December 2003 - Test - lists.nanog.org

25,000 ton amphibious spam relay
by Eric Kuhnke 16 Dec '03

16 Dec '03

http://www.interesting-people.org/archives/interesting-people/200312/msg000… ================================= At 09:59 AM 12/16/2003, Rich Kulawiec wrote: [ Doesn't it just make you feel all safe and cozy when the people responsible for our defense are allowing military hardware to be hijacked to relay spam? ---Rsk ] ----- Forwarded message from Bruce Gingery <bg7341(a)GTCS.COM> ----- > Date: Tue, 16 Dec 2003 00:48:14 -0700 > From: Bruce Gingery <bg7341(a)GTCS.COM> > Subject: Spam, Block: 25,000 ton spam relay, with photos of it! > To: SPAM-L(a)PEACH.EASE.LSOFT.COM > > ANNOUNCING: The amphibious transport dock and spam relay > > http://www.news.navy.mil/list_all.asp?id=8488 > Zoom-in > http://www.news.navy.mil/view_single.asp?id=4553 > http://www.news.navy.mil/view_single.asp?id=2746 > > > The ship supports the Marine Corps "mobility triad," the LCAC > >(Landing Craft Air Cushion vehicle), the "Triple A-V" (AAAV - > > Advanced Amphibious Assault Vehicle) and the MV-22 (Osprey > > tiltrotor aircraft), > > and (apparently) spammers in Guandong. Red China. > > > Furthermore, San Antonio incorporates the latest quality of life > > standards for the embarked Marines and sailors, including the sit-up > > berth, ship services mall, a fitness center and learning resource > > center/electronic classroom > > and Unsolicited Bulk E-Mail. > > Of course, it's possible that one of the OTHER eleven ships, still under > construction, is the Avondale, LA dot-MIL spam relay, or trojaned boat, > or some nice-and-secure Windows box in the construction drydocks, running > Microsoft Exchange Internet Mail Service Version 5.5.2653.13 > > But doesn't it make all Americans feel all fuzzy and secure that a > Red Chinese spammer can abuse a US Naval Vessel of one of the newest > designs, to relay his "business proposition"? > > Perhaps it's tied to the USS Green Bay, instead? or USS New Orleans? > http://www.navsea.navy.mil/newswire_content.asp?txtDataID=8963&txtTypeID=2 > > The USS Mesa Verde, seems to be in Mississippi, instead > http://www.navsea.navy.mil/newswire_content.asp?txtDataID=8663&txtTypeID=2 > > But the E-Mail headers finger the USS San Antonio, LPD 17, already > christened, and due for commissioning some time this coming year. > > > LPD 17 Looks Like a "Gator" > > http://www.navsea.navy.mil/newswire_content.asp?txtDataID=8596&txtTypeID=2 > > but from here, it just looks like another spammer. > > [SPECIMEN] > H: Return-Path: <lugbkbgkd(a)ms13.hinet.net> > H: Received: from avnavfw.lpd17.navsea.navy.mil > H: (avnavfw.pms317.navy.mil [205.67.231.235]) > H: by mail.gtcs.com (8.12.10/8.11.3/gtcs-6.3.8) with SMTP > H: id hBG65HO8091853 > H: for <[victim]>; Mon, 15 Dec 2003 23:06:39 -0700 (MST) > H: (envelope-from: <lugbkbgkd(a)ms13.hinet.net>) > H: X-Authentication-Warning: serv.gtcs.com: Host > H: avnavfw.pms317.navy.mil [205.67.231.235] > H: claimed to be avnavfw.lpd17.navsea.navy.mil > H: Received: from no.name.available by avnavfw.lpd17.navsea.navy.mil > H: via smtpd (for [209.181.16.1]) with SMTP; 16 Dec 2003 05:53:08 UT > H: Received: from avnavfw.AVONDALE (205.67.231.5 [205.67.231.5]) by > H: swn-email.lpd17.navy.mil with SMTP (Microsoft Exchange Internet Mail > H: Service Version 5.5.2653.13) > H: id YY2BDP4P; Tue, 16 Dec 2003 00:07:28 -0600 > H: From: "HuatonE-ScooterCo.,Ltd" <1232312fs21d(a)ms13.hinet.net> > H: Received: from [61.145.234.62] by avnavfw.AVONDALE > H: via smtpd (for [205.66.99.30]) with SMTP; 16 Dec 2003 05:51:47 UT > H: Subject: Re.About our new product > H: Content-Type: text/html > H: Date: Tue, 16 Dec 2003 13:57:41 +0800 > H: X-Priority: 3 > > [extract from HTML body] > B: Our company specializes in exporting electric & gas scooters, which > B: are most popular with our customers at home and abroad. Now we are > B: writing to offer you an opportunity to develop a mutual trade. If > B: you are interested in establishing business relations with us, please > B: let us know your requirements. Then we would like to forward catalogues > B: as well as detailed information to you, and offer the best price to > B: you. We assure you of our best attention to your any inquiries. > B: We anticipate your early response in respect. > > B: Huaton E-scooter Co., Ltd. > B: Room.B-202,Building Si-Hai-Ming-Yuan > B: Burg Weiji,Zone Gongbei > B: City Zhuhai 519020 > B: Province Kwangtung,China > B: Tel:86-756-821-6922 > B: Fax:86-756-888-3037 > ... > > Spam support by: > The US Navy, Avondale Lousiana Shipyard, Firewall, and hosts behind it > > OrgName: DoD Network Information Center > OrgID: DNIC > Address: 7990 Science Applications Ct > Address: M/S CV 50 > City: Vienna > StateProv: VA > NetRange: 205.0.0.0 - 205.117.255.255 > Comment: DOD Network Information Center > Comment: Space and Naval Warfare Systems > Comment: Washington, DC 20363-5100 US > > Responsible for these not-yet-commissioned ships ... > Naval Sea Systems Command > 1333 Isaac Hull Avenue S. E. > Washington Navy Yard, D.C. 20376 > Congressional/Press Inquiries: (202) 781-4124 > > Link in spam hosted at > B: http://dateu.to/ > inetnum: 202.181.192.0 - 202.181.223.255 > netname: HKCIX > > Link in spam hosted at > B: http://i19.ac.tpe.yahoo.com/ > inetnum: 202.1.232.0 - 202.1.239.255 > netname: YAHOO-ASIA > descr: streaming media, e-mail, instant messenger, www, etc > country: HK > > Spammer at: > inetnum: 61.145.0.0 - 61.145.255.255 > netname: CHINANET-GD > descr: CHINANET Guangdong province network ----- End forwarded message ----- ------------------------------------- You are subscribed as interesting-people(a)lists.elistx.com To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/

2 1

[carolw@merit.edu: NANOG 30 Meeting Information]
by Chris Woodfield 16 Dec '03

16 Dec '03

Can someone make sure that a proper supply of torches and pickaxes is requisitioned for the excusrsion to Boca Raton? -C ----- Forwarded message from Carol Wadsworth <carolw(a)merit.edu> ----- Envelope-to: rekoil(a)semihuman.com Delivery-date: Tue, 16 Dec 2003 13:50:11 -0500 Delivered-To: nanog-outgoing(a)trapdoor.merit.edu Delivered-To: nanog(a)trapdoor.merit.edu Delivered-To: nanog(a)merit.edu Delivered-To: nanog-announce-outgoing(a)trapdoor.merit.edu Delivered-To: nanog-announce(a)trapdoor.merit.edu Delivered-To: nanog-announce(a)nanog.org Date: Tue, 16 Dec 2003 13:48:50 -0500 From: Carol Wadsworth <carolw(a)merit.edu> To: nanog-announce(a)nanog.org Subject: NANOG 30 Meeting Information X-Mailer: Mulberry/2.1.1 (Mac OS/PPC) Precedence: bulk X-Loop: nanog X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on tino.semihuman.com X-Spam-Level: X-Spam-Status: No, hits=-4.9 required=5.0 tests=BAYES_00 autolearn=ham version=2.60 Registration is now open for NANOG 30, February 8-10, 2004, in Miami. The meeting will be hosted by Terremark Worldwide, Inc. Join us for NANOG's 10th anniversary celebration: http://www.nanog.org/ See you there! ----- End forwarded message -----

1 0

NANOG 30 Meeting Information
by Carol Wadsworth 16 Dec '03

16 Dec '03

Registration is now open for NANOG 30, February 8-10, 2004, in Miami. The meeting will be hosted by Terremark Worldwide, Inc. Join us for NANOG's 10th anniversary celebration: http://www.nanog.org/ See you there!

1 0

Re: Authority
by Michael.Dillon＠radianz.com 16 Dec '03

16 Dec '03

>i am just curious... do you have any authority/commission from arin (or >anyone else)? >this is certainly not flame bait, but it is an honest question. you're >very self-righteous, and although you may have valid points (i withold >judgement) i really want to know what gives you the right/authority to say >the things you say about others. Honest question, honest answer. You seem to be looking for a command and control hierarchy where none exists. This is more like a free market economy of ideas and projects. In other words, anyone can start up something and offer it to the networking community. Projects succeed or fail based on whether they find market acceptance within the economy of ideas. Please note that this free market economy of ideas is not the same thing as the free market economy of commerce; it just shares some of the same patterns. William is not alone here. Paul Vixie started MAPS in the same way, i.e. he had no authority to do it but just offered it to the economy of ideas. And Paul's entrepreneurial inclination have led him to do other projects in the commercial economy, some of which started life in the economy of ideas. Rob Thomas's Cymru project is another example and the various route server and IRR projects are also examples. Nobody gave the IRR people the authority to manage BGP4 routes; they just thought it was a good idea and offered it in the economy of ideas. Many Internet exchange points started life in the same way and I believe there are still a lot of smaller ones that exist in the economy of ideas, i.e. non-commercial. I may not agree with everything that William does or how he goes about it, but I do think that his approach is worthwhile. It gives us a chance to see a prototype of something that could be either incorporated into ARIN or commercialized in the future. By the way, ARIN, and the IANA before it, both started life in the economy of ideas. The only reason that ARIN is in the position that it now holds is that the networking community liked what they saw and supported it. There really was no "authority" that created ARIN. There was a lot of initiative from members of the networking community who lobbied the various power brokers of the time to demonstrate that ISPs supported an address resgistry that was entirely independent from domain name registries. Once it became clear that the only dissenters came from outside the industry and were confusing addressing and domain name issues, those groups who felt that they had authority in the matter, blessed the plans to create ARIN, and we went ahead with it. Even here, there was no command and control that gave ARIN its commission. On the contrary, there was a lot of bottom-up pressure that finally coalesced and ARIN was obviously the right thing to do. --Michael Dillon (one of the original members of the ARIN Advisory Council)

11 11

Re: Root Authority
by Michael.Dillon＠radianz.com 16 Dec '03

16 Dec '03

>> Sorry Mr Bush. We derive our authority from the old IANA, who >> assigned out the exiting roots. >No, that's who *appointed* you. However, you derive your actual >authority from all the named.ca hints files that point to you. Valdis is right. I suppose I could repeat my post about the free market economy of ideas, but if anyone missed it last time, it's in the NANOG archives here: http://www.merit.edu/mail.archives/nanog/msg00294.html The root servers are yet another area in which authority grew on its own rather than being handed down from above. If the explanations of this seem confusing it's because, like the Tao, what can be spoken is only a one-sided view of what really is. --Michael Dillon

1 0

Whitelisting, AOL E.mail etc.
by Robert Mathews 15 Dec '03

15 Dec '03

All: I have weighed the benefit of posting Vs. NOT posting this information to NANOG. I found that posting this note to the larger community was important perhaps for two reasons. They are: 1) The problems that we at the University of Hawai'i experienced from 10/17 - 10/20 with AOL, effected a fairly large userbase. Therefore, I am inclined to believe that someone who is at least partially responsible for the operation or managment of another network similar to our own - could benefit from having this information (I know of at least 2 other large University systems that were effected by the same issue). 2) Having the requisite AOL contact information in any event - might be important toward at least partially achieving a resolve to future problems. Now, a brief recap. Beginning the afternoon of the 17th (EDT), all E.mail traffic from UH' namespace to AOL began to bounce. This condition did not resolve until the morning of the 20th (EDT). Primarily, this was due to AOL's whitelisting, and whitelisting policies. Upon discovering this problem, I began an inquiry into the condition. We were informed that AOL had received complaints from 'its members', who stated that our central E.mail server was responsible for instances of spamming. Subsequently, AOL personnel and I were able to hold a dialog over the weekend to resolve pertinent issues regarding the matter. I wish to give praise the AOL Team, who responded quickly, and were both cooperative and sincere with respect to their desire to resolve issues. I MUST credit Carl Hutzler, Dir. of AntiSpam Operations at AOL, and Charles Stiles, Manager of the Postmaster-Team at AOL especially, for their commitment to resolve this issue expediently. Traffic exchange between AOL and us have been re-established. For your reference, I wish to present the following statement from Carl to me, which may be helpful to you as well. "Anyone can request to receive the complaints that mail transmitted from their IP space generated via a Complaint Feedback Loop. All we need is: 1. Address space (CIDR or otherwise) 2. Abuse email address where you want them sent We will send them in realtime as we get them with the entire original spam included for your analysis. Feel free to have them send this data to me and/or our abuse phone number for now ..." The relevant AOL contacts are as follows: Carl Hutzler Director, AntiSpam Operations America Online Mail Operations cdhutzler(a)aol.com 703.265.5521 work 703.915.6862 cell Carl Hutzler <cdhutzler(a)aol.com> or Charles Stiles <stilesch(a)aol.com> Manager, Postmaster-Team - AOL All my best, Robert. -------

4 4

Re: Weekly Routing Table Report
by Hank Nussbacher 15 Dec '03

15 Dec '03

> >Routing Table Report 04:00 +10GMT Sat 13 Dec, 2003 >... > >ARIN Region per AS prefix count summary >--------------------------------------- > > ASN No of nets /20 equiv MaxAgg Description > 7018 1420 7058 988 AT&T > 701 1417 8664 973 UUNET Technologies, Inc. Has anyone else noticed that for the 1st time AS701 no longer has the largest number of announced nets? -Hank > 1239 953 3096 664 Sprint > 209 857 3430 529 Qwest > 6197 800 426 276 BellSouth Network Solutions, >18566 732 176 8 Covad Communications > 3356 716 10892 567 Level 3 Communications, LLC > 4323 681 609 207 Time Warner Communications, I >20115 582 320 333 Charter Communications > 6198 561 337 189 BellSouth Network Solutions, > 7066 509 207 271 Virginia Polytechnic Institut > 852 508 1124 403 Telus Advanced Communications > 7843 506 509 123 Adelphia Corp. > 7132 451 7357 312 Southwestern Bell Internet Se >19029 424 174 275 New Edge Networks > 2386 404 527 211 AT&T Data Communications Serv > 690 400 58 270 Merit Network > 4355 391 329 101 EarthLink, Inc. > 705 382 196 237 UUNET Technologies, Inc. > 376 354 359 114 Reseau Interordinateurs Scien

1 0

Xo or TWT contacts?
by Drew Weaver 12 Dec '03

12 Dec '03

Anyone around I've tried all normal channels without avail, need network techs for either. -Drew

1 0

Opinion on riverhead's DDOS mitigation system?
by Drew Weaver 12 Dec '03

12 Dec '03

Has anyone seen this gear in action? Or does anyone have any better solutions? -Drew

1 0

Looking for an ATT.net (Worldnet) contact
by Dan Ellis 12 Dec '03

12 Dec '03

Greetings... Sorry to post another "looking for a contact" e-mail, but ATT Worldnet has mail blocked a large broadband ISP's mail servers with no response to their abuse contact and no contact at time of blocking. If you are from Worldnet.ATT.net, please contact me. Thanks in advance. --Dan -- Daniel Ellis, CTO, PenTeleData (610)826-9293 "The only way to predict the future is to invent it." --Alan Kay

1 0