August 2006 - Test - lists.nanog.org

Contact for optonline.net routing?
by David Hubbard 10 Aug '06

10 Aug '06

Anyone have a contact for optonline? Thanks, David

1 0

SORBS / Spam / RBLs / whatever
by Matt Ghali 10 Aug '06

10 Aug '06

guys, seriously, stop feeding the troll. --matt(a)snark.net------------------------------------------<darwin>< Moral indignation is a technique to endow the idiot with dignity. - Marshall McLuhan

1 0

SORBS Contact
by Brian Boles 10 Aug '06

10 Aug '06

Can someone from SORBS contact me offlist if they are on here.... My most recent allocation from ARIN turned out to be dirty IP's, and I'm having trouble getting them removed following the steps on their website (no action on tickets opened). 64.79.128.0/20 Brian Boles vegasnetman(a)gmail.com

10 16

Re: ISP wants to stop outgoing web based spam
by Allan Poindexter 09 Aug '06

09 Aug '06

>>>>> John Levine <nanog(a)johnlevine.com> writes: Allan> I would let any ISP I use make this mistake once. After that Allan> the individuals responsible would be up on ECPA charges. John> I suppose any ISP foolish enough not to disclaim ECPA John> confidentiality gets what it deserves. The ECPA doesn't provide any mechanism to explicitly disclaim responsibility under it. Even if it did such a disclaimer would undermine any claim to anything like common carrier status for an ISP This would make the ISP vulnerable to such things as libel based on user's content. This strikes me as jumping out of the spam/virus frying pan into the defamation fire.

2 2

RE: ISP wants to stop outgoing web based spam
by Jeroen Massar 09 Aug '06

09 Aug '06

On Wed, 2006-08-09 at 09:50 -0400, Mills, Charles wrote: > I think if such a thing would exist, the "verification" gifs to prevent > automated free yahoo and hotmail account signups would be defeated as > well. You mean Captcha (http://en.wikipedia.org/wiki/Captcha) Which is not so much of an issue: http://sam.zoy.org/pwntcha/ Otherwise simply setup a resource that people want to access (always the best example on the internet: a pr0n site) and present the image there and let them answer it for you ;) Hmm maybe I should look into hooking pwntcha into SA. Greets, Jeroen (who now will receive another gateway(a)blogger.com response that it doesn't understand multipart/signed messages.... can some nanog-list-admin remove that crappy thing?)

5 4

Re: mitigating botnet C&Cs has become useless
by Arjan Hulsebos 09 Aug '06

09 Aug '06

On Wed, 09 Aug 2006 20:16:44 +0300, Petri Helenius wrote: >Arjan Hulsebos wrote: >> >> The ones who've been mugged don't start mugging other people, infected >> PCs will infect other PCs. That's the difference, and that's why an >> ISP should do something about that. Although it may be out of fashion, >> I'd like to see good netizenship. >SPAM as other types of abuse is easiest to control closest to the >source, which in most cases means the consumer ISP providing the local >access for the user. Exactly. We, the ISPs, are the friendly (or maybe not-so-friendly at times) neighborhood police officer. It's our network, we set the rules, and we enforce them. Gr, Arjan H

1 0

Detecting parked domains
by Sean Donelan 09 Aug '06

09 Aug '06

Has anyone come up with a quick method for detecting if a domain name is parked, but is not being used except displaying ads? I'm hoping there is other method besides chasing a list of constantly changing IP addresses being used by the parking advertising companies.

19 29

semi-IPV6 question (pls dont flame me for asking)
by Cerebus cerebus 09 Aug '06

09 Aug '06

I put the subject that way, otherwise I think people would ignore this completely. I actually want to know, after all the years of pain from J.F. and everything, I really believe IPv8 is workable, if it was open and done right and not handled by a spastic mental patient (notice I didn't mention any names specifically). I have "higher-ups" who read about Ipv8 and demanded we implement it, thus the previous questions about finding you know who. After reading myself though, it seems very intuitive, it can tunnel and interface with ipv4 a lot easier than ipv6 can, its practically native, you can connect gateways, and such, and somewhere I read Lucent was actually selling IPv8 router gateways, but I haven't been able to find anything further, and now Lucent is gone, so that makes it kinda difficult. >From a real technical standpoint, looking only at the mertis of the basic model, does anything think the ipv8 concept really viable, or are people just "happy" with the idea that ipv6 is "enough" "forever"? I mean, aside from the odd posting saying "coulda had a v8" - the joke is getting rather old, the addressing size capability of ipv8 and so forth, are rather appealing in some ways. For example, we have need of creating a simulated network environment of over 320 trillion nodes (don't ask), but working this out on ipv6 seems exceedingly difficult, where ipv8 has built-in concept of "clusters"/"galaxies" and easy ipv4 interface. Personally I think it would be easier to modify existing routers/etc to handle Ipv8 than the more complex incompatibility with ipv6. or have i got this all wrong? --------------------------------- Yahoo! Music Unlimited - Access over 1 million songs.Try it free.

3 2

RE: mitigating botnet C&Cs has become useless
by Scott Weeks 09 Aug '06

09 Aug '06

----- Original Message Follows ----- From: "Barry Greene (bgreene)" <bgreene(a)cisco.com> > > What? That's what I'm trying to find out, but I'm not > > as smart as most, so I can only point out the things > > that I believe definitely won't work and why I think > > that. Hopefully by the application of flame to my butt > > by smart people for saying what I do will spark some > thought toward the goal. > > Start with: > > http://www.nanog.org/mtg-0602/greene.html I didn't see anything in there relating to bot brains. Also, with regard to 'cyberspace is just a meatspace overlay' I considered whay would I do to troubleshoot an overlay network. I'd work on the layer where the problem exists. (Duh! :) Here, the problem exists at two layers: Technically it's allowed and meat-wise there're those kinds of people in this world. So, the solution must be at both layers; meatspace and cyberspace. That makes us all correct, yes? (again, I'm putting on my flame-proof underpants... ;-) One thing someone mentioned offline: > The goal, as noted, shouldn't be to shut these things > down. It should be to keep them operating, not interfered > with, so that the C&C channels remain detectable > Shutting down C&C's is a direct action. > > More fun? Monitor those C&C's. In real time, update your > filtering to tag attack packets as a QoS that is > rate-limited at your borders. This would be hard for a > botherder to detect, but would limit damage against remote > sites. You don't actually want to *block* them; blocking > them lets the botherder know that you're on to them. But > this has to be done fairly cleverly (much moreso than I > suggest), so that they can't easily figure it out. This > is just an example for the sake of conveying the overall > idea. > But shutting them down, that's like the police arresting > all the informants. It doesn't stop the crime, it just > eradicates all your easy leads. What're folk's thoughts on that? scott

8 9

Re: mitigating botnet C&Cs has become useless
by Arjan Hulsebos 09 Aug '06

09 Aug '06

On Wed, 09 Aug 2006 10:10:21 -0600, Michael Loftis wrote: >Yup this is a social problem. Just like there's nothing actually stopping >any of us from beating up a guy on the street, we don't do it because it >isn't legal, doesn't make sense, etc. Some muggers do, the people in >control of the SPAM problem are the muggers....the people with infected >systems are just the ones who've been mugged. The ones who've been mugged don't start mugging other people, infected PCs will infect other PCs. That's the difference, and that's why an ISP should do something about that. Although it may be out of fashion, I'd like to see good netizenship. Gr, Arjan H

2 1