- Test - lists.nanog.org

someone from attbi please contact me regarding host 24.129.84.175
by Paul Vixie 29 Sep '03

29 Sep '03

noc@ and abuse@ are ignoring me as usual, so i'm spamming nanog@ in hopes of locating attbi clue. i need somebody who can educate one of your customers who is dns-updating me. re: [fh:i386] grep -c 'client 24.129.84.175.*update.*denied' messages 74 [fh:i386] zgrep -c 'client 24.129.84.175.*update.*denied' messages.?.gz messages.0.gz:67 messages.1.gz:43 messages.2.gz:106 messages.3.gz:206 messages.4.gz:215 messages.5.gz:104 PS. why is this so hard?

13 15

OT: co-lo DC Metro area non-rack-mount box?
by Brennan_Murphy＠NAI.com 29 Sep '03

29 Sep '03

Im posting this for a friend. Looking for a DC Metro area co-lo that will take a non-rack-mountable box for around $150/month or less. :) Looking for unlimted bandwidth. Respond directly to me please. Thanks, BM

1 0

Yet another address harvesting analysis idea
by Michael.Dillon＠radianz.com 29 Sep '03

29 Sep '03

>Supposedly if you put a newly installed, unpatched Windows box on the 'net, >with an Outlook address book full of fresh spamtrap addresses, you'll start >getting spam to those addresses in something like 3 hours. And if you buy a recently expired domain name and set up an SMTP server for it, then you will receive incoming email for quite a long period of time. Each one of those messages will have valid From and CC email addresses that you could collect. In order to truly secure the net against spammers we would need to secure both the email system and the DNS system. I use the word "system" in the context of General Systems Theory, to refer to everything connected with the transport of email across the Internet including the users, their interfaces, the MUAs, the MTAs and the protocols. Similarly for DNS, I include things like the domain name registries and registrars and their policies. Bandaid fixes only buy time, they don't fix the problem. --Michael Dillon P.S. ASRG is a good idea because it is systematically collecting and validating a lot of what we know about spam to make it easier for decision makers to understand the issues. http://www.irtf.org/asrg/

2 1

Re: ISPs blocking port 53? (was Re: Annoying dynamic DNS updates)
by Michael.Dillon＠radianz.com 29 Sep '03

29 Sep '03

> but no matter how good an >idea it is, my complaint is still that sending e-mail toward the whois >contact for a network or AS# should elicit a clueful reply, and if it >doesn't, then the key word we're looking for is "cost shifting". (and >that, in case y'all wondered, is why this is relevant to nanog@.) It's also relevant to the upcoming ARIN meeting in Chicago right after NANOG. There is a policy proposal to change the whois directory so that it only contains contact info for people who are ready, willing and able to act as contacts for an address block or AS number. Right now whois is a cesspool with too many people who are unable to do anything about network issues or who don't understand network issues or who have moved on and no longer exist. If we clean this up, then it is entirely reasonable for you to ask the community to give a higher priority to complaints from someone who is also listed as a whois contact. But right now I don't see any good way to systematically identify clueful complainers. --Michael Dillon

1 0

Re: Annoying dynamic DNS updates (was Re: someone from attbi please contact me ...)
by Michael.Dillon＠radianz.com 29 Sep '03

29 Sep '03

>Unfortunately, telling end users to disable a default setting is >rather difficult these days. Not if it's done the right way using the right language. For instance... ------------ Did you realize that your computer is probably wasting precious bandwidth and slowing down your Internet connection because of the wrong default setting? You can fix this problem and take back control of your connection with this small utility which resets the dynamic DNS settings to stop wasting your bandwidth. Go to http://0xdeadbeef.example.com/noddns.html and start surfing free. And don't forget to tell your friends too! ------------- In other words, Windows users don't typically change settings themselves but they do download small utilities that do nothing other than change one or two registry keys. >Back in beta days, the official explanation given was that the DNS >updating was a "value add" and that it would never be disabled as >a default as a courtesy to corporate customers. Corporate customers are smart enough to tick off a DDNS option during install or to automate the entire install process with a custom install script for their site. But MS is so big that the people making this decision probably had no idea how their product is really used in the real world. > larger ISPs ought >to include this "fix" as an option with their installation CDs. Alas, >we get back to the ongoing debate: adjust user prefs for them, for >their own good... or get the vendor to cooperate? Both. Create and distribute a tool that fixes the problem. Make sure the tool can run windowless as part of an ISP or corporate install script. Then sit back and watch while MS assimilates the functionality of this new tool in a later release. --Michael Dillon

1 0

Re: ISPs blocking port 53? (was Re: Annoying dynamic DNS updates)
by Paul Vixie 29 Sep '03

29 Sep '03

> whats disturbing is how many contact addresses for both whois and AS#'s > bounce sure, i agree, that's disturbing. however, it's a different problem than having mail get ignored or ignorebotted and then depref'd so low that nobody even bothers to call you or let you know whether a human ever say the message. when it's a spammer then i can understand that there might be money lost if the isp disco's them. that's evil and rude, but i understand it. when it's unwanted packet-level traffic, though, there is no revenue stream to be protected by the simple expedient of ignoring complaints -- ddos'ers do not pay for their outgo. what's happening in this case is simply that there isn't enough staff to deal with every issue that affects outside complainers. it turns out that this lack scales nicely, creating the same lack elsewhere, due to competitive pressure, general apathy toward whole classes of problems, and so forth. branding program. we need a branding program. is there still an isp consortium in existence or did they all just die like cix? we need a "better netkeeping seal of approval" stamp before the worseness goes through its next geometric progression.

2 1

Unauthorized DNS updates
by Lou Katz 29 Sep '03

29 Sep '03

Is there a way to configure bind so that when an **unauthorized** update comes in it enstates an address of the owner's choice? -- -=[L]=-

2 1

Re: ISPs blocking port 53? (was Re: Annoying dynamic DNS updates)
by Paul Vixie 28 Sep '03

28 Sep '03

> How should an ISP tell the difference between "good" DNS packets and "bad" > DNS packets? the bad ones are the ones people complain about. > You aren't complaining about your dynamic update packets or even all > dynamic updates. You are complaining about someone sending you packets > you don't want. And more precisely, you are complaining that Comcast is > failing to send you other packets you want to receive, i.e. a response to > your e-mail packets. yup. where "packets i do not want" could as easily be ddos ("zwil") or spam. > I've been thinking how to use ICMP to signal different types of > responses; and even how "smart" edges on both ends of a communication > could establish and enforce policies. Most of these are non-malicious > communications involving misconfigured systems. Edge communications > avoids problems with the host system, but has problems with multi-path > communications and source validation. the whole end-to-end argument depends on uniform clue distribution for scale.

2 1

OT: CPAN hacked or fubar'd?
by Eric Germann 28 Sep '03

28 Sep '03

Anyone know whats up with CPAN? http://www.cpan.org points to http://www.netcetera.dk Pointers would be appreciated and also if we can trust the CPAN module to install modules. ========================================================================== Eric Germann CCTec ekgermann(a)cctec.com Van Wert OH 45891 http://www.cctec.com Ph: 419 968 2640 Fax: 603 825 5893 "The fact that there are actually ways of knowing and characterizing the extent of one’s ignorance, while still remaining ignorant, may ultimately be more interesting and useful to people than Yarkovsky" -- Jon Giorgini of NASA’s Jet Propulsion Laboratory

2 2

address harvesting analysis idea
by Peter Galbavy 28 Sep '03

28 Sep '03

While sitting here watching bad TV, I had a thought(tm). Has anyone set-up a generic web-page, not linked from anywhere useful, which autogenerates a "contact e-mail" address (like deadbeef(a)example.com) and logs which IP reads what address (even using the remote IP as the username to provide) and then waits for the address to be used for SPAM ? Is there any use in doing this (to try to identify who is harvesting) ? Maybe I should go and eat some food, cool my head down. Peter

4 3