- Test - lists.nanog.org

RE: Stopping ip range scans
by william＠elan.net 29 Dec '03

29 Dec '03

On Mon, 29 Dec 2003, Abdullah Hameed Sheikh wrote: > There are two types of network: Enterprise and Service Provider. I kind of have both types. I call them unmanaged and managed. For certain ip blocks (always larger then /24) all traffic is passing through linux firewall with multiple vlans & ethernet ports to be able to accomodate multiple customers at the same time. I'd like to at least stop this scan for everything behind the firewall. Would be best if I stop it for entire network too, but that is just a wish and I did not see any easy way to do it using cisco configuration and modifying access lists every minute is probably not too interesting (here I again get reminded of the cooperative bgp filtering draft I worked on for bogons with Michael, Rob & Joren, see http://arneill-py.sacramento.ca.us/draft-py-idr-redisfilter-01.txt I'll have to wait until its part of OS to try something for scan prevention...). > The job of the service provider is very simple. Just provide plain > Internet connectivity. The above is true if you're very "plain" network provider. Some of us do more then just simple internet connectivity services... > if the traffic is detined to an IP which is > in my network, it is considered legitimate traffic. ) The problem is these are random scans, the traffic is going to ips that are not used and never were. They're clearly a random sequential scans. > But it can block your legitimate traffic as well. I've thought about it and the way I see it - if somebody is scanning me, its not a legitimate traffic to me and big potential security risk. So if same ip hits within fraction of a sec 2 or 3 sequential ip addresses on some monitoring device, it seems ok for me if its blocked for next 10 minutes (but not permanently). I don't think any legitimate traffic would be lost in this case. (Note: definition of "legitimate" varies from network to network and from one person to another). -- William Leibzon Elan Networks william(a)elan.net

2 1

a note to those who would automate their rejection notices
by Paul Vixie 28 Dec '03

28 Dec '03

today AOL thoughtfully supplied the following to postmaster(a)vix.com: Peewee1isme(a)aol.com SMTP error from remote mailer after initial connection: host mailin-02.mx.aol.com [64.12.137.89]: 554-(RLY:B1) The information presently available to AOL indicates this 554-server is generating high volumes of member complaints from AOL's 554-member base. Based on AOL's Unsolicited Bulk E-mail policy at 554-http://www.aol.com/info/bulkemail.html AOL may not accept further 554-e-mail transactions from this server or domain. For more information, 554 please visit http://postmaster.info.aol.com. this was in response to what the e-mail community refers to as a "trivial forgery", whose salient headers were: Return-path: <ediva.clapplz(a)vix.com> Received: from port-212-202-52-233.reverse.qsc.de ([212.202.52.233] helo=1-online-poker-video.com) by mx01.qsc.de with esmtp (Exim 3.35 #1) id 1AQIw9-0000bF-00; Sun, 30 Nov 2003 05:11:58 +0100 Message-ID: <0d7b01c3b6f8$814916c5$da62d340@ifptblb> From: "Ediva Clapp" <ediva.clapplz(a)vix.com> so once again we see, as in the case of the anti-virus rejection notices, that my reward for having my domain name forged in spam that didn't come from here, is to get mail from AOL telling me that they rejected it. so, i'll add this pattern to my own "drop silently" filters along with chaff from symantec's products, network associates' products, and so on. of the foundational principles which made the internet possible and which made it different from alternatives such as OSI, very few remain. one of them was "must scale indefinitely". a simple application of this principle toward anti-virus and anti-spam automated rejection notices is to ignore the envelope and ignore the header and just focus on the peer IP address: To: postmaster(a)[212.202.52.233] would have been a better destination for this. it's standards-compliant, and if the sender isn't an open proxy then they'll be able to get it, and it will not needlessly increase the collateral damage toward the holders of domains that were forged. "don't make me stop this car, kids." ...and to all a good night.

7 6

Re: a note to those who would automate their rejection notices
by Paul Vixie 27 Dec '03

27 Dec '03

> pv> of the foundational principles which made the internet > pv> possible and which made it different from alternatives such as > pv> OSI, very few remain. > > Would SPF <http://spf.pobox.com/> be a bit less destructive than many > other proposals to counter "trivial forgery". No. Nor will Yahoo's recently announced technology make any real difference. Preventing forgery is a way of protecting domain names as "service marks" and also ensuring that your own or your customers' non-spam output isn't snared in a bunch of false-positive trappery. But it won't stop or even slow the rate at which spam is sent or is received. Spammers still lie, but they are no longer as dumb as fence posts, and they can register throw-away domains whose crypto-authenticity is completely valid, even in the presence of wide scale wormspoor-proxy usage. It could be that I'm just especially irritable this year, or it could be that the reinvention frequency of bad ideas really is growing at the same rate as the internet's population. I no longer think that E-mail as we know it will survive. But I would be less irritable about it if the people who keep proposing to "save" it would (a) do their homework, (b) assume that spammers are going to try to adapt, and (c) think about the side effects of the tools they deploy. This is information warfare. "Warfare." You aren't fighting the terrain or the elements or some mindless bacteria. You're fighting other humans, and they are armed, committed, dangerous, and adaptive. In that light, I look at things like Bayesian filters or Vipul's Razor and I wonder, why is the "D" in Vern's DCC (see www.rhyolite.com/dcc) so difficult to predict a need for? (Y'all already know my views on relay-probing without spam-in-hand, but the tie-in here is "how can you fight spam if your principles aren't different from the people you're fighting? where exactly do you think it will end?") Anyway, I hope folks will stop sending automated rejection notices to domains who were not involved, other than by forgery, in the transmission of a virus or spam. In other words, there's relevant operational content in this thread, and when "fighting" spam it would be reasonable to avoid hurting uninvolved third parties. AOL, please listen.

2 1

RE: MS's new antispam idea
by Michel Py 27 Dec '03

27 Dec '03

David, >> Michel Py wrote: >> Besides, the deployment is sketchy: before it can be >> activated, it needs to be deployed at the vast majority >> of servers that send legitimate mail, which means that >> in the interim one still has to accept emails that don't >> use the system, which in turn produces no incentive to >> deploy it in the first place. > David Schwartz wrote: > While I think this scheme is a pretty bad idea, the argument > above is just not correct. Obviously, until this scheme is > widely-deployed, you have to accept email from sources that > won't perform this validation, but that doesn't mean that > there's no benefit to performing the validation or > requesting it. Your point is valid, but along with the benefits of performing the validation even if the deployment has not reached 100% yet comes major drawback: If it can be assumed that Microsoft or eBay will indeed shell out the resources to buy and operate a few rackfulls of 1U low-end servers to distribute the processing load, the same assumption does not apply to smaller entities. I have a relatively small customer (~200 employees) that has a 300,000 person mailing list; they effectively send 300,000 legitimate emails a day. If I stick to the figures proposed yesterday (10 seconds of CPU an email / 8000 a day for one CPU) what does it mean for these guys in the period before 100% deployment: They have to choose between: 1. Do nothing and risk being more filtered than they otherwise would be. 2. Bite the bullet, buy 37 new servers (while they were using one) and develop a mechanism to load share the computation of the puzzle. A large number of these guys won't go for the 37 extra servers. What does it mean for you and me in the decision to deploy or not to deploy such a scheme on our own mail servers: it means that the extended filtering capabilities you described (which are very valid) nevertheless have to be balanced with an increased number of false positives, that very number of false positives being greatly increased by the partial deployment. As of today, the way I see the challenge of spam is not in terms of how much you block, but in terms of the ratio of false positives to undetected spam. Unfortunately, in the interim period this enhanced filtering mechanism you describe would favor two categories: a) the big and/or wealthy (because they can buy the required resources) and b) the spammers (because they steal the resources) at the expense of the smaller organization. :-( Michel.

1 0

MS's new antispam idea
by Stephen J. Wilcox 27 Dec '03

27 Dec '03

http://news.bbc.co.uk/1/hi/technology/3324883.stm Ok so in summary you have to use a bit of CPU to solve a puzzle before it lets you send email. So either this doesnt work because spammers dont actually use their own PCs to send email or we are talking about a whole new mail protocol, either way I'm thinking this isnt going to work and its yet another publicity stunt. Steve

6 6

RE: MS's new antispam idea
by Michel Py 27 Dec '03

27 Dec '03

> Stephen J. Wilcox wrote: > So either this doesnt work because spammers don't > actually use their own PCs to send email Indeed; it doesn't do any good against spammers that control large numbers of zombie machines; they'll just distribute the processing load all over the place. And it would make life miserable for people that send large numbers of legitimate emails. Besides, the deployment is sketchy: before it can be activated, it needs to be deployed at the vast majority of servers that send legitimate mail, which means that in the interim one still has to accept emails that don't use the system, which in turn produces no incentive to deploy it in the first place. Michel.

2 1

RE: Out of office/vacation messages
by Pete Templin 27 Dec '03

27 Dec '03

You're correct in saying that OOO messages from Exchange are offensive. However, I don't think you should necessarily consider the subscriber as the offender - I for one have no choice in what email software is run at my corporate office. Everyone in my corporate IT group is so busy continually justifying their existence and staking their ground that there's no chance that they'll switch platforms. Heck, the Windoze guy turns almost white when I talk about taking over the DNS servers. -----Original Message----- From: David Lesher [mailto:wb8foz@nrk.com] Sent: Friday, December 26, 2003 9:51 AM To: nanog list Subject: Re: Out of office/vacation messages Speaking on Deep Background, the Press Secretary whispered: > > > > Again, if your auto-responder writes to *anyone*, it is broken, period. > > Then again, most of the autoresponders being sent to the list are from > Exchange. Which is broken, period. Most? Not "all"?? When/if I get tired of getting the admin box full of such, I find unsubscribing the offender to be a good cure. -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

3 2

The Cidr Report
by cidr-report＠potaroo.net 26 Dec '03

26 Dec '03

This report has been generated at Fri Dec 26 21:47:48 2003 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 19-12-03 128899 90425 20-12-03 128943 90361 21-12-03 128972 90386 22-12-03 129021 90403 23-12-03 128937 90406 24-12-03 128959 90484 25-12-03 129191 90477 26-12-03 129101 90490 AS Summary 16303 Number of ASes in routing system 6517 Number of ASes announcing only one prefix 1395 Largest number of prefixes announced by an AS AS701 : ALTERNET-AS UUNET Technologies, Inc. 73533184 Largest address span announced by an AS (/32s) AS568 : SUMNET-AS DISO-UNRRA Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 26Dec03 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 129152 90491 38661 29.9% All ASes AS4134 707 123 584 82.6% CHINANET-BACKBONE No.31,Jin-rong Street AS6197 821 295 526 64.1% BATI-ATL BellSouth Network Solutions, Inc AS4323 677 205 472 69.7% TW-COMM Time Warner Communications, Inc. AS701 1395 961 434 31.1% ALTERNET-AS UUNET Technologies, Inc. AS7018 1390 959 431 31.0% ATT-INTERNET4 AT&T WorldNet Services AS7843 505 116 389 77.0% ADELPHIA-AS Adelphia Corp. AS6198 568 228 340 59.9% BATI-MIA BellSouth Network Solutions, Inc AS22909 320 13 307 95.9% DNEO-OSP1 Comcast Cable Communications, Inc. AS27364 381 81 300 78.7% ACS-INTERNET Armstrong Cable Services AS22773 327 31 296 90.5% CCINET-2 Cox Communications Inc. Atlanta AS1239 955 665 290 30.4% SPRINTLINK Sprint AS4355 380 99 281 73.9% ERMS-EARTHLNK EARTHLINK, INC AS1221 911 656 255 28.0% ASN-TELSTRA Telstra Pty Ltd AS17676 290 42 248 85.5% GIGAINFRA Softbank BB Corp. AS6347 329 85 244 74.2% DIAMOND SAVVIS Communications Corporation AS25844 243 16 227 93.4% SKADDEN1 Skadden, Arps, Slate, Meagher & Flom LLP AS209 732 516 216 29.5% ASN-QWEST Qwest AS9583 272 56 216 79.4% SATYAMNET-AS Satyam Infoway Ltd., AS6140 350 138 212 60.6% IMPSAT-USA ImpSat AS14654 205 3 202 98.5% WAYPORT Wayport AS11305 231 38 193 83.5% INTERLAND-NET1 Interland Incorporated AS4519 194 13 181 93.3% MAAS Maas Communications AS6478 218 41 177 81.2% ATT-INTERNET3 AT&T WorldNet Services AS6327 204 28 176 86.3% SHAW Shaw Communications Inc. AS9929 203 27 176 86.7% CNCNET-CN China Netcom Corp. AS2386 405 237 168 41.5% INS-AS AT&T Data Communications Services AS20115 580 413 167 28.8% CHARTER-NET-HKY-NC Charter Communications AS2048 248 84 164 66.1% LANET-1 State of Louisiana AS15270 204 41 163 79.9% AS-PAETEC-NET PaeTec.net -a division of PaeTecCommunications, Inc. AS9800 212 57 155 73.1% UNICOM CHINA UNICOM Total 14457 6267 8190 56.7% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 ANDARA-HSI Andara High Speed Internet c/o Halifax Cable Ltd. 61.12.32.0/24 AS7545 TPG-INTERNET-AP TPG Internet Pty Ltd 61.12.34.0/24 AS7545 TPG-INTERNET-AP TPG Internet Pty Ltd 64.62.64.0/24 AS3549 GBLX Global Crossing 64.62.126.0/23 AS25700 SWIFTDESK SWIFTDESK VENTURE 66.41.192.0/18 AS13367 CCCH-AS3 Comcast Cable Communications Holdings, Inc 69.8.128.0/17 AS7260 NORLIGHT Norlight Telecommunications 132.0.0.0/10 AS568 SUMNET-AS DISO-UNRRA 137.0.0.0/13 AS568 SUMNET-AS DISO-UNRRA 138.136.0.0/13 AS568 SUMNET-AS DISO-UNRRA 140.143.2.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 158.0.0.0/13 AS568 SUMNET-AS DISO-UNRRA 192.43.230.0/24 AS4738 SAARDNET-AS South Australian Academic Research and Development Network 192.44.0.0/19 AS702 AS702 MCI EMEA 192.64.84.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.16.0/20 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.32.0/19 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.64.0/19 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.96.0/22 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.100.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.119.135.0/24 AS270 PSCNI-AS National Aeronautics and Space Administration 192.124.252.0/22 AS680 AS680 DFN-IP service G-WiN 192.135.50.0/24 AS7018 ATT-INTERNET4 AT&T WorldNet Services 192.136.71.0/24 AS719 AS719 LANLINK autonomous system 192.136.79.0/24 AS719 AS719 LANLINK autonomous system 192.153.144.0/21 AS568 SUMNET-AS DISO-UNRRA 192.172.0.0/19 AS568 SUMNET-AS DISO-UNRRA 192.188.208.0/20 AS568 SUMNET-AS DISO-UNRRA 192.243.32.0/23 AS2044 PALIN-AS Palin Aquisitions Inc. 198.23.26.0/24 AS4390 BELLATLANTIC-COM Bell Atlantic, Inc. 198.41.194.0/24 AS1982 ASN-NWNEXUS Northwest Nexus Inc. 198.97.72.0/21 AS568 SUMNET-AS DISO-UNRRA 198.97.80.0/20 AS568 SUMNET-AS DISO-UNRRA 198.97.88.0/24 AS89 NUSC-CSTLNET-AS Naval Underwater Systems Center 198.97.192.0/20 AS568 SUMNET-AS DISO-UNRRA 198.97.240.0/20 AS568 SUMNET-AS DISO-UNRRA 198.101.4.0/22 AS568 SUMNET-AS DISO-UNRRA 198.136.32.0/20 AS19329 MCNET Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY-NET CityNet, Inc. 198.161.87.0/24 AS6539 GROUPTLCOM GT Group Telecom Services Corp. 198.161.165.0/24 AS852 ASN852 Telus Advanced Communications 198.163.155.0/24 AS684 MBNET-AS Manitoba Regional Network 198.167.0.0/16 AS7456 INTERHOP Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ALLST-15290 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASKTEL SaskTel 198.232.133.0/24 AS23075 SKOTOS-AS Skotos Tech, Inc 199.10.0.0/16 AS568 SUMNET-AS DISO-UNRRA 199.60.0.0/20 AS271 BCNET-AS University of British Columbia 199.84.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 199.114.0.0/18 AS568 SUMNET-AS DISO-UNRRA 199.114.0.0/21 AS568 SUMNET-AS DISO-UNRRA 199.114.128.0/18 AS568 SUMNET-AS DISO-UNRRA 199.114.130.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.132.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.136.0/24 AS1913 DLA4 Defense Logistics Agency 199.114.138.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.140.0/24 AS3544 ITSDN-U7 DISA/UNRRA 199.114.142.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.144.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.148.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.150.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.152.0/24 AS1913 DLA4 Defense Logistics Agency 199.114.154.0/24 AS1733 CENTAF-SWA AF DDN PMO 199.114.156.0/24 AS1913 DLA4 Defense Logistics Agency 199.114.160.0/24 AS1733 CENTAF-SWA AF DDN PMO 199.120.32.0/19 AS16582 NEXTLEVELINTERNET NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS568 SUMNET-AS DISO-UNRRA 199.123.0.0/18 AS568 SUMNET-AS DISO-UNRRA 199.123.16.0/20 AS568 SUMNET-AS DISO-UNRRA 199.123.80.0/21 AS568 SUMNET-AS DISO-UNRRA 199.189.32.0/19 AS7332 IQUEST-AS IQuest Internet 199.202.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 200.120.0.0/16 AS22047 CL-VPNS-LACNIC VTR BANDA ANCHA S.A. 202.0.180.0/24 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.4.252.0/22 AS4808 CHINA169-BJ CNCGROUP IP network¡ªChina169 Beijing Province Network 202.4.255.0/24 AS4799 UNSPECIFIED Ji Tong Communications Co., Ltd. 202.70.240.0/20 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.72.112.0/22 AS22351 INTELSAT-1 INTELSAT 202.122.76.0/24 AS17553 TIMELESS-AP System Integration provider 202.136.254.0/24 AS4808 CHINA169-BJ CNCGROUP IP network¡ªChina169 Beijing Province Network 202.136.255.0/24 AS4808 CHINA169-BJ CNCGROUP IP network¡ªChina169 Beijing Province Network 203.29.222.0/24 AS22934 EBROADBANDNOW E Broadband Now Inc. 203.32.4.0/23 AS7617 APNIC-AS-2-BLOCK Asia Pacific Network Information Centre 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.76.128.0/24 AS9729 IS-AP iAdvantage Limited 203.76.224.0/24 AS9549 COMDEK-ISP-AS-AP Comdek ISP 203.86.2.0/23 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 203.132.95.0/24 AS9787 CONCEPT-AU-AP Concept Networks 203.132.97.0/24 AS7652 VIANET-AS-AP Vianet Communications Pty Ltd 203.132.107.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.108.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.109.0/24 AS10141 CALOUNDRA-AS-AP Caloundra.net 203.132.111.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.112.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.118.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.122.0/24 AS4802 WANTREE-AS-AP Wantree Development 203.132.123.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.124.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.125.0/24 AS4817 TECHEX1-AS-AP Techex Primary Netblock 203.135.99.0/24 AS2687 IBM-MMD-AS IBM 204.19.224.0/19 AS816 UUNET-AS4 UUNET Technologies, Inc. 204.69.144.0/22 AS5668 AS-5668 CenturyTel Internet Holdings, Inc. 204.154.125.0/24 AS3952 TELLABS-ASN TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLABS-ASN TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLABS-ASN TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBIT 205.150.0.0/15 AS701 ALTERNET-AS UUNET Technologies, Inc. 206.41.32.0/19 AS14824 NEWSOUTH NewSouth Communications Corp. 206.81.187.0/24 AS19194 JOVITA Sentris Network LLC 206.108.34.0/24 AS852 ASN852 Telus Advanced Communications 206.108.35.0/24 AS852 ASN852 Telus Advanced Communications 206.167.57.0/24 AS376 RISQ-AS Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ALLST-15290 Allstream Corp. Corporation Allstream 206.251.69.0/24 AS27429 TIL Telesat International Ltd. 207.47.39.0/24 AS816 UUNET-AS4 UUNET Technologies, Inc. 207.162.192.0/19 AS4589 EASYNET Easynet Group Plc 207.231.96.0/19 AS11194 NUNETPA NuNet Inc 208.81.187.0/24 AS19194 JOVITA Sentris Network LLC 209.169.219.0/24 AS189 GENUITY-AS189 Genuity 209.169.223.0/24 AS189 GENUITY-AS189 Genuity 209.172.0.0/18 AS7770 TRITON Triton Technologies, Inc. 209.196.192.0/19 AS1784 GNAPS Global NAPs Networks 209.213.32.0/19 AS10629 INTERPAC Inter-Pacific Network Services 209.213.50.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.51.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.55.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.56.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.222.137.0/24 AS27429 TIL Telesat International Ltd. 209.240.96.0/19 AS10815 KCNET KCnet, Inc. 209.251.0.0/19 AS11036 SISCOM SISCOM, Inc 209.251.64.0/19 AS10266 NETWAY-AS MDC, Inc. 210.213.0.0/19 AS6453 GIEUROPE Teleglobe America Inc. 216.18.224.0/21 AS11458 IMBRIS IMBRIS, INC. 216.18.224.0/22 AS11458 IMBRIS IMBRIS, INC. 216.18.228.0/22 AS11458 IMBRIS IMBRIS, INC. 216.36.46.0/24 AS7176 GENUITY-AS7176 Genuity 216.36.47.0/24 AS7176 GENUITY-AS7176 Genuity 216.96.128.0/18 AS7018 ATT-INTERNET4 AT&T WorldNet Services Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

Happy Holiday Wishes
by Braun, Mike 25 Dec '03

25 Dec '03

To all on Nanog, Have a happy holiday season and a great new year :-) Mike Braun "MMS <firstam.com>" made the following annotations on 12/24/2003 11:22:29 AM ------------------------------------------------------------------------------ "THIS E-MAIL MESSAGE AND ANY FILES TRANSMITTED HEREWITH, ARE INTENDED SOLELY FOR THE USE OF THE INDIVIDUAL(S) ADDRESSED AND MAY CONTAIN CONFIDENTIAL, PROPRIETARY OR PRIVILEGED INFORMATION. IF YOU ARE NOT THE ADDRESSEE INDICATED IN THIS MESSAGE (OR RESPONSIBLE FOR DELIVERY OF THIS MESSAGE TO SUCH PERSON) YOU MAY NOT REVIEW, USE, DISCLOSE OR DISTRIBUTE THIS MESSAGE OR ANY FILES TRANSMITTED HEREWITH. IF YOU RECEIVE THIS MESSAGE IN ERROR, PLEASE CONTACT THE SENDER BY REPLY E-MAIL AND DELETE THIS MESSAGE AND ALL COPIES OF IT FROM YOUR SYSTEM." ==============================================================================

4 3

Extreme spam testing
by Chris Brenton 24 Dec '03

24 Dec '03

Greets again all, I noticed something kind of interesting when I made my last post to NANOG. I can understand people wanting to do spam checking, but IMHO this is a bit excessive and inconsiderate. I'm guessing njabl.org is doing this to everyone who posts to the list, so I thought others might want to know about it in case they have not noticed it in their own logs. BTW, if you are curious about the "spammers_waste_oxygen" portion, that was grabbed off my SMTP banner. Cheers, C *********************************************** Dec 22 08:21:50 mailgate sendmail[492]: hBMDLnHS000492: before-reporting-as-abuse-please-see-www.njabl.org [209.208.0.15] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA Dec 22 08:21:50 mailgate sendmail[495]: hBMDLoHS000495: ruleset=check_rcpt, arg1=<relaytest(a)rr.njabl.org>, relay=rt.njabl.org [209.208.0.15], reject=550 5.7.1 <relaytest(a)rr.njabl.org>... Relaying denied Dec 22 08:21:50 mailgate sendmail[495]: hBMDLoHT000495: ruleset=check_mail, arg1=<relaytestsend@spammers_waste_oxygen;>, relay=rt.njabl.org [209.208.0.15], reject=553 5.1.8 <relaytestsend@spammers_waste_oxygen;>... Domain of sender address relaytestsend@spammers_waste_oxygen does not exist Dec 22 08:21:50 mailgate sendmail[495]: hBMDLoHU000495: ruleset=check_mail, arg1=<"relaytestsend(a)rt.njabl.org"@spammers_waste_oxygen;>, relay=rt.njabl.org [209.208.0.15], reject=553 5.1.8 <"relaytestsend(a)rt.njabl.org"@spammers_waste_oxygen;>... Domain of sender address relaytestsend@rt.njabl.org@spammers_waste_oxygen does not exist Dec 22 08:21:51 mailgate sendmail[495]: hBMDLoHV000495: ruleset=check_mail, arg1=<relaytestsend>, relay=rt.njabl.org [209.208.0.15], reject=553 5.5.4 <relaytestsend>... Domain name required for sender address relaytestsend Dec 22 08:21:51 mailgate sendmail[495]: hBMDLoHW000495: ruleset=check_mail, arg1=<relaytestsend@localhost>, relay=rt.njabl.org [209.208.0.15], reject=553 5.5.4 <relaytestsend@localhost>... Real domain name required for sender address Dec 22 08:21:51 mailgate sendmail[495]: hBMDLoHX000495: ruleset=check_rcpt, arg1=<relaytest(a)rr.njabl.org>, relay=rt.njabl.org [209.208.0.15], reject=550 5.7.1 <relaytest(a)rr.njabl.org>... Relaying denied Dec 22 08:21:51 mailgate sendmail[495]: hBMDLoHY000495: ruleset=check_rcpt, arg1=<relaytest(a)rr.njabl.org>, relay=rt.njabl.org [209.208.0.15], reject=550 5.7.1 <relaytest(a)rr.njabl.org>... Relaying denied Dec 22 08:21:51 mailgate sendmail[495]: hBMDLoHZ000495: ruleset=check_rcpt, arg1=<relaytest(a)rr.njabl.org>, relay=rt.njabl.org [209.208.0.15], reject=550 5.7.1 <relaytest(a)rr.njabl.org>... Relaying denied Dec 22 08:21:52 mailgate sendmail[495]: hBMDLoHa000495: ruleset=check_rcpt, arg1=<relaytest(a)rr.njabl.org>, relay=rt.njabl.org [209.208.0.15], reject=550 5.7.1 <relaytest(a)rr.njabl.org>... Relaying denied Dec 22 08:21:52 mailgate sendmail[495]: hBMDLoHb000495: ruleset=check_rcpt, arg1=<relaytest(a)rr.njabl.org>, relay=rt.njabl.org [209.208.0.15], reject=550 5.7.1 <relaytest(a)rr.njabl.org>... Relaying denied Dec 22 08:21:52 mailgate sendmail[495]: hBMDLoHc000495: ruleset=check_rcpt, arg1=<relaytest(a)rr.njabl.org>, relay=rt.njabl.org [209.208.0.15], reject=550 5.7.1 <relaytest(a)rr.njabl.org>... Relaying denied Dec 22 08:21:52 mailgate sendmail[495]: hBMDLoHd000495: ruleset=check_rcpt, arg1=<relaytest(a)rr.njabl.org>, relay=rt.njabl.org [209.208.0.15], reject=550 5.7.1 <relaytest(a)rr.njabl.org>... Relaying denied Dec 22 08:21:52 mailgate sendmail[495]: hBMDLoHe000495: ruleset=check_mail, arg1=<postmaster@spammers_waste_oxygen;>, relay=rt.njabl.org [209.208.0.15], reject=553 5.1.8 <postmaster@spammers_waste_oxygen;>... Domain of sender address postmaster@spammers_waste_oxygen does not exist Dec 22 08:21:53 mailgate sendmail[495]: hBMDLoHf000495: ruleset=check_rcpt, arg1=<relaytest%rr.njabl.org@spammers_waste_oxygen;>, relay=rt.njabl.org [209.208.0.15], reject=550 5.7.1 <relaytest%rr.njabl.org@spammers_waste_oxygen;>... Relaying denied Dec 22 08:21:53 mailgate sendmail[495]: hBMDLoHh000495: ruleset=check_mail, arg1=<relaytestsend@spammers_waste_oxygen;>, relay=rt.njabl.org [209.208.0.15], reject=553 5.1.8 <relaytestsend@spammers_waste_oxygen;>... Domain of sender address relaytestsend@spammers_waste_oxygen does not exist

14 21