September 2003 - Test - lists.nanog.org

RE: Another DNS blacklist is taken down
by Mark Segal 24 Sep '03

24 Sep '03

I think some RBLs might get better responses from the ISPs when they stop taking "collateral damage gets the abuse department's attention" attitudes.. Some RBLs cause many providers a LOT of headaches, so it is not surprising that when it is their turn to complain, the ISPs will just say: post to abuse.ddos.isp.net and we might get around to fixing it. :). Regards, Mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: Justin Shore [mailto:listuser@numbnuts.net] Sent: September 24, 2003 12:29 PM To: nanog(a)merit.edu Subject: Another DNS blacklist is taken down I thought ya'll might be interested to hear that yet another DNS blacklist has been taken down out of fear of the DDoS attacks that took down Osirusoft, Monkeys.com, and the OpenRBL. Blackholes.compu.net suffered a joe-job earlier this week. Apparently the joe-jobbing was enough to convince some extremely ignorant mail admins that Compu.net is spamming and blocked mail from compu.net. Compu.net has also seen the effects of DDoS attacks on other DNS blacklist maintainers. They've decided that the risk to their actual business is too great and they are pulling the plug on their DNS blacklist before they come under the gun by spammers. http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&selm=3f70e839%24 1%40dimaggio.newszilla.com Ron Guilmette, maintainer of the Monkeys.com blacklists has posted a farewell from Monkeys.com to news.admin.net-abuse.email. Ron cites the total lack of interest in the attacks by both big network providers and law enforcement authorities as the ultimate reason he's pulling the plug. http://groups.google.com/groups?q=%22Now+retired+from+spam+fighting%22&hl=en &lr=&ie=UTF-8&oe=UTF-8&selm=vn1lufn8h6r38%40corp.supernews.com&rnum=4 It's truely a sad day for spam fighters everywhere. So, my question for NANOG is how does one go about attracting the attention of law enforcement when your network is under attack? How does the target of such an attack get a large network provider who's customers are part of the attack to pay attention? Is media attention the only way to pressure a response from either group? These DDoS attacks have received some attention in mainstream media: http://www.msnbc.com/news/959094.asp?0cv=TB10 http://www.boston.com/news/nation/articles/2003/08/28/saboteurs_hit_spams_bl ockers Apparently it hasn't been enough. Legal remedies take too long and are cost prohibitive (unless you're the DoJ). Subpoenas and civil lawsuits take months if not years. Relief is needed in days if not hours. Justin

5 4

Re: Verisign Responds
by Paul Vixie 24 Sep '03

24 Sep '03

> See the NANOG archives for my post reguarding wildcard caching and set > comparison with additional resolver functionality for requesting if the > resolver wishes to receive wildcards or NXDOMAIN. oh... that wasn't a joke, then? there won't be a protocol change of that kind, not in a million years.

4 4

RE: monkeys.dom UPL being DDOSed to death
by sowens＠epik.net 24 Sep '03

24 Sep '03

Provide me a list of requirements and I'll see what I can do about the bandwidth, colo and BGP session. Shane -----Original Message----- From: John Payne [mailto:john@sackheads.org] Sent: Tuesday, September 23, 2003 7:41 PM To: nanog(a)merit.edu Subject: Re: monkeys.dom UPL being DDOSed to death --On Tuesday, September 23, 2003 6:11 PM -0400 Kai Schlichting <kai(a)pac-rim.net> wrote: > - BGP anycast, ideally suited for such forwarding proxies. > Anyone here feeling very adapt with BGP anycast (I don't) for > the purpose of running such a service? This is a solution that > has to be suggested and explained to some of the DNSBL operators. Anyone want to offer hardware, colo, bandwidth and a bgp session for a dnsbl anycast solution?

1 0

Re: "Class A Data Center"
by Scott Francis 24 Sep '03

24 Sep '03

On Wed, Sep 24, 2003 at 03:06:30PM -0400, devon(a)noved.org said: > On Wed, 24 Sep 2003, Scott Francis wrote: > > > I don't know if it qualifies as an "established standard", but ISTR that > > Steve Bellovin had a paper about various levels of reliability in data > > centers ... [searches] argh. I can't find it yet. Perhaps Mr. Bellovin can > > refresh my memory ... the paper I'm recalling had specifications for 5 or so > > different levels of reliability and redundancy in data centers (able to > > withstand criminal attack, armed attack, conventional explosives, nuclear > > explosion, acts of God, etc.) and was interesting reading. The focus, as I > > recall, was on the level of engineering required to reach various levels of > > uptime (99.9, 99.99, 99.999, etc.). > > > > This ringing a bell for anyone else? > > Do you mean <http://www.donelan.com/design/general.html>? doh! Indeed I do mean that file. I got Bellovin and Doneland mentally transposed for some reason. Apologies all (still thought that document was a good read, though). -- Scott Francis || darkuncle (at) darkuncle (dot) net illum oportet crescere me autem minui

1 0

"Class A Data Center"
by Bob German 24 Sep '03

24 Sep '03

Can anyone point me to a set of standards that define a "Class A Data Center?" I'm not asking for requirements, but an actual pointer to standards hammered out by an organization or governing body. Thanks.

8 8

Rack space in Chicago.
by John Palmer 24 Sep '03

24 Sep '03

Looking for rack space in Chicago to house 2 - 2U servers, a cisco 3620, a hub and flat panel/keyboard tray. Will need net access and 8 ip addresses. Low bandwidth usage. Contact me at user info at domain adns.net.

1 0

The *.com/robots.txt
by Guy Coslado (GC0111) 24 Sep '03

24 Sep '03

I've found inconsistencies in search engines mainly with domain name having transient status. Such dn inherit a new IP , the *.com IP ( the sitefinder IP). And sitefinder itself has its own inconsistency: Here an example using Nestscape or Mozilla (my IE6 config gives other results). http://www.pallet-containers-unlimited.com/bizdc.html http://sitefinder.verisign.com/lpc?url=pallet-containers-unlimited.com/bizd… That gives a link in Did You Mean ? We did find these similar Web addresses. http://www.pallet-containers-unlimited.com/bizdc.html And now searching with sitefinder http://sitefinder.verisign.com/spc?sb=pallet-containers-unlimited.com&searc… If VeriSign sitefinder doesnt take care of this case, what can we wait with other search engines ? The query : http://www.pallet-containers-unlimited.com/robots.txt gives User-agent: * Disallow: / is also a false answer that can confuse lot of http agents => for simple example, sites with dn in REDEMPTIONPERIOD can be suppressed or blacklisted from search engines indexes for a while. Because nobody knows already all the side effects I'm not sure having a robots.txt here is the best choice. On the other hand SE indexes can keep undefinitively no (more) existent sites without the *.com/robots.txt Possibly the *.com redirect will give us other surprises with search engines. Guy Coslado. http://www.coslado.com Bots & Smart Agents Pour la Guilde des metiers du logiciel: admin(a)fr.scguild.org http://www.fr.scguild.com

1 0

Re: Detecting a non-existent domain
by Kee Hinckley 24 Sep '03

24 Sep '03

At 10:24 AM -0400 9/24/03, John A. Martin wrote: > >>>>> "Kee" == Kee Hinckley >>>>>> "RE: Detecting a non-existent domain" >>>>>> Tue, 23 Sep 2003 20:16:04 -0400 > > Kee> At 3:15 PM -0700 9/23/03, David Schwartz wrote: > >> How would you do this before? Does an A record for a hostname > >> mean that a host with that name exists? If so, then all *.com > >> 'hosts' now 'exist'. If not, what did you mean by exist before? > >I just lurk nanog so my question probably doesn't count. Anyway, >whats wrong with checking what used to be called "the DNS invariant", >ie. name <-> ip queries should agree as in That seems like it would work as well. In my case I need to make use of the A and MX records for other things anyway, so I might as well go that path. I'd need to sit down and see which mechanism uses the least queries. I'm concerned though that all these mechanisms could fall apart if Verisign decided to start using a third-party content provider to distribute the load on their server. -- Kee Hinckley http://www.messagefire.com/ Next Generation Spam Defense http://commons.somewhere.com/buzz/ Writings on Technology and Society I'm not sure which upsets me more: that people are so unwilling to accept responsibility for their own actions, or that they are so eager to regulate everyone else's.

1 0

Do not call on hold
by Timo Janhunen 24 Sep '03

24 Sep '03

The Do Not Call registry is on hold... http://news.findlaw.com/cnn/docs/ftc/donotcall92303ord.pdf

2 1

Appologies
by Matthew Sullivan 24 Sep '03

24 Sep '03

Appologies to all, and the other DNSbls, I'm a little uptight about how long it is taking for the arrest of the DDoSer. Yes he has been identified, and that's all I can say. / Mat

6 5