- Test - lists.nanog.org

Re: Pesky spammers are using my mailbox
by Vinny Abello 31 May '03

31 May '03

At 02:39 PM 5/31/2003, you wrote: >On Sat, 31 May 2003, Stephen J. Wilcox wrote: > > > seems some spammers are using one of my personal domains as the from > > field in their emails, the local-part being random so I cant easily > > block it. > > > > Has anyone any advice on tracking them down and making them stop? > >Tactical baseball bat at close range? :) > >I and a number of coworkers are getting similar bounces, except the >spammers are actually using our full email addresses as the from address. >The first few cases of this, I wrote off to things like KLEZ...but >recently I've gotten actual spam bounces where my work email address was >the original from. > >I suppose it could possibly still be something like KLEZ and it's grabbing >a spam from their inbox and sending that out with a forged from. There are known spamming viruses making their rounds that I believe behave like klez and others that use known email addresses. A couple of our customers have been infected by them and have had their computers unknowingly sending out spam. Vinny Abello Network Engineer Server Management vinny(a)tellurian.com (973)300-9211 x 125 (973)940-6125 (Direct) PGP Key Fingerprint: 3BC5 9A48 FC78 03D3 82E0 E935 5325 FBCB 0100 977A Tellurian Networks - The Ultimate Internet Connection http://www.tellurian.com (888)TELLURIAN There are 10 kinds of people in the world. Those who understand binary and those that don't.

1 0

Re: dnsbl's? - an informal survey
by Crist J. Clark 31 May '03

31 May '03

Oh, the irony of this thread being initiated by someone with an @covad.com address. ;) I don't have an answer for the originator, but this reminded me of something about DNSBLs that I've been meaning to ask. Does anyone know of a black hole list of dynamic cable and DSL clients? What I really want is one that mimics AOLs block list of dynamic IPs. I HUGE portion of the spam we were (and still are) receiving came out of attbi.com, swbell.com, pacbell.com, covad.com, etc. DSL and cable customers, and almost no legitimate mail. Manangement resisted blocking those IPs until AOL lead the way. "If they can't send to AOL either, they can't complain that we're being unreasonable. They'll have to break down and fix their mail servers." However, trying to figure out which blocks of IPs these ISPs use for dynamic connections (which we want to block) versus static allocations (which we may not wish to) is non-trival. The few "dynamic" DNSBLs I've found haven't provided enough documentation about what they actually are trying to include. Plus, when I tested them, they didn't seem to block some of the most obvious culprits. (Before anyone starts arguing the merits of blocking dynamic addresses, you might as well try to tell me why you need to run an open relay and I shouldn't block it. I have a dynamic address at home, and I am blocked by my own filters at work. I figured out long ago that my home MTA needs to route outgoing email via my ISP's outgoing SMTP servers, and it has never caused me any problems.) -- Crist J. Clark | cjclark(a)alum.mit.edu | cjclark(a)jhu.edu http://people.freebsd.org/~cjc/ | cjc(a)freebsd.org

8 11

RE: .mil domain
by McBurnett, Jim 31 May '03

31 May '03

Let me say this: I am former military.. Worked in Military IT. AND worst case situation, use www.cert.mil Or if not that bad.. Call the public affairs officer at the branch of service.. Tell him you need help, tell him to put you in contact with the local Info systems type. and away u go.. I wish I still had the DoD and BoS NOC #'s but I don't.. If you want to complain to a US Military net admin and just find one, well it is not for lack of contact info.. It is lack of trying. And yes I have sent stuff to the military.. Recently got a huge nessus scan and DoS attack attempt from a military block.. went to that services web site and found the Info systems # on the web.. AND IT WORKED..... We used to say a Marine was not happy unless he had something to complain about... But it is the same for most all of us..... just my 10 cents worth.. Inflation ya know... J Lazyness is just the act of being tired before doing the work.... > > Your escalation route goes to the OSD-CIO (Office of Secretary > Defense) in the 5-sided building. That was Art Money's office but > I don't know if he's still there. I'd cc: the Inspector General > for whichever branch as well...and the FTC. > In other words, when one can't get a response, check with NANOG. :) -Jack

1 0

Level3 and BBNow (BroadbandNow) ??
by John Brown 31 May '03

31 May '03

seems that there is an ongoing many hour issue between level3 and broadband now anyone have any news. can't get anyone to answer at bbnow, and level 3 isn't saying anything john

1 0

.mil domain
by Steve Waddington 31 May '03

31 May '03

Our whole netblock 202.154.64.0/18 seems to be barred from anything .mil. Domain name resolution, MX, IP traceroute, the lot. Anyone able to shed any light on this? Any advice/feedback appreciated. Regards, Steve

17 21

Salt Lake NANOG Dinner and Movie, Reloaded
by Pete Kruckenberg 31 May '03

31 May '03

For those who will be in Salt Lake for NANOG on Sunday evening, June 1, and looking for fun socializing: Aviva Garrett from Juniper suggested a NANOG field trip Sunday evening to see Matrix Reloaded. Great idea. I will make the necessary arrangements (reservation at Happy Sumo Sushi Bar, hotel shuttle to get back) for anyone who will RSVP. We would leave right after the 5:00pm tutorial Sunday evening, ride TRAX light rail to The Gateway for a 6:00pm dinner at Happy Sumo (or any Gateway restaurant you'd like, see http://www.boyercompany.com/gateway/directory-a.html for a complete list). We'd catch the 8:15 (or if we eat fast, the 7:15) Reloaded show, then ride the hotel shuttle back at 11:00 (or 10:00 if we catch the 7:15 show). Let me know if you are interested, I will make the necessary arrangements. If you want to come just for dinner or for the movie, RSVP anyways and let me know that. This is a pay-your-own-way event. Though any vendors willing to fund the field trip will not be turned down. Pete.

2 1

RE: .mil domain
by Mike Damm 30 May '03

30 May '03

Counter: leave everything as it is. If they are willing to provide the hardware, bandwidth, and administrative costs to run root servers, they can block whoever they want. Just like if you run a web server you can block anyone from accessing it that you want. If you don't like it, start up your own root zone, there isn't anything stopping you. Not that it matters much in the big scheme of things; most modern resolvers will give preference to root servers they can actually reach. I for one am pretty happy with where E, G, and H are. Cogent and VeriSign's networks can hardly handle power cycles, let alone nuclear wars. --- Michael Damm, MIS Department, Irwin Research & Development V: 509.457.5080 x298 F: 509.577.0301 E: miked(a)irwinresearch.com -----Original Message----- From: Mark Borchers [mailto:mborchers@igillc.com] Sent: Friday, May 30, 2003 12:09 PM To: nanog(a)merit.edu Cc: stephen(a)sprunk.org; listuser(a)numbnuts.net; Mike Tancsa Subject: RE: .mil domain Suggestion: migrate the current MIL root servers to the DREN network. Thus they would be easily accessible from DoD's networks, while residining in front of any MIL filters or blackhole routers relative to the rest of the Internet. > On Fri, 30 May 2003, Mike Tancsa wrote: > > > > > At 01:15 PM 30/05/2003 -0500, Stephen Sprunk wrote: > > > > >For the same reason anyone else accepts their routes -- > because they want to > > >be able to reach them. If they don't want to reach _you_, that's their > > >choice. > > > > As Sean Donelan pointed out, the fact that 2 of the root name > servers are > > inside their network, there is more to the issue than you > suggest.... I for > > example want people in Australia to be able to reliably lookup > DNS info on > > my domains. The .mil people have decided to hamper this process. > > I agree. The root servers should have no filtering in place to block any > demographics (unless of course a given node is DoSing them). > > The last time I tried to contact a .mil to report an open relay that was > being abused, I was accused of being a spammer that had "hacked" their > server. Since that time I reject .mil mail. > > Justin >

2 1

UPS failure modes (was: fire at NAC)
by Robert Boyle 30 May '03

30 May '03

At 12:27 AM 5/29/2003 -0400, you wrote: >Sheesh. Heh. > >We're still here. > >Part of a rectifier in a Liebert UPS let loose, causing a momentary fire. >That is, until the FM200 quenched it. > >Since there seems to be interest, I will post the post-mortem to the list. I had a little 2000VA rackmount Liebert UPS catch fire in 1997 and another new and improved Liebert model almost catch fire about a year later. Both were operating well within specified input, load, and temperature parameters. I haven't really trusted them since.I bought dual MGE UPSes for our datacenter in 2002. I figured if E****s can flip them on and off randomly and massively overload them all in an environment which is 95 degrees F, then they should hold up nicely for us when lightly loaded at 65 degrees F. :) The reason for this rambling post is to ask if others have had similar problems with other UPS brands. I think they should have enough fail-safes built-in that they are never the CAUSE of an outage much less a fire! Based on my experience and NAC's incident today, is that an unreasonable expectation? I don't think manufacturers specify MTBF (mean time before fire) figures for UPS units. What have others experienced as the failure mode(s) for their UPS(s)? The static transfer switch should drop the load onto line/bypass power immediately and shut down the inverter while tripping the battery disconnect at the first sign of trouble - does this work as designed and advertised most of the time or just some of the time? Of those with UPS failure histories, what has happened in your situation? Robert Tellurian Networks - The Ultimate Internet Connection http://www.tellurian.com | 888-TELLURIAN | 973-300-9211 "Good will, like a good name, is got by many actions, and lost by one." - Francis Jeffrey

21 32

Re: Moving G and H off .MIL hosts (was Re: .mil domain)
by Kevin Day 30 May '03

30 May '03

> >If the .MIL network can't provide International Internet service, is it >time to move the g.root-servers.net and h.root-servers.net off their >current .MIL hosts to better locations to serve the entire Internet. >Otherwise .MIL policies reduce the robustness of the overall Internet. > >Heck, even when Paul Vixie did his original black-hole lists, he made >certain that even the worst spammers could still use f.root-servers.net. Whatever filtering some .MIL sites may or may not be doing, I don't believe that g or h.root-servers.net are affected. I've tried tracing to them from systems in .uk, .tw, .ru, .kr, .and hk and I get the same results from them as I do from my ARIN allocated US IP blocks. (trace to G with no problem, H has ICMP blocked at gw328-hroot.arl.army.mil, but UDP port 53 seems to get though fine) To be honest, I'd be rather surprised if .MIL as a whole did ANYTHING jointly. The number of independant networks, AS's, borders and administrators would make it really difficult for any blanket policy to take effect everywhere. -- Kevin

1 0

Off topic - New "Nanog" gene
by Joseph T. Klein 30 May '03

30 May '03

"In recognition of that power, the researchers have named the gene "nanog," a reference to the mythological Celtic land of Tir Nan Og, whose fairy-like residents are said to stay forever young." http://www.washingtonpost.com/wp-dyn/articles/A55817-2003May29.html -- Joseph T. Klein <This space available. Ask for my resume.> PSTN: +1 415 462 1534 Mobile: +1 414 628 3380

4 3