- Test - lists.nanog.org

RE: [Fwd: zone transfers, a spammer's dream?]
by Matt Ryan 14 Dec '04

14 Dec '04

www.bl.uk? Matt. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Stephane Bortzmeyer Sent: 14 December 2004 09:52 To: Gadi Evron Cc: nanog list Subject: Re: [Fwd: zone transfers, a spammer's dream?] On Thu, Dec 09, 2004 at 03:52:38AM +0200, Gadi Evron <ge(a)linuxbox.org> wrote a message of 174 lines which said: > 171 uk.zone Everything is in subdomains like co.uk, so there is no point in blocking zone transfers for the TLD. ------------------------------------------------------------------------------ Live Life in Broadband www.telewest.co.uk The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Statements and opinions expressed in this e-mail may not represent those of the company. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender immediately and delete the material from any computer. ==============================================================================

2 1

"User Unknown" errors related to DNS issues?
by Jim Popovitch 14 Dec '04

14 Dec '04

Hi all, I see a periodic problem with some email servers that report "User Unknown" for valid users. The most recognizable problematic host is hotmail.com, but there usually are others mixed in (today's additional problematic hosts included msn.com, verizon.net, and incentre.net) Here is one of the errors: Dec 13 11:20:55 mail sm-msp-queue[5360]: iBDGFPc0004630: to=<frank-****(a)msn.com>, delay=00:05:30, xdelay=00:00:00, mailer=esmtp, pri=470333, relay=mx1.hotmail.com. [64.4.50.99], dsn=5.7.1, stat=User unknown I found this post on Neohapsis that suggests the problem is DNS/firewall related: http://archives.neohapsis.com/archives/postfix/2004-03/1774.html What I can't understand is why this would be periodic and what, if anything, I can do to validate the authenticity of the errors? Do others see this same issue? -Jim P.

3 3

CBX-500 question, FRF.8
by james 14 Dec '04

14 Dec '04

I am working on a solution that will require my CBX-500 to do transparent mode and not translation mode. I've grepped the docs I have and looked on the web and can't find reference to which mode the CBX uses. This cross connect would be between the FR 3/1 card to the ATM DS3 card. Does anyone know which mode the CBX uses ? -- James H. Edwards Routing and Security Administrator At the Santa Fe Office: Internet at Cyber Mesa jamesh(a)cybermesa.com noc(a)cybermesa.com (505) 795-7101

1 0

China: Spam capital of the world?
by Fergie (Paul Ferguson) 14 Dec '04

14 Dec '04

Slightly off-topic, but some operational relevance. Taking a cue from a snippet on /. http://www.atimes.com/atimes/China/FL14Ad02.html - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

2 1

sarbanes-oxley email archiving
by Mike Walter 14 Dec '04

14 Dec '04

So, has anyone used the GFI email archiver for exchange server? Does anyone have thoughts as to other software that is similar to this product? What about software for linux email archiving? We are starting to look at this for some clients and thought the NANOGers might have some input. Feel free to email me off-list. Mike Walter, MCP PCD Network Solutions, Inc. 3z.net a PCD Company <http://www.3z.net>

3 2

Re: China: Spam capital of the world?
by sgorman1＠gmu.edu 13 Dec '04

13 Dec '04

The article reinforces the empirical findings from some spam mapping work we've been doing. Part of that work has been putting together a spammer social network based on collaborations and partnerships between different spammers. While the vast majority of spammers are based in the US there are a few key actors that link up the domestic slime with international slime hosting and zombie procurement. We've tried different arrest scenarios as well to see which key actors would have the most disturbance on the network by their removal. Since spammers still operate in a quasi legal environment their network is more susceptible to attack than similar criminal and terrorist network. >From an operational standpoint the argument goes that trying to solve spam with a purely technology based solutionis has some inherent troubles. Thus far technology based solution have, along with some success, also caused an escalating arms race with spammers, with increasing negative externalities. Heavy blacklisting and filtering led to the deployment of worms to create zombies to circumvent filters. The result is tit for tat responses that also create increasing problems for the Internet beyond just spam. Currently there is little incentive for spammers not to spam. Certainly not the ca-spam act. I'm not saying technology solutions are impossible, just that they are not a silve bullet. On the upside, at least from preliminary research, going after the individual spammers can have an impact. The trick is you need a bigger stick to go after them with and penalities and arrests that cause a disincentive to spam. You'll never get everyone but if you can cause the cost of doing business as a spammer to increase tangibly I'd wager the impact would be significant. They operate on very slim margins and exceedingly low response / success rates. Along those lines we are still working on a GIS databse of spammer addresses to do mapping and analysis, but still have a bit more to go on it. Just my biased 2 cents. ----- Original Message ----- From: "Fergie (Paul Ferguson)" <fergdawg(a)netzero.net> Date: Monday, December 13, 2004 1:54 pm Subject: China: Spam capital of the world? > > > Slightly off-topic, but some operational relevance. > > Taking a cue from a snippet on /. > > http://www.atimes.com/atimes/China/FL14Ad02.html > > - ferg > > -- > "Fergie", a.k.a. Paul Ferguson > Engineering Architecture for the Internet > fergdawg(a)netzero.net or > fergdawg(a)sbcglobal.net >

1 0

Juniper TX Matrix.
by Deepak Jain 13 Dec '04

13 Dec '04

[I'm wearing my asbestos gloves.] Is anyone out there in need of a 4-way interconnect between T640 nodes for production IP networks? Is this a silly question? A few months back, we all discussed how the CRS-1 from Cisco was largely aimed at folks who were spending other people's money -- research & gov't types mostly. The TX Matrix as announced Dec 3, 2004 (I just heard about on Slashdot today, so I admit I am a little behind) and have not heard a peep from anyone about it. I can assume that because this doesn't scale as high as a CRS-1, it is going to be less expensive, but the question is... does it fill a need for someone today? thanks, DJ

1 0

RE: (newbie) BGP For Dummies?
by Kashif Salam 13 Dec '04

13 Dec '04

Nice resource from Cisco for BGP http://www.cisco.com/univercd/cc/td/doc/cisintwk/ics/icsbgp4.htm Kashif Salam -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Irwin Lazar Sent: Sunday, December 12, 2004 11:37 AM To: dave(a)mvn.net; nanog(a)nanog.org Subject: Re: (newbie) BGP For Dummies? Try: http://www.itprc.com/routing.htm Look under the "BGP" sub-heading for links to a lot of info. Irwin > From: "David E. Smith" <dave(a)mvn.net> > Reply-To: <dave(a)mvn.net> > Date: Fri, 10 Dec 2004 14:35:34 -0600 > To: <nanog(a)nanog.org> > Subject: (newbie) BGP For Dummies? > > > "Hi, long-time listener, first-time caller..." > > Can anyone recommend a good forum for BGP questions? I've got my copy of the > O'Reilly book handy, but having never really worked with BGP before, I find > it's not really the best novice-level work. > > (Or, if questions about weird inter-AS routing scenarios are on-topic here, > I'd > be glad to bounce my problems around on NANOG.) > > Thanks! > > David Smith > MVN.net > ------------------------------------------------ This email is intended only for the person(s) named above and may contain confidential information. If you have received this email in error please promptly notify the sender of the message and delete it and any attachments from your computer.

1 0

no whois info ?
by Mike Tancsa 13 Dec '04

13 Dec '04

While doing a quick sample of my spam to see where spamvertized web sites were hosted and registered, I came across the domain vestigial3had.com shell1% whois vestigial3had.com Whois Server Version 1.3 Domain names in the .com and .net domains can now be registered with many different competing registrars. Go to http://www.internic.net for detailed information. No match for "VESTIGIAL3HAD.COM". yet, shell1% host -tns vestigial3had.com vestigial3had.com name server ns1.kronuna.biz vestigial3had.com name server ns2.kronuna.biz shell1% What gives ? How can their be no whois info anywhere ? ---Mike -------------------------------------------------------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike(a)sentex.net Providing Internet since 1994 www.sentex.net Cambridge, Ontario Canada www.sentex.net/mike

18 32

New Edge Brokenness?
by Jason Slagle 13 Dec '04

13 Dec '04

Has anyone else noticed an increase in layer 3 downtime in newedges network since the "big meltdown"? I'm now losing connectivity several times a day, and only layer 3. Attempts to go through the normal support channels have resulted in runarounds and layer one/two tests. Jason -- Jason Slagle - CCNP - CCDP /"\ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . \ / ASCII Ribbon Campaign . X - NO HTML/RTF in e-mail . / \ - NO Word docs in e-mail .

3 2