65.204.15.20

> From: "John L" 

> They claim that they do network monitoring and:
>
>    At RouterDog we believe Computers should work for people and notifiy us
>    of a problem rather then us always scrambling for them at the worst times.
>
> http://www.routerdog.com/rd_features.html
>
> A phone call to them at (215) 923-7100 would probably be quite amusing.

I tried that phone number.  After lots of what sounded like a lot of
forward-on-no-answer hops, I reached the voice mail of Wade Alexander.
He seems to be the administrative contact for routerdog.com, routerdog2.com,
and pcsolve.com (Proportal LLC), all at 124 Chestnut Street in Philadelphia.
The /24 is SWIP'ed to PROPORTAL LLC in Cinnaminson, NJ, with UUnet
contacts.  I would have called UUnet/MCI, but I don't like fighting
automated phone systems to reach the voice mail of someone who doesn't
know and won't admit that I know an IP address from a street address.

Judging from logged `cdcc stats` output, it started after 11:00 GMT
and ended by 15:30 GMT (06:00 and 10:30 EST).

...

Mr. Alexander has returned my phone call.  As you predicted, it was
quite amusing--or something.  Mr. Alexander insists it wasn't them, but
a DoS attack on them.  He said he has been up since 5 am, presumably
scrambling for his computers.  Eventually an engineer is supposed to
call me.

 From what I know now, I predict the explanation will be:

  - poorly maintained mail system went crazy and looped as hard as it
   could, asking SpamAssassin about a mail message.

  - the system is configured to use dccproc instead of dccifd, and has
   a years old version of dccproc from before I made dccproc stash times
   failures in /var/dcc/map so that dccproc like dccm and dccifd can
   refuse to try more than once every several minutes when no DCC servers
   are answering.

It's not likely to be real incoming mail, because they were doing more
than 1500 DCC requests/second.  I doubt their old sendmail installation
could do more than 100 million mail messages per day.


Do you suppose they might be interested in monitoring software to help
discover and diagnose such problems quicker?


Vernon Schryver    vjs@rhyolite.com