- Test - lists.nanog.org

manure distribution
by Petri Helenius 24 Sep '03

24 Sep '03

To put some semi-new information of the looping spam discussion; Here is a breakdown of the junk that took the priviledge of not arriving to my inbox but taking a detour to the spam/virus trap in the last few weeks: | count| Country| asnumber | asdescription | | 156 | IT | 3269 | TELECOM ITALIA | | 129 | US | 3561 | Cable & Wireless | | 89 | NL | 8737 | Planet Technologies BV | | 74 | UK | 2856 | BTnet UK Regional network | | 62 | UK | 5089 | NTL Group Limited | | 53 | US | 3356 | Level 3 Communications | | 53 | FR | 3215 | France Telecom Transpac | | 38 | BE | 5432 | SKYNETBE-AS | | 33 | UK | 5462 | Telewest Broadband | The suggestion I would make that if you are considering applying filters to block large geographical areas, here is a handy list to start from the top: 1/2 :-) |count| country| | 1813 | US | | 362 | CA | | 275 | IT | | 224 | UK | | 181 | NL | | 171 | CN | | 145 | AU | | 83 | JP | | 81 | FR | | 79 | BR | | 63 | KR | Pete

1 0

Re: monkeys.dom UPL being DDOSed to death
by Joe St Sauver 24 Sep '03

24 Sep '03

Hi, #This goes beyond spam and the resources that many mail servers are #using. These attacks are being directed at anti-spam organizations #today. Where will they point tomorrow? Many forms of breaking through #network security require that a system be DOS'd while the crime is being #committed. These machines won't quiet down after the blacklists are shut #down. They will keep attacking hosts. For the US market, this is a #national security issue. These systems will be exploited to cause havoc #among networks of all types and sizes; governmental and commercial. Note that not all DNSBLs are being effectively hit. DNSBLs which run with publicly available zone files are too distributed to be easily taken down, particularly if periodic deltas are distributed via cryptographically signed Usenet messages (or other "push" channels). You can immunize DNSBLs from attack, *provided* that you're willing to publicly distribute the contents of those DNSBLs. And when it comes to dealing with the sources of these attacks, we all know that there are *some* networks where security simply isn't any sort of priority. (For example, make it a practice to routinely see what ISPs consistently show up highly ranked on incident summary sites such as http://www.mynetwatchman.com/ ). Maybe the folks running those networks are overworked and understafffed, maybe they have legal constraints that limit what they can do, maybe their management just don't care as long as they keep getting paid. Who knows? Whatever the reason, no one is willing to depeer them or filter their routes, so they really are free to do absolutely *nothing* about vulnerable hosts or abusive customers. There are absolutely *no* consequences to their security inactivity, and because of that, none of us should be surprised that the problem is becoming a worsening one. Regards, Joe St Sauver (joe(a)oregon.uoregon.edu) University of Oregon Computing Center

13 18

RADB
by Christopher J. Wolff 24 Sep '03

24 Sep '03

Hello, On the RADB site, under features and benefits, the service claims to mirror "more than 30 other IRR databases." My challenge is that I need to list my information with RADB and don't want to go through the hassle of manually submitting every subnet owner and first-born when I can put a RWHOIS server up for ARIN. RADB should just poll my RWHOIS server. Thank you in advance for your advice. Regards, Christopher J. Wolff

2 1

RE: Another DNS blacklist is taken down
by Mark Segal 24 Sep '03

24 Sep '03

I think some RBLs might get better responses from the ISPs when they stop taking "collateral damage gets the abuse department's attention" attitudes.. Some RBLs cause many providers a LOT of headaches, so it is not surprising that when it is their turn to complain, the ISPs will just say: post to abuse.ddos.isp.net and we might get around to fixing it. :). Regards, Mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: Justin Shore [mailto:listuser@numbnuts.net] Sent: September 24, 2003 12:29 PM To: nanog(a)merit.edu Subject: Another DNS blacklist is taken down I thought ya'll might be interested to hear that yet another DNS blacklist has been taken down out of fear of the DDoS attacks that took down Osirusoft, Monkeys.com, and the OpenRBL. Blackholes.compu.net suffered a joe-job earlier this week. Apparently the joe-jobbing was enough to convince some extremely ignorant mail admins that Compu.net is spamming and blocked mail from compu.net. Compu.net has also seen the effects of DDoS attacks on other DNS blacklist maintainers. They've decided that the risk to their actual business is too great and they are pulling the plug on their DNS blacklist before they come under the gun by spammers. http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&selm=3f70e839%24 1%40dimaggio.newszilla.com Ron Guilmette, maintainer of the Monkeys.com blacklists has posted a farewell from Monkeys.com to news.admin.net-abuse.email. Ron cites the total lack of interest in the attacks by both big network providers and law enforcement authorities as the ultimate reason he's pulling the plug. http://groups.google.com/groups?q=%22Now+retired+from+spam+fighting%22&hl=en &lr=&ie=UTF-8&oe=UTF-8&selm=vn1lufn8h6r38%40corp.supernews.com&rnum=4 It's truely a sad day for spam fighters everywhere. So, my question for NANOG is how does one go about attracting the attention of law enforcement when your network is under attack? How does the target of such an attack get a large network provider who's customers are part of the attack to pay attention? Is media attention the only way to pressure a response from either group? These DDoS attacks have received some attention in mainstream media: http://www.msnbc.com/news/959094.asp?0cv=TB10 http://www.boston.com/news/nation/articles/2003/08/28/saboteurs_hit_spams_bl ockers Apparently it hasn't been enough. Legal remedies take too long and are cost prohibitive (unless you're the DoJ). Subpoenas and civil lawsuits take months if not years. Relief is needed in days if not hours. Justin

5 4

Re: Verisign Responds
by Paul Vixie 24 Sep '03

24 Sep '03

> See the NANOG archives for my post reguarding wildcard caching and set > comparison with additional resolver functionality for requesting if the > resolver wishes to receive wildcards or NXDOMAIN. oh... that wasn't a joke, then? there won't be a protocol change of that kind, not in a million years.

4 4

RE: monkeys.dom UPL being DDOSed to death
by sowens＠epik.net 24 Sep '03

24 Sep '03

Provide me a list of requirements and I'll see what I can do about the bandwidth, colo and BGP session. Shane -----Original Message----- From: John Payne [mailto:john@sackheads.org] Sent: Tuesday, September 23, 2003 7:41 PM To: nanog(a)merit.edu Subject: Re: monkeys.dom UPL being DDOSed to death --On Tuesday, September 23, 2003 6:11 PM -0400 Kai Schlichting <kai(a)pac-rim.net> wrote: > - BGP anycast, ideally suited for such forwarding proxies. > Anyone here feeling very adapt with BGP anycast (I don't) for > the purpose of running such a service? This is a solution that > has to be suggested and explained to some of the DNSBL operators. Anyone want to offer hardware, colo, bandwidth and a bgp session for a dnsbl anycast solution?

1 0

Re: "Class A Data Center"
by Scott Francis 24 Sep '03

24 Sep '03

On Wed, Sep 24, 2003 at 03:06:30PM -0400, devon(a)noved.org said: > On Wed, 24 Sep 2003, Scott Francis wrote: > > > I don't know if it qualifies as an "established standard", but ISTR that > > Steve Bellovin had a paper about various levels of reliability in data > > centers ... [searches] argh. I can't find it yet. Perhaps Mr. Bellovin can > > refresh my memory ... the paper I'm recalling had specifications for 5 or so > > different levels of reliability and redundancy in data centers (able to > > withstand criminal attack, armed attack, conventional explosives, nuclear > > explosion, acts of God, etc.) and was interesting reading. The focus, as I > > recall, was on the level of engineering required to reach various levels of > > uptime (99.9, 99.99, 99.999, etc.). > > > > This ringing a bell for anyone else? > > Do you mean <http://www.donelan.com/design/general.html>? doh! Indeed I do mean that file. I got Bellovin and Doneland mentally transposed for some reason. Apologies all (still thought that document was a good read, though). -- Scott Francis || darkuncle (at) darkuncle (dot) net illum oportet crescere me autem minui

1 0

"Class A Data Center"
by Bob German 24 Sep '03

24 Sep '03

Can anyone point me to a set of standards that define a "Class A Data Center?" I'm not asking for requirements, but an actual pointer to standards hammered out by an organization or governing body. Thanks.

8 8

Rack space in Chicago.
by John Palmer 24 Sep '03

24 Sep '03

Looking for rack space in Chicago to house 2 - 2U servers, a cisco 3620, a hub and flat panel/keyboard tray. Will need net access and 8 ip addresses. Low bandwidth usage. Contact me at user info at domain adns.net.

1 0

The *.com/robots.txt
by Guy Coslado (GC0111) 24 Sep '03

24 Sep '03

I've found inconsistencies in search engines mainly with domain name having transient status. Such dn inherit a new IP , the *.com IP ( the sitefinder IP). And sitefinder itself has its own inconsistency: Here an example using Nestscape or Mozilla (my IE6 config gives other results). http://www.pallet-containers-unlimited.com/bizdc.html http://sitefinder.verisign.com/lpc?url=pallet-containers-unlimited.com/bizd… That gives a link in Did You Mean ? We did find these similar Web addresses. http://www.pallet-containers-unlimited.com/bizdc.html And now searching with sitefinder http://sitefinder.verisign.com/spc?sb=pallet-containers-unlimited.com&searc… If VeriSign sitefinder doesnt take care of this case, what can we wait with other search engines ? The query : http://www.pallet-containers-unlimited.com/robots.txt gives User-agent: * Disallow: / is also a false answer that can confuse lot of http agents => for simple example, sites with dn in REDEMPTIONPERIOD can be suppressed or blacklisted from search engines indexes for a while. Because nobody knows already all the side effects I'm not sure having a robots.txt here is the best choice. On the other hand SE indexes can keep undefinitively no (more) existent sites without the *.com/robots.txt Possibly the *.com redirect will give us other surprises with search engines. Guy Coslado. http://www.coslado.com Bots & Smart Agents Pour la Guilde des metiers du logiciel: admin(a)fr.scguild.org http://www.fr.scguild.com

1 0