Re: IBGP Question --- Router Reflector or iBGP Mesh

2005-01-13 Thread Alexei Roudnev
Agree; but do not forget that you can alwys add direct connections between clients (if I am not forgotten something). If 2 clients have direct link between them, it may be a good practice to add direct iBGP connection. It means that iBGP topology should reflect (more or less) network one. Else yo

Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of "anonymity" when domain exists, whois not updated yet)

2005-01-13 Thread Andre Oppermann
Steven Champeon wrote: on Thu, Jan 13, 2005 at 10:25:18AM +0530, Suresh Ramasubramanian wrote: On Wed, 12 Jan 2005 23:19:47 -0500, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: On Wed, 12 Jan 2005 19:19:24 PST, Dave Crocker said: In general, that's what dkeys/iim and csv (and maybe spf) are attempti

Re: Proper authentication model

2005-01-13 Thread Michael . Dillon
> > My point was that competing, differently-named and > > organisationally-separate suppliers of network services frequently use > > common suppliers for metro fibre, long-haul transport, building access, > > etc. Just because you buy different services from different providers > > doesn't mean

Re: Proper authentication model

2005-01-13 Thread Erik Haagsman
On Wed, 2005-01-12 at 20:12, Daniel Golding wrote: > > The biggest problem I've seen with dial-up OOB is reliability. You really > need you really need to have a good series of testing scripts to ensure that > all the phone lines are working, modems have reset properly, serial ports > are ok, etc

Re: [eweek article] Window of "anonymity" when domain exists, whois not updated

2005-01-13 Thread Stephane Bortzmeyer
On Wed, Jan 12, 2005 at 04:11:42PM +, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote a message of 16 lines which said: > And if you will trust an ISP to deliver port 25 packets then why > wouldn't you trust them to deliver email messages? There are *many* ISP which provide a reasonable job w

Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of "anonym

2005-01-13 Thread Stephane Bortzmeyer
On Wed, Jan 12, 2005 at 10:59:43AM -0500, Steven Champeon <[EMAIL PROTECTED]> wrote a message of 98 lines which said: > 0) for the love of God, Montresor, just block port 25 outbound > already. If there is no escape / exemption (as proposed by William Leibzon), then, as a consumer, I scream "

Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of "anonym

2005-01-13 Thread Stephane Bortzmeyer
On Wed, Jan 12, 2005 at 10:59:43AM -0500, Steven Champeon <[EMAIL PROTECTED]> wrote a message of 98 lines which said: > 1) any legitimate mail source MUST have valid, functioning, > non-generic rDNS indicating that it is a mail server or > source. (Most do, many do not. There is NO reason why

Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of "anonym

2005-01-13 Thread Stephane Bortzmeyer
On Wed, Jan 12, 2005 at 10:59:43AM -0500, Steven Champeon <[EMAIL PROTECTED]> wrote a message of 98 lines which said: > 4) all domains with invalid whois data MUST be deactivated (not > confiscated, just temporarily removed from the root dbs) immediately > and their owners contacted. Because

/24 route propagation, how long is reasonable?

2005-01-13 Thread Michael Airhart
Quick question for the group.. How long should I be patient to wait for some /24s to become fully routable worldwide? None of the addresses are mine, they came from the upstream (only one provider) They are all part of the upstreams IP space, and I had assumed that they would have kept them as

RE: fixing insecure email infrastructure (was: Re: [eweek article] Window of "anonymity" when domain exists, whois not updated yet)

2005-01-13 Thread Joseph Johnson
>> Basically a call to operators to adopt a consistent forward and >> reverse DNS naming pattern for their mailservers, static IP netblocks, >> dynamic IP netblocks etc. > > ...and to ISPs to facilitate the process by supporting their users who > want to run mail servers, and helping the rest of u

Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of "anonym

2005-01-13 Thread Rich Kulawiec
On Thu, Jan 13, 2005 at 12:26:47PM +0100, Stephane Bortzmeyer wrote: > > 4) all domains with invalid whois data MUST be deactivated (not > > confiscated, just temporarily removed from the root dbs) immediately > > and their owners contacted. > > Because there is no data protection on many databas

Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of "anonym

2005-01-13 Thread Valdis . Kletnieks
On Thu, 13 Jan 2005 12:21:04 +0100, Stephane Bortzmeyer said: > American bias but remember the Internet is worldwide. I do not know > how it is in the USA but there are many parts of the world where ISP > do not have a delegation of in-addr.arpa and therefore cannot pass it > to their customers. (

FW: AlterPoint Mail Security detected prohibited content in a message sent from your address (SYM:42361956180980318002)

2005-01-13 Thread Steven Champeon
Why content filtering is stupid: - Forwarded message from [EMAIL PROTECTED] - X-Delivered-To: <[EMAIL PROTECTED]> From: <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: AlterPoint Mail Security detected prohibited content in a message sent from your address

answered: /24 route propagation, how long is reasonable?

2005-01-13 Thread Michael Airhart
Thanks for the private responses I received! Turns out it was a AS append problem... Michael Quick question for the group.. How long should I be patient to wait for some /24s to become fully routable worldwide? None of the addresses are mine, they came from the upstream (only one provider) T

Re: [eweek article] Window of "anonymity" when domain exists, whois not updated yet

2005-01-13 Thread Dave Crocker
On Wed, 12 Jan 2005 17:41:33 -0500, [EMAIL PROTECTED] wrote: >  The X.400 concepts of ADMD= and PRMD= really caught on, didn't they? ;) > >  Peering in a world of 64K ASNs, mostly basically static, is a lot different >  than peering in a world of 40 million plus .COMs, many in motion.  Most of > 

Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of "an

2005-01-13 Thread Stephane Bortzmeyer
On Thu, Jan 13, 2005 at 10:21:20AM -0500, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote a message of 45 lines which said: > > Requesting rDNS means "I don't want to receive email from Africa". > > Having an rDNS entry for a host doesn't mean you know if it is/isn't > in Africa, Of course, I kn

Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of "anonym

2005-01-13 Thread Steven Champeon
on Thu, Jan 13, 2005 at 12:21:04PM +0100, Stephane Bortzmeyer wrote: > > On Wed, Jan 12, 2005 at 10:59:43AM -0500, > Steven Champeon <[EMAIL PROTECTED]> wrote > a message of 98 lines which said: > > > 1) any legitimate mail source MUST have valid, functioning, > > non-generic rDNS indicating

Re: /24 route propagation, how long is reasonable?

2005-01-13 Thread bmanning
> Quick question for the group.. > > How long should I be patient to wait for some /24s to become fully routable > worldwide? forever. - or until you clarify your terms. all addresses, regardless of origin, are inherently "fully routable worldwide" ... but to instansia

Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of "anonymity" when domain exists, whois not updated yet)

2005-01-13 Thread Steven Champeon
on Wed, Jan 12, 2005 at 04:51:34PM -0800, william(at)elan.net wrote: ...a very long and useful and informative message, for which I thank him. Off to go decipher the madness that is RFC3982, Steve -- hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com join us! http:/

Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of "an

2005-01-13 Thread Eric Brunner-Williams in Portland Maine
> Of course, I know that. I just mentioned Africa because, in many > countries in Africa, it is simply impossible to get a PTR > record. That's a fact, there are many reasons behind. Howdy Stephane, It is also an area where many cctld operators maintain their registration data using spreadsheets

Cisco 7513 & Bandwidth Points

2005-01-13 Thread Claydon, Tom
Hello, We are moving from a Cisco 7206 to a 7513, and I was wondering if we will be limited by bandwidth points on the 7513 (as we are with the 7206). From the sparse documentation I've found so far, it doesn't appear that this limitation exists in the 7513, correct? Off-list replies are welcome

Re: Cisco 7513 & Bandwidth Points

2005-01-13 Thread Jon Lewis
On Thu, 13 Jan 2005, Claydon, Tom wrote: > We are moving from a Cisco 7206 to a 7513, and I was wondering if we > will be limited by bandwidth points on the 7513 (as we are with the > 7206). From the sparse documentation I've found so far, it doesn't > appear that this limitation exists in the 75

Re: Proper authentication model

2005-01-13 Thread Owen DeLong
That's great if you want to trust one carrier to provide all your seperacy, but, when you want to make sure carrier A isn't running your ring in common with carrier B, you need GIS data. Owen --On Thursday, January 13, 2005 10:36 AM + [EMAIL PROTECTED] wrote: > My point was that competing, d

Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of "anonym

2005-01-13 Thread Owen DeLong
Requesting rDNS means "I don't want to receive email from Africa". Having an rDNS entry for a host doesn't mean you know if it is/isn't in Africa, to any higher degree of certainty than when you just had the IP address. What he was pointing out her is that a majority of African ISPs do not even hav

Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of "anonym

2005-01-13 Thread Valdis . Kletnieks
On Thu, 13 Jan 2005 11:35:23 PST, Owen DeLong said: > >> Requesting rDNS means "I don't want to receive email from Africa". > > > > Having an rDNS entry for a host doesn't mean you know if it is/isn't in > > Africa, to any higher degree of certainty than when you just had the IP > > address. > >

Re: marking dynamic ranges, was fixing insecure email infrastructure

2005-01-13 Thread John Levine
>What is wrong with MTAMARK? >MTAMARK tags the reverse entries of IP addresses where SMTP servers >are. Fixes this problem very fast, efficient and with little effort >(script magic to regenerate the reverse DNS entries). In priciple, nothing. In practice, the rDNS is a mess and I don't know

North American MPLS

2005-01-13 Thread Vogel, Doug
Does anyone have an MPLS network up and running in North America? Can you share your experiences with the carriers. How did installations go and how has support been? I am particularly interested in BT and AT&T.

Re: fixing insecure email infrastructure (was: Re: [eweek article]

2005-01-13 Thread Mark Andrews
>What is wrong with MTAMARK? As currently described it doesn't fit well with RFC 2317 style delegations. They would need to be converted to use DNAME instead of CNAME which requires all the delegating servers to be upgraded to support DNAME. There are oth

Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of "an

2005-01-13 Thread Barry Shein
On January 13, 2005 at 17:41 [EMAIL PROTECTED] (Stephane Bortzmeyer) wrote: > Of course, I know that. I just mentioned Africa because, in many > countries in Africa, it is simply impossible to get a PTR > record. That's a fact, there are many reasons behind. That's because one of their leader

Re: /24 route propagation, how long is reasonable?

2005-01-13 Thread Jon Lewis
On Thu, 13 Jan 2005, Michael Airhart wrote: > Quick question for the group.. > > How long should I be patient to wait for some /24s to become fully routable > worldwide? There's no such thing as IP space fully routable worldwide. Somewhere there's a poorly run network with oudated bogon filters

Re: Cisco 7513 & Bandwidth Points

2005-01-13 Thread Noel Montales
On-List replies perhaps may be usefull.. Or could you post a summary of your findings? Regards, Noel Montales Claydon, Tom said: > > Hello, > > We are moving from a Cisco 7206 to a 7513, and I was wondering if we > will be limited by bandwidth points on the 7513 (as we are with the > 7206). From

Fiber cuts due to flooding

2005-01-13 Thread Aaron Gifford
Ah, the joys of fiber cuts! Apparently the recent flash flooding in the Arizona/Nevada/Utah tristate area (north of Las Vegas) earlier this week (Monday, Tuesday, and Wednesday - see http://tv.ksl.com/index.php?sid=144250&nid=5 for general flooding information) caused fiber cuts near Mesquite, Ne

Re: fixing insecure email infrastructure (was: Re: [eweek article]

2005-01-13 Thread Owen DeLong
That's bad sincd DNAME is deprecated and has been removed from BIND. Owen --On Friday, January 14, 2005 10:05 +1100 Mark Andrews <[EMAIL PROTECTED]> wrote: What is wrong with MTAMARK? As currently described it doesn't fit well with RFC 2317 style delegations. They would need to be c

Re: fixing insecure email infrastructure (was: Re: [eweek article]

2005-01-13 Thread william(at)elan.net
On Thu, 13 Jan 2005, Owen DeLong wrote: > That's bad sincd DNAME is deprecated and has been removed from BIND. > > Owen No, its A6 that is to be depreciated (and too bad because its superior to ), but last I heard DNAME stays as standard RR. -- William Leibzon Elan Networks [EMAIL PROTE

Re: fixing insecure email infrastructure (was: Re: [eweek article]

2005-01-13 Thread Suresh Ramasubramanian
On Thu, 13 Jan 2005 22:43:24 -0800 (PST), william(at)elan.net <[EMAIL PROTECTED]> wrote: > On Thu, 13 Jan 2005, Owen DeLong wrote: > > > That's bad sincd DNAME is deprecated and has been removed from BIND. > > No, its A6 that is to be depreciated (and too bad because its superior > to ), but