December 1999 - NZNOG - lists.nznog.org

RE: ORBS block
by Olof Olsson 22 Dec '99

22 Dec '99

> > > CLEAR/CLEAR Net is _not_ using ORBS. We are being scanned > as you are > > > though... > > > > Snap for Netlink/Telstra. > > For what it's worth, neither does Actrix, although we are constantly > scanned and have often found ourselves blocked with little or no > warning! > Ditto. We have been "blocked" a couple of times due to customers having open relays. Funny, we always get the ORBS notification around 4pm on Friday afternoons... Must be a coincidince... --Olof --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

ns99.waikato.ac.nz
by Simon Lyall 22 Dec '99

22 Dec '99

Hmm ping times to it just went to about 4 seconds, 80% packet loss. It's still answering name queries but it's a bit of a worry. Hopefully if it's a real problem Domainz will fix it when they get back to work :( -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz System/Network Admin | T&C Enforcement | Home: simon(a)darkmere.gen.nz The Internet Group, Auck. | Asst Doorman | Web: Currently Offline --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 4

RE: ORBS block
by Olof Olsson 22 Dec '99

22 Dec '99

> I'm not sure who the "we" concerned is but I see requests > from a particular > netblock maintained by a particular admin who just happens to > host the ORBS > site going through our network ranges on a regular basis... > anyway, the > point of my post, does anyone in NZ actually use the ORBS > database on there > mail servers (aside from the obvious) as a spam blocking > tool? XTRA, IHUG, > ICONZ, Clear, Voyager?? > CLEAR/CLEAR Net is _not_ using ORBS. We are being scanned as you are though... --Olof --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 4

RE: ORBS block - Forwarded
by Donald Neal 22 Dec '99

22 Dec '99

From: James Bell <jrb(a)wibble.net> Subject: RE: ORBS block In-Reply-To: <NDBBINFAOBJJKEKGNMGCCEPCDFAA.shane.cole(a)staff.paradise.net .nz> References: <Pine.LNX.4.05.9912211535460.26661-100000(a)mailhost.manawatu.net.nz> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" >point of my post, does anyone in NZ actually use the ORBS database on there >mail servers (aside from the obvious) as a spam blocking tool? XTRA, IHUG, >ICONZ, Clear, Voyager? Voyager doesn't. I'd be interested to know how many of ORBS sub-scribers do so becuase its easier to subscribe than to fix their customer's open relays. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: ORBS block (fwd)
by Robert Hunt 21 Dec '99

21 Dec '99

Jamie, To me the notion that ORBS is "attacking" is obviously specious.. so one goes on to wonder why Dean Anderson's message carries any appearance of credibility.. Hopefully whatever merit you see in Dean Anderson's message is soon run to ground by a little net research. That research will show that Dean Anderson is well known for "imaginative and persistent postings" and got himself kicked out of spam-l and spamtools, etc.. and that he features in a list of Net Kooks. Alan Brown /ORBS is assisting the FBI in some respects.. yes. Dean Anderson assisting the FBI? ... as a weapon of irritation perhaps :-) if you have some ideas on what would reduce the frequency of his "helpful" calls ... they might like to hear from you :-) Robert Hunt --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 4

A.P.E. and the future
by Robert Hunt 20 Dec '99

20 Dec '99

hi All, We have with some enthusiasm looked forward to the practical action re peering, and are really pleased that Clear and IHUG and very soon Telecom are going to be peering with us. No doubt this means that those of you on the above list are peering with each other too as well as other smaller parties. Today Telstra appear to have distinguished themselves. Our initiative to BGP peer with them was rejected in accordance with a policy of "not peering with anyone but a carrier". (- David Venables) This seems antithetical to the overall objective of an "exchange" ? In the interests of network efficiency do you think that Homo Australias could at least be persuaded to exchange with the route reflector?? I presume that in the end the win-win scenario of the exchange makes "evolutionary sense" :-)) Robert Hunt --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

ORBS block (fwd)
by Jamie Clark 17 Dec '99

17 Dec '99

This may be of interest: ---------- Forwarded message ---------- Date: Thu, 16 Dec 1999 16:44:19 -0500 From: Dean Anderson <dean(a)av8.com> To: nanog(a)merit.edu Cc: noc(a)bbn.com, noc(a)netgate.net.nz, abuse(a)bbn.com, abuse(a)netgate.net.nz Subject: ORBS block Well, after almost a month of no attacks and a coincident month of ORBS blocking at BBN/NZ link, the block on ORBS has been lifted, and we have started getting relay attacks again. I think thats pretty conclusive evidence that they are the cause of the relay attacks. I'm hoping the removal was an oversight, but I'd like to ask people to please put the following access lists in: access-list 104 deny ip 202.36.148.5 0.0.0.255 any access-list 104 deny ip 202.36.147.16 0.0.0.255 any Luckily, the FBI just called me back to begin work on last months attacks. I guess Egypt Air must be getting wrapped up. I guess I have some stuff to add to our complaints. Actually, given the cause and effect demonstrated by the block, I'm hoping that this will motivate the FBI to do something with ORBS. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

1q2000 in-addr walk - first notice
by Bill Manning 16 Dec '99

16 Dec '99

Hi, I appologize for duplicates. The next audit of the in-addr.arpa. tree will begin 01 january 2000. Since 1997, I've been walking the in-addr tree every quarter, looking for numbers of delegations, accurate delegations, and types and styles of error conditions. So... this is a heads up that you will be seeing zone transfers being generated by a couple of the collecter machines here. For those of you who utilize BINDs access controls, I'd appreciate your inclusion of the collector machines in allowed transfers. Queries will be from the following IP addresses: 128.9.160.57 and 198.32.4.13 If there are any questions or concerns, I'd be happy to talk about them. Past data has been presented at IEPG, Apricot and RIPE meetings. The expectation is that future data will be presented in the same and similar forums. Online summaries can be found at: www.isi.edu/~bmanning/in-addr-audit.html --bill --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

[pfs@cisco.com: [apops] AP routing table analysis]
by Joe Abley 16 Dec '99

16 Dec '99

>From the APOPS mailing list... ----- Forwarded message from Philip Smith <pfs(a)cisco.com> ----- X-Sender: philsmit(a)lint.cisco.com X-Mailer: QUALCOMM Windows Eudora Pro Version 4.2.2 Date: Thu, 16 Dec 1999 15:01:42 +1000 To: apops(a)whois.apnic.net From: Philip Smith <pfs(a)cisco.com> Subject: [apops] AP routing table analysis Cc: bgp-stats(a)whois.apnic.net Precedence: bulk Hello Everyone, As has been presented at the last two IEPG meetings I have been doing some work with APNIC which involves analysing the Internet Routing table as seen on the APNIC routers. The project has been running informally since March of this year, and I now feel it is an appropriate time to widen the audience who are aware of this work, and to make you aware of some of the initial results. APNIC receive the full Internet routing table at their NSPIXP2 location in Japan. The analysis work basically takes a daily snapshot of this full routing table at 4am GMT+10 hours and then separates out the announcements according to several programmed criteria. These criteria include information such as the number of prefixes and ASes which are being used in this region from APNIC allocatable space. The daily statistics are available on the APNIC web site, at the URL: http://www.apnic.net/stats/bgp both in graphical and textual format. The daily text is also sent by e-mail to the bgp-stats(a)lists.apnic.net mailing list. To subscribe to the list, please send e-mail to majordomo(a)lists.apnic.net, and put the words "subscribe bgp-stats" in the body of the mail message. I plan to start posting a weekly message to the apops(a)lists.apnic.net mailing list. If you are not on this list (which is the Asia Pacific Operations list, equivalent to the North American NANOG list, or European EOF list), you can subscribe through the APNIC majordomo system as referenced above ("subscribe apops"), or view the archive referenced from the APNIC web pages. All feedback and comments are welcome. With APNIC's help I am working on the next phase of the analysis system which includes more information and better graphical presentation. Acknowledgements: Thanks are due to APNIC for allowing me access to their equipment to run this project, and for their support. Thanks especially are due to Bruce Campbell for building and maintaining the web pages. Best wishes! philip -- -------------------------------------------------------- Philip Smith ph: +61 7 3238 8200 Consulting Engineering, Office of the CTO, Cisco Systems -------------------------------------------------------- * APOPS: Asia Pacific Operations Forum * * To unsubscribe: send "unsubscribe" to apops-request(a)apnic.net * ----- End forwarded message ----- -- Ua lawa küpono ka hakahaka pä o këia pä malule --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

[sean@donelan.com: subscription information for y2k list]
by Joe Abley 16 Dec '99

16 Dec '99

This may be of interest... For background on what Sean is doing, it might be instructive to glance through some archives from the NANOG list. There are operators here using different domestic infrastructure, different under-sea cables (as well as satellites operated by different stellite operators, using different earthstations both here and overseas). So if there's a good mix of people contributing as the clock ticks over to 1900, at least _some_ of it should get out. Joe ----- Forwarded message from Sean Donelan <sean(a)donelan.com> ----- Date: 15 Dec 1999 21:40:59 -0800 X-Sent: 16 Dec 1999 05:40:59 GMT To: jabley(a)patho.gen.nz From: Sean Donelan <sean(a)donelan.com> X-Mailer: Web Mail 3.3 Subject: subscription information for y2k list The y2k-announce list will be used for administrative announcements through December 30, 1999. From December 31, 1999 through January 3, 2000 the y2k-announce list will only be used for significant events. To subscribe to the y2k-announce list send a e-mail to majordomo(a)zocalo.net containing the command "subscribe y2k-announce" (without the quotes) in the body of the message. Lurkers are welcome on the y2k-announce list. Please do not subscribe addresses with automatic responses, for example NOC trouble ticket addresses which automatically respond with a ticket number. The y2k-status list will be the workhorse list. It will contain regular status reports including summaries of other ISP's reports, and information from the Information Coordination Center and International Y2K Coordaintion Centers through the New Year's weekend. Subscribers to the Y2K-status list are expected to contribute by filling out a short template in each message, and mailing it before the next status interval. No one has been subscribed to the y2k-status list automatically. Please subscribe the most appropriate address or alias for your organization. Remember, whomever you subscribe should be prepared to report the status of your organization. The y2k-status list will be moderated, and will only have summary posts according to the schedule below. This should avoid problems with a deluage of chatting overwhelming the list. In order for the list to provide the most value to everyone, everyone on the y2k-status list should contribute. To subscribe to the y2k-status list send a e-mail to majordomo(a)zocalo.net containing the command "subscribe y2k-status" (without the quotes) in the body of the message. Please do not subscribe addresses with automatic responses, for example NOC trouble ticket addresses which automatically respond with a ticket number. Hint: everyone should know the difference between their local time zone and UTC. A copy of the status template is included in this message ====================== CUT HERE ====================================== 1.Y2KVersion: 1 2.Organization: 3.NetworkASN: 4.Location: 5.ContactName: 6.Email: 7.Telephone: 8.ReportDueTime: 2000-01-01 00:00 UTC 9.Status: Normal/Reduced Capacity/Significant Disruption 10.Y2KRelated: No/Yes 11.Remarks: ====================== CUT HERE ====================================== Please complete the contact section (2-6). The ReportDueTime (8) will be set in each message to the due date for this report, 60 minutes before the next schedule status summary. In Status (9) choose one of the three options, and delete the other two. In Y2KRelated (10) indicate if the disruption is due to a Y2K related problem. In Remarks (11) give a brief description of a disruption, any known workaround, and any known restoral times. Please do not delay sending a status report if you do not know or have all the information, mark the item "UNKNOWN". Scheduled Status Reports (cities are informational, local time varies) 1999-12-30 12:30 UTC 1999-12-30 07:30 EST TEST POST 1999-12-31 00:30 UTC 1999-12-30 19:30 EST VERIFICATION POST 1999-12-31 09:30 UTC 1999-12-31 04:30 EST Initial Status Post 1999-12-31 12:30 UTC 1999-12-31 07:30 EST Wellington/Kamchatka 1999-12-31 15:30 UTC 1999-12-31 10:30 EST Tokyo/Adelaide 1999-12-31 18:30 UTC 1999-12-31 13:30 EST Novoisbrisk/Dhaka 1999-12-31 21:30 UTC 1999-12-31 16:30 EST Moscow/Riyadh 2000-01-01 00:30 UTC 1999-12-31 19:30 EST London/Monrovia 2000-01-01 03:30 UTC 1999-12-31 22:30 EST Buenos Aires/Rio de Janeiro 2000-01-01 06:30 UTC 2000-01-01 01:30 EST St. Louis/Mexico City 2000-01-01 09:30 UTC 2000-01-01 04:30 EST Anchorage 2000-01-01 12:30 UTC 2000-01-01 07:30 EST Marshall Islands 2000-01-02 00:30 UTC 2000-01-01 19:30 EST New Year's Summary 2000-01-02 12:30 UTC 2000-01-02 07:30 EST Weekend Summary 2000-01-03 00:30 UTC 2000-01-02 19:30 EST First Business Day 2000-01-03 12:30 UTC 2000-01-03 07:30 EST US Business Day Starts 2000-01-04 00:30 UTC 2000-01-03 19:30 EST CLOSING POST ----- End forwarded message ----- -- Ua lawa küpono ka hakahaka pä o këia pä malule --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0