June 2002 - Test - lists.nanog.org

Re: SPEWS?
by Steven J. Sobol 20 Jun '02

20 Jun '02

On Thu, 20 Jun 2002, Gerardo A. Gregory wrote: > I think this is just plain lazzines...there is no other way to view it. So if you have a problem with someone dumping crap onto your network and you've done everything you can to get the provider to stop the offender, and they won't, what would you do then? Ignore it? > Along the lines of SPEWS is spambag.org > this idiot, because there is no other way to describe him, has blocked > SPRINTLINK netblocks in huge chunks, and then raves on like a lunatic on how > he justifies his actions (I wonder if it because he realizes what a lazy, > good for nothing "administrator" he is, since he seems so emotional in > letting you know that he is a "professional" administrator) Yeah. I know the guy who runs spambag. He is very aggressive about blocking. He also doesn't advertise that his block list is usable for anyone besides himself. So what's your point? Sprint has cleaned up a lot. They used to be absolutely horrible WRT hosting spammers and abusers, which I'm sure is why spambag lists all of Sprint. I wouldn't use any list that lists an entire backbone, myself. But guess what... it's his server and he is allowed to protect it in whichever way he deems appropriate. > He doesnt realize that he only hurts himself....we where going to one of his > sites for a mail server solution, as soon as I read all his ravings I just > cruised somewhere else..to hell with him and his lazy administration skills. Your choice. > I still believe the guy blocked sprintlink because he cant really > subnet...he has no concept of math, that and lazzines. Nah, he's a decent programmer; I've used some of his stuff before. And a *ton* of spam used to come from Sprint. Like I said... they've made good efforts to clean up recently... but... The fact remains that there are a number of people who run very aggressive block lists (much more so than SPEWS). I can think of spambag and at least one or two others. (xbl.selwerd.cx comes to mind.) None of these people advertise that anyone else should use their lists. They're personal lists. Read the spambag.org homepage and it states very clearly that it's a personal list. SPEWS is a completely different animal, as I don't believe it was ever meant to be a personal list; it was meant to be used by others... -- Steve Sobol, CTO JustThe.net LLC, Mentor On The Lake, OH 888.480.4NET - I do my best work with one of my cockatiels sitting on each shoulder - 6/4/02:A USA TODAY poll found that 80% of Catholics advocated a zero-tolerance stance towards abusive priests. The fact that 20% didn't, scares me...

2 1

Re: SPEWS?
by Lou Katz 20 Jun '02

20 Jun '02

It seems to me that this issue is being highly obfuscated. SPEWS publishes a list. It is the ISP of your MAIL RECIPIENT that CHOOSES to use it. Take up the issue with them. It was their choice to use it - no one forced them to. I recently pointed out to the sendmail folks that their blacklist rejection message was misleading, and I believe they changed it. The mail is not being blocked by SPEWS. It is being blocked/refused as local policy by the ISP, who chooses to use the SPEWS list as part of their decision policy. -- -=[L]=-

1 0

RE: Bandwidth Monitoring by IP
by Daniska Tomas 20 Jun '02

20 Jun '02

you will get the accounting cache exhausted soon if you don't poll&clean it frequently... -- Tomas Daniska systems engineer Tronet Computer Networks Plynarenska 5, 829 75 Bratislava, Slovakia tel: +421 2 58224111, fax: +421 2 58224199 A transistor protected by a fast-acting fuse will protect the fuse by blowing first. > -----Original Message----- > From: Jared Mauch [mailto:jared@puck.Nether.net] > Sent: 20. júna 2002 17:17 > To: Mitchell, Dan > Cc: 'nanog(a)merit.edu' > Subject: Re: Bandwidth Monitoring by IP > > > > interface (gig|fast)ethernet1/0 > ip account mac (in|out) > > On Thu, Jun 20, 2002 at 08:48:34AM -0400, Mitchell, Dan wrote: > > > > Hi all, > > > > Does anyone know of a low-cost solution for monitoring > bandwidth by IP? My > > original thought was 1 switch port = 1 IP, but in the case > of virtual IP's > > on a single port, that just wouldn't work. I'm seeing more > and more of a > > demand for a basic BW report by IP, so our customers can > bill their customer > > accordingly. > > > > Any recommendations? > > > > Thanks, > > Dan > > > > Dan Mitchell > > Internet Systems Engineer - Boston > > AllegianceInternet / Hosting.com > > 781.478.1857 Direct Line > > dan.mitchell(a)hosting.com > > -- > Jared Mauch | pgp key available via finger from jared(a)puck.nether.net > clue++; | http://puck.nether.net/~jared/ My statements > are only mine. >

2 1

Bandwidth Monitoring by IP
by Mitchell, Dan 20 Jun '02

20 Jun '02

Hi all, Does anyone know of a low-cost solution for monitoring bandwidth by IP? My original thought was 1 switch port = 1 IP, but in the case of virtual IP's on a single port, that just wouldn't work. I'm seeing more and more of a demand for a basic BW report by IP, so our customers can bill their customer accordingly. Any recommendations? Thanks, Dan Dan Mitchell Internet Systems Engineer - Boston AllegianceInternet / Hosting.com 781.478.1857 Direct Line dan.mitchell(a)hosting.com

6 5

RE: Bandwidth Monitoring by IP
by Daniska Tomas 20 Jun '02

20 Jun '02

netflow? -- Tomas Daniska systems engineer Tronet Computer Networks Plynarenska 5, 829 75 Bratislava, Slovakia tel: +421 2 58224111, fax: +421 2 58224199 A transistor protected by a fast-acting fuse will protect the fuse by blowing first. > -----Original Message----- > From: Mitchell, Dan [mailto:Dan.Mitchell@hosting.com] > Sent: 20. júna 2002 14:49 > To: 'nanog(a)merit.edu' > Subject: Bandwidth Monitoring by IP > > > > Hi all, > > Does anyone know of a low-cost solution for monitoring > bandwidth by IP? My > original thought was 1 switch port = 1 IP, but in the case of > virtual IP's > on a single port, that just wouldn't work. I'm seeing more > and more of a > demand for a basic BW report by IP, so our customers can bill > their customer > accordingly. > > Any recommendations? > > Thanks, > Dan > > Dan Mitchell > Internet Systems Engineer - Boston > AllegianceInternet / Hosting.com > 781.478.1857 Direct Line > dan.mitchell(a)hosting.com > >

1 0

Fw: SPEWS?
by Mike Lewinski 20 Jun '02

20 Jun '02

> What ticks me off is there is noone to talk to about it, you are expected > to grovel on some usenet group and hope that they are reading and will > remove you after sufficient heckling. You could also try groveling on #spews @ dalnet. Mike

2 1

39/8 ?
by Stephen J. Wilcox 20 Jun '02

20 Jun '02

I'm receiving routes for 39.0.0.0/8 which is odd as IANA states this is a reserved block, as does arin but theres a route in radb .. I cant find AS4554 either and the rDNS doesnt exist in in-addr.arpa Whats this all about then? Steve *>i39.0.0.0 62.24.192.1 7765 100 0 6461 4554 ? [whois.radb.net] route: 39.0.0.0/8 descr: Exchange Point Networks PO 12317 Marina del Rey, CA. 90295 US origin: AS4554 mnt-by: MNT-EPNET changed: bmanning(a)karoshi.com 20020401 source: ARIN [whois.arin.net] IANA (RESERVED-39A) Internet Assigned Numbers Authority 4676 Admiralty Way, Suite 330 Marina del Rey, CA 90292-6695 US Netname: RESERVED-39A Netblock: 39.0.0.0 - 39.255.255.255 Coordinator: Internet Corporation for Assigned Names and Numbers (IANA-ARIN) res-ip(a)iana.org (310) 823-9358 Domain System inverse mapping provided by: FLAG.EP.NET 198.32.4.13 DOT.EP.NET 198.32.2.10

3 3

Re: SPEWS?
by Hermann Wecke 19 Jun '02

19 Jun '02

On Wed, 19 Jun 2002, Alex Rubenstein wrote: > So, to the point; what is the consensus on SPEWs? I've never really > noticed them until this point. I'm still trying to understand two points: 1) WHO is SPEWS (who is beyond that, who runs that stuff)??? 2) WHO uses it??? (I mean: who really big - like Yahoo!, Hotmail etc is using their list) I know that several netblocks listed there are really spamheavens (like Telefonica Brazil), but they are now listing /24 even if only IP in that netblock is spamming... They may even be serious, but listing /24 and bigger ranges without showing the evidence for that listing is really crazy and insane...

1 0

if anyone would like to help...
by Earnest Guevera 19 Jun '02

19 Jun '02

If anyone is in a position to assist... 2600 IRC SERVER OFFLINE INDEFINITELY Posted 18 Jun 2002 07:13:36 UTC As a result of a massive Denial of Service attack of biblical proportions, we no longer have a home for irc.2600.net. It's rather ironic that hackers are constantly blamed for DoS attacks when they, like many Internet users, are often the victims. We have, for the moment anyway, lost a major forum of communications for the hacker community. It doesn't much matter if this was orchestrated by a bored individual or some sort of government conspiracy - the result is the same. Voices are silenced, communication becomes all the harder, any semblance of community is wiped away. There are those who will view the dismantling of our network as a good thing and it's those people whose interests were served by these attacks - attacks which required no computer skills and had nothing at all to do with hacking. The attacks came over the weekend, around the same time other such attacks were directed at sites like Fox News. They, however, got their connection back and launched a federal investigation. We would have preferred to simply find a technical solution but we weren't given that chance as our provider chose to simply disconnect us instead. Our system was kept afloat entirely through volunteer efforts and the fact of the matter is that we have more pressing things to worry about right now. Whether the IRC network ever comes back is now entirely up to the hacker community's ability to design a network that can work around the efforts of those trying to shut us down. If you want to help, please email irc(a)2600.com. We're sorry that the net continues to be shaped by malicious morons intent on shutting down all aspects of free speech. http://www.2600.com/news/display.shtml?id=1203 __________________________________________________ Do You Yahoo!? Yahoo! - Official partner of 2002 FIFA World Cup http://fifaworldcup.yahoo.com

11 10

Re: KPNQWEST cease operation?
by Michael.Dillon＠radianz.com 19 Jun '02

19 Jun '02

>Anyone who isn't in the process of moving away from KQ/Ebone is >in deep trouble and should act now to ensure you get on the >list of an alternative nearer the top than the bottom. I've >heard reports from various parts of Europe about issues >and in todays FT it looks like the network will be shutdown >by the NOC employees unless the company is bought outright! What I wonder is what they mean by "shutdown". If this means that the equipment is unplugged, then how many of these alternate providers will suddenly discover that they have a dependency on an Ebone SDH/SONET ADM or an Ebone DWDM box? If management at these alternate providers is just hunting through their databases looking for KPN/Qwest dependencies they probably won't see the complete picture. KQ only completed the Ebone acquisition back in March and about a year earlier, Ebone was doing business under the name GTS or Global Telesystems. Most people who bought wavelengths or leased lines from Ebone would have done it under those names and most of those companies were carriers or network operators. This could get interesting. Personally, I hope that the NOC employees in Brussels succeed in getting potential buyers to realize the value of a functioning cross-border fiber network that covers all of Europe. Michael Dillon ex-Ebone

5 4