- Test - lists.nanog.org

RE: Out of office/vacation messages
by McBurnett, Jim 02 Jan '04

02 Jan '04

->Must really suck to put ALL those rules on and take them off ->every time you go ->on vacation. (Yes, I'm on at least 65 mailing lists - and ->that's just the ones ->high-volume enough to warrant filtering to their own folder). -> And even if you're ->on only 4 or 5 lists, that's enough work to mean it's likely ->you'll forget one. No, you setup the rules once and then turn on the OoO when necessary.. I have 40 or so rules.. and they are relatively easy.. -> ->Hardly a selling point for your choice of software. Unless ->it's a disguised ->"My management makes me use software so broken I have to...." story? I seem remember a conversation about a "big" business standard would not be a "big" business standard without good reason...... <ALMOST PUT AN EMOTICON>

2 1

RE: Out of office/vacation messages
by McBurnett, Jim 02 Jan '04

02 Jan '04

Microsoft Mail server is configureable so as not to send the out of office emails out to the internet for the entire server.. This is an ADMIN config.. ALSO if a user goes to the out of office attendent in Outlook, they has the option of creating rules.. RULE #1: If from owner-nanog(a)merit.edu Move the email to "NANOG EMAILS WHILE I WAS OUT SO I DON'T GET FLAMED FOLDER." Stop Processing more rules Rule # 2: Reply to Jerry WITH "I am taking 6 Month leave of ABSENSE to learn how to wear asbestos underwear" Stop Preccessing more rules.... Rule # 3: everyone else THERE that should settle it.. THIS WORKS I USE IT! Enough already folks! If anyone using exchange out there wants some nice screen shots, drop me a line, off list please, I will create it and send it to all at once via a BCC so no one needs to know who you are. Later, Jim ->-----Original Message----- ->From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of ->Valdis.Kletnieks(a)vt.edu ->Sent: Friday, January 02, 2004 1:32 PM ->To: Rachel K. Warren ->Cc: nanog(a)merit.edu ->Subject: Re: Out of office/vacation messages -> -> ->On Fri, 02 Jan 2004 10:13:28 PST, "Rachel K. Warren" -><rachel(a)plur.net> said: -> ->> Sometimes you have no choice but to run a Windows mail ->client - it's called ->> your company forcing you to a standard mailer. It's not ->something I have ->> liked doing in the past, but having your management heavily ->disaprove of ->> using something outside of standard is usually not a good thing. -> ->Wave the "security issue" flag at them on this one. There's ->a number of good ->security reasons to not use software that blabs in response ->to mailing list mail: -> ->1) If this is a reply to a message from a mailing list that ->you usually "lurk" ->on, your subscription to the list has just been revealed ->(probably to every ->person who is posting - possibly to the entire list if your ->responder replied ->to the list). -> ->2) The fact you are "Out of your office" could reveal ->information to a hacker. -> ->2a) The hacker now knows that you aren't watching your PC ->very carefully, and ->thus it's possibly a better target for a hacking attempt. -> ->2b) If the hacker has gotten a message "George Smith is at a ->client site until ->Aug 30", he can try calling your company and saying "This is ->George.. I'm at ->the client's site, and I can't get to the corporate net. Can ->you reset my ->password so I can get the documents I need to close this ->deal?". This is an ->amazingly effective "social engineering" attack. -> ->2c) The software most responsible for these errant messages ->is also well-known ->for multiple security issues - and quite often even puts its ->exact version in ->the X-Mailer header. This allows an attacker to send you a ->malicious e-mail ->message (specially selected for your software version), for ->you to read when ->you get back (and are probably buried under many messages and ->not paying as ->much attention to the contents as you should). -> ->If that doesn't work, point the PHB at this: -> ->http://news.bbc.co.uk/1/hi/technology/3290251.stm -> ->Only 2 out of the top 10 viruses/worms for last year did ->*NOT* target Outlook. -> ->Then ask the PHB if they have any legal criterion of "due ->care" that would put ->them at risk of being negligent for continuing to run their ->business in a known ->dangerous manner. -> ->

2 1

Packet-based multi-service provisioning platforms [MSPP]
by Henry Linneweh 02 Jan '04

02 Jan '04

I am interested in problems in this area and what nanog members are part of this emerging market and are generating a profit..... -Henry

1 0

The Cidr Report
by cidr-report＠potaroo.net 02 Jan '04

02 Jan '04

This report has been generated at Fri Jan 2 21:47:21 2004 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 26-12-03 129101 90485 27-12-03 129152 90411 28-12-03 128993 90454 29-12-03 129056 90534 30-12-03 129312 90459 31-12-03 129124 90575 01-01-04 129207 90551 02-01-04 129307 90461 AS Summary 16314 Number of ASes in routing system 6526 Number of ASes announcing only one prefix 1395 Largest number of prefixes announced by an AS AS7018 : ATT-INTERNET4 AT&T WorldNet Services 73402112 Largest address span announced by an AS (/32s) AS568 : SUMNET-AS DISO-UNRRA Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 02Jan04 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 129175 90402 38773 30.0% All ASes AS4134 709 124 585 82.5% CHINANET-BACKBONE No.31,Jin-rong Street AS6197 823 296 527 64.0% BATI-ATL BellSouth Network Solutions, Inc AS4323 675 204 471 69.8% TW-COMM Time Warner Communications, Inc. AS7018 1395 960 435 31.2% ATT-INTERNET4 AT&T WorldNet Services AS701 1386 955 431 31.1% ALTERNET-AS UUNET Technologies, Inc. AS7843 508 117 391 77.0% ADELPHIA-AS Adelphia Corp. AS6198 569 228 341 59.9% BATI-MIA BellSouth Network Solutions, Inc AS22909 320 13 307 95.9% DNEO-OSP1 Comcast Cable Communications, Inc. AS27364 381 81 300 78.7% ACS-INTERNET Armstrong Cable Services AS22773 327 31 296 90.5% CCINET-2 Cox Communications Inc. Atlanta AS1239 957 669 288 30.1% SPRINTLINK Sprint AS4355 380 101 279 73.4% ERMS-EARTHLNK EARTHLINK, INC AS1221 912 657 255 28.0% ASN-TELSTRA Telstra Pty Ltd AS17676 290 42 248 85.5% GIGAINFRA Softbank BB Corp. AS6347 325 83 242 74.5% DIAMOND SAVVIS Communications Corporation AS25844 243 16 227 93.4% SKADDEN1 Skadden, Arps, Slate, Meagher & Flom LLP AS9583 273 55 218 79.9% SATYAMNET-AS Satyam Infoway Ltd., AS209 730 515 215 29.5% ASN-QWEST Qwest AS6140 351 136 215 61.3% IMPSAT-USA ImpSat AS14654 206 3 203 98.5% WAYPORT Wayport AS11305 231 38 193 83.5% INTERLAND-NET1 Interland Incorporated AS4519 194 13 181 93.3% MAAS Maas Communications AS6478 218 41 177 81.2% ATT-INTERNET3 AT&T WorldNet Services AS9929 204 27 177 86.8% CNCNET-CN China Netcom Corp. AS6327 204 28 176 86.3% SHAW Shaw Communications Inc. AS2386 408 239 169 41.4% INS-AS AT&T Data Communications Services AS20115 581 414 167 28.7% CHARTER-NET-HKY-NC Charter Communications AS15270 204 41 163 79.9% AS-PAETEC-NET PaeTec.net -a division of PaeTecCommunications, Inc. AS2048 245 83 162 66.1% LANET-1 State of Louisiana AS4766 389 234 155 39.8% KIX Korea Internet Exchange for "96 World Internet Exposition Total 14638 6444 8194 56.0% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 ANDARA-HSI Andara High Speed Internet c/o Halifax Cable Ltd. 61.12.32.0/24 AS7545 TPG-INTERNET-AP TPG Internet Pty Ltd 61.12.34.0/24 AS7545 TPG-INTERNET-AP TPG Internet Pty Ltd 64.62.64.0/24 AS3549 GBLX Global Crossing 64.62.126.0/23 AS25700 SWIFTDESK SWIFTDESK VENTURE 66.41.192.0/18 AS13367 CCCH-AS3 Comcast Cable Communications Holdings, Inc 69.8.128.0/17 AS7260 NORLIGHT Norlight Telecommunications 132.0.0.0/10 AS568 SUMNET-AS DISO-UNRRA 137.0.0.0/13 AS568 SUMNET-AS DISO-UNRRA 138.136.0.0/13 AS568 SUMNET-AS DISO-UNRRA 140.143.2.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 158.0.0.0/13 AS568 SUMNET-AS DISO-UNRRA 192.43.230.0/24 AS4738 SAARDNET-AS South Australian Academic Research and Development Network 192.44.0.0/19 AS702 AS702 MCI EMEA 192.64.84.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.16.0/20 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.32.0/19 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.64.0/19 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.96.0/22 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.100.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.119.135.0/24 AS270 PSCNI-AS National Aeronautics and Space Administration 192.124.252.0/22 AS680 AS680 DFN-IP service G-WiN 192.135.50.0/24 AS7018 ATT-INTERNET4 AT&T WorldNet Services 192.136.71.0/24 AS719 AS719 LANLINK autonomous system 192.136.79.0/24 AS719 AS719 LANLINK autonomous system 192.153.144.0/21 AS568 SUMNET-AS DISO-UNRRA 192.172.0.0/19 AS568 SUMNET-AS DISO-UNRRA 192.188.208.0/20 AS568 SUMNET-AS DISO-UNRRA 192.243.32.0/23 AS2044 PALIN-AS Palin Aquisitions Inc. 198.23.26.0/24 AS4390 BELLATLANTIC-COM Bell Atlantic, Inc. 198.41.194.0/24 AS1982 ASN-NWNEXUS Northwest Nexus Inc. 198.97.72.0/21 AS568 SUMNET-AS DISO-UNRRA 198.97.80.0/20 AS568 SUMNET-AS DISO-UNRRA 198.97.88.0/24 AS89 NUSC-CSTLNET-AS Naval Underwater Systems Center 198.97.192.0/20 AS568 SUMNET-AS DISO-UNRRA 198.97.240.0/20 AS568 SUMNET-AS DISO-UNRRA 198.101.4.0/22 AS568 SUMNET-AS DISO-UNRRA 198.136.32.0/20 AS19329 MCNET Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY-NET CityNet, Inc. 198.161.87.0/24 AS6539 GROUPTLCOM GT Group Telecom Services Corp. 198.161.165.0/24 AS852 ASN852 Telus Advanced Communications 198.163.155.0/24 AS684 MBNET-AS Manitoba Regional Network 198.167.0.0/16 AS7456 INTERHOP Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ALLST-15290 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASKTEL SaskTel 198.232.133.0/24 AS23075 SKOTOS-AS Skotos Tech, Inc 199.10.0.0/16 AS568 SUMNET-AS DISO-UNRRA 199.60.0.0/20 AS271 BCNET-AS University of British Columbia 199.84.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 199.114.0.0/18 AS568 SUMNET-AS DISO-UNRRA 199.114.0.0/21 AS568 SUMNET-AS DISO-UNRRA 199.114.128.0/18 AS568 SUMNET-AS DISO-UNRRA 199.114.130.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.132.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.136.0/24 AS1913 DLA4 Defense Logistics Agency 199.114.138.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.140.0/24 AS3544 ITSDN-U7 DISA/UNRRA 199.114.142.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.144.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.148.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.150.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.152.0/24 AS1913 DLA4 Defense Logistics Agency 199.114.154.0/24 AS1733 CENTAF-SWA AF DDN PMO 199.114.156.0/24 AS1913 DLA4 Defense Logistics Agency 199.114.160.0/24 AS1733 CENTAF-SWA AF DDN PMO 199.120.32.0/19 AS16582 NEXTLEVELINTERNET NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS568 SUMNET-AS DISO-UNRRA 199.123.0.0/18 AS568 SUMNET-AS DISO-UNRRA 199.123.16.0/20 AS568 SUMNET-AS DISO-UNRRA 199.123.80.0/21 AS568 SUMNET-AS DISO-UNRRA 199.189.32.0/19 AS7332 IQUEST-AS IQuest Internet 199.202.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 200.120.0.0/16 AS22047 CL-VPNS-LACNIC VTR BANDA ANCHA S.A. 202.0.180.0/24 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.4.252.0/22 AS4808 CHINA169-BJ CNCGROUP IP network¡ªChina169 Beijing Province Network 202.4.255.0/24 AS4799 UNSPECIFIED Ji Tong Communications Co., Ltd. 202.70.240.0/20 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.72.112.0/22 AS22351 INTELSAT-1 INTELSAT 202.122.76.0/24 AS17553 TIMELESS-AP System Integration provider 202.136.254.0/24 AS4808 CHINA169-BJ CNCGROUP IP network¡ªChina169 Beijing Province Network 202.136.255.0/24 AS4808 CHINA169-BJ CNCGROUP IP network¡ªChina169 Beijing Province Network 203.32.4.0/23 AS7617 APNIC-AS-2-BLOCK Asia Pacific Network Information Centre 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.76.128.0/24 AS9729 IS-AP iAdvantage Limited 203.76.224.0/24 AS9549 COMDEK-ISP-AS-AP Comdek ISP 203.86.2.0/23 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 203.132.95.0/24 AS9787 CONCEPT-AU-AP Concept Networks 203.132.97.0/24 AS7652 VIANET-AS-AP Vianet Communications Pty Ltd 203.132.107.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.108.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.109.0/24 AS10141 CALOUNDRA-AS-AP Caloundra.net 203.132.111.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.112.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.118.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.122.0/24 AS4802 WANTREE-AS-AP Wantree Development 203.132.123.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.124.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.125.0/24 AS4817 TECHEX1-AS-AP Techex Primary Netblock 203.135.99.0/24 AS2687 IBM-MMD-AS IBM 204.19.224.0/19 AS816 UUNET-AS4 UUNET Technologies, Inc. 204.69.144.0/22 AS5668 AS-5668 CenturyTel Internet Holdings, Inc. 204.154.125.0/24 AS3952 TELLABS-ASN TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLABS-ASN TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLABS-ASN TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBIT 205.150.0.0/15 AS701 ALTERNET-AS UUNET Technologies, Inc. 206.41.32.0/19 AS14824 NEWSOUTH NewSouth Communications Corp. 206.81.187.0/24 AS19194 JOVITA Sentris Network LLC 206.108.34.0/24 AS852 ASN852 Telus Advanced Communications 206.108.35.0/24 AS852 ASN852 Telus Advanced Communications 206.167.57.0/24 AS376 RISQ-AS Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ALLST-15290 Allstream Corp. Corporation Allstream 206.251.69.0/24 AS27429 TIL Telesat International Ltd. 207.47.39.0/24 AS816 UUNET-AS4 UUNET Technologies, Inc. 207.162.192.0/19 AS4589 EASYNET Easynet Group Plc 207.231.96.0/19 AS11194 NUNETPA NuNet Inc 208.81.187.0/24 AS19194 JOVITA Sentris Network LLC 209.169.219.0/24 AS189 GENUITY-AS189 Genuity 209.169.223.0/24 AS189 GENUITY-AS189 Genuity 209.172.0.0/18 AS7770 TRITON Triton Technologies, Inc. 209.196.192.0/19 AS1784 GNAPS Global NAPs Networks 209.213.32.0/19 AS10629 INTERPAC Inter-Pacific Network Services 209.213.50.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.51.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.55.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.56.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.222.137.0/24 AS27429 TIL Telesat International Ltd. 209.240.96.0/19 AS10815 KCNET KCnet, Inc. 209.251.0.0/19 AS11036 SISCOM SISCOM, Inc 209.251.64.0/19 AS10266 NETWAY-AS MDC, Inc. 210.213.0.0/19 AS6453 GIEUROPE Teleglobe America Inc. 216.18.224.0/21 AS11458 IMBRIS IMBRIS, INC. 216.18.224.0/22 AS11458 IMBRIS IMBRIS, INC. 216.18.228.0/22 AS11458 IMBRIS IMBRIS, INC. 216.36.46.0/24 AS7176 GENUITY-AS7176 Genuity 216.36.47.0/24 AS7176 GENUITY-AS7176 Genuity 216.96.128.0/18 AS7018 ATT-INTERNET4 AT&T WorldNet Services 220.228.0.0/16 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.228.0.0/17 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.228.0.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.228.32.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.228.64.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.228.96.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.228.128.0/17 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.228.128.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.228.160.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.228.192.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.228.224.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.229.0.0/16 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.229.0.0/17 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.229.0.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.229.32.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.229.64.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.229.96.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.229.128.0/17 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.229.128.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.229.160.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.229.192.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.229.224.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

Re: any bellsouth admins around?
by mduckett＠bellsouth.net 31 Dec '03

31 Dec '03

Working to get you a contact. Stand by. > > From: Mark Jeftovic <markjr(a)easydns.com> > Date: 2003/12/31 Wed PM 07:37:59 GMT > To: nanog(a)merit.edu > Subject: any bellsouth admins around? > > > > Any bellsouth admins around? > > This would suck if it kept up over the holiday... > > -mark > > -- > Mark Jeftovic <markjr(a)easydns.com> > Co-founder, easyDNS Technologies Inc. > ph. +1-(416)-535-8672 ext 225 > fx. +1-(416)-535-0237 > > ---------- Forwarded message ---------- > Date: Wed, 31 Dec 2003 14:19:24 -0500 (EST) > From: Simon Carr <scarr(a)easydns.com> > To: abuse(a)bellsouth.net > Subject: Abuse: Getting hammered with forged addresses. > > Hey there, > > We seem to be getting hammered with forged addresses from several > bellsouth IPs on the 205.152.59.0/24 netblock. Please try to take action > agains this immediately as it is causing severe load on our SMTP cluster. > > Dec 31 13:27:25 10.0.2.44 postfix/smtpd[4221]: 13EEC4F3B3: > client=imf16aec.mail.bellsouth.net[205.152.59.64] > Dec 31 13:27:39 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from > imf16aec.mail.bellsouth.net[205.152.59.64]: 450 > <federicohooperfk(a)syselog.fr>: Sender address rejected: Domain not found; > from=<federicohooperfk(a)syselog.fr> to=<dmeans(a)the-means.net> > Dec 31 13:28:15 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from > imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <sritteron(a)ipcc.ch>: > Sender address rejected: Domain not found; from=<sritteron(a)ipcc.ch> > to=<dmeans(a)the-means.net> > Dec 31 13:28:23 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from > imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <deghejmfp(a)genie.com>: > Sender address rejected: Domain not found; from=<deghejmfp(a)genie.com> > to=<dmeans(a)the-means.net> > Dec 31 13:28:35 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from > imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <jim223bfovl(a)home.com>: > Sender address rejected: Domain not found; from=<jim223bfovl(a)home.com> > to=<dmeans(a)the-means.net> > Dec 31 13:28:41 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from > imf16aec.mail.bellsouth.net[205.152.59.64]: 450 > <K3TF72Ml1morientesedXqv0Cdr(a)freeserve.net>: Sender address rejected: > Domain not found; from=<K3TF72Ml1morientesedXqv0Cdr(a)freeserve.net> > to=<dmeans(a)the-means.net> > Dec 31 13:28:49 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from > imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <MGgcVpy(a)home.com>: Sender > address rejected: Domain not found; from=<MGgcVpy(a)home.com> > to=<dmeans(a)the-means.net> > Dec 31 13:29:36 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from > imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <w9hsxyu(a)wonderful.com>: > Sender address rejected: Domain not found; from=<w9hsxyu(a)wonderful.com> > to=<dmeans(a)the-means.net> > Dec 31 13:30:18 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from > imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <d.carrillo_lr(a)reg.fi>: > Sender address rejected: Domain not found; from=<d.carrillo_lr(a)reg.fi> > to=<dmeans(a)the-means.net> > Dec 31 13:31:22 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from > imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <lhancock_nh(a)ipcc.ch>: > Sender address rejected: Domain not found; from=<lhancock_nh(a)ipcc.ch> > to=<dmeans(a)the-means.net> > > > -- > Simon Carr, > easyDNS Technologies, Inc. > http://www.easydns.com > >

1 0

any bellsouth admins around?
by Mark Jeftovic 31 Dec '03

31 Dec '03

Any bellsouth admins around? This would suck if it kept up over the holiday... -mark -- Mark Jeftovic <markjr(a)easydns.com> Co-founder, easyDNS Technologies Inc. ph. +1-(416)-535-8672 ext 225 fx. +1-(416)-535-0237 ---------- Forwarded message ---------- Date: Wed, 31 Dec 2003 14:19:24 -0500 (EST) From: Simon Carr <scarr(a)easydns.com> To: abuse(a)bellsouth.net Subject: Abuse: Getting hammered with forged addresses. Hey there, We seem to be getting hammered with forged addresses from several bellsouth IPs on the 205.152.59.0/24 netblock. Please try to take action agains this immediately as it is causing severe load on our SMTP cluster. Dec 31 13:27:25 10.0.2.44 postfix/smtpd[4221]: 13EEC4F3B3: client=imf16aec.mail.bellsouth.net[205.152.59.64] Dec 31 13:27:39 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <federicohooperfk(a)syselog.fr>: Sender address rejected: Domain not found; from=<federicohooperfk(a)syselog.fr> to=<dmeans(a)the-means.net> Dec 31 13:28:15 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <sritteron(a)ipcc.ch>: Sender address rejected: Domain not found; from=<sritteron(a)ipcc.ch> to=<dmeans(a)the-means.net> Dec 31 13:28:23 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <deghejmfp(a)genie.com>: Sender address rejected: Domain not found; from=<deghejmfp(a)genie.com> to=<dmeans(a)the-means.net> Dec 31 13:28:35 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <jim223bfovl(a)home.com>: Sender address rejected: Domain not found; from=<jim223bfovl(a)home.com> to=<dmeans(a)the-means.net> Dec 31 13:28:41 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <K3TF72Ml1morientesedXqv0Cdr(a)freeserve.net>: Sender address rejected: Domain not found; from=<K3TF72Ml1morientesedXqv0Cdr(a)freeserve.net> to=<dmeans(a)the-means.net> Dec 31 13:28:49 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <MGgcVpy(a)home.com>: Sender address rejected: Domain not found; from=<MGgcVpy(a)home.com> to=<dmeans(a)the-means.net> Dec 31 13:29:36 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <w9hsxyu(a)wonderful.com>: Sender address rejected: Domain not found; from=<w9hsxyu(a)wonderful.com> to=<dmeans(a)the-means.net> Dec 31 13:30:18 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <d.carrillo_lr(a)reg.fi>: Sender address rejected: Domain not found; from=<d.carrillo_lr(a)reg.fi> to=<dmeans(a)the-means.net> Dec 31 13:31:22 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <lhancock_nh(a)ipcc.ch>: Sender address rejected: Domain not found; from=<lhancock_nh(a)ipcc.ch> to=<dmeans(a)the-means.net> -- Simon Carr, easyDNS Technologies, Inc. http://www.easydns.com

1 0

Internet law
by John Obi 31 Dec '03

31 Dec '03

Hello, when will we see the FBI, and other local police in the other countries send the script kiddies to the JAILL so we can use the internet without too much pain? Thanks, -J __________________________________ Do you Yahoo!? Find out what made the Top Yahoo! Searches of 2003 http://search.yahoo.com/top2003

9 9

RE: High volumes of UDP traffic
by Drew Weaver 31 Dec '03

31 Dec '03

We've seen similar instances of these types of things usually precipitated by a customer angering someone on IRC that they shouldn't have. Its just a targeted DDoS either by someone who has owned a large number of boxen on your network, or by someone who doesn't like people who owned a large number of boxen on your network. -Drew -----Original Message----- From: Anderson, Ian [mailto:i.anderson@lancaster.ac.uk] Sent: Wednesday, December 31, 2003 12:31 PM To: nanog(a)merit.edu Subject: High volumes of UDP traffic A heads-up Since yesterday afternoon we saw a large increase in offsite traffic circa 80,000pps directed at host deals.in.crackcocaine.us 17:02:52.527762 148.88.156.86.2571 > 69.50.162.82.7854: udp 1 17:02:52.527876 148.88.156.86.2571 > 69.50.162.82.3002: udp 1 17:02:52.527877 148.88.156.86.2571 > 69.50.162.82.37525: udp 1 17:02:52.527996 148.88.156.86.2571 > 69.50.162.82.6170: udp 1 17:02:52.527997 148.88.156.86.2571 > 69.50.162.82.39709: udp 1 17:02:52.528113 148.88.156.86.2571 > 69.50.162.82.9818: udp 1 17:02:52.528114 148.88.156.86.2571 > 69.50.162.82.57395: udp 1 17:02:52.528115 148.88.156.86.2571 > 69.50.162.82.18194: udp 1 17:02:52.528230 148.88.156.86.2571 > 69.50.162.82.55981: udp 1 17:02:52.528231 148.88.156.86.2571 > 69.50.162.82.42256: udp 1 17:02:52.528350 148.88.156.86.2571 > 69.50.162.82.41441: udp 1 These seem to be from various windows boxen on our network, due to our campus being locked down we've not been able to examine closely the machines and find out exactly what's going on, we've just disconnected them as an interim measure. Anyone else seen similar strangeness? Is it coincidence or is it another l33t haxor trying the old "no one's working on new years eve"?? Anyway a happy new year to all - I'm off to enjoy the party... Ian -- Ian Anderson Network Support Lancaster University, Lancaster, LA1 4YW t: 01524 593019 ~ ip: 01524 510101 ~ f: 01524 844011 i.anderson(a)lancs.ac.uk

1 0

High volumes of UDP traffic
by Anderson, Ian 31 Dec '03

31 Dec '03

A heads-up Since yesterday afternoon we saw a large increase in offsite traffic circa 80,000pps directed at host deals.in.crackcocaine.us 17:02:52.527762 148.88.156.86.2571 > 69.50.162.82.7854: udp 1 17:02:52.527876 148.88.156.86.2571 > 69.50.162.82.3002: udp 1 17:02:52.527877 148.88.156.86.2571 > 69.50.162.82.37525: udp 1 17:02:52.527996 148.88.156.86.2571 > 69.50.162.82.6170: udp 1 17:02:52.527997 148.88.156.86.2571 > 69.50.162.82.39709: udp 1 17:02:52.528113 148.88.156.86.2571 > 69.50.162.82.9818: udp 1 17:02:52.528114 148.88.156.86.2571 > 69.50.162.82.57395: udp 1 17:02:52.528115 148.88.156.86.2571 > 69.50.162.82.18194: udp 1 17:02:52.528230 148.88.156.86.2571 > 69.50.162.82.55981: udp 1 17:02:52.528231 148.88.156.86.2571 > 69.50.162.82.42256: udp 1 17:02:52.528350 148.88.156.86.2571 > 69.50.162.82.41441: udp 1 These seem to be from various windows boxen on our network, due to our campus being locked down we've not been able to examine closely the machines and find out exactly what's going on, we've just disconnected them as an interim measure. Anyone else seen similar strangeness? Is it coincidence or is it another l33t haxor trying the old "no one's working on new years eve"?? Anyway a happy new year to all - I'm off to enjoy the party... Ian -- Ian Anderson Network Support Lancaster University, Lancaster, LA1 4YW t: 01524 593019 ~ ip: 01524 510101 ~ f: 01524 844011 i.anderson(a)lancs.ac.uk

1 0

Waaaay off topic, but: the next IETF is in Seoul...
by Bill Woodcock 31 Dec '03

31 Dec '03

...and United and Lufthansa are have fare sales to Seoul if you buy the ticket by January 16. $478 round-trip from San Francisco, for instance. It would normally cost between $900-$1100 most of the time. http://www.united.com/page/article/0,1360,50105,00.html?code=&jumpLink=%2Fn… Sorry for the off-topic post, but I figured it might let a few more ops folks get to the meeting than might otherwise feel like they could afford an overseas IETF. -Bill

2 1