September 2010 - Test - lists.nanog.org

Re: RIP Justification
by Tim Franklin 30 Sep '10

30 Sep '10

> I think BGP is better for that job, ultimately because it was > specifically designed for that job, but also because it's now > available > in commodity routers for commodity prices e.g. Cisco 800 series. +1 - for me, if I need a dynamic routing protocol between trust / administrative domains, it's BGP unless there's a good reason not to. I find it more straightforward to work with (albeit slightly more up-front to configure it and get it right) than anything else - the information available is a very clear "who am I talking to?" / "what routes do I send them?" / "what routes do they send me?". Plus I can work through the route-selection process by hand from the information displayed, and have it make sense. Regards, Tim.

1 0

What must one do to avoid Gmail's retarded non-spam filtering?
by Erik L 30 Sep '10

30 Sep '10

I realize that this is somewhat OT, but I'm sure that others on the list encounter the same issues and that at least some folks might have useful comments. An increasingly large number of our customers are using Gmail or Google Apps and almost all of our OSS/BSS mail is getting spam filtered by Google. Among others, these e-mails include invoices, order confirmations, payment notifications, customer portal logins, and tickets. Almost anything we send to customers on Google ends up in their spam folder. This results in a lot of calls and makes much of our automation pointless, never mind all the lost sales. The problem is compounded by those who use mail clients and do not log in to the webmail at all, since they would never see the contents of the Google spam folder. We have proper A+PTR records on the edge MTAs, proper SPF records for the originating domain, proper Return-Path and other headers, and so on. There isn't anything that I can think of other than the content itself which would be abnormal, and obviously the content is repetitive and can't be changed much. Is there something obvious which we've missed? Aside from the following clearly impractical solutions, what can we do? 1. Asking everyone (including those we don't even know yet) to whitelist all of our addresses, to check their spam folders, and to click on "this is not spam" 2. Providing our own free e-mail service to everyone (including those we don't even know yet) and putting up "don't use Google" ads on all of our customer-facing systems At least this isn't Hotmail where mail is just silently deleted with no NDR after it's accepted by their MTAs. The call volume has been going up instead of down lately and it's gotten to the point where we're sending MTA log extracts to people to prove to them that we really did e-mail them. Would greatly appreciate any advice. Erik

15 19

AS11296 -- Hijacked?
by Ronald F. Guilmette 29 Sep '10

29 Sep '10

I confess that I find it somewhat tedious to try to answer all criticisms, individually, on a mailing list when people start ``piling on'', so I hope you'll all forgive me if I just try to to do this in one go. First, as regards to the lack of detail and/or specific in my reports, I was specifically insructed, by a gentleman who has far more experience participating here, on the NANOG mailing list, that I do, that I should NOT include too much lengthy elaboration and/or detail because (rough quote) ``... those folks in NANOG really only much care about routers and stuff like that, so don't even digress into topics like spam and such, or give a whole lot of lengthy details, because their eyes will just glaze over and/or you'll be accused of being off-topic. Many of them probably don't even know what the term `snowshoe spamming' refers to anyway.'' I'll be happy to provide all of the abundant evidence I've collected to anyone I can verify as being a legitimate network op offlist. I do need to say however that much of the relevantevidence can be ob- tained quite easily, and without any spoon feeding from me, i.e. directly in the form of applicable/relevant ARIN whois records, all of which are available to anyone. Other evidence, specifically the routes that _were_ being announced by AS11296 (and those that still are, currently, by AS10392) is also freely and publically available from you local friendly looking glass server. I have additional evidence... not so much of hijacking, but more relating to possible/probable snowshoe spamming activity... that is derived, indirectly, from public data sources, upon which I perform additional crunching with personally-developed, proprietary software... and that is stuff that I'll be happy to make available to anybody who can convince me that they are not playing for the other team. To the gentleman who wished me good luck in ``getting assistance from the list in the future'', I thank you for the generosity implied by your sentiment, and would only like to point out that on this occasion, at least (and on none others that I can remember off the top of my head) did I or have I requested assistance from the NANOG mailing list. On this occasion, I believe (and believed) that I was _offering_ my help to NANOG, rather than the other way 'round.) But again, I thank you for your concern anyway. To the gentleman who asked (with respect to the widespread... but certainly not universal... use of freemail accounts) whether or not ``the general population are all doing it wrong'', I would answer in the affirmative, generally, and not specifically with respect to the use of freemail accounts. As supporting evidence, I ask that you please begin reading here: http://en.wikipedia.org/wiki/Financial_crisis_of_2007%E2%80%932010 (I have a small mountain of documentation available to support the view that ``the general population are all doing it wrong'' with respect to almost anything you can name, and will be only too happy to provide more links as required/requested.) To the gentleman who suggested that my un-acceptance of e-mail from gmail, specifically, might be a black mark aganist my credibility, that's fine, I have no problem with that. I certainly never expected nor hoped that anybody would take any action of any kind based either on my perceived ephemeral and transitory credibility, or the perceived lack therof. For the two recent reports I have made here, and others I may make in future, the publically available evidence speaks for itself, and my personal credibility, or lack thereof, is neither here nor there, as a practical matter. I am not running for office, and I'm not tring to sell aluminum siding. What you think of me personally doesn't affect whether a given AS or IP block either is or isn't hijacked. Facts are facts... in this case mostly publically available... and thankfully are not dependant upon any one person for validation, least of all me. To the gentleman who quoted "A decent respect to the opinions of mankind requires that they should declare the causes.", the beauty and elegance of that sentiment, and its formulation, while undeniable and holding great appeal for any and all who call these United States home, actually applied to a rather different and more serious situation, I think, i.e. the dis- solution of political bands... dissolution which, I think everyone knew at the time, was highly likely to lead to a costly and bloody war... a rather more serious outcome than any likely to derive from a mere NANOG posting. Still, you make a reasonable point, and my only response is to reiterate what I have said above, i.e. that most of the substantiating documentation is readily and freely available from various public sources, and requires only the most modest amounts of motivation to independently obtain. To the gentleman who suggested that one could perpetrate what amounted to a DDoS attack, simply by making a derogatory posting about a given network on the NANOG mailing list, I can only ask ``Does that really work??'' If it does, then I'll have to remember to try it sometime, when I'm bored. (There are lots of naughty people on the Internet I'd like to spank, but I think that if I was really of a mind to seriously spank some of them, I might try route injection first. More effective and far more 31337. Plus I think the Russians are having a half price sale on that service next month. :-) To the gentleman who pointed out that a so-called ``appeal to authority'' is a lousey way to try to support any given claim, yea, you're absolutely right. I try never to do it myself. Personally, I find facts much more persuasive that anybody's rep. That same gentleman apparently took issue with my original post, apparently asserting that it wasn't ``...written in a way that recognizes that clued, skeptical individuals are going to carefully analyze it.'' All I can say is that in my own humble opinion, it actually _was_ written in _precisely_ that way. (The fact that it was witten that way partly explains why it was so terse.) To the gentleman who suggested that I was "Joe Blow", I can only say "Yea? So? Even if I am, what's yer point?" Just as nobody should evaluate important claims based only on somone's positive reputation alone, likewise, in my view, nobody should evaluate important claims exclusively on the basis of anyones negative or non-existant reputation either. I _am_ Joe Blow, and proud of it! To paraphrase an old TV commercial ``Don't hate me because I'm pretty. Don't believe me because I'm "somebody". Don't dis-believe me because I'm "nobody". You've got a keybord and eyes of your own. May I respectfully suggest that you use them?'' Regards, rfg

1 0

Re: AS11296 -- Hijacked?
by Robert Bonomi 29 Sep '10

29 Sep '10

> Date: Wed, 29 Sep 2010 13:06:31 -0700 > Subject: Re: AS11296 -- Hijacked? > From: Scott Howard <scott(a)doc.net.au> > > On Wed, Sep 29, 2010 at 9:26 AM, N. Yaakov Ziskind <awacs(a)ziskind.us> wrote: > > > Recommendations such as that are only as credible as the source they are > coming from, and knowing that the person making the request also believes > that blocking all mail from gmail.com is a valid anti-spam technique > probably results in a "different" credibility level than one might otherwise > have. I have to ask one question -- who are _you_ to judge what is 'valid' for *HIS* situation? He's not running a 'provider' network, with any responsibility to others, it's his personal environment. On _my_ personal servers, I block *LARGE* swaths of the world -- because I _do_ get significant amounts of spam from those locales, and have *zero* expectation of any 'legitimate' mail therefrom. The service denial messages _do_ provide info on how to get past the blocks. I can state with authority that in close to a million messages so rejected, -not-a-single-one- has been from someone with a serious interest in communicationg with me. The web-page with the explanatory data has not had so much as a single hit in over 8 years. Now, on systems I manage for others, I do things very differently, according to -their- needs. The rationale for such decisions is straightforward, and easy to understand. It's called the 'cost-benefit' ratio. _How_much_ work does it take to let that 'rare' piece of 'useful' mail through from a source that generates almost exclusively spam, and _is_ getting that occasional piece of mail 'worth the effort'. Ron has decided 'not', with regard to gmail. To argue that decision, _you_ would have to know how much 'valid' traffic he can reasonably expect to get from gmail, and the amount of effort it would take in his existing environment to accomplish that end.

3 4

Reputation Services [WAS: Re: AS11296 -- Hijacked?]
by Paul Ferguson 29 Sep '10

29 Sep '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Wed, Sep 29, 2010 at 5:04 PM, Franck Martin <franck(a)genius.com> wrote: > This is not what the Team Cymru Bogons list for? > http://www.team-cymru.org/Services/Bogons/ > > List bad ASNs after proper investigation? > > It then depends if you trust Team Cymru or not, like you would trust or > not Spamhaus... > Of course all policy should be local -- each organization can make their own determination whose DNSBL, reputation service, or filter list to employ. $.02, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.5.3 (Build 5003) wj8DBQFMo9WDq1pz9mNUZTMRAjUQAKCJc/hHDTUX9L3WHq+QaIDLpru8YgCg7O3h DTLrkDZZV4+obb97YODC57A= =kW01 -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawgster(at)gmail.com ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: Google blocks ISP arbitrarily contrary to their "don't be evil", ignorant fools debate merits of political correctness on NANOG
by Erik L 29 Sep '10

29 Sep '10

After you're done adding hate speech and spamming to my list of alleged criminal offences, can you and others please not post or e-mail me off-list if you have nothing new to contribute to the resolution of the problem? ----- Original Message ----- From: "Ryan Hayes" <ryguillian(a)gmail.com> To: "Erik L" <erik_list(a)caneris.com>, nanog(a)nanog.org Sent: Wednesday, September 29, 2010 5:08:18 PM Subject: Re: What must one do to avoid Gmail's retarded non-spam filtering? Can you please not use the word "retarded" in a pejorative sense? On Tue, Sep 28, 2010 at 3:15 PM, Erik L <erik_list(a)caneris.com> wrote: > I realize that this is somewhat OT, but I'm sure that others on the > list encounter the same issues and that at least some folks might have > useful comments. > > An increasingly large number of our customers are using Gmail or > Google Apps and almost all of our OSS/BSS mail is getting spam > filtered by Google. Among others, these e-mails include invoices, > order confirmations, payment notifications, customer portal logins, > and tickets. Almost anything we send to customers on Google ends up in > their spam folder. This results in a lot of calls and makes much of > our automation pointless, never mind all the lost sales. > > The problem is compounded by those who use mail clients and do not log > in to the webmail at all, since they would never see the contents of > the Google spam folder. > > We have proper A+PTR records on the edge MTAs, proper SPF records for > the originating domain, proper Return-Path and other headers, and so > on. There isn't anything that I can think of other than the content > itself which would be abnormal, and obviously the content is > repetitive and can't be changed much. Is there something obvious which > we've missed? > > Aside from the following clearly impractical solutions, what can we > do? 1. Asking everyone (including those we don't even know yet) to > whitelist all of our addresses, to check their spam folders, and to > click on "this is not spam" > 2. Providing our own free e-mail service to everyone (including those > we don't even know yet) and putting up "don't use Google" ads on all > of our customer-facing systems > > At least this isn't Hotmail where mail is just silently deleted with > no NDR after it's accepted by their MTAs. > > The call volume has been going up instead of down lately and it's > gotten to the point where we're sending MTA log extracts to people to > prove to them that we really did e-mail them. > > Would greatly appreciate any advice. > > Erik > >

1 0

RE: AS11296 -- Hijacked?
by Robert Bonomi 29 Sep '10

29 Sep '10

> From nanog-bounces+bonomi=mail.r-bonomi.com(a)nanog.org Wed Sep 29 13:59:15 2010 > From: Justin Horstman <justin.horstman(a)gorillanation.com> > To: "'George Bonser'" <gbonser(a)seven.com>, Heath Jones <hj1980(a)gmail.com>, > "Ronald F. Guilmette" <rfg(a)tristatelogic.com> > Date: Wed, 29 Sep 2010 11:53:27 -0700 > Subject: RE: AS11296 -- Hijacked? > Cc: "nanog(a)nanog.org" <nanog(a)nanog.org> > > > -----Original Message----- > > From: George Bonser [mailto:gbonser@seven.com] > > Sent: Wednesday, September 29, 2010 10:44 AM > > To: Heath Jones; Ronald F. Guilmette > > Cc: nanog(a)nanog.org > > Subject: RE: AS11296 -- Hijacked? > Is the person reporting this > > a > > known network operator that people trust or is it some Joe Blow out of > > nowhere that nobody has heard of before? That would make a huge > > difference. =20 > > > Going to his website....looks like Joe Blow...Googling his name/email/domai= > n, still nothing that would lead me to believe he is network Savvy. So comi= > ng from Joe Blow network Dude....he too is just Joe Blow. Just a little per= > spective for you from the bottom of the pile. > At least some of us -- who have been on the net for multiple decades -- know who the OP is. He's kept a low profile for a number of years, but he was very active in the early days of the anti-spam wars. Anyone actively involved in anti-spam activities in the days when promiscuous mail relays were common, (and Sun was still shipping 'sendmail 8.6.4') will likely recogize the name. They may have to think for a while, due to the time involved, but he was very well known in those days. 'Notorious' would be considered by some to be an accurate description. Absolutely top-notch technical skills, but a bit of a loose cannon in implementing things _he_ decided were 'for the good of the community'. 'Active' techniques, not just passive ones. *IF* he was accurate in his assessment, and it is my personal opinioin that it is *highly*likely* that there _was_ some sort of 'funny business' involved, whether or not his idenfitication was 100% accurate (and, based on personal experience again, I regard it a probable that he was =entirely= correct in his assessment), *THEN* the odds are quite good that one or more of the parties ivolved is a subscriber to this list. Considered in _that_ light, it would be simply 'stupid' -- which Ron is _not_ -- to tip them off as to where they screwed up, and what gave them away.

1 0

the lazy mans HW research
by bmanning＠vacation.karoshi.com 29 Sep '10

29 Sep '10

morning gentle people. i find myself in need of a multiport (8-16) 1 Gig ethernet HUB. or a switch smart enough to do transparant port mirroring to at least four ports. some kind soul pointed me here, http://www.dlink.com/products/?pid=337 but its not clear if this will actually perform as desired. suggest to the suggestable listener? --bill

3 2

Re: AS11296 -- Hijacked?
by Ronald F. Guilmette 29 Sep '10

29 Sep '10

Heath Jones <hj1980(a)gmail.com> wrote: >Out of curiosity, what led you to this conclusion? A number of factors, actually. Although I had started to type up a lengthy and elaborate response to your eminently reasonable question, on second thought, I don't think that I actually want to go into detail on this case, as anything I might say as regards to how I detected this would just allow future hijackers to evade me that much more effectively. So I'm sorry to be giving you a non-answer, but actually, I think that's best for now. In any case, further discussion of this particular case now appears to be moot. As of now, it appears that AS11296 is no longer announcing any routes at all, so I'm assuming that Nishant Ramachandran (Xeex/AS27524) and/or whoever else may have been involved in this has now been adequately spanked. (And my personal thanks go out to whoever did that.) Regards, rfg P.S. Yes, I actually _am_ blocking inbound e-mail from google/gmail. Too much spam from there, and far too little action to correct the abundant problem(s). (Can you spell E-V-I-L?) Also blocked here: Yahoo and Hotmail, for the same reasons. (To big to fail? No. Just too big to care. They don't need me, and I sure as hell don't need them.) I guess you don't have a real mail server of your own that you can use. For that, you have my sympathies.

12 16

Re: What must one do to avoid Gmail's retarded non-spam filtering?
by Erik L 29 Sep '10

29 Sep '10

Thanks, this is a possibility. However, that customer IP has been dealt with and hasn't been spamming for more than 60 hours at most (it's actually part of a dynamic DSL pool where port 25 outbound was supposed to have been blocked). Our problem appears to have started before the 27th. Earlier today I noticed that the SPF record had "a" and "ptr" in it and changed it to "mx" only, as it should be in our case. What I find most peculiar is none of these having problems: 1. Competitors over 10 times our size (similar % of gmail users), with invalid SPF records, no DKIM, who don't do *ANY* of what anyone here or off-list has suggested, who have PTRs for their DSL customers similar to ours (and didn't have a port 25 block), who've been blasting maintenance notices for years 2. Amazon, eBay, PayPal, Dell, etc. 3. Facebook with their ***user-generated content, in HTML*** ----- Original Message ----- From: "Joe Sniderman" <joseph.sniderman(a)thoroquel.org> To: nanog(a)nanog.org Sent: Wednesday, September 29, 2010 3:29:10 PM Subject: Re: What must one do to avoid Gmail's retarded non-spam filtering? On 09/29/2010 12:05 AM, Erik L wrote: > Google appears to have blacklisted our domain. From the edge MTA, I > sent three messages, differing only in the From header: 1. valid > email @klssys.com 2. valid email @caneris.com 3. abc123(a)caneris.com > > 1 not spam; 2 & 3 spam Ok, so its the domain not the IP. You're a DSL provider, right? IP's assigned to customers have PTR's in caneris.com, right? [..snip..] > ----- Original Message ----- From: "Erik L" <erik_list(a)caneris.com> > To: "William Pitcock" <nenolod(a)systeminplace.net> Cc: > nanog(a)nanog.org Sent: Tuesday, September 28, 2010 7:17:45 PM Subject: > Re: What must one do to avoid Gmail's retarded non-spam filtering? > > Hi William, > > I do so for our entire IP space on a regular basis. The edge MTA I > mentioned in the reply to Bill shows up as "Neutral" there. Ok, but there are a couple customer IP's that show up as "Poor" there, with rDNS in caneris.com not in klssys.com. One of those is on CBL (and XBL) and PSBL, and is spamming using your domain: http://psbl.surriel.com/evidence?ip=199.19.168.33&action=Check+evidence Its not PBL listed even though its a dynamic IP it seems: http://www.spamhaus.org/query/bl?ip=199.19.168.33 That would be an SPF pass as well, because of: caneris.com. 3600 IN TXT "v=spf1 a mx ptr -all" So, from the receiving end it could easily look like its one of caneris.com's outbound servers.. But not one of klssys.com's servers. Maybe this has something to do with the problem. HTH, Joe -- Joe Sniderman

1 0