- Test - lists.nanog.org

measurement
by randy＠psg.com 07 Mar '97

07 Mar '97

So who actually measures their network performance and how? randy

4 4

Re: Paul Vixie did not spam you (this is an automated response)
by Peter Galbavy 06 Mar '97

06 Mar '97

cc'ed to nanog@ FYI Paul Vixie wrote: > Today I started receiving a massive number of e-mail bounces and complaints > about spam. I immediately realized that someone had abused the network in my > name; sure enough, I shortly received the evidence shown below. I apologize > for this form letter response, but I'm expecting another 10,000 complaints and > I do not plan to send personalized replies to each one. [Posting from home, since thats where I get nanog@, but posting with my work hat on - Reply-To: set to peter(a)demon.net] Please note that we were hit by the same spammer. The original message went out, claiming it was from one of our customers (another thread last week) when in actual fact it is from an address block assigned the enterprise.net. I understand that this ISP (Enterprise in the UK) has made a statement to the effect that they in turn have traced this to a Compuserve location. Since the only Recieved: header with anything useful in it has one of their IP addrs in, this is difficult to check. Just for some background, the spammer proceeded to set the Reply-To: address to a range of mail-news gateways (demon.service(a)news.demon.co.uk was one) and really wound people up. This range of gateways have now been permanently closed, which is in itself a great shame. I would advise other out there to check if they have similar legacy newsgroup@ type gateways operating and close them to reduce the backlash of this type of spam. Regards, -- Peter Galbavy @ Home in Wonderland http://www.wonderland.org/ http://www.whirl-y-gig.org.uk/ http://www.demon.net Be remembered not for your final destination, but for your journey.

3 2

RE: Paul Vixie did not spam you (this is an automated response)
by Ry Jones 06 Mar '97

06 Mar '97

These are the same guys that the WA state AG shut down for mail fraud. I'm suprised they have the nuts to pop up again; this topic was beat to death on Seattle.General about 5 or 6 months ago. ---------- From: Geoff White[SMTP:geoffw@precipice.v-site.net] Sent: Thursday, March 06, 1997 4:14 AM To: peter(a)demon.net Cc: Paul Vixie; geertj(a)ripe.net; nanog(a)merit.edu Subject: Re: Paul Vixie did not spam you (this is an automated response) On Thu, 6 Mar 1997, Peter Galbavy wrote: > cc'ed to nanog@ FYI > > Paul Vixie wrote: > > Today I started receiving a massive number of e-mail bounces and complaints > > about spam. I immediately realized that someone had abused the network in my > > name; sure enough, I shortly received the evidence shown below. I apologize > > for this form letter response, but I'm expecting another 10,000 complaints and > > I do not plan to send personalized replies to each one. > > [Posting from home, since thats where I get nanog@, but posting > with my work hat on - Reply-To: set to peter(a)demon.net] > > Please note that we were hit by the same spammer. The original > message went out, claiming it was from one of our customers (another > thread last week) when in actual fact it is from an address block > assigned the enterprise.net. We have also been hit by the same spammer, he is using exchangecurrency(a)forprofit.com as his reply-field (which is one of my clients) Apparently one of the people at forprofit.com send a message to on of the spammers "superiors" (I think he just sent the message to the NOC contact of the host on a reply field that was sent to him :) and shortly after that, their domain name was showing up in the reply field of the spam. I am flushing all mail heading for exchangecurrency(a)forprofit.com to /dev/null. I've done a little research, aparently the original postings were using a domain... precipice:{root}67-> whois moneyworld.com Financial Connections, Inc (MONEYWORLD-DOM) 2508 5th Ave, #104 Seattle, WA 98121 Domain Name: MONEYWORLD.COM Administrative Contact, Technical Contact, Zone Contact, Billing Contact: Williams, Bob (BW747) willie(a)MONEYWORLD.COM 206 269 0846 Record last updated on 13-Oct-96. Record created on 26-Oct-95. Domain servers in listed order: NSH.WORLDHELP.NET 206.81.217.6 NSS.MONEYWORLD.COM 205.227.174.9 No answer at the number and apparently non of these DNS machines are currently on the net... hmm. This guy is causing my mail queues to fill up with a ton of bounces and flames and I don't appreciate it one bit. The guys at forprofit have some friends at the FBI, but they say that everytime they try to go after these guys, the ISPs won't co-operate :) Geoff White Virtual Sites http://www.v-site.net (415)437-4600 fax (415)437-4601

2 1

Re: 03/05/97 Internet Routing Problems
by Paul Ferguson 06 Mar '97

06 Mar '97

At 03:00 PM 3/6/97 GMT, stats(a)merit.edu wrote: > >Reserved Network and Host Announcements >--------------------------------------- >0/0 at PacBell from MIBX (6218) ASPATH=6218 Incomplete >0/0 at PacBell from MIBX (6218) ASPATH=6218 Incomplete >10/8 at PacBell from MIBX (6218) ASPATH=6218 IGP FYI. This is a prinicpal example of why people should be filtering on both inbound & outbound announcements of default & RFC1918 address space. - paul

5 4

in-addr problems
by William S. Duncanson 06 Mar '97

06 Mar '97

> Has anyone noticed lately that there have been a lot of problems getting > in-addr information on ms.uu.net ip addresses? At first I thought it was a > problem with a.root-servers.net, but it appears to be on the MSN/UUNet > side. We've had numerous customers of theirs complain that they could not > get to some of our sites, or that it was taking a lot longer than usual. > We looked at the logs, and sure enough, we're getting "refused connect from > aaa.xxx.yyy.zzz: gethostbyaddr() failed" messages from the IP addresses > that they're coming from. So, the question is, should we disable this > temporarily, or just wait for UUNet/MSN to get their act together? > > William S. Duncanson > william(a)neosoft.com > NeoSoft Operations > (888) NEOSOFT or (713) 968-5800 >

1 0

Re: measurement
by Bill McCauley 06 Mar '97

06 Mar '97

Randy, >So who actually measures their network performance and how? We use a traffic flow monitoring system from Kaspia Systems. (www.kaspia.com) The Kaspia product collects all sorts of data from router ports and RMON probes, stores the data and performs various trend analysis. We collect traffic flow, router CPU usage and router memory information plus various errors. There is a data reduction process which runs once a day, and a very nifty web interface. The product isn't cheap, but the system definitely fills a void here. Maybe I should organize a talk on what we're doing with it for an upcoming NANOG? As an old instrumentation engineer, I think the basis of our use of the tool is pretty solid. Plus, I actually developed a means for calibration of the accuracy of the flow data. Haven't had time yet to work out a validation for the trends, but I'll get to it one of these decades. Also, the Kaspia people will give you a thirty day trial on their product at no charge. Regards, Bill McCauley

2 1

Re: measurement
by Alex Rubenstein 06 Mar '97

06 Mar '97

You are WAY too helpfu; At 10:46 PM 3/5/97 -0500, Todd Graham Lewis wrote: >On Wed, 5 Mar 1997, Randy Bush wrote: > >> So who actually measures their network performance > >Us. > >> and how? > >Numerically. > >__ >Todd Graham Lewis MindSpring Enterprises tlewis(a)mindspring.com > >

1 0

Re: MCI noc
by Danny McPherson 06 Mar '97

06 Mar '97

trouble(a)mci.net or 800-663-9932... > I work for the Network Operations Center for the Army Corps of > Engineers. We (ceap.net) are basically the ISP for the entire Corps. One > of our internet service gateways is provided by MCI and we are having a > hell of a time getting a service issue with them resolved. Some time at > about 1:00 pm PST that gateway went down. Apparently, someone in their > provisioning group has decided to administratively shut down their > interface to us. That much I gathered from talking to someone in their > Internet group. He couldn't give me a good reason why this was the case > and the vapid account managers can't even find a circuit id and can't get > their connections to the MCI noc to do anything. I haven't been able to > get a hold of any one from their Internet group since then. This is > absurd. Is there anyone from MCI here who might be able to give me a > hand? > > > -------------------------------------------- > Esteban Gutierrez > US Army Corps Of Engineers > CEAP Network Operations > (503) 326-6126 > noc(a)ceap.net > >

1 0

MCI noc
by E Gutierrez 06 Mar '97

06 Mar '97

Greetings- I work for the Network Operations Center for the Army Corps of Engineers. We (ceap.net) are basically the ISP for the entire Corps. One of our internet service gateways is provided by MCI and we are having a hell of a time getting a service issue with them resolved. Some time at about 1:00 pm PST that gateway went down. Apparently, someone in their provisioning group has decided to administratively shut down their interface to us. That much I gathered from talking to someone in their Internet group. He couldn't give me a good reason why this was the case and the vapid account managers can't even find a circuit id and can't get their connections to the MCI noc to do anything. I haven't been able to get a hold of any one from their Internet group since then. This is absurd. Is there anyone from MCI here who might be able to give me a hand? -------------------------------------------- Esteban Gutierrez US Army Corps Of Engineers CEAP Network Operations (503) 326-6126 noc(a)ceap.net

1 1

Re: karl and paul, expostulating
by Paul Traina 05 Mar '97

05 Mar '97

[back from the grave] paul(a)vix.com (Paul A Vixie) writes: > Filtering packets based on source address makes Ciscos go way slow on > every packet. Filtering based on destination address makes Ciscos go > very fast on most packets and a little slower on SYN-ACKs. While I agree with what you're trying to do, your statement about filtering packets on source addresses is not correct. It's exactly the same hit. Paul -- The streets will flow with the blood of non-believers.

1 0