December 2002 - Test - lists.nanog.org

Fwd: Re: Networking in Africa...
by Hank Nussbacher 03 Dec '02

03 Dec '02

> > > i don't know if I've ever actually received 1 of those spam messages from > > > a host inside Nigeria > > > > wow, i seem to get several per day. would you like some, i can setup an > exploder > > for some of my spam if anyones interested? ;) > >and they're all actually sent/relayed through a host in Nigeria? my first >few were, none that I received after that were. alot from south africa, >and a few other parts, but no more from Nigeria Interestingly enough, I got the following today from a Cybercafe in Nigeria that I had blocked: >Thanks for the prompt response to the problem with our IP address. >I have alreday instructed all staff to be more vigilant and we are going >through the list of people who came around that time on saturday to track >down who sent this email. >I am in the process of buying a cybercafe management software which allows >the administrator to look at diffrent PCs and see what people are doing so >that if we spot things like this we will stop it. >Furthermore, I have instructed my team to program the webcams to take >snapshot of the shop every 20 minutes so that we can see who was in the shop >at what time. >I have also made sure we have notices put up in the cafe to say we do not >tolerate email spamming and anybody caught will be reported to the >autorities for appropriate action >However, I must stress that this is a cybercafe where 100% of people who >come there use web based email and there is no software or mechanism to stop >spamming from web based emails. You can see from the mail that was sent that >the person put a web based email address as the return address. Therefore I >cannot guarantee that this will not happen again , I can only put measures >in place to deter people. If there is any software you know about that would >prevent this or mechanism please let me know and I will put it in place >immediately >I am surprised however that there is no responsibility placed on providers >of web based emails who are in the best position to filter out and prevent >such emails from being delivered. >I hope all the measures highlighted above will be enough for you to go to >the ISP to reactivate our blocked IP > >cheers >Adeyinka So what exactly do people do in regards to Web spam? I block tcp/80 but would like to hear what others are doing. Regards, Hank

5 4

Networking in Africa...
by Eric Gauthier 03 Dec '02

03 Dec '02

Hello, A friend of mine is working on one of the committees for next years Supercomputing conference and noticed that, in the past, they'd had participants from most continents but none from Africa. Does anyone know of a good organization/group/etc which we could spam with our conference notice and request for participation? Thanks! Eric :) PS: For those who are curious, here's part of the write-up for the SC Global portion of next years Supercomputing conference: > SC Global is the multi-national and multi-cultural meeting place for > communication and discussion of ideas relating to high-end computing and > communications and their impact on science and society. SC Global 2003 > will be the second time we've held such an event; we have the > opportunity to build on the successes of SC Global 2001, and to learn > from its challenges. > > SC Global will include several Showcase events featuring art, music, > dance, and other innovative uses of advanced collaboration technologies. > In addition, SC Global will be an important extension of SC 2003's > high-quality technical program. For example, papers presented in SC > Global will meet the same high standards as those in the regular > Technical Papers sessions.

20 33

OT (was RE: Networking in Africa...)
by Martin, Christian 03 Dec '02

03 Dec '02

Folks, > judging any continent on a single country is extremely closed-minded. As this conversation is becoming. Please, this petty discussion is drifting pretty far offtopic. chris >

1 0

Re: Networking in Africa...
by Robbie Honerkamp 03 Dec '02

03 Dec '02

alex(a)yuriev.com wrote: > Try finding some IP connectivity while in Nigeria. You would be > hard-pressed, even if you are willing to pay enormous $$. Having worked and lived in Nigeria while consulting with several ISPs there, I can assure you this is incorrect. In large cities such as Lagos, you can't stand on the street and spit without hitting an Internet cafe, many of which are open 24-hours-a-day (419ers never sleep). $15 will get you all night (11pm - 7am) access in an air conditioned cafe with their own fast VSAT connection. I am _not_ joking- there are thousands of Internet cafes throughout Lagos State on almost every street. Many smaller towns in all parts of the country will often have at least one Internet cafe around. To answer your satellite comment, most ISPs have their own VSAT connections, though others go through local upstreams such as NITEL and GS Telecom (which eventually load the traffic onto their own satellite link). Many Internet cafes have set up their own VSATs as well, as many of the local ISPs can be unreliable and/or overpriced. Robbie -- Robbie Honerkamp ISP consultant- have-laptop-will-travel robbie(a)shorty.com

3 2

MSRFCs versus RFCs?
by joej＠Rocknyou.com 03 Dec '02

03 Dec '02

Happy Thanksgiving all! While I don't think I'll get a response to this question over the holidays, I thought I'd at least present it for response post Thanksgiving. I have a site that (along with others) has decided to use MSExchange as their SMTP hub. One of the problems I am seeing with this is that the current configuration allows for any inbound domain traffic. In otherwords, the exchange server seems to allow emails destin for any domain, then sends a None Delivery Report to the "Mail From" party. My argument is that there lies an exploit with this senario. In otherwords (and those of you that probably know where I am going with this just skip ahead) If I send an email to JoeSmo(a)domain.com and spoof the Mail From as Victim(a)innocentdomain.com to an Exchange Server setup in this manor, the Exchange server will bounce an email to the Victim(a)innoccentdomain.com. While this is all fine and dandy, if a person(s) decides to use this as a mailbomb method and exploit this, its rather simple to do. So, in short I am aguing that 1> Mail destine for a domain not handled should be 550 Denied. 2> None Delivery Reports should only be sent for Domains Handled. 3> That a Firewall should not be doing Domain checking for SMTP What I am at a loss for is RFCs that explicitly state this, that is NDR for other domains, and accepting for other domains. Perhaps I missed something or one of them. Anyone have to deal with this situation? Any suggestions on how to argue this? Am I perhaps missing something? Does Bill Gates feel that "Monopoly is just a game, I want the world!" Just kidding. Thanks in advance, and again Happy Thanksgiving! -Joe

3 2

Re: Risk of Internet collapse grows
by Michael.Dillon＠radianz.com 02 Dec '02

02 Dec '02

> > How much of this research is based on marketing maps on the ISPs' web sites, > > versus actual maps of the networks in question? Most "tier 1" ISPs won't > > even let their vendors see the latter. > last year we *measured* isp maps as part of a research project called > rocketfuel and found that the marketing maps can differ significantly from > the real ones quite a bit because of lack-of-detail, outdated-ness, or > optimistic-projections. a paper describing the methodology and the maps > themselves can be found off: > http://www.cs.washington.edu/research/networking/rocketfuel/ Something is wrong here... You are claiming that your maps are *MORE* correct than the ISP maps!? I don't think so. I had a look at your map of Ebone Europe through the browse button on your website. This displayed a messy meshy network that connected all the major cities of Europe. However, in fact, Ebone's network was a nice clean ringed network connecting all the major cities of Europe. It's true that Ebone's marketing map had some innacuracies but it still more or less showed the same network of sub-rings hanging off of a core ring. I just don't see how an outside probe can determine the true topology of a network. If a researcher wants to do analysis of real network topologies they either need to get the real maps from the ISPs in question or else they need to ally themselves with someone like Telegeography who have this information for at least some ISPs. --Michael Dillon

5 4

Re: Risk of Internet collapse grows
by sgorman1＠gmu.edu 02 Dec '02

02 Dec '02

There was also some interesting work done on the geographic location of Internet resources done at Boston University: http://www.cs.bu.edu/techreports/pdf/2002-015-internet-geography.pdf Any chance the Rocketfuel project had a chance to map out UUNET/Worldcom since the first run? ----- Original Message ----- From: Randy Bush <randy(a)psg.com> Date: Friday, November 29, 2002 8:39 pm Subject: Re: Risk of Internet collapse grows > > > last year we *measured* isp maps as part of a research project > called> rocketfuel and found that the marketing maps can differ > significantly from > > the real ones quite a bit because of lack-of-detail, outdated- > ness, or > > optimistic-projections. a paper describing the methodology and > the maps > > themselves can be found off: > > http://www.cs.washington.edu/research/networking/rocketfuel/ > > and, aside from reversing the meaning of a comment you attribute > to me, i heartily recommend this paper. > > randy > > >

7 8

test
by blitz 02 Dec '02

02 Dec '02

no reply needed

1 0

RE: Operational Issues with 69.0.0.0/8...
by Todd A. Blank 02 Dec '02

02 Dec '02

We feel your pain, Scott. We are just glad that we are able to verify that there are problems with this CIDR other than on our network. Now to get them resolved. Hopefully this conversation will end up in the proper inboxes to help clean this up. Does anyone besides me worry that because of the recent cutbacks in this industry that there are orphaned pieces of equipment out there causing some of these problems? Todd 614.207.5853 -----Original Message----- From: Scott Granados [mailto:scott@wworks.net] Sent: Monday, December 02, 2002 1:52 PM To: Todd A. Blank Cc: jfeger(a)feger.net; nanog(a)merit.edu Subject: Re: Operational Issues with 69.0.0.0/8... I'd like to second this. We have ran in to problems as well. Usually this is a great place to get help however we have had very responsive actions taken by others out there who had filters in place. On Mon, 2 Dec 2002, Todd A. Blank wrote: > > Thanks for the reply, James. > > I wish I could tell you the answer. We see traffic passing through some > of the routers (transit), but on each network, or their downstreams > there seem to be different devices filtering. Sometimes it is a border > or peering router. In other cases, it has been access devices, such as > firewalls. > > One we resolved this morning (with some help from the good folks at > ARIN) was a downstream provider from one of these transit providers that > was filtering in their devices as well. > > I am just trying to raise general awareness that the 69.0.0.0/8 block is > assigned and out there in use, and to get people to re-examine their > filters, access lists, etc. > > You help and response is appreciated. > > Sincerely, > > Todd A. Blank > 614.207.5853 > > -----Original Message----- > From: Feger, James [mailto:jfeger@feger.net] > Sent: Monday, December 02, 2002 1:35 PM > To: Todd A. Blank > Subject: Re: Operational Issues with 69.0.0.0/8... > > When you say 'Networks involved' do you mean those providers are > blocking > the traffic, or you see these networks in the transit? > > Thanks, > James > > > On Mon, 2 Dec 2002, Todd A. Blank wrote: > > > > > To all concerned: > > > > We have been assigned a CIDR of 69.1.192.0/19. > > > > We have had numerous problems getting traffic through to various > destinations. > > > > We are finding that many routers are still filtering 69.0.0.0/8. > > > > This block used to be restricted, but was assigned by IANA to ARIN in > August of 2002. > > > > If anyone is still filtering this block in their routers, please > remove the filters! > > > > Here are some of the destinations that are not reachable if your > source is anywhere in the 69.0.0.0/8 CIDR: > > > > www.cplink2.com > > www.ocas.com > > www.indofilms.com > > www.lavalife.com > > > > > > Some of the Networks involved are Cable and Wireless, Allegiance > Internet and AT&T. > > > > Thank you, > > > > Todd A. Blank > > IPOutlet LLC > > 614.207.5853 > > > > >

1 0

Operational Issues with 69.0.0.0/8...
by Todd A. Blank 02 Dec '02

02 Dec '02

Thanks for the reply, James. I wish I could tell you the answer. We see traffic passing through some of the routers (transit), but on each network, or their downstreams there seem to be different devices filtering. Sometimes it is a border or peering router. In other cases, it has been access devices, such as firewalls. One we resolved this morning (with some help from the good folks at ARIN) was a downstream provider from one of these transit providers that was filtering in their devices as well. I am just trying to raise general awareness that the 69.0.0.0/8 block is assigned and out there in use, and to get people to re-examine their filters, access lists, etc. You help and response is appreciated. Sincerely, Todd A. Blank 614.207.5853 -----Original Message----- From: Feger, James [mailto:jfeger@feger.net] Sent: Monday, December 02, 2002 1:35 PM To: Todd A. Blank Subject: Re: Operational Issues with 69.0.0.0/8... When you say 'Networks involved' do you mean those providers are blocking the traffic, or you see these networks in the transit? Thanks, James On Mon, 2 Dec 2002, Todd A. Blank wrote: > > To all concerned: > > We have been assigned a CIDR of 69.1.192.0/19. > > We have had numerous problems getting traffic through to various destinations. > > We are finding that many routers are still filtering 69.0.0.0/8. > > This block used to be restricted, but was assigned by IANA to ARIN in August of 2002. > > If anyone is still filtering this block in their routers, please remove the filters! > > Here are some of the destinations that are not reachable if your source is anywhere in the 69.0.0.0/8 CIDR: > > www.cplink2.com > www.ocas.com > www.indofilms.com > www.lavalife.com > > > Some of the Networks involved are Cable and Wireless, Allegiance Internet and AT&T. > > Thank you, > > Todd A. Blank > IPOutlet LLC > 614.207.5853 >

2 1