- Test - lists.nanog.org

Spam thread
by Susan Harris 25 Apr '03

25 Apr '03

Can we please stop the spam thread ("Open relays and open proxies") and take it to a more appropriate list: http://www.claws-and-paws.com/spam-l/spam-l.html -- spam-l list for spam prevention and discussion http://www.abuse.net/spamtools.html -- spam tools list for software tools that detect spam net.admin.net-abuse.email | net.admin.net-abuse.usenet -- usenet lists See the NANOG email list AUP and FAQ for more information: http://www.nanog.org/aup.html http://www.nanog.org/listfaq.html

3 2

Re: Open relays and open proxies
by Joe St Sauver 25 Apr '03

25 Apr '03

#Date: Fri, 25 Apr 2003 10:39:11 -0500 #From: Jack Bates <jbates(a)brightok.net> #Subject: Re: Open relays and open proxies #In-reply-to: <1459D594-7731-11D7-BA1C-00039312C852(a)isc.org> #Message-id: <3EA9569F.6010400(a)brightok.net> [snip] #Yet how many spams are sent out advertising pr0n and the websites never #cancelled? How many get rich schemes? The last I checked, #no-more-viruses.com was still at it and wasting my time by sending their #filth to every role account I have. And of course, no-more-viruses.com is a perfect example of a domain whose web site obtains transit from that fabulous far eastern "bulletproof ASN", AS9929. For context, AS9929 also has provided transit for hosts from a few other domains you may recognize, such as: -- antiagingway.com -- bannedcd.org -- bargin-inetwork.com -- bestemailoffers.com -- domainsforeveryone.com -- easyvling.com -- eclipseway.com -- edrugsale.com -- edrugshop.net -- emailoffer.us -- fastcasinobuilder.com -- genvia4u.com -- grantgiveawayprogram.com -- interactivepoker.net -- kokiya.com -- kososo.com -- lovingtouches.org -- lowratemortgages.info -- lzzemu.com -- mnjmtech.us -- my-vling.com -- n0hastlem0rtgage.com -- pharmsafe.net -- prescription4you.com -- real-sales.net -- removethisemail.com -- reserveadot.com -- romna.com -- rxmedsovernight.com -- snbm-online.com -- sys-630.com -- twofy.com -- vlingbuy.com -- xeemo.com -- yomsa.com -- yourplace.com.br -- yourvling.com -- zizikey.com -- 9top9.com Based on what I'm seeing from route-views.oregon-ix.net, AS9929 appears to be (primarily) a customer of AS1239 and AS3561. If you are unhappy with AS9929's support role for spammers, you *could* try contacting AS9929 directly (but I wouldn't bother wasting my breath). I believe that to make progress on the let's-go-after-their-web-hosting approach, you'll need to convince AS9929's upstreams, Sprint and Cable and Wireless, to pull the plug (which they probably won't do) or at least convince them to enforce an acceptable use policy on their customers (which they can only do if they're willing to pull the plug for non-compliance, which I don't believe they're willing to do in this case). But hey, I'd love to be proven wrong. Regards, Joe

2 1

RE: 60 Hudson
by Drew Weaver 25 Apr '03

25 Apr '03

I suppose they are different companies my mistake. However usually when a company is teetering on the brink of bankruptcy, and they sell to another company it usually does not stand to indicate that the 'teetering on bankruptcy' organization is going to remain in place after being acquired. The old FNSI customers are on cogent's network, and they now pay Cogent so for all useful purposes FNSI is no longer 'operating'. Also a quick look on http://www.fnsi.com/ pretty much says it all. Later, -Drew -----Original Message----- From: Todd A. Blank [mailto:todd.blank@ipoutlet.com] Sent: Friday, April 25, 2003 2:22 PM To: Drew Weaver; jeffrey(a)villageworld.com Cc: nanog(a)merit.edu Subject: RE: 60 Hudson Correct me if I am wrong, but the FiberNet to which you are referring in 60 Hudson is a different "FiberNet" than the one that was headquartered in Columbus, OH and recently sold to Cogent. As far as I know, they (the FiberNet in Columbus) are not out of business, unless selling to or being taken over by Cogent is synonymous with "going out of business" :-) This is not in defense or support of either of these organizations. It is merely a clarification of the facts. Maybe Drew is trying a new variation on the "Joe Job" thing :-) Sincerely, Todd A. Blank IPOutlet LLC -----Original Message----- From: Drew Weaver [mailto:drew.weaver@thenap.com] Sent: Friday, April 25, 2003 12:57 PM To: 'Jeffrey Meltzer' Cc: 'nanog(a)merit.edu' Subject: RE: 60 Hudson This might explain why fiber net went out of business and sold to cogent?? -Drew -----Original Message----- From: Jeffrey Meltzer [mailto:jeffrey@villageworld.com] Sent: Friday, April 25, 2003 10:32 AM To: nanog(a)merit.edu Subject: Re: 60 Hudson Quick followup, apparently the current issue i'm having with them is a "bad oc48 card" (again, shocker), and they don't have one in stock, and had to put a "rush order" in for a new one...You'd think a carrier would keep this sort of thing in stock. Went down late yesterday afternoon, and with this being Friday, i'm sure this won't be fixed until late Monday. Use this as an indicator before choosing FiberNet :) Jeff -- Jeffrey Meltzer Network Services Manager ICS/VillageNet 631.218.0700 On Fri, Apr 25, 2003 at 09:42:22AM -0400, Jeffrey Meltzer wrote: > > As someone who uses FiberNet in 60 Hudson (and ethernet link back to 25 > Broadway) i'd say avoid them like the plague. In the ~6 months that i've > had this circuit (aparently it's provisioned over an OC48), it's gone down > at least 4 times, possibly more, sometimes for upwards of 12 hours at a time > (starts at 10% packet loss, then just keeps growing). Their answer every > times has been "bad OC48 card". I don't know whether that's just the line > they're feeding me (I have a feeling it is), or their hardware vendor is > just garbage, but they don't appear to have the ability to keep this circuit > up for more than 3 weeks at a time. > > At one point they sold us on upgrading it from Ethernet to FastE, we said ok > maybe that will be better. However, they took down the 10M link at around 9pm > on a Friday night, and by 7pm Sunday night they hadn't had the 100M link up > yet so we just told them to forget it... > > Since the circuit is just backup, i've been testing FiberNet as fo late. > Yesterday, after I started seeing packet loss I waited at least 2 hours to > call them, to see if they'd notice the issue themselves. Of course as usual > they didn't. > > I'm fairly sure i'm the only customer they are providing this > service to between 25B and 60H, otherwise for sure they'd know by know > (unless they are dedicating a full OC48 to my 10M link, which would be a > whole other story itself). > > I'm unsure, however, if this is how they provision service inside (suite to > suite) 60 Hudson, it'd be fairly strange if they did, but FiberNet is > turning out to be a fairly strange company. > > ..just my experience :) > > JEFF > > -- > Jeffrey Meltzer > Network Services Manager > ICS/VillageNet > 631-218-0700 > > On Wed, 16 Apr 2003, Simon Lockhart wrote: > > > Speaking to Level3, they're saying that the Fibernet suite on the 1st floor > > is the best place for interconnects to other suites in the building.

1 0

Zebra Router???
by Tom Daly 25 Apr '03

25 Apr '03

Hi All, I'm trying to find out what peoples experiences regarding the throughput of Zebra on a FreeBSD Box. My configuration is as follows: Intel Pentium III 1.40G 1 Gig RAM 2x <Intel Pro 10/100B/100+ Ethernet> (one internal, one external) on board. This box is running as a simple static router, i.e. one subnet on the inside, Internet feed on the other side. No BGP, no RIP, no OSPF. Pretty simple, eh? So the goal is to know the bandwidth limitation of this router. Any ideas? I've heard numbers of 35Meg, 40 Meg, etc, however, I have not recieved a good reason backing it up. Can anyone offer some input on this? Regards, Tom Daly -- Tom Daly tom(a)dyndns.org Chief Infrastructure Officer Dynamic DNS Network Services http://www.dyndns.org/

14 14

Re: Open relays and open proxies
by Joe St Sauver 25 Apr '03

25 Apr '03

Hi Adi, #I am seeing an increasing number of hosts on our network become an open #proxy. So far the response to this has been reactive, once I receive #complaints from spam victims I deal with the source of the problem. The sheer act of having an abuse address and acting on reports received on it puts you a leg and a half up on a number of other service providers who have chosen to studiously ignore abused open proxies on their networks. #Is there an accepted way of blocking open proxy and open relay traffic at #the network edge? I think this is going to be an increasingly difficult problem to attack via blocks on specific ports; that is, while some folks may suggest blocking 1080/tcp, 3128/tcp, 5490/tcp, 6588/tcp, 8080/tcp, etc., you should be aware of an emerging class of viruses which are designed to create open proxies on uncommon and non-standardized high numbered ports which can then be exploited by the party controlling that virus (sort of a "make proxy hosts to order" operation). Jeem is probably the canonical example of this. The sheer magnitude of the problem also argues against manual construction of ACL's on a host-by-host basis; to date, having looked at this issue for maybe six months now, I believe the number of *known* open proxies is on the order of 120K hosts, few of which are sequentially disposed into nice CIDR-able netblocks (unless you're okay with the concept of lumping sheep with goats in the case of some thoroughly larded ISPs, if I may mix my metaphors). What's really needed is some way to take open proxy DNSBL data and instantiate a dump of that data onto a suitable appliance. It is probably too much state to burden a reasonable sized border route with, but you could imagine other devices that could probably handle it (at least for moderate speed flows), much as there are currently middle boxes which rip open packets to target peer to peer traffic. If you're interested in the issue of open proxies, you may want to see the paper I presented this April in Arlington VA at the Internet2 Member Meeting entitled "The Open Proxy Problem." Since that was a "suit" meeting, the talk backfills a bit about proxies at the start, but you can flip through the bits that are old news pretty easily. PDF and PowerPoint versions are available online at http://darkwing.uoregon.edu/~joe/proxies/ Regards, Joe St Sauver (joe(a)oregon.uoregon.edu) University of Oregon Computing Center

11 20

Re: 60 Hudson
by Jeffrey Meltzer 25 Apr '03

25 Apr '03

As someone who uses FiberNet in 60 Hudson (and ethernet link back to 25 Broadway) i'd say avoid them like the plague. In the ~6 months that i've had this circuit (aparently it's provisioned over an OC48), it's gone down at least 4 times, possibly more, sometimes for upwards of 12 hours at a time (starts at 10% packet loss, then just keeps growing). Their answer every times has been "bad OC48 card". I don't know whether that's just the line they're feeding me (I have a feeling it is), or their hardware vendor is just garbage, but they don't appear to have the ability to keep this circuit up for more than 3 weeks at a time. At one point they sold us on upgrading it from Ethernet to FastE, we said ok maybe that will be better. However, they took down the 10M link at around 9pm on a Friday night, and by 7pm Sunday night they hadn't had the 100M link up yet so we just told them to forget it... Since the circuit is just backup, i've been testing FiberNet as fo late. Yesterday, after I started seeing packet loss I waited at least 2 hours to call them, to see if they'd notice the issue themselves. Of course as usual they didn't. I'm fairly sure i'm the only customer they are providing this service to between 25B and 60H, otherwise for sure they'd know by know (unless they are dedicating a full OC48 to my 10M link, which would be a whole other story itself). I'm unsure, however, if this is how they provision service inside (suite to suite) 60 Hudson, it'd be fairly strange if they did, but FiberNet is turning out to be a fairly strange company. ..just my experience :) JEFF -- Jeffrey Meltzer Network Services Manager ICS/VillageNet 631-218-0700 On Wed, 16 Apr 2003, Simon Lockhart wrote: > Speaking to Level3, they're saying that the Fibernet suite on the 1st floor > is the best place for interconnects to other suites in the building.

1 1

is anybody filtering their root-ns sources?
by Paul Vixie 25 Apr '03

25 Apr '03

the table at http://www.root-servers.org/ intends to make it possible to filter out bad aspaths toward root servers. is anybody using it?

1 0

Re: Open relays and open proxies
by Jeffrey Race 25 Apr '03

25 Apr '03

On Fri, 25 Apr 2003 09:03:15 -0700 (PDT), Joe St Sauver wrote: >approach, you'll need to convince AS9929's upstreams, Sprint and Cable and >Wireless, to pull the plug (which they probably won't do) or at least >convince them to enforce an acceptable use policy on their customers (which You can *eventually* get Sprint to shut down offenders, but you have to be extremely persistent and you have to get the name of a human at the firm. I never managed to do via their abuse function. I succeeded when I found a Sprint human on a discussion group, whom I shamed into contacting the abusedroids internally. It still took weeks :( Jeffrey Race

1 0

RE: Open relays and open proxies
by Mike Damm 24 Apr '03

24 Apr '03

Block port 25 inbound and outbound, and setup a cluster of managed, authenticated, secure, mail relays (both in and out) for your customers. You're never going to get all the proxy ports, but regardless to send spam they have to hit port 25 on the outbound. I don't want to stir up old debates about SMTP filters on the edge, but I do think it's a viable solution if you provide a simple to use alternative for your userbase. (God knows I have had enough problems with sales staff plugging laptops into foreign networks and trying to get back to our mail boxes) --- Michael Damm, MIS Department, Irwin Research & Development V: 509.457.5080 x298 F: 509.577.0301 E: miked(a)irwinresearch.com -----Original Message----- From: Adi Linden [mailto:adil@adis.on.ca] Sent: Thursday, April 24, 2003 12:11 PM To: nanog(a)merit.edu Subject: Open relays and open proxies I am seeing an increasing number of hosts on our network become an open proxy. So far the response to this has been reactive, once I receive complaints from spam victims I deal with the source of the problem. Is there an accepted way of blocking open proxy and open relay traffic at the network edge? Adi

1 0

RE: Cogent Problems?
by McBurnett, Jim 24 Apr '03

24 Apr '03

Core routers down all over the backbone? If anyone gets more details, I would be curious.. >-----Original Message----- >From: Basil Kruglov [mailto:basil@cifnet.com] >Sent: Thursday, April 24, 2003 9:58 AM >To: nanog(a)merit.edu >Subject: Re: Cogent Problems? > > > >On Thu, Apr 24, 2003 at 08:39:11AM -0500, Basil Kruglov wrote: >> >> On Thu, Apr 24, 2003 at 09:20:55AM -0400, Brian S. Adelson wrote: >> > >> > Cogent is stating they are aware of a network outage but they are >> > unaware of duration or cause. They have opened up master >TT: HD26558. >> >> According to the person I just talk to, at 0837CST, the Core >router in >> Chicago went down and it will be up momentarily...obviously >no sign of that >> yet. > >It's up and passing packets now, I called again after 5m of >waiting and I've >been told they're tracking it under HD26558; some of their >core routers went >down all over the backbone, reason is still unknown. > >-Basil @ CIFNet >

1 0