November 2013 - Test - lists.nanog.org

Email Server and DNS
by rwebb＠ropeguru.com 08 Nov '13

08 Nov '13

So I figured a little break from the NSA was in order. I am looking for some info on current practice for an email server and SMTP delivery. It has been a while since I have had to setup an email server and I have been tasked with setting up a small one for a friend. My question centers around the server sending outgoing email and the current practices requirements for other servers to accept email Things like rDNS, SPF records, etc... I am pretty much set on the issue of incoming spam and virus. Probably overkill but it is checked at the Sophos UTM firewall and at the email server itself. Thanks, Robert

13 15

Any issues in asia-pac due to typhoon
by Grant Ridder 08 Nov '13

08 Nov '13

Hi Everyone, I am curious to see if anyone has been any issues or outages due to the typhoon in the area of the Philippines. Satellite: http://www.pagasa.dost.gov.ph/wb/sat_images/satpic.jpg http://www.usatoday.com/story/news/world/2013/11/07/philippines-typhoon/346… -Grant P.S. - Also sent this to outages list earlier

2 1

Bright House Networks Voice Contact
by Nick Olsen 08 Nov '13

08 Nov '13

Is anyone from the voice side of Bright House Networks Central Florida Division around? I seem to be hitting a CNAM cache on their network and was hoping to get it dumped. Thanks! Nick Olsen Network Operations (855) FLSPEED x106

2 1

Upstream / Handoff UPS?
by Kenny Kant 07 Nov '13

07 Nov '13

We have tons of circuits with various providers. Often times the demarc / handoff switch from the provider is not running on battery backup. Sometimes if the demarc device is located in the same room as our equipment we mitigate this and plug the device into our backup systems. Am I wrong to think that the demarc from the provider is a sacred thing that should only be touched by said provider. Thus they should provide their own battery system? Is it normal for this equipment not to be battery protected? We are not dealing with any crazy SLA's however I think it would be standard build practice to put UPS's on your gear. Even if its small handoff switch sitting right next to my switch. :) Kenny

5 4

advice on BGP + CARP setup on FreeBSD
by Antoine Beaupré 07 Nov '13

07 Nov '13

Hi fellow operators, We are slowly and carefully joining the fray of autonomous systems and started announcing our own netblock, a first test that started last week. So far, things are going well, but before going further along this setup, I would be curious to hear experience from other operators about the plan we are thinking of deploying. Our requirements: * free software, as much as possible * inexpensive * using existing operating system expertise (FreeBSD or Debian) So far, we have: * our own ASN * a /21 assigned by ARIN * two uplinks deployed (Netelligent and Cogent) * Netelligent announces 3 /24 netblocks for us * we announce the last /24 through a BGP link with cogent We have some horrible diagrams describing the setup here: https://wiki.koumbit.net/RoutingService/RoadMap As you can see, the uplinks are connected directly into a switch, in two separate VLANs. The reason for this is we want to be able to hotswap the routers in case of a hardware failure, but we have understood from Cogent's documentation that this is not a good practice because the links appears up even if the router goes down. What is your opinion on this? Also, we currently testing OpenBGPd for the announcements, and we are very pleased with it. The syntax is clear and it just works, with minimal memory usage: https://wiki.koumbit.net/OpenBgpdMaintenance#Checking_memory_usage However, this seems to be a fairly exotic platform, most people running BGP with Cisco, Juniper or, in some cases Quagga or Bird for Linux machines. Are there recmomendations on using OpenBGP in production? Good / bad experiences? How many people are running Linux routers vs dedicated Cisco/Juniper/etc routers? Finally, we are likely to complete this setup with a CARP (the free equivalent of VRRP) on the inside of the network. FreeBSD can apparently group interfaces and communicate with OpenBGPd - did anyone deploy such a thing here? What are your experiences or advice? Thanks for any advice, A. -- Sous un gouvernement qui emprisonne injustement, la place de l’homme juste est aussi en prison. - La désobéissance civile, Henry David Thoreau

2 3

www.akamai.net giving NXDOMAIN
by Anurag Bhatia 07 Nov '13

07 Nov '13

Anurags-MacBook-Pro:~ anurag$ dig @8.8.8.8 www.akamai.net. ; <<>> DiG 9.8.3-P1 <<>> @8.8.8.8 www.akamai.net. ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: *NXDOMAIN*, id: 2274 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;www.akamai.net. IN A ;; AUTHORITY SECTION: akamai.net. 167 IN SOA internal.akamaitech.net. hostmaster.akamai.com. 1383839413 90000 90000 90000 180 ;; Query time: 26 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Thu Nov 7 16:50:27 2013 ;; MSG SIZE rcvd: 109 Anurags-MacBook-Pro:~ anurag$ That's weird! Missing "akamai.net" entry from the authoritative DNS nodes? I am in Austria right now and so likely my nearby node giving bad replies. -- Anurag Bhatia anuragbhatia.com Linkedin <http://in.linkedin.com/in/anuragbhatia21> | Twitter<https://twitter.com/anurag_bhatia> Skype: anuragbhatia.com

2 2

Level3 and AT&T Latency
by Eric Williams 07 Nov '13

07 Nov '13

Is anybody else seeing or having major latency between Level 3 and AT&T today? We are multi-homed with Level 3 being one of our ISP's and had to divert traffic after seeing these issues. http://www.internetpulse.net/ Eric

8 9

M40e "AER" and MG9k's
by Shaw, Matthew 07 Nov '13

07 Nov '13

Good morning all, This is a bit of a longshot, but by any chance is there anyone watching this list who is currently or was formerly with VZ that's familiar with a configuration involving M40e's aggregating a number of customer facing MG9k's over ATM? We're having a heck of a time with them if you could reach out off list with any background or experiences with them from elsewhere I'd really appreciate it. Matt _______________________________________________________________________ This e-mail message and its attachments are for the sole use of the intended recipients. They may contain confidential information, legally privileged information or other information subject to legal restrictions. If you are not the intended recipient of this message, please do not read, copy, use or disclose this message or its attachments, notify the sender by replying to this message and delete or destroy all copies of this message and attachments in all media.

1 0

Re: Do you obfuscate email headers when reporting spam issues to clients?
by Anne P. Mitchell, Esq. 07 Nov '13

07 Nov '13

> On Wed, Nov 6, 2013 at 1:30 PM, Landon <landonstewart(a)gmail.com> wrote: >> How much trouble does your abuse department go to in order to obfuscate >> headers when providing evidence of spamming activity regardless of if it?s >> intentional/professional spammer activity or some kind of malware infection >> allowing a third party to spam. Especially for the pro spammers, we don?t >> want them list washing anything or worse yet becoming privy to spamtrap >> data if the reporting party wasn?t smart enough to obfuscate their own data >> before sending in the report. > > Howdy, > > It depends on the exact situation, but the general-purpose answer is: > none. zero. zip. > > The customer usually can't act on your information unless he can line > it up with an entry in his own logs. He needs lots of details in the > headers to figure out which computer or which of his users the message > came from. And he needs that information to determine whether the > message really came from his system -- headers get forged, you know. Because this is an issue inherent primarily with bulk mail, we remove all identifying information *except* the unsub link, which *should* have a unique identifying token embedded within, from which the sender *should* be able to determine the complainant's email address. And, if there is no such link, we use that as an opportunity to educate them as to *why* they need to include such a link (mind you, in order to be accredited with us the sender has to have already demonstrated that they comply with including an unsub link, but because many of our accreditation customers are ESPs, their customers may sometimes not be modelling 100% of best practices). Regardless of unsub link, or anything else, if we get a spam complaint against one of our customers, we hold their feet to the fire, and require them to explain exactly how the particular list was built, how the address was acquired, etc.. Failure to do so can (and usually does) result in termination of their accreditation - in the case of an ESP, they have to take corrective measures against their spamming customer or the ESP will lose their accreditation. Anne Anne P. Mitchell, Esq. Author: Section 6 of the CAN-SPAM Act of 2003 CEO/President Institute for Social Internet Public Policy http://www.ISIPP.com Member, Cal. Bar Cyberspace Law Committee How do you get to the inbox instead of the spam filter? SuretyMail! Helping businesses keep their email out of the junk folder since 1998 http://www.isipp.com/SuretyMail

4 6

latest Snowden docs show NSA intercepts all Google and Yahoo DC-to-DC traffic
by Jacque O'Lantern 07 Nov '13

07 Nov '13

http://www.washingtonpost.com/world/national-security/nsa-infiltrates-links…

19 28