November 2004 - Test - lists.nanog.org

Re: Best way to get of Bogon list?
by Majid Farid 29 Nov '04

29 Nov '04

Exactly what I have been doing for last week 2 weeks now. Thanks, Majid -------------------------- Sent from my BlackBerry Wireless Handheld -----Original Message----- From: Suresh Ramasubramanian <suresh(a)outblaze.com> To: Majid Farid <MajidFarid(a)TelecomOttawa.com>; nanog(a)merit.edu <nanog(a)merit.edu> Sent: Thu Nov 25 21:56:04 2004 Subject: Re: Best way to get of Bogon list? Majid Farid <MajidFarid(a)TelecomOttawa.com> wrote: > > I have question for the list what would be best/fastest way to get off > bogon list. Arin allocated us a /19 2 months ago (72.1.192.0/19) We > find that a lot of providers aren't accepting the BGP advertisements > for that block because the block 72.0.0.0/8 was on bogon list. > There's only one widely used "list" of bogons that I know of - bogons.cymru.com, and that is quite well updated. What you are seeing is a whole bunch of providers who have hardcoded bogon lists into their router ACLs, manually. The fastest way for you to get off these providers' ACLs is going to be "call each provider's NOC and tell them to update their filters". srs

12 16

RE: "Make love, not spam"....
by Hannigan, Martin 29 Nov '04

29 Nov '04

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Hannigan, Martin > Sent: Monday, November 29, 2004 1:16 PM > To: nanog(a)merit.edu > Subject: RE: "Make love, not spam".... > > > > > > -----Original Message----- > > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] > > Sent: Monday, November 29, 2004 12:45 PM > > To: nanog(a)merit.edu > > Subject: RE: "Make love, not spam".... > > > > > > > > > > -----Original Message----- > > >> From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] > > >> Sent: Monday, November 29, 2004 11:54 AM > > >> To: nanog(a)merit.edu > > >> Subject: RE: "Make love, not spam".... > > >> > > >> > > >> > > >[ SNIP ] > > > > > >> > > >> The big difference between Lycos Europe, and a script > kiddie with > > >> zombies is that Lycos is mature enough to use restraint > > and not knock > > >> down websites with brute force. They're attempting to use the > > >> politically correct "grown up" way to attack someone: > economics. > > > > > >I didn't know there was a politically correct way to create a > > >BotMonster and rule the Internet by emminent domain. > > > > > >-M< > > > > > > Yeah, that's exactly what they're doing! It's a plot to TAKE OVER > > THE WORLD. You figured it out! > > > > It's about giving the spammers what they want: More > traffic to their > > websites. How can it be wrong when they send out 1 million emails > > that all say "click on this link" and 1 million computers actually > > click the link? Who's in the wrong there? > > > > Besides: "rule the Internet by emminent domain." Isn't' that > > Verisign's job? > > > > For all who are interested, the controller appears to live at > 230.136.241.83 That would be the in-addr folks. 83.241.136.230 -M<

1 0

RE: "Make love, not spam"....
by Hannigan, Martin 29 Nov '04

29 Nov '04

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] > Sent: Monday, November 29, 2004 12:45 PM > To: nanog(a)merit.edu > Subject: RE: "Make love, not spam".... > > > > > > -----Original Message----- > >> From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] > >> Sent: Monday, November 29, 2004 11:54 AM > >> To: nanog(a)merit.edu > >> Subject: RE: "Make love, not spam".... > >> > >> > >> > >[ SNIP ] > > > >> > >> The big difference between Lycos Europe, and a script kiddie with > >> zombies is that Lycos is mature enough to use restraint > and not knock > >> down websites with brute force. They're attempting to use the > >> politically correct "grown up" way to attack someone: economics. > > > >I didn't know there was a politically correct way to create a > >BotMonster and rule the Internet by emminent domain. > > > >-M< > > > Yeah, that's exactly what they're doing! It's a plot to TAKE OVER > THE WORLD. You figured it out! > > It's about giving the spammers what they want: More traffic to their > websites. How can it be wrong when they send out 1 million emails > that all say "click on this link" and 1 million computers actually > click the link? Who's in the wrong there? > > Besides: "rule the Internet by emminent domain." Isn't' that > Verisign's job? For all who are interested, the controller appears to live at 230.136.241.83 Interesting. I started it up and it immediately attacked Yahoo/Akamai: premium3.geo.yahoo.akadns.net Then it went and attacked a slew of other sites and had nothing but errors coming back. It also appears to attack sequentially from the top each time the dll loads. They've miscalculated the speed at which spammers relocate. RBL's aren't realtime. Spammers are near real time. <makeLOVEnotSPAM>(bhGBX5Und`p\|kr3<&D4=RfF#o:4F'^!?)TC:X@Sri)hm"tw!g;E6=uaKe .a*iNb</makeLOVEnotSPAM> </&D4=RfF#o:4F'^!?)TC:X@Sri)hm"tw!g;E6=uaKe.a*iNb</makeLOVEnotSPAM></makeLOV EnotSPAM>.<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <HTML><HEAD> <TITLE>403 Forbidden</TITLE> </HEAD><BODY> <H1>Forbidden</H1> You don't have permission to access / on this server.<P> </BODY></HTML> <makeLOVEnotSPAM>@1w0tu|aG/)*kzM*L"8xbj{GN<y/ZZA\5zg('PIM`6MD$+V&Ta8f"h M3lQvAWZ}iv</makeLOVEnotSPAM> </y/ZZA\5zg('PIM`6MD$+V&Ta8f"hM3lQvAWZ}iv</makeLOVEnotSPAM></makeLOVEnotSPAM >.<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <HTML><HEAD> <TITLE>501 Method Not Implemented</TITLE> </HEAD><BODY> <H1>Method Not Implemented</H1> <makeLOVEnotSPAM>@1w0tu|aG/)*kzM*L&quot;8xbj{GN<y/ZZA\5zg('PIM` 6MD$+V&Ta8f"hM3lQvAWZ}iv</makeLOVEnotSPAM> to / not supported.<P> Invalid method in request <makeLOVEnotSPAM>@1w0tu|aG/)*kzM*L&quot;8xbj{GN<y/ZZA\\5zg('PIM `6MD$+V&Ta8f\"hM3lQvAWZ}iv</makeLOVEnotSPAM><P> </BODY></HTML> > > -Jerry >

1 0

RE: "Make love, not spam"....
by Hannigan, Martin 29 Nov '04

29 Nov '04

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] > Sent: Monday, November 29, 2004 11:54 AM > To: nanog(a)merit.edu > Subject: RE: "Make love, not spam".... > > > [ SNIP ] > > The big difference between Lycos Europe, and a script kiddie with > zombies is that Lycos is mature enough to use restraint and not knock > down websites with brute force. They're attempting to use the > politically correct "grown up" way to attack someone: economics. I didn't know there was a politically correct way to create a BotMonster and rule the Internet by emminent domain. -M<

2 1

Re: who gets a /32 [Re: IPV6 renumbering painless?]
by Paul Vixie 29 Nov '04

29 Nov '04

> > i have long wished for and sometimes needed a way to renumber a host > > w/o killing or restarting its active tcp flows. this isn't a > > layering violation. tcp should be able to know about > > endpoint-renumber events. > > Unfortunately this sounds like a good target for people to mess up > implementations and introduce huge security issues into TCP > stacks. (along the theme of the one which started the recent MD5 > discussion) of course. and if endpoint-renumber were possible, it would also be used in load-balancing handoffs (similar to the thing that goes under the trade name "3TCP"), clustering, failover... plus things we havn't even thought of yet. of course there would be security problems, and just knowing the current sequence numbers wouldn't be enough proof, and there's an interesting question of whether both directions would have to renumber at the same time. this is a nec'y enabling technology for so many things that calling it a layering violation is "outrageous." > But obviously, implemeted properly that would be very useful. The > problem then becomes, how an ISP can signal a renumber. as it turns out, there is no silver bullet -- no single thing that if we could just to that then we'd be done, "roll credits." same thing for spam, as it turns out. it's going to take a lot of little things, which amounts to a lot of hard work by a lot of people, some of whom won't even know eachother or about eachother's work, to get "ipng" done. real time tcp session renumberability is on the list, but it's a big list. what i DON'T like is having the future of "ipng" decided in star chambers where things like A6/DNAME can be killed without transparency or accountability.

1 0

RE: "Make love, not spam"....
by Hannigan, Martin 29 Nov '04

29 Nov '04

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] > Sent: Monday, November 29, 2004 11:00 AM > To: nanog(a)nanog.org > Subject: Re: "Make love, not spam".... > > > > Rich Kulawiec <rsk(a)gsp.org> wrote: > > Already noted as unbelievably stupid and dissected on Spam-L, > > I'm inclined to agree... > > > but: getting into a bandwidth contest with spammers is a guaranteed > > loss, as they have an [essentially] infinite amount available to > > them for free. Apparently Lycos is unaware of zombies (including > > those hosting web sites), HTTP redirectors, rapidly-updating DNS, > > throwaway domains, and other facts of life in the spam sewer. > > ... but this screensaver means that Lycos *also* have a botnet > available to them. That means they are subject to the same sanctions as a botnet. This isn't a new issue to the operator community. We have a consistent opinion of this type of actvity going as far back as Green Card Lawyers and Sanford Wallace/Cyberpromo. The risks are too high for this to be anything but a publicity stunt. I can't read any German other than "bier". Is the utility up there? I'd love to take a look at it. -M<

1 0

FW: "Make love, not spam"....
by Miller, Mark 29 Nov '04

29 Nov '04

Scratch that... Yes, the A record. You are right. I need coffee or something... :-) -----Original Message----- From: Miller, Mark Sent: Monday, November 29, 2004 9:27 AM To: nanog(a)merit.edu Subject: RE: "Make love, not spam".... Not the A, the PTR... But yes, that could be a nasty retaliation by spammers with control of their DNS. I would hope, however, that the "screen saver's" target would be an IP address instead of a FQ mnemonic hostname. From the article, I understand that Lycos will be manually watching the list of targets and pushing updates to the users. Although I have traditionally been in favor of low bandwidth "fixes", this kind of appeals to my sense of poetic justice. -mark -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Mike Tancsa Sent: Monday, November 29, 2004 9:12 AM To: Suresh Ramasubramanian Cc: nanog(a)merit.edu Subject: Re: "Make love, not spam".... ... What about the case where the spammer gets black listed, traffic starts pounding the rouge site and then the spammer changes the A record to be www.example.com instead. Now all of a sudden www.example.com is being pounded by all those screen savers. ---Mike

1 0

Consortium sheds light on dark fiber's potential
by Vicky 29 Nov '04

29 Nov '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 http://www.eetimes.com/showArticle.jhtml?articleID=53700951 regards, /vicky -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBpMpOpbZvCIJx1bcRAqFmAJ96505uhm2Ipg//JLYktUm59adqsQCgi1Hh mnOxyvTt188SnRmHtU5sBo8= =cdob -----END PGP SIGNATURE-----

7 8

Re: "Make love, not spam"....
by Fergie (Paul Ferguson) 29 Nov '04

29 Nov '04

The BBC also has an article this morning about this: http://news.bbc.co.uk/2/hi/technology/4051553.stm - ferg -- "Fergie (Paul Ferguson)" <fergdawg(a)netzero.net> wrote: Techdirt has an article this morning that discusses how Lycos Europe is encouraging their users to run a screensaver that constantly "pings servers suspected to be used by spammers" and also suggests that "In other words, it's a distributed denial of service attack against spammers by Lycos." The Techdirt article referenced is on Heise Online: http://www.heise.de/english/newsticker/news/53697 I'd be curious to hear what NANOG readers thoughts are on this. Techdirt is located at http://www.techdirt.com/ - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

1 0

Re: who gets a /32 [Re: IPV6 renumbering painless?]
by Paul Vixie 29 Nov '04

29 Nov '04

> (catching up) (you missed some stuff.) > On 2004-11-22, at 18.52, Paul Vixie wrote: > > > (let me put it this way: A6/DNAME was shot down because of > > complexity, and it was simpler than this.) > > I am not convinced A6/DNAME would have solved all problems, not even > all of the ones you pointed out. the property of a6/dname that wasn't widely understood was its intrinsic multihoming support. the idea was that you could go from N upstreams to N+1 (or N-1) merely by adding/deleting DNAME RRs. so if you wanted to switch from ISP1 to ISP2 you'd start by adding a connection to ISP2, then add a DNAME for ISP2, then delete the DNAME for ISP1, then disconnect ISP1. the DNAME was expected to be inside your own zone. presto, no lock-in. my theory at the time, bitter and twisted i admit, was that we had too many ISP employees in positions of power inside IETF, and that A6/DNAME was seen as shifting too much power to the endsystems. i've since learned that it was just another case of FID (fear, ignorance, and doubt). naturally this presumed that you could add and delete ipv6 supernets from a LAN, which appeared to be the case at that time, though now with dhcp6 and static addressing making a comeback that's no longer clear. in any case there was a need for a TCP option for endpoint-renumber, which was killed in a committee somewhere (i don't know which one, or where or when.) given that ipv6 is now somewhat deployed without rapid renumbering, and that rapid renumbering could have required logic in "both endpoints" of every flow, but that there are now a lot of "other endpoints" without any such logic, it seems to me that MULTI6's only option is to make NAT work, even if you call it "site local addressing" or even "ULA's". (show me.)

7 10