April 2004 - Test - lists.nanog.org

CW Routing Registry source change to SAVVIS.
by Padliya, Deepak 07 Apr '04

07 Apr '04

Greetings ! On March 8th, 2004, SAVVIS Communications Corporation (NASDAQ: SVVS), a leading global managed services provider, secured all regulatory approvals and closed its acquisition of the assets of Cable & Wireless USA, Inc. and Cable & Wireless Internet Services, Inc. (together, with certain of their affiliates, "Cable & Wireless America" or "CWA"). As the result of this acquisition the Cable & Wireless (CW) Routing registry will be transitioned to source SAVVIS registry. On Friday, April 9th, 2004 the Routing Registry data would be converted to source SAVVIS. We expect the downtime to be from 3:00 PM to 9:00 PM EST. As a result of this maintenance source CW RR will cease to exist. Please visit http://www.irr.net/docs/list.html#SAVVIS for more details about SAVVIS RR. Regards..

2 1

Anti-Spam Router -- opinions?
by Andy Johnson 07 Apr '04

07 Apr '04

Has anyone had any experience with this device? Turntide.com. Looks like a traffic-shaping device designed specifically for cutting down spammers throughput to your inbound SMTP servers. My main concern is, how does it make the distinction between legitimate mass-mailings (e.g.: mailing lists such as this one), and spam? Interesting approach to killing spam though I must say. -Andy

13 23

TISCALI
by Shazad 07 Apr '04

07 Apr '04

Looking for opinions and experience on Tiscali IP network performance within Europe and out of Europe i.e. North America on the whole.. I have heard mixed reports, but am looking for information from those with first-hand experience either on transit or peering level. Would they be classed in top-three performing networks in Europe (recent bandx report gave them #1 spot)? If not what are you recommendations on reaching the largest amount of eyeballs on a very stable network primarily in Europe. Thanks in advance for your time. Regards, Shazad

1 0

NSA wiretap leads to arrest
by Sean Donelan 06 Apr '04

06 Apr '04

Operational as far as service provider capability to assist lawful interception of networks. Previous NANOG meetings have dealt with the topic. There are several other forums for related comments. http://www.globetechnology.com/servlet/story/RTGAM.20040406.gtterror06/BNSt… Citing anonymous sources in the British intelligence community, The Sunday Times reported that an e-mail message intercepted by NSA spies precipitated a massive investigation by intelligence officials in several countries that culminated in the arrest of nine men in Britain and one in suburban Orleans, Ont. -- 24-year-old software developer Mohammed Momin Khawaja, who has since been charged with facilitating a terrorist act and being part of a terrorist group. The Orleans arrest is considered an operational milestone for this vast electronic eavesdropping network and its operators. But Dave Farber, an Internet pioneer and computer-science professor at Carnegie-Mellon University in Pittsburgh, said the circumstances are also notable because it will be the first time that routine U.S. monitoring of e-mail traffic has led to an arrest.

1 0

TE Panel in SF
by Susan Harris 06 Apr '04

06 Apr '04

Greetings - we're hoping to present a panel on "Approaches to TE" at the next NANOG meeting, to be held May 23-25 in San Francisco. Potential topics include: - Layer two-based approaches (e.g., ATM) - Explicit routing-based approaches (e.g., MPLS-TE) - Other approaches (e.g., IGP ECMP) If you're using one of these techniques and would like to tell us about your experiences, send a detailed outline or abstract to nanog-support(a)nanog.org. Abstracts for the TE panel are due April 14. Thanks!

1 0

Re: Anti-Spam Router -- opinions?
by Joe St Sauver 06 Apr '04

06 Apr '04

Hi, #Let's assume that 75% of spam is sent via hijacked zombie machines. This #would mean that to get 7.5 billion spams/day at 20 msgs/day/zombie, #you'd need several hundred million compromised machines. 20 messages/day/zombie is way too low an estimate (by multiple orders of magnitude). #And even though the average machine is woefully insecure, there's not THAT #many zombies. I'm currently tracking right around 2.5 million listed open proxies/spam zombies. Data I'm receiving from typical mid sized ISPs includes 300K or so unique blocked dotted quads/week, of which maybe half are listed on one or more of the open proxy/spam zombie DNSBLs I track. So take the number from that you like best: -- 2.5 million listed open hosts -- 300K unique blocked dotted quads/week -- 150K or so of those unique blocked dotted quads which are listed on DNSBLs I see no indication that the number of compromised hosts seen per week is decreasing, and of course, because compromised hosts are not getting cleaned and taken off the air in many cases, the total pool of compromised hosts is steadily increasing. (And those "old timer"/"well known" compromised hosts, while blocked from sending email to most sites that use DNSBLs, still represent a source of potential attack traffic, etc.) #On the other hand, 20K msgs/day/zombie is only about 1 ever 4 seconds, #not enough to make the average cablemodem user notice - and reduces the #number of zombies down to several million - a much more plausible number. As a lower bound, assume modem-like throughput of 40Kbps, and typical spam message size of what, maybe 5K? That would amount to a message a second, or 86,400/day/host assuming an around-the-clock uniform distribution (probably not a valid assumption, but then again, upstream throughput from broadband connected hosts will generally exceed 40Kbps). If you wanted to deliver 7,500,000,000 pieces of spam a day at that rate, that would imply use of order(~100,000) freshly compromised hosts at any given time, a figure which I find quite plausible/conservative/consistent with the data I'm seeing. (And in fact, you can model the release of new virii/worms (intended to create new batches of compromised hosts) based on compromised host "harvest requirements," just like forecasting the demand for soybeans or steel or any other commodity) Spam's a big business, and compromised hosts are a fundamental input which are being efficiently supplied by the market as far as I can tell. Regards, Joe

1 0

Mailserver requirements
by Arnold Nipper 06 Apr '04

06 Apr '04

Today I run across a MTA which refused to accept mail because it could not detect an MX record for the reverse mapping of the IP address of the server which tried to deliver mail. Is this correct? Or: if A is the IP Address of server trying to deliver mail, does mx(reverse(A)) have to exist? -- Arnold

5 4

Wide Outage at DSL.net
by Drew Linsalata 06 Apr '04

06 Apr '04

For those with an operational interest, DSL.net is reporting multi-LATA outages impacting over 10,000 customers. Seems that things started dropping at about 6:15 AM EDT. -- Drew Linsalata The Gotham Bus Company, Inc. Colocation and Dedicated Access Solutions http://www.gothambus.com

1 0

RE: Mailserver requirements
by Mike Walter 06 Apr '04

06 Apr '04

Arnold, I am surprised you don't have problems sending to AOL as well. They don't accept email from servers that do not have reverse addresses. I don't accept email from severs without reverse addressing. Mike Walter, MCP 3z.net a PCD Company <http://www.3z.net> "When Success is the Only Solution t h i n K 3z.net" -----Original Message----- From: Arnold Nipper [mailto:arnold@nipper.de] Sent: Monday, April 05, 2004 5:03 PM To: NANOG Subject: Mailserver requirements Today I run across a MTA which refused to accept mail because it could not detect an MX record for the reverse mapping of the IP address of the server which tried to deliver mail. Is this correct? Or: if A is the IP Address of server trying to deliver mail, does mx(reverse(A)) have to exist? -- Arnold

8 10

RE: Spam with no purpose?
by Michel Py 06 Apr '04

06 Apr '04

>> Michel Py wrote: >> Indeed; notice I did write "Bayesian-like" and not "Bayesian" and >> never mentioned anything about good ones or not-as-good ones. > Paul Jakma wrote: > Right, but if we're going to talk about bayesian filtering > in general, there's little sense in constraining the > discussion to "not-as-good" bayesian filters. The not-as-good > filters are obviously doomed to extinction, if they do not > improve and become good ones. Paul, I hope you forgive my bluntness, but this is the worst argument you have ever made in the hundreds of postings I had the privilege to exchange with you on other mailing lists over the years. Especially on _this_ mailing list, if you were right, Microsoft would be extinct. Michel.

2 1