- Test - lists.nanog.org

RE: anybody else been spammed by "no-ip.com" yet?
by Rowland, Alan D 10 May '02

10 May '02

For more on EarthLink's Port 25 policy see: http://help.earthlink.net/port25/ Best regards, Al Rowland -----Original Message----- From: Joel Baker [mailto:lucifer@lightbearer.com] Sent: Thursday, May 09, 2002 7:26 PM To: nanog(a)merit.edu Subject: Re: anybody else been spammed by "no-ip.com" yet? On Fri, May 10, 2002 at 11:27:10AM +1000, Terence Giufre-Sweetser wrote: > > Now there's a good idea, and it works, I have several sites running a > "port 25" trap to stop smtp abuse. > > To stop port 25 abuse at some schools, the firewall grabs all outgoing > port 25 connections from !"the mail server", and to !"the mail server", > and runs then via "the mail server", which stops header forging, mass rcpt > to: abuse, and vrfy/expn probing. Anything that goes past the filters has > a nice clear and traceable received by: line. > > If a few of the larger pre-paid isp's could simply filter port 25 on their > accounts, add some sanity checking (like, a user must be using a valid > email address in the from:/return-path:/reply-to: lines, etc) and reject > other abuse like rcpt to: stacking. Plus, add a anti-bulk email check, > like razor or checksum clearinghouse, (yeah, seriously, checksum the > outgoing emails, if some humans somewhere have said "this is spam", then > /dev/null or BOUNCE the outgoing email.) > > I'd even be inclined to place these filters at the border to smaller > downstream isp's, let them register their valid email domains, any user > from their network trying to send invalid email, or email that is listed > in razor, just kill it or auto-refer to the abuse desk. > > [This may sound expensive, but on reflection, a US$2K box with BSD could > handle 20Mbps of port 25, remember only port 25, nothing else, you would > place one behind your dial up infrastructure, or several for a large site, > and your "transparent smtp proxy" would pay for itself by killing off a > lot of your abuse@ work. There was many ways of redirecting the port 25 > packets, have a look at all the good work done on port 80 transparent > proxies.] > > // :), patent pending? No, the concept is hereby commited to the public > domain. // Earthlink was doing this for basically all of their consumer-grade (dialup, most of the ADSL, etc) customers in 1999 (well, almost certainly earlier than that, but I can only personally speak to it being in place then). It doesn't stop absolutely everything, but it's a very good 95% first pass filter. Don't forget to allocate support queue time for explaining to folks why they can't do SMTP relaying through their other provider where they have a hosting account, though... (Business customers were exempted, but paid hefty setup fees and monthly fees, and if I recall the contract correctly, forfeited all of them for AUP violations, which explicitly included UCE). Keeping the filters up to date is often a painful excercise in assignment coordination testing, too... -- *************************************************************************** Joel Baker System Administrator - lightbearer.com lucifer(a)lightbearer.com http://users.lightbearer.com/lucifer/

3 2

gTLD Informational Message
by Verd, Brad 10 May '02

10 May '02

This is an Informational Message to the internet community: VeriSign Global Registry Services will be changing the IP address for k.gtld-servers.net in the authoritative NS set for com/net/org. The change will be reflected in zone serial # 2002051001 The new set of servers authoritative for these TLDs will be: A.GTLD-SERVERS.NET. 518400 IN A 192.5.6.30 G.GTLD-SERVERS.NET. 518400 IN A 192.42.93.30 H.GTLD-SERVERS.NET. 518400 IN A 192.54.112.30 C.GTLD-SERVERS.NET. 518400 IN A 192.26.92.30 I.GTLD-SERVERS.NET. 518400 IN A 192.43.172.30 B.GTLD-SERVERS.NET. 518400 IN A 192.33.14.30 D.GTLD-SERVERS.NET. 518400 IN A 192.31.80.30 L.GTLD-SERVERS.NET. 518400 IN A 192.41.162.30 F.GTLD-SERVERS.NET. 518400 IN A 192.35.51.30 J.GTLD-SERVERS.NET. 518400 IN A 210.132.100.101 K.GTLD-SERVERS.NET. 518400 IN A 192.52.178.30 E.GTLD-SERVERS.NET. 518400 IN A 192.12.94.30 M.GTLD-SERVERS.NET. 518400 IN A 192.55.83.30 This will not require any change to root.cache file and both the new and old k.gtld-servers.net will provide answers for com, net, and org in parallel to accommodate the zones TTL's. ------------------------------------------------------------ Brad Verd Resolution Systems Operations Manager Verisign Global Registry Services http://www.verisign-grs.com Email: bverd(a)verisign.com ------------------------------------------------------------

1 0

gTLD Informational Message
by Verd, Brad 10 May '02

10 May '02

This is an Informational Message to the internet community: VeriSign Global Registry Services will be changing the IP address for k.gtld-servers.net in the authoritative NS set for com/net/org. The change will be reflected in zone serial # 2002051001 The new set of servers authoritative for these TLDs will be: A.GTLD-SERVERS.NET. 518400 IN A 192.5.6.30 G.GTLD-SERVERS.NET. 518400 IN A 192.42.93.30 H.GTLD-SERVERS.NET. 518400 IN A 192.54.112.30 C.GTLD-SERVERS.NET. 518400 IN A 192.26.92.30 I.GTLD-SERVERS.NET. 518400 IN A 192.43.172.30 B.GTLD-SERVERS.NET. 518400 IN A 192.33.14.30 D.GTLD-SERVERS.NET. 518400 IN A 192.31.80.30 L.GTLD-SERVERS.NET. 518400 IN A 192.41.162.30 F.GTLD-SERVERS.NET. 518400 IN A 192.35.51.30 J.GTLD-SERVERS.NET. 518400 IN A 210.132.100.101 K.GTLD-SERVERS.NET. 518400 IN A 192.52.178.30 E.GTLD-SERVERS.NET. 518400 IN A 192.12.94.30 M.GTLD-SERVERS.NET. 518400 IN A 192.55.83.30 This will not require any change to root.cache file and both the new and old k.gtld-servers.net will provide answers for com, net, and org in parallel to accommodate the zones TTL's. ------------------------------------------------------------ Brad Verd Resolution Systems Operations Manager Verisign Global Registry Services http://www.verisign-grs.com Email: bverd(a)verisign.com ------------------------------------------------------------

1 0

users of xacct?
by Mark Turpin 10 May '02

10 May '02

I'm interested to hear from those of you that might be using xacct, and your thoughts on the product. To keep traffic down on the list, just reply to me. If you are providing cable modem service and using xacct I'd really like to talk to you. For those of you that ask for a summary of the replies I receive, I will pass opinions, not names. Thanks, -Mark -- To a dog, you're one of the family. To a cat, you're one of the help.

1 0

RE: Effects of de-peering... (was RE: ratios)
by James Smith 10 May '02

10 May '02

>-----Original Message----- >From: E.B. Dreger [mailto:eddy+public+spam@noc.everquick.net] >Sent: Friday, May 10, 2002 10:13 AM >To: nanog(a)merit.edu >Subject: Re: Effects of de-peering... (was RE: ratios) > <snip> > >Hmmmm.... maybe there should be a "list of peering policies" site >a la Jared's NOC page. ========== Interesting idea. Include verifiable user comments as to what the policy actually is as exemplified by actual practice vs. what they say it is (or should be)... James H. Smith II NNCDS NNCSE Systems Engineer The Presidio Corporation

2 1

Re: Effects of de-peering... (was RE: ratios)
by E.B. Dreger 10 May '02

10 May '02

Hmmmm.... maybe there should be a "list of peering policies" site a la Jared's NOC page. BTW, has anybody else tried calling the toll-free Sprint NOC number listed on puck.nether.net? Is this a new alternative to on-hold muzak? ;-) (To prevent slashdotting said INWATS line without totally blowing the punchline... let's just say one needs a credit card handy to continue the call.) -- Eddy Brotsman & Dreger, Inc. - EverQuick Internet Division Phone: +1 (316) 794-8922 Wichita/(Inter)national Phone: +1 (785) 865-5885 Lawrence ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Date: Mon, 21 May 2001 11:23:58 +0000 (GMT) From: A Trap <blacklist(a)brics.com> To: blacklist(a)brics.com Subject: Please ignore this portion of my mail signature. These last few lines are a trap for address-harvesting spambots. Do NOT send mail to <blacklist(a)brics.com>, or you are likely to be blocked.

1 0

RE: ratios
by Dean S Moran 10 May '02

10 May '02

Stephen J. Wilcox wrote: >Your quality of life is affected by being turned down for peering how? Who said I was turned down for peering? When I buy a pipe from an internet provider, I buy it under the assumption that I'm going to be able to see the entire internet from it. I know that probably any given moment, that some small part of the internet is going to be inaccesible due to outages or routing loops, but I do not expect to lose a path to another provider for days because my upstream decides to bully the competition. I depended on, and had customers who depended on, being able to reach AS174, and for years this "just worked" so there was no need to multihome. Short outages, or even overnight outages never hurt us, so single-homing was the way to go. All of that changed when C&W depeered from PSI. I lost a lot of money due to Mr. Jansen's fascism. Understand now? Dean >Steve > > _____________________________________________ Free email with personality! Over 200 domains! http://www.MyOwnEmail.com

3 2

Re: IP renumbering timeframe
by David R Huberman 10 May '02

10 May '02

I'm not a lawyer and cannot answer the questions you pose. However I fail to see why the interesting legal principles you are espousing have anything to do with the original topic of this thread: an upstream revoking an assignment upon the severing of its relationship with its downstream.

2 1

Re: anybody else been spammed by "no-ip.com" yet?
by Paul Vixie 10 May '02

10 May '02

> I hate to sound like the big idiot here, but what exactly in the email > you received indicates no-ip.com spammed? It looks to me like you just > have some secret "admirer" who thought you wanted a no-ip.com account, > and no-ip.com emailed you to confirm that you do want the account. spam is like pollution in that (a) whenever you're not sure if you're doing it, you probably are, and (b) if everybody did whatever it is, life would be universally worse for, well, everybody. > Random disclaimer: Yes, we're a competitor of no-ip.com's... And yes, we > used to send similar emails to people signing up for an account, > although nowadays instead of sending them an initial password we send a > confirm URL instead. that's the right approach. no-ip's problem was they presumed my permission.

8 10

RE: ratios
by smd＠clock.org 10 May '02

10 May '02

| I lost a lot of money due to Mr. Jansen Tough. Sean. (who do you blame for losing alot of credibility? aliens?)

1 0