SMURF amplifier page

Mailman List Mirror (Read Only)
1

As promised, we now have a web page for this.

The current smurf list is at http://www.mcs.net/smurf

This will be updated roughly weekly, or whenever major changes are made
to the list of blocked networks. It contains, in addition to dialogue on
the Smurf issue, a list of network numbers and "whois" lookups on the
owners.

IF YOU APPEAR ON THIS LIST YOU CANNOT TRANSPORT PACKETS INTO OUR
INFRASTRUCTURE.

Instructions for what you must do to get the block removed are contained
within this page. Bitching and moaning is pointless - the only fix is
to FIX THE PROBLEM.

Thank you!

2

Hi Karl,

As promised, we now have a web page for this.

The current smurf list is at http://www.mcs.net/smurf

   Thanks for this great resource! Would you consider a summary
of just the network IPs at the bottom of the page so that it will
be easy to cut and paste to create router filters?

   Thanks,
   Barry

   Barry Caplin People's Choice TV
   Network Operations Center Manager work: bcaplin@speedchoice.com
                                      home: bc@mtiweb.com
PGP fingerprint = 9F E9 5C B6 A2 AD 85 AE 1E 4D 11 0B C2 85 60 93
finger bc@mtiweb.com for PGP public key

3

Hmmm.. now that is a good idea (considering that we just take the filter
list and use awk and sed on it to make the page :slight_smile:

Let me see what I can do with it.

4

Uhhh, is it just me, or does the below imply that if you are on the list,
you can't read the page to find out

a) you're on the list
b) how to get off the list

Kind of a catch-22 here, isn't it?

:slight_smile:

Eric

5

I didn't see you on the list, but I can send you a copy of the page and you can
double check...:slight_smile:

K

Subject: Re: SMURF amplifier page
Uhhh, is it just me, or does the below imply that if you are on the list,
you can't read the page to find out

a) you're on the list
b) how to get off the list

Kind of a catch-22 here, isn't it?

:slight_smile:

Eric

>
>As promised, we now have a web page for this.
>
>The current smurf list is at http://www.mcs.net/smurf
>
>This will be updated roughly weekly, or whenever major changes are made
>to the list of blocked networks. It contains, in addition to dialogue on
>the Smurf issue, a list of network numbers and "whois" lookups on the
>owners.
>
>IF YOU APPEAR ON THIS LIST YOU CANNOT TRANSPORT PACKETS INTO OUR
>INFRASTRUCTURE.
>
>Instructions for what you must do to get the block removed are contained
>within this page. Bitching and moaning is pointless - the only fix is
>to FIX THE PROBLEM.
>
>Thank you!
>
>--
>--
>Karl Denninger (karl@MCS.Net)| MCSNet - Serving Chicagoland and Wisconsin
>http://www.mcs.net/ | T1's from $600 monthly / All Lines

K56Flex/DOV

> > NEW! Corporate ISDN Prices dropped by up to 50%!
>Voice: [+1 312 803-MCS1 x219]| EXCLUSIVE NEW FEATURE ON ALL PERSONAL

ACCOUNTS

>Fax: [+1 312 803-4929] | *SPAMBLOCK* Technology now included at no

cost

6

You can take a look at

http://puck.nether.net/smurf/

  It's not filtered and copies the mcs page, graphics and all.

  - Jared

7

That should be "http://if.you.on.this.list.youre.phucked.nether.net/smurf/"

Sorry, but I just had to be cute :slight_smile:

8

It is a lynx-friendly page. I suppose you could get to it from a
shell on a responsible network - provided one was available to the
individual :slight_smile:

9

<drift on>
  Actually. yeah

http://if.you.on.this.list.youre.phucked.nether.net/smurf/ works now.

  :p

  Not sure how long i'll leave that.. use the other link instead,
http://puck.nether.net/smurf/

  </drift off>

10

you don't see the list = you are on the list

Dirk

11

My point was a philosophical one. Kind of like leaving your "Art of
Picking Door Locks" book inside your car next to your car keys. I just
wanted to get it in the archives so when a blocked monkey comes along, they
can find how to fix themselves in the archives.

Eric

12

Unless of course:

a) AT&T tries to upgrade their software and melts their frame cloud
b) MAE-EAST goes belly up
c) 8584 tunnels the Internet via Jerusalem (gives new meaning to the
wailing wall)
d) Anybody sticks a shovel in the ground near WorldCom fiber (since they
bought the world, thats pretty much anywhere)
e) All of the above.

you don't see the list = you are on the list

Dirk

That should be "http://if.you.on.this.list.youre.phucked.nether.net/smurf/&quot;

Sorry, but I just had to be cute :slight_smile:

--
--
Karl Denninger (karl@MCS.Net)| MCSNet - Serving Chicagoland and Wisconsin
http://www.mcs.net/ | T1's from $600 monthly / All Lines

K56Flex/DOV

           > NEW! Corporate ISDN Prices dropped by up to 50%!
Voice: [+1 312 803-MCS1 x219]| EXCLUSIVE NEW FEATURE ON ALL PERSONAL

ACCOUNTS

Fax: [+1 312 803-4929] | *SPAMBLOCK* Technology now included at no

cost

> You can take a look at
>
> http://puck.nether.net/smurf/
>
> It's not filtered and copies the mcs page, graphics and all.
>
> - Jared
>
> > Uhhh, is it just me, or does the below imply that if you are on the

list,

> > you can't read the page to find out
> >
> > a) you're on the list
> > b) how to get off the list
> >
> > Kind of a catch-22 here, isn't it?
> >
> > :slight_smile:
> >
> > Eric
> >
> >
> > >
> > >As promised, we now have a web page for this.
> > >
> > >The current smurf list is at http://www.mcs.net/smurf
> > >
> > >This will be updated roughly weekly, or whenever major changes are

made

> > >to the list of blocked networks. It contains, in addition to

dialogue on

> > >the Smurf issue, a list of network numbers and "whois" lookups on the
> > >owners.
> > >
> > >IF YOU APPEAR ON THIS LIST YOU CANNOT TRANSPORT PACKETS INTO OUR
> > >INFRASTRUCTURE.
> > >
> > >Instructions for what you must do to get the block removed are

contained

> > >within this page. Bitching and moaning is pointless - the only fix

is

> > >to FIX THE PROBLEM.
> > >
> > >Thank you!
> > >
> > >--
> > >--
> > >Karl Denninger (karl@MCS.Net)| MCSNet - Serving Chicagoland and

Wisconsin

> > >http://www.mcs.net/ | T1's from $600 monthly / All Lines

K56Flex/DOV

> > > > NEW! Corporate ISDN Prices dropped by up to 50%!
> > >Voice: [+1 312 803-MCS1 x219]| EXCLUSIVE NEW FEATURE ON ALL

PERSONAL ACCOUNTS

> > >Fax: [+1 312 803-4929] | *SPAMBLOCK* Technology now included

at no cost

13

I asked Karl about that. This is really something that beggs to be
mirrored elsewhere...else you can't see that you're on it or why?.

14

And I would like to volunteer a website which is responsible as a jump
point for customers who try to reach the networks which are being blocked.
I read this in a different email, but what was said was that for all
networks which are being blocked, if a port 80 request destined for a
blocked network is sourced from your network, redirect it to a page that
explains WHY it is being blocked. I think it would be more worth while to
have one single page that everyone could redirect to the have every NOC
setup their own server.

Opinions? Suggestions?

15

Or, I particularly like this URL:

http://if.you.on.this.list.youre.phucked.nether.net/smurf/

=)

16

touchee..

17

As promised, we now have a web page for this.

The current smurf list is at http://www.mcs.net/smurf

This will be updated roughly weekly, or whenever major changes are made
to the list of blocked networks. It contains, in addition to dialogue on
the Smurf issue, a list of network numbers and "whois" lookups on the
owners.

If you want to contact the operators of these networks please read the
objects carefully. In the ARIN database address space allocated by
other regional registries (RIPE NCC in Europe & APNIC in Asia/Pacific)
will have a record of the form...

  NETWORK NUMBER BEING BLOCKED: 194.47.136
  European Regional Internet Registry/RIPE NCC (NETBLK-RIPE-C2)
     These addresses have been further assigned to European users.
     Their contact information can be found in the RIPE database.
     See below how to use that database to obtain up-to-date information.

     Netname: RIPE-CBLK2
     Netblock: 194.0.0.0 - 194.255.255.0
     Maintainer: RIPE

     Coordinator:
  RIPE Network Co-ordination Centre (RNC-ORG-ARIN) nicdb@RIPE.NET
  +31 20 535 4444
  Fax- +31 20 535 4445

     Domain System inverse mapping provided by:

     NS.RIPE.NET 193.0.0.193
     NS.EU.NET 192.16.202.11
     AUTH03.NS.UU.NET 198.6.1.83
     NS2.NIC.FR 192.93.0.4
     SUNIC.SUNET.SE 192.36.125.2 192.36.148.18
     MUNNARI.OZ.AU 128.250.1.21
     TECKLA.APNIC.NET 202.12.28.129

     The RIPE database is available via the WHOIS and TELNET
     servers at whois.ripe.net. For further information see
     http://www.ripe.net/
     To search on arbitrary strings, see the Database page on
     the RIPE NCC web-site at http://www.ripe.net/db/

     Record last updated on 03-Dec-97.
     Database last updated on 30-Apr-98 16:09:22 EDT.

  The ARIN Registration Services Host contains ONLY Internet
  Network Information: Networks, ASN's, and related POC's.
  Please use the whois server at rs.internic.net for DOMAIN related
  Information and nic.ddn.mil for MILNET Information.

So to find the user of this address space do something like this...

  ; whois -h whois.ripe.net 194.47.136.0

  % Rights restricted by copyright. See http://www.ripe.net/db/dbcopyright.html

  inetnum: 194.47.128.0 - 194.47.159.0
  netname: KARONET
  descr: University College in Karlskrona/Ronneby
  descr: Karlskrona, Sweden
  country: SE
  admin-c: Phillip Dale
  tech-c: Phillip Dale
  changed: geertj@ripe.net 940307
  source: RIPE

  route: 194.47.0.0/16
  descr: SUNET-2845 Aggregate 1
  origin: AS2845
  mnt-by: SUNET-MNT
  changed: bc@sunet.se 950419
  source: RIPE

  route: 194.47.0.0/16
  descr: SUNET-2845 Aggregate 1
  origin: AS1653
  mnt-by: SUNET-MNT
  changed: bc@sunet.se 980403
  source: RIPE

  person: Phillip Dale
  address: University of Karlskrona/Ronneby
  address: Computer Services
  address: S-371 79 KARLSKRONA
  address: Sweden
  phone: +46 455 78000
  fax-no: +46 455 78007
  e-mail: pdale@dat.hk-r.se
  nic-hdl: PDA6-RIPE
  notify: pdale@dat.hk-r.se
  changed: geertj@ripe.net 940307
  changed: pdale@dat.hk-r.se 980407
  changed: hostmaster@ripe.net 980407
  source: RIPE

Alex Bligh writes

Would it be possible to take the amplifier list and publish an abbreviated
version sorted by origin AS (will need a BGP lookup).

This information is also available from the (various) routing
registries. See the 'route:' object above.

Chris - RIPE NCC