- Test - lists.nanog.org

RE: Best way to get of Bogon list?
by Majid Farid 29 Nov '04

29 Nov '04

72.0.0.0/8 as well :) Will send you a private email once I get the IP going :-) -- Majid. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Jared Mauch Sent: Monday, November 29, 2004 5:08 PM To: Barry Raveendran Greene Cc: 'Jared Mauch'; 'Jon Lewis'; nanog(a)merit.edu Subject: Re: Best way to get of Bogon list? On Mon, Nov 29, 2004 at 07:04:28AM -0800, Barry Raveendran Greene wrote: > > Jared Mauch: > > > jlewis: > > > If someone will lend me appropriate /24's, I'll copy > > > 69box.atlantic.net into 70box, 71box, etc. and come up with a > > > large (fairly comprehensive) list of IPs behind broken bogon > > > filters. > > > > http://puck.nether.net/~jared/papers/69-paper.html > > > > I can rewrite this slightly and post it on slashdot and > > other places again.. > > I think it would be useful. The "Bogon Team" implemented several > changes after 69/8 to make "change management" easier. This included > maintain objects at Merit RADB, RIPE NCC RADB, and a way to track via > DNS (see the details on http://www.cymru.com/Bogons/index.html) I'll write up a new version of this. Can those of you that are having problems in the 70/8 and 71/8 space write me a snippet in private email saying how this is impacting them? One paragraph please, also include your full name and employer or whom you represent. this way i can include the impact seen in it so people *may* wake up and realize the impact of lack of maintence of these filters. - jared -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

1 0

RE: "Make love, not spam"....
by Miller, Mark 29 Nov '04

29 Nov '04

Not the A, the PTR... But yes, that could be a nasty retaliation by spammers with control of their DNS. I would hope, however, that the "screen saver's" target would be an IP address instead of a FQ mnemonic hostname. From the article, I understand that Lycos will be manually watching the list of targets and pushing updates to the users. Although I have traditionally been in favor of low bandwidth "fixes", this kind of appeals to my sense of poetic justice. -mark -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Mike Tancsa Sent: Monday, November 29, 2004 9:12 AM To: Suresh Ramasubramanian Cc: nanog(a)merit.edu Subject: Re: "Make love, not spam".... ... What about the case where the spammer gets black listed, traffic starts pounding the rouge site and then the spammer changes the A record to be www.example.com instead. Now all of a sudden www.example.com is being pounded by all those screen savers. ---Mike

3 3

Re: Best way to get of Bogon list?
by Majid Farid 29 Nov '04

29 Nov '04

Exactly what I have been doing for last week 2 weeks now. Thanks, Majid -------------------------- Sent from my BlackBerry Wireless Handheld -----Original Message----- From: Suresh Ramasubramanian <suresh(a)outblaze.com> To: Majid Farid <MajidFarid(a)TelecomOttawa.com>; nanog(a)merit.edu <nanog(a)merit.edu> Sent: Thu Nov 25 21:56:04 2004 Subject: Re: Best way to get of Bogon list? Majid Farid <MajidFarid(a)TelecomOttawa.com> wrote: > > I have question for the list what would be best/fastest way to get off > bogon list. Arin allocated us a /19 2 months ago (72.1.192.0/19) We > find that a lot of providers aren't accepting the BGP advertisements > for that block because the block 72.0.0.0/8 was on bogon list. > There's only one widely used "list" of bogons that I know of - bogons.cymru.com, and that is quite well updated. What you are seeing is a whole bunch of providers who have hardcoded bogon lists into their router ACLs, manually. The fastest way for you to get off these providers' ACLs is going to be "call each provider's NOC and tell them to update their filters". srs

12 16

RE: "Make love, not spam"....
by Hannigan, Martin 29 Nov '04

29 Nov '04

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Hannigan, Martin > Sent: Monday, November 29, 2004 1:16 PM > To: nanog(a)merit.edu > Subject: RE: "Make love, not spam".... > > > > > > -----Original Message----- > > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] > > Sent: Monday, November 29, 2004 12:45 PM > > To: nanog(a)merit.edu > > Subject: RE: "Make love, not spam".... > > > > > > > > > > -----Original Message----- > > >> From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] > > >> Sent: Monday, November 29, 2004 11:54 AM > > >> To: nanog(a)merit.edu > > >> Subject: RE: "Make love, not spam".... > > >> > > >> > > >> > > >[ SNIP ] > > > > > >> > > >> The big difference between Lycos Europe, and a script > kiddie with > > >> zombies is that Lycos is mature enough to use restraint > > and not knock > > >> down websites with brute force. They're attempting to use the > > >> politically correct "grown up" way to attack someone: > economics. > > > > > >I didn't know there was a politically correct way to create a > > >BotMonster and rule the Internet by emminent domain. > > > > > >-M< > > > > > > Yeah, that's exactly what they're doing! It's a plot to TAKE OVER > > THE WORLD. You figured it out! > > > > It's about giving the spammers what they want: More > traffic to their > > websites. How can it be wrong when they send out 1 million emails > > that all say "click on this link" and 1 million computers actually > > click the link? Who's in the wrong there? > > > > Besides: "rule the Internet by emminent domain." Isn't' that > > Verisign's job? > > > > For all who are interested, the controller appears to live at > 230.136.241.83 That would be the in-addr folks. 83.241.136.230 -M<

1 0

RE: "Make love, not spam"....
by Hannigan, Martin 29 Nov '04

29 Nov '04

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] > Sent: Monday, November 29, 2004 12:45 PM > To: nanog(a)merit.edu > Subject: RE: "Make love, not spam".... > > > > > > -----Original Message----- > >> From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] > >> Sent: Monday, November 29, 2004 11:54 AM > >> To: nanog(a)merit.edu > >> Subject: RE: "Make love, not spam".... > >> > >> > >> > >[ SNIP ] > > > >> > >> The big difference between Lycos Europe, and a script kiddie with > >> zombies is that Lycos is mature enough to use restraint > and not knock > >> down websites with brute force. They're attempting to use the > >> politically correct "grown up" way to attack someone: economics. > > > >I didn't know there was a politically correct way to create a > >BotMonster and rule the Internet by emminent domain. > > > >-M< > > > Yeah, that's exactly what they're doing! It's a plot to TAKE OVER > THE WORLD. You figured it out! > > It's about giving the spammers what they want: More traffic to their > websites. How can it be wrong when they send out 1 million emails > that all say "click on this link" and 1 million computers actually > click the link? Who's in the wrong there? > > Besides: "rule the Internet by emminent domain." Isn't' that > Verisign's job? For all who are interested, the controller appears to live at 230.136.241.83 Interesting. I started it up and it immediately attacked Yahoo/Akamai: premium3.geo.yahoo.akadns.net Then it went and attacked a slew of other sites and had nothing but errors coming back. It also appears to attack sequentially from the top each time the dll loads. They've miscalculated the speed at which spammers relocate. RBL's aren't realtime. Spammers are near real time. <makeLOVEnotSPAM>(bhGBX5Und`p\|kr3<&D4=RfF#o:4F'^!?)TC:X@Sri)hm"tw!g;E6=uaKe .a*iNb</makeLOVEnotSPAM> </&D4=RfF#o:4F'^!?)TC:X@Sri)hm"tw!g;E6=uaKe.a*iNb</makeLOVEnotSPAM></makeLOV EnotSPAM>.<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <HTML><HEAD> <TITLE>403 Forbidden</TITLE> </HEAD><BODY> <H1>Forbidden</H1> You don't have permission to access / on this server.<P> </BODY></HTML> <makeLOVEnotSPAM>@1w0tu|aG/)*kzM*L"8xbj{GN<y/ZZA\5zg('PIM`6MD$+V&Ta8f"h M3lQvAWZ}iv</makeLOVEnotSPAM> </y/ZZA\5zg('PIM`6MD$+V&Ta8f"hM3lQvAWZ}iv</makeLOVEnotSPAM></makeLOVEnotSPAM >.<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <HTML><HEAD> <TITLE>501 Method Not Implemented</TITLE> </HEAD><BODY> <H1>Method Not Implemented</H1> <makeLOVEnotSPAM>@1w0tu|aG/)*kzM*L&quot;8xbj{GN<y/ZZA\5zg('PIM` 6MD$+V&Ta8f"hM3lQvAWZ}iv</makeLOVEnotSPAM> to / not supported.<P> Invalid method in request <makeLOVEnotSPAM>@1w0tu|aG/)*kzM*L&quot;8xbj{GN<y/ZZA\\5zg('PIM `6MD$+V&Ta8f\"hM3lQvAWZ}iv</makeLOVEnotSPAM><P> </BODY></HTML> > > -Jerry >

1 0

RE: "Make love, not spam"....
by Hannigan, Martin 29 Nov '04

29 Nov '04

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] > Sent: Monday, November 29, 2004 11:54 AM > To: nanog(a)merit.edu > Subject: RE: "Make love, not spam".... > > > [ SNIP ] > > The big difference between Lycos Europe, and a script kiddie with > zombies is that Lycos is mature enough to use restraint and not knock > down websites with brute force. They're attempting to use the > politically correct "grown up" way to attack someone: economics. I didn't know there was a politically correct way to create a BotMonster and rule the Internet by emminent domain. -M<

2 1

Re: who gets a /32 [Re: IPV6 renumbering painless?]
by Paul Vixie 29 Nov '04

29 Nov '04

> > i have long wished for and sometimes needed a way to renumber a host > > w/o killing or restarting its active tcp flows. this isn't a > > layering violation. tcp should be able to know about > > endpoint-renumber events. > > Unfortunately this sounds like a good target for people to mess up > implementations and introduce huge security issues into TCP > stacks. (along the theme of the one which started the recent MD5 > discussion) of course. and if endpoint-renumber were possible, it would also be used in load-balancing handoffs (similar to the thing that goes under the trade name "3TCP"), clustering, failover... plus things we havn't even thought of yet. of course there would be security problems, and just knowing the current sequence numbers wouldn't be enough proof, and there's an interesting question of whether both directions would have to renumber at the same time. this is a nec'y enabling technology for so many things that calling it a layering violation is "outrageous." > But obviously, implemeted properly that would be very useful. The > problem then becomes, how an ISP can signal a renumber. as it turns out, there is no silver bullet -- no single thing that if we could just to that then we'd be done, "roll credits." same thing for spam, as it turns out. it's going to take a lot of little things, which amounts to a lot of hard work by a lot of people, some of whom won't even know eachother or about eachother's work, to get "ipng" done. real time tcp session renumberability is on the list, but it's a big list. what i DON'T like is having the future of "ipng" decided in star chambers where things like A6/DNAME can be killed without transparency or accountability.

1 0

RE: "Make love, not spam"....
by Hannigan, Martin 29 Nov '04

29 Nov '04

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] > Sent: Monday, November 29, 2004 11:00 AM > To: nanog(a)nanog.org > Subject: Re: "Make love, not spam".... > > > > Rich Kulawiec <rsk(a)gsp.org> wrote: > > Already noted as unbelievably stupid and dissected on Spam-L, > > I'm inclined to agree... > > > but: getting into a bandwidth contest with spammers is a guaranteed > > loss, as they have an [essentially] infinite amount available to > > them for free. Apparently Lycos is unaware of zombies (including > > those hosting web sites), HTTP redirectors, rapidly-updating DNS, > > throwaway domains, and other facts of life in the spam sewer. > > ... but this screensaver means that Lycos *also* have a botnet > available to them. That means they are subject to the same sanctions as a botnet. This isn't a new issue to the operator community. We have a consistent opinion of this type of actvity going as far back as Green Card Lawyers and Sanford Wallace/Cyberpromo. The risks are too high for this to be anything but a publicity stunt. I can't read any German other than "bier". Is the utility up there? I'd love to take a look at it. -M<

1 0

FW: "Make love, not spam"....
by Miller, Mark 29 Nov '04

29 Nov '04

Scratch that... Yes, the A record. You are right. I need coffee or something... :-) -----Original Message----- From: Miller, Mark Sent: Monday, November 29, 2004 9:27 AM To: nanog(a)merit.edu Subject: RE: "Make love, not spam".... Not the A, the PTR... But yes, that could be a nasty retaliation by spammers with control of their DNS. I would hope, however, that the "screen saver's" target would be an IP address instead of a FQ mnemonic hostname. From the article, I understand that Lycos will be manually watching the list of targets and pushing updates to the users. Although I have traditionally been in favor of low bandwidth "fixes", this kind of appeals to my sense of poetic justice. -mark -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Mike Tancsa Sent: Monday, November 29, 2004 9:12 AM To: Suresh Ramasubramanian Cc: nanog(a)merit.edu Subject: Re: "Make love, not spam".... ... What about the case where the spammer gets black listed, traffic starts pounding the rouge site and then the spammer changes the A record to be www.example.com instead. Now all of a sudden www.example.com is being pounded by all those screen savers. ---Mike

1 0

Consortium sheds light on dark fiber's potential
by Vicky 29 Nov '04

29 Nov '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 http://www.eetimes.com/showArticle.jhtml?articleID=53700951 regards, /vicky -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBpMpOpbZvCIJx1bcRAqFmAJ96505uhm2Ipg//JLYktUm59adqsQCgi1Hh mnOxyvTt188SnRmHtU5sBo8= =cdob -----END PGP SIGNATURE-----

7 8