- Test - lists.nanog.org

Weekly lamer report
by Rob Thomas 08 Sep '03

08 Sep '03

Hi, NANOGers. Don't forget to check for lame DNS delegations! There are 13066 entries in the lamer report for the week ending 07 SEP 2003. These entries are often indicators of greater problems with name server configurations. <http://www.cymru.com/DNS/lame.html> Thanks, Rob, for Team Cymru. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

3 3

Qwest.Net/USWest.Net SWIP Contact for 63.224.0.0/13?
by Andy Ellifson 07 Sep '03

07 Sep '03

Can a Qwest.Net/USWest.Net person that can remove an ARIN SWIP within the IP Block of 63.224.0.0/13 please contact me off list? I'm having problems getting an entry removed since I no longer have those IP addresses and the related service. Thanks! Andy Ellifson

1 0

Re: BMITU
by Jim Shankland 07 Sep '03

07 Sep '03

> Qmail doesn't scale well with large injection rates. Qmail > scaling in that sort of manner is completely dependant upon > the filesystem. Now this may have changed, but not that long > back everything in submission was in one dir, processing in > another dir, just like sendmail (by default) does. This > caused the queue manager to stuff up something wicked at high > injection rates. Hans Reiser would argue that that reflects a limitation of the filesystem, rather than of qmail; and that apps should not have to code around such unreasonable filesystem limitations. And reiserfs goes to considerable effort to achieve good performance on directories containing thousands of small files. This would imply that if you're going to use qmail in a high-volume environment, you might consider using reiserfs, also. Jim Shankland

2 1

RE: BMITU
by Robert Bridgham 07 Sep '03

07 Sep '03

I have been a UNIX geek for quite a few years and in that time I have had the pleasure or displeasure of working with many mail packages. The 2 that I had the most exposure to was Sendmail and Qmail. Now barring any flames about sendmail, once I had exposure to Qmail I will never turned back. Qmail was developed with security in mind, it has never had a security bug in the years it has been available, it is scalable, reliable and easy to administrate. Now I will not bore you with every spec or detail about how it runs but even Hotmail.com uses Qmail as it's MTA. This the one of the leading webmail sites in the world with between 80-100million accounts, and still running strong. I would definitely put my vote to Qmail for any organization, any size! - Robert Bridgham > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Fisher, Shawn > Sent: Thursday, September 04, 2003 11:03 AM > To: Nanog List (E-mail) > Subject: BMITU > > > > This is my first post so please be gentle. > > I would like to get some opinions on the Best Mailserver in > the Universe. > Is there a more appropriate list for this question? > > I have looked at Communigate Pro, IMAIL, and others. > > I am interested in integrated solution that can scale to handle 500k > accounts > > Any experience good / bad would be great. > > Thanks > > /SF > >

3 2

RE: BMITU
by McBurnett, Jim 07 Sep '03

07 Sep '03

> Robert Bridgham wrote: > > > it runs but even Hotmail.com uses Qmail as it's MTA. This > the one of the > > leading webmail sites in the world with between > 80-100million accounts, and > > still running strong. I would definitely put my vote to > Qmail for any > > organization, any size! > > > telnet mx1.hotmail.com 25 > Trying 65.54.252.99... > Connected to mx1.hotmail.com. > Escape character is '^]'. > 220 mc5-f7 Microsoft ESMTP MAIL Service, Version: > 5.0.2195.5600 ready at > Sat, 6 > Sep 2003 13:51:52 -0700 > quit > 221 mc5-f7 Service closing transmission channel > Connection closed by foreign host. > > I wouldn't recommend it myself, but well... ummm, yeah. > > -Jack I can't remember the whole story, but when Microsoft bought hotmail they converted it to exchange server. if was using qmail.. and that was very stable... Later, J

1 0

AOL Postmaster contact?
by Eric Whitehill 06 Sep '03

06 Sep '03

Please give me a jingle offlist. Thanks, -Eric

1 0

RE: Re: CalPOP contact? HTTP CONNECT scanning]
by Jeroen Massar 06 Sep '03

06 Sep '03

-----BEGIN PGP SIGNED MESSAGE----- lynn [mailto:lynn@calpop.com] wrote: > Thanks for your lengthy letter- it's just the kind of letter we need - > complete with specific cases so that we can go and investigate and > terminate any individual cases that might not be terminated yet. Three days later... > The idea that CalPOP is in the spamming business is a joke, > we hate spam just as much as anyone else, That indeed why you are listed in spamhouse. > among our clients is Interland, Boeing Airlines, lots of the > entertainment industry, HilaryDuff.com, Jeopardy.com, Kingworld.com, Seal.com, - > ecommece companies like BizCrafter.com, So you've got 7 domains which are not spamming. But you apparently have a lot of clientelle that comes back and back causing you to earn bucks with signup fees and terminating them "directly" (ahem) when somebody complains in public. Good service indeed, for spammers. > and we even have servers for anti-virus > clients like Panda Software and AVG, and tons of Game servers here... we > do not have 1,000 spamming servers - in fact we terminate anyone who is You only got a couple, not 1000, spamming servers? Every spamming server is one too much. Terminate them. > found to be spamming instantly as it is a violation of our terms of > service which is in the signed contract that every one of our customers has signed. Which is nowhere to be found publicly, not even a public statement about this, unless you want to record this as your "CalPOP AUP". > Because we have inexpensive bandwidth and servers we get all types of > stuff - our network pretty much mirrors the internet at large- > a little bit of everything, but because we have a set-up fee we > usually don't get as many spammers as some of the other "free set-up" "We don't get as many spammers as some other..." Aka you _DO_ get spammers. This is going in the right direction. Admittance of your problems is better than denial. > cheap server companies. We turn people off for spamming all the time and You turn them off and probably back on again because they signup again, and only till you get a big public offense you suddenly turn them off. > we keep thier set-up fee so we are > not the company to come to for spamming! Indeed, you are in the perfect business of earning lots of money from spammers by cashing in their spamming fees. > abuse(a)calpop.com works too. I was just offering an > alternative by given out support(a)calpop.com as it seemed that > people were looking for additonal means > to contact us- we are open 24 hours so you can always call. > And our support(a)calpop.com assigns tickets- that was a great > idea to have the abuse assign tickets too and we will set that up. Ahem, so support and abuse are different and they don't work? > > The client at 216.240.140.204 has been terminated. So that's > a closed case- told you we were quick! After three days of PUBLIC messages and you getting it via some of your personal close friends who is in the same business :) > We have the signed signatures of every customer agreeing to > our acceptable use policy which of course calls for zero tolerance > for spam which is why you don't find it online- we are so adament > about abuse that we make every customer fill out a contract > AND SIGN IT PERSONALLY agreeing to our anti-abuse contract and we > make them sign-it and fax it back before we will put them online. If they sign it maybe you can earn MUCH MORE money ($$$ bling bling) if you put in a clause that when they spam that they have to pay you a fine for spamming. This will really keep those 'customers' away and earn you even more money. Though all your setup revenues will ofcourse go down, but you will get a better network and respect from the rest of the internet and maybe then even real non-spamming customers. > That's why you can't search google and find our policy. > However- since you suggested it, we will create an online > webpage just for that purpose - so that other people can see our > policy not just our customers. Step in the right direction. > The idea that we don't work as vigorusly as anyone else is > simply false, if anything, we are one of the most proactive > fighters of spam in the industry. Why where you in spamhouse again? http://www.spamhaus.org/sbl/listings.lasso?isp=calpop.com 216.240.129.0/26 is listed on the Spamhaus Block List (SBL) Jul 26 2003 - 8:13hrs GMT Daniel Licht Open proxy spammer. "Meet The Bullet-Proof Proxy Hijacking Licht Brothers - Daniel and Ernst" http://google.com/groups?selm=vi1pvep3jlil1f@corp.supernews.com "MORE: Licht Brothers Proxy Hijacking Team Really Gets Around!" http://google.com/groups?selm=vi3o5mat1rlpd9@corp.supernews.com Very pro-active indeed. Very speedy *rofl* > We have just finished working with the FBI to catch an > alleged spam ring known as Pilot Holding. Aha, you got forced to do track it down by law... And was that company owned by yourself or was it some other nice tax-evading contstruction like some other person who was caught redhanded and denies everything. Or where you talking about the fact that the FBI caught up to you and you needed to "work" with them? > I don't think people realize how big our operation really is We do, 1000 servers, you told that already. Basically nobody cares how big your (spamming?) "operation" really is, it spams through proxies. You should not do that not with 1 box and not with a 1000. > - our building for example > has only 5 clients - XO, QUEST, ICG, CALPOP, and EQUINIX and > that's why it can appear like we are a small operation that is > spamming when in fact we are a big operation that gets a > few spammers on it now and then, like all big and fast > growing operations. Now you are big again? Oh my, the contradictions. Also that you are in the same housing facility as another ISP doesn't relate to the fact that your abuse department doesn't do a thing unless complaints go up in public. <SNIP bottom quoted message> I think you now know how everybody thinks about your "operation". I also sincerely hope that you clean up your act and become a respectable hoster that does _really_ work on abuse reports. As for your ticket numbering system, you might want to let it send updates to the complainants that the matter has been sorted out and possibly the actions you took. Greets, Jeroen - -- "I am in the gutter now, but at least this gutter is mine" -- M.B. Former Spammer -----BEGIN PGP SIGNATURE----- Version: Unfix PGP for Outlook Alpha 13 Int. Comment: Jeroen Massar / jeroen(a)unfix.org / http://unfix.org/~jeroen/ iQA+AwUBP1oV/ymqKFIzPnwjEQIZQwCYjWHelhmHrRdP9urfQlHREDA86QCgmhAC Tk4vtLfrNSu9BC3q/dMthRU= =ECFW -----END PGP SIGNATURE-----

1 0

More on the DDoS Attack
by Matthew Sullivan 06 Sep '03

06 Sep '03

To those providers who have started filtering some if not all of the spoofed traffic, and those have been nuking the zombied hosts. Please accept my thanks, it seems that enough has been stopped so the DNS and websites are now available again. Thanks, Matthew

3 4

Important changes to the .org tld today.
by Rodney Joffe 06 Sep '03

06 Sep '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 During the root zone (.) update later today, specifically with root zone serial number 2003090501, the entries for .org will me modified. The current zone entry contains the following authoritative nameservers for the .org tld: org. 2D IN NS A7.NSTLD.COM. org. 2D IN NS L7.NSTLD.COM. org. 2D IN NS G7.NSTLD.COM. org. 2D IN NS F7.NSTLD.COM. org. 2D IN NS M5.NSTLD.COM. org. 2D IN NS TLD1.ULTRADNS.NET. org. 2D IN NS TLD2.ULTRADNS.NET. org. 2D IN NS J5.NSTLD.COM. org. 2D IN NS I5.NSTLD.COM. org. 2D IN NS C5.NSTLD.COM. org. 2D IN NS E5.NSTLD.COM. Effective with the 2003090501 load, the entry will reflect the removal of the Verisign NSTLD.COM nameservers. The zone entry will therefore contain the following only: org. 2D IN NS TLD1.ULTRADNS.NET. org. 2D IN NS TLD2.ULTRADNS.NET. If you have the 9 ??.NSTLD.COM nameservers cached or hard coded in any way, you may wish to flush your cache or modify your nameservers in the near future to avoid any inconsistent or stale data, and you may want to make your system administrators, NOCs and customer support groups aware of the changes. The .org zone file will continue to be pushed to the Verisign nameservers for a short period of time. However due to the fact that the UltraDNS nameservers publish and propagate zone changes globally within 5 minutes, rather than the twice daily update schedule of the Verisign nameservers, answers from the NSTLD.COM nameservers may be out of date and inconsistent with the actual SOA for up to 24 hours after a change is accepted by the Public Interest Registry (PIR.org) Any questions or concerns regarding this change should be directed to the PIR (http://www.pir.org) Sincerely, Rodney Joffe CTO and Chairman UltraDNS Corp. http://www.ultradns.com -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.2 iQA/AwUBP1iJJEa3pZtqJ3OwEQJvwACdHkKdAW3TqDSpOJVoguhFAx0YebwAnAw9 c6fW3PeXcgvjwhvLIPaxRVEW =+m9c -----END PGP SIGNATURE-----

6 6

RE: Re: CalPOP contact? HTTP CONNECT scanning]
by Jeroen Massar 06 Sep '03

06 Sep '03

-----BEGIN PGP SIGNED MESSAGE----- [This message apparently was sent off list, but I think it is in everybodies interrest to know how the apparent owner/CEO/CTO whatever thinks about this, and possibly enlightening everybody where we do have to send abuse complaints.] lynn [mailto:lynn@calpop.com] wrote: > CalPOP has a vigorus anti-spam policy and > terminates any customers that are found to be spamming. > CalPOP has a ZERO TOLERANCE for spam and any abuse complaints should be sent to > support(a)calpop.com where they will be handled very quickly. 216.240.140.204 - - [03/Sep/2003:06:27:15 +0200] "CONNECT 65.54.253.99:25 HTTP/1.0" 200 2366 "-" "-" 216.240.140.204 - - [03/Sep/2003:06:27:17 +0200] "CONNECT 65.54.167.5:25 HTTP/1.0" 200 2366 "-" "-" 216.240.140.204 - - [03/Sep/2003:06:27:19 +0200] "CONNECT 65.54.253.230:25 HTTP/1.0" 200 2366 "-" "-" 216.240.140.204 - - [03/Sep/2003:06:27:20 +0200] "CONNECT 65.54.167.230:25 HTTP/1.0" 200 2366 "-" "-" 216.240.140.204 - - [03/Sep/2003:06:27:22 +0200] "CONNECT 65.54.254.151:25 HTTP/1.0" 200 2366 "-" "-" And see the beginning of the thread for more stuff and older dates. See: http://www.merit.edu/mail.archives/nanog/msg13312.html Let's lookup those IP's in whois: 8<------------------------------------------ jeroen@purgatory:~$ date Sat Sep 6 12:23:47 CEST 2003 jeroen@purgatory:~$ whois 216.240.140.204 OrgName: WebVision/ATMLINK Inc. OrgID: ATML Address: 3250 Wilshire Blvd. Address: Suite 1405 City: Los Angeles StateProv: CA PostalCode: 90010 Country: US NetRange: 216.240.128.0 - 216.240.159.255 CIDR: 216.240.128.0/19 NetName: CALPOP-COMMUNICATIONS NetHandle: NET-216-240-128-0-1 Parent: NET-216-0-0-0-0 NetType: Direct Allocation NameServer: NS1.CALPOP.COM NameServer: NS2.CALPOP.COM Comment: CalPOP Communications RegDate: 1999-09-22 Updated: 2003-01-11 TechHandle: BSB-ARIN TechName: Bacsa, Sam Samuel TechPhone: +1-714-330-9227 TechEmail: sam(a)calpop.com OrgAbuseHandle: CALPO-ARIN OrgAbuseName: CalPOP Abuse OrgAbusePhone: +1-213-351-1355 OrgAbuseEmail: abuse(a)calpop.com OrgNOCHandle: CNO4-ARIN OrgNOCName: CalPOP Network Operations OrgNOCPhone: +1-213-351-1355 OrgNOCEmail: noc(a)calpop.com OrgTechHandle: BSB-ARIN OrgTechName: Bacsa, Sam Samuel OrgTechPhone: +1-714-330-9227 OrgTechEmail: sam(a)calpop.com # ARIN WHOIS database, last updated 2003-09-05 19:15 # Enter ? for additional hints on searching ARIN's WHOIS database. - --------------------------------->8 Let me see... support(a)calpop.com... I don't see no support(a)calpop.com but I do see an abuse(a)calpop.com.. hmm so the "CEO" of this "company" doesn't even know where abuse is sent to? And they apparently don't handle abuse sent to the abuse address. > The idea that CalPOP is "knowingly facilitating this > behaviour" is simply not true. Then why don't you fix your customers and reply to abuse reports. Even having a ticket tracking system with an auto reply containing the wording that you are going to work at it and a pointer to your AUP, which you apparently don't have: http://www.google.com/search?hl=en&lr=&ie=UTF-8&oe=UTF-8&safe=off&q=AUP+sit… http://www.google.com/search?hl=en&lr=&ie=UTF-8&oe=UTF-8&safe=off&q=Use+Pol… Turn up 0 records, oh and: http://www.google.com/search?hl=en&lr=&ie=UTF-8&oe=UTF-8&safe=off&q=abuse+s… http://www.google.com/search?hl=en&lr=&ie=UTF-8&oe=UTF-8&safe=off&q=spam+si… Don't return anything either. http://www.google.com/search?hl=en&lr=&ie=UTF-8&oe=UTF-8&safe=off&q=spam+ca… On the other hand show a LOT of spamming complaints. Thus dear "Lynn" go fix your network. Apparently you do want to do it as you did want to reply to the message, thus I sincerely hope you do so. > For the record, Patrick Greenwell never worked for CalPOP.com, Inc. - > although he did work for AirlineReservations.Com, Inc. for a VERY > short time when AirlineReservations.Com, Inc. owned CalPOP and was > under different management. Thus you worked for him, perfect :) > CalPOP has over 1,000 servers at it's Downtown Los Angeles > facility alone and is growing very fast and, of course, termination of > spammers is largely complaint driven- after all, there is such a thing as an > opt-in list - and there are various liability reasons and "common carrier" laws > which prevent CalPOP from prying into the servers of its customers to see > what they are doing . Good advertisement, thus you have 1000 spamming boxes? > CalPOP's Los Angeles data Center at Carrier Center 600 > W. 7th - a facility in which Patrick Greenwell has never been in so > obviously allot has changed. Why should he be going there if you just said that you can't pry into those servers anyways? > Patrick is a great and very knowledgable guy and I am > surprised to find him saying bad things about a network that he > was supposedly in charge of. Oh, so suddenly he DID manage it, quite odd that you say that he didn't just a few lines up. > Anyway, send any complaints, IF ANY, our way and we will handle them > accordingly. Fix your whois records, people all around the world don't even want to know about your operation in the spamming business. Also there is quite an apparent proof, see the other list managers that you really don't give a cents worth about anything related to being something in handling abuse and making you a good netizen. > Lynn Hoover > CalPOP.com, Inc. > 213-627-1937 > support(a)calpop.com Where can that address be found in whois again? > ----- Original Message ----- > From: "Jeff S Wheeler" <jsw(a)five-elements.com> > To: <lynn(a)calpop.com>; <ross(a)calpop.com> > Sent: Thursday, September 04, 2003 7:31 PM > Subject: [Fwd: Re: CalPOP contact? HTTP CONNECT scanning] > > > > Dear Sirs: > > > > I thought you should read what is being said about your > organization on > > the NANOG (North American Network Operators Group) mailing > list by an > > individual who claims to have been in your employ. I > imagine you will > > have an enforcable NDA with said individual. Oh god NDA's... SUE SUE SUE SUE SUE!!!! We are in the US again :) <grin> Greets, Jeroen -----BEGIN PGP SIGNATURE----- Version: Unfix PGP for Outlook Alpha 13 Int. Comment: Jeroen Massar / jeroen(a)unfix.org / http://unfix.org/~jeroen/ iQA/AwUBP1m5kCmqKFIzPnwjEQIu1QCfYPls1CyfHxVV4tUwMPT7ON/BdeIAnA5i W+6/G/7Vp1eEE3SwTXIkMiBT =fPI5 -----END PGP SIGNATURE-----

1 0