- NZNOG - lists.nznog.org

Re: [nznog] Vote Verisign CEO down
by Michael Hallager 17 Sep '03

17 Sep '03

You have to vote first. Then after some time, (Server must be slow), you get a popup window with the results. > Where do you go to see the current figure? > > On Wednesday, September 17, 2003, at 03:30 PM, Michael Hallager wrote: > > Done. He is at 95% disapproval rating now. > > > >> http://www.forbes.com/2003/05/01/cx_ceointernetpoll.html > >> > >> Let's give him a 1% approval rating for September. > > > > Michael Hallager > > Managing Director > > Networkstuff Limited > > > > URL: http://www.networkstuff.co.nz > > Networkstuff, NZ's leading supplier of high quality used networking > > equipment. > > E-Mail: michael @ networkstuff.co.nz > > > > Member of the NZ Open Source Society. > > Member of the Auckland VHF Group. > > Amateur radio callsign: ZL1VMH. > > > > _______________________________________________ > > NZNOG mailing list > > NZNOG(a)list.waikato.ac.nz > > http://list.waikato.ac.nz/mailman/listinfo/nznog -- Michael Hallager Managing Director Networkstuff Limited URL: http://www.networkstuff.co.nz Networkstuff, NZ's leading supplier of high quality used networking equipment. E-Mail: michael @ networkstuff.co.nz Member of the NZ Open Source Society. Member of the Auckland VHF Group. Amateur radio callsign: ZL1VMH.

1 0

Re: [nznog] Email for domains hosted by 2day.com
by Ewen McNeill 16 Sep '03

16 Sep '03

In message <Pine.WNT.4.55.0309172044160.696(a)den3>, Juha Saarinen writes: >On Wed, 17 Sep 2003, Keith Davidson wrote: >> If someone of a technical nature wanted to draft up something more >> useful than a moan at ICANN / Verisign, I'd be happy to mobilise >> InternetNZ to take the issue further. > >Most of the techie stuff should be conveniently there in Google/Froups. I think the point was that someone technical write it up in a single document which InternetNZ can then put forward -- that has the best chance of ensuring nothing gets overlooked and no one gets the wrong end of the stick through not being experienced with all the hands-on details. And if nothing else it's probably useful to have a single document to wave at people saying "these are all the bad things you've caused by doing this". Ewen

4 4

Re: [nznog] *.net and Exim 4
by James Tyson 16 Sep '03

16 Sep '03

>> Hey folks. >> >> Anyone who's using Exim 4 might want to take a look at this: >> >> http://www.giantrobot.co.nz/~jnt/stardotnet.html > > Oi. > > I haven't used dnsdb before (seems very useful) -- can you explain a > bit > how the condition works? An explanation of dnsdb can be found at http://www.exim.org/exim-html-4.20/doc/html/spec_9.html#SECT9.9 The condition quite simply uses the lookup expansion via dnsdb to look up the a record for $sender_address_domain (ie the domain name of the sender address). If there is a successful lookup it returns the value of the lookup (ie the resolved address) or simply an empty string if the lookup failed (this stops exim throwing an error). It then compares the result with the string "64.94.110.11". If they match it returns true, and thus the ACL declines the message, otherwise false. Note that I am not actually using this condition myself because I wrote a condition using SQL to check against a whole bunch of addresses instead, but I figured some people here would be less fortunate :) Good luck! --- James Tyson Director, Giant Robot Ltd http://www.giantrobot.co.nz/

2 1

Re: [nznog] shamelessly off topic
by Gavin Legge [Invincible Technologies Limited] 16 Sep '03

16 Sep '03

ha ha - great - quick off the mark. can crank the bit rate a bit i'm thinking - as long as the boss doesn't get to unhappy. Mike Cooper [Actrix Support] wrote: > On it ;-) > > Had just been bitching about the crappy range of shoutcast servers > available about 10 mins ago :-) > > Regards, > > Mike > ________________________________________________________ > Mike Cooper - Actrix Support > > m.cooper(a)actrix.co.nz <mailto:m.cooper(a)actrix.co.nz> > > Phone: 0800 228-749 > > Fax: (04) 801 5335 > > www.actrix.co.nz <http://www.actrix.co.nz> > > ----- Original Message ----- > From: Gavin Legge [Invincible Technologies Limited] > <mailto:glegge(a)InvincibleTechnologies.co.nz> > To: nznog(a)list.waikato.ac.nz <mailto:nznog(a)list.waikato.ac.nz> > Sent: Wednesday, September 17, 2003 7:11 PM > Subject: [nznog] shamelessly off topic > > For all of us poor New Zealand sysadmin's needing NZ music to 'keep the > internet running by' try http://gavweb.dts.net.nz:8000 > > Ok, it's only a baby server (only 5 at a time please - don't fight!) > but > it's just proof of concept for now. (part of gavland.co.nz) > > plenty of interesting NZ music for all. > > regards > Gavin > > I know - looks like a shameless plug but really just trying to point > some traffic at the poor old 100mhz 586. see if it breaks. I truly > hope not. > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz <mailto:NZNOG(a)list.waikato.ac.nz> > http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

*.net and Exim 4
by James Tyson 16 Sep '03

16 Sep '03

Hey folks. Anyone who's using Exim 4 might want to take a look at this: http://www.giantrobot.co.nz/~jnt/stardotnet.html --- James Tyson Director, Giant Robot Ltd http://www.giantrobot.co.nz/

1 0

RE: [nznog] Email for domains hosted by 2day.com
by Stephen Andrew 16 Sep '03

16 Sep '03

Keith Davidson wrote: > Juha wrote: >> 2-daaayyoh, 2-day-ay-ay-oh. Internet sucks and me wanna go home. >> >> Anyway, things seem to be working again. >> >> So who's going to roast point the Giant Flamethrower at Marina Del >> Rey? Perhaps this is a job for Captain InternetNZ? > > I guess it could be a job for InternetNZ. But it occurs to me that > Veri$ign are doing nothing "wrong", it's just not within the spirit > of Internet practices? [snip] Maybe not "wrong" exactly but... RFC 1912 (Informational) Wildcard As and CNAMEs are possible too, and are really confusing to users, and a potential nightmare if used without thinking first. It could result (due again to domain searching) in any telnet/ftp attempts from within the domain to unknown hosts to be directed to one address. One such wildcard CNAME (in *.edu.com) caused Internet-wide loss of services and potential security nightmares due to unexpected interactions with domain searching. It resulted in swift fixes, and even an RFC ([RFC 1535]) documenting the problem. RFC 1535 makes interesting reading. -- Andrew Stephen DDI: +64 4 460 6849 IT Security Architect Mobile: +64 25 582 304 New Zealand Post Fax: +64 4 494 4299 "...shouldn't a DMZ actually be called a Free Fire Zone?" -- Chris Mahn, Three Tiered DMZ's, May 2001 This email with any attachments is confidential and may be subject to legal privilege. If it is not intended for you please reply immediately, destroy it and do not copy, disclose or use it in any way.

1 0

Re: [nznog] Email for domains hosted by 2day.com
by Ewen McNeill 16 Sep '03

16 Sep '03

In message <20030917002145.71549.qmail(a)web13607.mail.yahoo.com>, Stephen Sheehan writes: >Does anybody have a workaround. for .nz MX records ewen(a)basilica:~ $ host -t MX eaudio.co.nz eaudio.co.nz mail is handled by 10 mail.2day.com. ewen(a)basilica:~ $ host mail.2day.com mail.2day.com has address 64.94.110.11 The message you're seeing from 64.94.110.11 -- Verisign's wonderful "all domains are ours" IP address -- is that it won't accept mail for the domain eaudio.co.nz. No great surprise. It won't accept mail for anything else either. In fact, it's got a very fixed pattern of responses to absolutely anything at all you send it. I suspect the MX record is cached, and the A record for mail.2day.com isn't cached/available any longer. If it weren't for Verisign adding their brokenness to the .com/.net DNS yesterday, then you'd at least get a NXDOMAIN error on mail.2day.com and it'd be more obvious what was wrong. If you want a work around I suggest something like the bind forward entry that has already been posted on nznog, at some point where it's visible to your mail server. 2day.com might be able to achieve some improvements by changing all the MX records on the domains for which they handle DNS and Mail to something not under 2day.com and/or by doing a bulk update on the NZ Register for the names that they host the DNS to nameservers not under 2day.com (but that'd need to be done carefully, and would have to wait for zone push/cache expiry anyway). Ewen

1 0

Verisign grabs *.net and *.com
by Simon Lyall 16 Sep '03

16 Sep '03

FYI verisign have just adjusted the gTLD name servers to return point to their one IP for any .net (and soon .com) domain that doesn't exist. eg: $ host kjjhgkjhskhg.net kjjhgkjhskhg.net has address 64.94.110.11 $ host uyowiriu777777.net uyowiriu777777.net has address 64.94.110.11 This may break stuff (ie if you refuse email from bogus domains). See: http://www.verisign.com/resources/gd/sitefinder/implementation.pdf http://www.verisign.com/resources/gd/sitefinder/bestpractices.pdf http://www.cbronline.com/latestnews/d04afc52ae9da2ee80256d9c0018be8b -- Simon J. Lyall. | Very Busy | Mail: simon(a)darkmere.gen.nz "To stay awake all night adds a day to your life" - Stilgar | eMT.

7 8

2day.com assistance required
by Joe Abley 16 Sep '03

16 Sep '03

Forwarded for Rob, since he's subscribed to nznog using his 2day.com address (see below). Mail to 2day.com addresses is currently being bounced by the host listed in the wildcard A record in the COM zone, so if your customers call and complain that they can't send mail to foo(a)2day.com, this is probably why. Begin forwarded message: > From: Rob Isaac <rob(a)automagic.org> > Date: Tue Sep 16, 2003 17:10:32 Canada/Eastern > To: jabley(a)automagic.org > Subject: 2day.com assistance required > > > A registrar inadvertently put the 2day.com zone on REGISTRAR HOLD, with > the unpleasant result of removing it from the root zone. > > This makes hosts in the zone 2day.com unresolvable. The registrar in > question has been appropriately disciplined, but it will be some time > until the root zone is updated. > > In the meantime, it would be helpful if you could add a stub to your > name servers, so that requests for things in the 2day.com zone are > still > resolved appropriately until the root servers catch up. This should > reduce your customer support load relating to services hosted by > 2day.com. > > Sample stub for BIND8, mangle as appropriate. > > --- snip --- > zone "2day.com" { > type stub; > file "2day.com"; > masters { 202.37.240.3; 198.32.66.4; 203.118.144.212; } > }; > --- snip --- > > > <R>< > >

4 5

[Fwd: Re: [spamtools] Verisign hijack *.net]
by Juha Saarinen 15 Sep '03

15 Sep '03

I didn't even know there was a .museum... -------- Original Message -------- Subject: Re: [spamtools] Verisign hijack *.net Date: Tue, 16 Sep 2003 03:31:30 -0600 (MDT) From: Bruce Gingery <antispam(a)gtcs.com> Reply-To: spamtools(a)lists.abuse.net To: SpamTools <spamtools(a)lists.abuse.net> This is a widespread problem. Vix has been doing this, mostly unnoticed, with dot-museum for months (perhaps since .museum startup). Checking, a few minutes ago... *.ac A 194.205.62.122 *.cc A 206.253.214.102 *.com A 64.94.110.11 *.cx A 219.88.106.80 *.museum A 195.7.77.20 *.net A 64.94.110.11 *.nu A 64.55.105.9 and A 212.181.91.6 *.sh A 194.205.62.62 *.tm A 194.205.62.62 *.ws A 216.35.187.246 Other domains checked (I don't THINK I missed any active ones, but could have missed a recently-activated ccTLD) do NOT have this bogus behaviour. RCFDNS + FCRDNS is now a NECESSITY - for client of an smtp connection for HELO/EHLO parameter for domain of sender hacks and patches welcome. Remember, sendmail 8.11.x does NOT have the "dns" map, and 8.12.x recently had bad code in that same map. There is only so much you can do with: $[ $] K<name> host K<name> bestmx etc. For those stuck with 8.11 or below binaries, and no ready- to-use MILTER on their OS, this may require a regexp to sanitize, followed by an external program map. Meanwhile, any FCRDNS, and RCFDNS provisions are helpful, especially if you bogus the PNAP nameservers doing VeriSign's rdns for 64.94.110.11 and comparable DNS servers for other bogus domain resolutions.

2 2

Verisign "cure" from comp.sendmail
by Juha Saarinen 15 Sep '03

15 Sep '03

LOCAL_CONFIG Kverisign dns -R A -a. -T<TMP> -r 5 SLocal_check_mail R$* $: $>canonify $1 R$*<@$*.> $: $1<@$2> Strip the trailing . if present R$*<@$+> $: $(verisign $2 $) R$+<TMP> $#error $@ 4.7.1 $: "451 Temporary lookup failure: try again later" R64.94.110.$* $#error $: "550 Real domain name required for sender address"

1 0

RE: [nznog] Verisign grabs *.net and *.com
by Paul Adshead 15 Sep '03

15 Sep '03

> > Just to get click-through money! > > On the other hand, ISPs can now add their own redirect rule for > 64.94.110.11 to point to *their own* advertising page (or "VeriSign > Suck" page). I hope some do, if only to piss VeriSign off. Indeed, how many Corporate firewalls _already_ redirect: "ads.<domain name>.co.nz"; "ads.<domain name>.com" etc, etc to an internal webserver (- with error 404 set to give a blank page), in order to cutdown on all of the adverts appearing on the corporate LAN??? Paul Adshead.

1 0

Linux Router
by Tikiri Wicks 15 Sep '03

15 Sep '03

Does anyone know anything about this product http://www.imagestream.com/Enterprise.html Cheers Tikiri

2 1

Reminder - "Handle the Jandal" webcast tonight
by Richard Naylor 15 Sep '03

15 Sep '03

Doubt if it will break anything, but just a reminder that the "Handle the Jandal" webcast is tonight. Might get a few viewers. Starts at 7:00pm - Online voting will take place as well. Webcast details at http://www.r2.co.nz/20030916/ and http://www.radioactive.co.nz rich

1 0

RE: [nznog] Big Geek Programme '04
by Donald Neal 11 Sep '03

11 Sep '03

> From: Lin Nah [mailto:lin(a)darkmere.gen.nz] > Sent: Thursday, 11 September 2003 17:17 > To: Tony McGregor > Cc: Donald Neal; Simon Lyall; nznog(a)list.waikato.ac.nz > Subject: RE: [nznog] Big Geek Programme '04 [...] > Actually I came across the concept of "Open Space" when reading a > blog entry by Bruce Eckel. http://mindview.net/WebLog/log-0004 says > "One of the new features here at the conference is "Open > Space" which I > was initially skeptical about but which seems to be working > astoundingly > well. The room where the keynote talks are being held has boards where > you can post a topic for a time slot. The original idea was a talk at > the front of the room and one at the back, but it seems that > tables have > been taken over for individual discussions and as a result there are > already more discussions than two at any one time. There needs to be a formal programme for a number of reasons. One is that we do hope to cover some topics in the sort of detail which isn't compatible with short presentations. Another is so that attendees have something to show their managers. :{)* Other things can certainly be done as well. There used to be these things called BOF's ... Donald Neal | "And if you think virus Technical Specialist | writers are scary, you Operations Engineering | have clearly never met a Integration & Services Divn. | tort lawyer." Alcatel NZ Ltd | - The Economist 28/8/03 All opinions mine only. | ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ------------------------------------------------------------------------------

1 0

Geek program 2004
by Michael Hallager 10 Sep '03

10 Sep '03

Hi, Could the person organising this please email me offlist? Kind regards, Michael Hallager Managing Director Networkstuff Limited URL: http://www.networkstuff.co.nz Networkstuff, NZ's leading supplier of high quality used networking equipment. E-Mail: michael @ networkstuff.co.nz Member of the NZ Open Source Society. Member of the Auckland VHF Group. Amateur radio callsign: ZL1VMH.

1 0

RE: [nznog] Big Geek Programme '04
by Jamie Baddeley 10 Sep '03

10 Sep '03

hmm. so basically you're recommending we should all just go to the pub and have a bit of a yarn. Mmm. It's got my vote. <ducks> But seriously, does the concept of planning the unplanned really work? The value of hallway conversations is surely not physicality of it but the spontaneity of it. They just sorta happen. <Thinking out loud now> - maybe it's also the passion of an issue that causes individuals to have a real conversation with someone who may be a stranger that makes it so appealing and rewarding. I figure leave 50% of the conference to hallway/pub/accidental learning and 50% of the conference to presented/structured learning. So basically the way it is, is good for me. Cool thoughts though Lin. jamie >>> Lin Nah <lin(a)darkmere.gen.nz> 11/9/2003 5:17:22 PM >>> On Thu, 11 Sep 2003, Tony McGregor wrote: > > There's nothing magical about an hour. Volunteers to do other things > > are welcomed. > > I personally think an hour is way too long for a standard talk. Most > conferences seem to go for 25min + 5m questions and change over. Well it is probably better to split the day into 35 min slots (or 30 min slots but that means 20min + 5min questions + 5 min changeover). If someone wants more time they take up 2 slots or 3 slots . > I really like the idea of a session of rapid fire short talks. Some > conferences have an "outrageous opinions" session structured like > that. We could have a session of 5-10 min anything goes talks. Give > an idea, an experience, a spoof, anything you want the audience to > hear. The only rules being sit down after 10 min and wear the flak > for anything you say yourself. Actually I came across the concept of "Open Space" when reading a blog entry by Bruce Eckel. http://mindview.net/WebLog/log-0004 says "One of the new features here at the conference is "Open Space" which I was initially skeptical about but which seems to be working astoundingly well. The room where the keynote talks are being held has boards where you can post a topic for a time slot. The original idea was a talk at the front of the room and one at the back, but it seems that tables have been taken over for individual discussions and as a result there are already more discussions than two at any one time. The goal was to foster the "hallway conversation" events that are often the best experiences that people have at a conference, by providing nuclei of interests for such conversations through focused topics. I'm particularly interested to see how the open space continues to develop, as it may be one of the most interesting variations in this conference. It already makes the conference more interesting and interactive than the ones we have had in the past. " I had a look into the concept and found it isn't that unknown. The following links have more info about it: http://www.co-intelligence.org/P-Openspace.html http://www.wikipedia.org/wiki/Open_space_conference I am not suggesting using "Open space" throughout the entire meet. However I wonder if such a concept could be tried at one or two sessions to see how it goes. Based on the many corridor/bar/outdoors mini conversations I have seen/heard or been part of at uniforum in the past conferences, I think this would work. regards lin _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

RE: [nznog] Big Geek Programme '04
by Donald Neal 10 Sep '03

10 Sep '03

From: Simon Lyall [mailto:simon(a)darkmere.gen.nz] Sent: Wed 9/10/2003 11:45 PM To: nznog(a)list.waikato.ac.nz Cc: Subject: Re: [nznog] Big Geek Programme '04 >Donald Neal wrote: >> At some stage a formal(ish) call for presentations should be issued. >> Before that, could people who are likely to attend please tell me what >> sort of topics they'd be interested in? Volunteers to present are, of >> course, welcome. [...] >I've seen a few technical type conferences where they have 5 or 10 minute >talks on short topics. This might be a good thing for people to stand up >and give a quick talk on "p2p kazaa proxy servers " or "Trends in errors >in Herald IT articles" or something. So if you know something that other >people might be interested in but you don't want to talk for a whole hour >then you could do one of those. There's nothing magical about an hour. Volunteers to do other things are welcomed. >How about someone from Telecom giving a bit of a talk on IPnet, how it's >designed, how ADSL and dialup gets from the customer to the ISP etc? Most >of us have to interact with it but I've only picked up the odd bit here >and there rather than a nice outline (including how each dept (NCC, >Netgate, CRC etc) fits in) . [2] That may be possible. :{)* - Donald Neal _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ------------------------------------------------------------------------------

4 4

Port 0 Probe
by Ray Chow 10 Sep '03

10 Sep '03

Hi All, I was wondering how useful is port 0 beside some Unix program requires it and OS finger printing. What effect it will create if the port is blocked? Regards Ray Chow ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ------------------------------------------------------------------------------

3 2

Fw: New Vulnerability in Microsoft Systems (RPC II)
by Barry Murphy 10 Sep '03

10 Sep '03

----- Original Message ----- Subject: New Vulnerability in Microsoft Systems (RPC II) > Dear Barry Murphy, > > Vulnerability in Microsoft Windows Servers > ------------------------------------------ > > Severity of Bug : CRITICAL > Port / Service : Microsoft RPC > > Versions Affected : > > * Microsoft Windows NT Workstation 4.0 > * Microsoft Windows NT Server 4.0 > * Microsoft Windows NT Server 4.0, Terminal Server Edition > * Microsoft Windows 2000 > * Microsoft Windows XP > * Microsoft Windows Server 2003 > > 3 new bugs have been found in the Microsoft implementation of RPC. Although these bugs are also related to DCOM activation, they _are_not_ the same issue addressed in July. > > Exploits for this (these) problems already exist in the wild, as both Denial of Service and remote compromise. This problem could possibly be more serious than the previous (http://www.microsoft.com/security/security_bulletins/ms03-026.asp) one, since Microsoft have _not_ ruled out exploitation of RPC via HTTP. (Simply filtering access to ports 135, 139, 445 & 593 will not ensure safety from exploitation) > > Microsoft has an end-user write up of the problem here : > http://www.microsoft.com/security/security_bulletins/ms03-039.asp > > Patches may be downloaded here : > > Windows 2000 : > http://www.microsoft.com/downloads/details.aspx?FamilyId=F4F66D56-E7CE-44C3- 8B94-817EA8485DD1&displaylang=en > > Windows XP : > http://www.microsoft.com/downloads/details.aspx?FamilyId=5FA055AE-A1BA-4D4A- B424-95D32CFC8CBA&displaylang=en > > Windows 2003 > http://www.microsoft.com/downloads/details.aspx?FamilyId=51184D09-4F7E-4F7B- 87A4-C208E9BA4787&displaylang=en > > SensePost suggest that the patch be applied as soon as possible. > > Sincerely. > > ======================================================= > SensePost Research research(a)sensepost.com > http://www.sensepost.com (tel) +27 12 667 4737 > ======================================================= > > >

2 1

TelstraClear PPPoE
by Philip D'Ath 10 Sep '03

10 Sep '03

I've been told that TelstraClear have commenced using PPPoE over their ADSL now, instead of PPPoA. I produce a series of sample configs for Cisco routers for DSL, which can be found at: http://www.ifm.net.nz/cookbooks/ I would like to get a sample Cisco config for a Cisco 837 from TelstraClear (or any Cisco DSL router), and add it to my WWW pages. Could someone from TelstraClear contact me offlist with this info please. Philip D'Ath CCNP, CCDA, BCMS http://www.ifm.net.nz/

1 0

Re: [nznog] Big Geek Programme '04
by Simon Lyall 10 Sep '03

10 Sep '03

Donald Neal wrote: > At some stage a formal(ish) call for presentations should be issued. > Before that, could people who are likely to attend please tell me what > sort of topics they'd be interested in? Volunteers to present are, of > course, welcome. I'd like to see a few practical type presentations from people, things like "How we use Oracle and BitKeeper to maintain our router configs" sort of things. A couple of people I talked to at Uniforum had some cools ways of installing and maintaining their servers for example[1] . I've seen a few technical type conferences where they have 5 or 10 minute talks on short topics. This might be a good thing for people to stand up and give a quick talk on "p2p kazaa proxy servers " or "Trends in errors in Herald IT articles" or something. So if you know something that other people might be interested in but you don't want to talk for a whole hour then you could do one of those. Maybe something about IPV6 or Multicast telling people why they should deploy it on their networks from a revenue perspective :) How about someone from Telecom giving a bit of a talk on IPnet, how it's designed, how ADSL and dialup gets from the customer to the ISP etc? Most of us have to interact with it but I've only picked up the odd bit here and there rather than a nice outline (including how each dept (NCC, Netgate, CRC etc) fits in) . [2] VOIP seems to be getting a bit more mature now so maybe a talk or two in that area. [1] One thing I noticed from Uniforum was that a lot of people run "Debian everywhere except for the Oracle Servers" , Interesting trend to see since Debian doesn't get much press. [2] Someone will probably give the URL for the uptodate document that does this now. -- Simon J. Lyall. | Very Busy | Mail: simon(a)darkmere.gen.nz "To stay awake all night adds a day to your life" - Stilgar | eMT.

2 1

OT: www.telecon.co.nz
by Dan Clark 09 Sep '03

09 Sep '03

Just out of interest, has anyone else come across this site? www.telecon.co.nz I am not sure weather they are all for Telecom's Monopoly approach or if they are against. Quite an interesting read really. Kind Regards, Dan Clark Network Manager Scarfies.Net Ltd Wickliffe Ltd

2 1

RE: [nznog] OT: www.telecon.co.nz
by Paul Adshead 09 Sep '03

09 Sep '03

I believe in April next year (or sometime close to then,) you will be able to get your landline from Telstra-Clear in Auckland. I wonder what the prices will be like?? It's all good for customer choice and competition! :-) Regards, Paul Adshead Network & Systems OTL Software Ltd www.otl.co.nz -----Original Message----- From: Dan Clark [mailto:dan(a)scarfies.net] Sent: Wednesday, 10 September 2003 12:57 To: nznog(a)list.waikato.ac.nz Subject: [nznog] OT: www.telecon.co.nz Just out of interest, has anyone else come across this site? www.telecon.co.nz I am not sure weather they are all for Telecom's Monopoly approach or if they are against. Quite an interesting read really. Kind Regards, Dan Clark Network Manager Scarfies.Net Ltd Wickliffe Ltd

2 1

mta.xtra.co.nz
by Simon Garner 09 Sep '03

09 Sep '03

Hi, Anybody from Xtra have an ETA for when mta.xtra.co.nz will be working again? I have a whole pile of mail queued up for you :) % telnet mta.xtra.co.nz smtp Trying 203.96.92.132... Connected to mta.xtra.co.nz. Escape character is '^]'. (then nothing - no 220 - and it takes a minute or so to get connected.) Hotmail also seems to be broken this morning: % telnet mx1.hotmail.com smtp Trying 65.54.254.129... telnet: connect to address 65.54.254.129: Connection refused Trying 65.54.252.99... telnet: connect to address 65.54.252.99: Connection refused Trying 65.54.166.99... telnet: connect to address 65.54.166.99: Connection refused % telnet mx2.hotmail.com smtp Trying 65.54.252.230... telnet: connect to address 65.54.252.230: Connection refused Trying 65.54.166.230... telnet: connect to address 65.54.166.230: Connection refused Trying 65.54.254.145... telnet: connect to address 65.54.254.145: Connection refused % telnet mx3.hotmail.com smtp Trying 65.54.167.5... telnet: connect to address 65.54.167.5: Connection refused Trying 65.54.254.140... telnet: connect to address 65.54.254.140: Connection refused Trying 65.54.253.99... Connected to mx3.hotmail.com. Escape character is '^]'. Connection closed by foreign host. % telnet mx4.hotmail.com smtp Trying 65.54.254.151... telnet: connect to address 65.54.254.151: Connection refused Trying 65.54.253.230... telnet: connect to address 65.54.253.230: Connection refused Trying 65.54.167.230... Connected to mx4.hotmail.com. Escape character is '^]'. Connection closed by foreign host. -Simon

2 2

Router Info
by Tikiri Wicks 09 Sep '03

09 Sep '03

Be gratefull if anyone can give me a pointer here... I need a router with 14 fibre ports. The thing is I don't want to spend 25,000 Plus on a router like a Cisco 4000 series or a top of the line Nortel. We don't need terrabits of routing capability and hundreds of wan ports etc.. What I'm looking for is a router than can do full layer 4 routing on 14 fibres, each running at no more than 100 Mbps. Any ideas ? Cheers Tikiri

5 6

.nz Zone File review
by Steven Heath 08 Sep '03

08 Sep '03

Folks, The DNC has just released the minutes of the NZOC (.nz oversight committee) meeting which has the following: Item 6 updates progress on the Zone Transfer Policy review. A call for public comment has now been made to seek feedback on the issues the review is covering. The Call for Public Comment can be found at http://dnc.org.nz/content/zone_transfer_policy_review.pdf and the review page (where submissions will be published) is available at http://dnc.org.nz/story/30134-35-1.html Steven Heath .nz news & views www.nznews.org.nz

1 0

HEADS UP - Handle the Jandal
by Richard Naylor 07 Sep '03

07 Sep '03

Sorry for another post. There may be traffic issues next Tuesday 16 Sept in the evening. We will be streaming "Handle the Jandal" on behalf of RadioActive. This is the NZ Music Video Awards. The finalist videos will be streamed and then there will be on-line voting (as well as in the theatre). In theatre band, lotsa noise, etc. I have no idea as to how popular this will be, but at least you now know its happening. Details at www.radioactive.co.nz and www.r2.co.nz (when I get around to writing them). As usual there will be 5 bit rates streamed and available on WIX. rich

1 0

HEADS UP - LOTR Premiere
by Richard Naylor 07 Sep '03

07 Sep '03

Hello All, This is a very preliminary Heads Up on the network impact of the LOTR Premiere to be held in 2 months time. I'm detailing what is planned so that operators can make arrangements for bandwidth, peering, route exchanging, or other descriptions for making it easy for their customers to view the content. Offers of bandwidth, money, food or sleep are also very welcome. (Its monday and I'm tired and grumpy and may just tell everyone to bugger off) The current plan, is that we will have a few more webcams around the Courtenay Place area. These seem very popular, especially with Canadians for some reason. Viewers like to watch the street preparations and clean up take place. There will also be a large streaming programme in place, which MAY begin up to 7 days before the event and carry on up to 3 days afterwards. They may be 24 hour continuous streams. All streams at this stage will be at 5 bit rates (2 audio and 3 video). Both the webcam server and streaming server have gigE connections to WIX and are peered with as many as we can. Last year we were carrying around 140mbps and all servers were at around 10% capacity. We expect a little more interest this year. Our international capacity is very limited both by carrier and by budget. We are currently negotiating feeds to offshore streamers to reduce the potential international impact. Ours will certainly stop. Any offers of International capacity would be gladly accepted. At the moment we can't even guarantee that we will be able to feed off shore streamers. Confirmed Dates At this stage the following dates can be confirmed. Sun 30 Nov - theonering dance party. Andy will be playing. Don't know times yet. Mon 1 Dec - the premiere - set up, red carpet stuff, clean up. All day and most of the night stream. Event will be BIG. Last year the Avalon crew was used. This year I suspect we'll all have to pool camera feeds. The area to be covered is huge. (thats a big hint) What do I want ? Sleep, food, money. If you feel that your customers will be watching the event, please check your connectivity to WIX. If you have a streamer (MS) and want to carry a feed, I'll make a server available purely for replication servers, but this is very much demand driven. remember the budget is very easy to understand - zero. Please contact me if you have any questions. Cheers - rich

1 0

Big Geek Programme '04
by Donald Neal 04 Sep '03

04 Sep '03

NZNOG People, Two days ago I outlined a possible lower-cost gathering to be held on The University of Waikato's "main campus in Hamilton on 29 and 30 January 2004. Indicative registration cost would be $100, with on-campus accommodation available at an indicative cost of $45 per night. The dates are dictated by availability of that low-cost accommodation. It is possible that the running time might be extended beyond two days, depending on the number of presentations to be included. The university is able to offer auditoriums of suitable size for pretty well any plausible number of registrations and for sessions of varying sizes." In the forty-eight hours since then I've been advised of forty-eight people who expect to attend. Of the thirteen people who expressed a preference, twelve opted for the lower-cost option. I think you can pencil into your calendars that this event will go ahead on those dates. At some stage a formal(ish) call for presentations should be issued. Before that, could people who are likely to attend please tell me what sort of topics they'd be interested in? Volunteers to present are, of course, welcome. Donald Neal | "And if you think virus Technical Specialist | writers are scary, you Operations Engineering | have clearly never met a Integration & Services Divn. | tort lawyer." Alcatel NZ Ltd | - The Economist 28/9/03 All opinions mine only. | ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ------------------------------------------------------------------------------

3 2

Big Geek Plan '04 - Update
by Donald Neal 04 Sep '03

04 Sep '03

NZNOG People, I yesterday outlined a possible lower-cost gathering to be held on The University of Waikato's "main campus in Hamilton on 29 and 30 January 2004. Indicative registration cost would be $100, with on-campus accommodation available at an indicative cost of $45 per night. The dates are dictated by availability of that low-cost accommodation. It is possible that the running time might be extended beyond two days, depending on the number of presentations to be included. The university is able to offer auditoriums of suitable size for pretty well any plausible number of registrations and for sessions of varying sizes. I'd be interested to hear from people who are likely to attend, and _if you are likely to attend one or the other_ whether you would prefer the same format as this year and last." In the first twenty-four hours I've received responses covering 25 likely attendees. Of those expressing a preference, a huge proportion (all right, four votes to one) have opted for the lower-cost option. Is there anyone else likely to turn up, or wishing to express a preference? Donald Neal | "And if you think virus Technical Specialist | writers are scary, you Operations Engineering | have clearly never met a Integration & Services Divn. | tort lawyer." Alcatel NZ Ltd | - The Economist 28/9/03 All opinions mine only. | ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ------------------------------------------------------------------------------

3 2

Sys Admin Contractor Needed
by lists＠bagel.gen.nz 04 Sep '03

04 Sep '03

Hopefully this is on topic. If anyone on this list is/knows of a suitable person, please get in touch, preferably to dg-cv(a)techsavvy.co.nz. I am looking to contract someone to build a redundant network. I want to use mainly Linux boxen and possibly CISCO's. I need someone who can speak BGP and understands QoS. Also, person needs to be based in Auckland. I envisage 2 stages - building and documenting the network, and contracting to maintain it. Thanks, David.

1 0

Transfering DNS from other ISP's and other services - opinions needed.
by Gavin Legge [Invincible Technologies Limited] 02 Sep '03

02 Sep '03

Good afternoon all. I have recently 'acquired' (transferred) a domain from one isp to one i work for. From this transfer, a few problems arose - which where quite possibly (probably) due to my ignorance but i wanted to ask the list's advice/opinion. when i transferred the domain/zone, the other ISP canceled the email accounts also. My question is i guess - is this normal, what is normal, is this a general practice with ISP's as if it is maybe I could implement that process here. Thanks for any advice/answers.

6 6

Hi
by tayfun＠milliyet.com.tr 02 Sep '03

02 Sep '03

Hi, I am a member of this group for 2 months and I am reading e-mails with interest. Sometimes off topic e-mails are being sent to this group, so I am sending one. sorry about inconvenience. During the 4 months period that I have been to NZ, I have tried to get a job. It is possible because of not having NZ experience, I couldn't find yet. Here is the assembly point for IT engineers. to ask for advice and to ask for possible opportunities I would like to write a short brief about me and If any of you has position at your company I would love hear from you. I am WAN engineer with telecommunication and LAN management experience on Windows platform. I have CCNA certification and I have passed the routing exam of CCNP. I have mostly worked with Cisco routers, Alcatel/Newbridge/DXX high-speed modems and nodes, several types of ADSL/SDSL/ISDN modems etc. This is just a brief information about me but I can send my CV to anybody who interested in. My priority is starting with 1 step and begin to have NZ experience. I am open to trial offers or It will be easy to negotiate on everything else. I am permanent resident in NZ and I can legally work within NZ. In addition, I currently live in Mission Bay/Auckland. Thanks for your concern again sorry about inconvenience Regards Tayfun Tuna

1 0

Big Geek Plan '04
by Donald Neal 02 Sep '03

02 Sep '03

NZNOG People, This year and last we have been part of UniForum New Zealand's annual conferences. Each year a great deal of useful, interesting and even entertaining material has been presented to around fifty NZNOG subscribers who have turned up. And each year there have been expressions of concern at the cost of registration for this conference. With that in mind, The University of Waikato's WAND group have offered to host a much lower-cost gathering next year. Current thinking would see this held on the university's main campus in Hamilton on 29 and 30 January 2004. Indicative registration cost would be $100, with on-campus accommodation available at an indicative cost of $45 per night. The dates are dictated by availability of that low-cost accommodation. It is possible that the running time might be extended beyond two days, depending on the number of presentations to be included. The university is able to offer auditoriums of suitable size for pretty well any plausible number of registrations and for sessions of varying sizes. I'd be interested to hear from people who are likely to attend, and _if you are likely to attend one or the other_ whether you would prefer the same format as this year and last. If you wish to raise subjects for discussion, by all means reply to the list. If you just wish to state a preference, please instead reply to me directly. - Donald Neal Explanatory Note NZNOG doesn't have subscriptions, paid staff and so on. That means that to have a face to face meeting with formal presentations, coffee and so on we need to have someone else do a fair amount of the work. This can be done either by working with an organisation who are already running a conference - and UniForum NZ are the best fit going for that option - or by having an NZNOG conference hosted by someone. This is our first attempt at taking the latter course. We simply don't know whether large numbers more people will really turn up if we run a much lower-cost event. I don't personally believe that the five hundred plus subscriptions to this list are going to turn into hundreds of attendees at anything. We also don't know how large an obstacle to attendance moving outside Auckland will be. It may even be an advantage. This proposal is an exercise in trying it and seeing what happens. Whether this is the format we adopt for 2004 or not, I believe a decision about the format of the next gathering should be made in the light of the response to this one. Donald Neal | "And if you think virus Technical Specialist | writers are scary, you Operations Engineering | have clearly never met a Integration & Services Divn. | tort lawyer." Alcatel NZ Ltd | - The Economist 28/9/03 All opinions mine only. | ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ------------------------------------------------------------------------------

1 0

Re: [nznog] Xtra mail.
by Simon Byrnand 31 Aug '03

31 Aug '03

At 16:53 1/09/2003 +1200, Simon Lyall wrote: >Just a quick email cause I can't be bothered getting permission from my >boss to post from work. > >Anyway look like our friend Xtra might be having problems with email. I'm >seeing queues building up and manual connects are just timing out. Same here...about 4:30 I noticed messages sent to Xtra were being accepted by mta.xtra.co.nz but not arriving in users pop accounts... (at least not within a reasonable amount of time) and just in the last 5 minutes connections are being refused as well... Regards, Simon Byrnand iGRIN Internet

1 0

Xtra mail.
by Simon Lyall 31 Aug '03

31 Aug '03

Just a quick email cause I can't be bothered getting permission from my boss to post from work. Anyway look like our friend Xtra might be having problems with email. I'm seeing queues building up and manual connects are just timing out. -- Simon J. Lyall. | Very Busy | Mail: simon(a)darkmere.gen.nz "To stay awake all night adds a day to your life" - Stilgar | eMT.

1 0

RE: [nznog] DomainNamesNZ
by Tim John 31 Aug '03

31 Aug '03

This has been taken up by the DNC - check out her website for the latest info. I'm not sure whether they are using an old version of the .nz zone file (although these haven't been available for at least 18 months), or they have some scripting engine pulling the information of the general WhoIs. This breaches the DNC policy on use of private information for commercial gain, yada, yada ... Tim -----Original Message----- From: Matthew G Brown [mailto:Matt(a)Brh.Co.Nz] Sent: Thursday, 7 August 2003 2:10 p.m. To: nznog(a)list.waikato.ac.nz Subject: [nznog] DomainNamesNZ I've been getting a few good old snail mail letters from Domainnamesnz.com offering me to register domain names. Eg: I own learnbydestroying.co.nz and the "offer" is for learnbydestroying.net . How ever since these letters include; Reference #, MPID ? , Closing Date, Credit card details, and very little info to conclude that this is a Renewal many people have inadvertently paid the money ( $237 for two years ! ) thinking it's a Domainz or other registrar invoice. I'm not questioning the legality of this , as I am no expert, how ever im interested to know how so many of my clients and myself ended up with these letters? Anyone else experienced these letters or perhaps had clients pay for what they thought was a valid renewal? Best Regards Matthew G Brown Managing Director B & R Holdings LIMITED Nelson, New Zealand Ph: 027 4807731 Http://www.brh.co.nz _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog DISCLAIMER: The content of this email is confidential and may contain legally privileged information intended only for the individual or entity named above. Access to this message by anyone else is unauthorised. If you are not the intended recipient, please be advised that the use, distribution and publication of the above information is prohibited. If you have received this email in error, please contact Domainz by returning the email and destroying the original. Thank you.

3 2

(fwd) Anti-spam Workshop
by DPF 30 Aug '03

30 Aug '03

For the information of any 'nznoger' who would like to attend the anti-spam workshop detailed below. DPF >On Thursday 4 September 2003 in Wellington, there will be an >Anti-spam Workshop co hosted by InternetNZ and the DMA with >the support of TelstraClear. > >It is an opportunity for those in the NZ Internet industry >to discuss solutions to the problem of spam. > >Spam is now high on everyone's hit list, but there, >agreement seems to end. > >Suggestions for addressing the increasing deluge of unwanted >material range from "too bad; its the internet" through >"technology will save the >day" to "public stoning is not enough for spammers". > >InternetNZ, in association with the Direct Marketing >Association of New Zealand and with the support of >TelstraClear, is bringing together experts and interested >individuals from within the New >Zealand Internet industry in an effort to craft a >multidisciplinary approach to solving this problem. > >Included in the those presenting to the workshop are: >- Enrique Salem, CEO of Brightmail, one of the worlds >leading suppliers of anti-spam solutions >- David Harris, InternetNZ Councillor and author of a >comprehensive review of spam and approaches to its control (paper at http://tinyurl.com/kkd8) >- Representative of the DMA >- Officials from the Ministry of Economic Development and >other NZ government agencies > >Spaces are limited. Those interested in attending are >requested to register their interest with the InternetNZ >office. RSVP to office(a)internetnz.net.nz by 5:00pm Wednesday >3 September 2003. > >There is no charge to participate in the workshop. > >Date: Thursday 4 September 2003 >Time: 1.00 pm - 5.00pm followed by refreshments >Venue: TelstraClear Conference Centre, Te Papa, Wellington -- Blog: http://www.kiwiblog.co.nz E-mail: david(a)farrar.com ICQ: 29964527 MSN: dpf666(a)hotmail.com

2 2

Anyone else had this similar problem
by Timothy Law 29 Aug '03

29 Aug '03

I have recently moved house and good old telecom has connected our phone line to the empty flat behind us instead of ours what is worse is even though this is clearly their fault, refused to fix it until tomorrow morning (when 123 staff are on duty) Real pain in the ass Anyone share similar hassles with telecom? Anyone know the appropriate channels to complain? Timothy Law Network Engineer Satlan Corp Phone: +64 21 728 526 Fax: +64 7 854 0907 ICQ: 12695380 Email: tim(a)satlan.com Snail Mail: PO Box 21048, Hamilton, New Zealand

2 2

spamarrest.com is offline
by Aaron Nielsen 29 Aug '03

29 Aug '03

It is seems spamarrest.com is offline. Had a customer who uses it ring as they can't check their mail - invalid username and password. spamarrest.com site says it will back online in a few minutes, but it has been offline since about 7:30 this morning. I wonder if they are under DDoS attacks or if it is a spin off from osirusoft.com and spews.org being closed down... Aaron

4 3

Blaster.D/Nachi Worm. Infected NZ IPs
by Simon Lyall 28 Aug '03

28 Aug '03

As part of tracing our customers infected with the Blaster D, Nachi worm [1] I've been go through our traffic logs. A side effect of this is that it's really easy for me to get a list of NZ ip's that appear to be infected and that have pinged our customers. If anyone [2] is interested in a copy I'd be happy to send them one. Format will be: <Epoch Time><space><ip> ie: 1062069861 23.81.23.21 1062069939 156.74.132.12 Send me an email if interested. I can probably do last night and some of this morning. 2 hours worth of last night was approx 400 different ips. [1] This one: http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MSBLAS… [2] Network or abuse admins I mean, not other people who may be on the list. -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz Ihug Ltd, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz

2 1

RE: [nznog] Cisco 1000 10BaseT Interface...
by Lindsay Hill 28 Aug '03

28 Aug '03

I have seen some older stuff only support half duplex, so you may not have the duplex full command. Make sure you've got both ends set to the same. I haven't had much luck with autonegotiate, and just tend to lock everything down. -----Original Message----- From: Dan Clark [mailto:dan(a)scarfies.net] Sent: Friday, 29 August 2003 10:33 a.m. To: James Tyson Cc: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] Cisco 1000 10BaseT Interface... Thats a good point, does anyone have something more exciting lying around? We might buy it off you if its resonable. ----- Original Message ----- From: "James Tyson" <james(a)giantrobot.co.nz> To: "jfp" <jfp(a)clearfield.com> Cc: <nznog(a)list.waikato.ac.nz> Sent: Friday, August 29, 2003 10:29 AM Subject: Re: [nznog] Cisco 1000 10BaseT Interface... > >> I wonder if someone could tell me how to either hardset the unit to > >> full duplex or if it doesn't support full duplex operation > > > > Try the "full-duplex" command. > > > > Also try "duplex full", you know how they like to change the commands > around, but most likely it won't do it. > > Geez, a 1000 probably was made before anyone even thought of > full-duplex ethernet :) > > --- > James Tyson > Director, Giant Robot Ltd > http://www.giantrobot.co.nz/ > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog > _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog ----------------------------------------------------------------------------------------------- Have you seen our website?.... http://www.vodafone.co.nz CAUTION: This correspondence is confidential and intended for the named recipient(s) only. If you are not the named recipient and receive this correspondence in error, you must not copy, distribute or take any action in reliance on it and you should delete it from your system and notify the sender immediately. Thank you. Unless otherwise stated, any views or opinions expressed are solely those of the author and do not represent those of Vodafone New Zealand Limited. Vodafone New Zealand Limited 21 Pitt Street, Private Bag 92161, Auckland, 1020, New Zealand Telephone + 64 9 357 5100 Facsimile + 64 9 377 0962

3 2

Cisco 1000 10BaseT Interface...
by Dan Clark 28 Aug '03

28 Aug '03

Hi Guys, I have a Cisco 1000 Border router here for one of our frame-relay connections. I am getting many collisions on the 10MB Ethernet0 interface. The other end is connected to our Pix and that interface is set to autonegotiate as thats the only way I can get it to come up. The only IOS command I can see under the Ethernet0 interface seems to be the bandwidth command much like that of a frame-relay serial interface, so I set that to 10000. Does the interface simply not support full duplex operation? Is an IOS upgrade needed, would this help? I wonder if someone could tell me how to either hardset the unit to full duplex or if it doesn't support full duplex operation Or are there such things as a 10/100 Ethernet Card Interface for what appears to be an expander slot next to the frame serial interface connector on the router. Ref: (C1000-RBOOT-R), Version 10.3(9) - flash:c1005-xy-mz.111-24a.bin Kind Regards, Dan Clark Network Manager Wickliffe Ltd Scarfies.Net Ltd

3 4

Heads up on an email account scam
by Steve Rielly 28 Aug '03

28 Aug '03

Hi All, Just wanted to give people a quick heads up on some spoofed emails that are going around. The email is to appear to come from admin@(company...), actually came from bb220-255-58-109.singnet.com.sg, and asks them to read an attached document (message.zip) else their account will expire. I'm going to see if the zip file is quarantined if anyone wants to look further, and its not exactly new but its been a while since I've seen it, figured you may be wanting to let you users/clients know in case they haven't learnt their lessons about this yet. Cheers, Steve Rielly Security Engineer Extranet Technologies Limited Level 1, 60 Cook St, Auckland, New Zealand P.O. Box 7726, Wellesley Street, Auckland, New Zealand Ph: +64 9 3771122, Mob: 025 835530 Fax: +64 9 3771109

2 1

Cisco Simulations
by William 1.0.S. Seal 27 Aug '03

27 Aug '03

Hello all, I recently viewed a NZNOG members website where he thankd one company for allowing him to configure their routers from the website in training for CCNA. If someone knows who's website this was or where I can do something similiar to this it would be much appreciated. Thanks, William Seal

4 3

postmaster@world-net.co.nz mail is bouncing
by Dan Langille 27 Aug '03

27 Aug '03

Could someone please contact world-net.co.nz and let them know mail to postmaster(a)world-net.co.nz is bouncing. Thanks. [P.S. I would, but I'm in Ottawa, and just heading out to a movie] Thanks -- Dan Langille : http://www.langille.org/

1 0

Re: [nznog] Mark's Netsites site
by Mark Davies 26 Aug '03

26 Aug '03

From: DPF <david(a)farrar.com> Date: Wed, 27 Aug 2003 18:45:18 +1200 > I believe there is an intention to have growth stats published again, > but I'm not aware or involved with any details such as where about. The only thing stopping the growth stats side of my monthly update happening was me getting around to it - done now. mark

1 0

Re: [nznog] Netsites Domain Name Changes page offline?
by Mark Davies 26 Aug '03

26 Aug '03

From: Ewen McNeill <ewen(a)naos.co.nz> Date: Mon, 07 Jul 2003 22:30:05 +1200 > I wasn't aware that they were (still) conducting a review (again), and > Mark's "changes" list seems (at first glance) to be consistent with the > existing zone transfer policies. I got asked on 1 July by Nick Griffin to not publish the changes list until some review I wasn't aware of that is apparently currently happening was completed. > I know that Mark updated those scripts recently ('cause I prompted him > to do so, since some links were out of date including the ones for > whois) Actually it was just the whois links. > >I guess lots of people doing the same thing would be bad, but this page has > >been around for yonks. > > As I understand it, that was the main reason (in an earlier interation > of setting zone transfer restrictions) for allowing Mark's scripts to > keep going -- it was one point where people could look for changes, > rather than everyone doing their own zone transfers. Well the growth stats are the primary reason I'm still doing it. The other pages merely fall out from doing that. cheers mark

4 4

Another Dead RBL
by Matthew G Brown 26 Aug '03

26 Aug '03

As of last night osirusoft & spews are returning almost 100% blacklisted results. Anyone running osirusoft & spews should remove these RBL's from mailers. The WWW sites say that this may be an indefinate problem I have had no email since early AM so if this had been mentioned already im sorry. More info at www.osirusoft.com & www.spews.org . Best regards Matthew G Brown B & R Holdings LIMITED Nelson, New Zealand DDI: + 64 3 544 9116 MOB: 027 4807731 http://www.brh.co.nz http://www.backupserver.co.nz

2 2

Cabletron 6000
by rod_christie＠wilsonandhorton.co.nz 25 Aug '03

25 Aug '03

Hi all, anyone interested in a Cabletron Smart Switch 6000 with spare chassis and power supplies. Total of 96 10Mb and 16 100Mb ports. Suitable for 19" rack approx. 600mm in height. If anyone is interested let me know. Cheers Rod Christie APN Holdings NZ Limited E-Mail: rod_christie(a)apn.co.nz *************************************************************************** This may contain privileged and confidential information intended only for the use of the intended recipient. If you are not the intended recipient of this message, any use, dissemination, distribution or reproduction of this message is prohibited. Any views expressed in this message are those of the individual sender and may not necessarily reflect the views of APN News & Media NZ Ltd. For more information on APN News & Media NZ Ltd please visit our web site at http://www.apn.co.nz ***************************************************************************

2 1

Cisco 2500 PSU.
by Michael Hallager 25 Aug '03

25 Aug '03

Hello all. Andy has been mentioned in my last post. His name was in there soley because he was quoted in the email from Jon as being the referer, acting in good faith, nothing more. Andy has nothing to do with this problem, and he has been good in all of the email correspondence that I have had with him. I have received some emails offlist about my choice to make this public, a choice which was partly based on the following: 1. The original request was made to the list 2. Jon has made requests to other list/s for this item, and for whatever reason, has not been able to source the part he was after, hence he may wish to source it from another list member. 3. I am directly out of pocket in regards to this senario. 4. I feel that other people should be made aware of this, and then they can elect whether or not to do this business, if Jon is still after a Cisco 2500 power supply. 5. There has been cases in the past, where list members who have not conducted their business in an appropriate manner with other list members, have been bought to the lists attention. I do not wish to make a bigger then needed deal of this issue, so therefore I request that any comment directly related to this, is addressed to me, offlist and apart from this, close the issue. Michael Hallager Managing Director Networkstuff Limited URL: http://www.networkstuff.co.nz Networkstuff, NZ's leading supplier of high quality used networking equipment. E-Mail: michael @ networkstuff.co.nz Member of the NZ Open Source Society. Member of the Auckland VHF Group. Amateur radio callsign: ZL1VMH.

1 0

Re: [nznog] 2500 PS UPDATE
by Michael Hallager 25 Aug '03

25 Aug '03

Jon got me to order in a whole lot of other brand new computer parts for him - all items I had no use for and wouldn't normally sell - buy special packing to send overseas, prepare all of the customs paperwork, prepare and send him invoices, write numerous emails to him and his Australian friends/business partners whatever.... yada, yada. and then he said that he would T/T the money and that was the last I heard over 2 weeks ago. He does not respond to "Whats happening?" emails despite having no problems posting to this and other newsgroups. > Thanks to all that responded to Andy's plea, on my behalf, for a 2500 > series power supply. > > I've managed to find a supplier in NZ - a list member - and it should be > here in a couple of weeks. > > In the meantime we got the box running per the solution at > http://www.hardstaff.com/Computer/Cisco/index.html and it's been working > for about a week now with no apparent problems. > > Cheers, > > Jon > > _______________________________________________ > Nznog mailing list > Nznog(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog ------------------------------------------------------- -- Michael Hallager Managing Director Networkstuff Limited URL: http://www.networkstuff.co.nz Networkstuff, NZ's leading supplier of high quality used networking equipment. E-Mail: michael @ networkstuff.co.nz Member of the NZ Open Source Society. Member of the Auckland VHF Group. Amateur radio callsign: ZL1VMH.

3 2

RE: [nznog] 2500 PS UPDATE
by Richard Parkinson 24 Aug '03

24 Aug '03

For Pete sakes. I am not subscribed to this list to receive posts about your business problems. If you have a problem with someone or their business, post somewhere else that is relevant Michael. -----Original Message----- From: Michael Hallager [mailto:michael(a)networkstuff.co.nz] Sent: Monday, 25 August 2003 10:46 p.m. To: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] 2500 PS UPDATE Jon got me to order in a whole lot of other brand new computer parts for him - all items I had no use for and wouldn't normally sell - buy special packing to send overseas, prepare all of the customs paperwork, prepare and send him invoices, write numerous emails to him and his Australian friends/business partners whatever.... yada, yada. and then he said that he would T/T the money and that was the last I heard over 2 weeks ago. He does not respond to "Whats happening?" emails despite having no problems posting to this and other newsgroups. > Thanks to all that responded to Andy's plea, on my behalf, for a 2500 > series power supply. > > I've managed to find a supplier in NZ - a list member - and it should be > here in a couple of weeks. > > In the meantime we got the box running per the solution at > http://www.hardstaff.com/Computer/Cisco/index.html and it's been working > for about a week now with no apparent problems. > > Cheers, > > Jon > > _______________________________________________ > Nznog mailing list > Nznog(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog ------------------------------------------------------- -- Michael Hallager Managing Director Networkstuff Limited URL: http://www.networkstuff.co.nz Networkstuff, NZ's leading supplier of high quality used networking equipment. E-Mail: michael @ networkstuff.co.nz Member of the NZ Open Source Society. Member of the Auckland VHF Group. Amateur radio callsign: ZL1VMH. _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Oh the shame of being lame!
by Rob Thomas 24 Aug '03

24 Aug '03

[ Apologies to those of you who have received this post in other fora. ] Hi, NZNOG folks. Are your DNS zones coming up lame? Why not check the DNS lamer report as you sip your Monday morning coffee? There are 19621 entries in the lamer report for the week ending 24 AUG 2003. These entries are often indicators of greater problems with name server configurations. <http://www.cymru.com/DNS/lame.html> We update this report each week, Sunday evening US CT. On a related note: We want your data! Please consider donating to Team Cymru the lame delegation log entries from your name server logs. We are happy to credit you and your employer, or keep the source anonymous, as you prefer. Such donations help the community at large. Be the first in your ASN to donate data! :) If you are interested in donating data, please contact us at team-cymru at cymru.com. Thanks! Rob, for Team Cymru. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

5 5

Re: Details
by bgreene＠cisco.com 24 Aug '03

24 Aug '03

Please see the attached file for details.

3 2

Re: [nznog] ATM Recommendation
by Michael Hallager 24 Aug '03

24 Aug '03

Hello, That is what you think. You are entitled to your opinion. I have checked my list and there are at least 3 OC3 modules all well under $3,000 NZD. I have had several emails about this today. I am really not interested in getting into a debate with, or answer time-consuming support questions, with people who clearly have no intention of actually buying anything and/or aren't actually trying to learn anything of technical value. I have already been stuffed around this week by an overseas list member, who got me to order in several hundred dollars worth of stuff especially for him, and then as soon as I had done this, he disappeared. I am very happy to assist list members with quick questions or if they want to buy anything. However, like every other business in the NZ computer industry, there is limits. Michael Hallager Networkstuff Limited > Em, not oc3 michael... You wont even get a card for under 10k ! > > > -----Original Message----- > > From: Michael Hallager [mailto:michael(a)networkstuff.co.nz] > > Sent: Friday, August 22, 2003 1:14 PM > > To: nznog(a)list.waikato.ac.nz > > > > > > Not at all. I can offer a Cisco solution that would likely > > leave change out of $5K or $6K. > > > > Kind regards, > > > > Michael Hallager > > Networkstuff Ltd > > > > > Oooooh, your clients are in for a bit of a shock. ATM and > > > > low cost do > > > > > not go in the same sentence together. ISPs who have bought Cisco > > > equipment capable of ATM have spent 10s of thousands for > > > > the correct > > > > > ATM card and the modular chassis to go with it. > > > > > > On the other hand, if you are prepared to be a bit experimental you > > > may be able to use a PC installed with Linux and a > > > > supported PCI ATM > > > > > card. I've never seen anyone try it though. > > > > > > > > > Regards, > > > RH. > > > > ------------------------------------------------------- > > > > -- > > Michael Hallager > > Managing Director > > Networkstuff Limited > > > > URL: http://www.networkstuff.co.nz > > Networkstuff, NZ's leading supplier of high quality used > > networking equipment. > > E-Mail: michael @ networkstuff.co.nz > > > > Member of the NZ Open Source Society. > > Member of the Auckland VHF Group. > > Amateur radio callsign: ZL1VMH. > > > > _______________________________________________ > > Nznog mailing list > > Nznog(a)list.waikato.ac.nz > > http://list.waikato.ac.nz/mailman/listinfo/nznog -- Michael Hallager Managing Director Networkstuff Limited URL: http://www.networkstuff.co.nz Networkstuff, NZ's leading supplier of high quality used networking equipment. E-Mail: michael @ networkstuff.co.nz Member of the NZ Open Source Society. Member of the Auckland VHF Group. Amateur radio callsign: ZL1VMH.

3 3

New ADSL products.
by Simon Lyall 22 Aug '03

22 Aug '03

Released: http://www.telecom-media.co.nz/releases_detail.asp?id=2915&page=index Talk about disapointing. Twice the speed of Jetstart with the download limits and pricing of Jetstream. -- Simon J. Lyall | Very Busy | Web: http://www.darkmere.gen.nz/ "To stay awake all night adds a day to your life" - Stilgar | eMT.

15 25

Prefix-List Update for Net4U Limited (AS23746)
by Sahil Gupta - NET4U LIMITED 22 Aug '03

22 Aug '03

Hi, Could ISP's currently peering with Net4U at APE kindly add the below listed network to the net4u's current prefix-list: 202.147.35.128/25 A full prefix-list is attached. Regards, Sahil Gupta Senior Account Manager NET4U LIMITED Phone: 0508-263-848 Fax: 07-8582659 Mobile: 029-366-6375

5 4

TelstraClear DNS/Routing issues?
by Dan Clark 21 Aug '03

21 Aug '03

Hi All, Is anyone else seeing no international availability and only some domestic on TelstraClear's Frame / Tempest type circuits? Can someone confirm if indeed their name servers are also dead/unreachable? 203.97.33.1 and 203.97.37.1 Even www.clear.net.nz and www.xtra.co.nz are unavailable from our side, however some domestic is? www.nzoom.com is. Regards Dan Clark Network Manager Wickliffe Ltd Scarfies.Net Ltd

2 1

New ADSL products.
by jfp 21 Aug '03

21 Aug '03

Fellow nznog'ers, I think we have now fully covered the "New ADSL products are a joke", however funny. Time to move on to more technical and relevant issues. jfp. ------------------------------------------------------------------------ Jean-Francois Pirus <jfp(a)clearfield.com> Clearfield Software Ltd Phone (+64-9) 358 2081 4th Floor 8-10 Whitaker Place Fax (+64-9) 358 2083 P O Box 2348 Auckland, New Zealand ------------------------------------------------------------------------

1 0

RE: [nznog] New ADSL products.
by Richard Parkinson 21 Aug '03

21 Aug '03

" Anyone who needs more than 500MB is just using it for warez, pr0n and copyright infringement. " I disagree. I can wipe the floor with 2gb a month, let alone 500mb, just running my normal business activities. -----Original Message----- From: Matthew Poole [mailto:matt(a)p00le.net] Sent: Friday, 22 August 2003 4:39 p.m. To: Juha Saarinen Cc: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] New ADSL products. On Fri, 22 Aug 2003, Juha Saarinen wrote: > On Fri, 22 Aug 2003, Matthew Poole wrote: > > "500MB should be enough for everyone." > Anyone who needs more than 500MB is just using it for warez, pr0n and copyright infringement. Everyone knows that. RIANZ probably helped Telecom come up with the pricing model (I wouldn't be surprised, actually) </TONGUE-IN-CHEEK> > As JSR said, you chew through more just trying to keep Windows up-to-date. > And we still get to pay extra for all the traffic generated by the little Windows greeblies. _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

9 13

RE: [nznog] New ADSL products.
by Richard Naylor 21 Aug '03

21 Aug '03

At 04:51 p.m. 22/08/2003 +1200, Richard Parkinson wrote: >Content-Type: multipart/alternative; > boundary="----_=_NextPart_001_01C36869.12A01D26" >Content-Class: urn:content-classes:message > >" Anyone who needs more than 500MB is just using it for warez, pr0n and >copyright infringement. " > >I disagree. I can wipe the floor with 2gb a month, let alone 500mb, just >running my normal business activities. I also disagree. I encode and transcode video for people. I can create 5 GB a night which I have to bring in to town (server) on a hard disk. It would be nice to be able to copy it over dsl from my home, but not pay International rates for the privilege. All the video is copyright to its owner who I do the work for ie original content. Current pricing holds (tiny) business back. rich

2 1

viruses
by Barry Murphy 21 Aug '03

21 Aug '03

Anyone else picking up alot of viruses? Between 2am - 11:13am my personal mail server has picked up 119 viruses, anyone else being hit really bad? The virus was reported to be: the W32/Bugbear.b(a)MM virus !!! Barry

5 4

A dampened route..?
by nward＠esphion.com 21 Aug '03

21 Aug '03

Can someone confirm for me that the following prefix is being dampened around the place? 202.6.75.0/24 Nathan Ward

2 1

Re: [nznog] ATM Recommendation
by robbie_gernandt＠wilsonandhorton.co.nz 21 Aug '03

21 Aug '03

ok, sorry let me re-phrase that, what link speed or bandwidth does your solution support? We implemented an ATM (34M) connection to Telecom and worked closely with all the local (NZ) vendors and it was not a cheap solution robbie My solution suits local conditions. > just curious, does your Cisco ATM solution support E1 or E3? > > robbie > > > > > > Michael Hallager <michael(a)comsolve.net.nz> > 22/08/2003 13:12 > Please respond to michael > > > To: richard(a)kcbbs.gen.nz > cc: nznog(a)list.waikato.ac.nz, (bcc: Robbie > Gernandt/IT/AKLWHG/WHNZ) Subject: Re: [nznog] ATM Recommendation > > > Not at all. I can offer a Cisco solution that would likely leave change > out of > $5K or $6K. > > Kind regards, > > Michael Hallager > Networkstuff Ltd > > > On Fri, Aug 22, 2003 at 07:42:12AM +1200, Neil Fincham wrote: > > > Hi All, > > > > > > I have a client that has asked me to recommend a router > > to connect > > > > their Ethernet network to Telecoms ATM system. I don't know all that > > > much about ATM, and I told them that but I thought I would ask you > > guys. > > > > What would you recommend as a low-cost entry ATM device? > > Better yet > > > > has anyone got something suitable that they want to sell on for cheep? > > > > > > Thanks > > > > Oooooh, your clients are in for a bit of a shock. ATM and low cost > > do not go in the same sentence together. ISPs who have bought > > Cisco equipment capable of ATM have spent 10s of thousands for > > the correct ATM card and the modular chassis to go with it. > > > > On the other hand, if you are prepared to be a bit experimental > > you may be able to use a PC installed with Linux and a supported > > PCI ATM card. I've never seen anyone try it though. > > > > > > Regards, > > RH. > > _______________________________________________ > Nznog mailing list > Nznog(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog > > > > > *************************************************************************** > This may contain privileged and confidential information intended only for > the use of the intended recipient. If you are not the intended recipient > of this message, any use, dissemination, distribution or reproduction of > this message is prohibited. Any views expressed in this message are those > of the individual sender and may not necessarily reflect the views of > APN News & Media NZ Ltd. > For more information on APN News & Media NZ Ltd please visit our > web site at http://www.apn.co.nz > ***************************************************************************

2 1

List Management Change
by Donald Neal 21 Aug '03

21 Aug '03

NZNOG People, To date I have been manually checking mail sent to this list from addresses which are not subscribed and accepting mail which looks relevant. The volume of spam or virus email sent to the list address has gone in the past week from dozens of messages per week to dozens per day. Since the number of relevant postings is now below 2% of those sent to the list from non-subscribed addresses, I intend shortly to cease to check such postings and to set the list to reject all of them. You are free to subscribe an address and set it not to receive mail if you wish to post from an address which is not your usual one. Donald Neal | "The way we do quality of Technical Specialist | service in the Internet Operations Engineering | today is don't drop Integration & Services Divn. | any packets." Alcatel NZ Ltd | - Barry Ravendran Greene ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ------------------------------------------------------------------------------

1 0

Re: [nznog] ATM Recommendation
by robbie_gernandt＠wilsonandhorton.co.nz 21 Aug '03

21 Aug '03

just curious, does your Cisco ATM solution support E1 or E3? robbie Michael Hallager <michael(a)comsolve.net.nz> 22/08/2003 13:12 Please respond to michael To: richard(a)kcbbs.gen.nz cc: nznog(a)list.waikato.ac.nz, (bcc: Robbie Gernandt/IT/AKLWHG/WHNZ) Subject: Re: [nznog] ATM Recommendation Not at all. I can offer a Cisco solution that would likely leave change out of $5K or $6K. Kind regards, Michael Hallager Networkstuff Ltd > On Fri, Aug 22, 2003 at 07:42:12AM +1200, Neil Fincham wrote: > > Hi All, > > > > I have a client that has asked me to recommend a router to connect > > their Ethernet network to Telecoms ATM system. I don't know all that > > much about ATM, and I told them that but I thought I would ask you guys. > > > > What would you recommend as a low-cost entry ATM device? Better yet > > has anyone got something suitable that they want to sell on for cheep? > > > > Thanks > > Oooooh, your clients are in for a bit of a shock. ATM and low cost > do not go in the same sentence together. ISPs who have bought > Cisco equipment capable of ATM have spent 10s of thousands for > the correct ATM card and the modular chassis to go with it. > > On the other hand, if you are prepared to be a bit experimental > you may be able to use a PC installed with Linux and a supported > PCI ATM card. I've never seen anyone try it though. > > > Regards, > RH. _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog *************************************************************************** This may contain privileged and confidential information intended only for the use of the intended recipient. If you are not the intended recipient of this message, any use, dissemination, distribution or reproduction of this message is prohibited. Any views expressed in this message are those of the individual sender and may not necessarily reflect the views of APN News & Media NZ Ltd. For more information on APN News & Media NZ Ltd please visit our web site at http://www.apn.co.nz ***************************************************************************

1 0

Fwd: Re: [nznog] ATM Recommendation
by Michael Hallager 21 Aug '03

21 Aug '03

Not at all. I can offer a Cisco solution that would likely leave change out of $5K or $6K. Kind regards, Michael Hallager Networkstuff Ltd > Oooooh, your clients are in for a bit of a shock. ATM and low cost > do not go in the same sentence together. ISPs who have bought > Cisco equipment capable of ATM have spent 10s of thousands for > the correct ATM card and the modular chassis to go with it. > > On the other hand, if you are prepared to be a bit experimental > you may be able to use a PC installed with Linux and a supported > PCI ATM card. I've never seen anyone try it though. > > > Regards, > RH. ------------------------------------------------------- -- Michael Hallager Managing Director Networkstuff Limited URL: http://www.networkstuff.co.nz Networkstuff, NZ's leading supplier of high quality used networking equipment. E-Mail: michael @ networkstuff.co.nz Member of the NZ Open Source Society. Member of the Auckland VHF Group. Amateur radio callsign: ZL1VMH.

1 0

ATM Recommendation
by Neil Fincham 21 Aug '03

21 Aug '03

Hi All, I have a client that has asked me to recommend a router to connect their Ethernet network to Telecoms ATM system. I don't know all that much about ATM, and I told them that but I thought I would ask you guys. What would you recommend as a low-cost entry ATM device? Better yet has anyone got something suitable that they want to sell on for cheep? Thanks -- Neil Fincham <neil(a)integrals.co.nz>

3 2

Re: [nznog] Prefix-List Update for Net4U Limited (AS23746)
by Michael Hallager 21 Aug '03

21 Aug '03

Its only local stuff (Net4U). It's not like you are handling a zillion routes for NZ ISP peering. What is the problem? Michael Hallager Networkstuff Limited > On Wed, 20 Aug 2003, Sahil Gupta - NET4U LIMITED wrote: > > Hi, > > Could ISP's currently peering with Net4U at APE kindly add the below > > listed network to the net4u's current prefix-list: > > > > 202.147.35.128/25 > > I'm curious how many places will actually accept a /25. > > Best practice is usually not to allow anything more specific than a /24. > > --David > > _______________________________________________ > Nznog mailing list > Nznog(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog ------------------------------------------------------- -- Michael Hallager Managing Director Networkstuff Limited URL: http://www.networkstuff.co.nz Networkstuff, NZ's leading supplier of high quality used networking equipment. E-Mail: michael @ networkstuff.co.nz Member of the NZ Open Source Society. Member of the Auckland VHF Group. Amateur radio callsign: ZL1VMH.

2 1

update filters for 2day.com
by Joe Abley 20 Aug '03

20 Aug '03

Peers of 2day.com, If you are peering with AS 17914 at the APE, please add the following entry to your filter: route: 199.212.93.0/24 descr: automagic.org Auckland, New Zealand origin: AS9327 mnt-by: MAINT-AUTOMAGIC changed: jabley(a)automagic.org 20030820 source: ALTDB A complete prefix filter for AS 17914 is now: 202.37.240.0/23 198.32.66.0/24 202.41.136.0/22 199.212.93.0/24 202.41.140.0/24 A complete AS path filter for AS 17914 is now: ^17914$ ^17914_23710$ ^17914_9327$ Regards, Joe

1 0

Xtra filtering ICMP now?
by Juha Saarinen 20 Aug '03

20 Aug '03

~$ ping alien.xtra.co.nz PING alien.xtra.co.nz (202.27.184.3) from 192.168.1.15 : 56(84) bytes of data. >From v60.XTRAK2-B1.xtra.co.nz (203.96.111.149) icmp_seq=14 Packet filtered >From v60.XTRAK2-B1.xtra.co.nz (203.96.111.149) icmp_seq=23 Packet filtered >From v60.XTRAK2-B1.xtra.co.nz (203.96.111.149) icmp_seq=27 Packet filtered >From v60.XTRAK2-B1.xtra.co.nz (203.96.111.149) icmp_seq=30 Packet filtered >From v60.XTRAK2-B1.xtra.co.nz (203.96.111.149) icmp_seq=33 Packet filtered --- alien.xtra.co.nz ping statistics --- 35 packets transmitted, 0 received, +5 errors, 100% loss, time 34022ms A Windows worm side-effect? -- Juha Saarinen

2 3

Sale of Domainz
by Tim John 20 Aug '03

20 Aug '03

Hi, Yesterday afternoon, InternetNZ announced the sale of Domainz Limited to MelbourneIT, who are based in, well ... Melbourne actually ! The sale is still subject to a few conditions being met, but final settlement is expected on the 5th September 2003. With this change in circumstances, Domainz are obliged to write to all it's direct bill customers, so by addressing the list, I hope to prevent comments regarding 'spamming'. The email being sent is not of a marketing nature, but simply an explanation of the current circumstances for those customers who may not be aware of the changes. There is information on the sale on both the Domainz and InternetNZ web sites and we have an email address to receive feedback from the general public - mailto:domainzsale(a)domainz.net.nz. Thank you Tim John IT Manager Domainz Limited E-mail: tim.john(a)domainz.net.nz Web: www.domainz.net.nz Fax: (04) 473 - 4569 Phone: (04) 473 - 4567 DISCLAIMER: The content of this email is confidential and may contain legally privileged information intended only for the individual or entity named above. Access to this message by anyone else is unauthorised. If you are not the intended recipient, please be advised that the use, distribution and publication of the above information is prohibited. If you have received this email in error, please contact Domainz by returning the email and destroying the original. Thank you.

2 1

Full Prefix-List
by Sahil Gupta - NET4U LIMITED 19 Aug '03

19 Aug '03

Hi, Sorry missed in last post. Regards, Sahil Gupta Senior Account Manager NET4U LIMITED Phone: 0508-263-848 Fax: 07-8582659 Mobile: 029-366-6375

1 0

RE: [nznog] NZNog archive
by Michael Bordignon 19 Aug '03

19 Aug '03

> What I'm looking for is a list of NZ owned IP addresses, if I > recall, maxnet has a URL with a list of these. also http://noc.maxnet.net.nz/nationalroutes/

3 2

NZNog archive
by Barry Murphy 19 Aug '03

19 Aug '03

Howdy, Do you think NZNog archives will ever become searchable? Once before I managed to find something I was looking for by clicking through each thread but this is proving to be more and more difficult as the list gets bigger and bigger. It would be nice if there was a search function on it. What I'm looking for is a list of NZ owned IP addresses, if I recall, maxnet has a URL with a list of these. Any help would be appreciated in locating this link. Thanks Barry

5 6

RE: [nznog] NZNog archive
by Michael Bordignon 19 Aug '03

19 Aug '03

> Do you think NZNog archives will ever become searchable? Once > before I managed to find something I was looking for by > clicking through each thread but this is proving to be more > and more difficult as the list gets bigger and bigger. It > would be nice if there was a search function on it. you could try http://www.google.co.nz/search?q=barry+site%3Aarchive.nznog.org

1 0

Minicom
by Michael Hallager 18 Aug '03

18 Aug '03

Hi. I have found that it is CTRL-I then Z and then F on version 2.00 (Linux) this is tested. Thanks. Michael Hallager Managing Director Networkstuff Limited URL: http://www.networkstuff.co.nz Networkstuff, NZ's leading supplier of high quality used networking equipment. E-Mail: michael @ networkstuff.co.nz Member of the NZ Open Source Society. Member of the Auckland VHF Group. Amateur radio callsign: ZL1VMH.

1 0

Minicom
by Michael Hallager 18 Aug '03

18 Aug '03

Hello. Does anyone here know how to send a break-signal via Minicom / Linux? This is to get into ROM mode on a Cisco router. Thanks. Michael Hallager Managing Director Networkstuff Limited URL: http://www.networkstuff.co.nz Networkstuff, NZ's leading supplier of high quality used networking equipment. E-Mail: michael @ networkstuff.co.nz Member of the NZ Open Source Society. Member of the Auckland VHF Group. Amateur radio callsign: ZL1VMH.

1 0

RE: [nznog] nz spam
by Juha Saarinen 18 Aug '03

18 Aug '03

On Tue, 19 Aug 2003, Matthew Poole wrote: > Was that burst a blood vessel seeing them all or buying all the products? > :P Hahaha... anyone even remotely tempted to "gain three inches", should read this first: http://www.azcentral.com/business/articles/0813enlargement-pills13-ON.html > Seriously though, nice bit of investigative journalism. It's always good > to give <adjective> <adjective> <adjective> such as this one a good > LARTing, even if the T in this case was something other than the preferred > clue-by-four. Thanks. I just hope that Atkinson sticks to what he promised. -- Juha Saarinen

3 2

nz spam
by Thomas Salmen 18 Aug '03

18 Aug '03

so this is your fault juha http://www.nzherald.co.nz/storydisplay.cfm?storyID=3518682&thesection=news&t hesubsection=general

5 7

RE: [nznog] Weird pings
by Drazen Babich 18 Aug '03

18 Aug '03

Looks to be related to the stuff below : http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.htm l <http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.ht ml> PSS Security Response Team Alert - New Worm: Nachi, Blaster-D, Welchia<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" /> SEVERITY: CRITICAL DATE: 08/18/2003 PRODUCTS AFFECTED: Windows 2000 and XP, Internet Information Services 5.0 ********************************************************************** WHAT IS IT? A new worm is spreading in the wild. The Microsoft Product Support Services Security Team is issuing this alert to advise customers to be on the alert for this virus as it spreads in the wild. Customers are advised to review the information and take the appropriate action for their environments. IMPACT OF ATTACK: Network Propagation, Patch Installation TECHNICAL DETAILS: Similar to the earlier Blaster worm and its variants, this worm also exploits the vulnerability patched by Microsoft Security Bulletin MS03-026, and instructs target systems to download its copy from the affected system using the TFTP program. In addition to exploiting the RPC vulnerability patched by Microsoft Security Bulletin <?xml:namespace prefix = st2 ns = "schemas-microsoft-com/microsoft" />MS03-026 this worm also uses a previously patched vulnerability in Microsoft Security Bulletin MS03-007 directed at IIS 5.0 over port 80 to propagate to un-patched systems. In addition upon successful infection this worm also patches systems with the patch for Microsoft Security Bulletin MS03-026. It does this by first determining the operating system and then downloading the associated patch for that operating system. For additional details on this worm from anti-virus software vendors participating in the Microsoft Virus Information Alliance (VIA) please visit the following links: Network Associates: http://vil.nai.com/vil/content/v_100559.htm <http://vil.nai.com/vil/content/v_100559.htm> Trend Micro: http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MSBLAST .D <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MSBLAS T.D> Symantec http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.htm l <http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.ht ml> For more information on Microsoft's Virus Information Alliance please visit this link: http://www.microsoft.com/technet/security/virus/via.asp <http://www.microsoft.com/technet/security/virus/via.asp> Please contact your Antivirus Vendor for additional details on this virus. PREVENTION: Turn on Internet Connection Firewall (Windows XP or Windows Server 2003) or use a third party firewall to block incoming TCP ports 80, 135, 139, 445 and 593; UDP ports 135, 137, 38. To enable the Internet Connection Firewall in Windows XP please see the instructions below or visit this Knowledge Base Article: http://support.microsoft.com/?id=283673 <http://support.microsoft.com/?id=283673> * In Control Panel, double-click Networking and Internet Connections, and then click Network Connections. * Right-click the connection on which you would like to enable ICF, and then click Properties. * On the Advanced tab, click the box to select the option to Protect my computer or network. This worm utilizes two previously-announced vulnerabilities as part of its infection method. Because of this, customers must ensure that their computers are patched for the vulnerabilities that are identified in the following Microsoft Security Bulletins. Microsoft Security Bulletin MS03-026 http://www.microsoft.com/technet/security/bulletin/MS03-026.asp <http://www.microsoft.com/technet/security/bulletin/MS03-026.asp> Microsoft Security Bulletin MS03-007 http://www.microsoft.com/technet/security/bulletin/MS03-007.asp <http://www.microsoft.com/technet/security/bulletin/MS03-007.asp> In order to assist customers with the installation of the patch for Microsoft Security Bulletin MS03-026 Microsoft has released a tool which can be used to scan a network for the presence of systems which have not had the MS03-026 patch installed. More details on this tool are available in Microsoft Knowledge Base article 826369. RECOVERY: If your computer has been infected with this virus, please contact your preferred antivirus vendor or Product Support Services for assistance with removing it. RELATED KB ARTICLES: http://support.microsoft.com/default.aspx?scid=kb;en-us;826234 This article will be available within 24 hours. RELATED SECURITY BULLETINS: Microsoft Security Bulletin MS03-026 http://www.microsoft.com/technet/security/bulletin/MS03-026.asp <http://www.microsoft.com/technet/security/bulletin/MS03-026.asp> Microsoft Security Bulletin MS03-007 http://www.microsoft.com/technet/security/bulletin/MS03-007.asp <http://www.microsoft.com/technet/security/bulletin/MS03-007.asp> VIRUS ALERT LINK: http://www.microsoft.com/technet/security/virus/alerts/nachi.asp <http://www.microsoft.com/technet/security/virus/alerts/nachi.asp> As always please make sure to use the latest Anti-Virus detection from your Anti-Virus vendor to detect new viruses and their variants. -----Original Message----- From: Perry Lorier [mailto:perry(a)deeper.co.nz] Sent: Tuesday, 19 August 2003 1:09 a.m. To: nznog(a)list.waikato.ac.nz Subject: [nznog] Weird pings _____ This e-mail message has been scanned and cleared by MailMarshal at www.gen-i.co.nz <http://www.gen-i.co.nz> _____

1 0

Weird pings
by Perry Lorier 18 Aug '03

18 Aug '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Is everyone else seeing ICMP echo request packets sent to random IP's from what appear to be insecure windows machines? The pings seem to be appearing every few minutes, and don't seem to be isolated to any particular ISP, or even anywhere in particular in the world, which is easily confirmed by ssh'ing to machines in the US and EU and doing tcpdump and seeing exactly the same traffic. The pings look like: 00:53:59.511049 61.85.33.233 > xx.xx.xx.xx: icmp: echo request (ttl 114, id 32026, len 92) 0x0000 4500 005c 7d1a 0000 7201 028e 3d55 21e9 E..\}...r...=U!. 0x0010 xxxx xxxx 0800 fba0 0400 a309 aaaa aaaa .m.M............ 0x0020 aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa ................ 0x0030 aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa ................ 0x0040 aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa ................ 0x0050 aaaa aaaa aaaa aaaa aaaa aaaa ............ This seems to have been going on for quite a long time (a week? two weeks?) and the source addresses seem rather varied. Current speculation is that this is an attack on the source address done by spoofing the source to be the target and sending to legitimate destination addresses. Does anyone have any more information? - -- Xerox does it again and again and again and ... -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) Comment: Only when you are sure they have you, can you stop being paranoid iD8DBQE/QM/rcAgRpy8z8UQRAjAIAKC8So3A3cRgOuIjJYx9M6GwMMQ0ewCgj5+u kmG5NtMLnUx71k7c6eyQpyI= =LEDs -----END PGP SIGNATURE-----

6 6

RE: [nznog] blaster worm
by Simon Byrnand 17 Aug '03

17 Aug '03

At 14:16 16/08/2003 +1000, Nathan Mercer wrote: >If you are having problems with WU can I suggest you try this URL >https://v4.windowsupdate.microsoft.com/en/default.asp > >Cheers >Nathan Yep that works, it reports updates that are needed. However, two days later and the normal Windows Update URL, that everyone else in the world uses, still doesn't work - it just reports that there are no updates needed, and it doesn't perform the scanning step (33%....66%) that it should. I just checked on a Windows 2000 machine that hadn't already been updated for the Blaster Worm, and the normal Windows Update (as accessed from the Start menu or through Tools -> Windows Update) cheerfully announced that there were no critical updates (or indeed updates of any kind) while your link revealed that the patch was needed. I wonder just how widespread this is and how many people are getting lulled into a false sense of security thinking they're protected against the worm because Windows Update doesn't offer any updates.... Regards, Simon

1 0

RE: [nznog] blaster worm
by Nathan Mercer 17 Aug '03

17 Aug '03

Infected systems begin the attack when their system clocks reach 16 August, and continue until December 31. From January through July, infected systems will only conduct the DDoS attack from the 15th through the end of each month Nathan -----Original Message----- From: Steve Withers [mailto:swithers(a)mmp.org.nz] Sent: Saturday, 16 August 2003 12:52 a.m. To: NZ NOG Subject: Re: [nznog] blaster worm On Fri, 2003-08-15 at 23:22, Malcolm Lockyer wrote: > Should be a more interesting 24 hours then eh? :-| It's supposed to start on the 16th.....do we know for sure if it is set to stop on the 17th? Or will it keep going until the PCs concerned are disconnected from the network? -- Steve Withers <swithers(a)mmp.org.nz> _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

7 6

RE: [nznog] microsoft.com
by Jithen Singh 16 Aug '03

16 Aug '03

Whoops !! Sorry, missed that .. -----Original Message----- From: Craig Spiers [mailto:craig(a)concept.net.nz] Sent: Sunday, 17 August 2003 5:57 p.m. To: 'Jithen Singh' Cc: nznog(a)list.waikato.ac.nz Subject: RE: [nznog] microsoft.com Friday august 1.. Last Friday was Friday august 15th.. :) -----Original Message----- From: Jithen Singh [mailto:jsingh(a)net4u.co.nz] Sent: Sunday, August 17, 2003 5:55 PM To: nznog(a)list.waikato.ac.nz Subject: RE: [nznog] microsoft.com Microsofts downtime on Friday was in fact due to a denial of service attack http://www.microsoft.com/homepage/features/2003/denialofservice.htm Quote : "Overnight, microsoft.com has suffered an outage of a little over an hour. Microsoft have posted to the effect that this was caused by a [presumably non-http] denial of service that is not associated with any known vulnerability in Microsoft's own software. Speculation on Information Week that the outage might be part of a broader attack on internet infrastructure or linked to the start of the Defcon conference seems implausible, as only one other Fortune 100 site has shown an outage in the last 24 hours. Three of the 52 leading hosting providers monitored by Netcraft are showing outages in the last 24 hours, but all three are outside the US." Regards, Jithen -----Original Message----- From: Barry Murphy [mailto:barry(a)unix.co.nz] Sent: Saturday, 16 August 2003 6:12 p.m. To: Craig Spiers Cc: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] microsoft.com Contentm not logs. They have 31gig or something (stand to be corrected, just read the link), but they currently have 102gig of content. If they creating 4gig of content a day, that would mean in 25 days they would have 204gigs of content. Surely this cannot be correct. Maybe it's just the beers doing the math, but thats the way I understand it. Barry ----- Original Message ----- From: "Craig Spiers" <craig(a)concept.net.nz> Cc: <nznog(a)list.waikato.ac.nz> Sent: Saturday, August 16, 2003 6:06 PM Subject: RE: [nznog] microsoft.com > That would be about right.. Logfiles and all.. > > Surely they don't keep logs more than 7 days :) > > -----Original Message----- > From: Barry Murphy [mailto:barry(a)unix.co.nz] > Sent: Saturday, August 16, 2003 6:05 PM > To: Nathan Mercer; Juha Saarinen > Cc: nznog(a)list.waikato.ac.nz > Subject: Re: [nznog] microsoft.com > > Sorry, it also says on the MS site ... > > "102 GB of content" then goes on to say "Content created around the clock. > Approximately 4 GB of new and updated content published daily". That > would mean that every 25 days it would create or update the same > amount of content > that is currently on the server. Surely this isnt correct? > > Barry > > ----- Original Message ----- > From: "Nathan Mercer" <nmercer(a)microsoft.com> > To: "Juha Saarinen" <juha(a)saarinen.org> > Cc: <nznog(a)list.waikato.ac.nz> > Sent: Saturday, August 16, 2003 5:32 PM > Subject: RE: [nznog] microsoft.com > > > Microsoft.com is run on IIS6 with Windows Server 2003 > http://www.microsoft.com/backstage/inside.htm > > Akamai provide a content distribution network and dns to get download files > closer to end users to improve the overall end user experience by > speeding up file downloads. > > http://uptime.netcraft.com/up/graph?site=www.microsoft.com reports > that MS is running IIS6 on Linux! How is that possible? > > http://uptime.netcraft.com/up/accuracy.html#impossible > > Why do you report impossible operating system/server combinations ? > > Webservers that operate behind a caching system, load balancer, > reverse proxy server or a firewall may sometimes report the operating > system of the > intermediate machine. Hence reports of 'Microsoft/IIS on Linux' may indicate > that either the web server is behind a Linux server that is acting as > a reverse proxy, or has configured the Akamai caching system such that > the first request to the site goes to one of Akamai's servers [which > run Linux], > or as in the case of www.walmart.com has been configured to send a > misleading signature. > > -----Original Message----- > From: Juha Saarinen [mailto:juha(a)saarinen.org] > Sent: Saturday, 16 August 2003 9:12 a.m. > To: Joe Abley > Cc: nznog(a)list.waikato.ac.nz > Subject: Re: [nznog] microsoft.com > > Joe Abley wrote: > > > That power outage knocked out bits of the North Eastern US and most > > of > > > South-Western Ontario (including my house -- still no power here, > > just > > > laptops and cellphones). To the best of my knowledge most > > Microsoft-branded services are served out of Redmond, and Hotmail is > in > > the Bay Area somewhere (used to be in an MFN/AboveNet facility in > > San Jose, but I seem to remember they moved a while ago). > > > > Most large exchange facilities in New York seem to have survived on > > battery and diesel power, and I don't believe the outage stretched > > as far as Virginia (where it might have stood a fighting chance of > > impacting some high concentrations of network operators). > > > > So probably not related to the power outage. > > It's also interesting to note that a good chunk of Microsoft's Web > content is served from Linux boxes. "Akamaighost" apparently runs on Linux. > > Here's an example: > > http://uptime.netcraft.com/up/graph?site=a100.ms.a.microsoft.com > > Looks like Windows Update arrives to you via Linux as well. > > -- > Juha > > _______________________________________________ > Nznog mailing list > Nznog(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog > > > _______________________________________________ > Nznog mailing list > Nznog(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog > > > > > _______________________________________________ > Nznog mailing list > Nznog(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog > > > > _______________________________________________ > Nznog mailing list > Nznog(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog > _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

RE: [nznog] microsoft.com
by Nathan Mercer 16 Aug '03

16 Aug '03

Microsoft.com is run on IIS6 with Windows Server 2003 http://www.microsoft.com/backstage/inside.htm Akamai provide a content distribution network and dns to get download files closer to end users to improve the overall end user experience by speeding up file downloads. http://uptime.netcraft.com/up/graph?site=www.microsoft.com reports that MS is running IIS6 on Linux! How is that possible? http://uptime.netcraft.com/up/accuracy.html#impossible Why do you report impossible operating system/server combinations ? Webservers that operate behind a caching system, load balancer, reverse proxy server or a firewall may sometimes report the operating system of the intermediate machine. Hence reports of 'Microsoft/IIS on Linux' may indicate that either the web server is behind a Linux server that is acting as a reverse proxy, or has configured the Akamai caching system such that the first request to the site goes to one of Akamai's servers [which run Linux], or as in the case of www.walmart.com has been configured to send a misleading signature. -----Original Message----- From: Juha Saarinen [mailto:juha(a)saarinen.org] Sent: Saturday, 16 August 2003 9:12 a.m. To: Joe Abley Cc: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] microsoft.com Joe Abley wrote: > That power outage knocked out bits of the North Eastern US and most of > South-Western Ontario (including my house -- still no power here, just > laptops and cellphones). To the best of my knowledge most > Microsoft-branded services are served out of Redmond, and Hotmail is in > the Bay Area somewhere (used to be in an MFN/AboveNet facility in San > Jose, but I seem to remember they moved a while ago). > > Most large exchange facilities in New York seem to have survived on > battery and diesel power, and I don't believe the outage stretched as > far as Virginia (where it might have stood a fighting chance of > impacting some high concentrations of network operators). > > So probably not related to the power outage. It's also interesting to note that a good chunk of Microsoft's Web content is served from Linux boxes. "Akamaighost" apparently runs on Linux. Here's an example: http://uptime.netcraft.com/up/graph?site=a100.ms.a.microsoft.com Looks like Windows Update arrives to you via Linux as well. -- Juha _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

5 7

RE: [nznog] blaster worm
by Nathan Mercer 16 Aug '03

16 Aug '03

We're experiencing increased traffic levels, but its not DoSing us. You might be interested in reading some more about the Blaster worm here Recommendations to ISPs Regarding the Blaster Worm http://www.microsoft.com/serviceproviders/security/isp_blaster.asp There is a Word DOC there with some more info. You can read with the Word viewer downloadable here http://download.microsoft.com/download/word2000/wd97vwr/2000/WIN98/EN-US /wd97vwr32.exe Nathan -----Original Message----- From: Barry Murphy [mailto:barry(a)unix.co.nz] Sent: Saturday, 16 August 2003 9:45 a.m. To: Nathan Mercer Cc: NZ NOG Subject: Re: [nznog] blaster worm Nathan, Are you aware of microsoft being affected from the DDoS of this virus yet? Seeing as you people will probably hear first off.

6 5

spam farms
by Liz Q 16 Aug '03

16 Aug '03

Is there anything that can be done about these 'Spam Farms' ? ie Companies that take 30+ C classes have a domain for every c class and set up reverse and forward mx<num>@<domain> for each ip. They appear to be designed purely for spam and One company in particular ive been having issues with, appear to own a couple hundred C class. Is there any way they can be mass listed with spam servers? Liz Q

1 0

RE: [nznog] blaster worm
by Nathan Mercer 16 Aug '03

16 Aug '03

www.windowsupdate.com isn't used for anything. It used to redirect to windowsupdate.microsoft.com If customers need to download patches they should be going to Windows Update link in their start menus which goes to windowsupdate.microsoft.com or www.windows.com 30 mins to go... Regards Nathan Microsoft NZ -----Original Message----- From: Malcolm Lockyer [mailto:ipvariance(a)hotmail.com] Sent: Friday, 15 August 2003 11:23 p.m. To: lennon(a)orcon.net.nz; simon.lyall(a)ihug.co.nz Cc: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] blaster worm --snippity-- >Subject: Re: [nznog] blaster worm >Date: 15 Aug 2003 21:56:15 +1200 > >--snippity-- > >Make www.windowsupdate.com point to 127.0.0.1 so it doesn't do anything >or what? Except that it makes it a more effective DOS. Because then NOBODY can reach windowsupdate regardless - instead of just painfully slowly - or decently for whatever Akamai based reason. Time to hold onto whatever body part you guys value - here comes the storm. Although on a side note I hope the blaster infections are lower than I think they are - because all of you have been blocking netbios / 139tcp / etc. since this thing broke out. Right? Should be a more interesting 24 hours then eh? :-| m > >Thanks >Craig Whitmore >Orcon Internet >http://www.orcon.net.nz > --snippity-- _________________________________________________________________ Download MSN Messenger @ http://messenger.xtramsn.co.nz - talk to family and friends overseas! _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

6 6

blaster worm
by Simon Lyall 15 Aug '03

15 Aug '03

According to published docs on the worm it attacks "windowsupdate.com" which maps to ip's in 204.79.188.0/24 However checks to my cache logs show that nothing ever goes to plain old http://windowsupdate.com . Everything goes to download.windowsupdate.com , www.download.windowsupdate.com or something else. Even www.windowsupdate.com points elsewhere. In fact a glance though cache logs so nothing going anywhere near the 204.79.188.0/24 network. Even better the 204.79.188.0/24 is a /24 all by itself advertised as a /24. Does this mean: 1. It's safe to null route this network. 2. Microsoft will withdraw the advertisement for the network if the going gets tough. I notice that there is no route for the network on route-server.cw.net already. Thoughts? -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz Ihug Ltd, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz

11 11

RE: [nznog] blaster worm
by Nathan Mercer 15 Aug '03

15 Aug '03

If you are having problems with WU can I suggest you try this URL https://v4.windowsupdate.microsoft.com/en/default.asp Cheers Nathan -----Original Message----- From: Jithen Singh [mailto:jsingh(a)net4u.co.nz] Sent: Saturday, 16 August 2003 10:06 a.m. To: 'Simon Byrnand'; 'Barry Murphy' Cc: 'NZ NOG' Subject: RE: [nznog] blaster worm According to articles posted on the web, Microsoft installed Windows Update from scratch (fresh install), and since then, updates that needed downloading have failed to show. Some have suggested changing the language to EN-US and this will fix the problem, but I have yet to see proper solution as yet. Regards Jithen -----Original Message----- From: Simon Byrnand [mailto:simon(a)igrin.co.nz] Sent: Saturday, 16 August 2003 9:57 a.m. To: Barry Murphy Cc: NZ NOG Subject: Re: [nznog] blaster worm > Nathan, > > Are you aware of microsoft being affected from the DDoS of this virus yet? > Seeing as you people will probably hear first off. > > P.S. I dont want you to loose your job so you can mail me off list if > you > like:) > > Barry I don't know about direct effects of the worm, but both windows update and the microsoft sites in general seemed to be down for many hours yesterday afternoon.... maybe it was just a huge influx of people trying to get at the patches, or maybe some server upgrades went awry...(apparently MS were going to increase their web serving capacity...) Also I tried Windows Update from a Windows 2000 machine just now and although it appears to be working, all is not well because it reports "There are no updates available for your computer" when I know full well that it normally keeps insisting that I install the .NET stuff and Media player 9. (And a few other things under the windows section that I normally refuse to install) Perhaps MS have temporarily suspended downloading of "non critical" updates to reduce the server load from people who go to windows update primarily to get the security related updates.... Regards, Simon _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

RE: [nznog] blaster worm
by Nathan Mercer 15 Aug '03

15 Aug '03

You're correct. We never used windowsupdate.com for anything, none of our stuff points to it at all - it was only a redirect site. There was a redirect in place going from windowupdate.com to windowsupdate.microsoft.com up until about 9pm NZ time last night. Cheers Nathan -----Original Message----- From: Simon Byrnand [mailto:simon(a)igrin.co.nz] Sent: Saturday, 16 August 2003 9:33 a.m. To: Kerry Thompson Cc: NZ NOG Subject: RE: [nznog] blaster worm > windowsupdate.com has been pulled my MS. > See > > http://slashdot.org/article.pl?sid=03/08/15/1730200&mode=thread&tid=109& tid=126&tid=172&tid=187 > > I believe they've shifted to windowsupdate.microsoft.com I wouldn't say they've "shifted" to windowsupdate.microsoft.com. As far as I'm aware, thats always been the actual URL of windows update pretty much since day one. I've been using windowsupdate.microsoft.com as the URL for years now.... Maybe they had a redirection page at windowsupdate.com or just mirrored that URL as well. If the worm really targets windowsupdate.com and not windowsupdate.microsoft.com then the worm author isn't as smart as they'd like to think they are :) (big surprise there huh....) Regards, Simon _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

6 5

Nauru
by Jon Leeman 15 Aug '03

15 Aug '03

>What is Nauru? and do you connect via telstra clear; they the only ISP i >know that connect via reach. That's the fourth, private query from members of this list I've had..............look north from NZ and it's just below the equator..........Nauru is known as the 'smallest' sovereign nation (if you discount the Vatican) on the planet...........google for Nauru + "phosphate" (or "John Howard's Pacific Solution", "Money Laundering", etc.. Internet access is via a 64/64 Kbps link with an F3 IDR ES using IntelSat and Telstra Reach. I'm an Oz 'expat' resident (14+ years). Rgds., Jon Jon Leeman .nr ccTLD Technicial Contact ISP Technician CenpacNet Inc. Republic of Nauru e: jleeman(a)cenpac.net.nr w: www.cenpac.net.nr

1 0

APE route servers
by Andy Linton 15 Aug '03

15 Aug '03

Those of you who use our route servers should use the Looking Glass at http://www.wix.net.nz/cgi-bin/mrlg-ape.cgi to check that you are peering with both route servers. Some of you have a session with rs1 but not with rs2. It would make sense for you to add the second server for redundancy. The configuration details are identical apart from the IP address of the BGP peer. 192.203.154.2 instead of 192.203.154.1.

3 2

Re: [nznog] blaster worm
by Malcolm Lockyer 15 Aug '03

15 Aug '03

--snippity-- >Subject: Re: [nznog] blaster worm >Date: 15 Aug 2003 21:56:15 +1200 > >--snippity-- > >Make www.windowsupdate.com point to 127.0.0.1 so it doesn't do anything >or what? Except that it makes it a more effective DOS. Because then NOBODY can reach windowsupdate regardless - instead of just painfully slowly - or decently for whatever Akamai based reason. Time to hold onto whatever body part you guys value - here comes the storm. Although on a side note I hope the blaster infections are lower than I think they are - because all of you have been blocking netbios / 139tcp / etc. since this thing broke out. Right? Should be a more interesting 24 hours then eh? :-| m > >Thanks >Craig Whitmore >Orcon Internet >http://www.orcon.net.nz > --snippity-- _________________________________________________________________ Download MSN Messenger @ http://messenger.xtramsn.co.nz - talk to family and friends overseas!

2 1

OT: MP3 Players
by Dan Clark 12 Aug '03

12 Aug '03

Hey did anyone else get one of these MP3 players My version of the manual has no page 9 and 2 page 10's incl 2 covers ?? Also, how do ya get it to be recognised in WinXP? Kind Regards, Dan Clark Network Manager Scarfies.Net Ltd

6 5

ISPs / Sites blocking IPs?
by Steve Withers 10 Aug '03

10 Aug '03

All I'm on a TelstraClear / paradsie cable modem. When I try to access the web site for the "Indepednent" in the UK, I get: Access Denied You don't have permission to access "http://news.independent.co.uk/uk/environment/story.jsp?" on this server. I'm thinking they have started blocking IPs they may consider possible sources of SPAM.... Has anyone else seen this? Can everyone else access this site from their networks? I'm on 203.96.144.119. -- Steve Withers <swithers(a)mmp.org.nz>

4 3

Full URL
by Steve Withers 10 Aug '03

10 Aug '03

Sorry...the full URL is: http://news.independent.co.uk/uk/environment/story.jsp?story=431319 -- Steve Withers <swithers(a)mmp.org.nz>

1 0