- Test - lists.nanog.org

Re: ** Forged spamming going on
by Dean Anderson 21 Dec '98

21 Dec '98

At 11:43 AM 12/21/1998 -0700, John Gonzalez/netMDC admin wrote: >On Mon, 21 Dec 1998, Dean Anderson wrote: > >-| At 11:23 AM 12/21/1998 -0500, alex(a)nac.net wrote: >-| >-| >Still wouldn't fix it, as AOL is the one sending me the mails (bounces). >-| >-| Perhaps you can get AOL to stop sending. >-| >-| Actually, I think this might qualify AOL for the RBL, since they are >-| sending unsolicited mail and won't stop. Thats supposed to be the only >-| qualifier, right? > >I doubt AOL would be put on the RBL unless they SERIOUSLY did something >wrong. Too much legit mail comes from them. Besides, it's not their fault. >In this instance, they are doing the sane thing. It's the spammer forging >the domain that must be stopped. Let's blame those who deserve the blame, >and not punish innocents. Well, this is somewhat tongue in cheek. I'm really poking at the problems with the definition of who gets RBL'ed. I would think that since Vixie has some experience with standards, he would be able to come up with a better definition. One perhaps that doesn't change day to day depending on who he wants to block at the moment. Although, perhaps that is what he means to do, in which case, look out AOL. I thought at least we could get an answer as to whether Vixie will RBL AOL for sending unsolicited mail and refusing to stop. I would hope for some sort of explanation about how they do or don't fit his current definition. I'm all for blaming spammers. We just found an unauthorized relay this morning. But I'll be pursuing them with federal prosescutors, not via vigilante operations. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 0

Re: ** Forged spamming going on
by Robert Tarrall 21 Dec '98

21 Dec '98

alex(a)nac.net wrote: -> Received: from mailme.com (146.st-louis-71-72rs.mo.dial-access.att.net [12.7 Agh. Nevermind my previous comment about denying relays - obviously not of much use in your case. Must remember to wait till the caffeine kicks in before sending email in the morning... I *would* still like to know if anyone has a list of legitimate SMTP servers for the big dialups though. Alex, seems like your ideal solution would be something that transparently redirects all the AOL bounces to AT&T's servers. Might be more likely to get their attention that way... -Robert Tarrall.- System/Network Admin E Central

2 1

Advance notice for 1q99 walk
by bmanning＠ISI.EDU 21 Dec '98

21 Dec '98

Hi, I appologize for duplicates. Its almost time for the next quarterly walk of the inverse tree of the DNS. For the last few quarters, I've been walking the in-addr tree looking for numbers of delegations, accurate delegations, and types and styles of error conditions. So... this is a heads up that you will be seeing zone transfers being generated by a couple of the collecter machines here. For those of you who utilize BINDs access controls, I'd appreciate your inclusion of the collector machines in allowed transfers. The expectation is that they will be the following IP addresses: 128.9.160.57 and 198.32.4.13 If there are any questions or concerns, I'd be happy to talk about them. Past data has been presented at IEPG, Apricot and RIPE meetings. The expectation is that future data will be presented in the same and similar forums. The expected start date is 01jan99 and it is expected to run through February 1999. The 4q98 and preliminary data for the 1q99 audits will be presented at Apricot99 in Singapore. www.apricot.net for details about this venue. The data will be available via http as well. www.isi.edu/div7/people/bmanning.home/in-addr-audit.html --bill

1 0

mae-east-atm, update
by dlr＠bungi.com 19 Dec '98

19 Dec '98

Well, at least two people are now live on the mae-east ATM. Above.net, with an OC12, and Iconnet, with an OC3. After being operational for a few days, I can say that it performs really well with 1 Mbps of traffic :-) Hopefully, some more folks will be live on it soon, and we can see how it is going to scale. I still think that PNIs are the right way to go, but this will work fine for the smaller networks, as an economy-of-scale connection. Let's hope the switches have adequate buffering... -- Dave Rand dlr(a)bungi.com http://www.bungi.com

1 0

Re: appearently so: hotmail.com ... again ?!?
by David Lesher 18 Dec '98

18 Dec '98

Unnamed Administration sources reported that Randy Delucchi said: > From: "Randy Delucchi" <rdelucchi(a)hotmail.com> > > We're upgrading our mailservers, during this process, you may see > intermittant deferrals, refusals, and larger than normal queues. It can > be mitigated by resending, esp. at offpeak times. We hope to be finished > and back to normal shortly. Sorry for the hassle. Hope this is not Yet Another attempt to migrate to NT.... -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Re: InterNIC "whois server <handle>" broke?
by Gerry Boudreaux 18 Dec '98

18 Dec '98

At 01:31 PM 12/18/98 -0600, Phil Howard <phil(a)whistler.intur.net> wrote: >But a means still needs to exist for the authorized contact for a >host to be able to get the full server list that Internic has for >that host. Sending the list by e-mail to the contact of record would >seem to me to be the best way to do it. If this still works: http://rs.internic.net/reports/index.html Hope this helps Gerry Boudreaux Network Manager InterSurf Online, Inc.

1 0

Re: appearently so: hotmail.com ... again ?!?
by Randy Delucchi 18 Dec '98

18 Dec '98

We're upgrading our mailservers, during this process, you may see intermittant deferrals, refusals, and larger than normal queues. It can be mitigated by resending, esp. at offpeak times. We hope to be finished and back to normal shortly. Sorry for the hassle. Randy Delucchi, Dir of CS/NOC MSN Hotmail (408) 222-7037 >To: Carl Moberg <carl(a)telia.net>, nanog(a)merit.edu, rdelucchi(a)HOTMAIL.COM, > hostmaster(a)jsnet.com, support(a)EXODUS.NET >cc: rader(a)teak.wiscnet.net >Subject: appearently so: hotmail.com ... again ?!? >Date: Fri, 18 Dec 1998 10:48:00 -0600 >From: steve rader <rader(a)teak.wiscnet.net> > > > > From: Carl Moberg > > I am (once again) experiencing _heavy_ problems delivering > > mail to mail.hotmail.com. My SMTP sessions keep timing out > > in the initial phase. TCP is up clean but it seems like > > the servers are having a hard time producing anything SMTP-like. > > Anyone else ? > >Carl: > >Us too... see enclosed which I sent yesterday afternoon but >didn't seem to make it through to the list. (It was accepted >by mail.merit.edu with id OAA21910?!) > >My mrtg graphs show it started on tuesday at about 1000-1200 CST. >Some msgs flush around 0300-0400 every night, but mail.hotmail.com >certainly isn't keeping up: > > - tuesday's peak was ~460 msgs > - wednesday's peak was ~690 > - last night it hit 902 > > >Javasoft & Exodus: > >(I doubt rdelucchi(a)HOTMAIL.COM will get this msg...) >Please let hotmail know there smtp msg throughput has >really sucked rocks the last ~ 72 hrs. Thanks. > > >steve >-- -- -- -- >Steve Rader >Systems and Network Manager >WiscNet--Internetworking for Wisconsin >rader(a)wiscnet.net >bash: syntax error near unexpected token `=:)' > >------- Forwarded Message > >Date: Thu, 17 Dec 1998 13:57:33 -0600 >From: steve rader <rader@teak> >To: nanog(a)merit.edu >Subject: hotmail has gone cold!?! > > >Anybody know what's up with hotmail? To wit... > > gomer(rader): mailq | grep Deferred | grep mail.hotmail.com | wc -l > 593 > >steve >- -- -- -- -- >Steve Rader >Systems and Network Manager >WiscNet--Internetworking for Wisconsin >rader(a)wiscnet.net >bash: syntax error near unexpected token `=:)' > > >------- End of Forwarded Message > > ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

Re: [NIC-981207.1418] whois for 'server SERVER-HANDLE' not returning information?
by nicholas harteau 18 Dec '98

18 Dec '98

i complained to hostmaster(a)internic.net about this a few nights ago, but by the time they got around to replying to my mail, it had been fixed. judging from the response, i think it's more likely that they're having problems with the feature than killing it. Jeffrey Haas wrote: > Has anyone else noted that "whois server <handle>" no longer seems > to be working at the InterNIC? > > -- > Jeffrey Haas "Denial of Spamming is not a crime." > elezar(a)pfrc.org -- Russell Nelson <nelson(a)crynwr.com> -- nicholas harteau nrh(a)sfx.com

1 0

The Cidr Report
by Tony Bates 18 Dec '98

18 Dec '98

This is an auto-generated mail on Fri Dec 18 12:00:00 PST 1998 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to xara.net for giving me access to their routing tables once a day. Please send any comments about this report directly to me. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 18Dec98 0) General Status Table History ------------- Date Prefixes 111298 54438 121298 54337 131298 54282 141298 54446 151298 54647 161298 54628 171298 54720 181298 54712 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 4332 Number of ASes announcing only one prefix: 2126 (1136 cidr, 990 classful) Largest number of cidr routes: 358 announced by AS3561 Largest number of classful routes: 991 announced by AS701 1) Gains by aggregating at the origin AS level --- 18Dec98 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS271 390 148 242 62.1% BCnet Backbone AS3749 229 70 159 69.4% TECNET AS2493 326 179 147 45.1% iSTAR Internet, Inc. AS1785 541 403 138 25.5% NYSERNet Backbone AS701 991 855 136 13.7% Alternet AS174 676 549 127 18.8% Performance Systems International AS5668 133 36 97 72.9% Century Telephone Inc. AS4200 191 98 93 48.7% AGIS (Apex Global Information Ser AS1267 109 30 79 72.5% IUNET-AS AS4293 207 135 72 34.8% IMCI AS4755 133 62 71 53.4% Videsh Sanchar Nigam Ltd. India AS549 220 154 66 30.0% ONet Backbone AS4740 394 330 64 16.2% Ozemail Pty Ltd (ASN-OZEMAIL) AS8517 128 71 57 44.5% UNKNOWN AS1221 384 328 56 14.6% AARNET-AS AS7046 247 194 53 21.5% UUNET-CUSTOMER AS7657 137 86 51 37.2% The Internet Group Limited AS7545 116 66 50 43.1% TPG Internet Pty Ltd AS1239 532 483 49 9.2% SprintLink Backbone AS72 88 40 48 54.5% Schlumberger Information Network AS7496 74 29 45 60.8% Power Up AS577 208 163 45 21.6% Bell Canada Backbone AS3221 84 42 42 50.0% RIPE-ASNBLOCK4 AS10928 90 49 41 45.6% UNKNOWN AS852 172 133 39 22.7% AGT Advance Communication AS719 440 403 37 8.4% LANLINK-AS AS803 71 35 36 50.7% SaskNet Backbone AS7122 111 76 35 31.5% MTS ADVANCED Network Policy AS3564 69 36 33 47.8% Microserve Infromation Systems In AS2707 65 32 33 50.8% WEC For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

hotmail.com ... again ?!?
by Carl Moberg 18 Dec '98

18 Dec '98

I am (once again) experiencing _heavy_ problems delivering mail to mail.hotmail.com. My SMTP sessions keep timing out in the initial phase. TCP is up clean but it seems like the servers are having a hard time producing anything SMTP-like. Anyone else ? -- carl --------------------------------------------------------- Carl Moberg, TeliaNet voice: +46-8-456 7274 <carl(a)telia.net> fax: +46-8-456 7280 ---------------------------- FreeBSD: The Power to Route!

2 1