- Test - lists.nanog.org

Re: botted hosts
by Dean Anderson 05 Apr '05

05 Apr '05

On Tue, 5 Apr 2005, Tony Finch wrote: > On Mon, 4 Apr 2005, Dean Anderson wrote: > > > > Err, not likely. SPF came out, and now bots can find the ISPs "closed > > relays" with very little trouble at all. > > AFAIK bots use the MX of a parent domain of the infected machine's > hostname to find an outgoing relay, not SPF. This is based on an > incident I dealt with in September, and the Spamhaus article > http://www.spamhaus.org/news.lasso?article=158 > Fortunately it isn't too hard to lock down MXs to incoming only. Yes. Many ISPs have MXs incoming only for reasons besides spam. But SPF identifies _outgoing_ mailservers. Just what a bot needs. --Dean -- Av8 Internet Prepared to pay a premium for better service? www.av8.net faster, more reliable, better service 617 344 9000

1 0

Re: botted hosts
by Dean Anderson 05 Apr '05

05 Apr '05

On Mon, 4 Apr 2005, Sam Hayes Merritt, III wrote: > > Unblocking on customer request is an expensive operation, for both the > > ISP and the customer. > > > And they frequently assume that network operations changes are > > free---Comcast reported that it would cost $58 million to implement port > > 25 blocking and notify customers, just for Comcast. > > Anyone can come up with a number to convince themselves that they don't > need to do the 'right thing'. Comcast is probably using Docsis. Docsis > makes applying filters on a per user basis pretty darn easy. Thats not the only thing they have to do. They have to (probably) 1) change the user service agreements 2) notify users of upcoming change several times 3) alter docsis on networks in hundreds of cities. 4) Staff additional support to handle calls. 5) lose business because many people want to send email to the server of their choice. > AOL blocks outbound 25. They've said this for many years, but I have hundreds of AOL addresses that have tried to abuse our relays. Maybe they do in some places, but not everywhere. Aug 6 2003 172.155.12.106 Trace 1638 This sort of attempted open relay abuse stopped only after the open relay blacklists shutdown in late 2003. Indeed, after about a year of complete quiet, abuse just started up again about mid March, but not as strong as before: Very few hosts, very few nets. Pretty lame, really, in comparision with the old days. All from Korea, and China targeting Korean ISPs, and one from Uruguay targeting Uruguayan ISP. Pretty definitely mailbombing by some open relay zealots or script kiddies, who probably pass themselves off as anti-spammers. It was interesting because I first got wind when some bounces were recieved from a Korean open relay. I got them because they were forged av8 from: addresses. Possibly, av8 was the target. Now who would target av8 with mailbombing? --Dean -- Av8 Internet Prepared to pay a premium for better service? www.av8.net faster, more reliable, better service 617 344 9000

1 0

Re: botted hosts
by Dean Anderson 05 Apr '05

05 Apr '05

On Mon, 4 Apr 2005 Valdis.Kletnieks(a)vt.edu wrote: > The problem arises when you are trying to push signal (spam) to a > non-cooperating recipient. I've seen spam that's so obfuscated that it's > unclear whether it's trying to sell me a R00leckss or medications. At > that point, it may be able to pass under the effective-bandwidth filter > of your covert channel. You are making the assumption that spam means to sell something. Spam includes mailbombing, in which the purpose is not commercial at all, but rather purely for annoyance. (there may be secondary commercial purposes, ie, to annoy users at a certain ISP to harm its business, but we can't discover that purpose by looking a single message. The terribly obfuscated spams never seem to be genuinely commercial. But its hard to count*. The confluence of CAN-SPAM and rapid early genuine spammer adoption of SPF records has revealed some interesting things about how much spam is genuinely commercial and how much is annoyance. It gave us a way to label commercial spam in an easily countable way. The numbers suggested that only about 6% of spam was genuinely commercial. And so leaving the other 94% as non-commercial garbage of one kind or another*. [See Malicious Cryptography: Exposing Cryptovirology by Adam Young et al. Unintelligible spam-like messages may be parts of an encrypted message sent to a "mix-net"] > If you hide the spam in a steganographic message inside a .JPG of a giraffe, > it will almost certainly make it to the mailbox. But at that point, the > user is left looking at a picture of a giraffe...... And on the girafe, the spots spell out a message that is immediately recognizable to a human. Sort of just like those crawler-thwarting "image" authenticators do now. Partly, this example is a deviation from info theory. The girafe example is just reliant on the fact that machines aren't as good a human at these sort of recognition tasks. If machines were, we'd have other problems, but unwanted messages would still be one of them. Info theory is much deeper. --Dean -- Av8 Internet Prepared to pay a premium for better service? www.av8.net faster, more reliable, better service 617 344 9000

1 0

Re: potpourri (Re: Clearwire May Block VoIP Competitors )
by David Barak 01 Apr '05

01 Apr '05

--- Paul Vixie <vixie(a)vix.com> wrote: > sure as hell, we'll see laws requiring every home to > have a telephone, to > have that telephone in the kitchen or other main > room of the home, and to > be clearly marked. then the POTS tithe comes back, > it'll be with vengeance. So given that you see this as likely, and by your tone, I'm guessing that you're not in favor of this outcome, what do you propose? David Barak Need Geek Rock? Try The Franchise: http://www.listentothefranchise.com __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Topicality Question: VoIP
by J.D. Falk 01 Apr '05

01 Apr '05

Are the hundreds upon hundreds of recent threads about VoIP /really/ on-topic for the NANOG list? -- J.D. Falk uncertainty is only a virtue <jdfalk(a)cybernothing.org> when you don't know the answer yet

3 2

Re: potpourri (Re: Clearwire May Block VoIP Competitors )
by Eric A. Hall 01 Apr '05

01 Apr '05

On 3/31/2005 7:22 PM, Brad Knowles wrote: > At 6:27 PM -0600 2005-03-31, Eric A. Hall wrote: >> Our system is chaotic and annoying at times but it produces better stuff >> in the form of whole new technologies and in the form of incremental >> improvements to existing technologies. > Don't pretend that just because you're an American, you > automatically know better, I don't pretend, and it's not because I'm an American > or that your system is inherently better. I didn't say the system was better, I said it produces "better stuff" insofar as that applies to long-term advancement, but that's nothing to say about here and now. Stability is cheap and friendly, which is arguably better when you are trying to exlain why somebody's TDMA phone won't ever work with a CDMA network. OTOH, I'm glad the world didn't stand still on X.25 and OSI, if you know what I mean. They are different models is all. But if you insist on reading something into that, then perhaps it's yourself suffering from prejudicial bias. Just a thought. > It is entirely possible that the Europeans might know a thing or two It's possible I guess. I mean, a European did bother advancing beyond Gopher to create HTTP, although I suspect that says more about the low-capitalization requirements of network services than anything about the cultural differences. -- Eric A. Hall http://www.ehsco.com/ Internet Core Protocols http://www.oreilly.com/catalog/coreprot/

1 0

Re: T1 vs. T2 [WAS: Apology: [Tier-2 reachability and multihoming]]
by John Dupuy 01 Apr '05

01 Apr '05

My apologies to UUNet/MCI, I'm not trying to pick on you, but you are useful to the discussion. But by the technical description of a "transit free zone", then 701 is not tier one, since I have encountered scenarios where many AS are transversed between 701 and other networks, not just a peer of a peer. Unless, by "transit free zone" you mean "transit trading" where large providers permit each other to transit for free. (Which gets back to my 'who hurts more' discussion.) I'm willing to be wrong. If any of the large providers on the list will say that their network does not transit beyond the customer of a peer; and they still maintain full connectivity, I will gladly be corrected. John At 07:23 PM 3/28/2005, you wrote: >On Mon, 28 Mar 2005, John Dupuy wrote: > > > I'll be brief, but I do want to perhaps word Alex's definition in a > different way > > that might be more useful. > > > > Even "tier 1" providers regularly trade transit. They must since no single > > network is connected to all the other ones. Not even close. Even UUNet (ASN > > 701), arguably the most-connected network on the planet, only connects to a > > fraction of the possible peerings. > >701 is not the most connected, it has only customers and a restrictive set of >peers? > >you dont need to peer with all networks tho, if all networks are buying >from 701 >or one of its peers then it will get those routes via peering not transit or >transit trades... you seem to be forgetting what peering is. > >and if you peer with all networks in the 'transit free zone' then you too >become >transit free also. > > > The true definition is more vague: if a peering or transit circuit > between A or B > > is taken down, who will be hurt the most: A or B? If it predominantly > B, and much > > less A, then A is "more Tier 1" and B is of a "lesser Tier". If they > are equally > > hurt, they the are of equal status. Essentially, "Tier 1" is whatever > the other > > "Tier 1" providers believe at the moment is "Tier 1". It is > self-referential and > > not distinct at all. > >i believe the distinction exists as shown above ie transit free.. as to >why this >might be considered a goal i'm not sure, its not obvious that transit free is >cheaper than buying transit! > >this thing about 'who hurts most' is an entirely different topic and has >nothing >to do with who is in the transit free zone. altho destructive depeering does >seem to be common practice within that zone :) > > > This is, frustratingly, a very non-technical definition. But it seems > to map > > with what I've actually seen the industry do. > >thats because non-technical definitions mean anyone can call themselves >anything >they like.. wiltel recently spammed me to buy their 'tier1 transit'.. >presumably >they are tier1 within their own definition of tier1. > >if you want to be technical tho, and aiui we are a technical forum, then >tier1 >means transit free. > >i reaffirm my earlier point - but why care, isnt it about cost and >reliability, >and as peering and transit are about the same cost who cares who you dont >peer >with > >Steve > > > > > John > > > > At 09:17 AM 3/28/2005, Stephen J. Wilcox wrote: > > > > On Mon, 28 Mar 2005, Randy Bush wrote: > > > > > > Firstly, peering isn't binary. Is peering vs transit a > distinction > > based on > > > > routes taken / accepted & readvertised, or on cost? Does > "paid for > > peering" > > > > count as peering or transit? If you pay by volume? If you pay for > > "more than > > > > your fair share" of the interconnect pipes? (if the latter, I am > > guessing > > > > there are actually no Tier 1s as everyone reckons they pay > for more > > than > > > > their fair share...). > > > > > > pay? did i say pay? i discussed announcement and receipt of > > prefixes. this > > > was not an accident. it is measurable. > > > > i also avoided money.. i dont think its that relevant, everyone is > > paying for > > peering or transit in one form or another, i dont think any > peering is > > free > > (free != settlement free) > > > > > > Secondly, it doesn't cover scenarios that have have happened > in the > > past. > > > > For instance, the route swap. EG Imagine networks X1, X2, X3, X4 > > are "Tier > > > > 1" as Randy describes them. Network Y peers with all the above > > except X1. > > > > Network Z peers with all the above except X2. Y & Z peer. To > avoid > > Y or Z > > > > needing to take transit, Y sends Z X2's routes (and sends Z's > > routes to X2 > > > > routes marked "no export" to X2's peers), and Z sends Y X1's > routes > > (and > > > > sends Y's routes to X1 marked "no export" to X1's peers). Perhaps > > they do > > > > this for free. Perhaps they charge eachother for it and settle up > > at the end > > > > of each month. Perhaps it's one company that's just bought > another. > > > > "transit (n). The act of passing over, across, or through; passage." > > > > whether it is a settlement arrangement or a mutual swap, they do NOT > > have > > peering, they ARE transitting and by our definition are not > > transit-free (and > > hence not tier1) > > > > however alex, you do highlight an excellent point - things are not as > > simple as > > 'tier1, tier2', there are complicated routing and financial > > arrangements in > > operation, which brings me back to my earlier point: does it matter > > what a > > network is paying for some connectivity providing they deliver to you > > the > > connectivity you need at the quality you desire? > > > > Steve > > > > > >

10 10

SORBS lies and new location for SORBS discussions
by Dean Anderson 01 Apr '05

01 Apr '05

I wrote a response to his message, but the details are rather redundant because no reasonable people have ever beleived them. So, I will instead post Sullivan's messages to www.iadl.org. Since possibly Nanog doesn't want to hear about all SORBS complaints, they can be forwarded there for posting. I'll set up a mailing list tomorrow with instructions on the site. BTW, this should pretty conclusively refute Browns/Sullivans' lies. (not that any reasonable people ever believed them.) dig ns camb.opengroup.org ; <<>> DiG 9.2.1 <<>> ns camb.opengroup.org ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34403 ;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;camb.opengroup.org. IN NS ;; ANSWER SECTION: camb.opengroup.org. 10800 IN NS ns1.camb.opengroup.org. camb.opengroup.org. 10800 IN NS ns2.camb.opengroup.org. camb.opengroup.org. 10800 IN NS xopen.xopen.co.uk. camb.opengroup.org. 10800 IN NS xopuk.xopen.co.uk. camb.opengroup.org. 10800 IN NS concorde.av8.com. What is that there: concorde.av8.com? How odd. Surely, it couldn't be that Sullivan is lying.... Of course, most people just see that OSF/The Open Group still exist, and that they have reported any space as being stolen. --Dean -- Av8 Internet Prepared to pay a premium for better service? www.av8.net faster, more reliable, better service 617 344 9000

1 0

Disappointment at DENIC over Poor Rating in .net Procedure
by Fergie (Paul Ferguson) 01 Apr '05

01 Apr '05

The Register article: "The report that this week decided the ownership of the second most important directory on the Internet has been called into question with the claim that a fundamental element of it is factually incorrect." http://www.theregister.co.uk/2005/03/31/net_report_denic/ DENIC statement: http://www.denic.de/en/denic/presse/press_70.html - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

9 11

SORBS Scanning (unauthorized)
by Dean Anderson 01 Apr '05

01 Apr '05

Ok, lets get back on topic: (some cisco config for network operators:) SORBS is relay testing again (see bounce below). BTW: for those networks that only feel comfortable blocking illegal activity, this is a violation of CAN-SPAM, because the message forges email headers, which is banned. You can access list the scanners by the following: access-list 104 deny ip 203.15.51.42 0.0.0.31 any Its more effective to block the DNS servers for the blacklist: access-list 104 deny ip host 194.109.9.11 any access-list 104 deny ip host 194.134.35.168 any access-list 104 deny ip host 194.134.35.204 any access-list 104 deny ip host 204.152.186.189 any access-list 104 deny ip host 203.15.51.34 any access-list 104 deny ip host 209.209.1.20 any access-list 104 deny ip host 209.142.2.10 any access-list 104 deny ip host 194.134.64.74 any access-list 104 deny ip host 128.193.0.30 any access-list 104 deny ip host 128.193.0.130 any Date: Wed, 30 Mar 2005 16:48:17 -0500 From: Mail Delivery Subsystem <MAILER-DAEMON@unspecified-domain> To: postmaster@unspecified-domain, spamtest(a)citation.av8.net Subject: Returned mail: Local configuration error The original message was received at Wed, 30 Mar 2005 16:44:45 -0500 from goliath.sorbs.net [203.15.51.42] ----- The following addresses had permanent fatal errors ----- <@[130.105.12.3]:relays@sorbs.net> ----- Transcript of session follows ----- 554 <@[130.105.12.3]:relays@sorbs.net>... Local configuration error -- Av8 Internet Prepared to pay a premium for better service? www.av8.net faster, more reliable, better service 617 344 9000

1 0