December 2004 - Test - lists.nanog.org

Re: The Cidr Report
by Joe Provo 14 Dec '04

14 Dec '04

[This was started last month. been a little busy. unsuprisingly I only had to *add* an incident and it still works.] On Fri, Nov 12, 2004 at 02:47:30PM -0800, Randy Bush wrote: [snip] Yes it means what you think. No, I don't see anyone giving a rat's patootie about aggregation. I was starting to think I was the only one still reading the reports. Had a half-written rant each time interesting events happened, just been too busy. In recent months: - on the 4th->5th of November, the (reported) table bloated by ~9k pfefixes overnight. not an eyebrow raised. - when the table bloated over 140k, just this last July, the report was hosed at the end of a cycle obviously hit its own MAXINT. Not a comment from regular report readers, nor even a mocking Nelson "Ha-Haw" post by those taking the actions. - this month, another knee was at 150k [Dec 4th] and similarly garbled results came out. Again, no response. ...in this one year we've seen the shape of the climb return to the curve characterized by two years 99-01. Going for e? I'm not quite sure what the current point of the report is if no-one responds to even it breaking. I never saw a single post following up to to the actual purpose and policy issues from October's "aggregation & table entries" thread. Other than the specifics of multihomed customers and RPF issues, my point about segregation of internal and externaal policies and the reflection in the "announce used" vs "announce allocated" was neither agreed, refuted, nor even commented further. I have seen deaggregators claim 'security' [shred the routing table in response to windows worms scanning their classical-B], or assume that if Some Other Company can base their entire business plan on moving the costs of 'optimized' deaggregation onto the global community (beyond their providers), then why can't they. When I'm feeling conspiracy-minded, it seems that those of a certain size are trying to squeeze the smaller folks out of the business by encouraging the behavior of bloat. But then I correct the angle of my tinfoil beanie and realize they are just lazy. Their laziness does directly cost any newly-multihoming enterprises; some of the networks who are contributing to the garbage still tell customers that full tables will fit into 128M on a cisco. (eg, http://www.sprintlink.net/support/bgp_request.html) It is disappointing and frankly I can't see a way past it. When 2914 finally slid down to the lowest common denominator, the last 'big stick' was gone. 1239 is unapologetically violating their own customer bgp policies in this regard (point 9 on http://www.sprintlink.net/policy/bgp.html) The list goes on and on. Otherwise reasonable people have refuted logic and claim adding more data into the system doesn't increase churn effect and thereby degrade stability. Control theory and structured programming be damned, they say "it hasn't melted yet." Perhaps they want to see if they can make Metcalfe's predict come true, just 10 years too early? The baseline expectation is that the DFZ carries rechability data. Any more-specific data of interest is exchanged between parties who want it, request it, or pay for it. "Being conservative in what you send" also applies to anticipating *others* not being liberal in what they receive. There's a whole lot of non-conservative senders out there, and when they have reachability problems of their own making, with simple and trivial fixes if they had only thought things through in the first place, they have no-one but themselves to blame. Those believing otherwise are encouraged to send real, hard data. There is no meaningful data I can find since the Bellovin/Bush/ Griffin/Rexford 2001 paper. Joe -- RSUC / GweepNet / Spunk / FnB / Usenix / SAGE

3 5

ICANN moves to add .mobi & .jobs
by Fergie (Paul Ferguson) 14 Dec '04

14 Dec '04

http://icann.org/announcements/announcement-13dec04.htm - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

1 0

Re: Contact for "The World"
by Hannigan, Martin 14 Dec '04

14 Dec '04

ISP's aren't required to register in Puck's database. How about trying abuse@ ? -M --- Martin Hannigan hannigan(a)verisign.com Verisign, Inc. -----Original Message----- From: owner-nanog(a)merit.edu <owner-nanog(a)merit.edu> To: nanog(a)merit.edu <nanog(a)merit.edu> Sent: Mon Dec 13 22:51:56 2004 Subject: Contact for "The World" Does anyone have a contact @ The World? They are not listed in Jared's NOC list nor do postmaster@ or mailer-daemon@ seem to have a human behind the wheel. As an aside, they send one of the most annoying spam-receipt-auto-ack's I've ever seen and the fact that you can't even reply to it is even more annoying. (sent from mailer-daemon) ISPs like them make the necessary evil of running an active abuse-desk all the more frustrating. Thanks, davidu ---------------------------------------------------- David A. Ulevitch - Founder, EveryDNS.Net http://david.ulevitch.com -- http://everydns.net ----------------------------------------------------

1 0

RE: [Fwd: zone transfers, a spammer's dream?]
by Matt Ryan 14 Dec '04

14 Dec '04

www.bl.uk? Matt. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Stephane Bortzmeyer Sent: 14 December 2004 09:52 To: Gadi Evron Cc: nanog list Subject: Re: [Fwd: zone transfers, a spammer's dream?] On Thu, Dec 09, 2004 at 03:52:38AM +0200, Gadi Evron <ge(a)linuxbox.org> wrote a message of 174 lines which said: > 171 uk.zone Everything is in subdomains like co.uk, so there is no point in blocking zone transfers for the TLD. ------------------------------------------------------------------------------ Live Life in Broadband www.telewest.co.uk The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Statements and opinions expressed in this e-mail may not represent those of the company. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender immediately and delete the material from any computer. ==============================================================================

2 1

"User Unknown" errors related to DNS issues?
by Jim Popovitch 14 Dec '04

14 Dec '04

Hi all, I see a periodic problem with some email servers that report "User Unknown" for valid users. The most recognizable problematic host is hotmail.com, but there usually are others mixed in (today's additional problematic hosts included msn.com, verizon.net, and incentre.net) Here is one of the errors: Dec 13 11:20:55 mail sm-msp-queue[5360]: iBDGFPc0004630: to=<frank-****(a)msn.com>, delay=00:05:30, xdelay=00:00:00, mailer=esmtp, pri=470333, relay=mx1.hotmail.com. [64.4.50.99], dsn=5.7.1, stat=User unknown I found this post on Neohapsis that suggests the problem is DNS/firewall related: http://archives.neohapsis.com/archives/postfix/2004-03/1774.html What I can't understand is why this would be periodic and what, if anything, I can do to validate the authenticity of the errors? Do others see this same issue? -Jim P.

3 3

CBX-500 question, FRF.8
by james 14 Dec '04

14 Dec '04

I am working on a solution that will require my CBX-500 to do transparent mode and not translation mode. I've grepped the docs I have and looked on the web and can't find reference to which mode the CBX uses. This cross connect would be between the FR 3/1 card to the ATM DS3 card. Does anyone know which mode the CBX uses ? -- James H. Edwards Routing and Security Administrator At the Santa Fe Office: Internet at Cyber Mesa jamesh(a)cybermesa.com noc(a)cybermesa.com (505) 795-7101

1 0

China: Spam capital of the world?
by Fergie (Paul Ferguson) 13 Dec '04

13 Dec '04

Slightly off-topic, but some operational relevance. Taking a cue from a snippet on /. http://www.atimes.com/atimes/China/FL14Ad02.html - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

2 1

sarbanes-oxley email archiving
by Mike Walter 13 Dec '04

13 Dec '04

So, has anyone used the GFI email archiver for exchange server? Does anyone have thoughts as to other software that is similar to this product? What about software for linux email archiving? We are starting to look at this for some clients and thought the NANOGers might have some input. Feel free to email me off-list. Mike Walter, MCP PCD Network Solutions, Inc. 3z.net a PCD Company <http://www.3z.net>

3 2

Re: China: Spam capital of the world?
by sgorman1＠gmu.edu 13 Dec '04

13 Dec '04

The article reinforces the empirical findings from some spam mapping work we've been doing. Part of that work has been putting together a spammer social network based on collaborations and partnerships between different spammers. While the vast majority of spammers are based in the US there are a few key actors that link up the domestic slime with international slime hosting and zombie procurement. We've tried different arrest scenarios as well to see which key actors would have the most disturbance on the network by their removal. Since spammers still operate in a quasi legal environment their network is more susceptible to attack than similar criminal and terrorist network. >From an operational standpoint the argument goes that trying to solve spam with a purely technology based solutionis has some inherent troubles. Thus far technology based solution have, along with some success, also caused an escalating arms race with spammers, with increasing negative externalities. Heavy blacklisting and filtering led to the deployment of worms to create zombies to circumvent filters. The result is tit for tat responses that also create increasing problems for the Internet beyond just spam. Currently there is little incentive for spammers not to spam. Certainly not the ca-spam act. I'm not saying technology solutions are impossible, just that they are not a silve bullet. On the upside, at least from preliminary research, going after the individual spammers can have an impact. The trick is you need a bigger stick to go after them with and penalities and arrests that cause a disincentive to spam. You'll never get everyone but if you can cause the cost of doing business as a spammer to increase tangibly I'd wager the impact would be significant. They operate on very slim margins and exceedingly low response / success rates. Along those lines we are still working on a GIS databse of spammer addresses to do mapping and analysis, but still have a bit more to go on it. Just my biased 2 cents. ----- Original Message ----- From: "Fergie (Paul Ferguson)" <fergdawg(a)netzero.net> Date: Monday, December 13, 2004 1:54 pm Subject: China: Spam capital of the world? > > > Slightly off-topic, but some operational relevance. > > Taking a cue from a snippet on /. > > http://www.atimes.com/atimes/China/FL14Ad02.html > > - ferg > > -- > "Fergie", a.k.a. Paul Ferguson > Engineering Architecture for the Internet > fergdawg(a)netzero.net or > fergdawg(a)sbcglobal.net >

1 0

Juniper TX Matrix.
by Deepak Jain 13 Dec '04

13 Dec '04

[I'm wearing my asbestos gloves.] Is anyone out there in need of a 4-way interconnect between T640 nodes for production IP networks? Is this a silly question? A few months back, we all discussed how the CRS-1 from Cisco was largely aimed at folks who were spending other people's money -- research & gov't types mostly. The TX Matrix as announced Dec 3, 2004 (I just heard about on Slashdot today, so I admit I am a little behind) and have not heard a peep from anyone about it. I can assume that because this doesn't scale as high as a CRS-1, it is going to be less expensive, but the question is... does it fill a need for someone today? thanks, DJ

1 0