August 2003 - NZNOG - lists.nznog.org

Blaster.D/Nachi Worm. Infected NZ IPs
by Simon Lyall 28 Aug '03

28 Aug '03

As part of tracing our customers infected with the Blaster D, Nachi worm [1] I've been go through our traffic logs. A side effect of this is that it's really easy for me to get a list of NZ ip's that appear to be infected and that have pinged our customers. If anyone [2] is interested in a copy I'd be happy to send them one. Format will be: <Epoch Time><space><ip> ie: 1062069861 23.81.23.21 1062069939 156.74.132.12 Send me an email if interested. I can probably do last night and some of this morning. 2 hours worth of last night was approx 400 different ips. [1] This one: http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MSBLAS… [2] Network or abuse admins I mean, not other people who may be on the list. -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz Ihug Ltd, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz

2 1

RE: [nznog] Cisco 1000 10BaseT Interface...
by Lindsay Hill 28 Aug '03

28 Aug '03

I have seen some older stuff only support half duplex, so you may not have the duplex full command. Make sure you've got both ends set to the same. I haven't had much luck with autonegotiate, and just tend to lock everything down. -----Original Message----- From: Dan Clark [mailto:dan(a)scarfies.net] Sent: Friday, 29 August 2003 10:33 a.m. To: James Tyson Cc: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] Cisco 1000 10BaseT Interface... Thats a good point, does anyone have something more exciting lying around? We might buy it off you if its resonable. ----- Original Message ----- From: "James Tyson" <james(a)giantrobot.co.nz> To: "jfp" <jfp(a)clearfield.com> Cc: <nznog(a)list.waikato.ac.nz> Sent: Friday, August 29, 2003 10:29 AM Subject: Re: [nznog] Cisco 1000 10BaseT Interface... > >> I wonder if someone could tell me how to either hardset the unit to > >> full duplex or if it doesn't support full duplex operation > > > > Try the "full-duplex" command. > > > > Also try "duplex full", you know how they like to change the commands > around, but most likely it won't do it. > > Geez, a 1000 probably was made before anyone even thought of > full-duplex ethernet :) > > --- > James Tyson > Director, Giant Robot Ltd > http://www.giantrobot.co.nz/ > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog > _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog ----------------------------------------------------------------------------------------------- Have you seen our website?.... http://www.vodafone.co.nz CAUTION: This correspondence is confidential and intended for the named recipient(s) only. If you are not the named recipient and receive this correspondence in error, you must not copy, distribute or take any action in reliance on it and you should delete it from your system and notify the sender immediately. Thank you. Unless otherwise stated, any views or opinions expressed are solely those of the author and do not represent those of Vodafone New Zealand Limited. Vodafone New Zealand Limited 21 Pitt Street, Private Bag 92161, Auckland, 1020, New Zealand Telephone + 64 9 357 5100 Facsimile + 64 9 377 0962

3 2

Cisco 1000 10BaseT Interface...
by Dan Clark 28 Aug '03

28 Aug '03

Hi Guys, I have a Cisco 1000 Border router here for one of our frame-relay connections. I am getting many collisions on the 10MB Ethernet0 interface. The other end is connected to our Pix and that interface is set to autonegotiate as thats the only way I can get it to come up. The only IOS command I can see under the Ethernet0 interface seems to be the bandwidth command much like that of a frame-relay serial interface, so I set that to 10000. Does the interface simply not support full duplex operation? Is an IOS upgrade needed, would this help? I wonder if someone could tell me how to either hardset the unit to full duplex or if it doesn't support full duplex operation Or are there such things as a 10/100 Ethernet Card Interface for what appears to be an expander slot next to the frame serial interface connector on the router. Ref: (C1000-RBOOT-R), Version 10.3(9) - flash:c1005-xy-mz.111-24a.bin Kind Regards, Dan Clark Network Manager Wickliffe Ltd Scarfies.Net Ltd

3 4

Heads up on an email account scam
by Steve Rielly 28 Aug '03

28 Aug '03

Hi All, Just wanted to give people a quick heads up on some spoofed emails that are going around. The email is to appear to come from admin@(company...), actually came from bb220-255-58-109.singnet.com.sg, and asks them to read an attached document (message.zip) else their account will expire. I'm going to see if the zip file is quarantined if anyone wants to look further, and its not exactly new but its been a while since I've seen it, figured you may be wanting to let you users/clients know in case they haven't learnt their lessons about this yet. Cheers, Steve Rielly Security Engineer Extranet Technologies Limited Level 1, 60 Cook St, Auckland, New Zealand P.O. Box 7726, Wellesley Street, Auckland, New Zealand Ph: +64 9 3771122, Mob: 025 835530 Fax: +64 9 3771109

2 1

Cisco Simulations
by William 1.0.S. Seal 27 Aug '03

27 Aug '03

Hello all, I recently viewed a NZNOG members website where he thankd one company for allowing him to configure their routers from the website in training for CCNA. If someone knows who's website this was or where I can do something similiar to this it would be much appreciated. Thanks, William Seal

4 3

postmaster@world-net.co.nz mail is bouncing
by Dan Langille 27 Aug '03

27 Aug '03

Could someone please contact world-net.co.nz and let them know mail to postmaster(a)world-net.co.nz is bouncing. Thanks. [P.S. I would, but I'm in Ottawa, and just heading out to a movie] Thanks -- Dan Langille : http://www.langille.org/

1 0

Re: [nznog] Mark's Netsites site
by Mark Davies 26 Aug '03

26 Aug '03

From: DPF <david(a)farrar.com> Date: Wed, 27 Aug 2003 18:45:18 +1200 > I believe there is an intention to have growth stats published again, > but I'm not aware or involved with any details such as where about. The only thing stopping the growth stats side of my monthly update happening was me getting around to it - done now. mark

1 0

Re: [nznog] Netsites Domain Name Changes page offline?
by Mark Davies 26 Aug '03

26 Aug '03

From: Ewen McNeill <ewen(a)naos.co.nz> Date: Mon, 07 Jul 2003 22:30:05 +1200 > I wasn't aware that they were (still) conducting a review (again), and > Mark's "changes" list seems (at first glance) to be consistent with the > existing zone transfer policies. I got asked on 1 July by Nick Griffin to not publish the changes list until some review I wasn't aware of that is apparently currently happening was completed. > I know that Mark updated those scripts recently ('cause I prompted him > to do so, since some links were out of date including the ones for > whois) Actually it was just the whois links. > >I guess lots of people doing the same thing would be bad, but this page has > >been around for yonks. > > As I understand it, that was the main reason (in an earlier interation > of setting zone transfer restrictions) for allowing Mark's scripts to > keep going -- it was one point where people could look for changes, > rather than everyone doing their own zone transfers. Well the growth stats are the primary reason I'm still doing it. The other pages merely fall out from doing that. cheers mark

4 4

Another Dead RBL
by Matthew G Brown 26 Aug '03

26 Aug '03

As of last night osirusoft & spews are returning almost 100% blacklisted results. Anyone running osirusoft & spews should remove these RBL's from mailers. The WWW sites say that this may be an indefinate problem I have had no email since early AM so if this had been mentioned already im sorry. More info at www.osirusoft.com & www.spews.org . Best regards Matthew G Brown B & R Holdings LIMITED Nelson, New Zealand DDI: + 64 3 544 9116 MOB: 027 4807731 http://www.brh.co.nz http://www.backupserver.co.nz

2 2

Cabletron 6000
by rod_christie＠wilsonandhorton.co.nz 25 Aug '03

25 Aug '03

Hi all, anyone interested in a Cabletron Smart Switch 6000 with spare chassis and power supplies. Total of 96 10Mb and 16 100Mb ports. Suitable for 19" rack approx. 600mm in height. If anyone is interested let me know. Cheers Rod Christie APN Holdings NZ Limited E-Mail: rod_christie(a)apn.co.nz *************************************************************************** This may contain privileged and confidential information intended only for the use of the intended recipient. If you are not the intended recipient of this message, any use, dissemination, distribution or reproduction of this message is prohibited. Any views expressed in this message are those of the individual sender and may not necessarily reflect the views of APN News & Media NZ Ltd. For more information on APN News & Media NZ Ltd please visit our web site at http://www.apn.co.nz ***************************************************************************

2 1