Re: Cisco etherchannel question

2004-10-20 Thread william(at)elan.net
ic and only one destination) and solution in this case appears to be to manually change MAC addresses of some servers until I can acheive better load-balancing. On Wed, 20 Oct 2004, william(at)elan.net wrote: > Hi, > > I have etherchannel setup between cisco 7500 router and 5500 switch. >

Cisco etherchannel question

2004-10-20 Thread william(at)elan.net
Hi, I have etherchannel setup between cisco 7500 router and 5500 switch. For data going from 7500 router everything seems to be ok and data is well split between four interfaces with about 1/4th sent to each one (about 40% utilization each right now). But for data going from 5500 switch the s

Re: short Botnet list and Cashing in on DoS

2004-10-13 Thread william(at)elan.net
On Wed, 13 Oct 2004, David Barak wrote: > > and anyone posting from yahoo/gmail/hotmail should have > > their posting rights immediately revoked because > > obviouslythey have no claim whatsoever to any critical > > Network Operations. > > You had me until then: has it not occurred to you that

Re: Is those ICP crazy -- 10GB free emailbox?

2004-09-29 Thread william(at)elan.net
On Wed, 29 Sep 2004, Joe Shen wrote: > > Hi, > > I just received an email from one of my friends and he > told me http://www.hriders.com/ is providing free 10GB > email box for subscribers. Translation: We don't have a functioning quota filesystem so we'll let subscribers have as much space

Re: IETF anti-spam MARID group disbands

2004-09-28 Thread william(at)elan.net
On Tue, 28 Sep 2004, Hank Nussbacher wrote: > > http://www.nwfusion.com/news/2004/092704ietfspam.html http://www.moongroup.com/index.php?option=content&task=view&id=31&Itemid=2 -- William Leibzon Elan Networks [EMAIL PROTECTED]

Re: APNIC Privacy of customer assignment records - implementation update

2004-09-23 Thread william(at)elan.net
On Thu, 23 Sep 2004, Leo Bicknell wrote: > In a message written on Thu, Sep 23, 2004 at 05:56:42PM -0400, Joe Abley wrote: > > The proposal (which comes from APNIC members, not from APNIC staff) > > concerns non-portable addresses assigned to end-users. I don't know > > about anybody else, but

Re: APNIC Privacy of customer assignment records - implementation update

2004-09-23 Thread william(at)elan.net
On Thu, 23 Sep 2004, Matt Ghali wrote: > On Thu, 23 Sep 2004 16:19:19 +1000, George Michaelson <[EMAIL PROTECTED]> wrote: > > > This is an important announcement on the implementation of APNIC > > approved proposal prop-007-v001 regarding privacy of customer assignment > > records. The proposal

Questinair about email policy records to indicate proper source of email (RE: FW: The worst abuse e-mail ever, sverige.net)

2004-09-22 Thread william(at)elan.net
> As such, when we have seen our IP blocks get blocked strictly because of > the rDNS entry having 'dsl' in it, a simple email to the admins > explaining that we are not providing dynamic services has gotten our > rDNS entries taken off of the blacklist. I don't particularly like situation where

Re: European Nanog?

2004-09-13 Thread william(at)elan.net
On Mon, 13 Sep 2004, Arnold Nipper wrote: > As already noted here a couple of times: > > RIPE != RIPE NCC > > Although MERIT is organizing NANOG meetings, no one would say: MERIT == > NANOG. Right? Not quite. As far as I'm concerned, NANOG is part of MERIT activities. And while I'm not c

Re: ISP Policies

2004-09-08 Thread william(at)elan.net
On Thu, 9 Sep 2004, Tulip Rasputin wrote: > Hi, > > I have a general policy question. > > Do the ISPs ever look for some particular AS number in the BGP AS_PATH and > then decide what action/preference/priority they need to take/give based on > the AS number(s) present in the BGP AS_PATH_SEQ/

Re: OT- need a new GSM provider

2004-09-02 Thread william(at)elan.net
On 2 Sep 2004, Paul Vixie wrote: > Now that AT&T has followed T-Mobile's example by screwing the pooch on my > cell phone billing, and I've flung yet another SIM-locked Motorola V600 > out the window of yet another moving vehicle, and am about to enter into > another year long "you violated the

Re: BGP-based blackholing/hijacking patented in Australia?

2004-08-13 Thread william(at)elan.net
On Fri, 13 Aug 2004, Bevan Slattery wrote: > > > > Hi, > > > > Just to ease peoples concerns, the patent has nothing to do with > > blackholing. A brief description of the way it works can be found here: > > > > http://www.scamslam.com/ScamSlam/whatis.shtml And based on what I've read, the

Re: Google?

2004-07-26 Thread william(at)elan.net
> > Google seems to fail on every search containing the word 'mail' ? > > http://isc.sans.org/diary.php?isc=d46940064182f61f40ca333bc3c2f439 > > Operational in the context that it's a response to a network traveling > worm, and will generate customer calls. Don't know about customer calls, bu

Re: VeriSign's rapid DNS updates in .com/.net

2004-07-23 Thread william(at)elan.net
On Fri, 23 Jul 2004, Duane Wessels wrote: > Maybe, but don't forget that when BIND9 and DJBDNS caches find > expired nameserver address (A) records they don't trust any cached > data and start them back at the roots. And in the case of BIND9, > it sends both A and A6 queries for each nameserver

Re: VeriSign's rapid DNS updates in .com/.net

2004-07-22 Thread william(at)elan.net
On Fri, 23 Jul 2004, Richard Cox wrote: > The key here is not registration but change. Currently, while spammers > and other malfeasants have the ability to send out through compromised > proxies and zombied PCs, there is little that can be done to identify > them until they require a response,

Re: VeriSign's rapid DNS updates in .com/.net

2004-07-22 Thread william(at)elan.net
On Thu, 22 Jul 2004, Daniel Karrenberg wrote: > What I am concerned about is the pressure to lower TTLs across the board > if the increase in zone update speed creates expectations that it alone > cannot fulfill. > > I observe this being sold as "instantaneous updates" instead of > "instantaneo

Re: VeriSign's rapid DNS updates in .com/.net

2004-07-22 Thread william(at)elan.net
On Thu, 22 Jul 2004, Eric Brunner-Williams in Portland Maine wrote: > > the primary beneficiaries of this > > new functionality are spammers and other malfeasants, > > I think this is a true statement. I think it is important to keep in > mind that registry operators "compete" for TLD franchise

Re: VeriSign's rapid DNS updates in .com/.net

2004-07-14 Thread william(at)elan.net
re are any problems found that would arrise from the change that the plan to address them would be made available. -- Forwarded message -- Date: Mon, 12 Jul 2004 04:35:36 -0700 (PDT) From: "william(at)elan.net" <[EMAIL PROTECTED]> To: Matt Larson <[EMAIL

Re: Spyware becomes increasingly malicious

2004-07-12 Thread william(at)elan.net
On Mon, 12 Jul 2004, William Warren wrote: > coolwebsearch has become more and more sneaky..so bad that > development of cws shredder has been abandoned by its > developerEither serious lock down you ie(which with CWS is > not going to help) or use something other than ie. http://www.sec

Re: VeriSign's rapid DNS updates in .com/.net

2004-07-12 Thread william(at)elan.net
On Fri, 9 Jul 2004, Matt Larson wrote: > VeriSign Naming and Directory Services (VNDS) currently generates new > versions of the .com/.net zones files twice per day. VNDS is > scheduled to deploy on September 8, 2004 a new feature that will > enable VNDS to update the .com/.net zones more frequ

Re: Non-Portable ip blocks become portable (was - Can a Customer take their IP's with them? )

2004-06-30 Thread william(at)elan.net
On Tue, 29 Jun 2004, william(at)elan.net wrote: > Not an ARIN example but when KPNQwest went out of business, the situation > was as you desribe and it would have been difficult to everybody to quickly > renumber so their PA assigned customer ip blocks with assistance of RIPE &g

Re: (UPDATE) Can a Customer take their IP's with them? (Court says yes!)

2004-06-30 Thread william(at)elan.net
On Wed, 30 Jun 2004, Dan Hollis wrote: > On Wed, 30 Jun 2004, Sabri Berisha wrote: > > And then I'm not even taking into account the fact that the UCI/Pegasus > > is a well-known spammer (http://www.spews.org/html/S2649.html). > > I imagine NAC is pretty tired of being RBL'd. Can't blame them fo

Non-Portable ip blocks become portable (was - Can a Customer take their IP's with them? )

2004-06-29 Thread william(at)elan.net
On Tue, 29 Jun 2004, Crist Clark wrote: > Also can one think of other circumstances where non-portable IPs should > become portable without reallocation through ARIN? Say, *poof*, ISP > goes out of business _very_ suddenly with no one buying up its assets > and taking over its operations quickly

Re: Can a Customer take their IP's with them? (Court says yes!)

2004-06-29 Thread william(at)elan.net
On Tue, 29 Jun 2004, Matthew Crocker wrote: > The TRO is irrelevant, The courts made the wrong decision, did anyone > actually think they would have a clue? Actually, after reading most of the papers which Richard just made available at http://www.e-gerbil.net/ras/nac-case/ I don't see that c

Re: Can a customer take IP's with them?

2004-06-29 Thread william(at)elan.net
On Tue, 29 Jun 2004, Edward B. Dreger wrote: > JL> Date: Tue, 29 Jun 2004 08:08:03 -0400 (EDT) > JL> From: Jon Lewis > > JL> If someone figures out the IP block in question let me know. > > I don't know the rogue netblock, but > http://www.fixedorbit.com/cgi-bin/cgirange.exe?ASN=8001 Mor

Re: Can a Customer take their IP's with them? (Court says yes!)

2004-06-28 Thread william(at)elan.net
What you really should try is to have ARIN provide "friend of the court" brief and to explain to judge policies and rules in regards to ip space, so you need to have your laywer get in touch with ARIN's lawyer. You can probably even force them to provide a statement or testimony (if they don'

Re: The use of .0/.255 addresses.

2004-06-26 Thread william(at)elan.net
On Sat, 26 Jun 2004, Jared Mauch wrote: > This includes Washington state host software vendors that > may need to distribute patches for networking stacks with defects > in their handling of outbound TCP connections (referenced in an alternate > email..) Then of course we could use their i

Re: Attn MCI/UUNet - Massive abuse from your network

2004-06-24 Thread william(at)elan.net
On Thu, 24 Jun 2004, Curtis Maurand wrote: > spamhaus has gotten too agressive. Its now preventing too much legitimate > email. Spammers have gotten too agressive. If you don't filter you would not see any legitimate email. -- William Leibzon Elan Networks [EMAIL PROTECTED]

Re: Verisign vs. ICANN

2004-06-17 Thread william(at)elan.net
On Fri, 18 Jun 2004, Paul Vixie wrote: > > Anything I/we can do to help the cause? > > not at the moment. i'm not a defendant, just a named co-conspirator. Hah? Are they also naming individually all the dns operators that installed bind patch and specifically enabled it so that wildcards woul

Re: "Default" Internet Service

2004-06-14 Thread william(at)elan.net
On Mon, 14 Jun 2004, Owen DeLong wrote: > > Point I am making is that the post office is not responsible and/or > > liable for the content of the packages they deliver. However, if they > > deliver packages that are obviously visibly dangerous to the recipient > > they have an obligation to i

Re: Verizon IP's and ARIN Records

2004-06-08 Thread william(at)elan.net
> ARIN is cracking down on IP Space that is or has been issued (legally) and > have been found to have the contact records "out of date" or the e-mail > addresses either don't work or their are mailboxes full and so on. You will > see more and more of these allocations being removed for failing

Re: Verizon IP's and ARIN Records

2004-06-07 Thread william(at)elan.net
Based on this problem, completewhois has stopped listing 206.46.0.0/16 as a bogon (and actively having it blocked through dns for those using bogons.dnsiplists.completewhois.com for active blocking in email), this exception will last 48 hours. If you're using bogon lists in firewall with daily

Re: Site elimination service -:) - I received offer by 's'p'a'm'

2004-06-05 Thread william(at)elan.net
it'd likely be done on the specialized forums. That is why I asked how targeted do you think that email was... On Fri, 4 Jun 2004, Alexei Roudnev wrote: > Of course, this is not new on IRC, but it is new in SPAM. > > - Original Message - > From: "william(at)

Re: Site elimination service -:) - I received offer by 's'p'a'm'

2004-06-04 Thread william(at)elan.net
On Fri, 4 Jun 2004, Alexei Roudnev wrote: > Ooo, a great idea. As a result - $60 for QA, plus a chance to catch a > criminal -:). Just as _want to test network IDS - set up IRC, join it into > EFNet, and here you are_. > > Generally speaking, I think it deserves attention (this adv.). You're as

Re: New block of AS Numbers to ARIN

2004-05-28 Thread william(at)elan.net
Historic moment. 32k+ ASN assignments are coming! On Fri, 28 May 2004, Doug Barton wrote: > > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > This is to inform you that the IANA has allocated the following > block of AS Numbers to ARIN: > > 32768 - 33791 > > For a full list of IANA AS

Re: New IANA allocations to RIPE NCC

2004-05-07 Thread william(at)elan.net
On Sat, 8 May 2004, Bastiaan Spandaw wrote: > On Sat, 2004-05-08 at 03:30, william(at)elan.net wrote: > > > My understanding is that they have made twice as many ip6 allocations as > > rest of the world combined! That is very impressive indeed!!! > > But its still not e

Re: New IANA allocations to RIPE NCC

2004-05-07 Thread william(at)elan.net
On Sat, 8 May 2004, Iljitsch van Beijnum wrote: > On 8-mei-04, at 1:18, william(at)elan.net wrote: > > > Why so many ip6 blocks at once? > > The RIPE NCC gives out /32s to ISPs, but they actually reserve a /29. > This means they have to get a new /23 for every 64

Re: New IANA allocations to RIPE NCC

2004-05-07 Thread william(at)elan.net
Also FYI - I noticed this message was actually signed (PGP) and I believe that may be first iana announcement message that was, thank you !!! P.S. Of course its also notable that it says "Version: PGP 8.0 - not licensed for commercial use". I kind of wonder if use by IANA or ICANN is considere

Re: New IANA allocations to RIPE NCC

2004-05-07 Thread william(at)elan.net
Why so many ip6 blocks at once? Its not that I'm worrried about us running out of ip space for ip6 :) but is ripe really using ip6 20 times more then rest of the world? On Fri, 7 May 2004, John L Crain wrote: > > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Greetings, > > This is t

RE: FW: Worms versus Bots

2004-05-05 Thread william(at)elan.net
On Wed, 5 May 2004 [EMAIL PROTECTED] wrote: > > (To deflect the inevitable "NAT is not a firewall" complaints, the box > is a > > stateful inspection firewall -- as all NAT boxes actually are). > > Hmmm, are you saying that the solution to many so-called > Internet security vulnerabilities i

Re: Worms versus Bots

2004-05-03 Thread william(at)elan.net
On Mon, 3 May 2004, Sean Donelan wrote: > On Mon, 3 May 2004, Rob Thomas wrote: > > ] Just because a machine has a bot/worm/virus that didn't come with a > > ] rootkit, doesn't mean that someone else hasn't had their way with it. > > > > Agreed. > > Won't help. What's the first thing people do

Re: Lsass.exe causing shutdown in IE.

2004-05-01 Thread william(at)elan.net
Yes, for last couple days I'm getting constant nagios reports about some windows servers getting rebooted all the time (these are all win2000 but obviously it has same kernel as xp and viruses and exploits are all same) I could not find any good way to actually shut this all down on firewall lev

RE: why use IPv6, was: Lazy network operators

2004-04-18 Thread william(at)elan.net
On Sun, 18 Apr 2004, Michel Py wrote: > - Tomorrow, IPv4 will get the small upgrades that are needed. Like what? 128bit ip addresses so we don't run out 10 years from now? Or ability to do QoS PtP over internet? Or security that is built in and not part of additional layer? Perhaps ipv6 has

looking for cisco person in regards to completewhois

2004-04-12 Thread william(at)elan.net
If there is somebody from Cisco on this list who has been accessing completewhois port 43 whois service with thousands of consequitive queries for last few days (or possibly somebody else from cisco who can lookup in your gateway/firewall logs to see it was) then please contact me for privat

Re: Mail with no purpose?

2004-04-01 Thread william(at)elan.net
On Thu, 1 Apr 2004, Eric A. Hall wrote: > On 4/1/2004 11:15 AM, william(at)elan.net wrote: > > > Where as WYSIWYG html email client (no matter if its web-based or > > outlook or mozilla) will reference and display all images contained in > > email > > You can turn

Re: Mail with no purpose?

2004-04-01 Thread william(at)elan.net
On Thu, 1 Apr 2004, Richard Cox wrote: > Some times the request goes to the website, sometimes a DNS request to > nameservers is sufficient to cause the account to be tagged as active. I don't quite understand how that would work. DNS Request does not contain name of who the email is addressed

RE: Spam with no purpose?

2004-03-31 Thread william(at)elan.net
On Wed, 31 Mar 2004, Michel Py wrote: > > > Deepak Jain wrote: > > Can someone explain to me (publicly or privately) why someone > > would send spam with no product to sell, no position to pitch, > > nothing except text designed to get by a spam filter -- without > > even HTML to KNOW it got by

Re: So, What Now, NANOG? Was: Request response [important]

2004-03-18 Thread william(at)elan.net
On Thu, 18 Mar 2004, Daniel Golding wrote: > Its time to figure out what to do about this, employing a proactive stance. > The answer is not "start a new mailing list". Names have power, as they say, > and NANOG has the juice. So, a few simple proposals for people to chew > over... > > 1) Turn o

Re: Hi (fwd)

2004-03-17 Thread william(at)elan.net
ters joined together are getting nastier and nastier. On Wed, 17 Mar 2004, william(at)elan.net wrote: > > Me thinks somebody has found a trapdoor in nanog mailsetup and is in > general out to get us ... > > This one supposedely came from 203.18.63.43 (australia powerhous museum -

Re: Hi (fwd)

2004-03-17 Thread william(at)elan.net
Me thinks somebody has found a trapdoor in nanog mailsetup and is in general out to get us ... This one supposedely came from 203.18.63.43 (australia powerhous museum - phm.gov.au) and advertises page on ip 165.134.187.102 (saint louis univerisity - slu.edu). "Connection refused" when I tried

Question on possibly using route switch as standby backup to router

2004-03-17 Thread william(at)elan.net
(On topic to nanog for a change...) I'll be soon going through resetup of one of our primary hosting POPs (moving to different DC and upstream provider) and as a result have opportunity to make some changes to the configuration, etc and want to set it up so there is standby backup available

Strange message possibly through nanog mail server

2004-03-17 Thread william(at)elan.net
I Just received this. I would like to check if others have received it and did it indeed come through nanog mailist: > Date: Wed, 17 Mar 2004 21:10:38 + > From: Deep Throat <[EMAIL PROTECTED]> > To: [EMAIL PROTECTED] > Subject: Spamhaus Exposed > > Disturbing information on one of the found

Re: Packet Kiddies Invade NANOG

2004-03-16 Thread william(at)elan.net
On Tue, 16 Mar 2004 [EMAIL PROTECTED] wrote: > > On Tue, 16 Mar 2004, Alexei Roudnev wrote: > > > Hmm, if someone (except masochists and security vendiors) still hosts > > efnet... I can only send them my condoleences. > > > > I saw sthe same dialogs 6 years ago. Nothing changes. > > What abo

Re: 2001:590::/32 announced by both AS4436 (nLayer) and AS4474 (Global Village, no contact in whois, but seems to be nLayer...)

2004-03-16 Thread william(at)elan.net
Why would nlayer be now using AS4436? It is listed as scruz.net, but as far as I remember scruz was taken overy by DSL.NET (I think that even included their peering agreements) and some of their ip block such as 204.139.8.0/21, 204.147.224.0/20 and others certainly seem to confirm that. As fa

PRISP (ISP Provisiong) Project (was - Ipal project)

2004-03-15 Thread william(at)elan.net
have been some smaller discussions last week on different mail lists but we're starting it all again to keep track of this in archives): -- Date: Mon, 15 Mar 2004 13:40:26 -080D (PST) From: "william(at)elan.net"

Re: who offers cheap (personal) 1U colo?

2004-03-14 Thread william(at)elan.net
On Sun, 14 Mar 2004, Stephen Sprunk wrote: > Students have an existing legal relationship with the school; they can be > required to accept the AUP in writing at some point during the enrollment > process. They may have legal relationship with the school but internet service can be considered t

Re: who offers cheap (personal) 1U colo?

2004-03-14 Thread william(at)elan.net
On Sun, 14 Mar 2004, Christopher L. Morrow wrote: > > What do you think spews wants? My experience with them has been that > > that's pretty much the only thing that will satisfy them. I have had > > That's funny since we've cleaned up several over the years, yet they are > still listed... and

Re: wholesalebandwidth.com major sponsor of spammers refuses to accept email at abuse

2004-03-11 Thread william(at)elan.net
On Fri, 12 Mar 2004, Suresh Ramasubramanian wrote: > > Henry Linneweh writes on 3/12/2004 8:41 AM: > > I have received almost 200 different spam messages from domains > > hosted by this provider from russain domains attempting to sell > > pharmacueticals and other unsolicited services that I d

Re: Counter DoS

2004-03-11 Thread william(at)elan.net
On Thu, 11 Mar 2004, Laurence F. Sheldon, Jr. wrote: > Petri Helenius wrote: > > > Maybe there is a lesson to be learned from many RBL operators. To make > > sure, just send packets to the whole /24 or /16 you got an "attack" > > packet from. > > Which RBL operators flood /24's or /16's? What

Re: Ipal project (was - Summary: Web Based tool for tracking circuits)

2004-03-11 Thread william(at)elan.net
e. IPal is a commercial product available > from Internet Associates LLC. (www.internetassociatesllc.com). > > - Dennis > > On Thu, Mar 11, 2004 at 11:17:12AM -0800, william(at)elan.net wrote: > > > > > > We're starting project to create opensource software hel

Ipal project (was - Summary: Web Based tool for tracking circuits)

2004-03-11 Thread william(at)elan.net
We're starting project to create opensource software help ISPs to provision network services and track information related to that afterwards. This would include allocation of ip addresses and database of such allocations, database of circuits and network devices, administration and colloborat

Re: Counter DoS

2004-03-11 Thread william(at)elan.net
On Thu, 11 Mar 2004, Petri Helenius wrote: > Gregory Taylor wrote: > > Oh yes, lets not forget the fact that if enough sites have this > > 'firewall' and one of them gets attacked by other sites using this > > firewall it'll create a nuclear fission sized chain reaction of > > looping Denial o

Re: Counter DoS

2004-03-10 Thread william(at)elan.net
On Wed, 10 Mar 2004, Joshua Brady wrote: > > http://news.zdnet.co.uk/internet/security/0,39020375,39148215,00.htm > Comments? This is not really a comment about this article. But I really think it would have been better if people don't just put the link and then say "comments" but actually p

Re: Summary: Web Based tool for tracking circuits

2004-03-08 Thread william(at)elan.net
Several commercial ip allocation systems exist (cost thousands, I came across couple of them but did not keep list). The closest opensource on this is freeipdb (http://www.freeipdb.org), but its not very feature-rich. The IRM project (which I've never heard about until I just demod it right no

Re: "Information Warfare"

2004-03-06 Thread william(at)elan.net
On Fri, 5 Mar 2004, John Bishop wrote: > > Since it has the potential to make everyone's jobs here more interesting, I > thought I'd bring it up and get everyone's opinion. This company claims to be > developing a "security solution" that claims to "fight back" against attackers. > > I'm sure

Re: Bagle and other recent viruses (Was: warning - new trend of attempts to infect ISP users, possibly virus)

2004-03-04 Thread william(at)elan.net
Or was there something more devious behind the surge? The answer, said security experts, is a bit of both, with some fighting over hacker turf thrown in for good measure ..." On Thu, 4 Mar 2004, william(at)elan.net wrote: > On Wed, 3 Mar 2004, Stephen J. Wilcox wrote: > > > Perh

Bagle and other recent viruses (Was: warning - new trend of attempts to infect ISP users, possibly virus)

2004-03-04 Thread william(at)elan.net
On Wed, 3 Mar 2004, Stephen J. Wilcox wrote: > Perhaps I'm only following this as its affecting us more, but I dont recall a > time previously when I've had so many viruses hitting us and getting thro our > scanners with nothing we can do about it. I dont recall seeing viruses with > variants

Re: UUNet Offer New Protection Against DDoS

2004-03-02 Thread william(at)elan.net
On Tue, 2 Mar 2004, John Obi wrote: > Hello Nanogers! > > I'm happy to see this, and I hope C&W, Verio, and Level3 will do the same! > http://informationweek.securitypipeline.com/news/18201396 "MCI/WorldCom Monday unveiled a new service level agreement (SLA) to help IP services customers thwa

Warning - new trend of attempts to infect ISP users (possibly virus)

2004-03-02 Thread william(at)elan.net
I have just seen emails (several different kinds) pretending to be sent from 3 of my isp domains to users of those domains warning users that their email account would be disabled and asking to open a .pif attachment. I know largest ISPs probably have expierenced this but I believe what I have

Re: The Geography of Spam

2004-03-02 Thread william(at)elan.net
> On 2 Mar 2004, at 15:57, Michael Airhart wrote: > > Somehow it seems like when you take into account the number of PCs on > > high speed connections, these numbers make a lot of sense. The US has > > a large population of these PCs so yeah, duh, the US leads in > > compromised hosts. > > W

Re: Lawsuit on ICANN (was: Re: A few words on VeriSign's sitefinder)

2004-02-26 Thread william(at)elan.net
On Thu, 26 Feb 2004, Deepak Jain wrote: > > Since no one else has mentioned this: > > http://biz.yahoo.com/rc/040226/tech_verisign_2.html And I'm sure ICANN will remember it for long time - right up to the point when Verisign's contracts for .com/.net management are up for renewal. -- Willia

Re: Lawsuit on ICANN (was: Re: A few words on VeriSign's sitefinder)

2004-02-26 Thread william(at)elan.net
d on that Verisign rule over these tlds ends in November 2007 On Thu, 26 Feb 2004, Roman Volf wrote: > > When are they up for renewal exactly? > > william(at)elan.net wrote: > > >On Thu, 26 Feb 2004, Deepak Jain wrote: > > > > > >>Since no one else has

Re: Lawsuit on ICANN (was: Re: A few words on VeriSign's sitefinder)

2004-02-26 Thread william(at)elan.net
On Thu, 26 Feb 2004, John Kinsella wrote: > > > When are they up for renewal exactly? > > November 10, 2007, according > > Any way to speed that up? ;) http://www.icann.org/tlds/agreements/verisign/registry-agmt-com-25may01.htm "16. Termination ... B. In the event of termination by DOC of its

RE: New Draft Document: De-boganising New Address Blocks

2004-02-24 Thread william(at)elan.net
BTW - in the email it meant to be just stand DOS (Original IBM PC Operating System based on CP/M), I automaticly write small "o" now when using this word because of how I've used it in the last sevaral years On Tue, 24 Feb 2004, william(at)elan.net wrote: > > On Tue, 2

RE: Proposal: De-boganising New Address Blocks

2004-02-24 Thread william(at)elan.net
On Tue, 24 Feb 2004 [EMAIL PROTECTED] wrote: > Assuming the pilot program does some form of reachability testing and then > some effort is made to notify those with bad filters (good luck), then at > least this notifies them before it's a real inconvenience for anyone. > They may or may not c

RE: New Draft Document: De-boganising New Address Blocks

2004-02-24 Thread william(at)elan.net
On Tue, 24 Feb 2004, Michel Py wrote: > Hint: all this bogon or related filtering is not a long-term solution. > We need it now, but the long term solution is some kind of > authentication that will allow only the rightful owner of a block to > announce it. This I completely agree with. The corr

RE: New Draft Document: De-boganising New Address Blocks

2004-02-24 Thread william(at)elan.net
On Tue, 24 Feb 2004, Michel Py wrote: > > William, > > > william(at)elan.net wrote: > > [http://www.cymru.com/BGP/bogon-rs.html] > > Unfortunetly this is kind-of a bgp hack and as has > > been already mentioned it needs very carefull > > implemention >

Re: New Draft Document: De-boganising New Address Blocks

2004-02-24 Thread william(at)elan.net
On Tue, 24 Feb 2004, Timothy Brown wrote: > > Completewhois bogon ip lists provide data on ip blocks that are not allocated > > by RIRs to ISPs (rather then just list of /8 blocks not allocated by IANA > > to RIRs as for example cymru does). The list can be used for anti-spam > > filtering thro

Re: 168.0.0.0/6

2004-02-24 Thread william(at)elan.net
This has been mentioned on nanog maillist before, it appears several months after notification swisscom still has not fixed this problem (when similar leak came from he, I think they fixed it in 48 hours!). Here are pointers to previous thread: http://www.merit.edu/mail.archives/nanog/2003-11

Re: New Draft Document: De-boganising New Address Blocks

2004-02-24 Thread william(at)elan.net
On Tue, 24 Feb 2004, Timothy Brown wrote: > On Tue, Feb 24, 2004 at 04:32:46PM +, [EMAIL PROTECTED] wrote: > > > > >The RIPE NCC has prepared a draft document titled "De-Bogonising New > > >Address Blocks": > > > > That is a misleading title. I agree, consindering the block is still a bogo

RE: Genu/L3 Major Outage

2004-02-23 Thread william(at)elan.net
FYI - this is probably regarding the same issues: http://www.dslreports.com/shownews/39381 They are reporting it as DDOS from "compromised home PCs", i.e. zombies. There are some interesting rumors there (note its nothing more then rumors) from lusers about possible irc connections and this be

Re: BL of Compromised Hosts?

2004-02-22 Thread william(at)elan.net
On 22 Feb 2004, Robert E. Seastrom wrote: > "Michel Py" <[EMAIL PROTECTED]> writes: > > > There is a regrouping of BGP feeds for various "questionable" hosts and > > networks around AS29467; That is actually not correct. The AS29467 will stay as being used for BOGON and similar data. It is qu

Re: eBGP, iBGP, injecting networks

2004-02-20 Thread william(at)elan.net
Note - I got confused by the subject and everything myself. The routes you have locally would not be from IBGP but just directly through IGP (i.e. OSPF or EIGRP etc). I don't think you can really do IBGP if routers are not configured with the same ASN. On Fri, 20 Feb 2004, willi

Re: eBGP, iBGP, injecting networks

2004-02-20 Thread william(at)elan.net
Ok. The way I read this is that you're redundant as far as one of your upstream links going down - it'd not cause complete meltdown as that router that had that link would still be announcing that space to the other router (over EBGP) and then to the net. What you're worrying then is what ha

Re: Verisign wins an award...

2004-02-20 Thread william(at)elan.net
Small clarification, this was award for year 2003. But I think they are planning on being nominated (and winning) this year as well ... On Fri, 20 Feb 2004, Ray Bellis wrote: > > Seeing as this didn't appear to hit NANOG yet - > > Our dear friends at Verisign won the "Internet Villain" of th

Re: Open, anonymous services and dealing with abuse

2004-02-17 Thread william(at)elan.net
On Tue, 17 Feb 2004 [EMAIL PROTECTED] wrote: > Trojaned PCs and zombie proxies relaying spam are like cold > sores; they don't kill anyone, they just make things mildly > uncomfortable, so we numb them over, and go about our > business like normal, even if that includes allowing the > infection t

RE: Anti-spam System Idea

2004-02-14 Thread william(at)elan.net
On Sat, 14 Feb 2004 [EMAIL PROTECTED] wrote: > > On Sat, 14 Feb 2004, Tim Thorpe wrote: > > > If these exist then why are we still having problems? > > Because the spammers are creating proxies faster than any of the anti-spam > people can find them. Evidence suggests, at least on the order

Re: Anti-spam System Idea

2004-02-14 Thread william(at)elan.net
There are several groups working on identifying open relays, proxies, etc and creating lists of such ips for active blocking. For example see http://www.spamhaus.org/xbl/index.lasso The problem is not as much actual open relays (which are now rare and almost universlly blocked) but open proxies

<    1   2   3   4