January 2007 - NZNOG - lists.nznog.org

DNS problems yesterday?
by Patrick Mchale 18 Jan '07

18 Jan '07

Hey There, I was wondering if anyone noticed an odd external DNS problem happening yesterday, the National Library's main website was affected for several hours. We could resolve internally but nothing from outside would get resolved. Nothing was changed on our DNS servers. Vodafone seemed to be affected also. Default Server: planet.natlib.govt.nz Address: 192.122.171.130 > server 210.55.131.76 Default Server: jupiter.natlib.govt.nz Address: 210.55.131.76 > www Server: jupiter.natlib.govt.nz Address: 210.55.131.76 Name: slbweb.natlib.govt.nz Address: 210.55.131.96 Aliases: www.natlib.govt.nz > server defiant.netgate.net.nz Default Server: defiant.netgate.net.nz Address: 202.37.245.17 > www.natlib.govt.nz Server: defiant.netgate.net.nz Address: 202.37.245.17 Name: slbweb.natlib.govt.nz Address: 210.55.131.96 Aliases: www.natlib.govt.nz > server reliant.net.nz *** Can't find address for server reliant.net.nz: Non-existent host/domain > server reliant.netgate.net.nz Default Server: reliant.netgate.net.nz Address: 202.37.245.20 > www.natlib.govt.nz Server: reliant.netgate.net.nz Address: 202.37.245.20 Name: slbweb.natlib.govt.nz Address: 210.55.131.96 Aliases: www.natlib.govt.nz > server 203.96.152.4 Default Server: rachel.paradise.net.nz Address: 203.96.152.4 > www.natlib.govt.nz Server: rachel.paradise.net.nz Address: 203.96.152.4 *** rachel.paradise.net.nz can't find www.natlib.govt.nz: Non-existent host/domain > server 202.73.198.15 Default Server: isdn1ldv.vodafone.co.nz Address: 202.73.198.15 > www.natlib.govt.nz Server: isdn1ldv.vodafone.co.nz Address: 202.73.198.15 *** isdn1ldv.vodafone.co.nz can't find www.natlib.govt.nz: Non-existent host/domain Cheers Patrick McHale National Library of New Zealand.

8 11

Re: [nznog] DNS problems yesterday?
by Patrick Mchale 18 Jan '07

18 Jan '07

Thanks for the responses, We kinda thought there was a bit of fiddling going on but at to who and finding a definitive answer, this problem may be a total mystery forever. We are though inquiring into one particular DNS provider to check if anything went astray yesterday. The report was very interesting and a very useful website for finding out about a particular sites DNS issues and security. I need to read up more on the info it presented and sort out some changes. Cheers Patrick McHale >>> "Patrick Mchale" <Patrick.Mchale(a)natlib.govt.nz> 19/01/2007 9:26 a.m. >>> Hey There, I was wondering if anyone noticed an odd external DNS problem happening yesterday, the National Library's main website was affected for several hours. We could resolve internally but nothing from outside would get resolved. Nothing was changed on our DNS servers. Vodafone seemed to be affected also. Default Server: planet.natlib.govt.nz Address: 192.122.171.130 > server 210.55.131.76 Default Server: jupiter.natlib.govt.nz Address: 210.55.131.76 > www Server: jupiter.natlib.govt.nz Address: 210.55.131.76 Name: slbweb.natlib.govt.nz Address: 210.55.131.96 Aliases: www.natlib.govt.nz > server defiant.netgate.net.nz Default Server: defiant.netgate.net.nz Address: 202.37.245.17 > www.natlib.govt.nz Server: defiant.netgate.net.nz Address: 202.37.245.17 Name: slbweb.natlib.govt.nz Address: 210.55.131.96 Aliases: www.natlib.govt.nz > server reliant.net.nz *** Can't find address for server reliant.net.nz: Non-existent host/domain > server reliant.netgate.net.nz Default Server: reliant.netgate.net.nz Address: 202.37.245.20 > www.natlib.govt.nz Server: reliant.netgate.net.nz Address: 202.37.245.20 Name: slbweb.natlib.govt.nz Address: 210.55.131.96 Aliases: www.natlib.govt.nz > server 203.96.152.4 Default Server: rachel.paradise.net.nz Address: 203.96.152.4 > www.natlib.govt.nz Server: rachel.paradise.net.nz Address: 203.96.152.4 *** rachel.paradise.net.nz can't find www.natlib.govt.nz: Non-existent host/domain > server 202.73.198.15 Default Server: isdn1ldv.vodafone.co.nz Address: 202.73.198.15 > www.natlib.govt.nz Server: isdn1ldv.vodafone.co.nz Address: 202.73.198.15 *** isdn1ldv.vodafone.co.nz can't find www.natlib.govt.nz: Non-existent host/domain Cheers Patrick McHale National Library of New Zealand. _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Malware used to spam pump and dump scams
by matthew＠auscert.org.au 17 Jan '07

17 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Greetings all, As above - anyone aware of what particular bit of malware is being used to spam pump and dump scams? Also seeing similar usage for mule recruitment. Subjects may have the stock symbol CBFE for the stock P&D or "Managers opened - GAPFG Co" for the mule recruitment. Any feedback appreciated. Thanks for your time, - -- Matthew McGlashan -- Coordination Centre Team Leader | Hotline: +61 7 3365 4417 Australian Computer Emergency Response Team | Direct: +61 7 3365 7924 (AusCERT) | Fax: +61 7 3365 7031 The University of Queensland | WWW: www.auscert.org.au Qld 4072 Australia | Email: auscert(a)auscert.org.au -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (FreeBSD) Comment: http://www.auscert.org.au/render.html?it=1967 Comment: http://www.auscert.org.au/render.html?it=1967 iQCVAwUBRa7T0Ch9+71yA2DNAQLKHAP/U0x1SudRh4BRtg+mxxkry6YifNUPFD+J 6sYjwErVf1N4N+Y6WN5zmU9JuXO+HqrMf79JiZ9eff3fC/2xd7jK1wJWr1GzNO5w jw8jZmO0QAC/2UzrEQuC9q4eDbogk/mHCLzSpg2qyzY6+cdN6IFGcnmgnkL0ycUk eTRO+t+6PQE= =AijR -----END PGP SIGNATURE-----

1 0

IGMP testing - thanks
by Ian Batterbee 16 Jan '07

16 Jan '07

Thanks all for the suggestions. That C source code, (the setting of theIP_ADD_MEMBERSHIP socket option in particular), led me to this rather useful document: http://tldp.org/HOWTO/Multicast-HOWTO-7.html ...which describes how it is the kernel's task to send IGMP out for sockets set as above, and not the application's problem, which explains why there aren't many apps around that send IGMP. And using 'tcpdump -n igmp', on the client end, I can see that it's doing what it should be doing :) Thanks.

1 0

Re: [nznog] IGMP test tools
by chris＠chrishellberg.com 16 Jan '07

16 Jan '07

Hi Ian, What about using a media application like vlc (videolan) and joining a multicast group? I think you might be able to run it in command line mode, if you don't have an X server listening. This'll trigger your IGMP membership reports and respond to group queries. /Chris ----- Original Message ---- From: Ian Batterbee <ian.batterbee(a)aut.ac.nz> To: nznog(a)list.waikato.ac.nz Sent: Tuesday, January 16, 2007 10:45:30 PM Subject: [nznog] IGMP test tools Hi all, I'm looking for some linux test tools that I can run that will send IGMP join commands and that will respond to IGMP queries (to keep the group alive), that I can use to prove or disprove a sparse mode pim configuration. There's such a blatent lack of matches for anything like this on google that I wonder if I'm overlooking some basic utility that is already included with most distros or is built into the kernel, but I can't come up with anything on that front either. Using a Cisco router or switch as a multicast group member is a possibility, but I'd rather use linux hosts if I can do so. _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

2 1

IGMP test tools
by Ian Batterbee 16 Jan '07

16 Jan '07

Hi all, I'm looking for some linux test tools that I can run that will send IGMP join commands and that will respond to IGMP queries (to keep the group alive), that I can use to prove or disprove a sparse mode pim configuration. There's such a blatent lack of matches for anything like this on google that I wonder if I'm overlooking some basic utility that is already included with most distros or is built into the kernel, but I can't come up with anything on that front either. Using a Cisco router or switch as a multicast group member is a possibility, but I'd rather use linux hosts if I can do so.

3 2

Notification of NZRR Database changes
by NZRR Database Notifications 15 Jan '07

15 Jan '07

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS9733 descr: Route set advertised to AS9439 by Netspace Services Limited - AS9733 members: 203.118.134.64/26^26-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: operations(a)netspace.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20061219 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS9733 descr: advertised to AS9439 by Netspace Services Limited - AS9733 members: 210.4.208.0/21^21-29, 203.118.134.64/26^26-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: operations(a)netspace.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070116 source: NZRR

1 0

Hello all & a word on SPEWS DNS blackhole
by Michael Fincham 15 Jan '07

15 Jan '07

Hi everyone... Just wondering if anyone knows how prevalent checking against the (supposedly now defunct) SPEWS SPAM DNS blackhole list remains among NZ operators? Reason I ask is that our netblock seems to be inadvertently (and/or incorrectly) listed as an Aussie porn spam sender, and with the general unpleasantness involved in dealing with SPEWS combined with the apparent departure of their admins, I don't see any real resolution to this other than waiting for people to stop using SPEWS on their mail servers... Currently it looks like iServe's mail server is still using SPEWS as are the mail servers used by ISP amuri.net. These are the only two I have encountered so far since moving our mail server to its new home (202.6.116.105) -- --Michael Fincham Unleash Technology Solutions

3 2

Re: [nznog] Hello all & a word on SPEWS DNS blackhole
by Michael Fincham 15 Jan '07

15 Jan '07

> We do not use SPEWS though if you would kindly provide onlist a list > > of your > netblock addresses, myself and I'm sure others will check them against the > BL's we use and if neccessary whitelist accordingly. Hooray. Nothing like a post like that to restore my faith in humanity :^) We've got: 202.6.116.0/23 and for a short time longer, 210.55.104.0/26 - although that is technically assigned to Maxnet, not directly to us, and we are phasing out mailing from addresses in that range. Here's hoping I didn't break the threading with this post - I need to turn off digest mode :) -- --Michael Fincham Unleash Technology Solutions

2 1

Bus/Train to NZNOG
by Joel van Velden 14 Jan '07

14 Jan '07

Hi all The idea was floated at last weeks Curry in Auckland about hiring a bus to travel to NZNOG, as there would possibly be quite a number of people between Auckland and Palmerston North interested in a less stressful and cheaper means of getting there. I have no idea of what numbers would be required at this stage or what the cost would be. Obviously it would be cheaper than flying, but take longer to get there. The other alternative might be to group-book the train, which has tables, not sure about AC power, you can walk around, is apparently newly-refurbished, but probably takes a little longer than a bus, and possibly more expensive. Is anyone is interested? Contacting me off-list would be best. Regards, Joel van Velden

4 3