Re: preventing future situations like panix

2006-01-23 Thread Thor Lancelot Simon
On Mon, Jan 23, 2006 at 12:47:38PM -0700, Josh Karlin wrote: > > Suspicious routes are those that originate at an AS that has not > originated the prefix in the last few days and those that introduce > sub-prefixes. Sub-prefixes are always considered suspicious (~1 day) > and traffic will be rou

Re: oof. panix sidelined by incompetence... again.

2006-01-22 Thread Thor Lancelot Simon
On Sun, Jan 22, 2006 at 10:33:04AM -0800, william(at)elan.net wrote: > > > Can there be a confirmation of this? I see no such MOTD at > http://www.panix.com/panix/help/Announcements/ Verio was just extremely helpful and filtered out the bogus Panix routes ConED was sending them quite rapidly u

oof. panix sidelined by incompetence... again.

2006-01-22 Thread Thor Lancelot Simon
This is hardly as serious as the last incident -- but, well, some people do seem to have all the luck, eh? Of course, there are measures one can take against this sort of thing; but it's hard to deploy some of them effectively when the party stealing your routes was in fact once authorized to of

Re: Using snort to detect if your users are doing interesting things?

2005-06-09 Thread Thor Lancelot Simon
can anyone > think of a single application that would mimic that behavior? VoIP with a low-rate codec, or some quantitatively similar multimedia or gaming application? -- Thor Lancelot Simon [EMAIL PROTECTED] "The inconsistency is startling, tho

Re: US slaps fine on company blocking VoIP

2005-03-04 Thread Thor Lancelot Simon
On Fri, Mar 04, 2005 at 01:54:33PM -0800, David Schwartz wrote: > > I'm curious how you'd feel if your local telephone company started > preventing you from calling its competitors. How about if you suddenly Your local telephone company is a regulated entity. It's required to complete you

Re: More on Vonage service disruptions...

2005-03-03 Thread Thor Lancelot Simon
On Wed, Mar 02, 2005 at 09:46:05AM -0600, Church, Chuck wrote: > > Another thing for an ISP considering blocking VoIP is the fact that > you're cutting off people's access to 911. That alone has got to have > some tough legal ramifications. I can tell you that if my ISP started > blocking my Von

Re: Why do so few mail providers support Port 587?

2005-02-15 Thread Thor Lancelot Simon
On Tue, Feb 15, 2005 at 09:30:18PM -0500, Sean Donelan wrote: > > In theory true, you could run a TELNET listener on Port 25 or 135. But > the world works a bit better when most people follow the same practice. > Port 587 is for authenticated mail message submission. I'm sorry, your last messag

Re: Why do so few mail providers support Port 587?

2005-02-15 Thread Thor Lancelot Simon
On Wed, Feb 16, 2005 at 02:23:04AM +, Adrian Chadd wrote: > > Quite useful when it works (read: the other party has implemented > AUTH-SMTP on port 587). And if they's implemented unauthenticated SMTP on port 587, like, say, Sendmail, you've achieved nothing, or possibly worse, since you hav

Re: Why do so few mail providers support Port 587?

2005-02-15 Thread Thor Lancelot Simon
On Tue, Feb 15, 2005 at 09:00:11PM -0500, Sean Donelan wrote: > > Sendmail now includes Port 587, although some people disagree how > its done. But Exchange and other mail servers are still difficult > for system administrators to configure Port 587 (if it doesn't say > click here for Port 587 d

Re: Vonage complains about VoIP-blocking

2005-02-15 Thread Thor Lancelot Simon
On Tue, Feb 15, 2005 at 01:45:05PM -0500, Eric Gauthier wrote: > > > > On Tue, Feb 15, 2005 at 11:53:59AM -0600, Adi Linden wrote: > > >> How is this any different then blocking port 25 or managing the bandwidth > > >> certain applications use. > > Something else to consider. We block TFTP at o

Re: High Density Multimode Runs BCP?

2005-01-26 Thread Thor Lancelot Simon
On Wed, Jan 26, 2005 at 09:17:44PM -0500, John Fraizer wrote: > > >I assume multiplexing up to 10Gb (possibly two links thereof) and then > >back down is cost-prohibitive? That's probably the "best" practice. > > It's best practice to put two new points of failure (mux + demux) in a > 200m fib

Re: High Density Multimode Runs BCP?

2005-01-26 Thread Thor Lancelot Simon
On Wed, Jan 26, 2005 at 02:49:29PM -0500, Hannigan, Martin wrote: > > > > > > When running say 24-pairs of multi-mode across a datacenter, I have > > > considered a few solutions, but am not sure what is > > common/best practice. > > > > I assume multiplexing up to 10Gb (possibly two links the

Re: High Density Multimode Runs BCP?

2005-01-26 Thread Thor Lancelot Simon
On Tue, Jan 25, 2005 at 07:23:17PM -0500, Deepak Jain wrote: > > > I have a situation where I want to run Nx24 pairs of GE across a > datacenter to several different customers. Runs are about 200meters max. > > When running say 24-pairs of multi-mode across a datacenter, I have > considered a

Re: Gtld transfer process

2005-01-18 Thread Thor Lancelot Simon
On Tue, Jan 18, 2005 at 06:36:16PM +1100, Bruce Tonkin wrote: > > (5) The registry will send a message to the losing registrar confirming > that a transfer has been initiated. Can you confirm or deny whether this actually happened in the case of the panix.com transfer? The other problem I see i

[alexis@panix.com: Panix.com- Some brief comments on the hijacking of our domain]

2005-01-17 Thread Thor Lancelot Simon
- Forwarded message from Alexis Rosen <[EMAIL PROTECTED]> - X-Original-To: [EMAIL PROTECTED] Delivered-To: [EMAIL PROTECTED] Resent-Message-Id: <[EMAIL PROTECTED]> X-Original-To: [EMAIL PROTECTED] Delivered-To: [EMAIL PROTECTED] Date: Mon, 17 Jan 2005 01:42:04 -0500 From: Alexis Rosen <[E

Re: panix.com recovery in progress

2005-01-16 Thread Thor Lancelot Simon
On Sun, Jan 16, 2005 at 06:01:35PM -0500, Henry Yen wrote: > > The latest shell host motd's: > > . Hijack recovery underway (elr) Sun Jan 16 17:43:28 2005 > . > .Recovery is underway from the panix.com domain hijack. > . > .The root name servers now have the correct information, as

Re: panix.com hijacked (VeriSign refuses to help)

2005-01-15 Thread Thor Lancelot Simon
On Sun, Jan 16, 2005 at 02:22:59AM -0500, Paul G wrote: > > > - Original Message - > From: "Thor Lancelot Simon" <[EMAIL PROTECTED]> > To: > Sent: Sunday, January 16, 2005 2:04 AM > Subject: Re: panix.com hijacked (VeriSign refuses to help) >

Re: panix.com hijacked

2005-01-15 Thread Thor Lancelot Simon
Apologies for what may be another duplicate message, probably with broken threading. This is Alexis Rosen's original posting to this thread; we think the mail chaos caused by the hijacking of panix.com kept it from ever reaching the list (but, flying mostly-blind, we aren't sure). > On Sat, Jan

Re: panix.com hijacked (VeriSign refuses to help)

2005-01-15 Thread Thor Lancelot Simon
Alexis Rosen tried to send this to NANOG earlier this evening but it looks like it never made it. Apologies if it's a duplicate; we're both reduced to reading the list via the web interface since the legitimate addresses for panix.com have now timed out of most folks' nameservers and been replace