Re: Repeated Blacklisting / IP reputation

2009-10-03 Thread Rich Kulawiec
On Tue, Sep 15, 2009 at 09:22:02PM -0400, Christopher Morrow wrote: build expertise on managing it. If you go to SpamHaus you will see a major ISP and their netblocks listed and associated with known spammers. What is this ISP doing about this? Nothing! ?My guess is that they look at their

RE: Repeated Blacklisting / IP reputation, replaced by registered use

2009-09-15 Thread Michiel Klaver
I think ARIN is no party to contact all RBL's and do any cleanup of 'contaminated' address space. The only steps ARIN might do are: - When requesting address space, one should be able to indicate whether receiving previous used address space would be unwanted or not. - When assigning address

Re: Repeated Blacklisting / IP reputation

2009-09-15 Thread Martin Hannigan
Well, I haven't even had coffee yet and... Get the removals: curl -ls http://lists.arin.net/pipermail/arin-issued/2009-September/000270.html | grep Remove | grep -v PRE Get the additions: mahannig$ curl -ls http://lists.arin.net/pipermail/arin-issued/2009-September/000270.html | grep Add |

RE: Repeated Blacklisting / IP reputation

2009-09-15 Thread Shawn Somers
on a sliding scale based on the amount of contamination and churn. the more contamination, the higher the fee. Shawn Somers Michiel Klaver wrote: - Message: 3 Date: Tue, 15 Sep 2009 11:57:58 +0200 From: Michiel Klaver mich...@klaver.it Subject: RE: Repeated Blacklisting / IP reputation

Re: Repeated Blacklisting / IP reputation

2009-09-15 Thread Justin Shore
Martin Hannigan wrote: Well, I haven't even had coffee yet and... Get the removals: curl -ls http://lists.arin.net/pipermail/arin-issued/2009-September/000270.html | grep Remove | grep -v PRE Get the additions: mahannig$ curl -ls

RE: Repeated Blacklisting / IP reputation

2009-09-15 Thread Aaron Wendel
The mailing sent daily contains both. -Original Message- From: Justin Shore [mailto:jus...@justinshore.com] Sent: Tuesday, September 15, 2009 11:18 AM To: Martin Hannigan Cc: NANOG list Subject: Re: Repeated Blacklisting / IP reputation Martin Hannigan wrote: Well, I haven't even

Re: Repeated Blacklisting / IP reputation

2009-09-15 Thread Valdis . Kletnieks
On Tue, 15 Sep 2009 08:01:48 PDT, Shawn Somers said: Anyone that intentionally uses address space in a manner that they know will cause it to become contaminated should be denied on any further address space requests. You *do* realize that the people you're directing that paragraph at are

Re: Repeated Blacklisting / IP reputation

2009-09-15 Thread bmanning
so... this thread has a couple of really interesting characteristics. a couple are worth mentioning more directly (they have been alluded to elsewhere)... Who gets to define bad - other than a blacklist operator? Are the common, consistent defintions of contamination?

Re: Repeated Blacklisting / IP reputation

2009-09-15 Thread Brandon Lehmann
I believe there is another side to that argument as well. If I operate a regional ISP and request address space for dynamic address pools I am aware of a few things: 1) I am fully aware that there is a chance a customer's system could become infected and generate millions of malicious

on naming conventions (was: Re: Repeated Blacklisting / IP reputation)

2009-09-15 Thread Steven Champeon
on Tue, Sep 08, 2009 at 09:57:58AM -0500, Tom Pipes wrote: [...] We have done our best to ensure these blocks conform to RFC standards, including the proper use of reverse DNS pointers. Sorry to jump in so late, been catching up from vacation. I'm checking out the PTRs for the /18 you mention,

Re: Repeated Blacklisting / IP reputation

2009-09-15 Thread Christopher Morrow
On Tue, Sep 15, 2009 at 5:31 PM, Zaid Ali z...@zaidali.com wrote: I think costs of maintaining an abuse helpdesk is a big factor here. I don't see many ISP's putting money and resources into an abuse helpdesk and this is because it is low cost to obtain a Netblock so why should one employ and

Re: Repeated Blacklisting / IP reputation

2009-09-15 Thread Christopher Morrow
On Tue, Sep 15, 2009 at 4:46 PM, bmann...@vacation.karoshi.com wrote: so... this thread has a couple of really interesting characteristics. a couple are worth mentioning more directly (they have been alluded to elsewhere)... as always, despite your choice in floral patterned shirts :) good

Re: Repeated Blacklisting / IP reputation

2009-09-15 Thread bmanning
On Tue, Sep 15, 2009 at 09:34:14PM -0400, Christopher Morrow wrote: On Tue, Sep 15, 2009 at 4:46 PM, bmann...@vacation.karoshi.com wrote: so... this thread has a couple of really interesting characteristics. a couple are worth mentioning more directly (they have been alluded to

Re: Repeated Blacklisting / IP reputation

2009-09-15 Thread Christopher Morrow
On Tue, Sep 15, 2009 at 10:29 PM, bmann...@vacation.karoshi.com wrote: On Tue, Sep 15, 2009 at 09:34:14PM -0400, Christopher Morrow wrote: On Tue, Sep 15, 2009 at 4:46 PM,  bmann...@vacation.karoshi.com wrote: so... this thread has a couple of really interesting characteristics. a couple

Re: Repeated Blacklisting / IP reputation

2009-09-15 Thread Joel Jaeggli
Christopher Morrow wrote: Spammers have a lot of variables to change in this equation, RIR's dont always have the ability to see all of the variables, nor correlate all of the changes they see :( Being a crimnal enterprise there are some tools in your kit that a legitimate business does not

Re: Repeated Blacklisting / IP reputation

2009-09-15 Thread Christopher Morrow
On Wed, Sep 16, 2009 at 12:08 AM, Joel Jaeggli joe...@bogus.com wrote: Christopher Morrow wrote: Spammers have a lot of variables to change in this equation, RIR's dont always have the ability to see all of the variables, nor correlate all of the changes they see :( Being a crimnal

Re: Repeated Blacklisting / IP reputation

2009-09-14 Thread Andy Davidson
On 9 Sep 2009, at 06:04, Peter Beckman wrote: How about a trial period from ARIN? You get your IP block, and you get 30 days to determine if it is clean or not. The reuse issue is possibly decades away in v6 land. The reuse issue can't really be solved for v4 in a year or two. Sounds

Re: Repeated Blacklisting / IP reputation

2009-09-14 Thread Tim Chown
On Sun, Sep 13, 2009 at 12:45:03PM -0400, Christopher Morrow wrote: On Wed, Sep 9, 2009 at 11:48 PM, Mark Andrews ma...@isc.org wrote: skip a note about isc having quite a few legacy blocks Note we all could start using IPv6 and avoid this problem altogether. There is nothing stopping us

Re: Repeated Blacklisting / IP reputation

2009-09-14 Thread Rich Kulawiec
On Tue, Sep 08, 2009 at 11:44:44AM -0700, Wayne E. Bouchard wrote: Best practices for the public or subscription RBLs should be to place a TTL on the entry of no more than, say, 90 days or thereabouts. But there's no reason to do so, and a number of reasons not to, including the very high

Re: Hijacked Blocks (was: Repeated Blacklisting / IP reputation)

2009-09-14 Thread John Curran
On Sep 14, 2009, at 6:49 AM, Rich Kulawiec wrote: ... For example: Ron Guilmette has recently pointed out that notorious spammer Scott Richter has apparently hijacked *another* /16 block -- 150.230.0.0/16. I've dropped that block into various local blacklists, and in some cases,

Re: Repeated Blacklisting / IP reputation

2009-09-14 Thread Martin Hannigan
On Sun, Sep 13, 2009 at 7:43 AM, John Curran jcur...@arin.net wrote: On Sep 11, 2009, at 6:52 PM, Martin Hannigan wrote: I honestly don't think that it's up to them to create a set-aside either, hence my comment about behind the scenes activities. I appreciate you detailing that, but I

Re: Hijacked Blocks (was: Repeated Blacklisting / IP reputation)

2009-09-14 Thread Christopher Morrow
On Mon, Sep 14, 2009 at 7:05 AM, John Curran jcur...@arin.net wrote: On Sep 14, 2009, at 6:49 AM, Rich Kulawiec wrote: ... For example: Ron Guilmette has recently pointed out that notorious spammer Scott Richter has apparently hijacked *another* /16 block -- 150.230.0.0/16. oh lokoie,

Re: Repeated Blacklisting / IP reputation, replaced by registered use

2009-09-14 Thread Douglas Otis
On 9/13/09 12:49 PM, joel jaeggli wrote: Frank Bulk wrote: [] If anything, there's more of a disincentive than ever before for ARIN to spend time on netblock sanitization. This whole thread seems to be about shifting (I.E. by externalizing) the costs of remediation. presumably the entities

RE: Repeated Blacklisting / IP reputation, replaced by registered use

2009-09-14 Thread Lee Howard
-Original Message- From: Douglas Otis [mailto:do...@mail-abuse.org] Sent: Monday, September 14, 2009 1:41 PM To: joel jaeggli Cc: NANOG list Subject: Re: Repeated Blacklisting / IP reputation, replaced by registered use On 9/13/09 12:49 PM, joel jaeggli wrote: Frank Bulk wrote

Re: Repeated Blacklisting / IP reputation, replaced by registered use

2009-09-14 Thread David Conrad
On Sep 14, 2009, at 10:40 AM, Douglas Otis wrote: Perhaps ICANN could require registries establish a clearing-house, where at no cost, those assigned a network would register their intent to initiate bulk traffic, such as email, from specific addresses. ICANN can't require the RIRs do

RE: Repeated Blacklisting / IP reputation, replaced by registered use

2009-09-14 Thread Azinger, Marla
Subject: Re: Repeated Blacklisting / IP reputation, replaced by registered use On Sep 14, 2009, at 10:40 AM, Douglas Otis wrote: Perhaps ICANN could require registries establish a clearing-house, where at no cost, those assigned a network would register their intent to initiate bulk traffic

Re: Repeated Blacklisting / IP reputation

2009-09-14 Thread Justin Shore
Frank Bulk wrote: With scarcity of IPv4 addresses, organizations are more desperate than ever to receive an allocation. If anything, there's more of a disincentive than ever before for ARIN to spend time on netblock sanitization. I do think that ARIN should inform the new netblock owner if it

Re: Repeated Blacklisting / IP reputation

2009-09-14 Thread Martin Hannigan
On Mon, Sep 14, 2009 at 2:58 PM, Justin Shore jus...@justinshore.comwrote: Frank Bulk wrote: With scarcity of IPv4 addresses, organizations are more desperate than ever to receive an allocation. If anything, there's more of a disincentive than ever before for ARIN to spend time on

Re: Repeated Blacklisting / IP reputation

2009-09-13 Thread John Curran
On Sep 11, 2009, at 6:52 PM, Martin Hannigan wrote: I honestly don't think that it's up to them to create a set-aside either, hence my comment about behind the scenes activities. I appreciate you detailing that, but I honestly don't think it matters since as you mentioned you get

Re: Repeated Blacklisting / IP reputation

2009-09-13 Thread Christopher Morrow
On Wed, Sep 9, 2009 at 11:30 PM, Leo Vegoda leo.veg...@icann.org wrote: On Sep 9, 2009, at 7:18 PM, Alex Lanstein wrote: Along the same lines, I noticed that the worst Actor in recent memory (McColo - AS26780) stopped paying their bills to ARIN and their addresses have been returned to the

Re: Repeated Blacklisting / IP reputation

2009-09-13 Thread Christopher Morrow
On Wed, Sep 9, 2009 at 11:48 PM, Mark Andrews ma...@isc.org wrote: skip a note about isc having quite a few legacy blocks Note we all could start using IPv6 and avoid this problem altogether. There is nothing stopping us using IPv6 especially for MTA's. that'd solve the spam problem... for a

Re: Repeated Blacklisting / IP reputation

2009-09-12 Thread James Cloos
Joe == Joe Greco jgr...@ns.sol.net writes: Joe Show me ONE major MTA which allows you to configure an expiration Joe for an ACL entry. Any MTA which supports using an sql db as its backend. Postfix is a fine example. You just define the table and the query to either have an until column, or

Re: Repeated Blacklisting / IP reputation

2009-09-12 Thread Joe Greco
Joe == Joe Greco jgr...@ns.sol.net writes: Joe Show me ONE major MTA which allows you to configure an expiration Joe for an ACL entry. Any MTA which supports using an sql db as its backend. Postfix is a fine example. You just define the table and the query to either have an until

Re: Repeated Blacklisting / IP reputation

2009-09-12 Thread James Cloos
Joe == Joe Greco jgr...@ns.sol.net writes: Joe So, you agree, MTA's do not implement this functionality. It's Joe obviously possible to make it happen through shell scripting, Joe database tricks, No, I do not agree. The sql backend is part of the MTA; features added by offering a sql backend

Re: Repeated Blacklisting / IP reputation

2009-09-12 Thread Joe Greco
Joe == Joe Greco jgr...@ns.sol.net writes: Joe So, you agree, MTA's do not implement this functionality. It's Joe obviously possible to make it happen through shell scripting, Joe database tricks, No, I do not agree. The sql backend is part of the MTA; features added by offering a

RE: Repeated Blacklisting / IP reputation

2009-09-12 Thread Frank Bulk
, September 09, 2009 5:40 PM To: NANOG list Subject: Re: Repeated Blacklisting / IP reputation snip They can (and IMHO should) determine the state it is in before they reallocate it. What happens next is obviously unpredictable but in reality an IP that isn't being blocked today and isn't being

Re: Repeated Blacklisting / IP reputation

2009-09-12 Thread joel jaeggli
list Subject: Re: Repeated Blacklisting / IP reputation snip They can (and IMHO should) determine the state it is in before they reallocate it. What happens next is obviously unpredictable but in reality an IP that isn't being blocked today and isn't being used (by anyone) is highly

RE: Repeated Blacklisting / IP reputation

2009-09-12 Thread Keith Medcalf
and then that's PART of the MTA. Otherwise, it's an add-on of some sort. Given that the point I was making was about capabilities *included* in the MTA, and given that I *said* you could add on such functions, it's kind of silly to try to confuse the issue in this manner. CommuniGate Pro

Re: Repeated Blacklisting / IP reputation

2009-09-11 Thread Joel Jaeggli
Peter Beckman wrote: On Thu, 10 Sep 2009, Mark Andrews wrote: What a load of rubbish. How is ARIN or any RIR/LIR supposed to know the intent of use? Why don't we just blacklist everything and only whitelist those we know are good? Because the cost of determining who is good and

Re: Repeated Blacklisting / IP reputation

2009-09-11 Thread Joel Jaeggli
Benjamin Billon wrote: Why don't we just blacklist everything and only whitelist those we know are good? snip Note we all could start using IPv6 and avoid this problem altogether. snip Yeah. When ISP will start receiving SMTP traffic in IPv6, they could start to accept whitelisted

Re: Repeated Blacklisting / IP reputation

2009-09-11 Thread David Conrad
Marty, On Sep 10, 2009, at 2:45 PM, Martin Hannigan wrote: Not sure when ICANN got into the business of economic bailouts, ?? The blog posting implies it: AfriNIC and LACNIC have fewest IPv4 /8s and service the regions with the most developing economies. We decided that those RIRs

Re: Repeated Blacklisting / IP reputation

2009-09-11 Thread Martin Hannigan
On Fri, Sep 11, 2009 at 4:23 PM, David Conrad d...@virtualized.org wrote: Marty, It's possible that not everything is above the table as well. Actually, no. The whole point in publishing the algorithm IANA is using in allocating /8s is to allow anyone to verify for themselves we are

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread Dave Martin
On Wed, Sep 09, 2009 at 04:13:18PM -0700, Jay Hennigan wrote: JC Dill wrote: As for a role account, there is postmaster. I would think that the best hope in the real world, rather than an autoresponder would be an RFC that clearly defines text accompanying an SMTP rejection notice

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread Nick Feamster
GMT -06:00 US/Canada Central Subject: Repeated Blacklisting / IP reputation Greetings, We obtained a direct assigned IP block 69.197.64.0/18 from ARIN in 2008. This block has been cursed (for lack of a better word) since we obtained it. It seems like every customer we have added has had

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread Peter Beckman
On Thu, 10 Sep 2009, Mark Andrews wrote: What a load of rubbish. How is ARIN or any RIR/LIR supposed to know the intent of use? Why don't we just blacklist everything and only whitelist those we know are good? Because the cost of determining who is good and who is not has a great cost.

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread Benjamin Billon
Why don't we just blacklist everything and only whitelist those we know are good? snip Note we all could start using IPv6 and avoid this problem altogether. snip Yeah. When ISP will start receiving SMTP traffic in IPv6, they could start to accept whitelisted senders only. IPv6 emails ==

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread bmanning
On Thu, Sep 10, 2009 at 04:42:13PM +0200, Benjamin Billon wrote: Why don't we just blacklist everything and only whitelist those we know are good? snip Note we all could start using IPv6 and avoid this problem altogether. snip Yeah. When ISP will start receiving SMTP traffic in IPv6,

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread Kevin Loch
Benjamin Billon wrote: Why don't we just blacklist everything and only whitelist those we know are good? snip Note we all could start using IPv6 and avoid this problem altogether. snip Yeah. When ISP will start receiving SMTP traffic in IPv6, they could start to accept whitelisted senders

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread Peter Beckman
On Thu, 10 Sep 2009, Benjamin Billon wrote: Why don't we just blacklist everything and only whitelist those we know are good? snip Note we all could start using IPv6 and avoid this problem altogether. snip Yeah. When ISP will start receiving SMTP traffic in IPv6, they could start to

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread Benjamin Billon
You're not Hotmail =)

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread Valdis . Kletnieks
On Wed, 09 Sep 2009 20:30:02 PDT, Leo Vegoda said: Putting these addresses back into use does not mean that they have to be allocated to networks where they'll number mail servers. ARIN staff is doubtless aware of the history of these blocks and will presumably do their best to allocate them

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread Joe Greco
Because the cost of determining who is good and who is not has a great cost. If you buy an IP block, regardless of your intent, that IP block should not have the ill-will of the previous owner passed on with it. Might as well be the end of discussion, right there, then, because what

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread David Conrad
On Sep 9, 2009, at 8:41 PM, Martin Hannigan wrote: Not sure when ICANN got into the business of economic bailouts, ?? but the mechanism that ICANN has defined seems patently unfair. RFC 2777 is unfair? Or are you unhappy that LACNIC and AfriNIC have 2 /8s from the least tainted pools?

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread Martin Hannigan
On Thu, Sep 10, 2009 at 4:21 PM, David Conrad d...@virtualized.org wrote: On Sep 9, 2009, at 8:41 PM, Martin Hannigan wrote: Not sure when ICANN got into the business of economic bailouts, ?? The blog posting implies it: AfriNIC and LACNIC have fewest IPv4 /8s and service the regions

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread Leo Vegoda
On 09/09/2009 8:48, Mark Andrews ma...@isc.org wrote: [...] What a load of rubbish. How is ARIN or any RIR/LIR supposed to know the intent of use? In my limited experience, requesting address space from ARIN involved describing what I would be doing with it. YMMV. Leo

Re: Repeated Blacklisting / IP reputation

2009-09-10 Thread Scott Weeks
--- leo.veg...@icann.org wrote: In my limited experience, requesting address space from ARIN involved describing what I would be doing with it. YMMV. - That's the easy part of the process. Proof of what you did with what you already have assigned to

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Jay Hennigan
bmann...@vacation.karoshi.com wrote: sounds like domain tasting to me. Oops! Oh yeah. Spammer gets an allocation... Well, if that netblock was clean before, it sure isn't now! May I please have another? Lather, rinse, repeat. -- Jay Hennigan - CCIE #7880 - Network Engineering -

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Chris Hills
On 08/09/09 21:34, Joe Greco wrote: Show me ONE major MTA which allows you to configure an expiration for an ACL entry. This is fairly trivial to do with Exim by storing your acl entries in a database or directory with a field/attribute for expiry, and an appropriate router configuration. No

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Joe Greco
Show me ONE major MTA which allows you to configure an expiration for an ACL entry. The problem with your opinion, and it's a fine opinion, and it's even a good opinion, is that it has very little relationship to the tools which are given to people in order to accomplish blocking.

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Joe Greco
bmann...@vacation.karoshi.com wrote: sounds like domain tasting to me. Oops! Oh yeah. Spammer gets an allocation... Well, if that netblock was clean before, it sure isn't now! May I please have another? Lather, rinse, repeat. THAT would probably be easy enough to detect; RIR

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Dave Rand
[In the message entitled Re: Repeated Blacklisting / IP reputation on Sep 8, 14:34, Joe Greco writes:] there is a fundamental disconnect here. the IP space is neutral. it has no bias toward or against social behaviours. its a tool. the actual/real target here are the people who are using

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Joe Maimon
John, ARIN's role as the entity engaged in legal contractual relationship with the previous owners of the space puts it in the position to insert enforceable contract clauses to deter and/or mitigate graffiti in allocations. Policy proposals probably are not required for this. Space

Re: You're still not important, was Repeated Blacklisting / IP reputation

2009-09-09 Thread John Levine
Cleaning up a block of IPs previously used by shady characters has a real cost, both in time and money. The argument as I see it is who bears the responsibility and cost of that cleanup. ... and as we all know the fundamental axiom of Internet economics is to foist of as many of your costs as

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Joe Greco
John, ARIN's role as the entity engaged in legal contractual relationship with the previous owners of the space puts it in the position to insert enforceable contract clauses to deter and/or mitigate graffiti in allocations. That's complicated. How do you define graffiti? Just for

RE: Repeated Blacklisting / IP reputation

2009-09-09 Thread Frank Bulk
, etc. Frank -Original Message- From: Jay Hennigan [mailto:j...@west.net] Sent: Tuesday, September 08, 2009 1:14 PM To: John Curran Cc: nanog@nanog.org Subject: Re: Repeated Blacklisting / IP reputation John Curran wrote: Folks - It appears that we have a real operational problem

RE: Repeated Blacklisting / IP reputation

2009-09-09 Thread Skywing
Subject: Re: Repeated Blacklisting / IP reputation How about a trial period from ARIN? You get your IP block, and you get 30 days to determine if it is clean or not. Do some testing, check the blacklists, do some magic to see if there are network-specific blacklists that might prevent your customers

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Seth Mattinen
Skywing wrote: What's to stop spammers from doing this to cycle through blocks in rapid-fashion? This proposal seems easily abusable to me. Oh, I don't know, maybe ARIN staff can say no? The process is heavy with human interaction, there is nothing rapid about it, and bears no comparison

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Martin Hannigan
On Wed, Sep 9, 2009 at 1:15 PM, Seth Mattinen se...@rollernet.us wrote: Skywing wrote: What's to stop spammers from doing this to cycle through blocks in rapid-fashion? This proposal seems easily abusable to me. Oh, I don't know, maybe ARIN staff can say no? The process is heavy with

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread John Curran
On Sep 8, 2009, at 5:20 PM, Joe Provo wrote: On Tue, Sep 08, 2009 at 01:43:39PM -0400, John Curran wrote: [snip] Could some folks from the appropriate networks explain why this is such a problem and/or suggest additional steps that ARIN or the receipts should be taking to avoid this

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Valdis . Kletnieks
On Wed, 09 Sep 2009 15:13:44 EDT, Martin Hannigan said: Not sure that this is an ARIN problem more than an operational problem since RBL's are opt-in. An effort to identify RBL's that are behaving poorly is probably more interesting at this point, no? I suspect the problem isn't poor RBLs,

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread JC Dill
Joe Greco wrote: John Curran wrote: On Sep 8, 2009, at 2:18 PM, JC Dill wrote: It seems simple and obvious that ARIN, RIPE, et. al. should determine the blacklist state of a reclaimed IP group and ensure that the IP group is usable before re-allocating it. When IPs are

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Jay Hennigan
JC Dill wrote: Joe Greco wrote: Answer queries to whether or not IP space X is currently blocked (potentially at one of hundreds or thousands of points in their system, which corporate security may not wish to share, or even give some random intern access to)? Process reports of new ARIN

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread David Conrad
On Sep 9, 2009, at 12:13 PM, Martin Hannigan wrote: The problem of tainted ipv4 allocations probably grows from here since at some point in the near future there isn't going to be much left in terms of clean space to allocate. We're running out of v4 addresses in case anyone forgot.

RE: Repeated Blacklisting / IP reputation

2009-09-09 Thread Alex Lanstein
...@arin.net] Sent: Tuesday, September 08, 2009 1:43 PM To: nanog@nanog.org Subject: Re: Repeated Blacklisting / IP reputation Folks - It appears that we have a real operational problem, in that ARIN does indeed reissue space that has been reclaimed/returned after a hold-down period

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Paul Ferguson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Wed, Sep 9, 2009 at 7:18 PM, Alex Lanstein alanst...@fireeye.com wrote: Along the same lines, I noticed that the worst Actor in recent memory (McColo - AS26780) stopped paying their bills to ARIN and their addresses have been returned to the

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Leo Vegoda
On Sep 9, 2009, at 7:18 PM, Alex Lanstein wrote: Along the same lines, I noticed that the worst Actor in recent memory (McColo - AS26780) stopped paying their bills to ARIN and their addresses have been returned to the pool. It's my opinion that a very select number of CIDR blocks

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Martin Hannigan
On Wed, Sep 9, 2009 at 11:30 PM, Leo Vegoda leo.veg...@icann.org wrote: On Sep 9, 2009, at 7:18 PM, Alex Lanstein wrote: Along the same lines, I noticed that the worst Actor in recent memory (McColo - AS26780) stopped paying their bills to ARIN and their addresses have been returned to

Re: Repeated Blacklisting / IP reputation

2009-09-09 Thread Mark Andrews
In message e1decfc9-80ef-40fa-9d98-5c622aacc...@icann.org, Leo Vegoda writes: On Sep 9, 2009, at 7:18 PM, Alex Lanstein wrote: Along the same lines, I noticed that the worst Actor in recent =20 memory (McColo - AS26780) stopped paying their bills to ARIN and =20 their addresses have been

Repeated Blacklisting / IP reputation

2009-09-08 Thread Tom Pipes
Greetings, We obtained a direct assigned IP block 69.197.64.0/18 from ARIN in 2008. This block has been cursed (for lack of a better word) since we obtained it. It seems like every customer we have added has had repeated issues with being blacklisted by DUL and the cable carriers. (AOL,

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Ronald Cotoni
Tom Pipes wrote: Greetings, We obtained a direct assigned IP block 69.197.64.0/18 from ARIN in 2008. This block has been cursed (for lack of a better word) since we obtained it. It seems like every customer we have added has had repeated issues with being blacklisted by DUL and the cable

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread John Curran
Folks - It appears that we have a real operational problem, in that ARIN does indeed reissue space that has been reclaimed/returned after a hold-down period, and but it appears that even once they are removed from the actual source RBL's, there are still ISP's who are manually

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Suresh Ramasubramanian
John, its about the same situation you get when people use manually updated bogon filters. A much larger problem, I must admit .. having ISPs follow the maawg best practices might help, that - and attending MAAWG sessions (www.maawg.org - Published Documents) That said most of the larger

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Jason Bertoch
Suresh Ramasubramanian wrote: That said most of the larger players already attend MAAWG - that leaves rural ISPs, small universities, corporate mailservers etc etc that dont have full time postmasters, and where you're more likely to run into this issue. I've found the opposite to hold true

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Seth Mattinen
Suresh Ramasubramanian wrote: John, its about the same situation you get when people use manually updated bogon filters. A much larger problem, I must admit .. having ISPs follow the maawg best practices might help, that - and attending MAAWG sessions (www.maawg.org - Published Documents)

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Jay Hennigan
John Curran wrote: Folks - It appears that we have a real operational problem, in that ARIN does indeed reissue space that has been reclaimed/returned after a hold-down period, and but it appears that even once they are removed from the actual source RBL's, there are still ISP's who

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Jon Lewis
On Tue, 8 Sep 2009, John Curran wrote: I'm sure there's an excellent reason why these addresses stay blocked, but am unable to fathom what exactly that is... Could some folks from the appropriate networks explain why this is such a problem and/or suggest additional steps that ARIN or

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Brian Keefer
On Sep 8, 2009, at 11:13 AM, Jay Hennigan wrote: John Curran wrote: snip I'm sure there's an excellent reason why these addresses stay blocked, but am unable to fathom what exactly that is... Could some folks from the appropriate networks explain why this is such a problem and/or

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Valdis . Kletnieks
On Tue, 08 Sep 2009 13:43:39 EDT, John Curran said: I'm sure there's an excellent reason why these addresses stay blocked, but am unable to fathom what exactly that is... If I'm a smaller shop with limited clue, there's 3 likely colloraries: 1) Even a smallish spam blast is big enough to

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Wayne E. Bouchard
On Tue, Sep 08, 2009 at 10:16:33AM -0500, Ronald Cotoni wrote: Tom Pipes wrote: Greetings, We obtained a direct assigned IP block 69.197.64.0/18 from ARIN in 2008. This block has been cursed (for lack of a better word) since we obtained it. It seems like every customer we have added

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Joe Greco
On Tue, 8 Sep 2009, John Curran wrote: I'm sure there's an excellent reason why these addresses stay blocked, but am unable to fathom what exactly that is... Could some folks from the appropriate networks explain why this is such a problem and/or suggest additional steps that

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Jon Lewis
On Tue, 8 Sep 2009, Joe Greco wrote: It seems like it *could* be useful to have a system to notify of network delegation changes, but it also seems like if this was particularly important to anyone, then someone would have found a trivial way to implement at least a poor man's version of it.

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Jon Lewis
On Tue, 8 Sep 2009, Wayne E. Bouchard wrote: This is not actually a new problem. ISPs have been fighting this for some time. When a dud customer spams from a given IP range and gets it placed in various RBLs, when that customer is booted or otherwise removed, that block will probably get

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Jay Hennigan
Seth Mattinen wrote: I was always under the impression that smaller orgs were not allowed to join the MAAWG club. They're allowed. At $4k/year minimum, up to $25K/year. By the way, among the members... Experian CheetahMail ExactTarget, Inc Responsys, Inc. Vertical Response, Inc Yesmail

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Joe Greco
On Tue, 8 Sep 2009, Joe Greco wrote: It seems like it *could* be useful to have a system to notify of network delegation changes, but it also seems like if this was particularly important to anyone, then someone would have found a trivial way to implement at least a poor man's version of

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread JC Dill
John Curran wrote: On Sep 8, 2009, at 2:18 PM, JC Dill wrote: It seems simple and obvious that ARIN, RIPE, et. al. should determine the blacklist state of a reclaimed IP group and ensure that the IP group is usable before re-allocating it. When IPs are reclaimed, first check to see if the

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread bmanning
On Tue, Sep 08, 2009 at 02:34:10PM -0500, Joe Greco wrote: there is a fundamental disconnect here. the IP space is neutral. it has no bias toward or against social behaviours. its a tool. the actual/real target here are the people who are using these tools to be antisocial. blacklisting

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Justin Shore
Jason Bertoch wrote: Suresh Ramasubramanian wrote: That said most of the larger players already attend MAAWG - that leaves rural ISPs, small universities, corporate mailservers etc etc that dont have full time postmasters, and where you're more likely to run into this issue. I've found the

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread Joe Greco
John Curran wrote: On Sep 8, 2009, at 2:18 PM, JC Dill wrote: It seems simple and obvious that ARIN, RIPE, et. al. should determine the blacklist state of a reclaimed IP group and ensure that the IP group is usable before re-allocating it. When IPs are reclaimed, first check

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread J.D. Falk
Seth Mattinen wrote: I was always under the impression that smaller orgs were not allowed to join the MAAWG club. I've heard that, too, but have no idea where it comes from. It's not true; there's no size requirement or anything like that. http://www.maawg.org/ has the membership

Re: Repeated Blacklisting / IP reputation

2009-09-08 Thread William Astle
J.D. Falk wrote: Seth Mattinen wrote: I was always under the impression that smaller orgs were not allowed to join the MAAWG club. I've heard that, too, but have no idea where it comes from. It's not true; there's no size requirement or anything like that. http://www.maawg.org/ has the

  1   2   >