August 2000 - Test - lists.nanog.org

Re: surge in spam email (fwd)
by J.D. Falk 11 Aug '00

11 Aug '00

On 08/11/00, kingp(a)mindspring.net wrote: > On Fri, 11 Aug 2000, J.D. Falk wrote: > > > How many years have we been attempting technical solutions? > > Five, six? > > Does anal electrocution count as a technical soloution? Not unless we can find a way to have it automagically happen whenever somebody sends spam.... -- J.D. Falk "Laughter is the sound Product Manager that knowledge makes when it's born." Mail Abuse Prevention System LLC -- The Cluetrain Manifesto

1 0

The Cidr Report
by Tony Bates 11 Aug '00

11 Aug '00

This is an auto-generated mail on Fri Aug 11 12:00:00 PDT 2000 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 11Aug00 0) General Status Table History ------------- Date Prefixes 040800 83610 050800 83840 060800 83427 070800 83701 080800 83736 090800 83783 100800 83825 110800 83938 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- *** Bogus 65.0.0.0/14 from AS6172 *** Bogus 65.65.136.0/23 from AS701 *** Bogus 217.8.32.0/20 from AS3220 *** Bogus 217.8.160.0/20 from AS8246 *** Bogus 217.9.224.0/20 from AS13124 *** Bogus 220.10.56.0 from AS3215 AS Summary ---------- Number of ASes in routing system: 8121 Number of ASes announcing only one prefix: 4577 (2540 cidr, 2037 classful) Largest number of cidr routes: 867 announced by AS701 Largest number of classful routes: 1081 announced by AS701 1) Gains by aggregating at the origin AS level --- 11Aug00 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS271 435 154 281 64.6% BCnet Backbone AS1221 594 435 159 26.8% TELSTRA-AS AS7046 431 293 138 32.0% COQUI-NET PRTC Internet AS9706 155 26 129 83.2% Pusan Metropolitan City Office of AS2609 128 8 120 93.8% EUnet-TN AS7657 309 200 109 35.3% The Internet Group Limited AS1785 472 364 108 22.9% AppliedTheory Communications AS9304 121 15 106 87.6% Hutchcity AS9269 160 57 103 64.4% Hong Kong CTI AS7545 156 57 99 63.5% TPG Internet Pty Ltd AS6429 210 116 94 44.8% FirstCom Internet AS7496 126 38 88 69.8% Power Up AS577 260 174 86 33.1% Bell Backbone AS174 551 465 86 15.6% Performance Systems International AS4293 331 246 85 25.7% Internal ASN for C&W AS3908 253 175 78 30.8% Supernet, Inc. AS705 322 247 75 23.3% ALTERNET-AS AS1727 167 94 73 43.7% MRMS-WEST AS6595 124 55 69 55.6% DODDSEUR AS816 340 272 68 20.0% UUNET Canada (ASN-UUNETCA-AS4) AS724 214 149 65 30.4% DLA-ASNBLOCK-AS AS4755 171 107 64 37.4% Videsh Sanchar Nigam Ltd. India AS5106 98 36 62 63.3% AADS-COLUMBUS AS3749 122 60 62 50.8% TECNET AS7018 553 494 59 10.7% AT&T WorldNet Service Backbone AS701 1081 1022 59 5.5% Alternet AS3602 295 239 56 19.0% Sprint Canada Inc. AS4740 323 270 53 16.4% Ozemail Pty Ltd (ASN-OZEMAIL) AS11252 90 37 53 58.9% Idaho State University AS16758 62 10 52 83.9% UNKNOWN For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

Operational focus
by Susan R. Harris 11 Aug '00

11 Aug '00

Hi everyone - given the recent volume of email regarding spam, this is just a reminder that the NANOG email list is for discussion of ISP engineering and operational topics. Other lists focus on spam specifically, including: SPAM-L (LISTSERV(a)PEACH.EASE.LSOFT.COM) spamtools(a)abuse.net For information about subscribing to these lists, please see: http://www.nanog.org/isp.html#spam Please see the NANOG email list AUP for more information: http://www.nanog.org/aup.html Thanks for your cooperation in helping to maintain the focus of the NANOG email list. Susan R. Harris, Ph.D. Merit Network/Univ. of Mich. (734) 936-2100

2 1

An example
by Roeland M.J. Meyer 11 Aug '00

11 Aug '00

I post some negative messages about ORBS and RBL and look what happens! Gee, isn't it co-incidental that my mailer is now blocked? It sounds like straight-up intimidation actions to me. If this is the action of a responsible anti-spam fanatic then it is an even greater indictment of the entire RBL/ORBS movement. The hostname is right, DNS is healthy, including my ORSC root-zone servers, and I am running current sendmail with anti-relay active. Gee, maybe they're making a statement ...ya think? That's alright, woods just hit my kill-file anyway >plonk< But, this seriously indicates that this ORBS/RBL think is getting way out of hand. Typical vigilante pattern. > -----Original Message----- > From: Mail Delivery Subsystem [mailto:MAILER-DAEMON@mhsc.com] > Sent: Thursday, August 10, 2000 11:46 PM > To: rmeyer(a)mhsc.com > Subject: Returned mail: Service unavailable > > > The original message was received at Thu, 10 Aug 2000 23:46:01 -0700 > from peregrin.lvrmr.mhsc.com [199.108.175.234] > > ----- The following addresses had permanent fatal errors ----- > <woods(a)weird.com> > > ----- Transcript of session follows ----- > ... while talking to mail.weird.com.: > >>> HELO condor.lvrmr.mhsc.com > <<< 550-You are not permitted to send mail from > condor.lvrmr.mhsc.com[199.108.175.226]. > <<< 550-All SMTP connections have been blocked from that address, > <<< 550-possibly because it has been listed in one of the many RBLs, > <<< 550-or possibly because your DNS is broken or your > hostname is wrong. > <<< 550- > <<< 550-Please forward this message to your own LOCAL > postmaster and ask > <<< 550-them to contact us regarding this issue. > <<< 550- > <<< 550-Postmaster(a)[199.108.175.226]: Please contact > <postmaster(a)most.weird.com> > <<< 550-(via an unblocked server of course!) for exact > details on why your > <<< 550-mailer's connection was rejected. You must include > your IP number > <<< 550 given above in order to receive an accurate answer. > 554 <woods(a)weird.com>... Service unavailable >

4 4

RE: Can someone test AOL's mx servers for me...
by Karyn Ulriksen 11 Aug '00

11 Aug '00

Please. Please. Everyone. Thank you. But you can all go home now! I think I've received about 50 messages now about the RFC compliant '<>' usage and have got the message. So now I know ... it's right up there with not using CNAMEs for MX records ... they use to work once upon a time in a more forgiving internet (whenever that was) or at least a less RFC compliant internet. But I can take a hint (all 50!). And I have since figured out what the flippin' other problem with the mail was. Thank you all. Karyn -----Original Message----- From: Mark Brown To: Karyn Ulriksen Sent: 8/11/00 3:47 AM Subject: Re: Can someone test AOL's mx servers for me... On Thu, Aug 10, 2000 at 06:04:56PM -0700, Karyn Ulriksen wrote: > I'm seeing some wierd errors when emailing AOL. The response for the "MAIL > FROM: user(a)domain.com" is a '501 syntax error'. Is that exactly what you are typing? In that case AOL is being perfectly reasonable - the correct syntax is "FROM:<user(a)domain.com>" (without quotes) and similarly for RCPT TO. The <> are mandatory. -- Mark Brown mailto:broonie@tardis.ed.ac.uk (Trying to avoid grumpiness) http://www.tardis.ed.ac.uk/~broonie/ EUFS http://www.eusa.ed.ac.uk/societies/filmsoc/

2 1

RE: spammers will move offshore?
by Morgan Dollard 11 Aug '00

11 Aug '00

Im confuesed about the origin of this discussion, since i mised the kick off, but i see way too much concern over spam, we've all been receiving junk mail in our Mailboxes (paper plastic stuff) for years, and has any1 ever been sued or banned from the US postal service for it? Im gona add real quick that im not american, and quicky disagree with the fact that americans arent liked, its jsut that the fact that you try to control the rest of the world, INCLUDING, the internet, makes people think twice. the internet belongs to no one, and child pornography might be legal in some weird country in the world, but thats not the issue here. SPAM, typically unsolicited mail, is no differnet from having jehova witnesses knock at your door, or one of them salesman try to sell u insurance a house a boat, the moon, hell his underwear even. Do u actually SUE that guy for it? i agree that spam is anoying, even mailign lsitst like this one get picked up email addresses, and that there should be something done to fix it, but how can u prosecute people on the internet when u allow the same practice to go unbothered in real life. Morgan Dollard NSC Technology -----Original Message----- From: Derek J. Balling [mailto:dredd@megacity.org] Sent: Thursday, August 10, 2000 15:36 To: Barry Shein; nanog(a)merit.edu Subject: Re: spammers will move offshore? At 12:21 AM -0400 8/10/00, Barry Shein wrote: >Where did this dopey "spammers will just move offshore" idea come >from? Me. >The legal term is "agency", hire someone to do something illegal to >promote your US business and you're in trouble. But what if you don't KNOW that they're doing something illegal? e.g., you hire Joe's Marketing Company, and without your knowledge Joe's Mktg Co spams people. I'm no lawyer, but it seems silly that you'd be liable for stuff you weren't even aware of (or perhaps that you had told them not to do but they did anyway, who knows). >Besides there are a million cooperating treaties between major nations >and, etc... For major criminal activities like kiddie porn and drug smuggling? Sure. For spam complaints? You'd probably get laughed at all the way from one side of the globe to the other (Sadly). >Do people really believe you can open a mail order crack house in >the UK and sell to US customers...??? No. >Besides, that's making the best the enemy of the good, it's not like >spamming is some multibillion dollar biz that's going to open glass >and steel skyscraper complexes in Afgahnistan. > >It's the same pimply sociopaths who smurf, junk fax (do you find >yourself getting lots of offshore junk faxes???), etc. > >Make it illegal in the US, assume they'll make it illegal in other >countries which don't want to see their internet access disrupted >because they're rogue countries and blocked or severely whitelisted. Maybe you haven't been keeping track, but us Merkins aren't really well-liked or respected outside the borders of the land we live in. Other countries won't "cave in" that easily, methinks. >It's a heckuva lot more promising than whining that spammers might >launch their own space stations to spam from. Who said anything about space programs? ;-) >Cripes, as it stands you can't even stop that schmuck in Georgia who >has been mass spamming copier toner supplies for years. You can't >touch him (obviously, he keeps doing it and putting his name and 800 >number in the spam.) > >He ain't going to Libya to operate his toner business any time >soon...trust me on this. But why bother he's perfectly safe in >Georgia. My point exactly... when his lucrative source of income is gone, you don't think he'll move the operation somewhere that he can continue to make money? (I must assume its lucrative or he wouldn't still be wasting time on it) >It's just like the junk fax stuff, just make it illegal and no one >will hire the spammers except for a few miscreants who can be dealt >with. Just like that's working for crack sales? ;-) >And spammers won't be able to incorporate (limit liability), open bank >accounts, solicit investment money, get loans, business licenses, >etc. You can't do those kinds of thing for illegal activities. It's not like you put down "spamhaus" on your articles of incorporation. ;-) D Disclaimer ---------- This email and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. This communication represents the originator's personal views and opinions, which do not necessarily reflect those of the NSC Group. If you are not the original recipient or the person responsible for delivering the email to the intended recipient, be advised that you have received this email in error, and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. If you received this email in error, please immediately notify administrator(a)nscglobal.com.

12 12

RIPE-181 server to be decommissioned
by gerald＠merit.edu 10 Aug '00

10 Aug '00

As many of you know, Merit began a production RPSL service on 11/1/99. RIPE-181 and RPSL coexisted on our production server until 1/1/00; after that date, RIPE-181 updates were no longer accepted and only queries were available on the special RIPE-181 server. Merit will now complete the final stage of its transition to RPSL by decommissioning its RADB RIPE-181 server on Wednesday, August 23, between 5:00-8:00 A.M. EDT. Query activity has been extremely light on the RIPE-181 server and the remaining users have been notified by private email about the termination of this service. This change will not impact our production RPSL service. Please send your questions and comments to db-admin(a)radb.net. IRRd Team --Gerald Winters

1 0

Can someone test AOL's mx servers for me...
by Karyn Ulriksen 10 Aug '00

10 Aug '00

I'm seeing some wierd errors when emailing AOL. The response for the "MAIL FROM: user(a)domain.com" is a '501 syntax error'. I'm not sure if they are messed up or if we somehow ended up on their bunk list... --------------------------------------------------------------------- Best regards, Karyn Ulriksen Director of Network Operations PublicHost, A SiteStream Company 22 Mauchly, Suite 200 Irvine, California 92618 USA Phone: (949) 743-2000 email: kulriksen(a)publichost.com URL: http://www.publichost.com

1 0

Re: surge in spam email (fwd)
by multics＠ruserved.com 10 Aug '00

10 Aug '00

Forwarded message: [snip] > No, we need a legislative approach, with some technical support to > help increase the likelihood that spammers who break the law will get > caught. But first it has to be illegal, or else it's all for naught. > > Put it this way: I consider my house locked up even if I do have glass > windows, and even if glass is rather easy to break. > > If it were legal for a person of ill intent to break the glass to get > into my house to rob me the first approach would not in my mind be to > board up all the glass unless I really lived in some mad max anarchy. > > I'd first want to see it made illegal to break into my property. [snip] > -Barry Shein IMO, spam is already illegal, the problem is getting any police agency to take action. It's theft of service of any system that's relay raped and it's harasssment of the people being targeted as well as theft of service. It takes resources to bounce all those no longer existing email addresses and then even more processing to end up bouncing the bounces. I end up going into our mail spool every now and then and deleting all the bounced spam that can't be delivered. A royal pain in the neck when the outgoing spool is 90% to 100% spam bounces. -- Richard Shetron multics(a)ruserved.com multics(a)acm.rpi.edu NO UCE What is the Meaning of Life? There is no meaning, It's just a consequence of complex carbon based chemistry; don't worry about it The Super 76, "Free Aspirin and Tender Sympathy", Las Vegas Strip.

1 0

spammers will move offshore?
by Barry Shein 10 Aug '00

10 Aug '00

Where did this dopey "spammers will just move offshore" idea come from? The legal term is "agency", hire someone to do something illegal to promote your US business and you're in trouble. Assuming the point of sending spam to US addresses is to sell some product in the US, which means you have a business presence in the US, which means you're subject to US laws. etc. Besides there are a million cooperating treaties between major nations and, etc... Do people really believe you can open a mail order crack house in the UK and sell to US customers...??? Besides, that's making the best the enemy of the good, it's not like spamming is some multibillion dollar biz that's going to open glass and steel skyscraper complexes in Afgahnistan. It's the same pimply sociopaths who smurf, junk fax (do you find yourself getting lots of offshore junk faxes???), etc. Make it illegal in the US, assume they'll make it illegal in other countries which don't want to see their internet access disrupted because they're rogue countries and blocked or severely whitelisted. It's a heckuva lot more promising than whining that spammers might launch their own space stations to spam from. This sort of int'l legal stuff is hardly unique to spam or even the internet. Cripes, as it stands you can't even stop that schmuck in Georgia who has been mass spamming copier toner supplies for years. You can't touch him (obviously, he keeps doing it and putting his name and 800 number in the spam.) He ain't going to Libya to operate his toner business any time soon...trust me on this. But why bother he's perfectly safe in Georgia. It's just like the junk fax stuff, just make it illegal and no one will hire the spammers except for a few miscreants who can be dealt with. And spammers won't be able to incorporate (limit liability), open bank accounts, solicit investment money, get loans, business licenses, etc. You can't do those kinds of thing for illegal activities. -- -Barry Shein Software Tool & Die | bzs(a)world.std.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo*

3 2