November 1999 - Test - lists.nanog.org

Postmaster notify: Host unknown (Name server: servertest.com: host not found)
by Dean Anderson 22 Nov '99

22 Nov '99

Look. Just got 30 of these. First international relay. Coincidence that it happened today? Or is it more likely the culprit is on this list? That is, a malicious antispammer. Actually, we were probed by someone at dansk telecom a few weeks ago. From a non-customer machine. Hmm. --Dean >X-Persona: <Av8> >>From MAILER-DAEMON Mon Nov 22 16:53:46 1999 >Date: Mon, 22 Nov 1999 16:53:46 -0500 (EST) >From: Mail Delivery Subsystem <MAILER-DAEMON> >To: postmaster >Subject: Postmaster notify: Host unknown (Name server: servertest.com: host not found) >Auto-Submitted: auto-generated (postmaster-notification) > >The original message was received at Mon, 22 Nov 1999 16:53:46 -0500 (EST) >from localhost > > ----- The following addresses had permanent fatal errors ----- ><mail_from(a)servertest.com> > > ----- Transcript of session follows ----- >550 <mail_from(a)servertest.com>... Host unknown (Name server: servertest.com: host not found) >Reporting-MTA: dns; odie.av8.com >Received-From-MTA: DNS; ip111.arcnxr5.ras.tele.dk >Arrival-Date: Mon, 22 Nov 1999 16:53:46 -0500 (EST) > >Final-Recipient: RFC822; mail_from(a)servertest.com >Action: failed >Status: 5.1.2 >Remote-MTA: DNS; servertest.com >Last-Attempt-Date: Mon, 22 Nov 1999 16:53:46 -0500 (EST) >Return-Path: <MAILER-DAEMON> >Received: from localhost (localhost) > by odie.av8.com (8.9.3/8.8.5) with internal id QAA28557; > Mon, 22 Nov 1999 16:53:46 -0500 (EST) >Date: Mon, 22 Nov 1999 16:53:46 -0500 (EST) >From: Mail Delivery Subsystem <MAILER-DAEMON> >Message-Id: <199911222153.QAA28557(a)odie.av8.com> >To: <mail_from(a)servertest.com> >MIME-Version: 1.0 >Content-Type: multipart/report; report-type=delivery-status; > boundary="QAA28557.943307626/odie.av8.com" >Subject: Returned mail: Host unknown (Name server: servertest.com: host not found) >Auto-Submitted: auto-generated (failure) > >The original message was received at Mon, 22 Nov 1999 16:53:45 -0500 (EST) >from ip111.arcnxr5.ras.tele.dk [195.249.99.111] > > ----- The following addresses had permanent fatal errors ----- ><rcpt_to(a)servertest.com> > > ----- Transcript of session follows ----- >550 <rcpt_to(a)servertest.com>... Host unknown (Name server: servertest.com: host not found) >Reporting-MTA: dns; odie.av8.com >Received-From-MTA: DNS; ip111.arcnxr5.ras.tele.dk >Arrival-Date: Mon, 22 Nov 1999 16:53:45 -0500 (EST) > >Final-Recipient: RFC822; rcpt_to(a)servertest.com >Action: failed >Status: 5.1.2 >Remote-MTA: DNS; servertest.com >Last-Attempt-Date: Mon, 22 Nov 1999 16:53:46 -0500 (EST) >Return-Path: <mail_from(a)servertest.com> >Received: from server-test (ip111.arcnxr5.ras.tele.dk [195.249.99.111]) > by odie.av8.com (8.9.3/8.8.5) with SMTP id QAA28555 > for <rcpt_to(a)servertest.com>; Mon, 22 Nov 1999 16:53:45 -0500 (EST) >Date: Mon, 22 Nov 1999 16:53:45 -0500 (EST) >From: mail_from(a)servertest.com >Message-Id: <199911222153.QAA28555(a)odie.av8.com> >Subject: SERVER_TEST > >TEST MESSAGE > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 1

Re: ARIN whois
by Derek J. Balling 22 Nov '99

22 Nov '99

No offense to all, but you are ALL wasting your time trying to convince Dean through logic on this topic. We've all been round and round the same discussions on the anti-spam mailing lists, and Dean continues to insist that he MUST run open relays. Dean appears to be completely impervious to logic, so don't waste your time sending it his way. :) D At 04:07 PM 11/22/99 -0600, Joe Shaw wrote: >What "legitimate business purposes" necessitate leaving SMTP relays open >to the world? While I think spammers shouldn't be spamming, I think >you'd find it better to do what you can to stop them from spamming via >means you control, i.e. your servers, as opposed to going through the >FBI. > >The FBI has recently stated that their computer crimes people are entirely >overworked and way behind. So, while they will look into the matter, my >previous experience with the FBI and computer crime shows a decided lack >of interest in crimes that don't involve a high dollar figure for damages >or stolen goods/services except for the purposes of profiling attacks and >doing trend analysis. Unless you're looking at a six figure loss, you >probably won't get far. > >Your best bet is to find a solution to restrict access to your relays. > >-- >Joseph W. Shaw - jshaw(a)insync.net >Free UNIX advocate - "I hack, therefore I am." > >On Mon, 22 Nov 1999, Dean Anderson wrote: > > > > > These are coming from Mass, Cleveland, Ohio, and Virginia. > > > > We use our relays for legitimate business purposes. They are not > "accidentally left open". > > > > --Dean

3 2

History question, Morris worm
by Sean Donelan 22 Nov '99

22 Nov '99

>and what's more fun, when they come back up on jan 3 or whatever, they will >have whatever y2k problems then. I recall after the Morris worm hit the Internet, reading a report sites which unplugged their ARPANET connection were down longer than sites which remain connected and got repair information over the net. Does anyone else remember that, and knows a citation for the report (or news story) I'm recalling? Thanks.

4 3

Re: History question, Morris worm
by Dean Anderson 22 Nov '99

22 Nov '99

I don't have paper or email documentation. I know what I know because the friend was Andy Sudduth. He was the first postmaster at the OSF. I came to work at the OSF a several months after the worm was released, and heard the story from the other Computer Facilities people who were there at the time. I think that Sudduth testified at the trial, but he had left the OSF by the time the case went to trial. So I think this was all discussed in the court documents of Morris' prosecution. Those should be public domain. --Dean At 06:24 PM 11/21/1999 -0800, George Herbert supposedly said: > >I have printouts of all the Usenet traffic which was Worm-related >(not 100%, but close) over the few months immediately after. >I don't recall that story coming out. That doesn't mean it >didn't happen, but I'd like to see some documentation. > > >-george william herbert >gherbert(a)crl.com > > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 0

Re: History question, Morris worm
by George Herbert 21 Nov '99

21 Nov '99

I have printouts of all the Usenet traffic which was Worm-related (not 100%, but close) over the few months immediately after. I don't recall that story coming out. That doesn't mean it didn't happen, but I'd like to see some documentation. -george william herbert gherbert(a)crl.com

1 0

Re: History question, Morris worm
by Dean Anderson 21 Nov '99

21 Nov '99

I don't have a reference, but I suspect that what you are thinking of is that CSNet shutdown very early, preventing the innoculation message (sent by Morris via his friend from the OSF which was a CSnet customer) from getting out for 3 days. The worm was <probably> released from MIT, and Morris <probably> went across the street to the OSF to see his friend from his undergraduate days at Harvard about the problem. They composed and sent out a message describing the worm, its accidental escape, what it exploited, and how to stop it. But CSnet had already shutdown and the message stayed in queue at the OSF for 3 days. Much of the panic was due to the lack of communications about the nature of what was going on. This was made worse by sites shutting down. Morris' message didn't get out for 3 days. By then, Spafford and others had decompiled and analyzed the program, figured out by themselves how to stop it, and were making fun of it. And they were pissed. Due to lack of information, they assumed it was hostile. If the innoculation message had gotten out early on, fears of a hostile attack would have been allayed, and people would not have responded as though under hostile attack. So, I suppose CSnet bears some responsibility for the ensuing panic, and Morris' subsequent prosecution. --Dean Around 03:50 PM 11/21/1999 -0800, rumor has it that Sean Donelan said: > >>and what's more fun, when they come back up on jan 3 or whatever, they will >>have whatever y2k problems then. > >I recall after the Morris worm hit the Internet, reading a report sites >which unplugged their ARPANET connection were down longer than sites which >remain connected and got repair information over the net. > >Does anyone else remember that, and knows a citation for the report (or >news story) I'm recalling? > >Thanks. > > > > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 0

Re: ISP Address Allocation
by Aleksi Suhonen 20 Nov '99

20 Nov '99

Hello, Let me guess: you want to make demographics of different ISPs' users for web advertising purposes and that is why you need to know which IP belongs to which ISP. RIPE database licence says you can't use their data for that purpose and I would be surprised if ARIN (or any of the others) allowed it. (Just as a reminder.) -- Aleksi Suhonen

1 0

Re: ARIN to Allocate from 64.0.0.0/8
by Aleksi Suhonen 20 Nov '99

20 Nov '99

Hello, Richard Steenbergen and Kai Schlichting discussed how this new allocation policy affects ingress filtering. I was disgruntled too when I heard of it for the same reason. The way I fixed it was that I just changed the filter from 64.0.0.0/2 to 96.0.0.0/3. It isn't as perfect though of course. -- Aleksi Suhonen

1 0

Some networks will be down on Jan 1
by Sean Donelan 20 Nov '99

20 Nov '99

A person forwarded me this information. Whether Y2K affects anything, sites plan to shutdown over New Year's. In case you get trouble calls, you won't be able to send e-mail to places like Cornell. http://www.cit.cornell.edu/y2k/y2kdown.html Fortunately they are leaving the phone switch up, assuming you got their phone number ahead of time. Why do I get this sinking feeling there will be a lot of confusion over what is up, what is down, what is supposed to be down, and what is supposed to be up. And contacting their upstream usually isn't much help. The last time Tufts and Boston were down, their upstream didn't respond for over 24 hours. And then only to say, everything looked ok to them a day later.

2 1

Merit IRR Service Announcement
by Gerald Andrew Winters 19 Nov '99

19 Nov '99

Merit will be suspending RIPE-181 IRR service tomorrow morning, November 20, at 7am EST for routine system maintenance. The downtime is expected to last for less than an hour. During this period RIPE-181 queries to whois-rpsl.radb.net will be unavailable. Database updates to auto-ripe181(a)radb.net may be submitted but expect a delayed response until the maintenance is complete. Our primary production RPSL service will be unaffected. If you have any questions please direct them to db-admin(a)radb.net. Jerry Winters IRRd Team

1 0