- Test - lists.nanog.org

Re: ** Forged spamming going on
by Paul Vixie 21 Dec '98

21 Dec '98

I've got Dean listed in my procmail filters, but somebody sent me a copy of this separately, and so now you'll all have to wade through my answer: > >Still wouldn't fix it, as AOL is the one sending me the mails (bounces). > > Perhaps you can get AOL to stop sending. > > Actually, I think this might qualify AOL for the RBL, since they are > sending unsolicited mail and won't stop. Thats supposed to be the only > qualifier, right? "Won't" in this context has to mean "makes no effort". AOL makes an effort. Several of AOL's mail relays were blackholed in the first six months of the MAPS RBL project, but AOL has been a model network citizen since then. -- Paul Vixie <paul(a)vix.com>

1 0

RE: AT&T crap performance!
by Chris Mauritz 21 Dec '98

21 Dec '98

If your service has sucked for a long period of time, I would use that as a basis for premature cancellation. Are there any clauses in your contract with respect to their performance? I know that UUnet has such a clause. C Chris Mauritz Director, Systems Administration Rare Medium, Inc. chrism(a)raremedium.com -----Original Message----- From: Chris Cappuccio [mailto:chris@empnet.com] Sent: Monday, December 21, 1998 1:30 PM To: nanog(a)merit.edu Subject: AT&T crap performance! Hey, I've been using AT&T's network for a while now, and I have a lot of very poor performance issues like this for a long time. The easy answer would be to trash AT&T but we've got a contract with them that hasn't expired yet. Since these are network related issues, I'm wondering if anyone on NANOG has a clue as to what is going on/the best people to approach. I've been calling folks at AT&T for several months to get answers that amount to "we are upgrading this link to an OC3" and even after the upgrade, the performace still sucks. dqc:chris {107} traceroute lycaeum.org traceroute to lycaeum.org (207.66.171.40), 64 hops max, 40 byte packets 1 enet-IP4-de1-gw.bend2.EmpireNet.net (12.7.103.1) 0.440 ms 0.759 ms 0.375 ms 2 fe0-0.c7206.EmpireNet.net (12.7.96.1) 1.169 ms 1.71 ms 1.13 ms 3 12.127.193.109 (12.127.193.109) 18.43 ms 17.241 ms 21.98 ms 4 gr1-a3100s3.sffca.ip.att.net (192.205.35.1) 21.828 ms 32.112 ms 23.714 ms 5 att-gw.sf.cw.net (192.205.31.78) 473.411 ms 464.849 ms 494.304 ms 6 bordercore2.Seattle.cw.net (166.48.208.1) 482.713 ms 501.263 ms 511.764 ms 7 semaphore-corporation.Seattle.cw.net (166.48.208.6) 361.175 ms 368.1 ms 381.595 ms 8 fe0-0-0.sea2.semaphore.net (209.221.128.2) 383.171 ms 380.497 ms 447.556 ms 9 wolfe-gw-n-E12-3.semaphore.net (207.17.119.21) 677.106 ms 592.674 ms * 10 fci-sea-cr0-fa-0-0-0.flyingcroc.com (204.157.111.18) 573.205 ms 490.200 ms 454.482 ms 11 shaman.lycaeum.org (207.66.171.40) 493.69 ms 487.742 ms 487.732 ms lycaeum{101}% traceroute dqc.org traceroute to dqc.org (12.7.119.10), 30 hops max, 40 byte packets 1 * fci-sea-cr0.flyingcroc.com (204.157.104.1) 1.823 ms 0.986 ms 2 204.157.111.17 (204.157.111.17) 1.723 ms 1.649 ms 1.172 ms 3 wolfe-gw-f-E12-3.semaphore.net (207.17.119.22) 1.818 ms 2.196 ms 8.317 ms 4 903.Hssi5-0.GW1.SEA1.ALTER.NET (137.39.136.21) 8.787 ms 2.265 ms 1.847 ms 5 103.ATM3-0.XR1.SEA1.ALTER.NET (146.188.200.42) 2.692 ms 6.655 ms 5.883 ms 6 295.ATM2-0.TR1.SEA1.ALTER.NET (146.188.200.106) 2.518 ms 2.821 ms 2.922 ms 7 110.ATM7-0.TR1.CHI4.ALTER.NET (146.188.136.165) 50.112 ms 53.411 ms 48.689 ms 8 299.ATM7-0.XR1.CHI4.ALTER.NET (146.188.208.221) 46.940 ms 52.094 ms 47.992 ms 9 195.ATM8-0-0.BR1.CHI1.ALTER.NET (146.188.208.1) 47.254 ms 47.534 ms 48.252 ms 10 137.39.23.50 (137.39.23.50) 50.224 ms 49.393 ms 50.897 ms 11 gr1-a340s1.cgcil.ip.att.net (192.205.31.113) 74.123 ms 68.746 ms 94.304 ms 12 br2-a350s3.cgcil.ip.att.net (192.205.31.106) 1019.882 ms 977.420 ms 958.934 ms 13 br1-h31.sffca.ip.att.net (12.127.14.110) 292.712 ms 91.461 ms 79.426 ms 14 ar1-a300s1.sffca.ip.att.net (12.127.1.133) 322.673 ms 417.481 ms 385.498 ms 15 12.127.193.102 (12.127.193.102) 367.061 ms 374.838 ms * 16 lightwave-2-GW1.bend1.EmpireNet.net (12.7.96.4) 422.924 ms 420.412 ms 419.702 ms 17 dqc.org (12.7.119.10) 461.522 ms 465.937 ms 452.014 ms -- Keep Cool, but Don't Freeze - Hellman's Mayonnaise

1 0

Re: ** Forged spamming going on
by Dean Anderson 21 Dec '98

21 Dec '98

At 11:23 AM 12/21/1998 -0500, alex(a)nac.net wrote: >Still wouldn't fix it, as AOL is the one sending me the mails (bounces). Perhaps you can get AOL to stop sending. Actually, I think this might qualify AOL for the RBL, since they are sending unsolicited mail and won't stop. Thats supposed to be the only qualifier, right? Paul? --Dean (Color me amused if AOL is RBL'd ;-) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

3 2

Re: ** Forged spamming going on
by Dean Anderson 21 Dec '98

21 Dec '98

At 11:43 AM 12/21/1998 -0700, John Gonzalez/netMDC admin wrote: >On Mon, 21 Dec 1998, Dean Anderson wrote: > >-| At 11:23 AM 12/21/1998 -0500, alex(a)nac.net wrote: >-| >-| >Still wouldn't fix it, as AOL is the one sending me the mails (bounces). >-| >-| Perhaps you can get AOL to stop sending. >-| >-| Actually, I think this might qualify AOL for the RBL, since they are >-| sending unsolicited mail and won't stop. Thats supposed to be the only >-| qualifier, right? > >I doubt AOL would be put on the RBL unless they SERIOUSLY did something >wrong. Too much legit mail comes from them. Besides, it's not their fault. >In this instance, they are doing the sane thing. It's the spammer forging >the domain that must be stopped. Let's blame those who deserve the blame, >and not punish innocents. Well, this is somewhat tongue in cheek. I'm really poking at the problems with the definition of who gets RBL'ed. I would think that since Vixie has some experience with standards, he would be able to come up with a better definition. One perhaps that doesn't change day to day depending on who he wants to block at the moment. Although, perhaps that is what he means to do, in which case, look out AOL. I thought at least we could get an answer as to whether Vixie will RBL AOL for sending unsolicited mail and refusing to stop. I would hope for some sort of explanation about how they do or don't fit his current definition. I'm all for blaming spammers. We just found an unauthorized relay this morning. But I'll be pursuing them with federal prosescutors, not via vigilante operations. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 0

Re: ** Forged spamming going on
by Robert Tarrall 21 Dec '98

21 Dec '98

alex(a)nac.net wrote: -> Received: from mailme.com (146.st-louis-71-72rs.mo.dial-access.att.net [12.7 Agh. Nevermind my previous comment about denying relays - obviously not of much use in your case. Must remember to wait till the caffeine kicks in before sending email in the morning... I *would* still like to know if anyone has a list of legitimate SMTP servers for the big dialups though. Alex, seems like your ideal solution would be something that transparently redirects all the AOL bounces to AT&T's servers. Might be more likely to get their attention that way... -Robert Tarrall.- System/Network Admin E Central

2 1

Advance notice for 1q99 walk
by bmanning＠ISI.EDU 21 Dec '98

21 Dec '98

Hi, I appologize for duplicates. Its almost time for the next quarterly walk of the inverse tree of the DNS. For the last few quarters, I've been walking the in-addr tree looking for numbers of delegations, accurate delegations, and types and styles of error conditions. So... this is a heads up that you will be seeing zone transfers being generated by a couple of the collecter machines here. For those of you who utilize BINDs access controls, I'd appreciate your inclusion of the collector machines in allowed transfers. The expectation is that they will be the following IP addresses: 128.9.160.57 and 198.32.4.13 If there are any questions or concerns, I'd be happy to talk about them. Past data has been presented at IEPG, Apricot and RIPE meetings. The expectation is that future data will be presented in the same and similar forums. The expected start date is 01jan99 and it is expected to run through February 1999. The 4q98 and preliminary data for the 1q99 audits will be presented at Apricot99 in Singapore. www.apricot.net for details about this venue. The data will be available via http as well. www.isi.edu/div7/people/bmanning.home/in-addr-audit.html --bill

1 0

mae-east-atm, update
by dlr＠bungi.com 19 Dec '98

19 Dec '98

Well, at least two people are now live on the mae-east ATM. Above.net, with an OC12, and Iconnet, with an OC3. After being operational for a few days, I can say that it performs really well with 1 Mbps of traffic :-) Hopefully, some more folks will be live on it soon, and we can see how it is going to scale. I still think that PNIs are the right way to go, but this will work fine for the smaller networks, as an economy-of-scale connection. Let's hope the switches have adequate buffering... -- Dave Rand dlr(a)bungi.com http://www.bungi.com

1 0

Re: appearently so: hotmail.com ... again ?!?
by David Lesher 18 Dec '98

18 Dec '98

Unnamed Administration sources reported that Randy Delucchi said: > From: "Randy Delucchi" <rdelucchi(a)hotmail.com> > > We're upgrading our mailservers, during this process, you may see > intermittant deferrals, refusals, and larger than normal queues. It can > be mitigated by resending, esp. at offpeak times. We hope to be finished > and back to normal shortly. Sorry for the hassle. Hope this is not Yet Another attempt to migrate to NT.... -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Re: InterNIC "whois server <handle>" broke?
by Gerry Boudreaux 18 Dec '98

18 Dec '98

At 01:31 PM 12/18/98 -0600, Phil Howard <phil(a)whistler.intur.net> wrote: >But a means still needs to exist for the authorized contact for a >host to be able to get the full server list that Internic has for >that host. Sending the list by e-mail to the contact of record would >seem to me to be the best way to do it. If this still works: http://rs.internic.net/reports/index.html Hope this helps Gerry Boudreaux Network Manager InterSurf Online, Inc.

1 0

Re: appearently so: hotmail.com ... again ?!?
by Randy Delucchi 18 Dec '98

18 Dec '98

We're upgrading our mailservers, during this process, you may see intermittant deferrals, refusals, and larger than normal queues. It can be mitigated by resending, esp. at offpeak times. We hope to be finished and back to normal shortly. Sorry for the hassle. Randy Delucchi, Dir of CS/NOC MSN Hotmail (408) 222-7037 >To: Carl Moberg <carl(a)telia.net>, nanog(a)merit.edu, rdelucchi(a)HOTMAIL.COM, > hostmaster(a)jsnet.com, support(a)EXODUS.NET >cc: rader(a)teak.wiscnet.net >Subject: appearently so: hotmail.com ... again ?!? >Date: Fri, 18 Dec 1998 10:48:00 -0600 >From: steve rader <rader(a)teak.wiscnet.net> > > > > From: Carl Moberg > > I am (once again) experiencing _heavy_ problems delivering > > mail to mail.hotmail.com. My SMTP sessions keep timing out > > in the initial phase. TCP is up clean but it seems like > > the servers are having a hard time producing anything SMTP-like. > > Anyone else ? > >Carl: > >Us too... see enclosed which I sent yesterday afternoon but >didn't seem to make it through to the list. (It was accepted >by mail.merit.edu with id OAA21910?!) > >My mrtg graphs show it started on tuesday at about 1000-1200 CST. >Some msgs flush around 0300-0400 every night, but mail.hotmail.com >certainly isn't keeping up: > > - tuesday's peak was ~460 msgs > - wednesday's peak was ~690 > - last night it hit 902 > > >Javasoft & Exodus: > >(I doubt rdelucchi(a)HOTMAIL.COM will get this msg...) >Please let hotmail know there smtp msg throughput has >really sucked rocks the last ~ 72 hrs. Thanks. > > >steve >-- -- -- -- >Steve Rader >Systems and Network Manager >WiscNet--Internetworking for Wisconsin >rader(a)wiscnet.net >bash: syntax error near unexpected token `=:)' > >------- Forwarded Message > >Date: Thu, 17 Dec 1998 13:57:33 -0600 >From: steve rader <rader@teak> >To: nanog(a)merit.edu >Subject: hotmail has gone cold!?! > > >Anybody know what's up with hotmail? To wit... > > gomer(rader): mailq | grep Deferred | grep mail.hotmail.com | wc -l > 593 > >steve >- -- -- -- -- >Steve Rader >Systems and Network Manager >WiscNet--Internetworking for Wisconsin >rader(a)wiscnet.net >bash: syntax error near unexpected token `=:)' > > >------- End of Forwarded Message > > ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0