- Test - lists.nanog.org

Re: AS11296 -- Hijacked?
by Robert Bonomi 30 Sep '10

30 Sep '10

> Date: Wed, 29 Sep 2010 13:06:31 -0700 > Subject: Re: AS11296 -- Hijacked? > From: Scott Howard <scott(a)doc.net.au> > > On Wed, Sep 29, 2010 at 9:26 AM, N. Yaakov Ziskind <awacs(a)ziskind.us> wrote: > > > Recommendations such as that are only as credible as the source they are > coming from, and knowing that the person making the request also believes > that blocking all mail from gmail.com is a valid anti-spam technique > probably results in a "different" credibility level than one might otherwise > have. I have to ask one question -- who are _you_ to judge what is 'valid' for *HIS* situation? He's not running a 'provider' network, with any responsibility to others, it's his personal environment. On _my_ personal servers, I block *LARGE* swaths of the world -- because I _do_ get significant amounts of spam from those locales, and have *zero* expectation of any 'legitimate' mail therefrom. The service denial messages _do_ provide info on how to get past the blocks. I can state with authority that in close to a million messages so rejected, -not-a-single-one- has been from someone with a serious interest in communicationg with me. The web-page with the explanatory data has not had so much as a single hit in over 8 years. Now, on systems I manage for others, I do things very differently, according to -their- needs. The rationale for such decisions is straightforward, and easy to understand. It's called the 'cost-benefit' ratio. _How_much_ work does it take to let that 'rare' piece of 'useful' mail through from a source that generates almost exclusively spam, and _is_ getting that occasional piece of mail 'worth the effort'. Ron has decided 'not', with regard to gmail. To argue that decision, _you_ would have to know how much 'valid' traffic he can reasonably expect to get from gmail, and the amount of effort it would take in his existing environment to accomplish that end.

3 4

Reputation Services [WAS: Re: AS11296 -- Hijacked?]
by Paul Ferguson 30 Sep '10

30 Sep '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Wed, Sep 29, 2010 at 5:04 PM, Franck Martin <franck(a)genius.com> wrote: > This is not what the Team Cymru Bogons list for? > http://www.team-cymru.org/Services/Bogons/ > > List bad ASNs after proper investigation? > > It then depends if you trust Team Cymru or not, like you would trust or > not Spamhaus... > Of course all policy should be local -- each organization can make their own determination whose DNSBL, reputation service, or filter list to employ. $.02, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.5.3 (Build 5003) wj8DBQFMo9WDq1pz9mNUZTMRAjUQAKCJc/hHDTUX9L3WHq+QaIDLpru8YgCg7O3h DTLrkDZZV4+obb97YODC57A= =kW01 -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawgster(at)gmail.com ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: Google blocks ISP arbitrarily contrary to their "don't be evil", ignorant fools debate merits of political correctness on NANOG
by Erik L 29 Sep '10

29 Sep '10

After you're done adding hate speech and spamming to my list of alleged criminal offences, can you and others please not post or e-mail me off-list if you have nothing new to contribute to the resolution of the problem? ----- Original Message ----- From: "Ryan Hayes" <ryguillian(a)gmail.com> To: "Erik L" <erik_list(a)caneris.com>, nanog(a)nanog.org Sent: Wednesday, September 29, 2010 5:08:18 PM Subject: Re: What must one do to avoid Gmail's retarded non-spam filtering? Can you please not use the word "retarded" in a pejorative sense? On Tue, Sep 28, 2010 at 3:15 PM, Erik L <erik_list(a)caneris.com> wrote: > I realize that this is somewhat OT, but I'm sure that others on the > list encounter the same issues and that at least some folks might have > useful comments. > > An increasingly large number of our customers are using Gmail or > Google Apps and almost all of our OSS/BSS mail is getting spam > filtered by Google. Among others, these e-mails include invoices, > order confirmations, payment notifications, customer portal logins, > and tickets. Almost anything we send to customers on Google ends up in > their spam folder. This results in a lot of calls and makes much of > our automation pointless, never mind all the lost sales. > > The problem is compounded by those who use mail clients and do not log > in to the webmail at all, since they would never see the contents of > the Google spam folder. > > We have proper A+PTR records on the edge MTAs, proper SPF records for > the originating domain, proper Return-Path and other headers, and so > on. There isn't anything that I can think of other than the content > itself which would be abnormal, and obviously the content is > repetitive and can't be changed much. Is there something obvious which > we've missed? > > Aside from the following clearly impractical solutions, what can we > do? 1. Asking everyone (including those we don't even know yet) to > whitelist all of our addresses, to check their spam folders, and to > click on "this is not spam" > 2. Providing our own free e-mail service to everyone (including those > we don't even know yet) and putting up "don't use Google" ads on all > of our customer-facing systems > > At least this isn't Hotmail where mail is just silently deleted with > no NDR after it's accepted by their MTAs. > > The call volume has been going up instead of down lately and it's > gotten to the point where we're sending MTA log extracts to people to > prove to them that we really did e-mail them. > > Would greatly appreciate any advice. > > Erik > >

1 0

RE: AS11296 -- Hijacked?
by Robert Bonomi 29 Sep '10

29 Sep '10

> From nanog-bounces+bonomi=mail.r-bonomi.com(a)nanog.org Wed Sep 29 13:59:15 2010 > From: Justin Horstman <justin.horstman(a)gorillanation.com> > To: "'George Bonser'" <gbonser(a)seven.com>, Heath Jones <hj1980(a)gmail.com>, > "Ronald F. Guilmette" <rfg(a)tristatelogic.com> > Date: Wed, 29 Sep 2010 11:53:27 -0700 > Subject: RE: AS11296 -- Hijacked? > Cc: "nanog(a)nanog.org" <nanog(a)nanog.org> > > > -----Original Message----- > > From: George Bonser [mailto:gbonser@seven.com] > > Sent: Wednesday, September 29, 2010 10:44 AM > > To: Heath Jones; Ronald F. Guilmette > > Cc: nanog(a)nanog.org > > Subject: RE: AS11296 -- Hijacked? > Is the person reporting this > > a > > known network operator that people trust or is it some Joe Blow out of > > nowhere that nobody has heard of before? That would make a huge > > difference. =20 > > > Going to his website....looks like Joe Blow...Googling his name/email/domai= > n, still nothing that would lead me to believe he is network Savvy. So comi= > ng from Joe Blow network Dude....he too is just Joe Blow. Just a little per= > spective for you from the bottom of the pile. > At least some of us -- who have been on the net for multiple decades -- know who the OP is. He's kept a low profile for a number of years, but he was very active in the early days of the anti-spam wars. Anyone actively involved in anti-spam activities in the days when promiscuous mail relays were common, (and Sun was still shipping 'sendmail 8.6.4') will likely recogize the name. They may have to think for a while, due to the time involved, but he was very well known in those days. 'Notorious' would be considered by some to be an accurate description. Absolutely top-notch technical skills, but a bit of a loose cannon in implementing things _he_ decided were 'for the good of the community'. 'Active' techniques, not just passive ones. *IF* he was accurate in his assessment, and it is my personal opinioin that it is *highly*likely* that there _was_ some sort of 'funny business' involved, whether or not his idenfitication was 100% accurate (and, based on personal experience again, I regard it a probable that he was =entirely= correct in his assessment), *THEN* the odds are quite good that one or more of the parties ivolved is a subscriber to this list. Considered in _that_ light, it would be simply 'stupid' -- which Ron is _not_ -- to tip them off as to where they screwed up, and what gave them away.

1 0

the lazy mans HW research
by bmanning＠vacation.karoshi.com 29 Sep '10

29 Sep '10

morning gentle people. i find myself in need of a multiport (8-16) 1 Gig ethernet HUB. or a switch smart enough to do transparant port mirroring to at least four ports. some kind soul pointed me here, http://www.dlink.com/products/?pid=337 but its not clear if this will actually perform as desired. suggest to the suggestable listener? --bill

3 2

Re: AS11296 -- Hijacked?
by Ronald F. Guilmette 29 Sep '10

29 Sep '10

Heath Jones <hj1980(a)gmail.com> wrote: >Out of curiosity, what led you to this conclusion? A number of factors, actually. Although I had started to type up a lengthy and elaborate response to your eminently reasonable question, on second thought, I don't think that I actually want to go into detail on this case, as anything I might say as regards to how I detected this would just allow future hijackers to evade me that much more effectively. So I'm sorry to be giving you a non-answer, but actually, I think that's best for now. In any case, further discussion of this particular case now appears to be moot. As of now, it appears that AS11296 is no longer announcing any routes at all, so I'm assuming that Nishant Ramachandran (Xeex/AS27524) and/or whoever else may have been involved in this has now been adequately spanked. (And my personal thanks go out to whoever did that.) Regards, rfg P.S. Yes, I actually _am_ blocking inbound e-mail from google/gmail. Too much spam from there, and far too little action to correct the abundant problem(s). (Can you spell E-V-I-L?) Also blocked here: Yahoo and Hotmail, for the same reasons. (To big to fail? No. Just too big to care. They don't need me, and I sure as hell don't need them.) I guess you don't have a real mail server of your own that you can use. For that, you have my sympathies.

12 16

Re: What must one do to avoid Gmail's retarded non-spam filtering?
by Erik L 29 Sep '10

29 Sep '10

Thanks, this is a possibility. However, that customer IP has been dealt with and hasn't been spamming for more than 60 hours at most (it's actually part of a dynamic DSL pool where port 25 outbound was supposed to have been blocked). Our problem appears to have started before the 27th. Earlier today I noticed that the SPF record had "a" and "ptr" in it and changed it to "mx" only, as it should be in our case. What I find most peculiar is none of these having problems: 1. Competitors over 10 times our size (similar % of gmail users), with invalid SPF records, no DKIM, who don't do *ANY* of what anyone here or off-list has suggested, who have PTRs for their DSL customers similar to ours (and didn't have a port 25 block), who've been blasting maintenance notices for years 2. Amazon, eBay, PayPal, Dell, etc. 3. Facebook with their ***user-generated content, in HTML*** ----- Original Message ----- From: "Joe Sniderman" <joseph.sniderman(a)thoroquel.org> To: nanog(a)nanog.org Sent: Wednesday, September 29, 2010 3:29:10 PM Subject: Re: What must one do to avoid Gmail's retarded non-spam filtering? On 09/29/2010 12:05 AM, Erik L wrote: > Google appears to have blacklisted our domain. From the edge MTA, I > sent three messages, differing only in the From header: 1. valid > email @klssys.com 2. valid email @caneris.com 3. abc123(a)caneris.com > > 1 not spam; 2 & 3 spam Ok, so its the domain not the IP. You're a DSL provider, right? IP's assigned to customers have PTR's in caneris.com, right? [..snip..] > ----- Original Message ----- From: "Erik L" <erik_list(a)caneris.com> > To: "William Pitcock" <nenolod(a)systeminplace.net> Cc: > nanog(a)nanog.org Sent: Tuesday, September 28, 2010 7:17:45 PM Subject: > Re: What must one do to avoid Gmail's retarded non-spam filtering? > > Hi William, > > I do so for our entire IP space on a regular basis. The edge MTA I > mentioned in the reply to Bill shows up as "Neutral" there. Ok, but there are a couple customer IP's that show up as "Poor" there, with rDNS in caneris.com not in klssys.com. One of those is on CBL (and XBL) and PSBL, and is spamming using your domain: http://psbl.surriel.com/evidence?ip=199.19.168.33&action=Check+evidence Its not PBL listed even though its a dynamic IP it seems: http://www.spamhaus.org/query/bl?ip=199.19.168.33 That would be an SPF pass as well, because of: caneris.com. 3600 IN TXT "v=spf1 a mx ptr -all" So, from the receiving end it could easily look like its one of caneris.com's outbound servers.. But not one of klssys.com's servers. Maybe this has something to do with the problem. HTH, Joe -- Joe Sniderman

1 0

Re: What must one do to avoid Gmail's retarded non-spam filtering?
by Erik L 29 Sep '10

29 Sep '10

Google appears to have blacklisted our domain. From the edge MTA, I sent three messages, differing only in the From header: 1. valid email @klssys.com 2. valid email @caneris.com 3. abc123(a)caneris.com 1 not spam; 2 & 3 spam Return-Path of all three was still another address @caneris.com and the two SPF passed headers were still there. The body & subject of all messages was simply "testing5". The recipient even clicked on "not spam" on #2 prior to #3 being sent. At least it explains why all the other standard stuff we all looked at didn't explain the issue. The next (and last) question is: does anyone have a clueful Google mail ops contact? Thanks again for all the help and sorry for the OT noise. Erik ----- Original Message ----- From: "Erik L" <erik_list(a)caneris.com> To: "William Pitcock" <nenolod(a)systeminplace.net> Cc: nanog(a)nanog.org Sent: Tuesday, September 28, 2010 7:17:45 PM Subject: Re: What must one do to avoid Gmail's retarded non-spam filtering? Hi William, I do so for our entire IP space on a regular basis. The edge MTA I mentioned in the reply to Bill shows up as "Neutral" there. Thanks Erik ----- Original Message ----- From: "William Pitcock" <nenolod(a)systeminplace.net> To: "Erik L" <erik_list(a)caneris.com> Cc: nanog(a)nanog.org Sent: Tuesday, September 28, 2010 6:06:49 PM Subject: Re: What must one do to avoid Gmail's retarded non-spam filtering? Hi, Have you checked the IronPort reputation scores for your mailserver IPs? Google uses this data as part of it's spam detection method. William On Tue, 2010-09-28 at 16:15 -0400, Erik L wrote: > I realize that this is somewhat OT, but I'm sure that others on the > list encounter the same issues and that at least some folks might have > useful comments. > > An increasingly large number of our customers are using Gmail or > Google Apps and almost all of our OSS/BSS mail is getting spam > filtered by Google. Among others, these e-mails include invoices, > order confirmations, payment notifications, customer portal logins, > and tickets. Almost anything we send to customers on Google ends up in > their spam folder. This results in a lot of calls and makes much of > our automation pointless, never mind all the lost sales. > > The problem is compounded by those who use mail clients and do not log > in to the webmail at all, since they would never see the contents of > the Google spam folder. > > We have proper A+PTR records on the edge MTAs, proper SPF records for > the originating domain, proper Return-Path and other headers, and so > on. There isn't anything that I can think of other than the content > itself which would be abnormal, and obviously the content is > repetitive and can't be changed much. Is there something obvious which > we've missed? > > Aside from the following clearly impractical solutions, what can we > do? 1. Asking everyone (including those we don't even know yet) to > whitelist all of our addresses, to check their spam folders, and to > click on "this is not spam" > 2. Providing our own free e-mail service to everyone (including those > we don't even know yet) and putting up "don't use Google" ads on all > of our customer-facing systems > > At least this isn't Hotmail where mail is just silently deleted with > no NDR after it's accepted by their MTAs. > > The call volume has been going up instead of down lately and it's > gotten to the point where we're sending MTA log extracts to people to > prove to them that we really did e-mail them. > > Would greatly appreciate any advice. > > Erik >

3 2

Software-based Border Router
by Nathanael C. Cariaga 29 Sep '10

29 Sep '10

Hi All! Just want to ask if anyone here had experience deploying software-based routers to serve as perimeter / border router? How does it gauge with hardware-based routers? Any past experiences will be very much appreciated. I wanted to know because we've been asked if we want to assume full control of the internet link (up to the router). By assuming control up to the router, we still want to configure iBGP with our parent network so that we can take advantage of some routes available to the parent network's gateway. The saddest part is presently we do not have the router to serve as our gateway this is why we are considering the use of software-based routers. Thank you.

18 26

Randy in Nevis
by Rudolph Daniel 29 Sep '10

29 Sep '10

Dont know if this may assist, but here is another from St Vincent...lime network. Sunday 19th sep. 2010 http://n1.netalyzr.icsi.berkeley.edu/summary/id=43ca253f-6714-b0f7e7b0-d08e… RD

16 25