- Test - lists.nanog.org

Re: Don't like it, order the ISPs to block it
by Mike Tancsa 30 Sep '03

30 Sep '03

I would be happy just to see ISPs live up to their own published AUP. The Internet would be a MUCH nicer place if this were the case. Why does the topic of AUP enforcement gravitate towards straw man discussions of totalitarian governments? Yeah, I am sure the North Korean ISP scene is no fun. But this is North America. If a company wines about the fact that they dont have a business plan that allows for the enforcement of their published rules ("oh, it just costs too much money"), they should not BS the public that they have such rules in the first place. If we want our industry to be self policing, and not policed by the public sector, we better start policing ourselves. ---Mike At 02:47 PM 29/09/2003, Sean Donelan wrote: >Continuing the trend of holding ISPs morally responsible for all things, >India's Computer Emergency Response Team ordered all ISPs in India to >block a Yahoo bulletin board for "promoting anti-national news and >containing material against the government." > >http://www.wired.com/news/politics/0,1283,60628,00.html > >ISPs are not very good at fine grain control. In India the ISPs >initially blocked access to all Yahoo discussion group servers. But >I'm sure they will improve monitoring of the actions of their subscribers, >to adapt the blocks. What's interesting is in order to block less, the >ISPs will have to invade the privacy of their users' traffic more. > >Making the ISP the personal firewall for every user or country is an >growing concept. Talk about cost shifting. Some countries are willing to >pay for it (e.g. China), increasing the costs. The Internet may end up >costing more than private point-to-point lines after ISPs install >all the firewalls to implement all the personal controls desired by >governments.

1 0

Re: ISPs blocking port 53? (was Re: Annoying dynamic DNS updates)
by Paul Vixie 29 Sep '03

29 Sep '03

> ... probably most of the Abuse issues (especially via email) would > continue to be ignored. Noone wants to handle that stuff. But > someone(s) must handle that stuff. the underlying question is, "or else what?" this is an assymetric-benefit situation. when folks ignore reports from noncustomers the people they are hurting are those noncustomers. as sean and others have pointed out, there's no incentive-stick in that equation. someone asked me privately: > and why would anyone care about branding? what would it gain them? > > until theres financial penalties for being a bad netizen, there wont be > any incentive to follow the rules. if it were a checklist item for government/military/largecommercial contracts then you can bet that the sales team in every large/medium isp would beat the drum internally to ensure qualification and compliance. given the somewhat direct relationship between insider (customer) service, outsider responsiveness, and network uptime, this isn't a hard sell. what's hard is figuring out who can host the brand and what collection of people (network owners and their customers) can be trusted to define it. i'm thinking the new NRO (joint project by apnic/lacnic/ripe/arin) might be the right place to home a responsible-network-ownership branding program.

3 2

Re: ICMP Blocking Woes
by Kevin Oberman 29 Sep '03

29 Sep '03

> From: "Eric Germann" <ekgermann(a)cctec.com> > Date: Mon, 29 Sep 2003 15:56:04 -0400 > Sender: owner-nanog(a)merit.edu > > > winders does use udp instead of icmp in their tracert program, IIRC (or at > least they used to). At the risk of getting my head blown off, could we say > that was foresight :) You have it backwards. Windows tracert uses ICMP while most Unix boxes use the LBNL traceroute program (or something derived from it) which uses UDP. But both rely on the return of ICMP TTL expired or unreachable messages and blocking all ICMP breaks both. -- R. Kevin Oberman, Network Engineer Energy Sciences Network (ESnet) Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab) E-mail: oberman(a)es.net Phone: +1 510 486-8634

1 0

RE: Converting from telco Major-V, Major-H coordinates to Lat Long
by Stewart, William C (Bill), RTSLS 29 Sep '03

29 Sep '03

Pete Templin wrote: > Very rusty memory cells on this, but I think the mileage is > 0.1 * sqrt ((delta-V)^2 + (delta-H)^2)). > That's assuming same LATA, IIRC. Close. It's sqrt ( 0.1 * ((delta-V)^2 + (delta-H)^2)) ) and it doesn't care about LATAs. It's mostly accurate in the US middle 48 states and nearby parts of Canada and Mexico. http://datec.web.att.com/faqs/telecom.htm has more information, not all of it correct. Telecordia has pictures http://www.trainfo.com/products_services/tra/vhpage.html and will sell you more documentation and software, though they don't seem to make it easy :-) They've also got some material on issues with the newer coordinate systems such as WGS-84. Several other people all sell it - most of it's bundled with databases of NPA-NXX. http://article.gmane.org/gmane.comp.gis.proj-4.devel/26 points to the free OpenMap software, which has a converter. http://article.gmane.org/gmane.comp.gis.proj-4.devel/19 has Fortran code! Google will tell you more. ---- A long, long time ago, in a phone company far, far away, I worked with some people who decided they had to go reconstruct the algorithms used to generate these coordinates, and we had some programs that could calculate translations. Any records I have on that were probably backed up on a 9-track tape somewhere before the department moved to another building, though it's possible that they still exist on an account I no longer have access to on a machine that does still exist but is no longer as cutting-edge as it was in 1993.

1 0

RE: Another DNS blacklist is taken down
by Joel Perez 29 Sep '03

29 Sep '03

Great, Just Great. Wasn't there a post a while back that listed what providers are SPAM friendly? My fingers are getting tired trying to create ACL's lists to block ranges of IP's without compromising my service. I wish the power's up above would buy the right software to try and curb the SPAM but that is not to be according to them. So back to my ACL's I go! ---------------------------------------------- Joel Perez <jperez(a)ntera.net> | IP Engineer http://www.ntera.net/ | Ntera 305.914.3412 >>-----Original Message----- >>From: Justin Shore [mailto:listuser@numbnuts.net] >>Sent: Wednesday, September 24, 2003 12:29 PM >>To: nanog(a)merit.edu >>Subject: Another DNS blacklist is taken down >> >> >>I thought ya'll might be interested to hear that yet another DNS blacklist >>has been taken down out of fear of the DDoS attacks that took down >>Osirusoft, Monkeys.com, and the OpenRBL. Blackholes.compu.net suffered a >>joe-job earlier this week. Apparently the joe-jobbing was enough to >>convince some extremely ignorant mail admins that Compu.net is spamming >>and blocked mail from compu.net. Compu.net has also seen the effects of >>DDoS attacks on other DNS blacklist maintainers. They've decided that the >>risk to their actual business is too great and they are pulling the plug >>on their DNS blacklist before they come under the gun by spammers. >> >>http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF- >>8&selm=3f70e839%241%40dimaggio.newszilla.com >> >>Ron Guilmette, maintainer of the Monkeys.com blacklists has posted a >>farewell from Monkeys.com to news.admin.net-abuse.email. Ron cites the >>total lack of interest in the attacks by both big network providers and >>law enforcement authorities as the ultimate reason he's pulling the plug. >> >>http://groups.google.com/groups?q=%22Now+retired+from+spam+fighting%22 &hl= >>en&lr=&ie=UTF-8&oe=UTF-8&selm=vn1lufn8h6r38%40corp.supernews.com&rnum= 4 >> >>It's truely a sad day for spam fighters everywhere. >> >>So, my question for NANOG is how does one go about attracting the >>attention of law enforcement when your network is under attack? How does >>the target of such an attack get a large network provider who's customers >>are part of the attack to pay attention? Is media attention the only way >>to pressure a response from either group? These DDoS attacks have >>received some attention in mainstream media: >> >>http://www.msnbc.com/news/959094.asp?0cv=TB10 >>http://www.boston.com/news/nation/articles/2003/08/28/saboteurs_hit_sp ams_ >>blockers >> >>Apparently it hasn't been enough. Legal remedies take too long and are >>cost prohibitive (unless you're the DoJ). Subpoenas and civil lawsuits >>take months if not years. Relief is needed in days if not hours. >> >>Justin

8 9

Don't like it, order the ISPs to block it
by Sean Donelan 29 Sep '03

29 Sep '03

Continuing the trend of holding ISPs morally responsible for all things, India's Computer Emergency Response Team ordered all ISPs in India to block a Yahoo bulletin board for "promoting anti-national news and containing material against the government." http://www.wired.com/news/politics/0,1283,60628,00.html ISPs are not very good at fine grain control. In India the ISPs initially blocked access to all Yahoo discussion group servers. But I'm sure they will improve monitoring of the actions of their subscribers, to adapt the blocks. What's interesting is in order to block less, the ISPs will have to invade the privacy of their users' traffic more. Making the ISP the personal firewall for every user or country is an growing concept. Talk about cost shifting. Some countries are willing to pay for it (e.g. China), increasing the costs. The Internet may end up costing more than private point-to-point lines after ISPs install all the firewalls to implement all the personal controls desired by governments.

1 0

RE: Converting from telco Major-V, Major-H coordinates to Lat Long
by Pete Templin 29 Sep '03

29 Sep '03

Very rusty memory cells on this, but I think the mileage is 0.1 * sqrt ((delta-V)^2 + (delta-H)^2)). That's assuming same LATA, IIRC. Pete Templin Senior Staff Engineer TexLink Communications (210) 892-4183 pete.templin(a)texlink.com -----Original Message----- From: network-nanog(a)gwi.net [mailto:network-nanog@gwi.net] Sent: Monday, September 29, 2003 12:06 PM To: nanog(a)merit.edu Cc: fkittred(a)gwi.net Subject: Converting from telco Major-V, Major-H coordinates to Lat Long Any ideas on how to convert from telco "Major-V, Major-H" coordinates to latitude and longitude? Alternately, does anyone have a table of mapping CLLI codes to latitude and longitude? I am trying to programatically figure out the air distance between any two Verizon COs. regards, fletcher -- Fletcher Kittredge Great Works Internet 8 Pomerleau St. Biddeford, ME 04005-9457

1 0

Re: Annoying dynamic DNS updates (was Re: someone from attbi please contact me ...)
by Michael.Dillon＠radianz.com 29 Sep '03

29 Sep '03

>> It reminds me of the Netgear and U of Wisconsin time server SNAFU. >> http://www.cs.wisc.edu/~plonka/netgear-sntp/ >The difference is that Netgear admitted responsibility and worked with >UW to cope with the issue. Further, Netgear has funded UW in it's >cleanup efforts and generally stepped up to the plate. As much as I don't >care for Netgear's products, they did show decent corporate responsibility >when UW was able to escalate to the appropriate management at Netgear. Sounds like a great example to put before the judge when you sue Microsoft. Can anyone say "class action"? --Michael Dillon

4 3

Lucent/Avaya Cajun experiences
by Andy Grosser 29 Sep '03

29 Sep '03

This request is largely for anecdotal/historical purposes. The recent Foundry/Riverstone posts reminded me of a topic I'd kept meaning to broach. My organization will probably be replacing all of our L2/L3 Lucent/Avaya Cajun switches in the next few months with Catalyst 65XX series boxes. Our experience has largely been disastrous - 3 operational years have been filled with _constant_ HW and SW failures, buggy code (i.e. backplane suddenly stops all traffic forwarding), horrible tech support, lousy online resources (a la SW releases). Their M770 ATM gear hasn't been much better, and their PacketStar media gateways are still, surprisingly, limping along. Anyone care to share their own Lucent/Avaya experiences? Please feel free to reply off-list and I will provide an anonymous summary. Thanks. --- Andy Grosser, CCNP andy(a)meniscus.org ---

2 2

Re: ISPs blocking port 53? (was Re: Annoying dynamic DNS updates)
by Paul Vixie 29 Sep '03

29 Sep '03

> > the whole end-to-end argument depends on uniform clue distribution > > for scale. > ... > Getting vendors to supply more appropriate defaults offers better > scaling possibilities. Your complaint might fix one user's computer, > Microsoft updating the default behaivor would fix tens of millions > of users' computers. Which scales better? you've got a real mad on about software monopolies, and i guess i ought to join you since on any other day i'm just as worried. (the fact that dan geer lost his job over this issue makes it even more painful.) but in this case microsoft's culpability is toward their user, whereas the isp's culpability is toward me, so there are two "culpability segments" in the path, and i can't really complain to microsoft about these updates even if, as you point out, they are the ones who would find fixing it easiest, among all involved parties. > How can a Windows system have a fatal error every hour for days and > months, and the user not be aware of it until someone else calls them? from microsoft's point of view, the failure in that case is that they are not monetizing a condition which is very common amongst their users. MSN has the ability to sell domain names. windows has the ability to tell that a microsoft customer does not have a domain name, or does not own the one they are pretending to be in, or whatever. microsoft should not be waiting on complaints, nor should they have to feel any remorse before they fix this. the verb they should be considering is "monetize". > If Dynamic DNS Update is so critical that Microsoft feels the need to > enable it by default, why doesn't Microsoft pop an error dialog window > on the user's machine every time it fails? Then the user could decide > to fix the problem, or stop doing it. If the user doesn't know there > is a problem, why should he fix it? that's an excellent question, especially since it could have a "click here to send microsoft more of your money" button. but no matter how good an idea it is, my complaint is still that sending e-mail toward the whois contact for a network or AS# should elicit a clueful reply, and if it doesn't, then the key word we're looking for is "cost shifting". (and that, in case y'all wondered, is why this is relevant to nanog@.)

2 1