- Test - lists.nanog.org

Anti-spam System Idea
by Tim Thorpe 19 Feb '04

19 Feb '04

I wanted to run this past you to see what you thought of it and get some feedback on pro's and cons of this type of system. I have been thinking recently about the ever increasing amount of spam that is flooding the internet, clogging mail servers, and in general pissing us all off. I think it time to do something about it. very few systems are effective at blocking spam at the server level, and the ones that exist have a less then stellar reputation and are not very effective on top of that. 95% of spam comes through relays and its headers are forged tracking an E-mail back that you've received is becoming next to impossible, its also very time consuming and why waste your time on scumbags? my idea; a DC network that actively scans for active relays and tests them, it compiles a list on a daily basis of compromised IP addresses (or even addresses that are willingly allowing the relay) making this list freely available to ISPs via a secure and tracked site. to test a relay you actually have to send mail through it, I have a solution for this as well, the clients are set to e-mail a certain address that changes daily the E-mails are signed with a crypto key to verify authenticity (that way spammers can't abuse the address if it doesn't have the key, it get canned) work with ISP's to correct issues on their network help completely black list IP's from their network that are operating as an open relay and redirect to a page that alerts them of the compromise and solutions to fix the problem. the only way people are going to become aware of security issues such as this is if something happens that wakes them up, if they can't access a % of the web it would hopefully clue them in. because these scans only need to take place once per IP per day and over a large distribution of computers performing the tests, I don't see network load becoming a big issue, no bigger then it currently is. the only way to fight spammers is to squeeze them out of hiding, and that's what I hope this system would be designed to do. I do not have the coding knowledge to do this I will need coders, I do have the PR skills to work with ISPs. I am also working with my congresswoman to pave the way for legal clearance for this program. I would greatly appreciate your input on this and anything I may have overlooked. I would also like to know if this would be a DC program you would run. a lot of people argue the practical application of DC. although we know differently this project would show them what DC can do for them and wake them up to perhaps other DC projects.

36 65

80/udp floods?
by Scott Call 19 Feb '04

19 Feb '04

I apologize for the potentially obvious question, but I've been through sf, google, etc and can't find anything. I have a customer that is currently getting several hundred thousand packets per second sent to them on 80/udp. /etc/services lists 80/udp as IANA assigned for http but I've never seen a udp implementation of http so I'm assuming it's a sneaky DOS/DDOS of some kind. ACL's seem to work to catch it but I'm curious if anyone has seen this specific attack (80/udp) before. Thanks -Scott -- Scott Call Router Geek, ATGi, home of $6.95 Prime Rib I make the world a better place, I boycott Wal-Mart VoIP incoming: +1 360-382-1814

4 3

firstam.com contact
by Jonathan Nichols 19 Feb '04

19 Feb '04

Greetings, Could someone from First American get in touch with me off list? There seems to be a malfunctioning mail server in the firstam.com domain.. Thanks, Jonathan

1 0

Cogeco Cable listening?
by Christopher Chin 18 Feb '04

18 Feb '04

Howdy, If someone from Cogeco.net (AS7992) is onboard, please contact me off-list. Thanks, - Christopher ======================

1 0

Problems on ATDN this evening?
by Chris Horry 18 Feb '04

18 Feb '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Could a clueful person at ATDN (I've totally given up on Tech Support who seem to think it's an Internet Explorer issue...) tell me who I'm to call to get sensible technical support? :) I don't think this is an issue clearning my IE cache will resolve: Sample traceroute: traceroute to www.yahoo.akadns.net (216.109.118.67), 30 hops max, 38 byte packets: ~ 1 [censored] ~ 2 10.104.208.1 (10.104.208.1) 33.261 ms 19.641 ms 9.481 ms ~ 3 pos0-1.orldfldltn-rtr1.cfl.rr.com (24.95.226.113) 10.082 ms 7.719 ms 7.483 ms ~ 4 srp2-0.orldflwrpk-rtr2.cfl.rr.com (24.95.224.73) 17.200 ms 10.182 ms 12.921 ms ~ 5 srp4-0.orldfldvsn-rtr4.cfl.rr.com (24.95.224.10) 32.796 ms 21.182 ms 23.678 ms ~ 6 pop1-tby-P0-2.atdn.net (66.185.136.173) 17.532 ms 16.125 ms 17.136 ms ~ 7 bb1-tby-P0-2.atdn.net (66.185.136.164) 30.288 ms 14.761 ms 16.735 ms ~ 8 bb2-atm-P7-0.atdn.net (66.185.152.245) 46.710 ms 32.990 ms 32.029 ms ~ 9 pop1-atm-P4-1.atdn.net (66.185.150.3) 34.682 ms 34.601 ms 32.156 ms 10 CandW-atm.atdn.net (66.185.150.14) 563.166 ms 546.645 ms 533.035 ms 11 dcr1-so-4-3-0.Atlanta.cw.net (208.172.75.109) 554.113 ms 545.217 ms 560.184 ms . . . . . 17 p4.www.dcn.yahoo.com (216.109.118.67) 576.579 ms 528.573 ms 547.647 ms Apologies to the list if this is off topic. Chris - -- Chris Horry "Winter is the season in which people zerbey(a)wibble.co.uk try to keep the house as warm as it was PGP: DSA/2B4C654E it was in the summer, when they complained Amateur Radio: KG4TSM about the heat" --Author Unknown -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFAMrkYnAAeGCtMZU4RAlP2AJ9Qfps4HpsPAFmZVRuauS75Aa2fZwCeMI2I TZ+vJ/w404jwLAqL9IVzfew= =T8HW -----END PGP SIGNATURE-----

2 1

BGP - weight
by Sven Huster 18 Feb '04

18 Feb '04

Hello Dumb question: If I apply a equal weight to all our transit/peers, will that affect route announcements to iBGP or eBGP peers anyhow? We got a very simple setup: - 2 routers on the border to transit/peers (that's were i want to set the weight) - 1 edge router to customers - core router running BGP as well What I want to achieve is that traffic leaves through the border router it arrived, rather than have it bounced around. We had some recent issues were it looks like the core got "out of sync" with the border (looks more like a sw issue than just convergence delay) and packets bounced back and forth between them. I know this doesn't solve the cause but the before digging for the initial reason I want a quick workaround. Cheers Sven

4 10

Re: Clueless service restrictions (was RE: Anti-spam System Idea)
by Michael.Dillon＠radianz.com 18 Feb '04

18 Feb '04

> * No authentication scheme Bang on! > People do, however, use it because there >currently is no realistic widely deployed alternative available. Those >that are currently available (e.g. SPF) are not widely deployed, and >in any case are far from perfect. Whilst we have no hammer, people will >keep using the screwdriver to drive in nails, and who can blame them? Another way of saying this is that every ISP who operates an SMTP server on port 25 which is willing to accept incoming email from unauthenticated sources is guilty of destroying the end-to-end model of the Internet and pushing us to a centrally controlled model where ISPs run walled gardens. It's that simple. --Michael Dillon

1 0

Re: Open, anonymous services and dealing with abuse
by Michael.Dillon＠radianz.com 18 Feb '04

18 Feb '04

>Everybody thinks if its not us, we don't have problem so we dont want >to spend anything to fix it - bu its not true, you already are paying >for it due to increased cost of operation. The cost of fixing your own >network even 50% of other ISPs did it, would in the end be smaller. The cost of building a network is a step function. If you didn't have to provision the capacity to handle the traffic from spammers and DDoS attacks, then you could delay spending these significant chunks of money. In fact, I suspect that this was an important factor in killing off companies during the telecom collapse. These companies were driven to expand their networks faster than could be justified by the paying customers because of the large amount of traffic generated by non-paying customers. DDoS and spam have to be tackled in two different ways but both of these problems will not be solved until we address the roots of the issue and not the symptoms. In both cases, the root of the issue is that network operators are unable to cooperate effectively in tracking down network abuse. I know that a lot of people in the ISP industry have a basically anarcho-libertarian political viewpoint and that viewpoint has helped them make the right kind of decisions in building most of the technical architecture of the Internet. But this has also blinded people to the advantages of co-operative action. There is nothing wrong with network operators meeting together in a forum to jointly make decisions about best practices for running the Internet's email system or for tracking down the true sources of network abuse. This is basically the same kind of thing that the IETF does for network protocols and the MPLS forum and the ATM forum, etc. Once again, I call on the companies who participate in the various NANOG forums to get your email engineers and email architects and email managers all together in a single forum to hash out the issues. We have solutions, too many of them, but we cannot deploy these things succesfully without broad agreement. Remember what Tony Hain and Phil Karn have said about end-to-end. If you get a bunch of network engineers together and ask them to stop spam they will inevitably want to configure their routers which leads to filtering and ACLs. Anyone who believes that would be a mistake should be supporting the concept of an Internet Email Operators Forum because the people responsible for the application will be able to find a solution at the application layer. --Michael Dillon

1 0

RE: Clueless service restrictions (was RE: Anti-spam System Idea)
by Alex Bligh 18 Feb '04

18 Feb '04

Tony, --On 17 February 2004 17:27 -0800 Tony Hain <alh-ietf(a)tndh.net> wrote: > Clearly I misinterpreted your comments; sorry for reading other parts of > the thread into your intent. The bottom line is the lack of a -scalable- > trust infrastructure. You are arguing here that the technically inclined > could select from a list of partial trust options and achieve 'close > enough'. While that is true, Joe-sixpack wouldn't bother even if he could > figure out how. Whatever trust infrastructure that comes into existence > for the mass market has to appear to be seamless, even if it is > technically constructed from multiple parts. What I am thinking of takes the policy decision at the "end" MTA level, i.e. the MTA closest to the user receiving the mail. That could be a techy user on a DSL line. In the case of Joe-Sixpack, it would be whoever runs POP/IMAP for him. If he runs an MTA without any of this stuff, he is left where he is now (i.e. gets all mail). > Steve Bellovin suggested earlier that identity based approaches wouldn't > work. While I agree having the identity won't solve the problems by > itself, it does provide a key that the rest of the legal system can start > to work with. False identities are common in the real world, so their > existence in the electronic world is not really any different. I am not sure you need to go as far as verifiable individual identities for each sender/user; however, you may need to go as far as being able to verify identities of MTAs - at least the first one that claims "I have received this from someone for whom I am prepared to deal with the abuse consequences". > I guess I > am looking at this from the opposite side the two of you appear to be, > rather than requiring authorization to send, irrefutable identity should > be used to deny receipt after proven abuse. I am using authorization to permit/deny *receipt* (not sending). Clearly if enough people deny unauthenticated receipt then in practice it does imply one needs to authenticate sending. Whether you deny receipt after proven abuse, or only accept receipt on proven identity is just a policy decision in the hands of the mail-system-admin as to what they do with the "don't know" case. I think this is getting (further) OT for NANOG & I should just write something up. Alex

1 0

Re: Stopping open proxies and open relays
by Dr. Jeffrey Race 18 Feb '04

18 Feb '04

On Fri, 6 Feb 2004 22:43:39 -0600 (CST), Adi Linden wrote: >I am looking for ideas to stop the spam created by compromised Windows >PC's. This is not about the various worms and viruses replicating but >these boxes acting as open relays or open proxies. > >There are valid reasons not to run antivirus software, coupled with >clueless users, this results in machines that SPAM again just a few hours >after having been cleaned. First step is correctly to specify the system's properties. Yours is not a technical issue but one of user negligence. You have to build the solution around this fact. Curative measures that have worked elsewhere are: 1-Scan every client when it accesses 2-Disconnect compromised clients or route only to a warning page allowing access only to your tech support 3-First cleanup and advice to owner of compromised machine on how to be a good internet member is free; second costs $100; third results in permanent discontinuance of service and refusal to accept back as a client. These measures will fix your problem. Jeffrey Race

2 1