- Test - lists.nanog.org

RE: Unplugging spamming PCs
by Larry Pingree 24 Jun '04

24 Jun '04

Hi Peter, I agree with you it's a hard problem to solve. But unless there is mandatory cooperation within mail server software (which can be monitored) to interface with a registry of acceptable/registered sites, then this model could work. Is it perfect, no. And so far, I've not seen any technology that will solve this problem. So I default and say it's a problem that must be solved with agreements between countries that can provide registries that all (valid) mail servers must register. Then at least our spammer enforcement is dwindled down to those who go through some sort of process, that can be validated physically, i.e. Address, Company name, etc, etc... And then enforcement can be done only to those who misbehave that are validated and authenticated. Can you suggest another method that would have more accuracy? I think it's ridiculous that every service on the internet is provided without any authentication and integrity services, if we allowed anyone to call from anywhere within the telephone network, you'd have rampant falsification, which is what we have today. LP Best Regards, Larry Larry Pingree "Visionary people, are visionary, partly because of the great many things they never get to see." - Larry Pingree -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Peter Corlett Sent: Wednesday, June 23, 2004 4:11 PM To: nanog(a)nanog.org Subject: Re: Unplugging spamming PCs Larry Pingree <lpingree(a)juniper.net> wrote: > Mail servers should be registered just like domains and shutdown by > a registrar if they are misusing their registered services. This > really needs to be handled by a multi-lateral legal solution, > industry will not fix it alone. Yes, that's just what we need. More unworkable legislation that nobody'll bother to enforce in the intended manner anyway. It's not as if many of the things one has to do to spam effectively isn't already good for a few years behind bars, yet I don't exactly see prisons bulging with spammers. Let's suppose mail servers are registered like domains. What mechanism is there going to be in place to shut down the mail server if it starts misbehaving? Sending in the Marines? And again, much of this comes down to enforcement. When was the last time you heard of a spammer's domain being pulled? How about the last time you saw a spammer be even remotely bothered by having their domain pulled? Do you think they'll really care less about losing a mail server when they've got another dozen lined up ready and waiting? -- PGP key ID E85DC776 - finger abuse(a)mooli.org.uk for full key

3 2

whois.arin.net dead again
by Jon Lewis 24 Jun '04

24 Jun '04

What's going on? whois.arin.net is not accepting connections and the whois search via www.arin.net is dead again. ---------------------------------------------------------------------- Jon Lewis | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

2 1

Re: Attn MCI/UUNet - Massive abuse from your network
by Christopher L. Morrow 24 Jun '04

24 Jun '04

On Tue, 22 Jun 2004, Myke Place wrote: > Can you then explain why there are 189 Spamhaus complaint against > UUnet/MCI which haven't been dealt with? I answered ben already (a few minutes ago) but I'll answer you as well. I said I'd look into the listings and see what's known or being done about them.

1 0

Re: Attn MCI/UUNet - Massive abuse from your network
by Ben Browning 23 Jun '04

23 Jun '04

At 10:45 PM 6/22/2004, Tim Thorne wrote: >Not so long ago I took a long look at the SBL for MCI and I came to >the conclusion that the data is mostly out of date and therefore >inaccurate. The folks at the SBL posting in NANAE said this may be the >case, but its up to the MCI folks to clean up the SBL database. MCI does not want to "legitimize" blacklists by helping clean up their own records. Any company or network that afraid of accountability obviously must have its reasons. I am sure they have seen the many many times some provider has said "We removed Spammer A" and the antispam community has responded with "Great, how about spammers B through Z?". That's a question they don't and won't answer beyond the token "Email to abuse@ does get read". Maybe it does- I am not MCI, so I don't know. Regardless of whether the mail does get read, the spammers remain connected. Why? One can only come to the conclusion that it is either due to technical ineptitude or protection of their revenue stream. Likewise, they have no doubt noticed that providers that lie about canning spammers are quickly outed, and their blocklist listings(and no doubt private firewall rules, which are much harder to escape) tend to expand greatly. So, MCI has (correctly) identified that their options as A) clean up their network B) try to lie or C) do nothing. Given that A involves loss of revenue and a (short term) increase in labor and B will cause them even more problems, C is their obvious recourse. > >As an example, I see a posting that says emailtools.com was alive on > >206.67.63.41 in 2000. They aren't there any more... But now: > >Emailtools.com aren't spammers, but they sell spamware. That subtle >difference is enough to keep them on the MCI network. This may be true, but Atriks is still there, and they are one of the most technically malicious spammers in the game today. Spam support is spam support, whether you are hosting the website, DNS, proxy mining operation, or a drop-box. Any provider that is OK with hosting software that does this: "Email Marketing 98 is our high-end email marketing tool. It is one of the best extractors on the market while remaining price competitive. At the push of a button, Email Marketing 98 will retrieve Email addresses of all the posters on an Internet news group or a series of groups. Then it will send your Email message to any or all of those addresses." may as well be sending the spam themselves, IMO. >If you want rid >of sites like this that are based in Florida, then you best get >Florida to change their laws. Wouldn't *that* be lovely. --- Ben Browning <benb(a)theriver.com> The River Internet Access Co. WA Operations Manager 1-877-88-RIVER http://www.theriver.com

1 0

Unplugging spamming PCs
by Hank Nussbacher 23 Jun '04

23 Jun '04

http://www.cnn.com/2004/TECH/internet/06/22/tech.spam.reut/index.html "Consumers who allow their infected computers to send out millions of "spam" messages could be unplugged from the Internet under a proposal released Tuesday by six large e-mail providers." -Hank

8 8

re: Enterasys Matrix Switching Product
by Wayne Chow 23 Jun '04

23 Jun '04

Hi all, Anyone had any positive/negative experience with the Enterasys switching products, especially the Matrix E1/N7? How is their reliability and service support? Any thoughts and comments would be greatly appreciated. Thanks Wayne Chow Network Administrator Faculty of Dentistry, University of Toronto 124 Edward Street, Suite 458 Toronto, Ontario M5G 1G6 (416) 979-4900 Ext. 4620 (416) 979-4936 Fax

1 0

RE: Can a customer take IP's with them?
by Chris Ranch 23 Jun '04

23 Jun '04

Hello Alex, > > In other words, customer is asking a court to rule whether > > or not IP space should be portable, when an industry- > > supported organization (ARIN) has made policy that the > > space is in fact not portable. It can be further argued that > > the court could impose a TRO that would potentially negatively > > affect the operation of my network. > > A court will likely decide this based upon the terms of > your contract and what the court thinks is fair. They will > likely give very little consideration to common practice or > ARIN's rules. That's the crux of the biscuit. Your case depends on whether you provided for this in your contract with the customer. If its missing, you have a big challenge on your hands. No RFC or ARIN policy is a binding legal document. If its there, your chances are much better. So, do you discuss non-portable address space assignment in your contract? Where was this case filed? NJ or federal court? Do let us know how it turns out. This will establish a key legal precedent. Chris

3 2

RE: Can a customer take IP's with them?
by Chris Ranch 23 Jun '04

23 Jun '04

Sorry about the html. ^%$%&*.! -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Chris Ranch Sent: Wednesday, June 23, 2004 10:12 AM To: 'alex(a)nac.net' Cc: nanog(a)nanog.org Subject: RE: Can a customer take IP's with them? Hello Alex, > > In other words, customer is asking a court to rule whether > > or not IP space should be portable, when an industry- > > supported organization (ARIN) has made policy that the > > space is in fact not portable. It can be further argued that > > the court could impose a TRO that would potentially negatively > > affect the operation of my network. > > A court will likely decide this based upon the terms of > your contract and what the court thinks is fair. They will > likely give very little consideration to common practice or > ARIN's rules. That's the crux of the biscuit. Your case depends on whether you provided for this in your contract with the customer. If its missing, you have a big challenge on your hands. No RFC or ARIN policy is a binding legal document. If its there, your chances are much better. So, do you discuss non-portable address space assignment in your contract? Where was this case filed? NJ or federal court? Do let us know how it turns out. This will establish a key legal precedent. Chris

1 0

new operationally relevant papers from caida
by k claffy 23 Jun '04

23 Jun '04

CAIDA/UCSD: "Building a Better Netflow" http://www.caida.org/outreach/papers/2004/betternetflow/ to be presented at Sigcomm 2004 http://www.acm.org/sigs/sigcomm/sigcomm2004/ (we can write the papers, but you customers have to insist on vendors improving measurement. pass on the word if not the pdf file along w your zillion dollar purchase order. :) ) MeasurementFactory/CAIDA (Duane Wessels): "Is Your Caching Resolver Polluting the Internet?" http://www.caida.org/outreach/papers/2004/dns-pollution/ to be presented at Sigcomm 2004 troubleshooting workshop: http://www.acm.org/sigs/sigcomm/sigcomm2004/netts.html WIDE/CAIDA: "Identifying IPv6 Network Problems in the Dual-Stack World" [URL up at http://www.caida.org/outreach/papers/ in a few days, same workshop as above] [a workshop i reckon thoughtful NANOGers might enjoy attending as well as offer mutually valuable insights to other attendees; papers will be posted there eventually courtesy ACM] see http://www.acm.org/sigs/sigcomm/sigcomm2004/workshops.html for other sigcomm workshops you might find an interesting source as well as destination of insights. less operationally relevant, but for those who care about what's afoot at CAIDA: ----- Forwarded message from k claffy <kc(a)caida.org> ----- Date: Wed, 23 Jun 2004 07:56:40 -0700 From: k claffy <kc(a)caida.org> Subject: recent Internet topology, passive, and telescope data sets available To: caida(a)caida.org some of these have been up for a while, others new, but we're starting to catalog them all in a more usable way thanks to project funding from the National Science Foundation (your US tax dollars at work) http://www.caida.org/projects/trends/data/ so far includes comprehensive topology data sets, including AS and router adjacency matrices, passive traces (under various levels of AUP), network telescope data, and some other data sets provided in conjunction with valiant collaborating organizations. there are also links to pages that give more detail about the project. please contact me if you're interested in contributing data sets; we plan to have a prototype of the community data catalog by the end of this summer. k ----- End forwarded message ----- k

1 0

"Sizing router buffers" paper
by Mikael Abrahamsson 23 Jun '04

23 Jun '04

http://yuba.stanford.edu/~appenz/pubs/sigcomm-extended.pdf Anyone care to comment on this paper? I find that it confirms my beliefs and gut feeling I have had since 2000 or so, and my real life experiences with L3 switches with just a few ms of packet buffer. -- Mikael Abrahamsson email: swmike(a)swm.pp.se

2 1