- Test - lists.nanog.org

Re: Spam with no purpose?
by Michael.Dillon＠radianz.com 01 Apr '04

01 Apr '04

>A message like this will usualy contain an html portion with an image in it >that is a single pixel in size, that is white-on-white. It doesn't show up >when you look at it, but it sends a request to the sender's specified >website to get the pixel, thus showing them which email accounts are active. What would happen if an ISP's mail server were to collect the URLs in emails and then retrieve the URL. Wouldn't this create a lot of false positives for the spammer thus screwing with their business model? And what if some scumsucking bottom feeder were to create a whole bunch of fake email addresses pointing at the servers of ISPs who do this. And then this evil waste-of-space no-buts were to sell that list to spammers for a good price based on the fact that these were all good active email addresses? Criminals victimizing other criminals... oh what a surprise! And what if ISPs would get together and share the IP addresses of these 1-pixel web servers via some type of real-time feed so that they could engage in cooperative blocking of validation traffic? Would they be helping the spamming criminals or would they be helping the scamming criminals or would they be good guys?

1 0

Doesn't appear to be a 'foolish' item..
by Robert Mathews 01 Apr '04

01 Apr '04

http://www.networksolutions.com/en_US/name-it/popup-100-yr-term.jhtml Robert. -------

1 0

Is your domain licensed?
by Stephen J. Wilcox 01 Apr '04

01 Apr '04

Old news in terms of the granting of a patent on subdomains.. new news (afaik) that theyve now started sending out letters telling folks they need to pay now for a license: http://www.theregister.co.uk/content/4/36707.html Patent: http://appft1.uspto.gov/netacgi/nph-Parser?Sect1=PTO2&Sect2=HITOFF&p=1&u=/n… So, does anything need doing or like New.net and SCO do we just need to laugh at the futility and stupidity of these people and get back to more boring things? Steve

1 0

RE: Spam with no purpose?
by Michel Py 01 Apr '04

01 Apr '04

>> Michel Py wrote: >> You can bet that it won't be long until we see such messages >> that not only use only dictionary words, but furthermore are >> constructed with a valid grammar (and still mean nothing). > William Leibzon wrote: > I already saw it. Right now its just random phrases being put > together and not yet entire text. And somewhere (actually > several years ago), I've read of AI program capable of creating > complete stories when its given some key phrases to start with, > would not be surprised if same or similar algorithms began to > be used. Mind forwarding a few? I believe that these are early probes though; no reason to kill the "bunch of dictionary words" technique too early. Michel.

1 0

RE: Spam with no purpose?
by Michel Py 01 Apr '04

01 Apr '04

>> Deepak Jain wrote: >> Can someone explain to me (publicly or privately) why someone >> would send spam with no product to sell, no position to pitch, >> nothing except text designed to get by a spam filter -- >> without even HTML to KNOW it got by a spam filter.. > Gregory Hicks wrote > It is a probe to verify the address. since it did not > bounce, the address is verified. Old-school; nowadays probes to measure the real bounce rate are real text, not just a bunch of words. I got one recently thanking me for a wonderful week-end... Michel.

1 0

MLPPP Follow Up - How we fixed the problem
by Richard J. Sears 01 Apr '04

01 Apr '04

I asked the group some time ago about some problems we were seeing with MLPPP on our Cisco 7513s. I have had 5 or 6 people contact me off list to ask how we solved the problem, so I figured I would post "our" solution to the group. I am sure there may be other fixes, however this works great for us and we have not had a problem in months since converting all MLPPP customers over. Basically we shut down MLPPP and went with (ip load-sharing per-packet) Here is what our config looks like: interface Serial1/0/0/13:0 description Customer #4144 (San Diego) #1 UPDATE [4144] ip address X.X.X.X 255.255.255.252 no ip directed-broadcast ip load-sharing per-packet ip route-cache distributed no cdp enable interface Serial2/1/0/14:0 description Customer #4144 (San Diego) #2 UPDATE [4144] ip address X.X.X.X 255.255.255.252 no ip directed-broadcast ip load-sharing per-packet ip route-cache distributed no cdp enable ip route X.X.X.X 255.255.255.252 Serial1/0/0/13:0 ip route X.X.X.X 255.255.255.252 Serial2/1/0/14:0 The only problem that we ran into was that we had to use the Serial designator of the interface in our route statement otherwise it will not work (or at least it did not for us). Since converting our customers (all MLPPP customers) to ip load-sharing per-packet - we have had no further problems. Hope this helps someone.... ****************************************** Richard J. Sears Vice President American Digital Network ---------------------------------------------------- rsears(a)adnc.com http://www.adnc.com ---------------------------------------------------- 858.576.4272 - Phone 858.427.2401 - Fax ---------------------------------------------------- I fly because it releases my mind from the tyranny of petty things . . "Work like you don't need the money, love like you've never been hurt and dance like you do when nobody's watching."

4 4

Re: Spam with no purpose?
by Gregory Hicks 01 Apr '04

01 Apr '04

> Date: Wed, 31 Mar 2004 22:18:03 -0500 > From: Deepak Jain <deepak(a)ai.net> > To: nanog(a)merit.edu > Subject: Spam with no purpose? > > > > Can someone explain to me (publicly or privately) why someone would send > spam with no product to sell, no position to pitch, nothing except text > designed to get by a spam filter -- without even HTML to KNOW it got by > a spam filter.. It is a probe to verify the address. since it did not bounce, the address is verified. Some spam filters filter out empty messages. The words avoid this. Regards, Gregory Hicks > > For example: > > From: Joe Legitimate <jlegit(a)university.edu> > To: Deepak Jain <deepak(a)ai.net> > Subject: [dictionary word] > > [dictionary word] [dictionary word] [dictionary word] [dictionary word] > [dictionary word] [dictionary word] [dictionary word] [dictionary word] > [dictionary word] [dictionary word] [dictionary word] [dictionary word] > [dictionary word] [dictionary word] [dictionary word] [dictionary word] > [dictionary word] [dictionary word] [dictionary word] [dictionary word] > > --- EOM --- > > I don't understand why one would waste the time, if its a test, why > would it get out in public? > > I would like to think I am being naive, but I just don't see the upside > unless it were particularly targeted at me or my mailserver to determine > our response or response time, etc. > > Thanks in advance, > > DJ > --------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer Cadence Design Systems | Direct: 408.576.3609 555 River Oaks Pkwy M/S 6B1 | Fax: 408.894.3479 San Jose, CA 95134 | Internet: ghicks(a)cadence.com I am perfectly capable of learning from my mistakes. I will surely learn a great deal today. "A democracy is a sheep and two wolves deciding on what to have for lunch. Freedom is a well armed sheep contesting the results of the decision." - Benjamin Franklin "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

1 0

SMTP behavior: 553 5.5.2 Bad command format(h)
by Miguel Mata-Cardona 31 Mar '04

31 Mar '04

WTF? can anyone please explain me why must I enclose my address between the "<>"? 220 cassiopeia.remeyewear.com ESMTP service helo me.intercom.com.sv 250 cassiopeia.remeyewear.com talking to ip168-243-227-1 .243.227.171]) mail from:postmaster@intercom.com.sv 553 5.5.2 Bad command format(h) mail from: postmaster(a)intercom.com.sv 553 5.5.2 Bad command format(h) mail from:<postmaster(a)intercom.com.sv> 250 OK - mail from <postmaster(a)intercom.com.sv> quit 221 cassiopeia.remeyewear.com connection Connection to host lost. -- Miguel Mata-Cardona Intercom El Salvador mmata(a)intercom.com.sv voz: ++(503) 278-5068 fax: ++(503) 265-7024

4 3

SWIP vs. RWHOIS
by Eric Krichbaum 31 Mar '04

31 Mar '04

Has anyone run into other providers that refuse to take RWHOIS information? As I understand the general goings on, ARIN just wants the information available so that we can generally contact the correct people to deal with issues as the arise. Now, I'm having an issue where verizon is telling a customer of mine that they can't use an assigned block because it isn't in SWIP form. And they're quoting back ARIN to us. " PLEASE DO NOT RESPOND TO THIS EMAIL ADDRESS. PLEASE USE THE business-support(a)verizon.com EMAIL ADDRESS for ALL correspondence While I understand your point, it is currently the Verizon policy to have the SWIP beforehand. It is possable to have the greater range with one name and the subdomain regestered to you. For example look at 162.84.100.160 on ARIN's site. Search results for: 162.84.100.160 Verizon Internet Services VIS-162-84 (NET-162-84-0-0-1) 162.84.0.0 - 162.84.255.255 Performance Group INC VZ-PRFMNCG-1 (NET-162-84-100-160-1) 162.84.100.160 - 162.84.100.191 # ARIN WHOIS database, last updated 2004-03-29 19:15 # Enter ? for additional hints on searching ARIN's WHOIS database. Also look at this link : http://www.arin.net/library/guidelines/swip.html If you have any questions, please contact the Network Support Center at 1.800.475.7840 Option 1, 1, 1 or e-mail business-support(a)verizon.com Regards Charles Leitner business-support(a)verizon.com Verizon Enterprise Customer Service 1.800.475.7840 Option 1, 1, 1 " Have they ignored: http://www.arin.net/tools/rwhois.html and the policy itself says "ISPs must provide reassignment information on the entire previously allocated block(s) via SWIP or RWhois server for /29 or larger blocks." Am I wrong for assuming that they are unreasonable in this? Eric Krichbaum Chief Engineer Citynet

1 0

DSL and/or Routing Problems
by Jon.Kibler＠aset.com 31 Mar '04

31 Mar '04

Greetings NANOGers, Yesterday we starting noticing long delays on an ADSL connection. I spent most of the day trying to track down the problem and getting no where. Telco says they do not detect any problem on the line... so I am kind of lost. Anyone here have any ideas? Here are the specifics: This connection uses a Cisco 827 ADSL router and has several static IPs. All IPs show identical delays. Using other circuits between the same two locations, we do not see any delays. Normally on this DSL connection, local can ping remote with packet transit times around 60-70ms. Here is what we are seeing now: # ping -s SOMEHOST 68 25; sleep 1; ping -s SOMEHOST 68 25 PING SOMEHOST: 68 data bytes 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=0. time=105. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=1. time=9132. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=2. time=8132. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=3. time=7132. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=4. time=6132. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=5. time=5133. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=6. time=4133. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=7. time=3133. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=8. time=2133. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=9. time=1133. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=10. time=133. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=11. time=104. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=12. time=110. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=13. time=109. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=14. time=112. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=15. time=106. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=16. time=114. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=17. time=107. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=18. time=109. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=19. time=106. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=20. time=112. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=21. time=106. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=22. time=108. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=23. time=106. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=24. time=110. ms ----SOMEHOST PING Statistics---- 25 packets transmitted, 25 packets received, 0% packet loss round-trip (ms) min/avg/max = 104/1918/9132 PING SOMEHOST: 68 data bytes 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=0. time=112. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=1. time=9131. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=2. time=8132. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=3. time=7132. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=4. time=6132. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=5. time=5132. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=6. time=4133. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=7. time=3132. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=8. time=2133. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=9. time=1133. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=10. time=133. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=11. time=111. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=12. time=106. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=13. time=109. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=14. time=116. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=15. time=108. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=16. time=107. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=17. time=113. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=18. time=106. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=19. time=107. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=20. time=108. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=21. time=108. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=22. time=105. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=23. time=109. ms 76 bytes from SOMEHOST (w.x.y.z): icmp_seq=24. time=106. ms ----SOMEHOST PING Statistics---- 25 packets transmitted, 25 packets received, 0% packet loss round-trip (ms) min/avg/max = 105/1918/9131 What really has me bugged is the pattern shown by the first dozen packets... why the relatively quick first time, followed by a long but decreasing delay which repeats every time you restart the ping (that's why I provided 2 samples)? Despite the fact that Telco says there are not any line problems, we are seeing a change in DSL performance compared to our benchmark. When we first started noticing the problem yesterday, both in and out connections were using the Fast path, but compared to the benchmark, the inbound speed had dropped to 576 and the Capacity had jumped to 99%, plus we had some RS and CRC errors on both in and out connections. Later in the day, the connection switched from using the Fast path to the Interleave path (we did nothing on our end to cause this to change) and the performance settled down to what is shown below under "DSL NOW." DSL BENCHMARK: ============== ATU-R (DS) ATU-C (US) Capacity Used: 72% 21% Interleave Fast Interleave Fast Speed (kbps): 0 960 0 256 Reed-Solomon EC: 0 0 0 0 CRC Errors: 0 0 0 0 Header Errors: 0 0 0 0 Bit Errors: 0 0 BER Valid sec: 0 0 BER Invalid sec: 0 0 DSL NOW: ======== ATU-R (DS) ATU-C (US) Capacity Used: 94% 63% Interleave Fast Interleave Fast Speed (kbps): 736 0 256 0 Reed-Solomon EC: 99 0 4 0 CRC Errors: 4 0 1 0 Header Errors: 3 0 0 0 Bit Errors: 0 0 BER Valid sec: 0 0 BER Invalid sec: 0 0 This leaves me with a few questions... 1) What exactly is the difference between the Fast and Interleave paths? 2) At the same data rates, should both Fast and Interleave show similar throughput? 3) What would cause a switch from Fast to Interleave to occur? 4) If the Telco cannot find any line problems, what can account for the increased capacity use, the decreased data rates, and the data errors? And the bottom line is: Why the bizarre ping times, and could the changes observed in DSL performance account for that... plus the near doubling of average ping transit times? TIA for everyone's expert thoughts on this problem! Jon R. Kibler A.S.E.T., Inc. Charleston, SC USA (843) 849-8214 ================================================== Filtered by: TRUSTEM.COM's Email Filtering Service http://www.trustem.com/ No Spam. No Viruses. Just Good Clean Email.

7 6