Re: Operators Penalized? (was Re: Kenyan Route Hijack)

2008-03-17 Thread Joe Maimon
Glen Kent wrote: Do ISPs (PTA, AboveNet, etc) that unintentionally hijack someone else IP address space, ever get penalized in *any* form? The net only functions as a single entity because sp's intentionally DONT hijack space and the mutual trust in other sp's rational behavior.

Re: v6 subnet size for DSL leased line customers

2007-12-26 Thread Joe Maimon
Tony Li wrote: On Dec 26, 2007, at 8:26 AM, Leo Bicknell wrote: It's unlikely that it will matter. In practice, ICMP router discovery died a long time ago, thanks to neglect. Host vendors didn't adopt it, and it languished. The problem eventually got solved with HSRP and its

Re: v6 subnet size for DSL leased line customers

2007-12-24 Thread Joe Maimon
Scott Weeks wrote: Disclaimer: I'm still very much an IPv6 wussie... :-) - But even in 2000 the policy was and still is: /128 for really a single device /64 if you know for sure that only one single subnet will ever be allocated. /48

Re: Verizon has been listening to nanog.

2007-10-24 Thread Joe Maimon
Hex Star wrote: On 10/23/07, Leo Bicknell [EMAIL PROTECTED] wrote: http://www.usatoday.com/tech/news/2007-10-23-verizon-fios-plan_N.htm 20 Mbps down, 20 Mbps up, fully symmetrical for $65. That's pretty sweet, now all they have to do is start laying the fiber over here... And stop

Re: Belgian court rules that ISPs must block file-sharing

2007-07-05 Thread Joe Maimon
Mark Andrews wrote: Someone has succeeded in pulling the wool over the court's eyes if it has been convinced that there is a technical mechanism to do this. A ISP does not have access to enough information to determine this. The same file can be both

RTT from NY to New Delhi?

2007-05-16 Thread Joe Maimon
What should I expect? I am seeing ~350 from a vendor provided mpls cloud to a site in Sukhrali Chowk, Gurgaon, Haryana, India Thanks, Joe

Re: RTT from NY to New Delhi?

2007-05-16 Thread Joe Maimon
Justin M. Streiner wrote: On Wed, 16 May 2007, Joe Maimon wrote: What should I expect? I am seeing ~350 from a vendor provided mpls cloud to a site in Sukhrali Chowk, Gurgaon, Haryana, India Where are you running your tests from? USA (east or west coast)? Europe? Elsewhere in Asia

Re: RTT from NY to New Delhi?

2007-05-16 Thread Joe Maimon
Steven M. Bellovin wrote: On Wed, 16 May 2007 09:20:48 -0400 Joe Maimon [EMAIL PROTECTED] wrote: What should I expect? I am seeing ~350 from a vendor provided mpls cloud to a site in Sukhrali Chowk, Gurgaon, Haryana, India Thanks, Joe What does traceroute show? traceroute shows me

Re: barak-online.net icmp performance vs. traceroute/tcptraceroute, ssh, ipsec

2007-05-07 Thread Joe Maimon
Scott Weeks wrote: --- [EMAIL PROTECTED] wrote: From: Lincoln Dale [EMAIL PROTECTED] To: 'Joe Maimon' [EMAIL PROTECTED] The standard control plane arguments dont apply when the pattern holds all the way through to equipment under your {remote-}control. : : it most certainly does. lets

Re: barak-online.net icmp performance vs. traceroute/tcptraceroute, ssh, ipsec

2007-05-07 Thread Joe Maimon
Jo Rhett wrote: On May 6, 2007, at 6:07 PM, Joe Maimon wrote: Of course, and thats why I have cut down ip mtu and tcp adjust mss and all the rest. Not making much of a difference. Um.. sorry if you mean more than you said, but where did you cut down the TCP MTU? If you did

Re: barak-online.net icmp performance vs. traceroute/tcptraceroute, ssh, ipsec

2007-05-07 Thread Joe Maimon
Lincoln Dale wrote: Lower than 1500 mtu always requires some kind of hack in real life. That would be the adjust-mss which is the hack-of-choice note that using 'adjust-mss' only adjusts the MSS for TCP. it won't do much good for already-encapsulated IPSec traffic with protocol 47 or

Re: barak-online.net icmp performance vs. traceroute/tcptraceroute, ssh, ipsec

2007-05-07 Thread Joe Maimon
Joe Maimon wrote: This is obviously not best effort. Best guess would be managed bandwidth differentiated by ip ranges and that the change was a different pool assignment. I suspect the stellar icmp echo performance is also intentional. Or it could just be some QOS policing/shaping.

Re: barak-online.net icmp performance vs. traceroute/tcptraceroute, ssh, ipsec

2007-05-07 Thread Joe Maimon
Adrian Chadd wrote: On Mon, May 07, 2007, Joe Maimon wrote: Joe Maimon wrote: This is obviously not best effort. Best guess would be managed bandwidth differentiated by ip ranges and that the change was a different pool assignment. I suspect the stellar icmp echo performance

barak-online.net icmp performance vs. traceroute/tcptraceroute, ssh, ipsec

2007-05-06 Thread Joe Maimon
I was wondering if someone could shed some light on this little curiosity. US ping (sourced from different networks, including cable customer in NE) to the consumer grade residental israel dsl cpe (currently cisco 871) look really nice and sweet, gotomypc works alright, consumer is enjoying

Re: barak-online.net icmp performance vs. traceroute/tcptraceroute, ssh, ipsec

2007-05-06 Thread Joe Maimon
Lincoln Dale wrote: traceroute/tcptraceroute show packet loss and MUCH higher rtt than the corresponding direct pings on the reported hop entries. Is this some sort of massaging or plain just faking it? Or is such things merely net-urban myth? the vast majority of routers on the internet

Re: barak-online.net icmp performance vs. traceroute/tcptraceroute, ssh, ipsec

2007-05-06 Thread Joe Maimon
I did include icmp echo directly to each hop as a comparison. Right, but from what you posted you didn't send 1500-byte packets. My reaction was the same as Lincoln's -- it smells like a Path MTU problem. To repeat -- ping and traceroute RTT from intermediate nodes is at best advisory,

Re: barak-online.net icmp performance vs. traceroute/tcptraceroute, ssh, ipsec

2007-05-06 Thread Joe Maimon
Lincoln Dale wrote: I did include icmp echo directly to each hop as a comparison. i guess what i'm saying is that you can't read much from the backscatter of what a either: - ping of each hop - eliciting a response from each hop (as traceroute does) as the basis for determining much.

Re: Thoughts on increasing MTUs on the internet

2007-04-14 Thread Joe Maimon
Simon Leinen wrote: * Current Path MTU Discovery doesn't work reliably. Please, let's wait for these more robust PMTUD mechanisms to be universally deployed before trying to increase the Internet MTU. I think this is the proper summary of where we are at: Trying to restore one of

Re: Could it be possible to extend PPPoE Error code?

2007-03-27 Thread Joe Maimon
Joe Shen wrote: error 691 is a ms chap extensions to ppp error code that means auth failed. Its in response to the access-reject from the radius server most probably. There really isnt any room here to do more. client device. In my experience there are almost no client devices that

Re: TCP and WAN issue

2007-03-27 Thread Joe Maimon
Philip Lavine wrote: I have 2 data transmission scenarios: 1. Microsoft MSMQ data using TCP 2. Streaming market data stock quotes transmitted via a TCP sockets Philip TCP stack tuning works very well for applications with large sized network reads and writes. Applications that will

Windows based DDNS gslb tracker/updater product

2007-03-18 Thread Joe Maimon
Hey all, I am looking for a product I have seen in the past but dont recall its name or anyother information other than - it was windows based - it tracked which services were up on which ip address with rules/policies - it performed DDNS updates based on tracking results. With the

Re: Best way to supply colo customer with specific provider

2007-02-01 Thread Joe Maimon
Rick Kunkel wrote: Hello all, Being relatively new to the colocation business, we run into a fair number of issues that we've never run into before. Got a new one today, and although I can think of kludgey ways to accomplish what he wants, I'd rather get some other ideas first... We

Re: AFP article on Taiwan cable repair effort

2007-01-14 Thread Joe Maimon
Bill Woodcock wrote: http://news.yahoo.com/s/afp/20070112/tc_afp/asiaquakeinternet_070112170621 A few numbers to help understand the scale of the effort being applied. -Bill But that was so long ago! Everything should be fixed already. customers

Re: Collocation Access

2006-12-28 Thread Joe Maimon
Joe Abley wrote: On 27-Dec-2006, at 18:22, Mark Newton wrote: On Thu, Dec 28, 2006 at 12:13:07AM +0100, Leo Vegoda wrote: My driving license doesn't have a photograph on it, so using it as an identity document is pointless. There's no way for a minimum-wage security grunt to verify

Re: Collocation Access

2006-12-28 Thread Joe Maimon
Marshall Eubanks wrote: Here is a true story. Pardon me for being a little vague about details. They should have retained his id. That would have helped.

Re: Collocation Access

2006-12-27 Thread Joe Maimon
Randy Epstein wrote: throughout the US. In recent memory, I can think of two large collocation centers that retain your ID. One is in Miami and one in New York (I don't think I need to name names, most of you know to which I refer). All others (including ATT) have never asked to retain

Re: Collocation Access

2006-12-27 Thread Joe Maimon
Does that equate to a take it or leave standpoint? Suppose you dont need a key cause your client is already there? Owen DeLong wrote: Savvis wants to retain your ID if they issue a cage-key to you. Owen On Dec 27, 2006, at 8:52 AM, Joe Maimon wrote: Randy Epstein wrote: throughout

Re: Collocation Access

2006-10-23 Thread Joe Maimon
Edward Lewis wrote: But, I always thought that the purpose of most security was psychological reassurance anyway... Reacting to this and the story of just walking through the backdoor to get in - I think there's an element of self-fulfilling prophecy here. If the Classical NANOG

Re: New router feature - icmp error source-interface [was: icmp rpf]

2006-09-25 Thread Joe Maimon
Patrick W. Gilmore wrote: On Sep 25, 2006, at 9:06 AM, Ian Mason wrote: ICMP packets will, by design, originate from the incoming interface used by the packet that triggers the ICMP packet. Thus giving an interface an address is implicitly giving that interface the ability to source

Re: Why is RFC1918 space in public DNS evil?

2006-09-18 Thread Joe Maimon
Matthew Palmer wrote: I've been directed to put all of the internal hosts and such into the public DNS zone for a client. My typical policy is to have a subdomain of the zone served internally, and leave only the publically-reachable hosts in the public zone. This sounds like you have

Re: BGP unsupported capability code

2006-08-18 Thread Joe Maimon
Danny McPherson wrote: On Aug 17, 2006, at 10:57 PM, Joe Maimon wrote: If A tries to peer with B, and B sends a BGP capability 64 to A, if A does not support that capability what would proper and/or reasonable behavior for A be? Speaker A MAY send a NOTIFICATION message with Open

BGP unsupported capability code

2006-08-17 Thread Joe Maimon
If A tries to peer with B, and B sends a BGP capability 64 to A, if A does not support that capability what would proper and/or reasonable behavior for A be? (a published source for it, if you could possibly do so.) a) send unsupported capability code 64 lengh 6 ## 2006-08-17 19:17:05 :

Re: SORBS Contact

2006-08-10 Thread Joe Maimon
Matthew Sullivan wrote: Mark Andrews wrote: Actually there can be false positive. ISP's who put address blocks into dialup blocks which have the qualification that the ISP is also supposed to only do it if they *don't* allow email from the block but the ISP's

Re: key change for TCP-MD5

2006-06-19 Thread Joe Maimon
Steven M. Bellovin wrote: I just submitted an I-D on TCP-MD5 key change. Until it shows up in the official repository, see http://www.cs.columbia.edu/~smb/papers/draft-bellovin-keyroll2385-00.txt Here's the abstract: The TCP-MD5 option is most commonly used to secure

Re: private ip addresses from ISP

2006-05-23 Thread Joe Maimon
Robert Bonomi wrote: TTL-E messages _do_ have legitimate function in network management. TTL-E messages _can_ originate from RFC1918 space, addressed to 'public internet' addresses. Usefully, and meaningfully. Ever hear of 'traceroute'? Ever use it where packets went across a network

Re: private ip addresses from ISP

2006-05-23 Thread Joe Maimon
Brian Johnson wrote: In the Cisco world, I thought that the source would always be the interface that replies to the ICMP packet. That seems to be good form to me. Where am I going wrong? You are correct, however it could be usefull in regards to the topic at hand if this was

Re: private ip addresses from ISP

2006-05-23 Thread Joe Maimon
Robert Bonomi wrote: Date: Tue, 23 May 2006 11:14:53 -0400 Translating those addresses is a *BAD*IDEA*(TM). That obscures who the reporting machine was _if_ you have to actually communicate with that network operator. These are the options: Construct the network so that icmp is

Re: private ip addresses from ISP

2006-05-23 Thread Joe Maimon
Joseph S D Yao wrote: Folks are sounding as if they'd never 'traceroute'd THROUGH a set of unroutable IP addresses. I have seen cases where my 'traceroute' looked like this [when I've had the patience to not hit Interrupt at the first sign of stars]: 1 1 ms 1 ms 1 ms router.here 2 10

Re: Anycast applicable to Radius Server Farm ?

2006-05-08 Thread Joe Maimon
Joe Shen wrote: Can you indicate in more detail what the problems were with the L4 switch? We seperate our Radius servers into two farms, each farm has a L4 switch in front. To our understanding, radius authentication info. and accounting info. of a PPPoE session should be processed by

Re: AOL 421 errors

2006-05-03 Thread Joe Maimon
Jim Popovitch wrote: Matthew Black wrote: I've been dealing with this too for 6 days now (2 of them while away on vacation). My sympathies. Sure there are spam problems, but to block requested email from reaching interested users (some of them being AOL employees

Re: Open Letter to D-Link about their NTP vandalism

2006-04-12 Thread Joe Maimon
Miquel van Smoorenburg wrote: In article [EMAIL PROTECTED], Matt Ghali [EMAIL PROTECTED] wrote: .or do you think that TCP/IP connection should be held open until the message can be scanned for spam and viruses just so we can give a 550 MESSAGE REJECTED error instead of silently dropping

Re: Spam filtering bcps [was Re: Open Letter to D-Link about their NTP vandalism]

2006-04-12 Thread Joe Maimon
Matthew Sullivan wrote: Suresh Ramasubramanian wrote: On 4/11/06, Matthew Black [EMAIL PROTECTED] wrote: Are you suggesting that we configure our e-mail servers to notify people upon automatic deletion of spam? Frequently, spam cannot be properly identified until closure of the SMTP

Re: Spam filtering bcps [was Re: Open Letter to D-Link about their NTP vandalism]

2006-04-12 Thread Joe Maimon
Matthew Black wrote: there's no bandwidth savings from silently dropping the message versus providing a 550 rejection. In the best of all worlds, it would be nice to give feedback. No system is perfect and a false-positive rate of less than one in a million 220 accepted messages seems

Re: Open Letter to D-Link about their NTP vandalism

2006-04-11 Thread Joe Maimon
Matthew Black wrote: On Mon, 10 Apr 2006 23:23:06 -0700 (PDT) Matt Ghali [EMAIL PROTECTED] wrote: On Tue, 11 Apr 2006, Simon Lyall wrote: Everyone here runs spam filters. Many times a day you tell a remote MTA you've accepted their email but you delete it instead. Explain the

Bad bgp identifier

2006-03-31 Thread Joe Maimon
4271 specifies that bgp identifier must be a valid unicast ip address So what is the larget 32 bit value expressed as a dotted quad that meets this requirement? Is it the last address in class c? class e? Can 255.x.x.x be used? Do all vendors implement this? I understand that

Re: Mutual Redistribution

2006-03-29 Thread Joe Maimon
Mark Smith wrote: On Tue, 28 Mar 2006 16:37:48 -0500 Did it happen to be RIPv1 ? Only RIPv2 supports route tags. Of course it was rip2 Rip1 is dead. Anyone using it should be shot.

Re: Mutual Redistribution

2006-03-28 Thread Joe Maimon
Mark Smith wrote: One better solution is to take advantage of route tags or labels. When a route is redistributed you tag it, and then when mutual redistribution occurs in the other direction, you exclude routes that have that tag. You'd need to do this in both redistribution directions,

Re: DNS TTL adherence

2006-03-14 Thread Joe Maimon
[EMAIL PROTECTED] wrote: Although you asked for DNS servers - it helps to remember that no matter what the servers and resolvers do - IE will bring that behaviour to naught in many cases http://support.microsoft.com/default.aspx?scid=KB;en-us;263558 */Thurman, Steven [EMAIL PROTECTED]/*

Re: Security problem in PPPoE connection

2006-03-12 Thread Joe Maimon
Joe Shen wrote: Hi, We are facing problem with PPPoE in ethernet access network. To provide high speed access, 10Mbps/100Mbps ethernet is used as access method. But, we found some guy 'steal' some other's account by listening to broadcasting packets, and they also set up 'phishing' PPPoE

Re: anybody here from verizon's e-mail department?

2006-02-22 Thread Joe Maimon
Dave Pooser wrote: Which probably means Paul is blocking whatever server Verizon is using for its sender verification Something I've seen before is a lot of mail servers will wait 10-45 seconds before presenting an SMTP prompt to remote hosts; spambots typically won't wait that long

a not so radical proposal for PI in ip6 world: Hierarchial routing tables

2006-02-16 Thread Joe Maimon
Since the list seems to be accepting topics relating to ipv6 and PI multihoming AGAIN, I thought I would chime in again with my pet idea. Hierarchical routing. It worked for name resolution. It would work for todays routing table, which is the routing equivalent to the host file of old.

stp questions

2006-02-08 Thread Joe Maimon
With 802.1w how normal is it for an environment with 8 switches ~300 ports with to exhibit 1-3 seconds of packet losss/latency/jitter everytime any port transitions to STP forwarding and causes topology change notices to ripple through the entire stp domain? The ports causing this are connected

On the inoc-dba subject

2006-02-06 Thread Joe Maimon
Is it really cluefull to have this paragraph? Please make sure that your spam filters allow email from pch.net before you sign up, since we will need to automatically verify your email address. Since we all know that whitelisting and blacklisting by in-band stated from email address is

Re: On the inoc-dba subject

2006-02-06 Thread Joe Maimon
Rubens Kuhl Jr. wrote: pch.net publishes a SPF record: v=spf1 ip4:204.61.210.70/32 mx mx:woodynet.net a:sprockets.gibbard.org a:ghosthacked.net ~all Besides going from soft-fail (~all) to fail (-all), they are already giving you the tools you need to validate a MAIL FROM: claim. Rubens

Re: The Backhoe: A Real Cyberthreat?

2006-01-19 Thread Joe Maimon
Dennis Dayman wrote: In 2004, Department of Homeland Security officials became fearful that terrorists might start using accidental dig-ups as a road map for deliberate attacks, and convinced the FCC to begin locking up previously public data on outages. In a commission filing, DHS argued

Re: The Qos PipeDream [Was: RE: Two Tiered Internet]

2005-12-18 Thread Joe Maimon
Chris Woodfield wrote: One thing to note here is that while VoIP flows are low volume on a bits-per-second basis, they push substantially more packets per kilobit than other traffic types - as much as 50pps per 82Kbps flow. And I have seen cases of older line cards approaching their

Re: The Qos PipeDream [Was: RE: Two Tiered Internet]

2005-12-18 Thread Joe Maimon
Jay Hennigan wrote: VoIP by design will have high PPS per connection as opposed to data flows. At 20 ms sample rates you have 50 pps regardless of the CODEC or algorithm. Increasing the time per sample to 40 ms would cut this in half but the added latency would result in degraded

Re: The Qos PipeDream [Was: RE: Two Tiered Internet]

2005-12-18 Thread Joe Maimon
Mikael Abrahamsson wrote: On Sun, 18 Dec 2005, Joe Maimon wrote: Something about intelligent edges? The payload length of voip applications often has a lot to do with rtt. Adapting payload length to the actuall average rtt could have a positive effect on pps throughput. What is your

Re: Two Tiered Internet

2005-12-14 Thread Joe Maimon
[EMAIL PROTECTED] wrote: On Wed, Dec 14, 2005 at 04:59:44AM -0500, Hannigan, Martin wrote: Since the model is based around cash, there is no perception except you pay, you get priority. Someone has to pay for the Internet. The users aren't. hum... then what am i getting for

Re: Gothcas of changing the IP Address of an Authoritative DNS Server

2005-12-14 Thread Joe Maimon
Joe Abley wrote: You also want to check all the registries which are superordinate to zones your server is authoritative for, and check that any IP addresses stored in those registries for your nameserver are updated, otherwise you will experience either immediate or future glue

Re: SMTP store and forward requires DSN for integrity (was Re:Clueless anti-virus )

2005-12-09 Thread Joe Maimon
Douglas Otis wrote: On Dec 9, 2005, at 10:15 AM, Todd Vierling wrote: 1. Virus warnings to forged addresses are UBE, by definition. This definition would be making at least two of the following assumptions: 1) Malware detection has a 0% false positive. Near enough so that

Re: oh k can you see

2005-11-01 Thread Joe Maimon
Sam Crooks wrote: One of those pesky legal notice on all my outgoing email gets filtered by Randy's mail ... (the outgoing addition is not under my control) maybe someone could tell him for me (as I can't email him...) you have sent a message to me which seems to contain a legal

Re: oh k can you see

2005-10-31 Thread Joe Maimon
Randy Bush wrote: so a few of us are still looking at routing through the anycast sunglasses. a particular probe is seeing instability [0] for k.root-servers.net [1]. so we hop on to a router nearby, and o this obscures their path to k1 o and, as they obey k0's NO_EXPORT, they can

Re: New Rules On Internet Wiretapping Challenged

2005-10-27 Thread Joe Maimon
Owen DeLong wrote: Frankly, I think we need to show the Senate and the House a movie titled The Siege and ask them if they really want to keep moving in this direction. Owen TH The real secret is that hollywood designs these films expressly as desensitizers, in cahoots with

Re: design of a real routing v. endpoint id seperation

2005-10-24 Thread Joe Maimon
[EMAIL PROTECTED] wrote: On Mon, 24 Oct 2005 12:53:12 CDT, John Dupuy said: In fact, this is technically feasible right now with IPv4. Does anyone know of a pair of ISPs doing this? technically feasible and business case reasonable are two different things. Under what conditions does

Re: design of a real routing v. endpoint id seperation

2005-10-21 Thread Joe Maimon
(apologies to Owen for CC'ng list, his points are valid concerns that I hadnt addressed or considered properly) Owen DeLong wrote: c) Carry a much larger table on a vastly more expensive set of routers in order to play. ISPs who dont wish to connect these customers should feel

design of a real routing v. endpoint id seperation

2005-10-20 Thread Joe Maimon
This is what I meant by suggesting that source routing was an original attempt at a seperation from routing/locating and endpoint identifiers. You can replace the concept of source routing in below with mpls TE, l2tpv3 or any other suitable encapsulation mechanism. The concept is that

Re: design of a real routing v. endpoint id seperation

2005-10-20 Thread Joe Maimon
Owen DeLong wrote: A customer with a prefix assigned from this chunk has to connect with an ISP who has * a Very Large Multihoming (to handle scaling concerns) router somewhere in its network that peers to other ISP Very Large Multihoming routers. ISP operating a VLMrouter to offer

Re: And Now for Something Completely Different (was Re: IPv6 news)

2005-10-16 Thread Joe Maimon
Tony Li wrote: It's just a mess. I think that we all can agree that a real locator/ identifier split is the correct architectural direction, but that's simply not politically tractable. If the real message that the provider community is trying to send is that they want this, and not

Re: And Now for Something Completely Different (was Re: IPv6 news)

2005-10-16 Thread Joe Maimon
Tony Li wrote: How is a split between locator / identifier any different logicaly from the existing ipv4 source routing? IPv4 source routing, as it exists today, is an extremely limited mechanism for specifying waypoints along the path to the destination. IOW the end stations were

Re: And Now for Something Completely Different (was Re: IPv6 news)

2005-10-16 Thread Joe Maimon
Mike Leber wrote: On Sun, 16 Oct 2005, Joe Maimon wrote: For example, if your goal was to have TCP-like sessions between identifiers survive network events without globally propagating full network topology information about your site (the gripe against classic IPv4 BGP) you could have

design of a real routing v. endpoint id seperation

2005-10-16 Thread Joe Maimon
How about something like this. A chunk of ipv6 space is carved off. This is assigned to multihoming desiring sites. All routers {can | should } filter this space from their tables completely by default - except the single prefix covering the entire space. A customer with a prefix

Re: Cogent/Level 3 depeering

2005-10-07 Thread Joe Maimon
Jay Adelson wrote: On Fri, Oct 07, 2005 at 01:29:06AM -0400, Patrick W. Gilmore wrote: You also forgot that Providers A B have to pay cab fare to get to those geographically dispersed corners. One might have to take the cab a lot longer than the other, incurring more time money.

Re: 209.68.1.140 (209.68.1.0 /24) blocked by bellsouth.net for SMTP

2005-09-25 Thread Joe Maimon
[EMAIL PROTECTED] wrote: Yes, this is quite clearly the case; there are dozens of mutual customers who have forwarding rules setup. We are not generating Spam to send to Bellsouth; it's coming from somewhere else and then being forwarded. I imagine that at some time in the future,

Re: level3.net in Chicago - high packet loss?!?

2005-09-06 Thread Joe Maimon
If the hop(s) following the one you see loss for shows no loss, then disregard the loss for that hop, obviously whatever it is, it does not affect transit, which is what you really want to know. Is that correct? Network Fortius wrote: And how exactly would you interpret the number

Re: 4-Byte AS Number soon to come?

2005-08-22 Thread Joe Maimon
Elvis DePaula wrote: Anyone in the list has a good update on the IETF:draftietf- idr-as4bytes-10.txt ? Is the projection os AS Number exhaustion of 2011-2013 exaggerated or do we really have a potential big problem with a slow solution ahead of us? -Elvis. Are you asking this after

Re: zotob - blocking tcp/445

2005-08-16 Thread Joe Maimon
Christopher L. Morrow wrote: On Mon, 15 Aug 2005, [EMAIL PROTECTED] wrote: NetBIOS was never meant to be a WAN protocol, so no problem in blocking it. rule #1: do not be the Internet's Firewall rule #2: see rule #1 Surely we realize that this discussion is not concerning the oft

IOS new architechture will be more vulnerable?

2005-08-03 Thread Joe Maimon
quotes from wired interview with Mike Lynn WN: So this new version of the operating system that they're coming out with, that's in beta testing. Lynn: It's actually a better architecture ... but it will be less secure That's why I felt it was important to make the point now rather

Re: NETGEAR in the core...

2005-07-30 Thread Joe Maimon
Rob Can a cisco 1600 run PPPoE? I've never tried it, but if they can run 12.2, they should do PPPoE. R Only suitable one is the 1605R (because you would never dial on the same ethernet that your lan is on right?) 20mb flash card and 16mb SIMM you have around and your up and running

Re: OT? /dev/null 5.1.1 email

2005-07-05 Thread Joe Maimon
David Andersen wrote: On Jul 5, 2005, at 11:28 PM, Steven M. Bellovin wrote: snip It's much easier to configure your backup MXen to not toss messages or send warning emails after 4h than it is to politely ask all sending SMTP servers to do the same. -Dave Apparently this has

Re: OMB: IPv6 by June 2008

2005-07-01 Thread Joe Maimon
Christopher L. Morrow wrote: On Fri, 1 Jul 2005, Mohacsi Janos wrote: This keeps coming up in each discussion about v6, 'what security measures' is never really defined in any real sense. As near as I can tell it's level of 'security' is no better (and probably worse at the outset, for the

Re: Email peering

2005-06-17 Thread Joe Maimon
[EMAIL PROTECTED] wrote: Similar concept, same scaling problems; it just hides the explicit routing from the user (as would any modern peering system, presumably). snip One way that it COULD be implemented is for people accepting incoming email on port 25 to check a whitelist before

Re: Email peering (Was: Economics of SPAM [Was: Micorsoft's Sender IDAuthentication......?]

2005-06-16 Thread Joe Maimon
Todd Vierling wrote: On Thu, 16 Jun 2005, [EMAIL PROTECTED] wrote: The proponents of email peering typically want to switch from the current model (millions of independant email servers) to a different model, with only a few big actors. I don't know who these proponents are, that you

Re: URPF on small BGP-enabled customers?

2005-06-03 Thread Joe Maimon
Pete Templin wrote: [EMAIL PROTECTED] wrote: This is new to me, but I haven't bought any new transit in the past 18 months -- is this common practice on multihomed BGP customers now? I could force things to work by always advertising all my prefixes out to them with the obvious downside

Re: URPF on small BGP-enabled customers?

2005-06-03 Thread Joe Maimon
Joe Abley wrote: On 2005-06-03, at 10:26, Andre Oppermann wrote: [EMAIL PROTECTED] wrote: I guess it's been a while since I've played with it, but isn't this pretty well what happens with uRPF anyhow? No, my proposal works as long as the customer advertizes their prefixes via

Blocking port udp/tcp 1433/1434

2005-05-11 Thread Joe Maimon
Is there still justification for denying transit for ms-sql slammer ports? Thanks, Joe

Re: Blocking port udp/tcp 1433/1434

2005-05-11 Thread Joe Maimon
Joe Maimon wrote: Is there still justification for denying transit for ms-sql slammer ports? Thanks, Joe Thanks all for your responses. To me it appears that a) If you block 135/445 you should block slammer as well b) If the number of potential infected hosts connected to your network can

Re: what will all you who work for private isp's be doing in a few years?

2005-05-11 Thread Joe Maimon
Matt Bazan wrote: why in the world would anyone want to purchase dsl from a private reseller when i can get 4mb down 384 up from comcast for $25? think you dsl resellers out there are doomed. in fact, just a matter of time before most of you isps are down the toilet. im reminded of the mom and

Re: Acceptable DSL Speeds (ms based)

2005-05-04 Thread Joe Maimon
Joel Jaeggli wrote: On Wed, 4 May 2005, Luke Parrish wrote: Andrew, traceroute is an effective tool is measuring roundtrip in ms format. packets sent to a router are typically processed differently and with different priority then packets forwarded through it. This makes traceroute fairly

Re: Schneier: ISPs should bear security burden

2005-05-02 Thread Joe Maimon
Steven Champeon wrote: on Sun, May 01, 2005 at 10:40:21PM -0400, Joe Maimon wrote: What does the rest of the internet gain when all IPs have boilerplate reverse DNS setup for them, especialy with all these wildly differing and wacky naming conventions? I don't care what the rest

Re: Slashdot: Providers Ignoring DNS TTL?

2005-05-01 Thread Joe Maimon
Dean Anderson wrote: And if they aren't found by open-relay blacklists, they aren't abused and there are no problems whatsoever. How much credibility are you trying to lose?

Re: Schneier: ISPs should bear security burden

2005-05-01 Thread Joe Maimon
Nicholas Suan wrote: Suresh Ramasubramanian wrote: On 4/30/05, Steven Champeon [EMAIL PROTECTED] wrote: ANantes-106-1-5-107.w193-251.abo.wanadoo.fr You'll see 'abo' for 'cable', perhaps? as well as 'cable'. But for most abo = short for abonnement, that is, subscription / subscriber Just means

Re: SMTP AUTH

2005-05-01 Thread Joe Maimon
Yes it is kindof amazing how well it works.. Unlike others on this list I have never claimed to have any credibility. I am just a small time op. Dean Anderson wrote: Using SORBS? just how much credibility do you want to lose? -- Forwarded message -- Date: Sun, 1 May 2005

Re: Port 25 - Blacklash

2005-04-27 Thread Joe Maimon
Suresh Ramasubramanian wrote: On 4/27/05, Joel Jaeggli [EMAIL PROTECTED] wrote: In any event the malware is already ahead of port 25 blocking and is leveraging ISP smarthosting. SMTP-Auth is the pill to ease this pain/ Really smtp-auth will solve it? or do most windows mua's cache your password?

Re: DNS cache poisoning attacks -- are they real?

2005-03-30 Thread Joe Maimon
Florian Weimer wrote: * Joe Maimon: How do spammers make step 5 succeed? They delegate www.example.com instead of example.com? I suspect I am some distance over the cliff here but nevertheless, onward. I dont get it. That has nothing to do with the registrar, or dodging forced deactivation

Re: DNS cache poisoning attacks -- are they real?

2005-03-27 Thread Joe Maimon
Suresh Ramasubramanian wrote: On Sat, 26 Mar 2005 17:52:56 -0500 (EST), Sean Donelan [EMAIL PROTECTED] wrote: snip Thank $DEITY for large ISPs running open resolvers on fat pipes .. those do come in quite handy in a resolv.conf sometimes, when I run into this sort of behavior. --srs Slightly OT

Re: Please verify RFC1918 filters

2005-03-27 Thread Joe Maimon
vijay gill wrote: On Tue, Mar 22, 2005 at 03:13:07PM -0800, Randy Bush wrote: y'all might give us something pingable in that space so we can do a primitive and incomplete test in a simple fashion. randy try 172.128.1.1 /vijay Wouldnt 172.15.255.254 and 172.32.0.1 do better at helping to nail

Re: 72/8 friendly reminder

2005-03-27 Thread Joe Maimon
Jon Lewis wrote: On Thu, 24 Mar 2005, Randy Bush wrote: snip [1] at least not until cisco adds a feature allowing you to ignore new BGP routes for subnets of a bogon feed. Last I understood from c-nsp this was a feature without much interest. Is such a feature expected to arrive anytime soon?

Re: DNS cache poisoning attacks -- are they real?

2005-03-27 Thread Joe Maimon
[EMAIL PROTECTED] wrote: On Sun, Mar 27, 2005 at 11:36:26AM -0500, Joe Maimon wrote: snip er... common best practice for YOU... perhaps. dnsreport.com is apparently someone who agrees w/ you. and i know why some COMMERCIAL operators want to squeeze every last lira from

Re: Fire Code/UFC Regs?

2005-03-13 Thread Joe Maimon
Josh Vince wrote: Here's what APC has to say about it:

  1   2   >