- Test - lists.nanog.org

Re: unwise filtering policy from cox.net
by Paul Ferguson 21 Nov '07

21 Nov '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Sean Donelan <sean(a)donelan.com> wrote: >On Tue, 20 Nov 2007, goemon(a)anime.net wrote: >> <abuse(a)cox.net> >> (reason: 552 5.2.0 F77u1Y00B2ccxfT0000000 Message Refused. A URL in >> the content of your message was found on...uribl.com. For resolution do >> not contact Cox Communications, contact the block list administrators.) > >An unfortunate limitation of the SMTP protocol is it initially only >looks at the right-hand side of an address when connecting to a >server to send e-mail, and not the left-hand side. This means >abuse(a)example.com first passes through the same server as all of >the rest of *(a)example.com e-mail. A single high-volume or special >address can easily overwhelm the normal email infrastructure (i.e. mailbox > full) or the normal server administrators may make changes which affects >all addresses passing through that server (i.e. block by IP address). > Sure, it's an "unfortunate limitation", but I hardly think it's an issue to hand-wave about and say "oh, well". Suggestions? - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHQ9V5q1pz9mNUZTMRAvCjAJ9VGB/7LicKsAXUwSwbmRVntfXm8gCgjEYT y9YWpm8OhqCDI5nPDBy6kZY= =OqQL -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

7 8

Reflection Attack- 69.80.239.50
by mack 20 Nov '07

20 Nov '07

I apologize if this is off topic. Currently the IP 69.80.239.50 is the victim of a reflection attack. Many operators may be seeing what appears to be a syn attack generated by this IP. These are actually spoofed packet hitting an open port designed to generate a syn-ack packet at the victim server. This attack was originally a standard syn attack which has lasted since the 13th. On Saturday the 17th we moved the victim server to a new ip behind a firewall. Yesterday, Monday the 19th at approximately 3PM the attack changed to a reflection attack of greatly increased magnitude. We have rate limited syn-ack packets hitting the firewall to reduce backscatter of reset packets. Anyone seeing a stream of packets that appears to be improperly sourced from 69.80.239.50 is asked to contact us if they believe they can help us track back the perpetrators. Any assistance that can be rendered is appreciated. This includes direction to another forum that may be able to offer assistance. As there are approximately 102,000 reflectors being used please do not contact us unless you can help us trace this back or provide substantial assistance. We are currently overwhelmed by abuse complaints this has generated. The attack has now doubled in size and may be considerably more than 102k reflectors. ---- LR Mack McBride Network Administrator Alpha Red, Inc.

1 0

Network Solutions domain transfer lock policy?
by Deepak Jain 20 Nov '07

20 Nov '07

I just became aware of an SOP at Network solutions. On a contact change to a domain, they automatically transfer lock the domain for 60 days. I am aware of ICANN-approved behaviors like 60 days lock on new or transfered registrations. This is a new curve ball and seems a little out-of-the-spirit of ICANN regulations (last I saw them). Is anyone aware of this as a kosher activity and is anyone aware of any other registrars doing it? Keep in mind, these are legitimate contact changes and not suspicious in anyway. Thanks in advance, DJ

5 4

Peering issue between PCCW and Cogent ?
by AD 20 Nov '07

20 Nov '07

Anyone experiencing any peering issues between PCCW and Cogent ? I have been seeing timeouts all day from keynote and traceroutes from cogent when trying to hit 208.71.120.64 on the east coast. -Adam

1 0

VLANs
by Rodney Joffe 19 Nov '07

19 Nov '07

Are any of you operators utilizing VLANs to/with your transit providers in order to isolate traffic types or services, and/or to assist in traffic shaping before it hits your transit connections (isolating the effects of DDoS's)? Would you be prepared to share experiences, do's/don'ts, gotcha's etc? Off-line responses would be fine, obviously - I don't want to add to any of the current noise.

6 6

AOL Postmaster issues
by Drew Weaver 19 Nov '07

19 Nov '07

I have a question which has been unanswerable by normal channels, I will post it here hopefully someone else has run into it and I will not waste too much of anyone's time with it. Our abuse department has been receiving e-mails daily with our feedback loop with AOL about e-mails which were 'supposedly' sent about a year ago. Does this mean that A) the message was sent almost year ago but was not read and marked as spam until today? Or b) the "abuser" is changing the date on the mail server which is messing with their means of reporting it in their feedback loops? (the second one doesn't seem likely, but if it is the case we would like to kick this guy off of our network...) (shouldn't they have some limit on how long they will allow people to report spam?) Below is the header and part of the message we're getting from AOL... From: scomp(a)aol.net [mailto:scomp@aol.net] Posted At: Thursday, November 15, 2007 3:17 PM Posted To: Microsoft Office Outlook Embedded Message Conversation: Email Feedback Report for IP -ip address removed.. why not? -- Subject: Email Feedback Report for IP -ip address removed.. why not? -- This is an email abuse report for an email message received from IP address -ip address removed.. why not? --on Sat, 30 Dec 2006 15:22:02 -0500 Thanks in advanced if any list members know, or if anyone from AOL sees this. Sorry to anyone who sees this as a waste of their time.. -Drew

3 2

NANOG Updates
by Betty J. Burke 19 Nov '07

19 Nov '07

NANOG Community; On behalf of Merit Network, we are pleased to announce NANOG 42 meeting registration is now open. Hotel information is also posted. The meeting will begin mid-to-late Sunday afternoon, February 17, and will adjourn around 12 noon on Wednesday, February 20, 2008. Early Registration starts today $450 Late Registration starts January 17, 2008 $525 On Site Registration starts February 15, 2008 $600 The registration fee covers all tutorials, birds of feather sessions, general sessions, and also covers three continental breakfasts, six refreshment breaks, and one reception. Cancellation Fee Full Refunds minus a $35 transaction fee will be issued upon receipt of a written (e-mail) cancellation notice dated no later than February 10, 2008. No refunds will be issued after February 10, 2008. Visit <https://www.nanog.org/registration/> and <http://nanog.org/mtg-0802/hotel.html> for complete details. See you there! In addition, a number of web pages have been updated. NANOG Futures <http://www.nanog.org/future.html> NANOG Charter <http://www.nanog.org/charter.html> NANOG AUP <http://www.nanog.org/aup.html> NANOG41 Meeting Survey <http://www.nanog.org/mtg-0710/surveyresults.html> NANOG41 Meeting Stats <http://www.nanog.org/mtg-0710/presentations/stats.pdf> If you have any questions regarding the NANOG website and/or NANOG 42, please send them along to NANOG-support(a)nanog.org. Sincerely, Betty Burke

1 0

Postmaster Operator List?
by Justin Scott 19 Nov '07

19 Nov '07

Is there a mailing list similar to NANOG specifically for e-mail operations? I've seen some smaller lists around that deal with specific issues (spam, etc.) but have not seen a general postmaster operations mailing list, though I'm sure there has to be one around somewhere. Any hints in that direction would be appreciated. -Justin Scott | GravityFree Network Administrator 1960 Stickney Point Road, Suite 210 Sarasota | FL | 34231 | 800.207.4431 941.927.7674 x115 | f 941.923.5429 www.GravityFree.com

6 5

RE: BGP Communities
by Neil J. McRae 19 Nov '07

19 Nov '07

James, Community lists and route maps but the place to start is a sheet of paper and to think about what your goal is. Its quite easy (especially on large networks) to build contradictory logic. Also beware what implications you have for cost and capacity. E.g. A customer could signal send all my traffic via $expensivetransit and you then lose money quick. Communties are also good for blackhole signalling but remember your customers will raise queries when deploying them too! Regards, Neil -----Original Message----- From: James Blessing <james.blessing(a)entagroup.com> Sent: 19 November 2007 07:17 To: nanog(a)merit.edu Subject: BGP Communities Hi, Following up on the thread about BGP communities, I was wondering if there is a guide on how to actually implement communities within a network... There are a couple of presentations about why communities are good and about the general design of communities but my googlefu has so far not found a "Here is how to deploy Communities" guide that takes into account the important things like configuration maintenance, how to scale and what mistakes not to make. We are a Cisco house so any Cisco specific documentation would be great but any guide right now would be a start. J -- COO Entanet International T: 0870 770 9580 W: http://www.enta.net/ L: http://tinyurl.com/3bxqez

1 0

BGP Communities
by James Blessing 19 Nov '07

19 Nov '07

Hi, Following up on the thread about BGP communities, I was wondering if there is a guide on how to actually implement communities within a network... There are a couple of presentations about why communities are good and about the general design of communities but my googlefu has so far not found a "Here is how to deploy Communities" guide that takes into account the important things like configuration maintenance, how to scale and what mistakes not to make. We are a Cisco house so any Cisco specific documentation would be great but any guide right now would be a start. J -- COO Entanet International T: 0870 770 9580 W: http://www.enta.net/ L: http://tinyurl.com/3bxqez

2 2