- "Henry R. Linneweh" To: nanog <nanog(a)merit.edu> <linneweh@conce cc: ntric.net> Subject: What happened to the hosting infrastructure maps Sent by: owner-nanog@mer it.edu 11/29/99 04:46 AM Please respond to linneweh for the USA and Europe this link is dead http://www.bbnplanet.com/products/maps/us_host.htm -- Thank you; |--------------------------------------------| | Thinking is a learned process so is UNIX | |--------------------------------------------| Henry R. Linneweh

1 0

Locked out?
by Sean Donelan 28 Nov '99

28 Nov '99

A person sent me a pointer to the happenings at the Everquest data center on Saturday. Yet another person learns the joy of electronic door systems :-) http://everquest.station.sony.com/network_fs.html Another commonly overlooked system is a building's paging system. They are often handled by different groups, and aren't included in the systems backup plan. Fortuantely most people figure out workarounds quickly. Yep, I found out the hard way too.

1 0

What happened to the hosting infrastructure maps
by Henry R. Linneweh 28 Nov '99

28 Nov '99

for the USA and Europe this link is dead http://www.bbnplanet.com/products/maps/us_host.htm -- Thank you; |--------------------------------------------| | Thinking is a learned process so is UNIX | |--------------------------------------------| Henry R. Linneweh

1 0

Bell Atlantic FCC outage report available now
by Alex Rubenstein 28 Nov '99

28 Nov '99

Does anyone find it even remotely interesting that Bell Atl had an outage, performing a similar upgrade to a similar piece of equipment (Alcatel IMTN), only three days earlier in Philadelphia? http://www.fcc.gov/Bureaus/Engineering_Technology/Filings/Network_Outage/19… For once, I wish someone in the press would pick up how much the telco's suck, and try to hide significant events like this; especially this north jersey one where they said only three counties were affected! Bah! The entire LATA was affected! ---------- Forwarded message ---------- Date: 24 Nov 1999 13:13:16 -0800 From: Sean Donelan <sean(a)donelan.com> To: nanog(a)merit.edu Subject: Bell Atlantic FCC outage report available now Ah, I see my friends at the FCC are reading this list. The Bell Atlantic FCC outage report for the Nov 23 New Jersey outage has been scanned, and is online at the FCC web site. http://www.fcc.gov/Bureaus/Engineering_Technology/Filings/Network_Outage/19… --------------------------------------------------------------------- To unsubscribe, e-mail: internal-unsubscribe(a)nac.net For additional commands, e-mail: internal-help(a)nac.net

5 6

Voluntary outage report, who gets blamed
by Sean Donelan 28 Nov '99

28 Nov '99

Robert Cannon <rmcannon(a)mail.com> writes: >Focus Group III of NRIC is the Focus Group working on this issue. >Subcommittee 2 is looking at future considerations. This is the >subcommittee that came up with the recommendation to have a trial >period of ISP outage reporting. Of course, some large companies will continue their current practice of keeping bad news quiet. But my intent hasn't been to point out how bad some companies are. My concern is the wild, unregulated Internet gets blamed for a lot of outages which really aren't "Internet" outages. In the last two weeks I've only noticed three multi-hour multi-ISP affecting incidents: 1) a misconfigured router in Dallas spewed bogus routing information, 2) an ILEC's DACS lost its configuration in New Jersey, and 3) a MAE had a loopback which caused "network congestion" and routes to flap for a few hours. There were other problems, a couple of fiber cuts and power failures, but they didn't seem to cause problems for multiple ISPs. Interestingly enough problem 1 affected multi-homed networks more than single homed networks, which happen also to house the most popular web services. With so much hype this month about web retailers and the christmas shopping season, some very high profile sites have been hit by various problems and covered by the news media. However, just because a credit card processor goes down, and many web sites were shutdown, does not mean its an "Internet" problem. Its a credit card processor problem. As I poked around several of the problems over the last couple of weeks, I found most web site outages related to "back-end services." Problems with their database software, disk and server farms, and the ever popular "operator error." Yes, some network problems happened. But ISPs are getting pretty good at the packet delivery stuff. The ISP can usually deliver more packets than the server can handle :-) Perhaps surprising, but since some folks are concerned e-commerce is where the money is, none of the problem e-commerce web sites with whom I spoke or read about attributed any down time to criminal or "cracker" activity. But it may be a self-selecting group. Maybe the reason some people wouldn't answer my questions was because their outages did involve suspicious activity.

1 0

Re: ARIN whois
by Dean Anderson 27 Nov '99

27 Nov '99

Option 3. Invoice them for services. Send a demand letter for services rendered, and tell them to refrain from further relaying until payment terms are arranged. Send the letter certified return receipt to the corporate agent. If the services rendered exceed $5000, report the act to the FBI. To make an effective criminal complaint that can be prosecuted, you need to make efforts to collect the money. After the demand letter, engage a lawyer to sue them, or a collection agency to collect the money. Before ORBS and the antispammers started inciting attacks this summer, spammers did not find our service. Anyone that runs an active probe service on a leased line would be discovered, and shutdown. You aren't going to probe much of the internet on a dialin line. We know how to stop people on static IP addresses. Criminal relaying depends on a service like ORBS to collect and disseminate information on where to find a relay. This is why we ask all operators to block traffic to ORBS, which has recently changed addresses to 202.36.147.16. We had blocked 202.36.148/24. I just noticed they changed IP addresses to avoid filters. These are our new filters: access-list 104 deny ip 202.36.148.5 0.0.0.255 any access-list 104 deny ip 202.36.147.16 0.0.0.255 any Slippery. But these two /24's appears to be all that is swipped to them. I want to offer my heartfelt thanks to all operators who have blocked them so far. This holiday weekend has certainly been better. --Dean Around 10:42 AM 11/27/1999 -0600, rumor has it that Gene Black said: >That's why you engineer around the problem to insure that your >legitimate business can continue when you shut down your relays. If you >leave them open long enough, the spammers will eventually find you, and >when they do, you're only going to have two options left: > >1. Close the relays > >or > >2. Quit offering any type of SMTP services. > >This is what prompted us to close our relays a few years back. The sheer >amount of spam coming through was so massive as to effectively shut down >our mail servers and eat a very significant portion of our bandwidth. >Users won't tolerate outages like that - and shouldn't have to. The >majority of it was coming in from remote places overseas as well - not >the sort of thing that you can easily pursue legally if you can pursue >it at all. > >Just my two cents... > > >"Roeland M.J. Meyer" wrote: >> >> You have just explained why you are a SysAdmin and not a business operator. >> The issue is not that closing them is difficult. The issue is that it will >> ALSO close down a legitimate business. >> >> > -----Original Message----- >> > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of >> > Robert Gash >> > Sent: Monday, November 22, 1999 12:45 PM >> > To: Dean Anderson >> > Cc: nanog(a)merit.edu >> > Subject: Re: ARIN whois >> > >> > >> > >> > Dean, perhaps I am not fully understanding your logic behind >> > not closing >> > your relays. I have been a systems administrator for 4 years >> > and I have >> > not ever found an application where I needed to leave my SMTP >> > relays open >> > to the world. I do not doubt that you have legitimate >> > business purposes >> > in mind when opening your relay, but at some point you must >> > decide that >> > legal action will be too slow to fix anything and that it >> > might be a good >> > time to close your relays to aleviate other problems. Simply >> > saying "I >> > shouldn't need locks on my doors because everyone should be >> > honest and never come into my house without my permission," >> > dosen't cut it >> > in this world, and I am quite sure that you have >> > locks on every portal to your house, so why should your SMTP >> > server be any >> > different? Taking such a stance and refusing to close your >> > relays is simply a foolish decision. > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 1