October 2003 - Test - lists.nanog.org

AOL mail server problems?
by Brian Bruns 13 Oct '03

13 Oct '03

Hello everyone, I've noticed some weird things going on with AOL's smtp servers today - 2003-10-12 12:37:48 1A8k8X-0002OC-0c Remote host mailin-04.mx.aol.com [64.12.138.89] closed connection in response to initial connection 2003-10-12 12:37:55 1A8k8X-0002OC-0c Remote host mailin-04.mx.aol.com [64.12.136.153] closed connection in response to initial connection 2003-10-12 12:38:35 1A8k8X-0002OC-0c Remote host mailin-04.mx.aol.com [152.163.224.122] closed connection in response to initial connection Have about 40 of these in my mail logs going to different AOL smtp servers. Trying to connect by hand using telnet results in the mail servers closing the connection right away without giving a reason. I did however, out of about 20 tests, got through once and actually got the server's welcome message. Any ideas? -------------------------- Brian Bruns The Summit Open Source Development Group Open Solutions For A Closed World / Anti-Spam Resources http://www.sosdg.org ICQ: 8077511

3 5

New mail blocks result of Ralsky's latest attacks?
by Bob German 12 Oct '03

12 Oct '03

A colleague informed me this morning that Alan Ralsky is doing widespread bruteforce attacks on SMTP AUTH, and they are succeeding, mainly because it's quick, painless (for him), and servers and IDS signatures don't generally offer protection against them. Could this be why everyone's locking up their mail servers all of a sudden? Does anyone know of a way to stop them? Bob

8 11

Postini contact in the house ??
by John Brown (CV) 12 Oct '03

12 Oct '03

Hi list, seems there is no technical email contact listed for Postini on their website. a client is having an issue with postini, if there is someone with clue from postini on the list please contact me off list john at chagres d0t net thanks

1 0

DDOS Today?
by Greg Valente 12 Oct '03

12 Oct '03

I just got on today. Was there any large DDOS attacks today. Any specific networks impacted? -----Original Message----- From: Jeroen Massar [mailto:jeroen@unfix.org] Sent: Friday, October 10, 2003 8:16 PM To: 6bone(a)ISI.EDU; nanog(a)merit.edu Subject: Reserved ASN 64702, 6to4, 2 ghosts, other oddities and still no working contacts... -----BEGIN PGP SIGNED MESSAGE----- Checking http://www.sixxs.net/tools/grh/lg/?show=bogons&find=::/0 People might want to filter on private ASN's also when that ASN is being used as "transit"... 2001:a40::/32 AS64702 is reserved (path: 15516 3257 2497 4697 2914 10109 4538 4787 64702 20646 8763 5539 1930 9186) Ghost Route (14/12) 3ffe:3500::/24 3ffe:4005:fefe:: 25396 1752 10109 4538 4787 64702 20646 8319 We still have these 6to4 specifics btw: 2002:c2b1:d06e::/48 More specific 6to4 prefix (194.177.208.110/32) from AS5408 2002:c8a2::/33 More specific 6to4 prefix (200.162.0.0/17) from AS15180 2002:c8c6:4000::/34 More specific 6to4 prefix (200.198.64.0/18) from AS15180 2002:c8ca:7000::/36 More specific 6to4 prefix (200.202.112.0/20) from AS15180 And nopes, no contact has been made yet, apparently having your email address listed in the registry frees you of any obligations... Another funny one: 3ffe:3::/32 Subnet of 3ffe::/24 Mismatching origin ASN, should be 4555 (now: 29216) While there also is an announcement for: 2001:7fe::/32 I-rootserver-net-20030916 The ghosts of this month: 3ffe:1f00::/24 3ffe:2400::/24 Both with "10318 5623" common in their paths, obvious isn't it ? Oh and yes, still no contact from anybody at nortel, apparently that company doesn't know what IPv6 is. AS10318 (check above also) is still announcing *their* block and still haven't made any comment or reply back whatsoever. AS10318 have their own pTLA but apparently are not contactable for that pTLA either. If anybody knows someone alive for 3ffe:1300::/24 or AS762 or AS10318 please notify them. Maybe posting to nanog raises some people from sleep. Mailing the whois contacts directly doesn't help apparently. Greets, Jeroen -----BEGIN PGP SIGNATURE----- Version: Unfix PGP for Outlook Alpha 13 Int. Comment: Jeroen Massar / jeroen(a)unfix.org / http://unfix.org/~jeroen/ iQA/AwUBP4dLximqKFIzPnwjEQKluACglQJ+2QtJZ6O2fJZShwxLe0Z6Fz8AnRym p0Clq/HyC9EoC/RsaYudqZey =XBo4 -----END PGP SIGNATURE-----

3 2

internet consumers forum?
by Richard Welty 12 Oct '03

12 Oct '03

_please reply offlist_ i've sent some time (at least 20 minutes) considering that while there are forums for operators and engineers to discuss issues (nanog, ietf, others too numerous to mention), there aren't really forums for informed consumers of internet services to exchange notes (or for uninformed consumers to become informed.) if anyone knows of such, please let me know. otherwise, i'm considering starting an unmoderated but carefully monitored mailing list for business oriented discussion from the viewpoint of consumers. i'd probably want to tie this in with the development of FAQs and tutorials targeted at business consumers of internet services. again, comments offlist, please. richard -- Richard Welty rwelty(a)averillpark.net Averill Park Networking 518-573-7592 Java, PHP, PostgreSQL, Unix, Linux, IP Network Engineering, Security

3 3

edge interface bits
by Petri Helenius 11 Oct '03

11 Oct '03

Does anyone know, either on the east coast US, London, Stockholm, Copenhagen, Amsterdam or Helsinki transit providers which would allow edge/handoff interface control to different traffic classes using BGP communities? (for example to announce DDoS destinations and/or sources with different community which would drop the precedence of those packets to a lower level and thus de-prioritize them and allow legitimate traffic to have better performance) Pete

3 2

Puerto Rico
by Mehmet Akcin 11 Oct '03

11 Oct '03

Anyone living in Puerto Rico (if they are getting this mail, they should be working for computer/internet related anyway) can contact me offlist please? thanks. Mehmet Akcin

1 0

contact at yahoo mail? (they think we're an open relay :< )
by Mark Jeftovic 11 Oct '03

11 Oct '03

Today our email forwarders started getting this from yahoo.com mail handlers: 553 Mail from 216.220.40.247 not allowed - VS99-IP1 deferred - see help.yahoo.com/help/us/mail/defer/defer-02.html (#5.7.1) Connection closed by foreign host. Which when you go look at that page basically tells you you're probably an open relay (which we're not), etc. Can any mail admins at Yahoo contact me offlist, or post what the restrictions are or at what levels this will kick in? -mark -- Mark Jeftovic <markjr(a)easydns.com> Co-founder, easyDNS Technologies Inc. ph. +1-(416)-535-8672 ext 225 fx. +1-(416)-535-0237

6 9

first Yahoo, now RoadRunner?
by Mark Jeftovic 11 Oct '03

11 Oct '03

rr.com blocking our netblock since this morning now.... 5.7.1 Mail Refused - 216.220.40 - See http://security.rr.com/mail_blocks.htm#security Anyone else? -- Mark Jeftovic <markjr(a)easydns.com> Co-founder, easyDNS Technologies Inc. ph. +1-(416)-535-8672 ext 225 fx. +1-(416)-535-0237

6 10

The Earth's not slowing down fast enough to
by bmanning＠karoshi.com 11 Oct '03

11 Oct '03

> Date: Tue, 07 Oct 2003 23:33:45 -0700 > Subject: The Earth's not slowing down fast enough to suit Motorola > > Motorola reports that several GPS receivers in its Oncore line will > misdisplay the date on 28 Nov 2003 at midnight UTC. For a one-second window > the receivers will mistakenly report the date as 29 Nov instead of 28 Nov. > > Here's why. Every couple of years or so for the past three decades, the > International Earth Rotation Service has announced a leap-second because the > Earth is rotating slightly more slowly than an 86400-second day would > suggest. But since 1 Jan 1999, we've had an unusually long dry spell > without any leap seconds. The GPS week number in the UTC correction > parameter is 8 bits long, which allows for 256 weeks of unambiguous time > calculation. Until now this parameter has never rolled over, but because of > the dry spell 28 Nov will be exactly 256 weeks after the most recent leap > second, and the rollover will contribute to the bug. > <http://www.motorola.com/ies/GPS/docs_pdf/notification_oncore.pdf> > > Steve Allen writes in <http://www.ucolick.org/~sla/leapsecs/onlinebib.html> > that some JDAM smart bombs and other munitions are rumored to contain these > receivers. Anyone intending to use those weapons around the magic window > might want to reschedule their bombing runs for some other time. ... for all you NTP/GPS junkies out there... :) --bill

1 0