September 2003 - Test - lists.nanog.org

[Fwd: monkeys.dom UPL DNSBL being DDOSed to death]
by Matthew Sullivan 23 Sep '03

23 Sep '03

Forwarded for your information. That leave 2 proxy DNSbls left - SORBS and DSBL... Looking at the stats for SORBS over at SDSC looks like SORBS is pretty ineffective thanks to the DDoS: (see: http://www.sdsc.edu/~jeff/spam/cbc.html) -------- Original Message -------- From: Jon R. Kibler <Jon.Kibler.multi(a)ng.aset.com> Newsgroups: news.admin.net-abuse.email Subject: monkeys.dom UPL DNSBL being DDOSed to death Date: Tue, 23 Sep 2003 14:26:47 -0400 Greetings to all: I have some really sad news. I just got off the telephone with Ron Guilmette who runs the monkeys.com Unsecured Proxies List DNSBL. I hate to say it, but monkeys.com has been killed. It has been DDOSed to death. Ron says that every aspect of his network is undergoing a massive DDOS attack from thousands of IPs -- apparently many/all spoofed. He has tried to get law enforcement to investigate, but to no avail. He indicated that this is probably the end of his service. This makes two DNSBLs that have been DDOSed to death recently. Which one is next? NJABL? ORDB? The computer security industry really needs to figure out how to get law enforcement to take these attacks seriously. It would only take a few good prosecutions to put an end to these types of attacks. Any thoughts/suggestions? This is really a dark day for those of us fighting spam. It looks like the spammers have won a BIG battle. The only question now is who will be the causality in this war? Jon R. Kibler A.S.E.T., Inc. Charleston, SC USA

3 3

Foundry BigIron series
by william+nanog＠hq.dreamhost.com 23 Sep '03

23 Sep '03

We're considering switching to Foundry BigIrons (probably the 4000, as opposed to Cisco 6500 series switches. We're currently using 7206VXRs). Anyone have opinions (on or off list) on this product? Looking through the archives, I don't notice any discussions of this since about 2001 [1]. (http://www.foundrynet.com/products/l3backbone/bigiron/BigIronx00Datasheet.h…) I'm mostly interested in its BGP implementation, as the boxes would be handling our core routing via BGP. (I haven't noticed anyone complaining about BGP problems in the past year or so); also opinions on the CLI would be helpful (I'm told it's 95% identical to IOS's CLI). The CLI was another complaint in the thread cited below, so I'm curious if it has improved since 2001. I'd be interested in hearing about the comparable Riverstone boxes as well. [1] thread starting at http://www.merit.edu/mail.archives/nanog/2002-09/msg00050.html -- "Since when is skepticism un-American? Dissent's not treason but they talk like it's the same..." (Sleater-Kinney - "Combat Rock")

1 2

Follow up to: [Fwd: monkeys.dom UPL DNSBL being DDOSed to death]
by Matthew Sullivan 23 Sep '03

23 Sep '03

Hi all, Sorry people I had forgotten about EasyNet.nl's proxy list (Wirehub).... and for the record for a proxy spam blocker I don't rate the opm. Yours Matthew

1 0

Re: Providers removing blocks on port 135?
by Mike Tancsa 23 Sep '03

23 Sep '03

At 01:55 PM 21/09/2003, Justin Shore wrote: >On Sun, 21 Sep 2003, Mike Tancsa wrote: > > > Yes, this is all too familiar. Luckily it was not so acute for us. The > > porn company in question was using legit credit cards and we knew where > > they were located. We too got to the point where I had to contemplate > > blocking dialups with no ANI as I had already blocked all access from > their > > phone numbers. However, once they started doing that I called up their > > office yelling and screaming law suits and I guess they figured there were > > other ISPs that didnt care as much and moved on to them. > >I don't know if you did this but if it were me I'd have contacted two >other places. The first would have been the credit card companies with >the stolen credit cards. The credit cards in our case were legit. They were different numbers, but they were not stolen. > They are usuaully fairly responsive when it >comes to them loosing money. Secondly after I contacted the local police, >state BI, and perhaps the FBI (assuming no luck could be had with any of >them) I am in Canada, but I know that it has been stated that the FBI will not investigate computer fraud if damage is under $100,000. >I would have given the story to the local media. There's nothing >like a little bad PR to give law enforcement a little kick in the butt. I doubt a porn company with international clientele would give a toss about what the local media say. >If your newspapers where you're at are anything like our's, they love to >print a good scandal involving the local government. Local government has nothing to do with it. It was just some dime a dozen porn company. ---Mike

3 5

Re: Verisign Responds
by Rich Braun 23 Sep '03

23 Sep '03

Leo Bicknell wrote: >Looks like the lawsuits are going to be the ones to settle this >dispute...anyone think there's a chance of ICANN pulling .COM and .NET >from Verisign due to breach of contract? I think it's highly unlikely. Dave Stewart wrote: >Oh, I dunno... ICANN has no teeth, so that won't happen. Shouldn't one of them smarty-pants attorneys file for an immediate injunction against VeriSign? Looks like plenty of technical arguments have been posted here which even the most dim-witted judge would understand vs. the public position taken by VeriSign that they should keep their cash register jingling with Sitefinder proceeds while the topic is studied and/or fought over for another 24 months. It's obvious to me that the technical arguments fade out quickly if the service is kept up and running. VeriSign cashes in while everyone else incurs the expense of implementing workarounds and bug-fixes. Once the workarounds are in place for more than a couple weeks, there isn't much impetus to put everything back the way it was. Has an injunction been requested? -rich

1 0

RE: Foundry BigIron series
by Joel Perez 23 Sep '03

23 Sep '03

Hey Will, I do not have experience using any Foundry boxes. I do however use Riverstone extensively; my whole network is composed of RS boxes ranging from RS3000's up to RS8600's. I have an RS8600 handling my core routing right now! Im taking full bgp tables from 3 upstreams and several gig and ds-3 links for my OSPF backbone. I used to have a 7206VXR trying to do the same. The cli is in my opinion easier than Cisco's IOS to learn. It has plenty of neat features that make it very user friendly. The only issue I have had is with the way it handles flows. I used to hit 100% cpu utilization when my traffic peaked due to the way the flows were handled. However, the problem was sort of fixed by enabling Riverstone's version of Cisco's CFE and move the flows to the ASIC's in the linecards. Just as an example during my peak usage I move between 300-350Megs of traffic and my cpu barely goes above 10% utilization. The draw back is that I can not use ACL's as effectively in my core, so I moved all my ACL's to my edge routers! Oh, and they are a fraction of the cost of the other big name brands. If you want any more info you are more than welcome to ask. Regards, ---------------------------------------------- Joel Perez <jperez(a)ntera.net> | IP Engineer http://www.ntera.net/ | Ntera 305.914.3412 >>-----Original Message----- >>From: Will Yardley [mailto:william+nanog@hq.dreamhost.com] >>Sent: Tuesday, September 23, 2003 2:55 PM >>To: nanog(a)merit.edu >>Subject: Foundry BigIron series >> >> >>We're considering switching to Foundry BigIrons (probably the 4000, as >>opposed to Cisco 6500 series switches. We're currently using 7206VXRs). >>Anyone have opinions (on or off list) on this product? Looking through >>the archives, I don't notice any discussions of this since about 2001 [1]. >> >>(http://www.foundrynet.com/products/l3backbone/bigiron/BigIronx00Datas heet >>.html) >> >>I'm mostly interested in its BGP implementation, as the boxes would be >>handling our core routing via BGP. >>(I haven't noticed anyone complaining about BGP problems in the past >>year or so); also opinions on the CLI would be helpful (I'm told it's >>95% identical to IOS's CLI). The CLI was another complaint in the thread >>cited below, so I'm curious if it has improved since 2001. >> >>I'd be interested in hearing about the comparable Riverstone boxes as >>well. >> >>[1] thread starting at >>http://www.merit.edu/mail.archives/nanog/2002-09/msg00050.html >> >>-- >>"Since when is skepticism un-American? >>Dissent's not treason but they talk like it's the same..." >>(Sleater-Kinney - "Combat Rock") >>

1 0

Re: Verisign Responds
by Paul Vixie 23 Sep '03

23 Sep '03

> I wonder btw why Verisign didn't catch the "typo's" in their > own domains if they think it is that important: > ... > ;; QUESTION SECTION: > ;wwww.verisign.com. IN A wildcards don't work that way. there are ns rr's in .com for verisign.com, so you get a referral to those servers no matter whether a *.com wildcard exists or not.

2 1

bind 9.2.3rc3 successful
by William Allen Simpson 23 Sep '03

23 Sep '03

Thought I'd mention that I helped setup BIND 9.2.3rc3 on a yellowdog linux powercomputing machine tonight. It worked. And the mail queues began clearing out. Just for an oddball success report. Are others having similar luck? What needs to be done to make this a standard feature set? Is somebody working on an RFC? -- William Allen Simpson Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32

8 8

Windows updates and dial up users
by Sean Donelan 23 Sep '03

23 Sep '03

Larry Seltzer has a nice column about the difficulties of keeping up with Windows patches if you have a dialup connection. http://www.eweek.com/article2/0,4149,1272162,00.asp "It occurred to me that one way to make things easier for dial-up users, and even broadband users in many cases, would be to issue periodic update CDs. Imagine a disc with all of the updates on it and a program, it could even be written in Windows Script Host, to check a system for which updates need to be installed, apply them in the correct order and even reboot in between. Such a program would not be hard to write." [...] "I recently put this suggestion to Microsoft and their response basically avoided the whole issue. Why wouldn't the company want to offer such a CD, assuming that's the motivation behind their stonewalling?"

8 12

Re: bind patches++ (Re: Wildcards)
by Paul Vixie 23 Sep '03

23 Sep '03

> Hello Paul , All , Is there a url listing the TLD's that > officially use wild cards in their deployment ? nope. right now you just have to know. we're trying to keep a list of places that either use wildcards and have been accepted by the community, or don't use wildcards but run bind8 or other old broken software that incorrectly sends answers rather than referrals when queried for data held as subzone glue... > > see www.isc.org/products/BIND/delegation-only.html for details. ...and that's where you'll find it. it's very possible that declaring a small number of zones delegation-only will be less work and less intrusive than trying to find/list the exceptions.

1 0