From lars@netapp.com Wed Sep 12 10:01:32 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6B8B321F866B for ; Wed, 12 Sep 2012 10:01:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -11.723 X-Spam-Level: X-Spam-Status: No, score=-11.723 tagged_above=-999 required=5 tests=[AWL=0.765, BAYES_00=-2.599, GB_I_INVITATION=-2, RCVD_IN_DNSWL_HI=-8, SARE_NETPROD=0.111] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pdE9iEkYwgly for ; Wed, 12 Sep 2012 10:01:31 -0700 (PDT) Received: from mx2.netapp.com (mx2.netapp.com [216.240.18.37]) by ietfa.amsl.com (Postfix) with ESMTP id ACBA621F8694 for ; Wed, 12 Sep 2012 10:01:31 -0700 (PDT) X-IronPort-AV: E=Sophos;i="4.80,410,1344236400"; d="p7s'?scan'208";a="688825370" Received: from smtp1.corp.netapp.com ([10.57.156.124]) by mx2-out.netapp.com with ESMTP; 12 Sep 2012 10:01:28 -0700 Received: from vmwexceht01-prd.hq.netapp.com (vmwexceht01-prd.hq.netapp.com [10.106.76.239]) by smtp1.corp.netapp.com (8.13.1/8.13.1/NTAP-1.6) with ESMTP id q8CH1RAw002571 for ; Wed, 12 Sep 2012 10:01:27 -0700 (PDT) Received: from SACEXCMBX01-PRD.hq.netapp.com ([169.254.2.212]) by vmwexceht01-prd.hq.netapp.com ([10.106.76.239]) with mapi id 14.02.0309.002; Wed, 12 Sep 2012 10:01:26 -0700 From: "Eggert, Lars" To: "asrg@irtf.org" Thread-Topic: Call for Nominations: Applied Networking Research Prize 2013 Thread-Index: AQHNkQg+GH/GkthxzUuq0ICaLHqjVA== Date: Wed, 12 Sep 2012 17:01:25 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [10.106.53.51] Content-Type: multipart/signed; boundary="Apple-Mail=_A9874364-3148-468B-BC51-4F9129E77C4D"; protocol="application/pkcs7-signature"; micalg=sha1 MIME-Version: 1.0 Subject: [Asrg] Call for Nominations: Applied Networking Research Prize 2013 X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: "anrp@irtf.org" , Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Sep 2012 17:01:32 -0000 --Apple-Mail=_A9874364-3148-468B-BC51-4F9129E77C4D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 CALL FOR NOMINATIONS: APPLIED NETWORKING RESEARCH PRIZE (ANRP) 2013 http://irtf.org/anrp ******************************************************************** *** Submit nominations for the 2013 award period of the *** *** Applied Networking Research Prize until November 30, 2012! *** *** *** *** (Please share this announcement with your colleagues.) *** ******************************************************************** The Applied Networking Research Prize (ANRP) is awarded for recent results in applied networking research that are relevant for transitioning into shipping Internet products and related standardization efforts. Researchers with relevant, recent results are encouraged to apply for this prize, which will offer them the opportunity to present and discuss their work with the engineers, network operators, policy makers and scientists that participate in the Internet Engineering Task Force (IETF) and its research arm, the Internet Research Task Force (IRTF). Third-party nominations for this prize are also encouraged. The goal of the Applied Networking Research Prize is to recognize the best new ideas in networking, and bring them to the IETF and IRTF especially in cases where they would not otherwise see much exposure or discussion. The Applied Networking Research Prize (ANRP) consists of: =95 cash prize of $500 (USD) =95 invited talk at the IRTF Open Meeting =95 travel grant to attend a week-long IETF meeting (airfare, hotel, registration, stipend) =95 recognition at the IETF plenary =95 invitation to related social activities =95 potential for additional travel grants to future IETF meetings, based on community feedback The Applied Networking Research Prize will be awarded once per calendar year. Each year, several winners will be chosen and invited to present their work at one of the three IETF meetings during the year. HOW TO NOMINATE Only a single person can be nominated for the award. The basis of the nomination is a peer-reviewed, original journal, conference or workshop paper they authored, which was recently published or accepted for publication. The nominee must be one of the main authors of the nominated paper. Both self nominations (nominating one=92s own paper) and third-party nominations (nominating someone else=92s paper) are encouraged. The nominated paper should provide a scientific foundation for possible future IETF engineering work or IRTF research and experimentation, analyze the behavior of Internet protocols in operational deployments or realistic testbeds, make an important contribution to the understanding of Internet scalability, performance, reliability, security or capability, or otherwise be of relevance to ongoing or future IETF or IRTF activities. Applicants must briefly describe how the nominated paper relates to these goals, and are encouraged to describe how a presentation of these research results would foster their transition into new IETF engineering or IRTF experimentation, or otherwise seed new activities that will have an impact on the real-world Internet. The goal of the Applied Networking Research Prize (ANRP) is to foster the transitioning of research results into real-world benefits for the Internet. Therefore, applicants must indicate that they (or the nominee, in case of third-party nominations) are available to attend at least one of the year=92s IETF meetings in person and in its entirety. Nominations must include: =95 the name and email address of the nominee =95 a bibliographic reference to the published (or accepted) nominated paper =95 a PDF copy of the nominated paper =95 a statement that describes how the nominated paper fulfills the goals of the award =95 a statement about which of the year=92s IETF meetings the nominee would be available to attend in person and in its entirety =95 a brief biography or CV of the nominee =95 optionally, any other supporting information (link to nominee=92s web site, etc.) Nominations are submitted via the submission site at http://irtf.org/anrp/2013/. In exceptional cases, nominations may also be submitted by email to anrp@irtf.org. SELECTION PROCESS A small selection committee comprised of individuals knowledgeable about the IRTF, IETF and the broader networking research community will evaluate the submissions against these selection criteria. IMPORTANT DATES Applications close: November 30, 2012 (hard) Notifications: December 20, 2012 SPONSORS The Applied Networking Research Prize (ANRP) is supported by the Internet Society (ISOC), as part of its Internet Research Award Programme, in coordination with the Internet Research Task Force (IRTF). HELP PUBLICIZE THE ANRP If you would like to help publicize the ANRP within your organization, you are welcome to print and use the flyer at http://irtf.org/anrp-2013-flyer.pdf --Apple-Mail=_A9874364-3148-468B-BC51-4F9129E77C4D Content-Disposition: attachment; filename="smime.p7s" Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIMQDCCBUow ggQyoAMCAQICEFcfSRTG0jNknqb9LV9GuFkwDQYJKoZIhvcNAQEFBQAwgd0xCzAJBgNVBAYTAlVT MRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29y azE7MDkGA1UECxMyVGVybXMgb2YgdXNlIGF0IGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9ycGEg KGMpMDkxHjAcBgNVBAsTFVBlcnNvbmEgTm90IFZhbGlkYXRlZDE3MDUGA1UEAxMuVmVyaVNpZ24g Q2xhc3MgMSBJbmRpdmlkdWFsIFN1YnNjcmliZXIgQ0EgLSBHMzAeFw0xMTEyMTAwMDAwMDBaFw0x MjEyMDkyMzU5NTlaMIIBDTEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlT aWduIFRydXN0IE5ldHdvcmsxRjBEBgNVBAsTPXd3dy52ZXJpc2lnbi5jb20vcmVwb3NpdG9yeS9S UEEgSW5jb3JwLiBieSBSZWYuLExJQUIuTFREKGMpOTgxHjAcBgNVBAsTFVBlcnNvbmEgTm90IFZh bGlkYXRlZDEzMDEGA1UECxMqRGlnaXRhbCBJRCBDbGFzcyAxIC0gTmV0c2NhcGUgRnVsbCBTZXJ2 aWNlMRQwEgYDVQQDFAtMYXJzIEVnZ2VydDEeMBwGCSqGSIb3DQEJARYPbGFyc0BuZXRhcHAuY29t MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAokrhJTcXt6J/VEpZOicLoguBlYTjXP9v Ze4HuuhXnURUS8YouAfgaqA0zYbt5yd6fh4PBMdAaEWr5yJyHuFykXlrCumjUWSpLuqTS2A+pt4q cZaAQk9iLDN/UVd3SpkUuvWbxXlqzG7/BSqa3VNObBzCmyh+V7aXxri+30CT//DSsNRC4VFy6sn6 dMgSaFenXLwe/FBwY0qTMfICT1PrrX6Sw1S8OfH9rykLlZXbmfkFExxQngp1DJH9xMHeODHGbCv/ ty5gdxMOrLe+vENxFEcy1YQWBZd1kNL4UObugF8A/jE/s+Oa3H1VFH8ghqZTdqGDysVxmtKHuNFx 6jIBSQIDAQABo4HSMIHPMAkGA1UdEwQCMAAwRAYDVR0gBD0wOzA5BgtghkgBhvhFAQcXATAqMCgG CCsGAQUFBwIBFhxodHRwczovL3d3dy52ZXJpc2lnbi5jb20vcnBhMAsGA1UdDwQEAwIFoDAdBgNV HSUEFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwUAYDVR0fBEkwRzBFoEOgQYY/aHR0cDovL2luZGMx ZGlnaXRhbGlkLWczLWNybC52ZXJpc2lnbi5jb20vSW5kQzFEaWdpdGFsSUQtRzMuY3JsMA0GCSqG SIb3DQEBBQUAA4IBAQBA7q6tR92qpd7xo7VBsrOfGCWzoxIVfTc7t0RhB/Oz/+c3lnhYnNScIuKN JmyZvznmVxqB9BJ72+NkvmdB/hnILSBTRawL2tyLo9PkBtN0nRt4gS6wjpWnD8G83hlJLE7r25jk 7HkRev61dTIXsANFpJKF02C4XSoDfEzNV6MpuEvHvcgHCqMrlwWwfKc7+NoDnE8PBuRzwSXvlD5L mswCY2iiOsd7ImNO4OzTCxETvKTDu92+FTIbRJJpYjVNv1UF7e3w9Kq65BkZJErUH19beUeQl0Wh 2BJQE6/15rQyCnP0iJ/Nmx2/kI6M0PWunEsI6FMs0MbosreaWGHlQmomMIIG7jCCBdagAwIBAgIQ cRVmBUrkkSFN6bxE+azT3DANBgkqhkiG9w0BAQUFADCByjELMAkGA1UEBhMCVVMxFzAVBgNVBAoT DlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQL EzEoYykgMTk5OSBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYD VQQDEzxWZXJpU2lnbiBDbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9y aXR5IC0gRzMwHhcNMDkwNTAxMDAwMDAwWhcNMTkwNDMwMjM1OTU5WjCB3TELMAkGA1UEBhMCVVMx FzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3Jr MTswOQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAo YykwOTEeMBwGA1UECxMVUGVyc29uYSBOb3QgVmFsaWRhdGVkMTcwNQYDVQQDEy5WZXJpU2lnbiBD bGFzcyAxIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQSAtIEczMIIBIjANBgkqhkiG9w0BAQEFAAOC AQ8AMIIBCgKCAQEA7cRH3yooHXwGa7vXITLJbBOP6bGNQU4099oL42r6ZYggCxET6ZvgSU6Lb9UB 0F8NR5GKWkx0Pj/GkQm7TDSejW6hglFi92l2WJYHr54UGAdPWr2f0jGyVBlzRmoZQhHsEnMhjfXc MM3l2VYKMcU2bSkUl70t2olHGYjYSwQ967Y8Zx50ABMN0Ibak2f4MwOuGjxraXj2wCyO4YM/d/mZ //6fUlrCtIcK2GypR8FUKWVDPkrAlh/Brfd3r2yxBF6+wbaULZeQLSfSux7pg2qE9sSyriMGZSal J1grByK0b6ZiSBp38tVQJ5op05b7KPW6JHZi44xZ6/tu1ULEvkHH9QIDAQABo4ICuTCCArUwNAYI KwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC52ZXJpc2lnbi5jb20wEgYDVR0T AQH/BAgwBgEB/wIBADBwBgNVHSAEaTBnMGUGC2CGSAGG+EUBBxcBMFYwKAYIKwYBBQUHAgEWHGh0 dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9jcHMwKgYIKwYBBQUHAgIwHhocaHR0cHM6Ly93d3cudmVy aXNpZ24uY29tL3JwYTA0BgNVHR8ELTArMCmgJ6AlhiNodHRwOi8vY3JsLnZlcmlzaWduLmNvbS9w Y2ExLWczLmNybDAOBgNVHQ8BAf8EBAMCAQYwbgYIKwYBBQUHAQwEYjBgoV6gXDBaMFgwVhYJaW1h Z2UvZ2lmMCEwHzAHBgUrDgMCGgQUS2u5KJYGDLvQUjibKaxLB4shBRgwJhYkaHR0cDovL2xvZ28u dmVyaXNpZ24uY29tL3ZzbG9nbzEuZ2lmMC4GA1UdEQQnMCWkIzAhMR8wHQYDVQQDExZQcml2YXRl TGFiZWw0LTIwNDgtMTE4MB0GA1UdDgQWBBR5R2EIQf04BKJL57XM9UP2SSsR+DCB8QYDVR0jBIHp MIHmoYHQpIHNMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNV BAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJ bmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDEg UHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHM4IRAItbdVaEVIULAM+v OEjOsaQwDQYJKoZIhvcNAQEFBQADggEBADlNz0GZgbWpBbVSOOk5hIls5DSoWufYbAlMJBq6WaSH O3Mh8ZOBz79oY1pn/jWFK6HDXaNKwjoZ3TDWzE3v8dKBl8pUWkO/N4t6jhmND0OojPKvYLMVirOV nDzgnrMnmKQ1chfl/Cpdh9OKDcLRRSr4wPSsKpM61a4ScAjr+zvid+zoK2Q1ds262uDRyxTWcVib vtU+fbbZ6CTFJGZMXZEfdrMXPn8NxiGJL7M3uKH/XLJtSd5lUkL7DojS7Uodv0vj+Mxy+kgOZY5J yNb4mZg7t5Q+MXEGh/psWVMu198r7V9jAKwV7QO4VRaMxmgD5yKocwuxvKDaUljdCg5/wYIxggSL MIIEhwIBATCB8jCB3TELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYD VQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0 cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykwOTEeMBwGA1UECxMVUGVyc29uYSBOb3QgVmFs aWRhdGVkMTcwNQYDVQQDEy5WZXJpU2lnbiBDbGFzcyAxIEluZGl2aWR1YWwgU3Vic2NyaWJlciBD QSAtIEczAhBXH0kUxtIzZJ6m/S1fRrhZMAkGBSsOAwIaBQCgggJtMBgGCSqGSIb3DQEJAzELBgkq hkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTEyMDkxMjE3MDEzM1owIwYJKoZIhvcNAQkEMRYEFBjT aX077WTgDs97msFn1R17+s6zMIIBAwYJKwYBBAGCNxAEMYH1MIHyMIHdMQswCQYDVQQGEwJVUzEX MBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsx OzA5BgNVBAsTMlRlcm1zIG9mIHVzZSBhdCBodHRwczovL3d3dy52ZXJpc2lnbi5jb20vcnBhIChj KTA5MR4wHAYDVQQLExVQZXJzb25hIE5vdCBWYWxpZGF0ZWQxNzA1BgNVBAMTLlZlcmlTaWduIENs YXNzIDEgSW5kaXZpZHVhbCBTdWJzY3JpYmVyIENBIC0gRzMCEFcfSRTG0jNknqb9LV9GuFkwggEF BgsqhkiG9w0BCRACCzGB9aCB8jCB3TELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJ bmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1 c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykwOTEeMBwGA1UECxMVUGVyc29u YSBOb3QgVmFsaWRhdGVkMTcwNQYDVQQDEy5WZXJpU2lnbiBDbGFzcyAxIEluZGl2aWR1YWwgU3Vi c2NyaWJlciBDQSAtIEczAhBXH0kUxtIzZJ6m/S1fRrhZMA0GCSqGSIb3DQEBAQUABIIBAEebopXy gk39DKyOQdot1TwLokwEbT8oZ30wlwKMza841ldjnclfaQ++8M/JljITBJuQ8xYUS3TEkHRjDr1q ICV4wa5TO2dBclLDCXW2PF883Cku0JcVbNRXfoATx7/8OP72qG1IlH0oEIK+K2gY8v0mPulS/GJx riSGT1SviLSaDnNteRaqfUt+nuvY0WSenTj9Ihj3chuQIX4fM8V401qlnvSdJU9a83sx564/ssMp zte7/zwxFV1ib6rlFdqfJebb9Tk4rQw7WsKVGa5YurwF+ymdEWJ1vkaZcbbBLq8RP2quesD6m2tc bUSmLrDdZZBWwDDpX7x+FwWFrYoEVxYAAAAAAAA= --Apple-Mail=_A9874364-3148-468B-BC51-4F9129E77C4D-- From johnl@iecc.com Wed Sep 19 14:33:10 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7EB5B21E8044 for ; Wed, 19 Sep 2012 14:33:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8RNk0g+MprYI for ; Wed, 19 Sep 2012 14:33:09 -0700 (PDT) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id 8D40C21E8042 for ; Wed, 19 Sep 2012 14:33:09 -0700 (PDT) Received: (qmail 18570 invoked from network); 19 Sep 2012 21:33:07 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:mime-version:content-type:vbr-info:user-agent:cleverness; s=4889.505a3a13.k1209; bh=0l7ncn8phiuMKGQDS2Nxp9tJcQuV2Wu4Lnd3sBovzhw=; b=q6k6LyYXzqr5uyBnGx43YQPlJivsI6Vj/OVngeftSpCQEryQ50a529ieCCnE+A+hX8YT6RVoTnN6+hJOUuonw8YIDeib7fjs3sOyy/raWDR6m8p3fCRbJSD7PCNK+IFUYfgXjsbBF1p3wCgfhArKJQw4InyTNe7huJHKEwI3ud4= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Received: (ofmipd 127.0.0.1); 19 Sep 2012 21:32:45 -0000 Date: 19 Sep 2012 17:33:07 -0400 Message-ID: From: "John R. Levine" To: "Anti Spam Research Group" User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) Cleverness: None detected MIME-Version: 1.0 Content-Type: TEXT/PLAIN; format=flowed; charset=US-ASCII Subject: [Asrg] DNSBL caches and IPv6, again X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Sep 2012 21:33:10 -0000 As I've mentioned a few time, I'm trying to figure out the cache behavior of DNSBLs, so we can try and predict whether IPv6 BLs would make the DNS melt down. If I had traces of [IP,timestamp] from some medium sized mail sytems, I could do some cache simulations. Medium is in in the range of a million connections a day. Anyone have access to one of those? Nobody has IPv6 mail at that scale yet, but IPv4 would do fine for this. I don't need to know whether the connection was for real mail or spam. If you consider the IPs confidential, hashes or tokens would be fine so long as the same token consistently corresponds to the same IP. R's, John From prvs=16098981ca=lists@hireahit.com Wed Sep 19 14:55:11 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4635121E80B8 for ; Wed, 19 Sep 2012 14:55:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.11 X-Spam-Level: X-Spam-Status: No, score=-2.11 tagged_above=-999 required=5 tests=[BAYES_05=-1.11, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JbwpWjd2LjhK for ; Wed, 19 Sep 2012 14:55:10 -0700 (PDT) Received: from vinny.hireahit.com (vinny.hireahit.com [72.51.42.137]) by ietfa.amsl.com (Postfix) with ESMTP id 9C39421E80AF for ; Wed, 19 Sep 2012 14:55:10 -0700 (PDT) Received: from [172.24.0.107] by hireahit.com (vinny.hireahit.com) (SecurityGateway 2.0.7) with SMTP id SG002718190.MSG for ; Wed, 19 Sep 2012 14:54:52 -0700 Message-ID: <505A3F38.4030805@hireahit.com> Date: Wed, 19 Sep 2012 14:55:04 -0700 From: Dave Warren User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:16.0) Gecko/20120905 Thunderbird/16.0 MIME-Version: 1.0 To: asrg@irtf.org References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-SGOP-RefID: fgs=0 (_st=1 _vt=0 _iwf=0) Subject: Re: [Asrg] DNSBL caches and IPv6, again X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Sep 2012 21:55:11 -0000 On 9/19/2012 2:33 PM, John R. Levine wrote: > As I've mentioned a few time, I'm trying to figure out the cache > behavior of DNSBLs, so we can try and predict whether IPv6 BLs would > make the DNS melt down. > > If I had traces of [IP,timestamp] from some medium sized mail sytems, > I could do some cache simulations. Medium is in in the range of a > million connections a day. Anyone have access to one of those? > Nobody has IPv6 mail at that scale yet, but IPv4 would do fine for this. > > I don't need to know whether the connection was for real mail or > spam. If you consider the IPs confidential, hashes or tokens would be > fine so long as the same token consistently corresponds to the same IP. Isn't the fear that with IPv6, spammers simply won't use the same address twice, thereby causing cache meltdown on a scale that isn't possible in today's IP-scarce IPv4 world? In other words, the data you get from legitimate mail servers in IPv4 may roughly correspond to the data you'd get from legitimate mail servers in IPv4, but the data you get from spammers today won't be at all representative of IPv6 spammer's potential behaviour. Heck, even the data from legitimate mail might not mean much going forward. I'd be at least a little tempted to send mail from different clients from different IPs (or possibly even with more granularity for clients who send person to person, bulk and transactional mail, but don't currently send enough to justify wasting IPs to segregate such traffic), so even legitimate sites might end up using a lot more outbound IPs, simply because they can. In other words, as much as I'd love to see some concrete data on this going forward, I'm not sure that these simulations will apply to future real-world situations. -- Dave Warren http://www.hireahit.com/ http://ca.linkedin.com/in/davejwarren From johnl@iecc.com Wed Sep 19 15:27:41 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7C4E621E8044 for ; Wed, 19 Sep 2012 15:27:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -111.199 X-Spam-Level: X-Spam-Status: No, score=-111.199 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, RCVD_IN_BSP_TRUSTED=-4.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fSp6vYRj2+Dd for ; Wed, 19 Sep 2012 15:27:40 -0700 (PDT) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id D2A8721E8048 for ; Wed, 19 Sep 2012 15:27:32 -0700 (PDT) Received: (qmail 33780 invoked from network); 19 Sep 2012 22:27:31 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 19 Sep 2012 22:27:31 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=505a46d2.xn--i8sz2z.k1208; i=johnl@user.iecc.com; bh=X/iJIHT2yA1Oief5i3ST3HtOX0+dA0aveWpzSy8uwNw=; b=n+ocpfFX3F9rrjD9o6UgOvZNwjgs80PQQXmVM+BYZ+eC1L0MVYzqrYxRrrg1M12Vlu4lKb1fN3Zv2XR+v/g6TAZmlYb8OaGxsPDALrpv8J3qlvNyHxI6AmTxCU9NSbwhdTjzY7D2XesLt+IeYxuRmG8s3qiFgs7oBgk8/VYImQ0= DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=505a46d2.xn--i8sz2z.k1208; olt=johnl@user.iecc.com; bh=X/iJIHT2yA1Oief5i3ST3HtOX0+dA0aveWpzSy8uwNw=; b=W5jXFhWNCwjhJ+ss6432QzHXYGoBG3KB/yxELMxju+d/zckISsTedCBU1FDGaXLq5F6K3+hYxFVTAVqGbcLgxZvNf+5Rkf6GQ9KsXvH1qJFhCwGDeDoimGlRK3rW2OzTsE0YKsfm9x0MAjkTs5pcosgXOdH77ewE76tizDBQCGc= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Date: 19 Sep 2012 22:27:08 -0000 Message-ID: <20120919222708.79455.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: <505A3F38.4030805@hireahit.com> Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] DNSBL caches and IPv6, again X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Sep 2012 22:27:41 -0000 >Isn't the fear that with IPv6, spammers simply won't use the same >address twice, thereby causing cache meltdown on a scale that isn't >possible in today's IP-scarce IPv4 world? That is my concern, but it is not at all clear how well existing DNSBL queries cache. My current working hypothesis divides the mail world into three parts: Large: big mail systems get copies of the BLs out of band, e.g. by rsync, and run a local rbldnsd on the same LAN as the mail servers. Since a local rbldnsd can respond as fast as a cache, it uses a TTL of zero to effectively bypass the cache, no problem. Medium: mail systems query public BLs and use the local DNS cache. Cache may or may not help. Small: like medium, but so little traffic that cache entries all expire before being reused, so it doesn't matter. The concern is the medium systems. I have some hints, but nobody really knows how well their queries cache. If I had data I could try some experiments. Obvious things include varying TTLs to see how that affects cache behavior. Slightly less obvious things include the BL noting how many queries it gets for an address, and returning a longer TTL for heavily queried addresses. This would require a hacked server to vary the SOA TTL on negative answers, but we know how to do that. So, anyone got server log [IP,timestamp] data they can share? R's, John From clewis+ietf@mustelids.ca Wed Sep 19 18:06:09 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B40C921F849D for ; Wed, 19 Sep 2012 18:06:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.152 X-Spam-Level: ** X-Spam-Status: No, score=2.152 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, J_CHICKENPOX_29=0.6, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yAbeMYwWdP8J for ; Wed, 19 Sep 2012 18:06:09 -0700 (PDT) Received: from mail.mustelids.ca (unknown [174.35.130.2]) by ietfa.amsl.com (Postfix) with ESMTP id E915821F849C for ; Wed, 19 Sep 2012 18:06:08 -0700 (PDT) Received: from [192.168.0.8] (otter.mustelids.ca [192.168.0.8]) (authenticated bits=0) by mail.mustelids.ca (8.14.4/8.14.4/Debian-2ubuntu2) with ESMTP id q8K162kD031203 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Wed, 19 Sep 2012 21:06:03 -0400 X-DKIM: Sendmail DKIM Filter v2.8.3 mail.mustelids.ca q8K162kD031203 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mustelids.ca; s=default.private; t=1348103163; bh=LXG8hHPRefmanUGEo3LTv6EQ1vCbmJuRkz3IEzXcC5o=; h=Message-ID:Date:From:MIME-Version:To:Subject:References: In-Reply-To:Content-Type:Content-Transfer-Encoding; b=XCul7n5Xgr8fmYDaSjg6I3vfM7XpddzfcGtuJv3affUOEX+u3S2DMUcbzTTME5p5W ymZ60Su22tK+1f9U3OhVB11wPfkMiNC8iBBykDttCPfK9EmZFUfY4PO5V8sPu658A+ /qhbj0dmlS+9KcOJR86mTFqRlAp0T5TdWnXGe5So= Message-ID: <505A6BFA.5020504@mustelids.ca> Date: Wed, 19 Sep 2012 21:06:02 -0400 From: Chris Lewis User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.23) Gecko/20090812 Thunderbird/2.0.0.23 Mnenhy/0.7.6.666 MIME-Version: 1.0 To: asrg@irtf.org References: In-Reply-To: X-Enigmail-Version: 1.4.4 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] DNSBL caches and IPv6, again X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Sep 2012 01:06:09 -0000 On 12-09-19 05:33 PM, John R. Levine wrote: > As I've mentioned a few time, I'm trying to figure out the cache > behavior of DNSBLs, so we can try and predict whether IPv6 BLs would > make the DNS melt down. Didn't you already do this with data from my logs a year or more ago? I don't have large production flow anymore but will IP:timestamp from a trap do? I have several at the million-ish/day level ;-) From johnl@iecc.com Wed Sep 19 22:07:25 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2DE0021F8666 for ; Wed, 19 Sep 2012 22:07:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -110.899 X-Spam-Level: X-Spam-Status: No, score=-110.899 tagged_above=-999 required=5 tests=[AWL=-0.300, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, J_CHICKENPOX_29=0.6, RCVD_IN_BSP_TRUSTED=-4.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mVoprISU4Wt5 for ; Wed, 19 Sep 2012 22:07:23 -0700 (PDT) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id DBCE821F862B for ; Wed, 19 Sep 2012 22:07:22 -0700 (PDT) Received: (qmail 95709 invoked from network); 20 Sep 2012 05:07:20 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 20 Sep 2012 05:07:20 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=505aa488.xn--30v786c.k1208; i=johnl@user.iecc.com; bh=IUh6lu6Bb3XGyN3Pd1rTrYF1az3pRkznDtKdFZoG3WY=; b=N5J8BYdVaRPLtJb+liUbzEx5+7S2K+x2JuusCc3HiUJ0bx39YytJ7hXLXow32Z4BlnoGZ/wlCNlcH25cm/DEu0wipSXZ33Rvqu31DuMLTqqEkNshiog9HGq/Eb8kGyJSruPM3e9fi3u9XkhI8G1DqtH8m86uGw2e8tAH+B83SK8= DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=505aa488.xn--30v786c.k1208; olt=johnl@user.iecc.com; bh=IUh6lu6Bb3XGyN3Pd1rTrYF1az3pRkznDtKdFZoG3WY=; b=qFtIjNw7MglbwEPnoq7lVGFIjmkAaeKqVToPJIwZ3FaAzNloWdjPtPQfBmZX81GnWFH//CAAKvO8K/jAknbMAXCa69F7jfGfdF2FE3Xwo9JXtLQ3/InO9eQwiehpAqY5v7VA860rHcQ1+aIijlQqSu+QPcxypuWfCAii3ihj+Bk= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Date: 20 Sep 2012 05:06:58 -0000 Message-ID: <20120920050658.89937.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: <505A6BFA.5020504@mustelids.ca> Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] DNSBL caches and IPv6, again X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Sep 2012 05:07:25 -0000 In article <505A6BFA.5020504@mustelids.ca> you write: >On 12-09-19 05:33 PM, John R. Levine wrote: >> As I've mentioned a few time, I'm trying to figure out the cache >> behavior of DNSBLs, so we can try and predict whether IPv6 BLs would >> make the DNS melt down. > >Didn't you already do this with data from my logs a year or more ago? No, that was something else. >I don't have large production flow anymore but will IP:timestamp from a >trap do? I have several at the million-ish/day level ;-) It's certainly better than nothing. A real mail server would probably have large chunks of traffic from big mail hosts that a trap doesn't, but I'll take what I can get. By the way, anyone else interested in modelling and simulation? It's fun. R's, John From matthias@leisi.net Wed Sep 19 22:11:01 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 63CC321F8643 for ; Wed, 19 Sep 2012 22:11:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.377 X-Spam-Level: X-Spam-Status: No, score=-2.377 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, J_CHICKENPOX_42=0.6, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ivbWSeqm+Scg for ; Wed, 19 Sep 2012 22:11:00 -0700 (PDT) Received: from mail-ob0-f182.google.com (mail-ob0-f182.google.com [209.85.214.182]) by ietfa.amsl.com (Postfix) with ESMTP id A21ED21F862B for ; Wed, 19 Sep 2012 22:11:00 -0700 (PDT) Received: by obbun3 with SMTP id un3so2239408obb.13 for ; Wed, 19 Sep 2012 22:11:00 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :content-type:content-transfer-encoding:x-gm-message-state; bh=EZGVDsZe+pQV3aVFSy75KnpSaxl9WoQqMw0sQqIEt/w=; b=UAmTGavIyxwWy6MdzGmr1OZHfM3MSuQlgOIlfUaqeDN6QFkelgR6RIq9iCJ4vK2sOl drgZOrT/AeN8kM/LNwu9KG6ZfZEwhMDEhmk5N0GNfiV8/+Amc/b2eCpaddNG5n6+YJIj dp8ImLLydToM+wUURfvMJu7kdtYTKXnMWnVn4ti39jBTEQVaESmGCcgYORsy8p4pU8Zv z87JfEkvU9jQ3KwCh2pLIXyAVhCeZUMEeWMYm5ULenrb4Jm866rZTiSTKmwCQs79WBv1 LRg9+Ej2A3fsbeRD7hMCzSLNcQ7g4bB0rQgtOiUGJuNopc5SjgUfu70SHQjKvZ2t1e9s ofxw== Received: by 10.60.172.49 with SMTP id az17mr470163oec.44.1348117860033; Wed, 19 Sep 2012 22:11:00 -0700 (PDT) MIME-Version: 1.0 Received: by 10.76.135.35 with HTTP; Wed, 19 Sep 2012 22:10:39 -0700 (PDT) In-Reply-To: <20120919222708.79455.qmail@joyce.lan> References: <505A3F38.4030805@hireahit.com> <20120919222708.79455.qmail@joyce.lan> From: Matthias Leisi Date: Thu, 20 Sep 2012 07:10:39 +0200 Message-ID: To: Anti-Spam Research Group - IRTF Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable X-Gm-Message-State: ALoCoQk5E/tOcsbUN1ay4L7TMuuqUq9/Oj4x5CRK0Sn6vOdUNg0KRf+7Hgz0vcW2ZGRhtEo23tnc Subject: Re: [Asrg] DNSBL caches and IPv6, again X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Sep 2012 05:11:01 -0000 On Thu, Sep 20, 2012 at 12:27 AM, John Levine wrote: > So, anyone got server log [IP,timestamp] data they can share? I have [IP, # of queries] on a daily level from DNS query logs from dnswl.org, eg in a file named "2012-08-03.aggregate": | 178.63.223.135 1 | 219.255.134.101 4992 |=A0156.45.254.31 80 These are the numbers we see at the authoritative servers, ie after caching by (mostly "medium" in your terminology) local resolvers. We only collect about a third of the logs (we are only interested in relative numbers, so that is not an issue for our own purposes). Despite sanity checks, there are about 1% odd IPs, eg from those who forget that they should use reverse-nibble notation for the lookups, funny internal IP addressing schemes leaking out, DNSxLs trying to look up whole ranges etc). We also have data in the same format for the DNS server IPs that actually query our servers. We keep this data for about a month (the higher aggregated data, ie sender magnitudes, top query sources etc are kept in the DB for longer). We do not yet collect data on IPv6. If you want to help us to change that, see http://www.dnswl.org/news/archives/26-Do-you-want-to-support-the-dnswl.org-= project.html -- Matthias From johnl@iecc.com Wed Sep 19 23:08:36 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E5E0511E808E for ; Wed, 19 Sep 2012 23:08:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -111.192 X-Spam-Level: X-Spam-Status: No, score=-111.192 tagged_above=-999 required=5 tests=[AWL=0.007, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, RCVD_IN_BSP_TRUSTED=-4.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WeYxjHRj3vwA for ; Wed, 19 Sep 2012 23:08:36 -0700 (PDT) Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id 0FF1B11E808D for ; Wed, 19 Sep 2012 23:08:35 -0700 (PDT) Received: (qmail 5226 invoked from network); 20 Sep 2012 06:08:31 -0000 Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 20 Sep 2012 06:08:31 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=505ab2df.xn--3zv.k1208; i=johnl@user.iecc.com; bh=1Vw0HMhlPYPi+yMyUksyuyvq4WmAJZ9dv+5KGHuOqfM=; b=MDG0m8Iwh0gQNpq9stReKCLEuX5wdufgnWW/BlGb2GCrLXqm7OLl4xLWGrWcCpxDi23CoFSFcSzXfgKZq0rEteZ2rSSYvCfwmedfB6fGlQaLw/aK2NJaBHJq5z6IEzYiZWNeX5U0ZRB09mgIDNi7FGSejr0NEuSt2+xr0rv1kic= DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=505ab2df.xn--3zv.k1208; olt=johnl@user.iecc.com; bh=1Vw0HMhlPYPi+yMyUksyuyvq4WmAJZ9dv+5KGHuOqfM=; b=tEeZcctYx6ukNZMmNBt0HCb4WF9oxwvYvTWeYBsreQFOm0MvV/O8MdwJ/lSfnrw/xziCO3WfavTh3THZ4RajE3EsnNrPxtccpBUs+9LGCCtYNWHBsVpreUOAzOBBO6139hcsdItuZoIJoEKgAHEcZP+MyKOiu0y+y+YHNAwDVeQ= VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org Date: 20 Sep 2012 06:08:09 -0000 Message-ID: <20120920060809.92186.qmail@joyce.lan> From: "John Levine" To: asrg@irtf.org In-Reply-To: Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit Subject: Re: [Asrg] DNSBL caches and IPv6, again X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Sep 2012 06:08:37 -0000 >> So, anyone got server log [IP,timestamp] data they can share? > >I have [IP, # of queries] on a daily level from DNS query logs from >dnswl.org, eg in a file named "2012-08-03.aggregate": Thanks, but I really need mail server logs. I have logs for korea.services.net which is still surprisingly popular. Perhaps we could compare notes sometime. R's, John