- Test - lists.nanog.org

Re: Monitoring, Flow Stats (Re: spam whore, norcal-systems)
by Dean Anderson 03 Feb '99

03 Feb '99

At 12:55 PM 2/3/1999 -0500, Christopher Neill wrote: >On Tue, Feb 02, 1999 at 09:43:41PM -0500, Dean Anderson wrote: >> Of course, this is all moot with mutual consent. But then you have to show >> where Norcal signed off on Verio's policy. Since they aren't Verio's >> customer, it doesn't seem likely they agreed to Verio's policy. And of >> course, if Norcal claims they didn't agree to allow Verio to monitor and >> publish their traffic, and Verio has no paper that Norcal did agree, it >> seems difficult for Verio to prove that Norcal did agree. Which adds up to >> something called "exposure". > >Read our policy: http://www.qual.net/support/aup.html > >Our customer, let's call them "X", agrees to our policy. Our policy clearly states that their connection is at will, and can be terminated or restricted at any time by us. > >So there you have it, CYA. I did read it. It seems to be geared to dialin users. It mentions 2701 (stored communications) and says it will comply with applicable laws. However, perhaps you could send me a copy of the agreement that I signed with Verio. Or perhaps you can give me a copy of the agreement Norcal signed with Verio. I'm two providers away from Verio. Norcal is 3 providers away from Verio. Privacy laws apply to our communications that go through Verio. That was the purpose: To control your behavior when given access to our communications. But you also didn't answer answer the big question: Does Verio think that it can monitor and publish the communications that pass through it? Apparently it does. Your Peers should take note of that. Their customers should take note of that, too. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 0

brief followup (more DNS abuse)
by bmanning＠vacation.karoshi.com 03 Feb '99

03 Feb '99

you can also lookup many(most) ASN's using dig. %dig <yourASN>.rdi.int txt If you want to update/correct the entry, I can put in a pointer for you to keep your own data, like so: ;; QUERY SECTION: ;; 267.rdi.int, type = TXT, class = IN ;; ANSWER SECTION: 267.rdi.int. 1d11h59m27s IN TXT "CICNET2-AS;[CIC-NS-ARIN]" ;; AUTHORITY SECTION: 267.rdi.int. 1d11h59m27s IN NS puck.nether.net. 267.rdi.int. 1d11h59m27s IN NS thorn.blackrose.org. 267.rdi.int. 1d11h59m27s IN NS dns.voyager.net. ;; ADDITIONAL SECTION: dns.voyager.net. 11h19m25s IN A 209.153.128.4 ... % dig @dns.voyager.net. 267.rdi.int. any ; <<>> DiG 8.1 <<>> @dns.voyager.net. 267.rdi.int. any ; (1 server found) ;; res options: init recurs defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 14, AUTHORITY: 3, ADDITIONAL: 3 ;; QUERY SECTION: ;; 267.rdi.int, type = ANY, class = IN ;; ANSWER SECTION: 267.rdi.int. 1D IN SOA puck.nether.net. jared.nether.net. ( 199809071 ; serial 8H ; refresh 4H ; retry 4W ; expiry 1D ) ; minimum 267.rdi.int. 1D IN NS puck.nether.net. 267.rdi.int. 1D IN NS dns.voyager.net. 267.rdi.int. 1D IN NS thorn.blackrose.org. 267.rdi.int. 1D IN TXT "RPS 0000 person:Jared Mauch" 267.rdi.int. 1D IN TXT "RPS 0001 descr: NetherNet Networks" 267.rdi.int. 1D IN TXT "RPS 0002 aut-num: AS267" 267.rdi.int. 1D IN TXT "RPS 0003 as-in: from AS1225 80 accept ANY" 267.rdi.int. 1D IN TXT "RPS 0004 as-in: from AS234 80 accept ANY" 267.rdi.int. 1D IN TXT "RPS 0005 route: 204.42.252.0/22" 267.rdi.int. 1D IN TXT "RPS 0006 route: 3FFE:900:5::0/48" 267.rdi.int. 1D IN TXT "RPS 0007 admin-c: JM568" 267.rdi.int. 1D IN TXT "RPS 0008 tech-c: JM568" 267.rdi.int. 1D IN TXT "RPS 0009 source: DNS" ...

1 0

Re: Monitoring, Flow Stats (Re: spam whore, norcal-systems)
by Roeland M.J. Meyer 03 Feb '99

03 Feb '99

Here is something germane to this thread. >Date: Tue, 02 Feb 1999 19:42:43 -0500 >From: "vinton g. cerf" <vcerf(a)MCI.NET> >Subject: EC Directive on IP Addresses and Privacy >X-Sender: vcerf(a)shoe.reston.mci.net >To: "ISOC Members Discussion" <isoc-members-discuss(a)lyris.isoc.org> >Reply-To: ISOC Members Discussion <isoc-members-discuss(a)lyris.isoc.org> >List-Owner: <mailto:ISOC-members-discuss-owner@lyris.isoc.org> >X-Message-To: [rmeyer(a)mhsc.com] > >I thought this would interest you - these are NOT my words but >the words of the source of the message to me: > > > >"Yesterday, I learned from a very well-placed U.S. Government source that >European law enforcement officials have told their American counterparts >that they interpret the E.C. Data Protection Directive as prohibiting >Internet service providers from maintaining records of users' IP >addresses unless necessary for service or billing. This position indicates >that E.C. officials consider both dynamic and static IP addresses to be >subject to the Directive as "personal data'...relating to an...identifiable >natural person" under Article 2(a) of the Directive. Therefore, it is >being interpreted that the European Directive prohibits the retention of >dynamic IP addresses even by an ISP unless it is used for billing purposes >(which is rarely the case). > >If shared by others in the E.C., the position could have significant >implications for Internet business models." >================================================================= > >See you at INET'99, San Jose, CA, June 22-25,1999 >http://www.isoc.org/inet99/ > > ___________________________________________________ Roeland M.J. Meyer - e-mail: mailto:rmeyer@mhsc.com Internet phone: hawk.lvrmr.mhsc.com Personal web pages: http://staff.mhsc.com/~rmeyer Company web-site: http://www.mhsc.com ___________________________________________________ KISS ... gotta love it!

2 1

Re: spam whore, norcal-systems.net
by Paul Vixie 03 Feb '99

03 Feb '99

phil(a)whistler.intur.net (Phil Howard) writes: > I don't want to ban spam. I think if two consenting adults wish to carry > on a spamming relationship, that should be their choice, not mine nor the > government's. What I do want to do is NOT SERVICE spam. I elect to offer > a service to deliver NON-SPAM mail, because I believe there is more of a > market in NON-SPAM mail than there is in either SPAM mail or a mix. There's a slight definitions problem with this. The definition of "spam" in the e-mail context is "unwanted bulk or robotic messages." It makes no difference whether the unwanting is being done by the carrier or by the recipient. Anything that two consenting adults do together is by definition NOT "spam" because "spam" is "nonconsensual". Note that there are plenty of newsgroups and mailing lists where this thread could be relevant if expanded upon. I have therefore directed replies to myself personally. -- Paul Vixie <paul(a)vix.com>

1 0

Re: spam whore, norcal-systems.net
by Dean Anderson 03 Feb '99

03 Feb '99

At 03:38 PM 2/1/1999 -0800, I Am Not An Isp wrote: >At 03:35 PM 2/1/99 -0800, Dan Hollis wrote: >>On Mon, 1 Feb 1999, I Am Not An Isp wrote: >>> What type of monitoring are you talking about? Or are you saying I cannot >>> filter packets through my network as I please? >> >>You havent been on nanog for very long, otherwise youd know that all >>your networks and all your packets belong to Dean, our resident pro-spam >>nut. I take issue with being called pro-spam. It's kind of like calling anyone who thinks Clinton should be impeached anti-democrat, or perhaps pro-republican. I am pro-law. If you want to ban spam, there is a way to do that: People banned junk faxes, and banned telemarketers from calling your cell phone. However, they did that by passing laws. Not by taking the law into their own hands. Secondly, the internet isn't a lawless place. There are already laws which control how you must behave. Especially if you might have access to other peoples private electronic communications. We don't need more privacy laws. We just need to enforce those we have. Unfortunately, many people think they can do whatever they please. I suppose if the laws aren't enforced, then they are right. --Dean [note that I don't take issue with being called a nut ;-) I think Clinton should be impeached, too.] ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

3 2

Re: spam whore, norcal-systems.net
by Dean Anderson 03 Feb '99

03 Feb '99

You have the right to monitor, but you weren't monitoring in the first place. And thats why Ravi's monitoring and publishing is legal? You sound like the manager on Dilbert. I'll tell you what. I'll do my part. I'll assume I was a recipient of one of Norcals spams (in fact I think I was), and thus being one of the parties whose electronic privacy was violated I can complain about Verio's unauthorized monitoring. I didn't give Verio permission. Norcal didn't give Verio permission. I'll forward the post to norcal and verio's agents, and the US attorney. Thanks. Now maybe we can get a court case on record. --Dean At 11:17 AM 2/2/1999 -0500, Christopher Neill wrote: >Thanx Dean.. actually, we do have the right to monitor traffic on our network, which we werent doing in the first place. What we had was an extended access list that matched tcp port 25 outbound from their /23, and logged that. Since they were using us as a transit provider for their dubious activities we are well withing our rights per our AUP (http://www.qual.net/support/aup.html) But its too late for you to take back your post. Think first. > > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

4 3

Cisco >224.0/3 problems..
by James Rishaw 03 Feb '99

03 Feb '99

Hello all, Ran into a problem, thought maybe someone else has run into this and knows of a "fix", if this is intentional or what not. It seems that Cisco IOS has a problem dealing with addresses above 224.0.0.0/3. This came up in an e-mail with Paul Vixie about MAPS RBL, where I asked him why 224+ wasn't filtered. The reply was: IOS ignores it. GateD likes it, IOS doesn't. I'm finding that IOS isn't propagating routes, etc., (nor will it even seem to *recognize*) address space above 224. To wit: As a /3: bordercore1.chi(config)#ip route 224.0.0.0 224.0.0.0 Null0 %Invalid destination prefix /8, close to the end of address space: bordercore1.chi(config)#ip route 252.0.0.0 255.0.0.0 null0 %Invalid destination prefix As a /24: bordercore1.chi(config)#ip route 225.0.0.0 255.255.255.0 Null0 %Invalid destination prefix bordercore1.chi(config)#ip route 230.0.0.0 255.255.255.0 Null0 %Invalid destination prefix It's not Null0: bordercore1.chi(config)#ip route 234.128.230.123 255.255.255.255 h9/0 %Invalid destination prefix bordercore1.chi(config)#ip route 241.102.34.93 255.255.255.255 atm4/0 %Invalid destination prefix I know this is all "multicast" space, but considering classless routing and CIDR, shouldn't this space be usable and able to be manipulated ? -jamie -- jamie rishaw (efnet:gavroche) @ AIS / Exodus "I want peace on earth and goodwill towards men." "We are the United States Government. We don't do that sort of thing." --sneakers

2 1

trent's talk on the MAX
by Brett_Watson＠enron.net 03 Feb '99

03 Feb '99

someone might mention to trent (i'm watching at home) that the very exclusion tactics the "big guys" use to decide not to come to an exchange or not peer with someone is precisely what coop.net did when they decided not to let the "little guys" come to the MAX by saying "they're high maintainance". pot, kettle, black. -brett

2 1

SF Bay Area LEC discussion list?
by Jim Browne 03 Feb '99

03 Feb '99

I'm trying to gauge interest among San Francisco Bay Area operators (ISPs and knowledgeable corporate customers) with respect to starting a mailing list or forum dedicated to the notification of LEC operational issues specific to the Bay Area. I'm willing to run a list with a strict AUP. Such a list would allow customers of PacBell, ICG, TCG, Brooks, MFS, etc. to communicate outages such as the current DS0 shredding between Brooks and PacBell at SJ SpacePark. I'm interested in an emphasis on the tandems and PRI (dialup) related problems, but I'm sure there would be ample room for notifications regarding fiber cuts, DACS failures, and similar issues. If you are interested drop me a line. If sufficient interest arises, I'll make it a full-blown list. Jim Browne jbrowne(a)jbrowne.com "I wish journalism would return to its glory days, when principled incorruptible men like William Randolph Hearst and Joseph Pulitzer were in charge."- Vanessa Jackson, Piano Teacher, www.theonion.com

4 7

netscan.org being smurfed?
by Dalvenjah FoxFire 03 Feb '99

03 Feb '99

So it had to happen. http://netscan.org - the site listing all the current broadcast relays usable in smurf attacks - currently appears to be getting smurfed. traceroute to netscan.org (216.32.4.105), 30 hops max, 40 byte packets [...] 6 mae-west-ames.exodus.net (198.32.136.113) 18 ms 18 ms 20 ms 7 scca-02-h4-1-0.core.exodus.net (209.1.10.165) 18 ms 21 ms 19 ms 8 bbr02-p0-0.sntc01.exodus.net (209.1.169.49) 34 ms 34 ms * 9 * bbr01-p5-0.sntc03.exodus.net (209.185.249.142) 29 ms 33 ms 10 dcr01-p00000.sttl01.exodus.net (209.185.9.186) 66 ms 69 ms 66 ms 11 209.67.64.21 (209.67.64.21) 100 ms 108 ms * 12 * * * % ping -s netscan.org PING netscan.org: 56 data bytes ^C ----netscan.org PING Statistics---- 2 packets transmitted, 0 packets received, 100% packet loss % ping -s 209.67.64.21 PING 209.67.64.21: 56 data bytes 64 bytes from 209.67.64.21: icmp_seq=3. time=491. ms 64 bytes from 209.67.64.21: icmp_seq=7. time=89. ms ^C ----209.67.64.21 PING Statistics---- 9 packets transmitted, 2 packets received, 77% packet loss round-trip (ms) min/avg/max = 89/290/491 % ping -s 209.185.9.186 PING 209.185.9.186: 56 data bytes 64 bytes from dcr01-p00000.sttl01.exodus.net (209.185.9.186): icmp_seq=0. time=167. ms 64 bytes from dcr01-p00000.sttl01.exodus.net (209.185.9.186): icmp_seq=1. time=68. ms ^C ----209.185.9.186 PING Statistics---- 2 packets transmitted, 2 packets received, 0% packet loss round-trip (ms) min/avg/max = 68/117/167 Since I can't afford a lawyer to actually go after these negligents who can't seem to figure out that security is a part of being on the internet, I'm going to post a small rant here, again. Folks, it's not that hard to go to netscan.org (when it's not being smurfed), enter your subnets, and look to see if they give broadcasts. Heck, you could even automate it with a simple perl script. Give the task to one of your noc operators or something. Check your subnets, and your customers' subnets. And for those big ISPs out there who are getting targetted by smurf attacks, how about making your lawyers earn their keep and filing suit against the intermediaries for such things as gross negligence, anticompetitive practices, etc. etc. (note: I am not a lawyer). Have them get creative; I'm sure they're bored just sitting around poring over contracts all day. Talk to your managers. Make it a priority. But GET IT FIXED. I also advise you to fix the problem now, while the targets are still everyday users, and not 2 years from now, when Joe Achmed Terrorist discovers how easy it is to take down the pentagon from a UUnet dialup or a cable modem. Then, the FBI/CIA/military will come and fix it for you. (After they fix their own networks, of course }:P ). -dalvenjah P.S. Why am I sending this here? Because despite the fact that everyone on this list is in theory clueful, all the networks on netscan.org are customers of one of the big backbones or another, most of whom seem to have at least a minor presence on this list. If you have friends or contacts at backbones or ISPs who don't have a presence on nanog, forward away. If they are your customers, FIX THEM. You cannot get by with "they are responsible for their own networks" forever. Someone has to take responsibility. You should, before someone passes a law to force it upon you. -- Dalvenjah FoxFire (aka Sven Nielsen) DOS computers are by far the most popular Founder, the DALnet IRC Network worldwide. Macintosh fans, on the other hand, may note that cockroaches are far e-mail: dalvenjah(a)dal.net more numerous than humans, and that WWW: http://www.dal.net/~dalvenjah/ numbers alone do not denote a higher whois: SN90 life form.

1 0