February 2000 - NZNOG - lists.nznog.org

Open IP Directed Broadcast List... (fwd)
by Alan Brown 24 Feb '00

24 Feb '00

Supplementary to http://www.netscan.org/ and http://www.powertech.no/smurf/ > ---------- Forwarded message ---------- > Date: Wed, 23 Feb 2000 14:48:10 -0500 > From: dies <dies(a)PULLTHEPLUG.COM> > To: BUGTRAQ(a)SECURITYFOCUS.COM > Subject: Open IP Directed Broadcast List... > > Well I guess I reinvented the wheel here. On that note. > > I've compiled a list of open ip directed broadcasts. I've scanned > down into 26 bit subnet's and found some interesting results. Over > 138,000 broken networks where found. A list of these networks is > currently available at http://www.pulltheplug.com. The reason I did this > was because netscan.org is only hitting 24 bit subnets and with the > recent "Internet Rush" for companies, CIDR, etc I felt it was time to look > deeper into the problem. I've been pulled away from this project as of > late (real job calls) and I have yet to walk the networks through > arin/ripe/apnic and obtain contacts. That will be my next step, > ETA - 2/28/00. After that I'd like to jump down to 27 and 28 bit > subnets. I'd be willing to get some help from anyone that is interested. > > Lastly, for the script kiddies out there. Please do not go and > grab this list and annihilate someone. Take the information and maybe > learn something from it, like just was subnetting is and how it works.. > > dies(a)pulltheplug.com --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: NZ MBONE
by Richard Naylor 24 Feb '00

24 Feb '00

At 12:28 PM 2/25/00 +1300, James Tyson wrote: > >David Robb from IHUG and I have been talking about setting up a local >MBONEesque system across APE or WIX, I was just wanting a show of hands as >to who would want it, and how people think it should be implemented. > cool ! at long last. Count me in as interested/keen, etc. I have the stuff running at home, but haven't had time to bring it into work yet. Do you want to stay with MBONE or use the H.323 stuff thats out there. My experience is that the H.323 stuff is faster and gives better results. I was planning to have an H.323 device in next week which will host a conference call, and have auto answer, and have a TV channel on it so that you can see the latency. Only problem is some copyright issues with the content so it might have to be a live camera from the office or a video tape on a loop. rich richard.naylor(a)citylink.co.nz This mail message contains information that is confidential and which may be subject to legal privilege. If you are not the intended recipient, you must not use, distribute or copy this message. If you have received this message in error, please notify the sender immediately and erase this mail. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

[dangerously off-topic] Government to Regulate Routing!
by Joe Abley 23 Feb '00

23 Feb '00

** Quite Possibly of Negligable Operational Interest ** The Herald has an article about the Telecoms review being carried out (or to be carried out, give me a break, it's early): > The inquiry's brief is to examine interconnection issues, the Kiwi Share > obligation -which guarantees free local calling - number portability > and administration, management of internet traffic and the > development of New Zealand as a knowledge economy. "Management of internet traffic" was the phrase that caught my eye. If this review strays into the issues of routing, traffic filtering and peering at the packet layer, then I am scared. Mind you, this is probably the Herald quoting some government press release, so I wouldn't necessarily expect any the terms contained within it to be accurate. Anyway, just thought I'd share this. Please feel free to return to your usual network-wrangling activities. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Back to Non-Subscriber Postings
by Donald Neal 23 Feb '00

23 Feb '00

NZNOG-People, Yes, it seems restricting postings to subscribed addresses does create substantial inconvenience. I have now turned this off again. My thanks to all of the people who reminded me what a poor MUA I'm using. If I had any plans to do anything about this, I wouldn't be able to tell you about them. Donald Neal NZNOG Muggins --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: More on DDOS Attacks
by Donald Neal 23 Feb '00

23 Feb '00

At one stage we tried 12.0(5)T on 5 different boxes, all five failed with different faults ;-) 12.0(7)T1 is apparently the last in the 12.0T stream with 12.1 being its replacement (apparently within a couple of weeks). I think you should go to 12.0(7)T1 if you need T features. Arron Scott -----Original Message----- From: owner-nznog(a)list.waikato.ac.nz [mailto:owner-nznog(a)list.waikato.ac.nz]On Behalf Of Andrew Cutler Sent: Wednesday, February 23, 2000 08:43 To: nznog(a)list.waikato.ac.nz Subject: Re: More on DDOS Attacks I had a customer with a 2610 running 12.0(4) that had constant random "spurious memory access" errors. I advised him to upgrade to upgrade to 12.0(5) but haven't heard back. Cheers, Andrew Donald Neal wrote: Subject: BOUNCE nznog(a)list.waikato.ac.nz: Non-member submission from [David Zanetti <dave2(a)earthling.net>] Date: Tue, 22 Feb 2000 19:43:41 +1300 From: owner-nznog(a)list.waikato.ac.nz To: owner-nznog(a)list.waikato.ac.nz >From d1nc(a)telecom.co.nz Tue Feb 22 19:43:40 2000 Received: from wakko.burlap.net.nz (p267.tnt1.dialup.the.net.nz [203.110.6.13]) by johnwayne.waikato.ac.nz (8.9.1a/8.9.1/Debian/GNU) with ESMTP id TAA14625 for <nznog(a)list.waikato.ac.nz>; Tue, 22 Feb 2000 19:43:33 +1300 Received: from localhost (dave2(a)localhost) by wakko.burlap.net.nz (8.9.3/8.9.3/Debian/GNU) with ESMTP id TAA08222 for <nznog(a)list.waikato.ac.nz>; Tue, 22 Feb 2000 19:43:31 +1300 X-Authentication-Warning: wakko.burlap.net.nz: dave2 owned process doing -bs Date: Tue, 22 Feb 2000 19:43:30 +1300 (NZDT) From: David Zanetti <dave2(a)earthling.net> X-Sender: dave2(a)wakko.burlap.net.nz To: nznog(a)list.waikato.ac.nz Subject: Re: More on DDOS attacks In-Reply-To: <20000222133907.A5270(a)styx.clear.net.nz> Message-ID: <Pine.LNX.4.10.10002221936550.8170-100000(a)wakko.burlap.net.nz> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII On Tue, 22 Feb 2000, Chris Wedgwood wrote: > > I've been meaning to have another try with a newer version of 12 > > (especially as 12 has gone GD) so your experience is only going to > > encourage me, can I ask what version of IOS and on what platform you lab > > setup was using? [clip] > That's not to say it is very stable, the last I tried 12.0.7(S) > was pretty horrible. I have '9 down but not tested yet. Speaking of the stablity of different IOS versions, we have a 3640 with 12.0(4)T on it that needs rebooting after about 7 weeks of uptime. Starts spamming the console port with memory allocation failures, although still manages to route stuff. It's not a particullarly odd setup, just routing between a couple of FE ports, but we are using dynamic packet filtering on it, ala "permit ... reflect outbound". Ring any bells for anyone? Couldn't see anything that jumped out at me in the later release notes, and wasn't keen on an upgrade just to "try it out".. -- David Zanetti <dave2(a)earthling.net> | (__) Mr Moo says: Moderator, nz.politics.announce | ( oo #include <geek/unix.h> | /L_= ... ( Eat more porridge ) --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

None
by None 22 Feb '00

22 Feb '00

[203.97.2.226]) by johnwayne.waikato.ac.nz (8.9.1a/8.9.1/Debian/GNU) with ESMTP id = KAA06207 for <nznog(a)list.waikato.ac.nz>; Wed, 23 Feb 2000 10:44:28 +1300 Received: from [192.168.0.4] (admin4-admd-skyt.qsi.net.nz [202.89.128.132] = (may be forged)) by tardis.patho.gen.nz (8.9.3/8.9.3) with ESMTP id KAA20340; Wed, 23 Feb 2000 10:44:25 +1300 (NZDT) Message-Id: <200002222144.KAA20340(a)tardis.patho.gen.nz> X-Mailer: Microsoft Outlook Express for Macintosh - 4.01 (295)=20 Date: Tue, 22 Feb 2000 14:37:18 +1300 Subject: 12 good reasons to choose webmail.net.nz [WAS: Media announcement on free webmail] From: "Rob Isaac" <rob(a)terabyte.co.nz> To: nznog(a)list.waikato.ac.nz CC: Joe Abley <jabley(a)patho.gen.nz> Mime-version: 1.0 X-Priority: 3 Content-type: text/plain; charset=3D"US-ASCII" Content-transfer-encoding: 7bit >On Tue, Feb 22, 2000 at 01:40:35PM -1100, reply(a)webmail.net.nz wrote: >> Show Off New Zealand announces the launch of its free web-based Email >> service Webmail.net.nz in conjunction with American Email giant = Commtouch. > >These guys win today's prize for the least clue displayed in a public >forum. I have tried to think of a more moronic way for them to advertise >their product, and I have failed. > >Congratulations! Twelve good reasons to choose webmail.net.nz as *your* web email provider = -- a list of twelve publicly known exploits against Microsoft IIS, version = 3.0, currently being run by 'webmail.net.nz': Bugtraq ID: 978 2000-02-09 NT IIS ASP VBScript Runtime Error Viewable Source Vulnerability Bugtraq ID: 968 2000-02-02 NT IIS idq.dll Directory Traversal Vulnerability Bugtraq ID: 592 1999-07-20 Persits AspUpload Buffer Overflow Vulnerability Bugtraq ID: 529 1999-07-19 NT IIS MDAC RDS Vulnerability Bugtraq ID: 591 1999-07-07 NT IIS SSL DoS Vulnerability Bugtraq ID: 477 1999-06-24 NT IIS Double Byte Code Page Vulnerability Bugtraq ID: 501 1999-03-08 NT IIS ISAPI Extension Vulnerability Bugtraq ID: 230 1999-02-11 NT Using ASP And FSO To Read Server Files Vulnerability Bugtraq ID: 194 1999-01-26 NT IIS IISAPI Extension Enumerate Root Web Server Directory Vulnerability Bugtraq ID: 192 1999-01-24 NT IIS FTP DoS / Buffer Overflow Vulnerability Bugtraq ID: 149 1998-07-01 NT IIS ASP Alternate Data Streams Vulnerability Bugtraq ID: 676 1998-06-26 Multiple Vendor PKCS#1 Vulnerability They're currently vulnerable to 978, 968, 591, 477, 501, 230, 194, 192 and = 149. I can't confirm the others, mainly because their server seems to = lack the needed third party software that makes the exploit possible. Be sure to recommend them to all your friends, just because of their = innovative marketing strategies. By 'your friends', I mean bored fifteen = year olds with ADSL, cable modems or wheel on lots of well connected = machines. *cough* We now return you to your normal, spam-free programming. Regards, Rob. =20 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

12 good reasons to choose webmail.net.nz [WAS: Media announcement]
by Donald Neal 22 Feb '00

22 Feb '00

1 0

Re: More on DDOS Attacks
by Donald Neal 22 Feb '00

22 Feb '00

2 1

[bb@nsimail.com: Regarding Webmail]
by Joe Abley 22 Feb '00

22 Feb '00

In case anybody is still in any doubt as to the sensitivity of these webmail.net.nz people to the issue of spam, see attached message. Apparently it is ok for webmail.net.nz to send commercial, unsolicited mail because it is "useful information", as opposed to other unsolicited, commercial e-mail which is apparently not. Ho hum. File under "moron spam haven" and take appropriate precautions. Joe ----- Forwarded message from bb(a)nsimail.com ----- From: bb(a)nsimail.com Date: 21 Feb 2000 20:50:40 -0800 X-Sent: 22 Feb 2000 04:50:40 GMT To: jabley(a)patho.gen.nz X-Mailer: Web Mail 3.5.1.4 Subject: Regarding Webmail Hi Joe, We have had great feedback and alot of people have joined our service from the general public. We have been offering this state of the art free service to anyone who wishes to use it, and have been astounded by some harsh responses from people who themselves work in the industry. We have offered leading edge technology in NEW ZEALAND for new zealanders and cannot understand some of the hostile responses we have had, almost all from IT proffesionals, when we have had such a great response from the general public. Because of the pressure put on us by a few in the industry we will not be emailing anybody else but feel that the issue of spamming is such a grey area that useful information is being put in the same circle as email suggesting you buy a ticket to africa at your local travel branch in Vancouver. I am sorry if i have caused undue stress by emailing you, but it was only our intention to inform nz'ers of this superior technology that is free for them to operate as they please. Kindest Regards Billy. ------------------------------------------------- Get personalized e-mail and a web address or your own free e-mail at http://www.networksolutions.com. ----- End forwarded message ----- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

None
by None 22 Feb '00

22 Feb '00

13]) by johnwayne.waikato.ac.nz (8.9.1a/8.9.1/Debian/GNU) with ESMTP id = TAA14625 for <nznog(a)list.waikato.ac.nz>; Tue, 22 Feb 2000 19:43:33 +1300 Received: from localhost (dave2(a)localhost) by wakko.burlap.net.nz (8.9.3/8.9.3/Debian/GNU) with ESMTP id TAA08222 for <nznog(a)list.waikato.ac.nz>; Tue, 22 Feb 2000 19:43:31 +1300 X-Authentication-Warning: wakko.burlap.net.nz: dave2 owned process doing = -bs Date: Tue, 22 Feb 2000 19:43:30 +1300 (NZDT) From: David Zanetti <dave2(a)earthling.net> X-Sender: dave2(a)wakko.burlap.net.nz To: nznog(a)list.waikato.ac.nz Subject: Re: More on DDOS attacks In-Reply-To: <20000222133907.A5270(a)styx.clear.net.nz> Message-ID: <Pine.LNX.4.10.10002221936550.8170-100000(a)wakko.burlap.net.nz> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=3DUS-ASCII On Tue, 22 Feb 2000, Chris Wedgwood wrote: > > I've been meaning to have another try with a newer version of 12 > > (especially as 12 has gone GD) so your experience is only going to > > encourage me, can I ask what version of IOS and on what platform you = lab > > setup was using?=20 [clip]=20 > That's not to say it is very stable, the last I tried 12.0.7(S) > was pretty horrible. I have '9 down but not tested yet. Speaking of the stablity of different IOS versions, we have a 3640 with 12.0(4)T on it that needs rebooting after about 7 weeks of uptime. Starts spamming the console port with memory allocation failures, although still manages to route stuff. It's not a particullarly odd setup, just routing between a couple of FE ports, but we are using dynamic packet filtering on it, ala "permit ... reflect outbound".=20 Ring any bells for anyone? Couldn't see anything that jumped out at me in the later release notes, and wasn't keen on an upgrade just to "try it out"..=20 --=20 David Zanetti <dave2(a)earthling.net> | (__) Mr Moo says: Moderator, nz.politics.announce | ( oo #include <geek/unix.h> | /L_=3D ... ( Eat more porridge ) =20 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0