May 2001 - Test - lists.nanog.org

cnn.com name servers all in one AS
by Daniel Senie 27 May '01

27 May '01

Lookup on cnn.com reveals a response of 4 name servers: NS-01A.ANS.NET 199.221.47.7 NS-01B.ANS.NET 199.221.47.8 NS-02A.ANS.NET 207.24.245.179 NS-02B.ANS.NET 207.24.245.178 All 4 of these are in AS 1673. This situation has existed for a long time. CNN has their actual servers multihomed, and (I think) uses Akamai for content delivery. However, the core name servers remain on a single AS, so any routing problem within that AS, or peering issues affecting that AS will result in CNN.COM disappearing. Microsoft appears to have spread their DNS servers across multiple ASs after their disappearing act a while back. Though I've seen issues with CNN.COM reachability affected by ANS.NET issues as far back as 3 years ago, their DNS strategy remains unchanged. ----------------------------------------------------------------- Daniel Senie dts(a)senie.com Amaranth Networks Inc. http://www.amaranth.com

2 1

RE: Stealth Blocking
by Roeland Meyer 27 May '01

27 May '01

> From: David Schwartz [mailto:davids@webmaster.com] > Sent: Wednesday, May 23, 2001 4:18 PM > > > I'm getting seriously confused here. I thought that the > > open-relay issue was irelevent to MAPS. > > No. I hate to be pendantic here, but from your own email and what other sources have told me, this is inaccurate. MAPS does NOT do pre-emptive open-relay testing. I consider this to be a very important distinction. If I thought this was the case, I would stop using MAPS five minutes ago. > > That MAPS only black-holed confirmed SPAM > > sites (a little > > tougher, but more granular, charter). > > Yes, but open relays can easily become confirmed SPAM > sites. All that has > to happen is one spammer chooses to use that particular open relay. That is orthogonal to the point. > I hope this qualifies as clarification. This was actually the type of post that was muddying the waters quite severely. So no, it does not qualify as clarification. From other sources, and what I originally knew to be true, if MAPS blocks an open-relay, it is entirely incidental to the fact that it was a PROVEN spam origination point. Open relays that are NOT used by spammers never make it into MAPS. Ergo, a site's open-relay status is irrelevent to MAPS. I'm only interested in spanking spammers, not innocents, at any clue level. In the PURE war, one ONLY shoots confirmed bad-guys and has ZERO collateral damage.

13 21

Re: Strange IPSEC activity over UUNet..
by Andy Bradford 27 May '01

27 May '01

Thus said "Craig Holland" on Fri, 25 May 2001 11:01:24 PDT: > have any problems. Then a couple of days ago, my Ricochet connection > stopped working. The only common denominator is any connection that passes > through UUNet/AlterNet doesn't work. Crazy? I dialup to a Telia pop, no I can confirm that there are problems when routing IPSEC traffic through the UUNet/AlterNet networks. At work, I have setup VPNs between our main corporate offices using FreeS/Wan and the setup run without problems for months. Then a few months ago, the routes that were directing the traffic through the broadwing.net network switched to route through UUNet/AlterNet---this essentially killed all VPN traffic. We have been working with our upstream provider to discover what the problem is, but have not yet been successful at determining the problem. > problem. I dial up to a WorldCom POP, no problem. I connect with a Ricochet > (which goes through UUNet in this case)...broken. I dialup to a UUNet > pop...broken. I don't get it. Yep, same for us. Everything is fine until the route goes through UUNet/AlterNet, at which point it drops to almost nothing. > The client reports that it is receiving fragmented packets, and that it > doesn't have the other fragment in its cache. Its almost like the packets > are getting fragmented, and then some of those fragments are getting lost. This also sounds familiar, but I can't confirm this much yet. This basically means that all the packets will have to be retransmitted, however, it only does that intermittently. I have monitored TCP traffic closely and it seems that the Window Size never changes, and in fact, the outgoing queue for traffic on the port (as displayed with netstat -vatn on linux) is very high and very close to the Window Size. In addition, I am seeing a few TCP retransmits of the packets, so apparently something is taking a long time to ACK. Eventually, the stream stalls and just sits there with a full outbound queue (full window). > I've checked all my MTUs and circuits. I've reduced my MTU on the client to > attempt to stop this from happening. I'm running clean as far as I can tell, > and the good connections through other ISPs tells me my system is working > OK. I've pinged my host from the destination network with large packets and > don't lose any. Does anyone have any idea what this might be about? If Same here. I have attempted to reduce the MTU on all of our interfaces, but it doesn't seem to affect anything. ping shows decent latency and even large ICMP packets go through fine (with the exception of a few). As of yet, I don't have any more information, but I'm sure this is something that will have to be fixed because we just can't go forward with a VPN that transfers at 200bps. Andy -- [-----------[system uptime]--------------------------------------------] 2:59pm up 18 days, 17:36, 4 users, load average: 1.07, 1.16, 1.19

1 0

RE: ORBS (Re: Scanning)
by Roeland Meyer 27 May '01

27 May '01

> From: Derek Balling [mailto:dredd@megacity.org] > Sent: Sunday, May 27, 2001 11:20 AM > > At 11:10 AM -0700 5/27/01, Roeland Meyer wrote: > > > I'm not sure I understand this logic: > >> > >> 1.) They test positive for orbs... so they ARE an open relay > >> 2.) That system is using MAPS, which means that there is > some subset > >> of systems the open relay itself rejects mail from > > > >I somehow missed your logic here. A MAPS blocked system is, > by definition > >NOT an open-relay, since it IS MAPS-blocked. Yet, ORBS will > list it as an > >open-relay. I agree, there is a disconnect here. Your second premis > >invalidates the first. This may be a semantic issue, please > examine and > >clarify. > > I think this is all a phrasology thing. I'm sorry. I hate hare-splitting too. > Assuming "a MAPS-blocked system" means a system that is > listed/blocked by MAPS as a spam source. > > Then your statement makes no sense because in all > likelihood, that > host IS an open relay. My bad. What I meant was a MAPS-blocked system as a subcriber to MAPS. Not a MAPS-known spam source. > Assuming "a MAPS-blocked system" means a system that is partaking of > the MAPS lists to block inbound mail to it > > Then your statement further makes no sense, because any > non-MAPS-listed host could (in theory) send mail to/through that > system. If the system using MAPS is an open relay, then > non-MAPS-listed hosts could quite happily/easily pump mail through > that system regardless of whether or not it is using MAPS. Not true, I'm assuming that MAPS isn't the only anti-spam measures being implemented. > >I might point out that, since MAPS has been running for a > few years, most if > >not all, the spammer sources are now listed. > > I think my personal evidence (that about 90-95% of my spam that is > blocked is NOT from MAPS sources) does not seem to bear that out. You bear out my assumptions that other methods, besides MAPS and ORBS, are being deployed as well. Feeding such data into MAPS would improve MAPS accuracy.

4 3

Re: ORBS (Re: Scanning)
by Steve Sobol 27 May '01

27 May '01

Steve Sobol wrote: >abitrariness (if that's > a word) of some of the ORBS listings. Arbitrariness. -- Tired of Earthlink? Get JustTheNet! Nationwide Dialup, ISDN, DSL, ATM, Frame Relay, T-1, T-3, and more. EARTHLINK AMNESTY PROGRAM: Buy a year, get two months free More info coming soon to http://JustThe.net, or e-mail me! B!ff: K3wl, w3'v3 r00t3D da N@vy... 0h CrAp, INC0M!Ng $%^NO CARRIER

1 0

RE: Scanning (was Re: Stealth Blocking)
by Roeland Meyer 27 May '01

27 May '01

> From: woods(a)weird.com [mailto:woods@weird.com] > Sent: Saturday, May 26, 2001 11:02 PM > > [ On Sunday, May 27, 2001 at 00:17:29 (-0400), William Allen > Simpson wrote: ] > > But, ORBS > > remains indefensible. > > It would seem that I have no problems either defending it, or > using it. > Whether I'm successful in the latter endeavour is only for me > to decide. > Whether I'm successful in the former endeavour is a larger question. > > > The MAPS leads to far fewer mistakes -- does not block non-relaying > > servers just because they don't think the network has sufficient > > "action against spammers in recent months." That's entirely > > judgmental, not operational. > > The mechanically verified part of ORBS cannot, by definition, > lead to any Greg, it all comes down to ONE major issue ... collateral damage. > > We've been > > falsely accused by ORBS, > > Which list were you on again? Wasn't it the manual netblocks list? > > > without any evidence of spamming. He makes a perfectly valid point here. In the past few days I have seen much testimony, from folks right here on this list, that were listed on ORBS. I've also read testimony that their systems were never used for spam. I can't imagine a spammer being on this list for long. Nor, can I imagine those illustrious folks being spammers. Yet, they were on the ORBS list. BTW, MHSC systems were also carried on ORBS for a while and when they were, over 50% of my bandwidth was used to fend off crack attempts. Thank gawd I was using MAPS at the time. None of the relay attempts got through. Although, I *did* have to replace a couple of weak BIND boxen (thanks for the extra work, BTW >:P ). Brother, that is the very definition of collateral damage. In fact, it was worse. It's "friendly fire". If we start taking out innocents and even our own guys, the spammers will win. We need to start fighting the PURE WAR against spammers. What ORBS does is to find innocents and paints bulls-eyes on them for the spammers to find easier. The argument ORBS presented, on their web-site, to justify this, is terribly weak. It still amount to pointing the guns ... in the WRONG direction. > Please do not forget that ORBS goal is not to detect or > prevent spamming per se. But, without spammer behavior, open-relays are perfectly acceptable. Else, why was it the default option in sendmail for so long? The "anti" argument falls over dead without spammers. It's not the gun, it's the bloke pointing it. > It's full name should make this clear: Open Relay Behaviour- > modification System. Any open relay is a bad thing regardless of > whether it has yet been abused by a spammer (because it will > undoubtably be abused unless it is closed first). You make my point here. Remove spammers and ORBS becomes nothing more than a totalitarian tool for a political agenda without merit. If I can run a relay system safely (without spammer abuse) then you have lost the right to tell me I can't do so because there is no possible damage to your systems. It's also a control issue, I strongly resent someone, whom isn't paying the rent here, trying to modify my behavior. I get enough of that from my government. > > ORBS blocks for political reasons, rather than technical. > I guess I can't really disagree with that, though I will > point out that > I am using ORBS as a deterrent against such acts of theft of > service and > fraud and thus it is in fact what's known as a "technical control". Can't you see how inherently corrupt that is? Drop ORBS and go with MAPS. Be friendly to your friends and disdain only those that are truely your enemies.

2 1

RE: ORBS (Re: Scanning)
by Roeland Meyer 27 May '01

27 May '01

> From: Patrick W. Gilmore [mailto:patrick@ianai.net] > Sent: Sunday, May 27, 2001 11:27 AM > (NOTE: I assume we are only discussing the MAPS RSS, not > other MAPS products.) Incorrect, I was discussing MAPS RBL.

2 1

RE: ORBS (Re: Scanning)
by Roeland Meyer 27 May '01

27 May '01

> From: Derek Balling [mailto:dredd@megacity.org] > Sent: Sunday, May 27, 2001 10:49 AM > > At 9:11 AM -0700 5/27/01, Roeland Meyer wrote: > >A system that tests positive for ORBS , yet is using MAPS, > will not be used > >as a spam relay. Yet, ORBS will list such a system. > > I'm not sure I understand this logic: > > 1.) They test positive for orbs... so they ARE an open relay > 2.) That system is using MAPS, which means that there is some subset > of systems the open relay itself rejects mail from I somehow missed your logic here. A MAPS blocked system is, by definition NOT an open-relay, since it IS MAPS-blocked. Yet, ORBS will list it as an open-relay. I agree, there is a disconnect here. Your second premis invalidates the first. This may be a semantic issue, please examine and clarify. A MAPS-blocked system may show as an open-relay to another system not listed in MAPS. However, it will show as closed to a system that is listed in MAPS. It all depends on the source of the test. AHA! Maybe ORBS should be listed in MAPS? That will certainly resolve this problem and ORBS will no longer show false positives. > Somehow that means that non-MAPS-listed sources (of which there are > many) are somehow magically restricted from relaying through the open > relay? Since your first sylogy didn't parse, this one didn't either. I might point out that, since MAPS has been running for a few years, most if not all, the spammer sources are now listed.

3 2

RE: ORBS (Re: Scanning)
by Roeland Meyer 27 May '01

27 May '01

So, you aren't happy when I build a poisoned cake for spammers, you want me to use your specific recipe... even if mine works (better?). Tell me how a MAPS-blocked system can relay spam. Yes, I'll concede that your approach may work, albeit at higher HW cost than my approach. BTW, the MHSC answer to our ORBS listing last year is to drop sendmail and build an MS-Exchange server so that we can authenticate with Win2K Domain logins. But, that's very expensive and doesn't scale well. We also support both PPTP and SSH VPN tunnels. There are obvious problems with both, as I've discovered in practice. 1. Seat license costs with Exchange (scaling issues). 2. Unless very carefully run, Exchange has serious security issues. 3. Exchange is good groupware for corps and way too much for normal users. 4. Many firewalls block any and all tunneling technology. 5. POP-based solutions demand widespread deployment of POPs. If a user is out of POP range, they have to make LD calls. Plus there is an incremental HW cost per POP. If one has a largish number of POPs this is significant addition to the out-of-range LD charges that one still incurrs. > From: E.B. Dreger [mailto:eddy@noc.everquick.net] > Sent: Sunday, May 27, 2001 9:54 AM > > > Date: Sun, 27 May 2001 09:11:39 -0700 > > From: Roeland Meyer <rmeyer(a)mhsc.com> > > [ snip ] > > >> I don't buy the "we need open relay for nationwide users" argument, > >> either. Build a cheap MX that does nothing but take mail > from a given > > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > >> POP, and send it to the world. Anti-spoofing at the border, > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > >> don't accept mail from the outside world, and you're done. > > > You must not have a roaming staff or are willing to keep > telcos wealthy. > > Or I might know a better way. > > Again, put a simple MX at each POP. Want a constant IP > address for the > SMTP server? Each POP's border router redirects the SMTP server's IP > address to the local machine, which only allows inbound SMTP from the > local POPs. > > Nothing new here. > > And then there are VPNs for roaming staff...

2 1

ORBS (Re: Scanning)
by E.B. Dreger 27 May '01

27 May '01

> Date: Sun, 27 May 2001 02:02:24 -0400 (EDT) > From: Greg A. Woods <woods(a)weird.com> >> But, ORBS remains indefensible. > It would seem that I have no problems either defending it, or using it. ORBS catches far more than MAPS. My take is that anybody who has a problem with the infrequent ORBS probes should have a huge problem with the daily bombardment of relay attempts. Besides, whoever said that one must use ORBS "out of the box"? I maintain a whitelist of IP addresses to override ORBS. As much as I'd like to see Earthlink get a clue, MSN close their relays (have they yet?), and RoadRunner cooperate, I allow their MXes through when I find them. Modern spammers have gotten nasty. They use hundreds of different relays, each time changing the source address: a57e6s(a)t8iji7.somedomain.tld in46hi(a)diief4.anotherdomain.tld xkm8ey(a)ithi62.yetanotherdomain.tld with * DNS so that all subdomains resolve, and the subject: I have no respect for netiquette!!!!! [i35ed7] I have no respect for netiquette!!!!! [ed8ooe] I have no respect for netiquette!!!!! [h8qi2h] So as to throw off MXes that look for the same message again and again. I suppose that scanning the body and looking for repetition is possible, but it's only a matter of time until _that_ get perturbed in 100 different fashions. Bottom line: Blocking mail from rogue servers is the best way to stop spam and to not be a party to somebody else getting relay-raped. Anyone with clue closed relays how many years ago? I don't buy the "we need open relay for nationwide users" argument, either. Build a cheap MX that does nothing but take mail from a given POP, and send it to the world. Anti-spoofing at the border, don't accept mail from the outside world, and you're done. Eddy --------------------------------------------------------------------------- Brotsman & Dreger, Inc. EverQuick Internet Division Phone: (316) 794-8922 --------------------------------------------------------------------------- Date: Mon, 21 May 2001 11:23:58 +0000 (GMT) From: A Trap <blacklist(a)brics.com> To: blacklist(a)brics.com Subject: Please ignore this portion of my mail signature. These last few lines are a trap for address-harvesting spambots. Do NOT send mail to <blacklist(a)brics.com>, or you are likely to be blocked.

1 0