August 2003 - Test - lists.nanog.org

Edge 1 Networks/Williams Communications Group
by Jeff Kell 05 Aug '03

05 Aug '03

After several run-ins with Edge 1 Networks [69.44.28.0/22] having their machines "hijack" victim machines on our networks infected with Jeem, and then making their spam runs, I've had it. I have reported both to Edge 1 and their parent Williams Communications Group [AS7911] with no result and I will be blocking Edge 1 [in theory, AS29986, but no doubt private spewage from WCG.NET) They hijacked a Jeem proxy on July 17th, it was shut down. The help desk thought they had cleaned it up, but within 30 mins of placing it back online again, Edge 1 grabbed it again. I brought it into the lab with a sniffer, rebooted (new IP), and Edge 1 picked it up within 10 minutes and began spam/proxying. This past Sunday, a similarly Jeem'ed machine was hijacked by the same Edge 1 block (numerous machines in the Edge 1 block, mind you) and due to me being out of the office it wasn't noticed and shutdown until Tuesday, after a little over a half million proxied spams. Are these people just totally off-the-wall? Google searches seem to concur. I am awaiting confirmation that ALL the proxies originated from Edge 1 (takes a while to churn through those gigs of pix logs). Jeff Kell University of Tennessee, Chattanooga

3 2

clearblue part deux
by John Kinsella 05 Aug '03

05 Aug '03

So haven't seen anybody else mention it yet...Clearblue in SFO went off-net for 3ish hours today, again as the result of internal power issues as far as I can tell. Gennys didn't kick in. After gettin my stuff back up, went for a self-guided tour of the facility to find 3 guys gathered around one of their UPSes scratching their heads. I suspect something went *poof*. At least it was a Saturday... Personally, I'm looking forward to renegotiating my contract later this year. :) John

5 6

Re: testing bandwidth of big internet pipes
by Michael.Dillon＠radianz.com 05 Aug '03

05 Aug '03

>At the moment we are looking for a good badwidth test within your network to test the line and to see if the customer gets what he has asked/paid for. Have you tried pathload/pathrate? http://www.cc.gatech.edu/fac/Constantinos.Dovrolis/bw.html Pathchirp is another possibility http://www.spin.rice.edu/Software/pathChirp/ Both of these websites have documents that you may find useful, or you can google on pathrate or pathchirp to find additional documents. --Michael Dillon

1 0

Proper Protocol for Dealing with Unresponsive Contacts?
by Patrick Muldoon 05 Aug '03

05 Aug '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Greetings, What is the proper way to deal with a company that is unresponsive to any form of contact. IE they have outdated information on their ip assignments, bounce every piece of e-mail that I send? (including postmaster@ which is where the bounce message come from). Here is the situation I am facing. We just registered a new domain (tigerny.net/com) for a project we are working on . It appears that a company, in this case Tigerfund.com has a Microsoft Domain called TIGERNY. Well due to the the helpful setting in Windows that says register this connection in dns (Or something along those lines). We are now seeing 1000's of failed update attempts to our nameservers per day from all of the Tri-State area, mostly cable-modem networks, but also coming from AS5703, as these machines try in vain to update the dns information. As None of the contact information is correct, I have yet to be able to contact a human being, in an attempt to get this corrected. What should my next steps be? My thought is to go to their upstream (AS8112) and try to get contact through them. If it was just a a couple places that this traffic was being sourced from I would just null route them, but since it is all over the place, mostly coming from dynamic ip blocks in RR and Cablevision's cable modem networks, it makes blocking it at our edge rather difficult, if not impossible. Thanks in advance for any suggestions, - -Patrick - -- Patrick Muldoon Network/Software Engineer INOC (http://www.inoc.net) PGPKEY (http://www.inoc.net/~doon) Key fingerprint = 8F70 6306 F0A7 B8DA BA95 76C4 606A 7DC1 370D 752C "Back off Man!, I'm a scientist" Peter Vinkman -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (FreeBSD) iD8DBQE/L7uIYGp9wTcNdSwRAkP+AJwPsuxH/lu4MSr0mSNzW7edLPC4cwCgsaH0 VOhO3bUkmzd116UYakvJolw= =DiAR -----END PGP SIGNATURE-----

3 2

Re: Complaint of the week: Ebay abuse mail (slightly OT)
by Michael.Dillon＠radianz.com 05 Aug '03

05 Aug '03

>> The web of trusted email servers would use a new and improved mail >> transfer protocol (NIMTP) that would only be used to exchange email >> between trusted servers. Users could continue to use authenticated SMTP to >> initiate the sending of email, but nobody would accept any unauthenticated >> SMTP servers any more. >And this would deploy how? In particular, consider the following questions: A few of the larger user sites such as AOL and MSN would deploy it between themselves. Once it is proven, they would analyse their logs and invite the large email sender sites to begin using the protocol. Once it is clear that NIMTP can be deployed easily and cheaply, they begin to impose rate limiting on email senders using SMTP which will cause queues to build at the email sender sites. Eventually running NIMTP will be recognized as the right thing to do and everyon will use it. >1) What *immediate* benefits do you get if you are among the first to deploy? >(For instance, note that you can't stop accepting "plain old SMTP" till >everybody else deploys). You can replace complex and buggy spam filtering software with simple rules on your NIMTP servers. Since the spammer cannot spoof their identity, you simply rate limit them based on the volume of attempts. I.e. if a sender attempted to send 10 messages in one hour, you might limit him to 2 per hour but if he attempted to send 100 per hour you would limit him to 1 per hour. And if he attempted to send 1000 per hour you would limit him to 1 every 4 hours. >2) Who bears the implementation cost when a site deploys, and who gets the >benefit? (If it costs *me* to deploy, but *you* get the benefit, why do I want >to do this?) The site owners pay all the costs and reap all the benefits. Just like today with spam filtering. >3) What percentage of sites have to deploy before it makes a real difference, >and what incremental benefit is there to deploying before that? (For any given >scheme that doesn't fly unless 90% or more of sites do it, explain how you >bootstrap it). The incremental benefit is there if NIMTP deployment starts with large email sites. >4) Does the protocol still keep providing benefit if everybody deploys it? >(This is a common problem with SpamAssassin-like content filters - if most >sites filter phrase "xyz", spammers will learn to not use that phrase). Of course it keeps providing benefits. The two key elements of NIMTP (New Improved Mail Transfer Protocol) are that the receiver will only receive email messages from a known sender site and the sender site will certify the identity of the message sender. In order to know the sender site, there needs to be an authentication handshake for a session and it needs to be based on some kind of prearranged agreement and key exchange. In order to certify the message sender, all messages will need to be relayed through an NIMTP relay site and the message sender will need to authenticate themself, i.e. using something like AuthSMTP. But AuthSMTP will only be used between mail clients and their email service provider. NIMTP is intended to be used between email service providers. Some of these NIMTP sites will be relaying email for smaller NIMTP sites that cannot afford the complexity of prearranging keys with all other NIMTP sites. To summarize, the NIMTP core will have NIMTP peering arrangements with every other member of the NIMTP core, but many NIMTP sites will only have NIMTP peering with one or two other sites. In order for anyone to send email within the NIMTP world they will need to hand the email to any NIMTP site who will relay it to its destination. But the NIMTP site will only accept email if it can certify the sender's identity. >If you have a *serious* proposal that actually passes all 4 questions (in >other words, it provides immediate benefit to early adopters, and still >works when everybody does it), bring it on over to 'asrg(a)ietf.org'. I've just joined the ASRG list and if I can find the time I will try to write this up as a draft architecture and post it. But feel free to copy these emails to ASRG if you feel it would be worth discussing there. --Michael Dillon

2 1

Electrical Engineering Firm Recommendation
by Dan Lockwood 05 Aug '03

05 Aug '03

Can someone recommend an electrical engineering firm in the middle to north part of California that has experience with NOC design? TIA Dan Lockwood

1 0

Re: Complaint of the week: Ebay abuse mail (slightly OT)
by neil＠DOMINO.ORG 05 Aug '03

05 Aug '03

> And so we should do nothing? Absolutely not, and perhaps I should have been clearer in that respect. There needs to be more of an understanding of why people spam and what can be done to tackle that issue head on, its a social/educational issue. Do you think the people spamming the Nigerian scam do it because its a good laugh? No they do it because they think they will make money from it, some of the are succesful, even to this day, but its now such a common message that its almost a net legend. Education of these people to show them the err of their ways would deal with the problem. And typically thats a more expensive problem to solve and requires resolve from politicians and lawmakers, who unfortunately are overwhelemed with other "more important" issues. Until there is a much more hand in hand joint social / technical attack on the root causes then we will always have spam. I've tried many of the technical solutions and they end up shooting you in the foot more times than they are worth, although I do agree a more stronger mail transfer protocol should be developed but not just to deal with spam issues alone. Its akin to the way that most [all?] governments have abysmally failed to make any progress on dealing with illegal narcotics. The publicilty campaign formally known as "The war on drugs" was focused on attacking the suppliers and the manufacturers, when the root cause of the problem is with the demand of the people who use the drugs in the first place. We're now off topic and you don't need to send me an email Susan! Regards, Neil.

1 0

Humidity ranges?
by Steve Francis 05 Aug '03

05 Aug '03

We have sensors in our datacenters that report, among other things, humidity. One data center is exceeding the predefined humidity alerts of the devices, but given that cisco says the operating humidty of routers is 10% to 85%, I dont know if humidity of, say, 65% is anything to worry about. Anyone know if increased humidity correlates with decreased MTBF? And reasonable thresholds that I can tolerate, and when I should complain to the datacenter operators? (References I can point to would be nice.) Thanks

7 6

Re: Complaint of the week: Ebay abuse mail (slightly OT)
by Michael.Dillon＠radianz.com 04 Aug '03

04 Aug '03

>we all knew that profitable large network owners would change the landscape >compared to merely ebitda-positive large network owners, and here's an >example of how "big company" cost management practices can go up against >"reasonable and customary internet behaviour" and pretty much ignore it. Having an abuse@ email address may be customary Internet behavior but it is no longer reasonable. The fact is that SMTP email has outlived its usefulness and needs to be replaced with something that provides a chain of authentication that certifies the sender's identity. Once email senders are no longer able to falsify their identity, then it will again be economically feasible for companies to accept abuse@ email from anyone. Instead of working to prevent email relaying, we should be working to encourage it along with certification of the sender's identity. If we had a web of ISP mail servers that trust each other to certify the sender's identity, then people would be happy to accept any and all email relayed through that web. The web of trusted email servers would use a new and improved mail transfer protocol (NIMTP) that would only be used to exchange email between trusted servers. Users could continue to use authenticated SMTP to initiate the sending of email, but nobody would accept any unauthenticated SMTP servers any more. --Michael Dillon

5 4

Re: Complaint of the week: Ebay abuse mail (slightly OT)
by Richard D G Cox 04 Aug '03

04 Aug '03

Valdis Kletnieks <Valdis.Kletnieks(a)vt.edu> wrote: > 1) What *immediate* benefits do you get if you are among the first to > deploy? (For instance, note that you can't stop accepting "plain old > SMTP" till everybody else deploys). The immediate benefit (as sender) is that you reduce the (now ever-increasing) risk of your mail being rejected by filtration processes and will be trusted on arrival; the benefit for the recipient is of course less junk! However you CAN stop accepting "plain old SMTP" right away, because you can delegate that to a filtration service that hosts your old-style MX, applies ever-increasingly stringent filtration rules, and then forwards to you using the new protocol. Several such filtrations services may well appear when the time is right. > 2) Who bears the implementation cost when a site deploys, and who gets > the benefit? (If it costs *me* to deploy, but *you* get the benefit, > why do I want to do this?) Both parties get benefits which seriously outweigh the costs! > 3) What percentage of sites have to deploy before it makes a real > difference, and what incremental benefit is there to deploying before that? To some extent the concept is already here, and deployed, whether using in-house filters or remote-MX, to subject the unauthenticated mail - which of course is currently ALL the mail - to appropriate filtering. > (For any given scheme that doesn't fly unless 90% or more of sites do it, > explain how you bootstrap it). That is a very valid point that most people don't address. I define any new scheme as unworkable unless someone can describe the present, albeit unsatisfactory, arrangements that it offers to replace as a "special case" of the new scheme for which there is clearly-defined correct handling. > 4) Does the protocol still keep providing benefit if everybody deploys it? That depends entirely on the contactual relationships that may exist between mail-exchanging sites. Just implementing an authenticating protocol on its own will NOT help. There will be a prima-facie need for a selection of "trust-authorities" who specify what is acceptable for their trusted-senders to send. Recipients then get to choose which criteria are closest to their requirements (including whitelisting if needed on a per-site basis). > (This is a common problem with SpamAssassin-like content filters - if most > sites filter phrase "xyz", spammers will learn to not use that phrase). That goes for any precautions taken - not just content filters. That is WHY the contractual relationships are absolutely essential for any new scheme. And there, too, lies the bulk of the work needed - the technical issues do not place any great demands on the networking community. > If you have a *serious* proposal that actually passes all 4 questions > (in other words, it provides immediate benefit to early adopters, and > still works when everybody does it), bring it on over to 'asrg(a)ietf.org'. Heh. The noise-to-signal level *there* is far worse than in NANOG - by at least 12dB last time I looked ;-) -- Richard Cox RC1500-RIPE

2 1