July 2005 - Test - lists.nanog.org

Re: CircleID: News from the E-mail Authentication Summit in NYC
by Gregory Hicks 22 Jul '05

22 Jul '05

> Date: Thu, 21 Jul 2005 22:12:28 -0700 > From: Dave Crocker <dhc2(a)dcrocker.net> > To: nanog(a)merit.edu > Subject: Re: CircleID: News from the E-mail Authentication Summit in NYC > X-Songbird-SpamCheck: > > > > > > At The Email Authentication Implementation Summit in New York City last week, > > several major ISPs surprised attendees with their announcement that they are > > jointly backing a single authentication standard. > > > More details are at <http://mipassoc/mass>. That should be http://mipassoc.org/mass > > Participation by the ops community is *strongly* encouraged. > > -- > > d/ > > Dave Crocker > Brandenburg InternetWorking > +1.408.246.8253 > dcrocker a t ... > WE'VE MOVED to: www.bbiw.net --------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer Cadence Design Systems | Direct: 408.576.3609 555 River Oaks Pkwy M/S 6B1 | Fax: 408.894.3479 San Jose, CA 95134 | Internet: ghicks(a)cadence.com I am perfectly capable of learning from my mistakes. I will surely learn a great deal today. "A democracy is a sheep and two wolves deciding on what to have for lunch. Freedom is a well armed sheep contesting the results of the decision." - Benjamin Franklin "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

1 0

CircleID: News from the E-mail Authentication Summit in NYC
by Fergie (Paul Ferguson) 22 Jul '05

22 Jul '05

Bill Nussey writes on CircleID: [snip] At The Email Authentication Implementation Summit in New York City last week, several major ISPs surprised attendees with their announcement that they are jointly backing a single authentication standard. Yahoo!, Cisco, EarthLink, AOL, and Microsoft got together and announced they are submitting a new authentication solution, DomainKeys Identified Mail to the Internet Engineering Task Force for approval as a standard. This is big news. To date, these groups have been at odds over authentication, with each promoting their own authentication techniques. While it is likely that each will continue to support its own standard for now (Microsoft with Sender ID, AOL with SPF and Yahoo! with the original DomainKeys), we can expect that they all will begin to use this common standard over the coming years if it is adopted by the IETF. [snip] http://www.circleid.com/article/1143_0_1_0_C/ - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

3 2

RE: MCI billing fraud ... again
by Alex Rubenstein 21 Jul '05

21 Jul '05

Interesting. About 1 year ago (early 2004), in a one month period, we had every single MCI outstanding billing dispute resolved -- some even that were over 4 years old. It seemed to me that the dispute resolution people actually gave a hoot all of a sudden. And, some inside information I gleaned was that they were instructed by the higest levels to do so. Also, about 2 months ago, we had a random $90k charge on an account that usually bills a few thousand a month. This was quickly resolved (as in, already). Our rep was the channel used, and he was good about it. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Dan Hollis Sent: Thursday, July 21, 2005 6:32 PM To: 'nanog(a)merit.edu' Subject: MCI billing fraud ... again We're being hit up by MCI's billing fraud again. You'd think after the multiple settlements, the $4 billion accounting fraud and Ebbers' 25 year prison sentence that MCI would have learned something, but apparently not. Anyone have a definitive method of dealing with these clowns? Any contacts for someone skilled in getting MCI to FOAD? -Dan

1 0

RE: networks with many issues
by Kuhtz, Christian 21 Jul '05

21 Jul '05

> So, I guess, I wonder -- with the deficiencies indicated > above -- what operational use such a list would really have > in the end. ;-) Other than yet another interesting metric of > just how bad things are out there(TM). And, I should say, that in the end.. The best use might be aggregate statistical trending etc, without publicly (or privately) identifying specific nodes. That might actually be very interesting, just like we have clueful folks tracking a bunch of metrics for, say, the routing system itself. Perhaps folks like CAIDA might be interested in this.. ;-) Just a thought.. Thanks, Christian -- You may safely ignore any of the junk below. If you're reading this, you are the intended addressee. Proprietary info.. On NANOG? You're kidding right? ***** The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers. 162

1 0

RE: networks with many issues
by Kuhtz, Christian 21 Jul '05

21 Jul '05

Rick, Similar to what I expressed already in email directly to you, data without timestamp of when a specific IP address was found to be an offender is nearly worthless for action, and only interesting as statistical chatter.. Except where you perhaps have business customers (and the occasional residential customer) with static address assignments. Even still, acting on such 3rd party derived data for things like AUP enforcement is probably still more problematic... I understand the difficulty of coming up with a valid timestamp, but the other part of this is operational realities that IP addresses temporary assignments for a lot of broadband subs. So, I guess, I wonder -- with the deficiencies indicated above -- what operational use such a list would really have in the end. ;-) Other than yet another interesting metric of just how bad things are out there(TM). Regards, Christian > > I've come across a few requests for reports with over 10,000 > issues. for > the net ops folks that might have huge blocks with many > issues -- what > is the most relivant information? Also, how does one go about > solving a > large set of issues across a huge address space? > > Basickly I'm wondering if I can't build some tools to make > life easyer > and use the reports as an input to the tools. > > Also I'd be interested in how large reports should be broken down. I > have the issue, address, reverse dns, source and timestamp. > would it be > best to group the report by issue type. > > The issues I am track are > Open Proxy (http, socks, other) > Website with vunerabilities > Spam source( spammed honney pot, spamtrap) > Open Relay (smtp) > > Understand the timestamp is the time I saw the issue from the RBL. I > import data at best hourly and the DNSRBLs don't all have > timestamps for > their data. > > I am generaly interested in understanding how to produce > information and > tools that the large operaters can utilize effectively. > > I'd appreciate any thoughts and ideas on how to hande these problems. > > > -rick > > > ***** "The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers." 118

1 0

compromized host list available
by Rick Wesson 21 Jul '05

21 Jul '05

Folks, I've developed a tool to pull together a bunch of information from DNSRBLs and mix it with a BGP feed, the result is that upon request I can generate a report of all the compromised hosts on your network as seen by various DNSRBLs. reports are available daily in pdf, text, csv, and excel. they are all a bit chunky but should be helpful. contact me off list, if you would like to get a daily report for your ASN. You will be required to prove you are associated with and responsible for the ASN you want a report for. The report are free so this isn't a commercial =) honestly I hope the stuff helps. -rick

7 9

RE: compromized host list available
by Hannigan, Martin 21 Jul '05

21 Jul '05

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Rick Wesson > Sent: Wednesday, July 20, 2005 7:32 PM > To: nanog(a)merit.edu > Subject: compromized host list available > > > > Folks, > > I've developed a tool to pull together a bunch of information from > DNSRBLs and mix it with a BGP feed, the result is that upon request I > can generate a report of all the compromised hosts on your network as > seen by various DNSRBLs. > > reports are available daily in pdf, text, csv, and excel. > they are all a > bit chunky but should be helpful. > > contact me off list, if you would like to get a daily report for your > ASN. You will be required to prove you are associated with and > responsible for the ASN you want a report for. > > The report are free so this isn't a commercial =) honestly I hope the > stuff helps. What about collateral damage? -M<

3 2

networks with many issues
by Rick Wesson 21 Jul '05

21 Jul '05

I've come across a few requests for reports with over 10,000 issues. for the net ops folks that might have huge blocks with many issues -- what is the most relivant information? Also, how does one go about solving a large set of issues across a huge address space? Basickly I'm wondering if I can't build some tools to make life easyer and use the reports as an input to the tools. Also I'd be interested in how large reports should be broken down. I have the issue, address, reverse dns, source and timestamp. would it be best to group the report by issue type. The issues I am track are Open Proxy (http, socks, other) Website with vunerabilities Spam source( spammed honney pot, spamtrap) Open Relay (smtp) Understand the timestamp is the time I saw the issue from the RBL. I import data at best hourly and the DNSRBLs don't all have timestamps for their data. I am generaly interested in understanding how to produce information and tools that the large operaters can utilize effectively. I'd appreciate any thoughts and ideas on how to hande these problems. -rick

1 0

*** NANOG election update ***
by Betty Burke 21 Jul '05

21 Jul '05

All: As of 9:14am today:> 191 people have voted 915 votes cast Voting is proceeding, but at a slow pace, getting just a trickle the past few days.< If you are eligible and have not voted, please take advantage of this opportunity. A reminder, voting ends at midnight EST on Monday, July 25. Refer to <http://nanog.org/elections.html> for instructions and updates:> All best. Betty Burke Project Manager Merit Network

1 0

More bombings in London....
by Fergie (Paul Ferguson) 21 Jul '05

21 Jul '05

http://www.msnbc.msn.com/id/8655541/ - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1