- Test - lists.nanog.org

Real..Live...SPAM
by Rob Wilson 19 Nov '97

19 Nov '97

Take a moment to read the details within the body of this email. Someone might want to track this guy down... Perhaps a little "Black Ops" mission may be in order?? I'll leave it up to you smart guys. rw

1 0

Re: hmm..
by Sanjay Dani 19 Nov '97

19 Nov '97

> > Someone *is* playing with us. > One likely explanation is that a spammer is reading nanog and is > showing his/her/its displeasure with the anti-spam tone on this list > recently. > > This sort of revenge is very common among spammers, in my first-hand > experience. Block a spammer from your site and shortly thereafter > various malicious things begin happening with disturbing frequency. Unfortuntely the same can be said about some anti-spammers today (while there are several honorable exceptions) as I can testify from an on-going breakin by a juvenile. Feel free to email me if you want an example or like to help. These anti-spammer hackers are lower scums than all the spammers I've encountered. The spammers have never destroyed information (yet). And we are not even close to being spammer friendly. Isn't it always easy to generalize and find scapegoats instead of treating every case as unique?

1 0

NANOG mailing list charter
by Rodney Joffe 19 Nov '97

19 Nov '97

I stand corrected. And I apologize to the list. This morning I posted a 'heads-up' about an AOL problem. My rationale for doing so was that the information was important to my operations group, because AOL represents 10 million end users who spend a portion of their online life connecting to websites that we host. And our customers measure our performance based on the number of hits per minute/hour/day that they are getting. When this rate changes uncharacteristically, the web customer immediately assumes that it is our network that is failing, and calls our operations group to complain, or inquire. Knowing that AOL is experiencing a problem (which would not show up in any of our peer monitors) helps our ops guys to avoid a wild goose chase. I assumed this was the case for most ISPs. I received a number of (thankfully) private flames, asking me why I thought anyone on the list cared. Obviously I thought many of you would. I was wrong. So I went to look at the NANOG charter (based on the crud that shows up on NANOG, one could be forgiven for being confused). I thought that the charter covered operational issues. It doesn't. Specifically, from the NANOG web site: "The NANOG mailing list is established to provide a forum for the exchange of technical information and the discussion of specific implementation issues that require cooperation among network service providers. <snip>." It covers implementation and co-operation issues. Sorry to create improper noise. Is anyone aware of a good newsgroup that does cover mundane issues like fiber cuts, DNS and root server failures, NAP problems, Route leaks, backbone poisoning, etc? Or is NANOG a good place for this, depending on who is doing the posting? In which case, where should the clueless unwashed like me go? Thanks... Rodney Joffe Chief Technology Officer Genuity Inc., a Bechtel company http://www.genuity.net

4 4

hmm..
by James D. Butt 19 Nov '97

19 Nov '97

Is it just me or.. I just received 2 "Welcome to nanog" messages and then this...a bounce.. Is someone playing with us? From: nanog(a)merit.edu To: listserv(a)roadrunner.gateway2000.com Subject: Subscribe join new.product join web.contests join press.releases -------------------------------------------------------------------------- James D. Butt 'J.D.' Network Engineer Voice 319-557-8463 Network Operations Center Fax 319-557-9771 MidWest Communications, Inc. Pager 319-557-6347 241 Main St. noc(a)mwci.net Dubuque, IA 52001 jbutt(a)mwci.net --------------------------------------------------------------------------

18 19

MAE-East work?
by Chris A. Icide 18 Nov '97

18 Nov '97

I assume that MFS/WorldCom was performing some work at MAE-East this morning? It looks like I lost most of my peers for a bit.. Seems to have been restored about 0945 EST. Chris ---------------------------------------------------------------------- Chris A. Icide Genuity, Inc. / Nap.Net, L.L.C. Sr. Network Engineer 4041 North Central Ave. Suite 400 602-207-6409 Phoenix, AZ 85012 - Notice: NVRAM invalid, possibly due to write erase. Press RETURN to get started! - PGP Keys located at pgpkeys.mit.edu or http://nap.net/~chris/keys.html ----------------------------------------------------------------------

3 2

Kaiwan.com a SPAM Source?
by Chris A. Icide 18 Nov '97

18 Nov '97

*WARNING* Configuration of your router with the following file may cause multiple configuration errors. Do not configure your router with the following information. Recently today, Nap.Net's coprorate mail exhanger (does not support relaying) was e-mail bombed. Upon tracking this down, we found that the attack was sourcing from kaiwan.com. Our NOC contacted thier contact per InterNIC database, and asked them about the attack, thinking it might have been relayed through them or such. However, the nice gentleman on the phone (read irony into that please) said that that in fact was not the case. The had a script that when it identifies SPAM, it parses the header, retrieves the path of the spam, gets the contact info from the InterNIC database, and then sends multiple emails out to the path of the SPAM for each one received. An automated Denial of Service attack. How nice. Kaiwan.com has been completely uncooperative. Nap.Net has a strict AUP, and has agressively addressed any SPAM complaints addressed against any of it's downstream customers. However, unfortunately a customer must SPAM at least once before we can identify such SPAM. Automated scripts like this are of no help, and in fact possibly cause more harm than help. Just an FYI, it was either steam here, or add a network statement to my BGP config that contains more specific routes of kaiwan.com. This seemed a little less drastic. Chris A. Icide ---------------------------------------------------------------------- Chris A. Icide Genuity, Inc. / Nap.Net, L.L.C. Sr. Network Engineer 4041 North Central Ave. Suite 400 602-207-6409 Phoenix, AZ 85012 - Notice: NVRAM invalid, possibly due to write erase. Press RETURN to get started! - PGP Keys located at pgpkeys.mit.edu or http://nap.net/~chris/keys.html ----------------------------------------------------------------------

2 1

Re: Oooops
by Gerald Andrew Winters 18 Nov '97

18 Nov '97

Hello Richard, If there is a problem we can take care of we'd like to know about it. Can you give us a little more info? What did you notice? --Gerald (Merit) > From: Richard Irving <rirving(a)onecall.net> > > Those who use the RA may want to check the routes............ > You may not be going where you think you are right now.....

1 0

Oooops
by Richard Irving 18 Nov '97

18 Nov '97

Those who use the RA may want to check the routes............ You may not be going where you think you are right now..... Richard

1 0

General spam issues
by Phil Lawlor 18 Nov '97

18 Nov '97

Nanog is probably not the right forum to discuss spam generally. Please take issues to nana.e or the spam-l list. Correct me if I am wrong. Phil Lawlor President AGIS Voice - 313-730-1130 Fax - 313-563-6119

1 0

.DE Zone corrupted !!!!
by Winfried Haug 18 Nov '97

18 Nov '97

Hello together, the Root Server for the germany TLD .DE (ns.nic.de) seems to be corrupted. No queries for .DE Domains are answered. Only domains for which ns.nic.de is secondary are currently available. I just called the supervisor engineer from the DENIC and they are just on the way to solve the problem :_) So it is just a question of hours... Winfried Winfried Haug | SEICOM.DE & SCHWABEN.DE | Tel. 07121 9770- 0 Laiblinsplatz 12 | Internet+ISDN access & consulting | Fax. 07121 9770-19 72793 Pfullingen | Access in STGT + RT + TUE + BB + LB | Rack 07127 989-X haug(a)schwaben.net| 150*ISDN (64kb/X.75) / 100 * K56flex | Rack 0711 9675-X haug(a)seicom.net |SAP-OSS * FTP * TELNET * NETNEWS * IRC | Rack 07121 709-X * 4 MBit DE-CIX * 2 MBit INXS * 1 MBit Ebone * 2 Mbit Belwue * 0 Mbit WIN German ISP will shut down their WIN-Links. Visit www.decix.de/winpresse.html

1 0