October 2003 - Test - lists.nanog.org

Re: Heads-up: AT&T apparently going to whitelist-only inbound mail
by Stewart, William C (Bill), RTSLS 23 Oct '03

23 Oct '03

As a followup to Steve Bellovin's note, to clarify several comments people sent to the list, note that while AT&T's email folks decided not to take this approach (actually they'd decided that before somebody goofed up and sent the draft email anyway, sigh :-), it was never something that would have affected inbound email from the Internet to AT&T customers or outbound email from AT&T customers to the Internet. This was strictly for inbound email to AT&T's corporate mail servers at att.com, which were getting pounded with much more spam than usual. We'd rather not lose mail to j.random.salesrep(a)att.com either, but inbound mail is still slow even though they've cleaned up most of the mess. Technically I guess this isn't operational (unless you're trying to reach att.com email addresses), but if they'd done some of the things that people thought that the message said they were going to do, it would have been. Bill Stewart Usual-disclaimer: this is my opinion, not AT&T's official statements.

3 2

Re: China Telecom filtering nameservers
by John Kristoff 23 Oct '03

23 Oct '03

On Wed, Oct 22, 2003 at 11:23:08PM -0700, Joe Zhu wrote: > well...if it's really problem, someone will help. But if it's smart a$$ > comment like this, not sure. I'm not sure what exactly you took offense too, but if I offended someone, particularly our international neighbors I apologize. In my experience there has been a language barrier problem, which has hindered even the initial dialog via email or telephone. My intention was to convey that the issue is a known problem, what I thought might be going on and that I didn't yet have a good solution. John

1 0

RE: Heads-up: AT&T apparently going to whitelist-only inbound mai l
by Bowden, Terry 23 Oct '03

23 Oct '03

When individual employees of a large corporation speak to the general public, they need to put in a disclaimer. When a large corporation speaks to the general public, the disclaimer is not necessary. Bill was quite right to put a disclaimer after his personal remarks. For the official statement, look in the thread for the Press Release which was also inserted by Bill Stewart presumably after getting clearance from AT&T's Public Relations people. It stated AT&T STATEMENT - CURRENT SPAM ATTACK - 10/22/03 AT&T and a number of other large companies have seen a marked increase in the amount of incoming SPAM in recent days. A team of experts that includes members from AT&T Labs, Network Services, and Corporate Security has implemented a number of procedures to remediate this situation and minimize its impact on those trying to send e-mail to "att.com" addresses. As of this morning - Wednesday, October 22nd - the level of incoming e-mail messages is returning to normal and the situation appears to be well in hand. Although all AT&T e-mail servers are fully operational at this time, some incoming messages are experiencing intermittent delays as SPAM filtering continues at all network gateways. Customers who received e-mail bulletins from AT&T Monday and Tuesday requesting specific information are advised to disregard those messages. They were inadvertently sent out in error and we apologize for any confusion or inconvenience they may have caused. Network reliability is one of our top priorities at AT&T, so for obvious reasons we will not be providing more detailed information regarding the specific security procedures implemented to curb this SPAM attack. We have no intention of helping those who generate this type of computer and Internet mischief. Regards, ________________________________ Terry Bowden AT&T Service Delivery Manager NZ

1 0

Anyone from Rackshack/EV1 listening?
by drew＠gothambus.com 22 Oct '03

22 Oct '03

If anyone from Rackshack/EV1.net is listening, please drop me a note off-list. I have an issue that I'm having a hard time resolving through regular channels. Thanks! Drew Linsalata The Gotham Bus Company, Inc. Co-Location and Dedicated Access Solutions http://www.gothambus.com

1 0

How long much advanced notice do ISPs need to deploy IPv6?
by Sean Donelan 22 Oct '03

22 Oct '03

How much notice is adequate when changing widely used behavior on the Internet? When the ARPANET changed from NCP to TCP/IP how many days advance notice was needed? When the Internet changed from IPv4 to IPv6 how many days advance notice was needed? When the COM and NET zone behvior was changed to eliminate NXDOMAIN how many days advance notice was needed?

4 3

Unusual GET requests
by Brian Bruns 22 Oct '03

22 Oct '03

Hmmm, this is probably offtopic, but I can't seem to find anything online which explains this and I've never seen it before. Maybe someone else here has seen this in their logs or has any idea what would do this? Its obviously trying to gather some sort of information, could it be a prelude to some sort of DoS or exploit thats not publically known yet? 68.63.88.173 - - [21/Oct/2003:19:47:49 -0500] "GET /pad-Files HTTP/1.1" 404 322 "-" "libwww-perl/5.65" 68.63.88.173 - - [21/Oct/2003:19:47:49 -0500] "GET /PAD-FILES HTTP/1.1" 404 322 "-" "libwww-perl/5.65" 68.63.88.173 - - [21/Oct/2003:19:47:49 -0500] "GET /Pad-Files HTTP/1.1" 404 322 "-" "libwww-perl/5.65" 68.63.88.173 - - [21/Oct/2003:19:47:48 -0500] "GET /Pad-files HTTP/1.1" 404 322 "-" "libwww-perl/5.65" 68.63.88.173 - - [21/Oct/2003:19:47:48 -0500] "GET /pad-files HTTP/1.1" 404 322 "-" "libwww-perl/5.65" 68.63.88.173 - - [21/Oct/2003:19:47:48 -0500] "GET /PAD-FILE HTTP/1.1" 404 321 " -" "libwww-perl/5.65" 68.63.88.173 - - [21/Oct/2003:19:47:48 -0500] "GET /Pad-file HTTP/1.1" 404 321 " -" "libwww-perl/5.65" 68.63.88.173 - - [21/Oct/2003:19:47:47 -0500] "GET /pad-File HTTP/1.1" 404 321 " -" "libwww-perl/5.65" 68.63.88.173 - - [21/Oct/2003:19:47:47 -0500] "GET /Pad-File HTTP/1.1" 404 321 " -" "libwww-perl/5.65" 68.63.88.173 - - [21/Oct/2003:19:47:44 -0500] "GET /PadFiles HTTP/1.1" 404 321 " -" "libwww-perl/5.65" 68.63.88.173 - - [21/Oct/2003:19:47:44 -0500] "GET /Padfiles HTTP/1.1" 404 321 " -" "libwww-perl/5.65" 68.63.88.173 - - [21/Oct/2003:19:47:44 -0500] "GET /PADFILES HTTP/1.1" 404 321 " -" "libwww-perl/5.65" 68.63.88.173 - - [21/Oct/2003:19:47:44 -0500] "GET /padfiles HTTP/1.1" 404 321 " -" "libwww-perl/5.65" 68.63.88.173 - - [21/Oct/2003:19:47:43 -0500] "GET /PadFile HTTP/1.1" 404 320 "- " "libwww-perl/5.65" 68.63.88.173 - - [21/Oct/2003:19:47:43 -0500] "GET /Padfile HTTP/1.1" 404 320 "- " "libwww-perl/5.65" 68.63.88.173 - - [21/Oct/2003:19:47:43 -0500] "GET /PADFILE HTTP/1.1" 404 320 "- " "libwww-perl/5.65" 68.63.88.173 - - [21/Oct/2003:19:47:43 -0500] "GET /padfile HTTP/1.1" 404 320 "- " "libwww-perl/5.65" 68.63.88.173 - - [21/Oct/2003:19:47:43 -0500] "GET /Pads HTTP/1.1" 404 317 "-" " libwww-perl/5.65" 68.63.88.173 - - [21/Oct/2003:19:47:43 -0500] "GET /PADS HTTP/1.1" 404 317 "-" " libwww-perl/5.65" 68.63.88.173 - - [21/Oct/2003:19:47:42 -0500] "GET /pads HTTP/1.1" 404 317 "-" " libwww-perl/5.65" 68.63.88.173 - - [21/Oct/2003:19:47:42 -0500] "GET /Pad HTTP/1.1" 404 316 "-" "l ibwww-perl/5.65" 68.63.88.173 - - [21/Oct/2003:19:47:42 -0500] "GET /PAD HTTP/1.1" 404 316 "-" "l ibwww-perl/5.65" 68.63.88.173 - - [21/Oct/2003:19:47:42 -0500] "GET /pad HTTP/1.1" 404 316 "-" "l ibwww-perl/5.65" -------------------------- Brian Bruns The Summit Open Source Development Group Open Solutions For A Closed World / Anti-Spam Resources http://www.sosdg.org ICQ: 8077511

3 2

Re: Heads-up: AT&T apparently going to whitelist-only inbound mail
by Steve Bellovin 22 Oct '03

22 Oct '03

AT&T STATEMENT - CURRENT SPAM ATTACK - 10/22/03 AT&T and a number of other large companies have seen a marked increase in the amount of incoming SPAM in recent days. A team of experts that includes members from AT&T Labs, Network Services, and Corporate Security has implemented a number of procedures to remediate this situation and minimize its impact on those trying to send e-mail to "att.com" addresses. As of this morning - Wednesday, October 22nd - the level of incoming e-mail messages is returning to normal and the situation appears to be well in hand. Although all AT&T e-mail servers are fully operational at this time, some incoming messages are experiencing intermittent delays as SPAM filtering continues at all network gateways. Customers who received e-mail bulletins from AT&T Monday and Tuesday requesting specific information are advised to disregard those messages. They were inadvertently sent out in error and we apologize for any confusion or inconvenience they may have caused. Network reliability is one of our top priorities at AT&T, so for obvious reasons we will not be providing more detailed information regarding the specific security procedures implemented to curb this SPAM attack. We have no intention of helping those who generate this type of computer and Internet mischief.

4 3

Cheap temperature sensors
by Robert Boyle 22 Oct '03

22 Oct '03

From time to time this thread pops up. I found something which looked interesting and the price was right. I bought one and WOW! It is VERY impressive stuff for any price especially considering how cheap it was. I purchased 10 individual temperature sensors and two temp/humidity sensors, and the SNMP Ethernet module. From unpacking the box to installing the eight sensors in the inlet and outlet ducting of our four A/C units, two more to the inside of two server racks and yet two more to the UPS and general rack areas for ambient temp/humidity monitoring to setting up MRTG graphing and SNMP traps total time was under 4 hours! Very nice stuff. It works out of the box with minimal setup and no fabrication, or development/programming needed. All of this for $445.00 delivered!!! I'm going to order a spare because I like the equipment so much and it is so cheap. http://dcf.sk/microweb/snmpmain.html -Robert Tellurian Networks - The Ultimate Internet Connection http://www.tellurian.com | 888-TELLURIAN | 973-300-9211 "Good will, like a good name, is got by many actions, and lost by one." - Francis Jeffrey

4 3

Re: hunting for ARIN election site posted at NANOG
by ren 22 Oct '03

22 Oct '03

Thanks! -ren At 01:31 PM 10/22/2003 -0700, andrew.dul(a)quark.net wrote: >Was this what you were looking for? > >http://onsite.arin.net > >Quoting ren <ren(a)gweep.net>: > > > > > howdy - I wanted to vote for a few fine candidates but misplaced the URL > > > > Ray posted on Tuesday morning. Anyone have it handy? It was the one > > where > > you could include your NANOG registration info, not this one: > > http://ww1.arin.net/elections/votingbooth.html > > > > thank, -ren > > > >

1 0

hunting for ARIN election site posted at NANOG
by ren 22 Oct '03

22 Oct '03

howdy - I wanted to vote for a few fine candidates but misplaced the URL Ray posted on Tuesday morning. Anyone have it handy? It was the one where you could include your NANOG registration info, not this one: http://ww1.arin.net/elections/votingbooth.html thank, -ren

1 0