This week's puzzle ... What is symmetry? The mail relay for a defunct ISP with some 20k users has between 100k and 200k instances of sendmail journaled per day. At any point in time, there are about 1k entries in the host's proctable, 80% are the MTA, and a few connections/sec to port 25, with default MTA rules for open-relays, blacklists, etc. The host is an E250, running Solaris 2.6, with historically problematic roll-your-own-RAID. The load average is nearly zero. iostat and vmstat show nominal load, only 700 users are actually "getting mail", and with a multi-day delay observed anectdotally. ... Asymetric dns (forward and reverse paths with differing SOAs), plus rate limiting at the access router for all forward maps, can result in serious disfunction. Fixing the CTO's dns brought the proctable count down to sub-100. For what it is worth, this is the most horked machine I've ever seen. I decided not to try and explain this one.
From the post to nanog of the 25th, "Gifts for a CTO who has everything ..." (nmap 10.0.0.0/8 has side effects)
"Does life get any better than this" Best humor reply: Setup peering with a new provider that PROXY ARPs all your destinations. Second place (tie): LART the sucker, and the perenial foam bat. Best psychology reply: ... find a high-intensity clueino source? But clueinos interact very weakly with that sort of matter... The CTO's actual reply was "Do we have load that high? Were we being attacked by some script kiddies?? Very, very weak interaction. Cheers, Eric
Oki all, It appears that I closed the door on this too early. Then again, today is the first of April. Then again, I write about Iraq (not adulatory of any of the parties and their delights), and technotrivia, like "can .iq be operated like .tp was (via an ISP in .ie) while occupied?" Anyhow, SpamCop V1.3.3 is proud to point out that the following item of mail, sent to this list (nanog), meets its seal of Spam-Proval. I know cause my ISP (home) asked me "Eric, what's up with this?" The originating host ran FreeBSD 5.0 and sendmail 8.12.8 when the mail was sent (.9 now, obviously).
From the post to nanog of the 25th, "Gifts for a CTO who has everything ..." (nmap 10.0.0.0/8 has side effects)
"Does life get any better than this"
Best humor reply:
Setup peering with a new provider that PROXY ARPs all your destinations.
Second place (tie): LART the sucker, and the perenial foam bat.
Best psychology reply:
... find a high-intensity clueino source? But clueinos interact very weakly with that sort of matter...
The CTO's actual reply was "Do we have load that high? Were we being attacked by some script kiddies?? Very, very weak interaction.
Would someone with spmacop clue look at the following and drop me a note of decode?
193709546@reports.spamcop.net sent - - SpamCop V1.3.3 - This message is brief for your comfort. Please follow links for details.
http://spamcop.net/w3m?i=z193709546z369077d7127270f8cd00e0f3861920f0z Email from 216.220.241.233 / Sat, 29 Mar 2003 10:21:31 -0500 (EST)
Am I the only nanog'er so blessed? My ISP is now happy, so there only remains SpamBlop brain-death, or a non-gruntled nanog reader using SpamBlop to effect source-quench. Cheers, Eric
participants (1)
-
Eric Brunner-Williams in Portland Maine