June 2005 - NZNOG - lists.nznog.org

Notification of NZRR Database changes
by NZRR Database Notifications 24 Jun '05

24 Jun '05

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS64609 descr: advertised to AS9439 by WIXanycast - AS64609 members: 202.7.4.0/24^24-29, 202.7.6.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: rpsl-admin(a)nzix.net mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20050228 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS64609 descr: advertised to AS9439 by WIXanycast - AS64609 members: 202.7.6.0/23^23-29, 202.7.4.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: asjl(a)citylink.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20050624 source: NZRR --- PREVIOUS OBJECT: route-set: AS9560:RS-ROUTES:AS23754 descr: advertised to AS9560 by CityLink - AS23754 members: 198.48.0.0/22^22-29, 202.8.44.0/22^22-29, 198.32.71.0/24^24-29, 202.7.5.0/24^24-29, 202.7.6.0/24^24-29, 203.118.144.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc(a)citylink.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20050621 source: NZRR REPLACED BY: route-set: AS9560:RS-ROUTES:AS23754 descr: advertised to AS9560 by CityLink - AS23754 members: 198.48.0.0/22^22-29, 202.8.44.0/22^22-29, 202.7.6.0/23^23-29, 198.32.71.0/24^24-29, 202.7.5.0/24^24-29, 203.118.144.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: asjl(a)citylink.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20050624 source: NZRR

1 0

TelstraClear/ICONZ Fault
by Chris Woodrow 23 Jun '05

23 Jun '05

Apparently TelstraClear made some 'changes' to the primary ICONZ WGTN-AUCK circuit around midnight last night. Since then we have about 55% packet loss, with ICONZ as at 12:05 saying that they have not been given an ETA by TelstraClear. 12 hours of substandard performance with no ETA seems a bit poor to me. If anyone has any updates on this please feel free to let me know. Regards Chris Woodrow BDT

1 0

Re: [nznog] Anyone awake at Ihug NOC/Security?
by Mark Foster 22 Jun '05

22 Jun '05

Glen Wilson wrote: *snip* > I enquired about your email today and was told that you had lodged a fault > regarding smtp relay attempts in which the offending ip was not an Ihug > ip and the issue was dropped. It was also brought to my attention > that in a follow up email from you to the abuse mailbox stated the > following,... > > "If I don't get some sort of acknowledgement of my reports soon I will > start dropping ihug IP ranges at the highest supernet I can see... " Unfortunately you're taking my frustration and desire-to-get-SOME-sort-of-response out of context, and its a shame you did this on NZNOG. I don't make a habit of misreporting complaints, and i'm wary of the fact that as an end user (at least in the capacity I was reporting this particular abuse case in) I don't exactly have any 'clout'. So I was simply reporting a fact - that my frustration level was such that i'd rather add all of ihug to my RBL than deal with the ongoing virus payload that was (apparently) being ignored. I have sent another response offlist but I felt the need to make it clear that I am not a cry-wolf type and am familiar with the concepts of dns lookup and whois. ;-) Good luck to those at ihug with the thankless task of clearing that backlog! Mark.

5 4

RE: [nznog] Anyone awake at Ihug NOC/Security?
by Blair Robson 22 Jun '05

22 Jun '05

It was just a suggestion, that email was a few days old and none of you guys had responded (obviously cos it was sorted) - I was just trying to help. >> All your comments are just rumour and speculation. Yeah, absolutely I don't _know_ anything and I said that. Again just a suggestion. _b -----Original Message----- From: Simon Allard [mailto:simona(a)staff.iinet.net.au] Sent: Wednesday, 22 June 2005 9:23 a.m. To: Blair Robson; nznog(a)list.waikato.ac.nz Subject: RE: [nznog] Anyone awake at Ihug NOC/Security? Blair. Please don't comment on ihug matters which you know nothing about. All your comments are just rumour and speculation. None of the senior type jobs have gone. Yes some have left for other jobs, but they have all been replaced with new staff. abuse(a)iinet.net.au has no visibility into the ihug NZ network, so they will be no help to you. abuse(a)ihug.co.nz is the correct email to use. For the record, Mark was contacted minutes after his email and his problem was sorted. Cheers Simon Allard IHUG Security Monkey > -----Original Message----- > From: Blair Robson [mailto:blair.robson(a)ihug.co.nz] > Sent: Wednesday, 22 June 2005 2:52 a.m. > To: jon.brewer(a)att.net; 'Mark Foster'; nznog(a)list.waikato.ac.nz > Subject: RE: [nznog] Anyone awake at Ihug NOC/Security? > > Seriously - try abuse(a)iinet.net.au , explain that you have tried > contacting > abuse(a)ihug.co.nz (I assume you have?) > I don't know weather that will work or not, but I do know that nearly all > the senior people at Ihug in NZ are gone..And I think you will find Simon > no > longer works for Ihug. > As far as I can gather everything is being run or in the process of being > run from Perth now. > > Blair > > -----Original Message----- > From: jon.brewer(a)att.net [mailto:jon.brewer(a)att.net] > Sent: Tuesday, 21 June 2005 3:25 p.m. > To: Blair Robson; 'Mark Foster'; nznog(a)list.waikato.ac.nz > Subject: RE: [nznog] Anyone awake at Ihug NOC/Security? > > We too need a reply from Ihug security, and have unanswered mail in to > noc(a)ihug.net - address from Simon Lyall's NOC Contact List. Is there a > better address? > > To air some dirty laundry, 203-173-155-220.bliink.ihug.co.nz has generated > 30 GB of http traffic in the past month for one of our customers - > repeatedly downloading one file. (2400 times at last count) Our customer > would rather like it to stop. > > JB > > -------------- Original message from "Blair Robson" > <blair.robson(a)ihug.co.nz>: -------------- > > > > abuse(a)iinet ? > > > > > > > > -----Original Message----- > > From: Mark Foster [mailto:blakjak(a)blakjak.net] > > Sent: Wednesday, 15 June 2005 5:05 p.m. > > To: nznog(a)list.waikato.ac.nz > > Subject: [nznog] Anyone awake at Ihug NOC/Security? > > > > Repeat emails over the last week or two to abuse@ and noc@ havn't had > any > > sort of response or acknowledgement - can someone from Ihug NOC or > > security please contact me offlist. > > > > Thanks > > Mark. > > > > _______________________________________________ > > NZNOG mailing list > > NZNOG(a)list.waikato.ac.nz > > http://list.waikato.ac.nz/mailman/listinfo/nznog > > > > _______________________________________________ > > NZNOG mailing list > > NZNOG(a)list.waikato.ac.nz > > http://list.waikato.ac.nz/mailman/listinfo/nznog > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Re: [nznog] Anyone awake at Ihug NOC/Security?
by Glen Wilson 22 Jun '05

22 Jun '05

Glen Wilson Network Operations Manager Ihug Ltd, Auckland, New Zealand www.ihug.co.nz On Wed, 22 Jun 2005, Glen Wilson wrote: > > Again I clarify that noc(a)ihug and abuse(a)ihug remain the appropriate > channels. The mailbox is currently backlogged by several weeks, for the > benefit of the list if there are any urgent issues please feel free to > raise them with me directly (off list) for adequate responce. > > Your points are valid, but as the abuse autoresponder states, not all > emails warrent a reply. > > I can assure you that the matter was looked into and recommendations > were made to the responsible parties to improve the process. > > Abuse emails are treated seriously, however genuine cases of abuse are > dealt with faster than complaints of portscans, relay attempts and > blackice alarm logs. > > I enquired about your email today and was told that you had lodged a fault > regarding smtp relay attempts in which the offending ip was not an Ihug > ip and the issue was dropped. It was also brought to my attention > that in a follow up email from you to the abuse mailbox stated the > following,... > > "If I don't get some sort of acknowledgement of my reports soon I will > start dropping ihug IP ranges at the highest supernet I can see... " > > I recognise that current response times to abuse emails is somewhat > lacking but may I presume to recommend a more professional approach in > future Mark. > > Further comments should be off list. > > Regards > > Glen Wilson > Network Operations Manager > Ihug Ltd, Auckland, New Zealand > www.ihug.co.nz > > On Wed, 22 Jun 2005, Mark Foster wrote: > > > Glen - > > I dare say that instead of 'habitual abuse emailer' you might call me > > 'someone who's not willing to simply ignore situations for which ISPs > > and end users should actually be responsible'. > > > > And in case you missed what I stated in my original email, I had tried > > both addresses. Repeatedly. Over WEEKS. > > > > Further I suggest that the 'I'm having the same problem too' format of > > responses to my post to NZNOG might imply that maybe you need to examine > > your own internal processes before you decide to get snarky on a public > > mailing list. > > > > If Ihug abuse team actually acknowledged complaints and committed to > > actioning them within a specific timeframe - as many ISPs do - I would > > not have felt the need to post to NZNOG - which was an act of desparation. > > > > I've been responsible for the abuse@ mailboxes for 3 different ISPs in > > the past and funnily enough, each of those ISPs took abuse reports > > seriously. Nomatter how much they might have wanted to killfile reports > > from particularly frequent reporters. :-) > > > > So I hope you have a great day, Glen. :-) > > > > Mark. > > > > PS: In case anyone hasn't registered it, Simon Lyall's NOC Contact List > > at http://www.usenet.net.nz/noc is pretty damn useful. Most of the time. > > :) [And isn't related to Simons past employment with Ihug.] > > > > Glen Wilson wrote: > > > > > noc(a)ihug.co.nz or abuse(a)ihug.co.nz. > > > > > > As a habitual abuse emailer, Mark Foster knows the appropriate channels. > > > > > > > > > Glen Wilson > > > Network Operations Manager > > > Ihug Ltd, Auckland, New Zealand > > > www.ihug.co.nz > > > > > > On Wed, 22 Jun 2005, Blair Robson wrote: > > > > > > > > >>Seriously - try abuse(a)iinet.net.au , explain that you have tried contacting > > >>abuse(a)ihug.co.nz (I assume you have?) > > >>I don't know weather that will work or not, but I do know that nearly all > > >>the senior people at Ihug in NZ are gone..And I think you will find Simon no > > >>longer works for Ihug. > > >>As far as I can gather everything is being run or in the process of being > > >>run from Perth now. > > >> > > >>Blair > > >> > > >>-----Original Message----- > > >>From: jon.brewer(a)att.net [mailto:jon.brewer(a)att.net] > > >>Sent: Tuesday, 21 June 2005 3:25 p.m. > > >>To: Blair Robson; 'Mark Foster'; nznog(a)list.waikato.ac.nz > > >>Subject: RE: [nznog] Anyone awake at Ihug NOC/Security? > > >> > > >>We too need a reply from Ihug security, and have unanswered mail in to > > >>noc(a)ihug.net - address from Simon Lyall's NOC Contact List. Is there a > > >>better address? > > >> > > >>To air some dirty laundry, 203-173-155-220.bliink.ihug.co.nz has generated > > >>30 GB of http traffic in the past month for one of our customers - > > >>repeatedly downloading one file. (2400 times at last count) Our customer > > >>would rather like it to stop. > > >

2 1

RE: [nznog] Anyone awake at Ihug NOC/Security?
by Blair Robson 22 Jun '05

22 Jun '05

Seriously - try abuse(a)iinet.net.au , explain that you have tried contacting abuse(a)ihug.co.nz (I assume you have?) I don't know weather that will work or not, but I do know that nearly all the senior people at Ihug in NZ are gone..And I think you will find Simon no longer works for Ihug. As far as I can gather everything is being run or in the process of being run from Perth now. Blair -----Original Message----- From: jon.brewer(a)att.net [mailto:jon.brewer(a)att.net] Sent: Tuesday, 21 June 2005 3:25 p.m. To: Blair Robson; 'Mark Foster'; nznog(a)list.waikato.ac.nz Subject: RE: [nznog] Anyone awake at Ihug NOC/Security? We too need a reply from Ihug security, and have unanswered mail in to noc(a)ihug.net - address from Simon Lyall's NOC Contact List. Is there a better address? To air some dirty laundry, 203-173-155-220.bliink.ihug.co.nz has generated 30 GB of http traffic in the past month for one of our customers - repeatedly downloading one file. (2400 times at last count) Our customer would rather like it to stop. JB -------------- Original message from "Blair Robson" <blair.robson(a)ihug.co.nz>: -------------- > abuse(a)iinet ? > > > > -----Original Message----- > From: Mark Foster [mailto:blakjak(a)blakjak.net] > Sent: Wednesday, 15 June 2005 5:05 p.m. > To: nznog(a)list.waikato.ac.nz > Subject: [nznog] Anyone awake at Ihug NOC/Security? > > Repeat emails over the last week or two to abuse@ and noc@ havn't had any > sort of response or acknowledgement - can someone from Ihug NOC or > security please contact me offlist. > > Thanks > Mark. > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog

7 6

RE: [nznog] Help with configuring router
by Lesley Walker 22 Jun '05

22 Jun '05

As you were. I found out what my problem was. Sorry for the distraction, I no longer need help. > I need some help with setting up a borrowed Network iQ 1000 series > router. (Also labelled securicor 3net if that helps) Lesley

1 0

PS: RE: [nznog] Help with configuring router
by Lesley Walker 22 Jun '05

22 Jun '05

> Replies off-list, please. Or phone me or Rob on this number: > Phone 64 4 384 4153 Thanks in anticipation. Lesley

1 0

Help with configuring router
by Lesley Walker 22 Jun '05

22 Jun '05

I need some help with setting up a borrowed Network iQ 1000 series router. (Also labelled securicor 3net if that helps) I have got as far as connecting to the serial port, watching it boot up and produce the login prompt, then it doesn't seem to respond to input, and hangs my Hyperterm (sorry!) session. I'm told the config has been set back to factory defaults, but the person who loaned it to me is in the middle of a crisis and can't help me set it up. If anyone could spare a few minutes to point me in the right direction I would be very grateful. I have all the config info I need, I just can't talk to it. (This is a temporary replacement for a very dodgy router that's providing our internet connection, and quite urgent) Replies off-list, please. Lesley Walker Datamine Limited - turning numbers into people 103 Ghuznee Street PO Box 11-452 Wellington, New Zealand Phone 64 4 384 4153 http://www.datamine.co.nz

1 0

Re: Paradise MX , was: [nznog] Anyone awake at Ihug NOC/Security?
by Ewen McNeill 22 Jun '05

22 Jun '05

In message <Pine.LNX.4.56.0506221253110.2350(a)green.darkmere.gen.nz>, Simon Lyall writes: >Does anyone know why pop3.paradise.net.nz doesn't seem to listen on port >25? [1] I wouldn't normally mind but it is listed as the primamry MX for >the domain. > >[1] - Since Monday at least, might be a lot longer. It's been like that for a year.[0] The response I got when I reported it said "We have permanently blocked SMTP requests to pop3.paradise.net.nz.". After some discussion, and me suggesting some more sensible approaches to route their mail,[1] they eventually said: "Despite how our mail system may look to the outside world it is functioning in a manner that we require at this particular stage of development." >From where I sit it still looks fairly clueless to firewall your primary MX off from the world. But I concluded then that I would be best served by excluding the instances of "failed connection to pop3.paradise.net.nz" from my log reports and forgetting about it. If you're able to get hold of someone clueful at Paradise and get them to fix it, I'll be grateful too.[2] Ewen [0] I know this because I found the auto-response to my ticket reporting the problem, and it's dated 21 June 2004. [1] Eg, modern mailers mail forwarding from their preferred MX to pop3.paradise.net.nz when appropriate, split DNs, etc. [2] The wellylug mailing list I host has several @paradise.net.nz addresses subscribed to it, so I get instances of this in my log pretty much daily.

1 0