- NZNOG - lists.nznog.org

FW: [nsp] Cisco Security Advisory: Cisco IOS Software SNMP Read-Write ILMI Community String Vulnerability
by Barry Raveendran Greene 26 Feb '01

26 Feb '01

-----Original Message----- From: nobody(a)cisco.com [mailto:nobody(a)cisco.com]On Behalf Of Cisco Systems Product Security Incident Response Team Sent: Tuesday, February 27, 2001 1:00 AM To: cisco-nsp(a)puck.nether.net Cc: psirt(a)cisco.com Subject: [nsp] Cisco Security Advisory: Cisco IOS Software SNMP Read-Write ILMI Community String Vulnerability -----BEGIN PGP SIGNED MESSAGE----- Cisco Security Advisory: Cisco IOS Software SNMP Read-Write ILMI Community String Vulnerability Revision 1.0: INTERIM For Public Release 2001 February 27 04:00 US/Eastern (UTC+0500) _______________________________________________________________ Summary Cisco IOS software releases based on versions 11.x and 12.0 contain a defect that allows a limited number of SNMP objects to be viewed and modified without authorization using a undocumented ILMI community string. Some of the modifiable objects are confined to the MIB-II system group, such as "sysContact", "sysLocation", and "sysName", that do not affect the device's normal operation but that may cause confusion if modified unexpectedly. The remaining objects are contained in the LAN-EMULATION-CLIENT and PNNI MIBs, and modification of those objects may affect ATM configuration. An affected device might be vulnerable to a denial-of-service attack if it is not protected against unauthorized use of the ILMI community string. The vulnerability is only present in certain combinations of IOS releases on Cisco routers and switches. ILMI is a necessary component for ATM, and the vulnerability is present in every IOS release that contains the supporting software for ATM and ILMI without regard to the actual presence of an ATM interface or the physical ability of the device to support an ATM connection. To remove this vulnerability, Cisco is offering free software upgrades for all affected platforms. The defect is documented in DDTS record CSCdp11863. In lieu of a software upgrade, a workaround can be applied to certain IOS releases by disabling the ILMI community or "*ilmi" view and applying an access list to prevent unauthorized access to SNMP. Any affected system, regardless of software release, may be protected by filtering SNMP traffic at a network perimeter or on individual devices. This notice will be posted at http://www.cisco.com/warp/public/707/ios-snmp-ilmi-vuln-pub.shtml. Affected Products The vulnerability is present only in certain releases of Cisco IOS Software versions 11.x and 12.0 for router and switch products that include support for Asynchronous Transfer Mode (ATM) networking and Interim Local Management Interface (ILMI), and it is present without regard to any physical capability for supporting an ATM interface. Cisco IOS Software versions based on 10.3 and earlier do not contain the vulnerability. The defect was introduced in 11.0(0.2). All Cisco IOS software releases of 12.1 and later have been repaired and are not vulnerable to the defect described in this advisory. To determine the software running on a Cisco product, log in to the device and issue the command "show version" to display the system banner. Cisco IOS software will identify itself as "Internetwork Operating System Software" or simply "IOS (tm)". The image name will be displayed between parentheses, usually on the next line of output, followed by "Version" and the IOS release name. Other Cisco devices will not have the "show version" command or will give different output. The following example identifies a Cisco product running IOS release 12.0(3) with an installed image name of C2500-IS-L: Cisco Internetwork Operating System Software IOS (tm) 2500 Software (C2500-IS-L), Version 12.0(3), RELEASE SOFTWARE The device is not vulnerable to the defect described in this advisory since the model 2500 router is specifically excluded in the list of unaffected products shown below. Cisco devices that may be running an affected IOS software release include, but are not limited to: * Cisco 1400 and 1700 series. * Cisco 2600 (except that c2600-c-mz, c2600-d-mz, c2600-i-mz, c2600-io3-mz, and c2600-ix-mz images are not vulnerable). * Catalyst 2900 ATM, 2900XL, and 2948g series. * Cisco 3620 (except that c3620-d-mz, c3620-i-mz, c3620-io3-mz, and c3620-ix-mz images are not vulnerable). * Cisco 3640 (except that c3640-d-mz, c3640-i-mz, c3640-io3-mz, and c3640-ix-mz images are not vulnerable). * Cisco 3660 (except that c3660-d-mz, c3660-i-mz, and c3660-ix-mz images are not vulnerable). * Cisco MC3810 (except that mc3810-i-mz, mc3810-is-mz, mc3810-is56i-mz, and mc3810-js-mz images are not vulnerable). * Catalyst 4232, 4840g, 5000 RSFC series switches. * Cisco 4500, 4700, and 5800 DSC series. * Cisco 6200, 6400 NRP, and 6400 NSP series. * Catalyst MSM (c6msm), 6000 Hybrid Mode (c6msfc), and 6000 Native Mode (c6sup). * Cisco RSM, 7000, 7010, 7100, 7200, ubr7200, and 7500 series. * Catalyst 8510CSR, 8510MSR, 8540CSR, and 8540MSR series. * Cisco 10000 ESR and 12000 GSR series. * LS1010 and Cisco 6260-NI2. * DistributedDirector (except that igs-w3 images are not vulnerable). Cisco products that are not affected by this vulnerability either because they have no support for ATM and ILMI, or because they do not run IOS include, but are not limited to: * Catalyst ATM blade (runs possibly affected code, but an SNMP connection to the blade is not possible). * Cisco 800 and 805 series. * Cisco Universal Broadband Routers ubr900 and ubr920. * Cisco 1003, 1004, and 1005 series. * Cisco 1600, 2500, 2800, 4000 series. * Cisco 2500 Fixed Frad. * Cisco 3800 (not to be confused with MC3810). * Cisco 5100, 5200, and 5300 series access servers. * Catalyst 6000 Supervisor Module. * Cisco PIX Firewall. * Aironet and Cisco/Aironet wireless products. * CS11000, Cache Engine, LocalDirector, and network scaling products (except that the Distributed Director might be affected). * VPN products such as Altiga concentrators. * Host-based network management or access management products. * Cisco IP Telephony and telephony management software (except those that are hosted on a vulnerable IOS platform). * Voice gateways and convergence platforms (except those that are hosted on a vulnerable IOS platform). * Optical switch products such as the ONS 15000 series. Details ILMI (Interim Local Management Interface) is an independent industry standard used for configuration of ATM (Asynchronous Transfer Mode) interfaces. The standard specifies the use of mechanisms and formats previously defined by SNMP (Simple Network Management Protocol). Although it is based on SNMP, ILMI communication actually occurs using a transport other than IP (Internet Protocol) that traverses only the physical ATM link. ILMI is essential to functions such as ATM auto-discovery and LANE (LAN Emulation). SNMP "objects" are variables that are organized into a MIB (Management Information Base). The MIB has a tree structure and contains both operational (read-only) data as well as configuration (read-write) options. By specifying a community string of "ILMI" in an SNMP request, access can be obtained to read the objects in three specific parts of the overall management tree structure on any device affected by this vulnerability: the MIB-II system group, the LAN-EMULATION-CLIENT MIB, and the PNNI (Private Network-to-Network Interface) MIB. A subset of objects in each part can be modified using the same "ILMI" community string. The MIB-II system group contains basic information about the device itself. The number of objects that can be modified is limited. Examples include: * system.sysContact: The contact information for the person or organization responsible for managing the device. * system.sysLocation: A description of the physical location where the device is installed or operating. * system.sysName: The hostname of the device, how it identifies itself at the console prompt. (This might not be the same name by which the device is known to other hosts on the network.) Most of the objects in the system MIB are read-only and cannot be changed via SNMP, such as the time elapsed since the previous restart and textual descriptions of the device's hardware and software. Numerous objects can be viewed in the LAN-EMULATION-CLIENT MIB and PNNI MIB, and modification of some of the read-write objects can have an affect on ATM operation of the device. The objects in the LAN-EMULATION-CLIENT MIB can only be viewed or modified if LANE has already been configured on the device. Access to SNMP in Cisco IOS software can be limited by applying access control lists (ACLs), by modifying or removing the SNMP view, by removing the community string from the running configuration, or by disabling the SNMP service. Any SNMP query that does not meet the criteria for access is promptly discarded when such protective measures are in place. If a query does meet the criteria for access, then a response is formulated and sent. It is possible to configure the device so that the ILMI community string is unavailable in all IOS 11.1 and higher releases. The particular method selected to accomplish this depends on the specific IOS release and configuration. This defect is documented as CSCdp11863. The vulnerability is repaired by imposing a test such that an SNMP request using the "ILMI" community string will only be recognized if it has been transported by ILMI. ATM functionality was added in various 10.x releases of Cisco IOS software. However, the function containing the defect was introduced when support for ILMI and other ATM features was added in IOS release 11.0(0.2). Therefore, all prior releases are not vulnerable. Impact If SNMP requests can be received by an affected device, then certain MIB objects can be viewed without proper authorization, causing a violation of confidentiality. A subset of the readable MIB objects can be modified without authorization to cause a failure of integrity. For example, the hostname can be modified so as to confuse network adminstrators, or the contact and location information could be changed with a goal of disrupting operations or embarassing whoever is responsible for the device. Objects in the LAN-EMULATION-CLIENT and PNNI MIBs can be viewed and modified, thus resulting in changes to the operation of ATM functions. If ATM is in use on the device, this may result in a failure of availability. Any affected device that is not otherwise protected against the receipt of SNMP packets is vulnerable to a denial-of-service (DoS) attack by flooding the SNMP port with read or write requests. Software Versions and Fixes The following table summarizes the known affected Cisco IOS software releases and the earliest estimated dates of availability for fixed releases. All dates are tentative and subject to change. Each row of the table describes a release train and the platforms or products for which it is intended. If a given release train is vulnerable, then the earliest possible releases that contain the fix and the anticipated date of availability for each are listed in the "Rebuild", "Interim", and "Maintenance" columns. If a device is running an earlier release that is known to be vulnerable, it should be upgraded to at least the indicated version. When selecting a release, keep in mind the following definitions: Maintenance Most heavily tested and highly recommended release of any label in a given row of the table. Rebuild Constructed from the previous maintenance or major release in the same train, it contains the fix for a specific defect. Although it receives less testing, it contains only the minimal changes necessary to effect the repair. Interim Built at regular intervals between maintenance releases and receive less testing. Interims should be selected only if there is no other suitable release that addresses the vulnerability. Interim releases are usually not available for customer download via CCO without prior arrangement. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco TAC for assistance as shown in the following section. More information on IOS release names and abbreviations is available at http://www.cisco.com/warp/public/620/1.html. +=========================================================================== + | Train | Description of | Availability of Fixed Releases* | | | Image or Platform | | +=========================================================================== + | 10.3-based Releases and | | | | | Earlier | Rebuild | Interim** | Maintenance | +=========================================================================== + | 10.3 and | | | | earlier |All |Not affected | +=========================================================================== + | 11.0-based Releases | Rebuild | Interim** | Maintenance | +=========================================================================== + | | |11.0(22a) | | | | 11.0 |Major GD release | | | | | |for all platforms |2001-Mar-05 | | | +=========================================================================== + | 11.1-based Releases | Rebuild | Interim** | Maintenance | +=========================================================================== + | | |11.1(24a) | | | | 11.1 |Major release for | | | | | |all platforms |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | |ED release for | | |12.1(7) | | 11.1AA |access servers: | | | | | |1600, 3200, and | | | | | |5200 series. | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | |Platform-specific |11.1(36)CA1 | | | | 11.1CA |support for 7500, | | | | | |7200, 7000, and RSP|2001-Mar-02 | | | +----------+-------------------+------------+---------------+--------------- + | |ISP train: added | | | | | |support for FIB, |11.1(36)CC1 | | | | 11.1CC |CEF, and NetFlow on| | | | | |7500, 7200, 7000, |2001-Mar-02 | | | | |and RSP | | | | +----------+-------------------+------------+---------------+--------------- + | |Added support for |12.0(11)ST2 | | | | 11.1CT |Tag Switching on | | | | | |7500, 7200, 7000, | | | | | |and RSP |2001-Feb-26 | | | +----------+-------------------+------------+---------------+--------------- + | | |11.1(28)IA1 | | | | 11.1IA |DistributedDirector| | | | | |only |2001-Feb-26 | | | +=========================================================================== + | 11.2-based Releases | Rebuild | Interim** | Maintenance | +=========================================================================== + | | |11.2(25a) | | | | 11.2 |Major release, | | | | | |general deployment |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | |Platform-specific | | | | | |support for IBM | | |12.1(7) | | 11.2BC |networking, CIP, | | | | | |and TN3270 on 7500,| | |2001-Feb-26 | | |7000, and RSP | | | | +----------+-------------------+------------+---------------+--------------- + | |Early deployment |12.0(15)S1 | | | | 11.2GS |release to support | | | | | |12000 GSR |2001-Feb-20 | | | +----------+-------------------+------------+---------------+--------------- + | | |11.2(25a)P | | | | 11.2P |New platform | | | | | |support |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | | | | |12.1WC | | 11.2SA |Catalyst 2900XL | | | | | |switch only | | |2001-Apr-12 | +----------+-------------------+------------+---------------+--------------- + | | | | |12.0(10)W5(18c)| | 11.2WA3 |LS1010 ATM switch | | | | | | | | |Available | +----------+-------------------+------------+---------------+--------------- + | | |11.2(25a)P | | | |11.2(4)XA |Initial release for| | | | | |the 1600 and 3600 |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | |Initial release for| | | | | |the 5300 and |11.2(9)XA1 | | | |11.2(9)XA |digital modem | | | | | |support for the |Unscheduled | | | | |3600 | | | | +=========================================================================== + | 11.3-based Releases | Rebuild | Interim** | Maintenance | +=========================================================================== + | | |11.3(11b) | | | | 11.3 |Major release for | | | | | |all platforms |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | |ED for dial | | | | | |platforms and |11.3(11a)AA | | | | 11.3AA |access servers: | | | | | |5800, 5200, 5300, |2001-Mar-05 | | | | |7200 | | | | +----------+-------------------+------------+---------------+--------------- + | |Early deployment |12.1(5)DA1 | | | | 11.3DA |train for ISP DSLAM| | | | | |6200 platform |2001-Feb-28 | | | +----------+-------------------+------------+---------------+--------------- + | |Early deployment | | | | | |train for |12.1(4)DB1 | | | | |ISP/Telco/PTT xDSL | | | | | 11.3DB |broadband | | | | | |concentrator | | | | | |platform, (NRP) for|2001-Feb-26 | | | | |6400 | | | | +----------+-------------------+------------+---------------+--------------- + | |Short-lived ED | | | 11.3HA |release for ISR |Not Vulnerable | | |3300 (SONET/SDH | | | |router) | | +----------+-------------------+------------+---------------+--------------- + | | |11.3(1)MA8 | | | | 11.3MA |MC3810 | | | | | |functionality only |Unscheduled | | | +----------+-------------------+------------+---------------+--------------- + | |Voice over IP, |12.1(7) | | | | 11.3NA |media convergence, | | | | | |various platforms |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | |Early deployment |11.3(11b)T1 | | | | 11.3T |major release, | | | | | |feature-rich for | | | | | |early adopters |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | |Multilayer | | | | | |Switching and | | |12.0(14)W5(20) | | |Multiprotocol over | | | | | 11.3WA4 |ATM functionality | | | | | |for Catalyst 5000 | | | | | |RSM, 4500, 4700, | | |2001-Feb-28 | | |7200, 7500, LS1010 | | | | +----------+-------------------+------------+---------------+--------------- + | | |11.3(11b)T1 | | | |11.3(2)XA |Introduction of | | | | | |ubr7246 and 2600 |2001-Mar-05 | | | +=========================================================================== + | 12.0-based Releases | Rebuild | Interim** | Maintenance | +=========================================================================== + | |General deployment | |12.0(7.1) |12.0(16) | | 12.0 |release for all | | | | | |platforms | |Available |2001-Feb-20 | +----------+-------------------+------------+---------------+--------------- + | | | |12.0(7.1)T | | | 12.0DA |xDSL support: 6100,| | | | | |6200 | |Available | | +----------+-------------------+------------+---------------+--------------- + | |ISP/Telco/PTT xDSL |12.1(4)DB1 | | | | 12.0DB |broadband | | | | | |concentrator | | | | | |platforms |2001-Feb-26 | | | +----------+-------------------+------------+---------------+--------------- + | | |12.1(4)DC2 | | | | 12.0DC |6400 Access | | | | | |Concentrator |2001-Feb-26 | | | +----------+-------------------+------------+---------------+--------------- + | | |12.0(15)S1 | | | | 12.0S |Core/ISP support: | | | | | |GSR, RSP, c7200 |2001-Feb-20 | | | +----------+-------------------+------------+---------------+--------------- + | | |12.0(15)SC1 | | | | 12.0SC |Cable/broadband | | | | | |ISP: ubr7200 |2001-Feb-26 | | | +----------+-------------------+------------+---------------+--------------- + | | |12.0(14)SL1 | | | | 12.0SL |10000 ESR: c10k | | | | | | |2001-Feb-26 | | | +----------+-------------------+------------+---------------+--------------- + | |General deployment |12.0(11)ST2 | | | | 12.0ST |release for all | | | | | |platforms |2001-Feb-26 | | | +----------+-------------------+------------+---------------+--------------- + | | |12.1(5c)E8 | | | | 12.0SX |Early Deployment | | | | | |(ED) |2001-Feb-26 | | | +----------+-------------------+------------+---------------+--------------- + | |Early | | | | | |Deployment(ED): | | |12.1(7) | | 12.0T |VPN, Distributed | | | | | |Director, various | | |2001-Feb-26 | | |platforms | | | | +----------+-------------------+------------+---------------+--------------- + | |cat8510c, cat8540c,| | | | | |ls1010, cat8510m, | |12.0(10)W5(18c)|12.0(14)W5(20) | | |cat8540m, c5atm, | | | | | |c5atm, c3620, | | | | | |c3640, c4500, | | | | | 12.0W5 |c5rsfc, c5rsm, | |Available |2001-Feb-28 | | |c7200, rsp, | | | | | |cat2948g, cat4232 | | | | | +-------------------+------------+---------------+---------------+ | | | |12.0(10)W5(18d)|12.0(14)W5(20) | | |c6msm | | | | | | | |Available |2001-Feb-28 | +----------+-------------------+------------+---------------+--------------- + | |General deployment | | |12.0(13)WT6(1) | | 12.0WT |release for all | | | | | |platforms | | |2001-Feb-20 | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | |12.1(7) | | 12.0XA |(ED): limited | | | | | |platforms | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | | | | |12.1(7) | | 12.0XB |Short-lived early | | | | | |deployment release | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | |12.1(7) | | 12.0XC |(ED): limited | | | | | |platforms | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | |12.1(7) | | 12.0XD |(ED): limited | | | | | |platforms | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment |12.1(5c)E8 | | | | 12.0XE |(ED): limited | | | | | |platforms |2001-Feb-26 | | | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | |12.1(7) | | 12.0XF |(ED): limited | | | | | |platforms | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | |12.1(7) | | 12.0XG |(ED): limited | | | | | |platforms | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment |12.0(4)XH5 | | | | 12.0XH |(ED): limited | | | | | |platforms |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | |12.1(7) | | 12.0XI |(ED): limited | | | | | |platforms | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | |12.1(7) | | 12.0XJ |(ED): limited | | | | | |platforms | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment |12.0(7)XK4 | | | | 12.0XK |(ED): limited | | | | | |platforms |Unscheduled | | | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment |12.0(4)XH5 | | | | 12.0XL |(ED): limited | | | | | |platforms |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | | | | |12.1(7) | | 12.0XM |Short-lived early | | | | | |deployment release | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | | | | 12.0XN |(ED): limited | | | | | |platforms | | | | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | |12.1WC | | 12.0XP |(ED): limited | | | | | |platforms | | |2001-Apr-12 | +----------+-------------------+------------+---------------+--------------- + | | | | |12.1(7) | | 12.0XQ |Short-lived early | | | | | |deployment release | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | | |12.1(5)T5 | | | | 12.0XR |Short-lived early | | | | | |deployment release |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | | |12.1(5c)E8 | | | | 12.0XS |Short-lived early | | | | | |deployment release |2001-Feb-26 | | | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | |12.1WC | | 12.0XU |(ED): limited | | | | | |platforms | | |2001-Apr-12 | +----------+-------------------+------------+---------------+--------------- + | | |12.1(5)T5 | | | | 12.0XV |Short-lived early | | | | | |deployment release |2001-Mar-05 | | | +=========================================================================== + |12.1-based and Later Releases | Rebuild | Interim** | Maintenance | +=========================================================================== + | All 12.1 | | | | Releases |Various platforms |Not Vulnerable | +=========================================================================== + | Notes | +=========================================================================== + | * All dates are estimated and Subject to change. | | | |** Interim releases are subjected to less rigorous testing than regular | | maintenance releases, and may have serious bugs. | +=========================================================================== + Obtaining Fixed Software Cisco is offering free software upgrades to remedy this vulnerability for all affected customers. Customers with service contracts may upgrade to any software release. Customers without contracts may upgrade only within a single row of the table above, except that any available fixed software release will be provided to any customer who can use it and for whom the standard fixed software release is not yet available. Customers may install only the feature sets they have purchased. Note that not all fixed software may be available as of the release date of this notice. Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained via Cisco's Software Center at http://www.cisco.com/. Customers without contracts or warranty should get their upgrades by contacting the Cisco Technical Assistance Center (TAC) as shown below: * (800) 553-2447 (toll-free in North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com See http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including instructions and e-mail addresses for use in various languages. Give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Please do not contact either "psirt(a)cisco.com" or "security-alert(a)cisco.com" for software upgrades; faster results will be obtained by contacting the TAC directly. Workarounds Several workarounds are available based on customer needs, equipment, and software features. The usefulness and practicality of each workaround depends on the IOS release running on the device and many variables in the customer's environment. Customers are urged to consider each of the following alternatives carefully before deploying. These workarounds are only needed if it is not possible to upgrade to an unaffected release of IOS software. A. Default workaround for use with releases for which no other workarounds are effective: 1. Applying access lists to all the interfaces of the vulnerable device blocking SNMP from all hosts but those authorized to manage the devices. 2. Blocking SNMP access at the edge of the network to prevent undesirable SNMP traffic from entering the network containing the vulnerable device. Access lists should be deployed with careful consideration of the possible effects on network operation and performance. Also note that authentication based on an IP source address is weak, so the preceding method will not protect against certain types of attacks in which the IP source address has been spoofed. Further information can be found in the Cisco document "Improving Security on Cisco Routers", available at http://www.cisco.com/warp/public/707/21.html B. For affected releases based on IOS 11.1: 1. Remove the view so that the ILMI community cannot be reached: no snmp-server view *ilmi 2. This configuration will not survive a system reload. The command must be re-entered after every restart of the system. C. For affected releases of IOS 11.2 through 11.3(8) NOT REQUIRING ATM: In this affected range of releases, the ILMI community string can be modified or deleted. However, the changes will not persist through a reboot of the device. These instructions must be re-applied following every system reload of the affected device: 1. Expose the undocumented ILMI community string so it can be modified: snmp-server community ILMI RW The preceding command may cause an error that can be safely ignored. 2. Disable read-write capability for the same community: no snmp-server community ILMI RW If an error is displayed, then this workaround cannot be applied to the device. Use the default workarounds presented in the first item above. 3. Since this configuration will not survive a system reload, the command must be re-entered after every restart of the system. If the command in item 2 above did not generate an error and ATM is not needed on this device, then this workaround is complete. D. For affected releases of IOS 11.2 through 11.3(8) THAT REQUIRE ATM: This workaround will allow ILMI to continue to function for ATM while constraining who may reconfigure the device by way of the ILMI community string: 1. Create a simple ACL to deny access using the following command. If "66" is already in use, choose a different two-digit number: access-list 66 deny any 2. Apply it generally to the ILMI community to restrict its view: snmp community ILMI view *ilmi RW 66 An error will be reported if the *ilmi view doesn't exist. If that occurs, then use the following command to explicitly restrict the ILMI view: snmp community ILMI RW 66 If the preceding command produces persistent errors, then this workaround cannot be applied to this device. Use the default workarounds presented in the first item above. E. For affected releases of IOS 11.3(9) through 12.0(2)T NOT REQUIRING ATM: All versions of IOS in this range will accept this workaround, and the change will remain in place after a system reload. 1. Expose the undocumented ILMI community string so it can be modified: snmp-server community ILMI RW The preceding command may cause an error that can be safely ignored. 2. Disable read-write capability for the same community: no snmp-server community ILMI RW If an error is displayed, then this workaround cannot be applied to the device. Stop this procedure and use the default workarounds presented in the first item above. F. For affected releases of IOS 11.3(9) through 12.0(2)T THAT REQUIRE ATM: This workaround will allow ILMI to continue to function for ATM while constraining who may reconfigure the device by way of the ILMI community string: 1. Create a simple ACL to deny access using the following command. If "66" is already in use, choose a different two-digit number: access-list 66 deny any 2. Apply it generally to the ILMI community to restrict its view: snmp community ILMI view *ilmi RW 66 An error will be reported if the *ilmi view doesn't exist. If that occurs, then use the following command to explicitly restrict the ILMI view: snmp community ILMI RW 66 If the preceding command produces persistent errors, then this workaround cannot be applied to this device. Use the default workaround presented in the first item above. G. For affected releases of IOS 12.0(3)T and later: These releases of IOS include support for Simple Network Management Protocol version 3 (SNMPv3), which is required for this workaround. 1. Confirm the presence of SNMPv3 support by asking the console CLI (command-line interpreter) for assistance with options to complete the snmp-server command. Enter config mode, enter the command shown below, and note the expected response: snmp-server user test test ? remote Specify a remote SNMP entity to which the user belongs v1 user using the v1 security model v2c user using the v2c security model v3 user using the v3 security model If the preceding command did not produce the expected results, then SNMPv3 is not supported in the release and this workaround cannot be applied. Stop this procedure and consider applying the default workaround presented above in the first item. Otherwise, if the device responded as expected, continue with the following explanation and instructions. In these IOS releases (12.0(3)T and later), ILMI packets are processed by the SNMP engine in the same manner as ordinary IP SNMP packets. An access control list or a view applied to the ILMI community string will be processed whether the transport is ILMI or IP. However, the only types of access control lists that can be applied to a community string are via IP access-list statements, which when applied, block ALL non-IP packets, including ILMI packets. Modifying or deleting the *ilmi view will also affect the packets transported by ILMI, so workarounds that change the view are equally ineffective at permitting ILMI while denying SNMP. In this range of releases, it is not possible to apply a workaround that denies IP SNMP packets that does not also deny ILMI SNMP packets. H. For affected releases of IOS 12.0(3)T and later NOT REQUIRING ATM: 1. Expose the undocumented ILMI community string so it can be modified: snmp-server community ILMI RW The preceding command may cause an error that can be safely ignored. 2. Disable read-write capability for the same community: no snmp-server community ILMI RW If an error is displayed, then this workaround cannot be applied to the device. Stop this procedure and consider using the default workaround. I. For affected releases of IOS 12.0(3)T and later THAT REQUIRE ATM: NOTE: This section also applies to 12.0-based ATM switch software such as for the LS1010 and the 8500 series. The only effective workaround for systems in this category is the default workaround: 1. Applying access lists to all the interfaces of the vulnerable device blocking SNMP from all hosts but those authorized to manage the devices. 2. Blocking SNMP access at the edge of the network to prevent undesirable SNMP traffic from entering the network containing the vulnerable device. Access lists should be deployed with careful consideration of the possible effects on network operation and performance. Also note that authentication based on an IP source address is weak, so the preceding method will not protect against certain types of attacks in which the IP source address has been spoofed. In this range of releases it is not possible to block IP SNMP packets while permitting ILMI SNMP packets. The alternative workarounds presented previously will almost certainly cause a failure of ATM ILMI communications resulting in a loss of ATM connectivity, either immediately upon configuration, or unexpectedly at some later time. Either use the default workaround or upgrade to fixed software. Exploitation and Public Announcements This vulnerability is known to the engineering staff of several Cisco customers. Cisco considers it known to the public prior to the publication of this notice. Cisco is aware of one recent incident involving the unauthorized modification of a router that appears to have resulted from this vulnerability. However, it may have been the unintended side-effect of a test of the vulnerability. Cisco is not aware of any available tools specifically designed to make use of this vulnerability. However, various off-the-shelf network management programs could easily be used to test for this vulnerability and to exploit it. Certain widely-available programs known to the cracker community could be modified by any reasonably competent programmer to automate the abuse of this vulnerability. Cisco is not aware of any general public discussion of this vulnerability other than the exceptions previously noted. Status of This Notice: INTERIM This is an interim security advisory. Cisco anticipates issuing updated versions of this notice at irregular intervals as there are material changes in the facts, and will continue to update this notice as necessary. The reader is warned that this notice may contain inaccurate or incomplete information. Although Cisco cannot guarantee the accuracy of all statements in this notice, all of the facts have been checked to the best of our ability. Cisco anticipates issuing monthly updates of this notice until it reaches FINAL status. A standalone copy or paraphrase of the text of this security advisory that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution This notice will be posted at http://www.cisco.com/warp/public/707/ios-snmp-ilmi-vuln-pub.shtml . In addition to Worldwide Web posting, a text version of this notice will be clear-signed with the Cisco PSIRT PGP key and will be posted to the following e-mail and Usenet news recipients: * cust-security-announce(a)cisco.com * bugtraq(a)securityfocus.com * firewalls(a)lists.gnac.com * first-teams(a)first.org (including CERT/CC) * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * comp.dcom.sys.cisco * Various internal Cisco mailing lists Future updates of this notice, if any, will be placed on Cisco's Worldwide Web server, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the URL given above for any updates. Revision History Revision 1.0 2001-Feb-27 First interim public version Cisco Product Security Incident Procedures Instructions for reporting product security vulnerabilities in Cisco products, obtaining assistance with customer security incidents, and registering to receive security information from Cisco can be found at http://www.cisco.com/warp/public/707/sec_incident_response.shtml , including instructions for press inquiries regarding Cisco Security Advisories. _______________________________________________________________ Copyright 2001 by Cisco Systems, Inc. This notice may be redistributed freely after the release date given at the top of the text, provided that redistributed copies are complete and unmodified, and include all date and version information. _______________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.2 iQEVAwUBOpuPFWiN3BRdFxkbAQEmvAf+Ng5nJtzMpp2Dl/N+ZDp4/4Ul1nqMt89P IcNr/9AKa/jCMKNE8z20/tql78f0oniJ3YfR2GcoFfgfRCRKEVJ5QvzH3r+8BLA2 9YRsmxg/96aVwMP9gLoh4RiO4+qoTwSZkOBJ/DlZFzM7TG8SjKvgtjqcHWiLH9wx /YnxrVWg0jmnY9NvsRQSmS4KvKjFXZXaUBzlH8pOcrY9+vScS6ol+HwCiQOynQYn 2sG+KEapKP/ld2iDcHZPjbFfVsKm+iCtMzcroqpA+ND3ezBeNe2yjJXZG9oWUiVR zLYima8yuU5Mm18b3BoBkM2npf5QP/zRinis9A8d+mlnPemAWVoWug== =xM8n -----END PGP SIGNATURE----- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: [jamesr@rd.bbc.co.uk: Warning: Cisco RW community backdoor.]
by Andy Linton 26 Feb '01

26 Feb '01

At 14:44 27/02/2001 +1300, David Robb wrote: >On Tue, 27 Feb 2001, Chris Wedgwood wrote: > > > Unless you have IOS 11.1 where this doesn't work :) > > > > "no snmp-server" > >11.2 seems to require the same treatment. I tried the "patch" on IOS 11.2 and 11.3 boxes such as 2500s and 2924 switches. I had to leave out the "log'" option on the access list. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Cisco IOS ILMI/SNMP
by Roger De Salis 26 Feb '01

26 Feb '01

Gentlefolks, Cisco has become aware of an issue with ILMI (and there is is another advisory pending) across several versions of IOS. Please look at the PSAT pages on www.cisco.com, as info will be available very shortly with full details. Rgds Roger De Salis James A.T. Rice wrote > Its looks like parts of my earlier email are somewhat misleading, > the ILMI community appears to only allow RW access to the system > object and possibly some more objects. Its not a 'standard' open > RW community. hence the damage caused by this backdoor is limited. > There is still some write access however, so the fix mentioned > below is still highly recommended. > > And of course - it allows people to read what IOS/model cisco > you have, which could be used to find exploitable bugs in that > particular release. Oh I wonder what the chances of having a > router stolen due to discovery of system.sysLocation is! :-) > > Warm Regards > James -- \_ Roger De Salis Cisco Systems NZ Ltd </' +64 25 481 452 L8, ASB Tower, 2 Hunter St /) +64 4 496 9003 Wellington, New Zealand (/ roger(a)desalis.gen.nz rdesalis(a)cisco.com ` --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

[jamesr@rd.bbc.co.uk: Warning: Cisco RW community backdoor.]
by Joe Abley 26 Feb '01

26 Feb '01

----- Forwarded message from "James A. T. Rice" <jamesr(a)rd.bbc.co.uk> ----- Date: Tue, 27 Feb 2001 00:39:38 +0000 (GMT) From: "James A. T. Rice" <jamesr(a)rd.bbc.co.uk> X-Sender: <jamesr(a)inet15> To: <members(a)lonap.net>, <ops(a)linx.net> Subject: Warning: Cisco RW community backdoor. Precedence: bulk If your router responds to `snmpwalk router.isp.net.uk ILMI`, you probabally will want to do the following to disable it: conf t snmp-server community ILMI RO 99 access-list 99 deny any log (pick another spare access-list if 99 isn't available) If you dont, assuming your ios/hardware combination supports it, (most of the bigger routers do) anyone can do things like: `snmpset router.isp.net.uk ILMI system.sysName.0 s \ "ALL YOUR ROUTER ARE BELONG TO US."` Thats a harmless example. You can do almost anything with RW snmp. Warm Regards James -- James A. T. Rice | Email: jamesr(a)rd.bbc.co.uk Internet Operations Engineer | Phone: 01737 839 737 BBC Internet Services, Kingswood Warren, Tadworth, Surrey, UK. ----- End forwarded message ----- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

IOS & BGP
by James Tyson 26 Feb '01

26 Feb '01

Does anyone know what version of IOS the "bgp go faster you bitch" command appears in? It doesnt appear to be in 12.0(14)S. Sigh. Cheers. James Tyson --- Samizdat New Media Solutions --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

RE: ATM card in Cisco 4500
by Scott, Arron 25 Feb '01

25 Feb '01

Not speaking on behalf of any company in particular, I just wanted to say I know of a number of 4500's and 4700's running in production with the ATM card. Their throughput is limited by the CPU performance, but you can expect to get upwards of 40Mbps through it. If you want more than an OC3 I would suggest you look at something like a 7600 OSR, not speaking on behalf of any company in particular of course. Now we just need a Telco or three in NZ to support ATM at STM-4 rates. Arron Scott -----Original Message----- From: owner-nznog(a)list.waikato.ac.nz [mailto:owner-nznog(a)list.waikato.ac.nz]On Behalf Of Dennis Su Sent: Tuesday, 20 February 2001 7:04 p.m. To: nznog(a)list.waikato.ac.nz Subject: ATM card in Cisco 4500 Hi, We would like to purchase a ATM card for a Cisco 4500. Someone has mentioned to us that its ATM card is not very stable, although I doubt it. 4500 series router has been on the market for such a long time after all. I wonder if anyone can give us some previous experience. Good or bad and what type, all welcome. Thanks, Dennis ------------------------------------------------------------------------ ---- ----------------- Dennis Su, BSc MSc Network+ MCP CCNA CCDA CCNP CCDP Team Leader, Network Admin and Development IT Infrastructure, ITS, University of Waikato Hamilton, New Zealand phone:64 7 838 4183 email:d.su(a)waikato.ac.nz http://network-services.its.waikato.ac.nz/people/dennis.html --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

6 11

software required -- could be urgent
by Chris Wedgwood 24 Feb '01

24 Feb '01

... but probably it's not. Serious network software required. Only the network part isn't completely true :) I _need_ RollCage or RollCage II -- if I don't get this I'm sure something serious will happen; the entire Internet will stop routing or something. I am sure it will. I can feel it. I know the former was for sale at the warehouse for 20 bucks or so, but I can't find it now... the later, no idea. They are both old games by todays standards. Someone somewhere must have either both or one of these games. ... please ... :) --cw P.S. SPAM SPAM SPAM SPAM SPAM SPAM SPAM! --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: ATM card in Cisco 4500
by Scott, Arron 22 Feb '01

22 Feb '01

ATM is FAR WORSE than that, but it helps sell stuff in New Zealand ;-) Arron Scott Not speaking for any company in particular -----Original Message----- From: Joe Abley [mailto:jabley(a)automagic.org] Sent: Friday, 23 February 2001 3:49 a.m. To: Scott, Arron Cc: Dennis Su; nznog(a)list.waikato.ac.nz Subject: Re: ATM card in Cisco 4500 On Thu, Feb 22, 2001 at 02:17:09PM +1100, Scott, Arron wrote: > Now we just need a Telco or three in NZ to support ATM at STM-4 > rates. Is anybody really waiting for that? If you're shifting an STM-4s worth of data around, it's probably a stream of packets, and it's probably IP, and you probably want to use POS. You probably don't want the additional complexity, cost, operational overhead, cell tax and SAR latency that using ATM would involve. Also, ATM is the work of Satan, which should be mentioned, for the record. Joe --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

6 5

RE: ATM card in Cisco 4500
by Scott, Arron 22 Feb '01

22 Feb '01

Yeah yeah ... we're all telling the Service Providers that Broadband is critical, but that still doesn't change the fact that ATM aggregation, ADSL/FR access, legacy support, and the ability to run a fair bit of point-to-point bandwidth over an STM-4 ATM access is still quite attractive for a market like NZ. And being one who had to fight VERY hard to get POS inside a certain Telco here at all, I would love to see more widespread use of it. STM/4 ATM gives my customers what they want and need, not what I want to sell !!! Arron Scott -----Original Message----- From: dean(a)flatnet.gen.nz [mailto:dean(a)flatnet.gen.nz] Sent: Friday, 23 February 2001 4:45 p.m. To: Scott, Arron Cc: Joe Abley; nznog(a)list.waikato.ac.nz Subject: Re: ATM card in Cisco 4500 I'd rather sell something that had a future, and not cripple networking in NZ any more than it already is. No matter how much easier it made the sale. Customers listen to what vendors have to say. Vendors should be telling them the truth, not just what they think will make the sale. Long live POS =) Dean Not speaking for, or about, any company in particular On Fri, Feb 23, 2001 at 02:01:55PM +1100, Scott, Arron wrote: > ATM is FAR WORSE than that, but it helps sell stuff in New Zealand ;-) > > Arron Scott > Not speaking for any company in particular > > -----Original Message----- > From: Joe Abley [mailto:jabley(a)automagic.org] > Sent: Friday, 23 February 2001 3:49 a.m. > To: Scott, Arron > Cc: Dennis Su; nznog(a)list.waikato.ac.nz > Subject: Re: ATM card in Cisco 4500 > > > On Thu, Feb 22, 2001 at 02:17:09PM +1100, Scott, Arron wrote: > > Now we just need a Telco or three in NZ to support ATM at STM-4 > > rates. > > Is anybody really waiting for that? If you're shifting an STM-4s worth > of data around, it's probably a stream of packets, and it's probably IP, > and you probably want to use POS. You probably don't want the additional > complexity, cost, operational overhead, cell tax and SAR latency that > using ATM would involve. > > Also, ATM is the work of Satan, which should be mentioned, for the > record. > > > Joe > --------- > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > where the body of your message reads: > unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: ATM card in Cisco 4500
by dean＠flatnet.gen.nz 21 Feb '01

21 Feb '01

Having a look on the Cisco Web site it seems that the fastest interface is an oc3. http://www.cisco.com/univercd/cc/td/doc/pcat/4700m.htm It might be an old website though. If it were me I would POC this to death before I bought it. The 4500 is pretty old and MAY not be able to feed an oc12 and do everything that you want it to do. Dean (Who does not speak on behalf of any employer) On Thu, Feb 22, 2001 at 11:40:17AM +1300, Lindsay Druett wrote: > OC12 > > -----Original Message----- > From: dean(a)flatnet.gen.nz [mailto:dean(a)flatnet.gen.nz] > Sent: Thursday, 22 February 2001 11:39 > To: nznog(a)list.waikato.ac.nz > Subject: Re: ATM card in Cisco 4500 > > > > On Wed, Feb 21, 2001 at 04:04:21PM +1300, Dennis Su wrote: > > > We would like to purchase a ATM card for a Cisco 4500. Someone has > > > mentioned to us that its ATM card is not very stable, although I doubt > it. > > > 4500 series router has been on the market for such a long time after > all. I > > > wonder if anyone can give us some previous experience. Good or bad and > what > > > type, all welcome. > > What speed ATM are you talking here? > > > Dean > (Who does not speak on behalf of any employer) > --------- > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > where the body of your message reads: > unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 2

Re: ATM card in Cisco 4500
by dean＠flatnet.gen.nz 21 Feb '01

21 Feb '01

=) No Problems. I'd still POC it, But thats just me. Dean (Who does not speak on behalf of any employer) On Thu, Feb 22, 2001 at 12:06:03PM +1300, Lindsay Druett wrote: > I beg your pardon, it is an OC3 indeed (what was I thinking ?) > > -----Original Message----- > From: dean(a)flatnet.gen.nz [mailto:dean(a)flatnet.gen.nz] > Sent: Thursday, 22 February 2001 11:50 > To: Lindsay Druett; nznog(a)list.waikato.ac.nz > Subject: Re: ATM card in Cisco 4500 > > > > Having a look on the Cisco Web site it seems that the fastest interface is > an oc3. > http://www.cisco.com/univercd/cc/td/doc/pcat/4700m.htm > > It might be an old website though. > > If it were me I would POC this to death before I bought it. The 4500 is > pretty old and MAY not be able to feed an oc12 and do everything that you > want it to do. > > > Dean > (Who does not speak on behalf of any employer) > > On Thu, Feb 22, 2001 at 11:40:17AM +1300, Lindsay Druett wrote: > > OC12 > > > > -----Original Message----- > > From: dean(a)flatnet.gen.nz [mailto:dean(a)flatnet.gen.nz] > > Sent: Thursday, 22 February 2001 11:39 > > To: nznog(a)list.waikato.ac.nz > > Subject: Re: ATM card in Cisco 4500 > > > > > > > On Wed, Feb 21, 2001 at 04:04:21PM +1300, Dennis Su wrote: > > > > We would like to purchase a ATM card for a Cisco 4500. Someone has > > > > mentioned to us that its ATM card is not very stable, although I doubt > > it. > > > > 4500 series router has been on the market for such a long time after > > all. I > > > > wonder if anyone can give us some previous experience. Good or bad and > > what > > > > type, all welcome. > > > > What speed ATM are you talking here? > > > > > > Dean > > (Who does not speak on behalf of any employer) > > --------- > > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > > where the body of your message reads: > > unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

ATM card in Cisco 4500
by Dennis Su 21 Feb '01

21 Feb '01

Hi, We would like to purchase a ATM card for a Cisco 4500. Someone has mentioned to us that its ATM card is not very stable, although I doubt it. 4500 series router has been on the market for such a long time after all. I wonder if anyone can give us some previous experience. Good or bad and what type, all welcome. Thanks, Dennis ---------------------------------------------------------------------------- ----------------- Dennis Su, BSc MSc Network+ MCP CCNA CCDA CCNP CCDP Team Leader, Network Admin and Development IT Infrastructure, ITS, University of Waikato Hamilton, New Zealand phone:64 7 838 4183 email:d.su(a)waikato.ac.nz http://network-services.its.waikato.ac.nz/people/dennis.html --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

FYI: ihug DNS server ips.
by Simon Lyall 20 Feb '01

20 Feb '01

Just a note that ihug is in the process of changing it's main DNS ips (as used by customers). Previously almost all customers were using 203.29.160.4 and 203.29.160.2 but we have now switched to 203.109.252.42 and 203.109.252.43. It is likely that there are 10,000s of ihug and ex-ihug customers with the old ip's manually setup in their configurations. Since we are returning these networks to Telstra they will cease being advertised outside our network sometime next week. You may wish to warn your helpdesk to keep an eye open for this. -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | | Home: simon(a)darkmere.gen.nz ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

New 2LD Voting - Feedback request
by Sue Leader 19 Feb '01

19 Feb '01

Greetings There will be a meeting of the Council of the Society this Friday the 23rd. The Council will consider the following options in regard to voting rights for new 2LD applications. Your comments are encouraged: ================= Motion 1 Abstract The Request for Votes for the .bank.nz application requires a voting electorate. After review and consideration 3 options have been presented for discussion and voting. Option 1 The electorate for the RFV shall be members of good standing of ISOCNZ as of the day before the vote is called. Reason: Known community that is easy to reach and identify which has a greater propensity to understand the issues surrounding the vote. Option 2 The electorate for the RFV shall be name holders or name holder representatives of a name in the .nz name space. A person would be only be able to vote once no matter how many names they had that qualified. Reason: The addition of a new 2LD directly affects current name holders. By having a name in the .nz spaces means they are an existing stakeholder in the .nz name space. Option 3 The electorate for the RFV shall be any person that has an email address in the .nz name space, i.e. steven.heath(a)isocnz.org.nz but not steven.heath(a)seranova.com. A person would be only be able to vote once no matter how many email addresses they had that qualified. Reason: By having an address in the .nz name space means they have an affinity with .nz and provides the widest possible community. Also does not exclude anyone based on having membership or an existing name. Preferred Motion 1 wording: That the electorate for the RFV for the .bank.nz be any person that has an email address in the .nz name space. A person would be only be able to vote once no matter how many email addresses they had that qualified. ======= Cheers Sue Sue Leader - Executive Director ISOCNZ (Internet Society of New Zealand Inc) Exe.Dir(a)isocnz.org.nz Voice: +64-4-801-6256 http://www.isocnz.org.nz PLEASE NOTE CHANGE: P.O.Box 11-881, Wellington --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Deadline Extension - Green Paper
by Sue Leader 15 Feb '01

15 Feb '01

Greetings The Society has received requests for extension of the deadline for the SRS Implementation as the notification was not received by everyone on Feb 2 when I orginally sent it out. I resent the notice on the 8th, as even though the message went to the archives and some people had received it, clearly not everyone had. On that basis the Chair has agreed to an extension until Friday March 2 - 5:00pm. Please send all Submissions to me direct for collation. Cheers Sue Sue Leader - Executive Director ISOCNZ (Internet Society of New Zealand Inc) Exe.Dir(a)isocnz.org.nz Voice: +64-4-801-6256 http://www.isocnz.org.nz Postal: Level 1, (e)-Vision Centre, 282 Wakefield St, Wellington "Error: Press any key to continue or any other key to quit..." --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

ORBS blocking Domainz servers
by Don Stokes 15 Feb '01

15 Feb '01

Hello All, A heads-up for anyone using ORBS for spam filtering: ORBS has added the following manual entries to its database: 18.160.46.202.inputs.orbs.org IN TXT "Domainz.net.nz - Attacks on ORBS and ORBS hosters." 50.160.46.202.inputs.orbs.org IN TXT "Domainz.net.nz - Attacks on ORBS and ORBS hosters." 37.16.96.203.inputs.orbs.org IN TXT "Delivery point for Domainz.net.nz - Attacks on ORBS and ORBS hosters." These represent the hosts www.domainz.net.nz, office.domainz.net.nz and mail2.actrix.gen.nz respectively. The records were added on the 9th Feb 2001, according to the ORBS database web pages. The impact of this is that if a site is using ORBS for spam blocking, it will reject mail from the Domainz automated systems, including notifications of passwords, nameserver changes, reminders of accounts due and other automatically generated DRS notifications. It will also reject mail from the Actrix list server, which includes Domainz mailing lists, ISOCNZ mailing lists and presumably others. Normal customer service email should be unaffected, as these come from other Actrix hosts. Suffice to say, none of these addresses have been used to attack the ORBS service or systems, nor do the mail servers on these addresses relay spam or block ORBS queries. Email queries to ORBS by myself and Actrix staff have not elicited a reply. Unless ORBS decides to remove these records, anyone needing to to communicate (or having customers that may need to communicate) with Domainz should ensure that ORBS is not in use by their mail exchangers, or arrangements to bypass the blocks on the Domainz addresses are in place. -- don --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

15 23

zivo.co.nz (ex clearview.co.nz)
by PhoneNet 15 Feb '01

15 Feb '01

Following on from the ORBS discusion...... Anyone else having problems getting replies from zivo.co.nz (formerly clearview.co.nz) Our main email address was used to sign up to several porn sites from one of their IPs - The originating IP for the sign up process was recorded as: 202.78.157.14 which resolves to the address: >> router-cyber.cl.clearview.co.nz. Despite three emails regarding the matter I've had no response from them...... Ian Cousins --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Xtra / WIX
by Richard Naylor 14 Feb '01

14 Feb '01

At 03:35 PM 2/15/01 +1300, Ben Martel wrote: >Tony, > >It is the same for us (CLEAR) at the mo! Their router is there (ie. BGP is >active) but we are not exchanging any prefixes. > >I'm sure someone at Xtra is looking into it - right? Yep - I gave Peter a call about 2:40 and he had someone on the way to fix it. Sounded like internal switch failure/wedge. I understand dial-up users are down also - but then I don't use modems very often...... rich richard.naylor(a)citylink.co.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Xtra / WIX
by Ben Martel 14 Feb '01

14 Feb '01

Tony, It is the same for us (CLEAR) at the mo! Their router is there (ie. BGP is active) but we are not exchanging any prefixes. I'm sure someone at Xtra is looking into it - right? ~benm --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Xtra / WIX
by Tony Wicks 14 Feb '01

14 Feb '01

Hi all, my peering session with Xtra on WIX has disappeared, anyone know what has happened there ? --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Who else is being spammed by Cisco Australia?
by Alan Brown 14 Feb '01

14 Feb '01

Subject says it all. Our copy arrived to our info@ address (which only appears on the website) with a botched attempt to address match it to one of the staff. So far the only response from Australia is that this is a legitimate marketing method, yadda yadda, usual spammer bullshit, and that the staffer should unsubscribe from the list if he doesn't want it. AB --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

prefix list update
by Tony Wicks 14 Feb '01

14 Feb '01

Hi all, I have an updated prefix list for those of you who we preer with ( as4770 ). There are no additions, I have been removing old unused networks only. ip prefix-list AONZ-networks description networks(a)nz.asiaonline.net ip prefix-list AONZ-networks seq 5 permit 202.14.100.0/24 ip prefix-list AONZ-networks seq 10 permit 210.48.0.0/17 ip prefix-list AONZ-networks seq 15 permit 192.173.16.0/21 ip prefix-list AONZ-networks seq 25 permit 202.6.84.0/24 ip prefix-list AONZ-networks seq 30 permit 202.12.70.0/24 ip prefix-list AONZ-networks seq 40 permit 202.36.36.0/22 ip prefix-list AONZ-networks seq 45 permit 202.36.76.0/23 ip prefix-list AONZ-networks seq 55 permit 202.37.76.0/24 ip prefix-list AONZ-networks seq 60 permit 202.37.85.0/24 ip prefix-list AONZ-networks seq 75 permit 202.37.140.0/22 ip prefix-list AONZ-networks seq 80 permit 202.37.148.0/24 ip prefix-list AONZ-networks seq 85 permit 202.37.144.0/21 ip prefix-list AONZ-networks seq 90 permit 202.37.163.0/24 ip prefix-list AONZ-networks seq 115 permit 202.37.197.0/24 ip prefix-list AONZ-networks seq 120 permit 202.37.200.0/22 ip prefix-list AONZ-networks seq 130 permit 202.37.224.0/21 ip prefix-list AONZ-networks seq 145 permit 202.37.252.0/24 ip prefix-list AONZ-networks seq 150 permit 202.49.144.0/24 ip prefix-list AONZ-networks seq 155 permit 202.50.16.0/20 ip prefix-list AONZ-networks seq 160 permit 203.99.65.0/24 ip prefix-list AONZ-networks seq 165 permit 203.99.66.0/24 ip prefix-list AONZ-networks seq 170 permit 203.99.71.0/24 ip prefix-list AONZ-networks seq 175 permit 210.54.0.0/22 ip prefix-list AONZ-networks seq 180 permit 138.235.0.0/16 ip prefix-list AONZ-networks seq 185 permit 203.9.180.0/24 cheers --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Domainz
by David Buckingham 08 Feb '01

08 Feb '01

I find it interesting that a company which should be a leader in web development would leave something as simple as being able to miss out www undone http://domainz.net.nz doesn't work - WHY?!? How hard is it to make a 30 sec entry into bind? --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Quik Internet havening spammer websites: Re: Baron-marketing.co.nz spamming yet again....
by J Random Luser 08 Feb '01

08 Feb '01

[This is an email copy of a Usenet post to "nz.net.admin"] Quik Internet claim to have taken action against this spammer. "We have removed Steve Baron's dialup account, so that he is unable to spam again from our network" well duh. He wasn't spamming from Quik in the first place. He was spamming for websites hosted _at_ Quik. It appears that Quik is another "Bulletproof web hosting provider", along with Palmerston North's Inspire.net http://www.mail-abuse.org/rbl/candidacy.html#ByAssociation --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

In case anyone missed it ... APRICOT2001
by Scott, Arron 06 Feb '01

06 Feb '01

CALL FOR PARTICIPATION in The one event where Asia Pacific Internet Infrastructure Engineers gather, talk tech and learn about the latest tools and techniques CwindowsTEMPnsmailL11.gif 26th Feb - 2 March 2001 Developing the Next Generation ASIA PACIFIC REGIONAL INTERNET CONFERENCE ON OPERATIONAL TECHNOLOGIES KUALA LUMPUR, MALAYSIA _____ Last year's APRICOT 2000, in Seoul, was the largest technical conference gathering of Asia Pacific Internet Engineers and Operators so far. The first APRICOT of the New Millennium, APRICOT 2001 will be held in Kuala Lumpur, Malaysia and is looking to be even more exciting & worthwhile! Apricot2001 will be hosted by the PIKOM, The Association of the Computer & Multimedia Industry of Malaysia and the Ministry of Energy, Communications & Multimedia of Malaysia. As in the past, the week-long summit will comprise of workshops, tutorials, conference sessions, Birds of a Feather (BOFs), and other forums, all geared towards spreading and sharing the knowledge required to operate the Internet within the Asia Pacific region. Not forgetting of course, exciting social events have also been planned for this year's Apricot. We have lined up some very distinguished speakers from the internet community including David Isenberg from Isen.com, Prof Jun Murai from KEIO University of Japan and Tan Sri Dr. Othman Yeop from the Multimedia Development Corporation of Malaysia. Hot topics covered include: IPv6 BGP MPLS: Protocols and Applications Gigabit Ethernet Streaming and Multicast Multilingual DNS Traffic Engineering & MPLS High Performance Routing DNSSEC, Bind V9, IPv6 Bind Network Security APNIC Address Policy pt2 Optical Networking Reverse DNS Virtual Private Networks Peering & Internet Exchanges QoS Panel ICANN UPDATE We are pleased to invite you to participate in this important event. The full conference program is available on the event site and registration can be submitted on-line at http://www.regweb.com/Apricot/2001 <http://www.apricot2001.net> . Meawhile, sponsorship opportunities are still available. Please log on to http://www.apricot2001.net/participation/sponsorship.html <http://www.apricot2001.net/participation/sponsorship.html> for details. We look forward to you joining us for the APRICOT2001 in Kuala Lumpur. Should you have any queries, please e-mail me. Kind regards, Molly Cheam Apricot2001 Secretariat c/o PIKOM, Association of the Computer & Multimedia Industry Malaysia

1 0

RE: Paradise spam policy
by Shane Cole 04 Feb '01

04 Feb '01

Hi Michael In over 3 years of running Paradise we have had one complaint about the inability to 'opt out' of this policy. We don't block mail, we block insecure mail servers (those that are known to allow spam to be sent through them) from connecting to our mail servers (and consequently deliver any email to our customers). We don't try to determine whether the message that was attempting to be delivered by such a server was in fact spam or not, consequently, it is entirely possible that someone trying to send a message to one of our customers that one would consider to be 'other emails' would not get through, it would however, be bounced and the sender would normally learn the reason their message could not be delivered to our customer. It would come back with one of the following: 550 Rejected - see http://www.mail-abuse.org/rbl/ 550 Open spam relay - see http://www.mail-abuse.org/rss 550 Dialup - see http://www.mail-abuse.org/dul/ I would also recommend having a look at http://mail-abuse.org/rbl/rationale.html if you have not read it before, particularly the Rights to Passage section. Sorry I am not free to discuss this with you on the telephone. A copy of this message has been sent to other network and ISP operators as well as Quentin Bright, the media relations contact for TelstraSaturn. Regards Shane Cole -----Original Message----- From: Michael Foreman [mailto:mforeman(a)xtra.co.nz] Sent: Friday, 2 February 2001 4:34 p.m. To: shane.cole(a)staff.paradise.net.nz Subject: Paradise spam policy Hi Shane We have had a complaint from one of your customers that Paradise's mandatory anti-spam policy blocks other emails too. Could you give me a ring to discuss this? Best Regards Michael Foreman IT Writer, New Zealand Herald www.nzherald.co.nz Tel: 0-9-636 0077 Mobile: 021 260 2116 email: mforeman(a)ihug.co.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

BIND - VUW
by Sean Liddall 01 Feb '01

01 Feb '01

Due to final testing being completed, rata.vuw.ac.nz is now running 8.2.3-REL Regards Sean -- System Administrator Victoria University of Wellington Ph. +64 4 463 5979 P O Box 600 Fax. +64 4 463 5552 Wellington Mob. +64 21 626 099 New Zealand --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Public Consultation: SRS Implementation
by Sue Leader 01 Feb '01

01 Feb '01

Greetings all - Forwarded on behalf of the Chair: ================== Implementation of a competitive shared registry system for .nz: The SRS IOC is pleased to release its Green Paper on implementation of a competitive shared registrar system for .nz. This Green Paper sets the context in which the issue arises, discusses the steps taken by ISOCNZ to date, and lists the various options for action and their consequences. After a period of time to permit further comment, which is now solicited, the IOC will prepare a White Paper which will make selections from the various options, and chart the implementation course, including operational responsibilities, a timetable, and a budget. Because of the time taken to date, and the extensive consultation which has occurred, the consultation period for this Green Paper will therefore close on Friday, 16 February 2001. Between that time and 4 March 2001, the IOC will draft the White Paper. It will, in this period, take such further advice, and conduct such further consultations as it believes appropriate. On Monday, 5 March 2001 the White Paper will be presented to Council at a special meeting convened for the purpose of reviewing the White Paper. By Monday, 19 March Council will have voted on the implementation of the White Paper. By then, a Project Implementation Manager should have been appointed, and implementation should commence." Kind regards, Peter Dengate Thrush Chair, ISOCNZ ============== To read the Green Paper please go to: http://www.isocnz.org.nz/consult/ A new mailing list has been set up for this consultation. Members can subscribe to the discussion mailing list - by visiting the List pages at: http://listserver.actrix.co.nz/mailman/listinfo/ the list name is srs-implementation(a)isocnz.org.nz. Cheers Sue Sue Leader - Executive Director ISOCNZ (Internet Society of New Zealand Inc) Exe.Dir(a)isocnz.org.nz Voice: +64-4-801-6256 http://www.isocnz.org.nz Postal: Level 1, (e)-Vision Centre, 282 Wakefield St, Wellington "Error: Press any key to continue or any other key to quit..." --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

The New Zealand Network Operators' Group
by Donald Neal 01 Feb '01

01 Feb '01

The New Zealand Network Operators' Group The New Zealand Network Operators' Group (NZNOG) has no king, president or formal membership. At present it consists of the subscribers to this mailing list, which anyone is free to join. The list begins the new millenium with around two hundred subscribers. The NZNOG mailing list is provided through a server at The University of Waikato, and is administered by an employee of Telecom NZ Ltd. Neither of these organisations (nor the administrator) is responsible for its content. NZNOG Mailing List Acceptable Use Policy The NZNOG mailing list exists to provide a forum for the exchange of technical information and the discussion of implementation issues that require cooperation among New Zealand network service providers. In order to continue to provide a useful forum for discussion of relevant technical issues, users of the list are asked to respect the following guidelines. 1. Discussion will focus on Internet operational and technical issues. 2. Discussion related to meetings of network service providers is appropriate. 3. Discussion unrelated to these topics is not appropriate. 4. Postings to multiple mailing lists are discouraged. 5. Postings that include foul language, character assassination, and lack of respect for other participants are unacceptable. 6. Blatant product or service marketing is unacceptable. 7. Postings of a political, philosophical or legal nature are discouraged. 8. Postings to the list should be in ASCII or MIME encoded as text/plain. Attachments should not be sent to the list. To present a document, a suitable URL may be referred to. For documents of general interest, the use of proprietary file formats is discouraged. 9. Breaches of list etiquette should be dealt with privately with the offending list user, and should not result in complaints being sent to the list. Mailing List Archives A full archive is available at http://list.waikato.ac.nz/archives/nznog/ To search the archive, see http://list.waikato.ac.nz/archives/search.html (and remember to select nznog). Subscribing to the List To subscribe to the NZNOG list, send email to majordomo(a)list.waikato.ac.nz, where the body of the message reads subscribe nznog There are at present no restrictions on who may subscribe to the list, or even on who may post to the list. Digest Mailing List If you don't wish to receive postings as they are sent, you can instead subscribe to the nznog-digest mailiing list, on which all postings are sent out in a single "digest" every couple of days. Other Activities NZNOG does not at present have other regular activities than this mailing list, though the administrator is on the hunt for presenters for the annual Uniforum NZ conference, to be held in late June or early July. Donald Neal NZNOG Mailing List Owner/Administrator/Muggins --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

BIND-Members mailing list
by Richard Stevenson 01 Feb '01

01 Feb '01

Hiya I've just seen this; it's something I think .nz ccTLD nameserver operators might wish to consider. http://linuxtoday.com/news_story.php3?ltsn=2001-02-01-026-04-SC-CY Cheers Richard -- Richard Stevenson, Systems Support Specialist, Telecom Xtra Phone: +64 9 355 5231 Mobile: +64 25 290 3101 Pager: +64 26 100 155 Smith & Wesson: The original point and click interface. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

XTRA
by andreas.girardet 01 Feb '01

01 Feb '01

Hello terminator.xtra.co.nz alien.xtra.co.nz gorgon.xtra.co.nz have been upgraded this week to bind version 8.2.3. Regards Andreas Girardet, M.A. Checkpoint Certified System Administrator -----------OvO----------- General Systems Team Leader, Telecom Xtra 16 Kingston Street, Auckland Private Bag 92028, Auckland Email andreas.girardet(a)team.xtra.co.nz Phone: +64-9-355-5930 Fax: +64-9-355-5260 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Mail problem
by Gordon Findlay 31 Jan '01

31 Jan '01

Folks: I wonder if anyone can help. Last night I upgraded our name server (ns.cce.ac.nz) to the latest BIND. SInce then we've had intermittant problems receiving email. Now I've reverted to the previous version: still got problems. The setup is: name server ns.cce.ac.nz 202.36.178.69 mail server mailbox.cce.ac.nz 202.36.178.67 we connect through xtra, but have our own domain and mail servers. traceroute is stopped at our firewall. Every name server that I check has the correct records (well, I think they are correct) except that for a few hours dns1.clear.net.nz had the wrong MX record. Taking xtra as an example: only one out of many test messages has reached us. One message from paradise.net.nz got here - in three hours. Others have not. I'd have thought there might be a routing problem - but I can telent to the boxes from outside this site. Folk from clear, telecom and domainz have all looked at the problem, and been a great help, but we seem to be no nearer a solution. One suggested trying nznog Can anyone suggest where I might start looking now? It's been 24 hours and I'm puzzled. Thanks for any suggestions. You might not be able to mail me: but gordonf(a)xtra.co.nz is still working :-) --- Gordon Findlay Manager, Information Technology Services Christchurch College of Education, PO Box 31065, Christchurch, New Zealand email: gordon.findlay(a)cce.ac.nz phone +64 3 343 7766, mobile 021 358 788 -These views are mine: the College may agree, by coincidence.- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

RE: Wireless APE.
by derek 30 Jan '01

30 Jan '01

It is not the equipment that determines the output, but the 2.4Ghz spectrum regulations being 4 watts. It will cost you more for a WaveLan setup as Lucent's outdoor solution (COR and ROR)does not conform to 802.11. They have deployed there own proprietary polling system and they will not work with any other vendor. So if you want to use a Linux box at home to save cost you should go with Cisco, also the drivers for the Cisco card come prepackaged in the latest Linux distributions. Derek Gaeth Radionet Ltd -----Original Message----- From: owner-nznog(a)list.waikato.ac.nz [mailto:owner-nznog(a)list.waikato.ac.nz]On Behalf Of Matt Camp Sent: Tuesday, January 23, 2001 3:54 PM To: derek Cc: 'James Tyson'; 'nznog(a)list.waikato.ac.nz' Subject: RE: Wireless APE. On Tue, 23 Jan 2001, derek wrote: > The sky tower is about the worst place in Auckland to do wireless from. The > amount of noise coming off the sky tower is very high. You will only be able > to cover a small area with each Cisco bridge due to interference around the > CBD. The Cisco gear works in the 2.4Ghz Unlicensed band. The max power > output is 4 watts at the antenna. The best thing on your home end would be a > Linux box with a PCI cradle and Cisoc PCI card. Are there any better, higher-power equivalent units? I guess cost is also a consideration here. Anyone know much about WaveLan? I've only ever played with it in an intranet type setup. --- Matt Camp --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

Reminder: NZ NOC contact list
by Simon Lyall 30 Jan '01

30 Jan '01

As people may have heard this was offline for a week or two due to hardware failure. Anyway it's been backup for a few weeks again so I thought I'd remind people where it is. http://www.usenet.net.nz/noc/ Currently I have most major ISPs listed except for the Telecom group of companyies, anybody there who is able to give people a nudge could they please do so. Perhaps a pointer to the list could be included in this list's monthly posting. Please send any comments, updates or corrections to me or you can use the form on the page. -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | | Home: simon(a)darkmere.gen.nz ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 5

APE peering party....
by Matthew Grant 30 Jan '01

30 Jan '01

Hi HTere! I am currently the Network Administrator for Plain Communications (http://www.plain.co.nz/) in Christchurch. We have been an ISP from almost the start of public Internet service in the South Island, and host approx 200 WWW sites which include major corporate entities. We formed the first peering at APE with Clear Net when it started over a year ago. Next Friday we should have our router in the skytower upgraded to Zebra software (http://www.zebra.org/) from gated which means that we will be able to peer with much greater facility at APE. Could the parties interested in forming peering arrangements with us please get back to me, or my protege Mr Ben Aitchison <ben(a)plain.co.nz> who will be taking over next week. I will still be available from time to time when needed. Thank you for your cooperation. Cheers, Matthew Grant --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: bind versions
by Jason Hunter 30 Jan '01

30 Jan '01

Peter, All This is to confirm that the following CLEAR Net Name servers ns1.clear.net.nz ns2.clear.net.nz have been upgraded to Bind version 8.2.3 as of immediately. Jason CLEAR Net -----Original Message----- From: Peter Mott [mailto:peter(a)2day.com] Sent: Wednesday, January 31, 2001 11:32 AM To: Joe Abley; nznog(a)list.waikato.ac.nz Subject: RE: bind versions > These are the authoritative nameservers for NZ. > > dig version.bind chaos txt shows: If you have a dig around major nz ISP's you find very few have upgraded (or they have set version.bind to answer with an old version to fool us all). Heads down people! > gorgon.xtra.co.nz "8.1.2" > ns1.clear.net.nz "8.2.2-P5" > ns2.clear.net.nz "8.2.2-P5" > ns1.dns.net.nz "BIND 8" > ns99.waikato.ac.nz "BIND 8" > rata.vuw.ac.nz <no answer> > mx.nsi.nasa.gov "8.2.2-P7" Regards Peter Mott Chief Enthusiast 2day.com -/- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: APE peering party.... Plain AS number and details
by Matthew Grant 30 Jan '01

30 Jan '01

Hi! Forgo a few things like our ASN No $%-{.... NB Plain's IP number is 192.203.154.12 on APE, and we are AS 9559 Here is our information. Note the Auckland local subnets 202.36.174.100/30 and 202.36.174.104/29 that are there to cope with our backbone to Christchurch going to a backup connection. ip prefix-list plain-communications description Plain Communications Ltd, contact: ben(a)plain.co.nz ip prefix-list plain-communications seq 5 permit 202.36.174.0/24 ip prefix-list plain-communications seq 10 permit 202.49.64.0/21 ip prefix-list plain-communications seq 15 permit 202.49.140.0/24 ip prefix-list plain-communications seq 20 permit 202.36.174.100/30 ip prefix-list plain-communications seq 25 permit 202.36.174.104/29 > > Hi, > > Attica would be interested in peering with yourselves, AS 9790, 192.203.154.46, prefix > list as below. > > ip prefix-list attica-networks description Attica Communications Ltd, contact: brent.mcdowell(a)attica.co.nz > ip prefix-list attica-networks seq 5 permit 202.180.96.0/19 > ip prefix-list attica-networks seq 10 permit 202.180.64.0/18 le 19 > ip prefix-list attica-networks seq 15 permit 210.55.254.0/24 > > if you could send me your prefix list/AS, then I can setup our end this > afternoon.. > > cheers > > --Brent > > > On Wed, 31 Jan 2001, Matthew Grant wrote: > > > Hi HTere! > > > > I am currently the Network Administrator for Plain Communications > > (http://www.plain.co.nz/) in Christchurch. We have been an ISP from almost > > the start of public Internet service in the South Island, and host approx 200 > > WWW sites which include major corporate entities. We formed the first peering > > at APE with Clear Net when it started over a year ago. > > > > Next Friday we should have our router in the skytower upgraded to Zebra > > software (http://www.zebra.org/) from gated which means that we will be able > > to peer with much greater facility at APE. > > > > Could the parties interested in forming peering arrangements with us please > > get back to me, or my protege Mr Ben Aitchison <ben(a)plain.co.nz> who will be > > taking over next week. I will still be available from time to time when > > needed. > > > > Thank you for your cooperation. > > > > Cheers, > > > > Matthew Grant > > > > > > --------- > > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > > where the body of your message reads: > > unsubscribe nznog > > > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

bind versions
by Joe Abley 30 Jan '01

30 Jan '01

These are the authoritative nameservers for NZ. dig version.bind chaos txt shows: gorgon.xtra.co.nz "8.1.2" ns1.clear.net.nz "8.2.2-P5" ns2.clear.net.nz "8.2.2-P5" ns1.dns.net.nz "BIND 8" ns99.waikato.ac.nz "BIND 8" rata.vuw.ac.nz <no answer> mx.nsi.nasa.gov "8.2.2-P7" ISC says: If you are running any version of BIND version 8, we recommend you upgrade to BIND version 8.2.3 for security reasons http://www.isc.org/products/BIND/bind-security.html Some upgrades may be in order. Joe --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Spammer termination: Central Pacific Imports Ltd. (car.co.nz) (fwd)
by Alan Brown 25 Jan '01

25 Jan '01

This actually happened a couple of weeks ago, but usenet.net.nz has been down so I've been unable to post the notice. Central Pacific Imports Ltd, also known as Andre Blenkiron motors. We have terminated service to cpiltd(a)manawatu.gen.nz - this is/was the listed domain contact for cars.co.nz and a group of other domains registered through Ihug and elsewhere. The car.co.nz (*) domain has been spamming via email and usenet for some time, mainly from Xtra dialups. As soon as we became aware of it(**) and the records linking it to our domain(***), we suspended the account and required that they sign a written agreement to cease posting unsolicited commercial email and Usenet posting from any ISP in order to regain their account on ours. Central Pacific Imports have refused to do so - this is a fairly good indication that they know they're spamming and have every indication of continuing to do so. CPI currently have a Paradise.net.nz connection, judging from attempts to access the disabled account. (*) No relation to cars.co.nz (**) Spam arriving in our traps on November 27th originating from Xtra, confirmed by Dejanews searches. (***) Whois lookups while preparing LARTS showed cpiltd(a)manawatu.gen.nz as the domain contact for this and several related domains. As can be seen here, Central Pacific Imports have changed their DNS contact. [whois.geektools.com] Query: car.co.nz Registry: whois.domainz.net.nz Results: % Domainz D.R.S. Automated Registrar Interface % D.R.S. users confirm on submission their agreement to all published Terms % Last revision: 22-02-2000 - DRS-RL-v1.00 % domain_name_status: 01 Current registrar: The Internet Group Limited domain_name: car.co.nz domain_datecreated: 23/01/97 domain_datelastmodified: 9/01/01 10:04:01 holder_name: Central Pacific Imports Limited holder_contact: Andre Blenkiron holder_phone: 64 6 3584228 holder_fax: 64 6 3588795 holder_email: andre(a)car.co.nz holder_address: 391 Rangitikei St holder_addr_citycountry: PALMERSTON NORTH,NEW ZEALAND technical_contact: The Internet Group Ltd technical_contact_phone: +64 9 358 5067 technical_contact_fax: +64 9 358 4112 technical_contact_email: soa(a)ihug.co.nz technical_contact_address_line_1: PO Box 7281 technical_contact_address_line_2: Wellesley Street ns_name_1: ns2.ihug.net.nz ns_ip_1: ns_name_2: ns1.ihug.net.nz ns_ip_2: ns_name_3: ns-au.ihug.net.nz ns_ip_3: --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 3

RE: Wireless APE.
by derek 23 Jan '01

23 Jan '01

That is true, They do conform to 802.11 which is the 2.4Ghz standard for indoors. It is good up to about 2500 feet away from the transmission site. The further out you go the slower the connection will run. Saying that I have seen 15kms out of this stuff, but you may only get about 500k. It depends on the quality of the install and the antenna you use. If you wanted to do it with Lucent buy a Lucent AP not ROR or COR . I have some for sale second hand. Also have some old bronze cards(10 and 2Mb) if anyone wants them. Derek Gaeth Network Manager Radionet Ltd 72 Paul Matthews Rd, Albany, Auckland +64 9 414 0300 +64 21 649173 -----Original Message----- From: Joe Abley [mailto:jabley(a)automagic.org] Sent: Wednesday, January 24, 2001 4:51 AM To: derek Cc: 'Matt Camp'; 'nznog(a)list.waikato.ac.nz' Subject: Re: Wireless APE. On Tue, Jan 23, 2001 at 04:27:04PM +1300, derek wrote: > It is not the equipment that determines the output, but the 2.4Ghz spectrum > regulations being 4 watts. It will cost you more for a WaveLan setup as > Lucent's outdoor solution (COR and ROR)does not conform to 802.11. They > have deployed there own proprietary polling system and they will not work > with any other vendor. So if you want to use a Linux box at home to save > cost you should go with Cisco, also the drivers for the Cisco card come > prepackaged in the latest Linux distributions. Lucent's bronze, silver and gold 11M turbo cards all talk 802.11b; last time I looked there was nothing to stop anybody using them for outdoor applications. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

RE: Wireless APE.
by derek 22 Jan '01

22 Jan '01

The sky tower is about the worst place in Auckland to do wireless from. The amount of noise coming off the sky tower is very high. You will only be able to cover a small area with each Cisco bridge due to interference around the CBD. The Cisco gear works in the 2.4Ghz Unlicensed band. The max power output is 4 watts at the antenna. The best thing on your home end would be a Linux box with a PCI cradle and Cisoc PCI card. Cheers, Derek Gaeth Radionet Ltd -----Original Message----- From: owner-nznog(a)list.waikato.ac.nz [mailto:owner-nznog(a)list.waikato.ac.nz]On Behalf Of James Tyson Sent: Friday, January 19, 2001 11:10 AM To: nznog(a)list.waikato.ac.nz Subject: Wireless APE. Just out of interest, how many people on this list; a) live in Auckland. b) have line of sight to the sky tower. c) would be willing to help chip in for a Cisco Aironet 340 wireless RIG, or similar to their home. It's just this crazy idea I had, and I figure the more people the cheaper it is. Cheers. James Tyson --- Samizdat New Media Solutions --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

RE: Wireless APE.
by Ben Martel 21 Jan '01

21 Jan '01

James, Yes to (a), (b) (windows 13,14,15,16,17,18) - unless you are thinking of multiple antennae! and (c). Remembering of course that most of the cost is for international transit rather than the gear. However I'm sure that between us that wouldn't be a problem :)) I have already tested a Lucent Orinocco ROR1000 to my home (Bastion point) from the Sky Tower, Lvl 48 with great success. Don't forget the cost of the rental of window space for the antenna as well! ~benm ------------------------------------------------------------ Ben Martel CLEAR Net > -----Original Message----- > From: Juha Saarinen [mailto:juha_saarinen(a)email.msn.com] > Sent: Friday, 19 January 2001 11:22 a.m. > To: James Tyson; nznog(a)list.waikato.ac.nz > Subject: RE: Wireless APE. > > > Trying to compete with Ihug eh? ;-) > > Yes to a) & b)... and c) as well, I suppose, depending on the > size of the > chip so to speak. > > -- Juha > > %-> -----Original Message----- > %-> From: owner-nznog(a)list.waikato.ac.nz > %-> [mailto:owner-nznog(a)list.waikato.ac.nz]On Behalf Of James Tyson > %-> Sent: Friday, January 19, 2001 11:10 AM > %-> To: nznog(a)list.waikato.ac.nz > %-> Subject: Wireless APE. > %-> > %-> > %-> > %-> Just out of interest, how many people on this list; > %-> > %-> a) live in Auckland. > %-> b) have line of sight to the sky tower. > %-> c) would be willing to help chip in for a Cisco Aironet 340 > %-> wireless RIG, > %-> or similar to their home. > %-> > %-> It's just this crazy idea I had, and I figure the more people > %-> the cheaper > %-> it is. > %-> > %-> Cheers. > %-> > %-> James Tyson --- > %-> Samizdat New Media Solutions > %-> > %-> --------- > %-> To unsubscribe from nznog, send email to > majordomo(a)list.waikato.ac.nz > %-> where the body of your message reads: > %-> unsubscribe nznog > > > --------- > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > where the body of your message reads: > unsubscribe nznog > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 4

RE: Wireless APE.
by Chris Hellberg 20 Jan '01

20 Jan '01

Same response as Juha's. I've always had an idea of having a wireless-internet or wireless LAN co-op after I read a slashdot story about it. The only prob I can see with this is the yearly rental of the space at the sky tower for the comms gear. Aparently it's a few thousand a year. Chris >>> "Juha Saarinen" <juha_saarinen(a)email.msn.com> 01/19/01 11:21a.m. >>> Trying to compete with Ihug eh? ;-) Yes to a) & b)... and c) as well, I suppose, depending on the size of the chip so to speak. -- Juha %-> -----Original Message----- %-> From: owner-nznog(a)list.waikato.ac.nz %-> [mailto:owner-nznog(a)list.waikato.ac.nz]On Behalf Of James Tyson %-> Sent: Friday, January 19, 2001 11:10 AM %-> To: nznog(a)list.waikato.ac.nz %-> Subject: Wireless APE. %-> %-> %-> %-> Just out of interest, how many people on this list; %-> %-> a) live in Auckland. %-> b) have line of sight to the sky tower. %-> c) would be willing to help chip in for a Cisco Aironet 340 %-> wireless RIG, %-> or similar to their home. %-> %-> It's just this crazy idea I had, and I figure the more people %-> the cheaper %-> it is. %-> %-> Cheers. %-> %-> James Tyson --- %-> Samizdat New Media Solutions %-> %-> --------- %-> To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz %-> where the body of your message reads: %-> unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

7 7

Wireless APE.
by James Tyson 19 Jan '01

19 Jan '01

Just out of interest, how many people on this list; a) live in Auckland. b) have line of sight to the sky tower. c) would be willing to help chip in for a Cisco Aironet 340 wireless RIG, or similar to their home. It's just this crazy idea I had, and I figure the more people the cheaper it is. Cheers. James Tyson --- Samizdat New Media Solutions --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

8 9

RE: Wireless APE
by Scott, Arron 18 Jan '01

18 Jan '01

Level 25 actually, what are you suggesting ??? :-) Arron -----Original Message----- From: owner-nznog(a)list.waikato.ac.nz [mailto:owner-nznog(a)list.waikato.ac.nz]On Behalf Of James Tyson Sent: Thursday, 18 January 2001 4:31 p.m. To: nznog(a)list.waikato.ac.nz Subject: Re: Wireless APE One more thing I wanted to ask is, can anyone think of a different place that we can house the equipment, maybe someone has access to the roof of a building in the CBD or something. Say, I hear that Cisco NZ is in Level 20 of the ASB Tower :) Cheers. James Tyson --- Samizdat New Media Solutions --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: Wireless APE.
by Ben Martel 18 Jan '01

18 Jan '01

Y'all > There was also a rumor floating around that Walker Wireless had signed > some deal with Sky City which gave them exclusive use of > 2.4Ghz off the > tower, and that anyone else wanting to use that band would > have to go find > another high place. I have investigated this alot recently. The answer is that Walker Wireless have the first right to use of the Sky Tower as a beaming point. THis is not exclusive though. Providing that your equipment does not interfere with Walkers Wirelesses you can operate it from the Sky Tower. ~benm ------------------------------------------------ Ben Martel CLEAR Net --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Wireless APE
by James Tyson 18 Jan '01

18 Jan '01

One more thing I wanted to ask is, can anyone think of a different place that we can house the equipment, maybe someone has access to the roof of a building in the CBD or something. Say, I hear that Cisco NZ is in Level 20 of the ASB Tower :) Cheers. James Tyson --- Samizdat New Media Solutions --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

ihug finally gets to APE
by David Robb 16 Jan '01

16 Jan '01

The subject line says it all really... Anyone wanting to peer, let me know. AS 7657, 192.203.154.36 Prefix list available on request, if you don't have a copy already. David Robb --- Senior Network Engineer IHUG NZ "The Earth is a single point of failure" --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

(Fwd) New position at W3C: Web Internationalization
by Sue Leader 16 Jan '01

16 Jan '01

Greetings and Happy New Year. FYI Cheers Sue ------- Forwarded message follows ------- Date sent: Thu, 04 Jan 2001 21:00:32 +0900 To: apng-all(a)apng.org From: "Martin J. Duerst" <duerst(a)w3.org> Subject: New position at W3C: Web Internationalization Dear friends, colleagues, everybody, The W3C is trying to strengthen its effort on internationalization and has opened a new position. For details, please see below or at http://www.w3.org/2000/12/i18nposition. For other open positions at W3C, please see http://www.w3.org/Consortium/Recruitment/. Please feel free to forward this announcement to anybody who may be interested. If you have any questions, please feel free to contact Vincent Quint (mailto:quint(a)w3.org) or myself (mailto:duerst(a)w3.org) Please apologize if you get this announcement more than once. Regards, Martin. ------------------------------------------------------------------------- New Position: Web Internationalization The [1]World Wide Web Consortium (W3C) is looking for a new team member working on [2]Internationalization in its [3]User Interface (UI) domain, to assure proper internationalization of W3C technology. [1] http://www.w3.org/ [2] http://www.w3.org/International/Activity.html [3] http://www.w3.org/UI/ Your mission is to advance Web internationalization, so that Web technology becomes and stays usable for people around the world, independent of their language, script, or culture. In coordination with the Internationalization Activity Lead, and with the Internationalization Working Group and Interest Group, develop and review W3C specifications and guidelines with respect to internationalization, including followup work with other working groups; document existing best practices and contribute to develop Web internationalization architecture; give presentations on Web internationalization; maintain W3C Internationalization Web site. W3C Hosts are located at MIT in Boston, USA, at INRIA in Sophia-Antipolis and Grenoble in France, and at Keio University in Fujisawa, Japan. You will be based at INRIA, but you will have to travel often, to working group meetings or conferences as well as to the other W3C hosts. _________________________________________________________________ Requirements As the recognized leader for the technical development of the World Wide Web, we seek an individual with both Web technology and project management experience, a good understanding of the Web industry, eagerness to make the Web more international and interoperable, and enthusiasm for the [4]mission and spirit of W3C. * You have a background in computer science, software engineering, and internationalization * You are familiar with up-to-date Web technology, in particular with respect to internationalization * You have a good sense of the Web industry, its market, practices and product development cycle * You have good written and spoken competency in the working language of the W3C, English, and knowledge and practical experience of other languages and cultures * You have good communication skills, both written and oral * You are free to travel internationally on a monthly basis [4] http://www.w3.org/Consortium/Points/ To apply, please send a motivation letter and your resume or CV in electronic form to Vincent Quint ([5]quint(a)w3.org) and Martin Duerst ([6]duerst(a)w3.org) _________________________________________________________________ [5] mailto:quint(a)w3.org [6] mailto:duerst(a)w3.org Martin Duerst 4 January 2001 ------- End of forwarded message ------- Sue Leader - Executive Director ISOCNZ (Internet Society of New Zealand Inc) Exe.Dir(a)isocnz.org.nz Voice: +64-4-801-6256 http://www.isocnz.org.nz Postal: Level 1, (e)-Vision Centre, 282 Wakefield St, Wellington "Error: Press any key to continue or any other key to quit..." --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Domainz WWW site
by Andy Linton 14 Jan '01

14 Jan '01

At 11:26 15/01/2001 +1300, James Tyson wrote: >Is it just me or is domainz website down again? > >God they suck. How can they suck, unless they go down? --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

New Asia Online NZ BGP prefix list
by Tony Wicks 14 Jan '01

14 Jan '01

Hi all, can those of you we are peering with please update your filter lists as follows - ip prefix-list AONZ-networks description networks(a)nz.asiaonline.net ip prefix-list AONZ-networks seq 5 permit 202.14.100.0/24 ip prefix-list AONZ-networks seq 10 permit 210.48.0.0/17 ip prefix-list AONZ-networks seq 15 permit 192.173.16.0/21 ip prefix-list AONZ-networks seq 20 permit 192.188.185.0/24 ip prefix-list AONZ-networks seq 25 permit 202.6.84.0/24 ip prefix-list AONZ-networks seq 30 permit 202.12.70.0/24 ip prefix-list AONZ-networks seq 35 permit 202.27.99.0/24 ip prefix-list AONZ-networks seq 40 permit 202.36.36.0/22 ip prefix-list AONZ-networks seq 45 permit 202.36.76.0/23 ip prefix-list AONZ-networks seq 55 permit 202.37.76.0/24 ip prefix-list AONZ-networks seq 60 permit 202.37.85.0/24 ip prefix-list AONZ-networks seq 65 permit 202.37.132.0/24 ip prefix-list AONZ-networks seq 70 permit 202.37.138.0/23 ip prefix-list AONZ-networks seq 75 permit 202.37.140.0/22 ip prefix-list AONZ-networks seq 80 permit 202.37.148.0/24 ip prefix-list AONZ-networks seq 85 permit 202.37.144.0/21 ip prefix-list AONZ-networks seq 90 permit 202.37.163.0/24 ip prefix-list AONZ-networks seq 95 permit 202.37.171.0/24 ip prefix-list AONZ-networks seq 100 permit 202.37.184.0/23 ip prefix-list AONZ-networks seq 105 permit 202.37.186.0/24 ip prefix-list AONZ-networks seq 110 permit 202.37.192.0/23 ip prefix-list AONZ-networks seq 115 permit 202.37.197.0/24 ip prefix-list AONZ-networks seq 120 permit 202.37.200.0/22 ip prefix-list AONZ-networks seq 125 permit 202.37.229.0/24 ip prefix-list AONZ-networks seq 130 permit 202.37.224.0/21 ip prefix-list AONZ-networks seq 135 permit 202.37.249.0/24 ip prefix-list AONZ-networks seq 140 permit 202.37.248.0/22 ip prefix-list AONZ-networks seq 145 permit 202.37.252.0/24 ip prefix-list AONZ-networks seq 150 permit 202.49.144.0/24 ip prefix-list AONZ-networks seq 155 permit 202.50.16.0/20 ip prefix-list AONZ-networks seq 160 permit 203.99.65.0/24 ip prefix-list AONZ-networks seq 165 permit 203.99.66.0/24 ip prefix-list AONZ-networks seq 170 permit 203.99.71.0/24 ip prefix-list AONZ-networks seq 175 permit 210.54.0.0/22 ip prefix-list AONZ-networks seq 180 permit 138.235.0.0/16 ip prefix-list AONZ-networks seq 185 permit 203.9.180.0/24 cheers --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 3

Domainz WWW site
by James Tyson 14 Jan '01

14 Jan '01

Is it just me or is domainz website down again? God they suck. Cheers. James Tyson --- Samizdat New Media Solutions --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

The New Zealand Network Operators' Group
by Donald Neal 09 Jan '01

09 Jan '01

The New Zealand Network Operators' Group The New Zealand Network Operators' Group (NZNOG) has no king, president or formal membership. At present it consists of the subscribers to this mailing list, which anyone is free to join. The list begins the new millenium with around two hundred subscribers, increasing by between five and ten a month. The NZNOG mailing list is provided through a server at The University of Waikato, and is administered by an employee of Telecom NZ Ltd. Neither of these organisations (nor the administrator) is responsible for its content. NZNOG Mailing List Acceptable Use Policy The NZNOG mailing list exists to provide a forum for the exchange of technical information and the discussion of implementation issues that require cooperation among New Zealand network service providers. In order to continue to provide a useful forum for discussion of relevant technical issues, users of the list are asked to respect the following guidelines. 1. Discussion will focus on Internet operational and technical issues. 2. Discussion related to meetings of network service providers is appropriate. 3. Discussion unrelated to these topics is not appropriate. 4. Postings to multiple mailing lists are discouraged. 5. Postings that include foul language, character assassination, and lack of respect for other participants are unacceptable. 6. Blatant product or service marketing is unacceptable. 7. Postings of a political, philosophical or legal nature are discouraged. 8. Postings to the list should be in ASCII or MIME encoded as text/plain. Attachments should not be sent to the list. To present a document, a suitable URL may be referred to. For documents of general interest, the use of proprietary file formats is discouraged. 9. Breaches of list etiquette should be dealt with privately with the offending list user, and should not result in complaints being sent to the list. Mailing List Archives A full archive is available at http://list.waikato.ac.nz/archives/nznog/ To search the archive, see http://list.waikato.ac.nz/archives/search.html (and remember to select nznog). Subscribing to the List To subscribe to the NZNOG list, send email to majordomo(a)list.waikato.ac.nz, where the body of the message reads subscribe nznog There are at present no restrictions on who may subscribe to the list, or even on who may post to the list. Digest Mailing List If you don't wish to receive postings as they are sent, you can instead subscribe to the nznog-digest mailiing list, on which all postings are sent out in a single "digest" every couple of days. Other Activities NZNOG does not at present have other regular activities than this mailing list. Donald Neal NZNOG Mailing List Owner/Administrator/Muggins --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

IETF Provisioning / Registration protocol WG
by Peter Mott 01 Jan '01

01 Jan '01

I note that IETF have formed a working group to develop a standards track protocol for a provisioning/registration protocol. The main driver is the need for a standard protocol for used in a competitive registration environment. Both gTLD and ccTLD folk are participating. The list is located at ietf-provreg(a)cafax.se (send subscribe message to ietf-provreg-request(a)cafax.se) There is a mail archive available at http://www.cafax.se/ietf-provreg/ The wg is currently developing a charter. In the interests of a more enjoyable 2001, I have unsubscribed myself from every isocnz/domainz related list. If anybody feels the need to tell them about the prov/reg wg please feel free to do so. Regards Peter Mott Chief Enthusiast 2day.com -/- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

APE
by James Tyson 19 Dec '00

19 Dec '00

Anyone know what's up with APE? All my peering sessions are down. My connection is still up, however. Is there a problem with the switch? James Tyson james.tyson(a)attica.co.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 5

Greetings..
by Mark Foster 19 Dec '00

19 Dec '00

Hi All, just saying hello as a new subscriber :) I know some of the names on here so I wont waffle but my interest in this is: I work for CallPlus (aka Attica) and deal primarily with their abuse@ mailbox, so deal a bit with NOC related issues. Hi James :) Technically just a helpdesk pleb but looking to upskill and move into NOC operations eventually. Im here to keep my ears open and to learn, and Im quite keen to see positive moves in dealing with network abuse and hacking, etc etc. Cheers guys, Mark Foster --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

New type of DDOS
by Martin Forest 14 Dec '00

14 Dec '00

Hi All There is now a new type of DDOS. This one is hiding the source IP address and port, i.e. random IP address and port as source address. This makes it almost impossible to quickly trace back to the source. Our Cisco routers can with ease detect the attack and block it (IOS Firewall). However, this new attack makes it hard to get upstream providers to block the traffic or to find out who's servers that have been hacked. Happy to share knowledge... Martin Forest Senior Security & Infrastructure Specialist Asia Online NZ --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

NZ Spammer
by Tony Wicks 14 Dec '00

14 Dec '00

Hmm, it seems like we have a wannabe spammer in close proximity. Can one of the guys from Ihug please sharply deal with this customer before they get any more bright ideas ? Thanks Dear Internet User, DO YOU CONNECT TO THE INTERNET? ... that's obvious, you would not have got this email otherwise. Each time you connect to the Internet you run the risk of two things: Downloading a virus Opening the door to your computer so a hacker can walk through. Both are well documented and there are a number of brilliant products available to minimise your exposure to viruses, worms and hackers. Intrusion by hackers is more subtle than a virus, but no less devastating, while the former can cause havoc on your computer, the latter can see your computer being accessed and your files being read, destroyed or tampered with by another person completely unknown to you. The longer you are on-line the greater the risk of hacker intrusion. There are two products ideally suited to meet your needs: Norton Personal Firewall 2001 provides security for your PC and privacy for your personal information Symantec Desktop Firewall 2.0 is optimised for broadband connections (eg. ADSL services like Jetstream) and is set up to work intelligently in the background. Norton Personal Firewall V2.5 $121.00 + shipping $9.50 Symantec Desktop Firewall 2.0 $99.00 + shipping $9.50 Shipping: AU & NZ $9.50; CA, GB & US $15.50; Rest of World $19.00 If you would like to purchase one of these please let me know and your exposure to intrusion damage will be assuaged. If you would like to know more about either of them please let me know. Yours Sincerely Meredith Software Sales Database Services Ltd meredithg(a)database.co.nz or sales(a)database.co.nz Ph: (+64) 9 6230513 Fx: (+64) 9 6230471 Database Services has been providing products and services to clients for over ten years Microsoft and Symantec (Norton) sales and support Prices are in New Zealand dollars ============================================================================ ==== Your email addressed has been passed to us as potentially interested in Microsoft & Symantec products, it has not been purchased from a mailling list provider. I you know of other who may be interested in these product ranges please let me know. ============================================================================ ==== This email is intended to inform and not irritate, please email me at remove(a)database.co.nz and I will see you no longer receive emails from us. Return-Path: <database(a)database.co.nz> Received: from etrn.iconz.co.nz (etrn.iconz.co.nz [210.48.22.36]) by gravel.road.gen.nz (8.11.0/8.11.0) with ESMTP id eBE44vD18186 for <tony(a)road.gen.nz>; Thu, 14 Dec 2000 17:04:57 +1300 Received: from c000.zsm.cp.net (c000-mx000.c000.zsm.cp.net [209.228.56.55]) by etrn.iconz.co.nz (8.9.3/8.9.3) with SMTP id RAA193050976766694 for <tonyw(a)nz.asiaonline.net>; Thu, 14 Dec 2000 17:04:54 +1300 (NZDT) Received: (cpmta 6941 invoked from network); 13 Dec 2000 20:03:19 -0800 Delivered-To: asiaonline.net.nz%tonyw(a)asiaonline.net.nz Received: (cpmta 6930 invoked from network); 13 Dec 2000 20:03:18 -0800 Received: from etrn.iconz.co.nz (210.48.22.36) by smtp.c000.zsm.cp.net (209.228.56.55) with SMTP; 13 Dec 2000 20:03:18 -0800 X-Received: 14 Dec 2000 04:03:18 GMT Received: from smtp2.ihug.co.nz (root(a)smtp2.ihug.co.nz [203.109.252.8]) by etrn.iconz.co.nz (8.9.3/8.9.3) with ESMTP id RAA186480976766595; Thu, 14 Dec 2000 17:03:15 +1300 (NZDT) Received: from danielle (p490-apx1.akl.ihug.co.nz [203.173.193.236]) by smtp2.ihug.co.nz (8.9.3/8.9.3/Debian 8.9.3-21) with SMTP id QAA04909; Thu, 14 Dec 2000 16:58:31 +1300 X-Authentication-Warning: smtp2.ihug.co.nz: Host p490-apx1.akl.ihug.co.nz [203.173.193.236] claimed to be danielle Message-Id: <3.0.5.32.20001214154435.03c08b10(a)pop.ihug.co.nz> X-Stationery: 33212 3 X-Sender: database(a)pop.ihug.co.nz X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.5 (32) Date: Thu, 14 Dec 2000 15:44:35 +1300 To: sales(a)database.co.nz From: sales(a)database.co.nz Subject: INFORMATION AND PRICING ON FIREWALL SOFTWARE Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Domain Summary This domain is currently listed in the .nz Register Status: Registered Registered: 10/10/1996 Modified: 26/10/2000 Name Holder Name Holder Representative Database Services PO Box 94 AUCKLAND N Gladden Email: database(a)database.co.nz Phone: 0 9 6230512 .nz Provider Technical Contact The Internet Group Limited PO Box 7281 Wellelsey Street Email: soa(a)ihug.co.nz Phone: +64 9 358 5067 The Internet Group Limited Email: soa(a)ihug.co.nz Phone: +64 9 358 5067 Name Servers ns1.ihug.net.nz 203.109.252.7 ns-au.ihug.net.nz 203.109.250.41 ns2.ihug.net.nz 203.109.252.8 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

as5200 authentication faillure
by Mendez Martín 13 Dec '00

13 Dec '00

Well, i prubed different IOS version to solve the busy problem that i reported in the list last week, by the way, thanks to all for your comments and help. Finally 12.0.5(T) appear to be good, but i'm not sure yet. Now i find a problem with the authentication over the radius server ( a windows 2000 advanced server running IAS), with certains modems, specially USR 56K external, the as5200 fail, if i see the logs in the radius i see something like this: User WmeTeO=erST c*YXf,4v!X+(A)[3{m^C}ear^*hLEm/a/FdP'mV?+ was denied access. Fully-Qualified-User-Name = RADIUSDOM\WmeTeO=erST c*YXf,4v!X+(A)[3{m^C}ear^*hLEm/a/FdP'mV?+ NAS-IP-Address = 172.17.101.5 NAS-Identifier = <not present> Called-Station-Identifier = 5300 Calling-Station-Identifier = <not present> Client-Friendly-Name = Cisco 5200 Client-IP-Address = 172.17.101.5 NAS-Port-Type = Async NAS-Port = 8 Policy-Name = <undetermined> Authentication-Type = <undetermined> EAP-Type = <undetermined> Reason-Code = 16 Reason = There was an authentication failure because of an unknown user name or a bad password. Look at Username !!!, it would be my human username and not that ! Thanks for any comments. Regards.

2 1

Attica prefix-list update
by James Tyson 10 Dec '00

10 Dec '00

If you are a domestic peer of attica can you please update your prefix lists to something that vaguely resembles the following: ip prefix-list attica-networks description Attica Communications Ltd, contact: james.tyson(a)attica.co.nz ip prefix-list attica-networks permit 202.180.96.0/19 ip prefix-list attica-networks permit 202.180.64.0/18 le 19 ip prefix-list attica-networks permit 210.55.254.0/24 Cheerio. James Tyson james.tyson(a)attica.co.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Contents of a platinum spamware CD obtained.
by Alan Brown 08 Dec '00

08 Dec '00

After larting the hell out of the hwhclub.com spammers (Hamilton, wave source, webfarm site), I managed to obtain the software they used. Platinum has a list of 23 million addresses in it, with lots of duplication. If any local admins are interested in checking what addresses of theirs are on the CD, please contact me. As a FWIW, there are a shitload of Xtra(299), Clear(131), Voyager(202), Actrix(472), Iconz(442) and Ihug(691) addresses. If they're anything like the manawatu list (182 addresses), only 1-2% actually work and the rest could easily be pressed into service as spamtraps. Many of the manawatu addresses were cancelled because of spam levels and almost all of them were scraped from usenet postings. Surprisingly, few addresses at newer NZ ISPs (less than 2 years old) seem to be listed... AB --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Best IOS for IPSEC on Cisco 4000?
by Simon Blake 06 Dec '00

06 Dec '00

Hey folks The lovely chaps at Logical have lent me a couple of 4000's for the SAGE IPSEC bakeoff this weekend. So, at the risk of being mocked for my naivete, can somebody recommend a passable IOS for 3DES IPSEC to Win2K and *nix connectivity? Unfortunately, I haven't sparked the boxes up yet to find out how much RAM they have, but I reckon I can pillage enough from both to get enough in one. And of course, anybody near Citylink in Wellington on Sunday is most welcome to haul buy and join in the fun. People with exotic hardware/software (that is other than FreeS/WAN and Win2K) especially welcome. Cheers Si --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Last call...
by James Tyson 05 Dec '00

05 Dec '00

Anyone else that wants to peer with Attica please email me the following details. Peering Point (APE/WIX) Your Interface IP Your Prefix List Here's my details: APE: 192.203.154.46 WIX: 202.7.1.161 James Tyson --- Samizdat New Media Solutions --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: problems with as5200
by Mendez Martín 04 Dec '00

04 Dec '00

Yes, Cisco IOS has an option to define argentinian signialing as the country to use and i defined it in my configuration. thanks. > -----Mensaje original----- > De: Chris Rigby [SMTP:chris.r(a)staff.ihug.co.nz] > Enviado el: Lunes 4 de Diciembre de 2000 5:51 PM > Para: Mendez Martín > CC: nznog(a)list.waikato.ac.nz > Asunto: RE: problems with as5200 > > > It is extange, Cisco has say that this is not is a hardware problem, > anyway, > > i couldn't put operating this server, some one say me that may be it is > a > > particular problems of this aserver with signialling with the E1 (r2 > > signialling in Argentina). of my country. > > Anyway, thanks for your comments. > > Well I do know for a fact that r2 signaling in argentina is slightly > different than the standard. Lucent have even gone so far as to add the > "argentinian" signaling type as an option in their maxes and tnt's so it > must be enough different to warrant this. > > If it keeps going to sleep then it most likely is an issue like this. Have > you checked ciscos site to see if they have an "argentinian" option like > the maxes? > > Chris Rigby > Senior Systems Engineer > IHUG - Into the Internet

1 0

APE & WIX Peering
by James Tyson 04 Dec '00

04 Dec '00

Anyone wishing to peer with Attica over APE and WIX please call or email me before 5pm tonight. ip prefix-list attica-networks description Attica Communications Ltd, contact: james.tyson(a)attica.co.nz ip prefix-list attica-networks permit 202.180.96.0/19 ip prefix-list attica-networks permit 202.180.64.0/18 le 19 Cheers. James Tyson james.tyson(a)attica.co.nz +64-21-837-867 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: problems with as5200
by Scott, Arron 04 Dec '00

04 Dec '00

Thanks for your opinion Chris, however Cisco, the number 1 manufacturer of dial servers in the world would be happy to give Martin a hand to sort this out ;-) ps. We make more switches than routers now. Arron Scott Systems Engineer Cisco -----Original Message----- From: owner-nznog(a)list.waikato.ac.nz [mailto:owner-nznog(a)list.waikato.ac.nz]On Behalf Of Chris Rigby Sent: Monday, 4 December 2000 12:24 p.m. To: Mendez Martin Cc: 'nznog(a)list.waikato.ac.nz' Subject: Re: problems with as5200 > I'm trying to put on an access server cisco as5200 with support 56kbps. > I probed three IOS version (11-3.9T, 11-3-9A and 12.0.1) with different > modems (mica) firmwares (2.3.1.0, 2.6.2.0, 2.7.2.0) in differents > combinations. 1) you do realise this is a _New Zealand_ Network operators group right? > but the AS works horrible ! 2) you've hit the nail on the head. Ditch the crappy Cisco dial in servers and get some Lucent gear (A Max6000 should do what you want). Cisco should stick to routers. Chris Rigby Senior Systems Engineer IHUG - Into the Internet --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

RE: problems with as5200
by Mendez Martín 04 Dec '00

04 Dec '00

I hope this, but Cisco only say: probe this version, and after that say probe this another and so on. It appear like the Cisco engineer (TAC) don´t know really what is happend here. Thanks! > -----Mensaje original----- > De: Scott, Arron [SMTP:ascott(a)cisco.com] > Enviado el: Lunes 4 de Diciembre de 2000 5:57 PM > Para: Chris Rigby; Mendez Martin > CC: 'nznog(a)list.waikato.ac.nz' > Asunto: RE: problems with as5200 > > Thanks for your opinion Chris, however Cisco, the number 1 manufacturer > of dial servers in the world would be happy to give Martin a hand to > sort this out ;-) > > ps. We make more switches than routers now. > > Arron Scott > Systems Engineer > Cisco > > -----Original Message----- > From: owner-nznog(a)list.waikato.ac.nz > [mailto:owner-nznog(a)list.waikato.ac.nz]On Behalf Of Chris Rigby > Sent: Monday, 4 December 2000 12:24 p.m. > To: Mendez Martin > Cc: 'nznog(a)list.waikato.ac.nz' > Subject: Re: problems with as5200 > > > > I'm trying to put on an access server cisco as5200 with support > 56kbps. > > I probed three IOS version (11-3.9T, 11-3-9A and 12.0.1) with > different > > modems (mica) firmwares (2.3.1.0, 2.6.2.0, 2.7.2.0) in differents > > combinations. > > 1) you do realise this is a _New Zealand_ Network operators group right? > > > but the AS works horrible ! > > 2) you've hit the nail on the head. Ditch the crappy Cisco dial in > servers > and get some Lucent gear (A Max6000 should do what you want). Cisco > should > stick to routers. > > Chris Rigby > Senior Systems Engineer > IHUG - Into the Internet > > --------- > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > where the body of your message reads: > unsubscribe nznog

1 0

RE: problems with as5200
by Mendez Martín 03 Dec '00

03 Dec '00

It is extange, Cisco has say that this is not is a hardware problem, anyway, i couldn't put operating this server, some one say me that may be it is a particular problems of this aserver with signialling with the E1 (r2 signialling in Argentina). of my country. Anyway, thanks for your comments. Martín Méndez Teconología - PECOM Energia. Voice:+54-11-4344-6000 Int. 3103 mmendezb(a)pecom.com.ar > -----Mensaje original----- > De: Tony Wicks [SMTP:tony.wicks(a)nz.asiaonline.net] > Enviado el: Lunes 4 de Diciembre de 2000 5:29 PM > Para: nznog(a)list.waikato.ac.nz > Asunto: RE: problems with as5200 > > I use entirely Cisco access servers with excellent results. > > -----Original Message----- > From: owner-nznog(a)list.waikato.ac.nz > [mailto:owner-nznog(a)list.waikato.ac.nz]On Behalf Of Chris Rigby > Sent: Tuesday, 5 December 2000 9:24 a.m. > To: Mendez Martin > Cc: 'nznog(a)list.waikato.ac.nz' > Subject: Re: problems with as5200 > > > > I'm trying to put on an access server cisco as5200 with support 56kbps. > > I probed three IOS version (11-3.9T, 11-3-9A and 12.0.1) with different > > modems (mica) firmwares (2.3.1.0, 2.6.2.0, 2.7.2.0) in differents > > combinations. > > 1) you do realise this is a _New Zealand_ Network operators group right? > > > but the AS works horrible ! > > 2) you've hit the nail on the head. Ditch the crappy Cisco dial in servers > and get some Lucent gear (A Max6000 should do what you want). Cisco should > stick to routers. > > Chris Rigby > Senior Systems Engineer > IHUG - Into the Internet > > --------- > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > where the body of your message reads: > unsubscribe nznog > > --------- > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > where the body of your message reads: > unsubscribe nznog

2 1

RE: problems with as5200
by Mendez Martín 03 Dec '00

03 Dec '00

I know that this list is in NZ. Could i send email anyway ?? I am from Argentina in south america. I am thinking seriously in put a Lucent access server. Thanks ! > -----Mensaje original----- > De: Chris Rigby [SMTP:chris.r(a)staff.ihug.co.nz] > Enviado el: Lunes 4 de Diciembre de 2000 5:24 PM > Para: Mendez Martín > CC: 'nznog(a)list.waikato.ac.nz' > Asunto: Re: problems with as5200 > > > I'm trying to put on an access server cisco as5200 with support 56kbps. > > I probed three IOS version (11-3.9T, 11-3-9A and 12.0.1) with different > > modems (mica) firmwares (2.3.1.0, 2.6.2.0, 2.7.2.0) in differents > > combinations. > > 1) you do realise this is a _New Zealand_ Network operators group right? > > > but the AS works horrible ! > > 2) you've hit the nail on the head. Ditch the crappy Cisco dial in servers > and get some Lucent gear (A Max6000 should do what you want). Cisco should > stick to routers. > > Chris Rigby > Senior Systems Engineer > IHUG - Into the Internet

1 0

problems with as5200
by Mendez Martín 03 Dec '00

03 Dec '00

Hello, my name is Martin and i am new in the list. I'm trying to put on an access server cisco as5200 with support 56kbps. I probed three IOS version (11-3.9T, 11-3-9A and 12.0.1) with different modems (mica) firmwares (2.3.1.0, 2.6.2.0, 2.7.2.0) in differents combinations. The as works fine one or two days, after thats it begin to give busy tone (it is connected to E1) and i need to restarted. Some one could work fine with this servers ??. How ??. I need 56kpbs, callback and authenticate over a radius server, my configuration works fine, but the AS works horrible ! Thanks.-

3 3

Email notification of domain names moving
by James Bell 03 Dec '00

03 Dec '00

Is anyone else suffering from a lack of email notification from Domainz when a domain name moves to a new name service provider? We haven't had one since Oct 24th, yet domain names have definitely moved since then. (Domainz are apparently looking in to it - I just wondered how widespread the problem was). --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 3

RE: Email notification of domain names moving
by Tech Support 03 Dec '00

03 Dec '00

James, We've been in the same boat for several months. This has been bought to Domainz' attention on numerous occasions, and they have confirmed other ISPs are affected. I've upped the complaint rate of late as it's really starting to cause problems - Domainz have given us several dates for fixes, but none have been successful as yet. Perhaps we need to e-mail the previous host when we shift a domain ...? Cheers, Peter Gray Telstra Saturn Tech Support E-mail: tech(a)tsnz.net Phone: 0800 949 000 Fax: 04 922 8401 Website: www.netlink.net.nz PO Box 5358, Wellington, New Zealand "Smile," they said "things could be worse!" So I smiled, and things were worse.... Is anyone else suffering from a lack of email notification from Domainz when a domain name moves to a new name service provider? We haven't had one since Oct 24th, yet domain names have definitely moved since then. (Domainz are apparently looking in to it - I just wondered how widespread the problem was). --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

The New Zealand Network Operators' Group
by Donald Neal 03 Dec '00

03 Dec '00

The New Zealand Network Operators' Group The New Zealand Network Operators' Group (NZNOG) has no king, president or formal membership. At present it consists of the subscribers to this mailing list, which anyone is free to join. At last count the list had just over 190 subscribers. The gain of around twenty in the last month is well above the previous rate of growth. The NZNOG mailing list is provided through a server at The University of Waikato, and is administered by an employee of Telecom NZ Ltd. Neither of these organisations (nor the administrator) is responsible for its content. NZNOG Mailing List Acceptable Use Policy The NZNOG mailing list exists to provide a forum for the exchange of technical information and the discussion of implementation issues that require cooperation among New Zealand network service providers. In order to continue to provide a useful forum for discussion of relevant technical issues, users of the list are asked to respect the following guidelines. 1. Discussion will focus on Internet operational and technical issues. 2. Discussion related to meetings of network service providers is appropriate. 3. Discussion unrelated to these topics is not appropriate. 4. Postings to multiple mailing lists are discouraged. 5. Postings that include foul language, character assassination, and lack of respect for other participants are unacceptable. 6. Blatant product or service marketing is unacceptable. 7. Postings of a political, philosophical or legal nature are discouraged. 8. Postings to the list should be in ASCII or MIME encoded as text/plain. Attachments should not be sent to the list. To present a document, a suitable URL may be referred to. For documents of general interest, the use of proprietary file formats is discouraged. 9. Breaches of list etiquette should be dealt with privately with the offending list user, and should not result in complaints being sent to the list. Mailing List Archives A full archive is available at http://list.waikato.ac.nz/archives/nznog/ To search the archive, see http://list.waikato.ac.nz/archives/search.html (and remember to select nznog). Subscribing to the List To subscribe to the NZNOG list, send email to majordomo(a)list.waikato.ac.nz, where the body of the message reads subscribe nznog There are at present no restrictions on who may subscribe to the list, or even on who may post to the list. Digest Mailing List If you don't wish to receive postings as they are sent, you can instead subscribe to the nznog-digest mailiing list, on which all postings are sent out in a single "digest" every couple of days. Other Activities NZNOG does not at present have other regular activities than this mailing list, though some Auckland subscribers have been known to meet over beer. Donald Neal NZNOG Mailing List Owner/Administrator/Muggins --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Internet Surveillance / Swain anti-hacking bill
by Lin Nah 28 Nov '00

28 Nov '00

Hi All, As mentioned, there's to be a seminar on the Swain bill. Lech Janczewski will be conducting the seminar. He has been on a fact finding mission, talking to as many people who know anything about this as he can. He wished to present the information gathered "straight from the horses mouth". When I spoke to Lech, he was quite candid in his concerns over this. He didn't know whether the hype was due to media playing it up or whether some of the concerns are true. Lech has had a keen interest in Data security. He was my lecturer in information security a couple of years back and is still teaching the paper. He is also the organiser for the Information Security Forum. He has also been teaching the Data Communications paper ever since I have known him (and probably before that too) in 1990. I am not sure if he's still teaching this paper as I did remember him trying to reduce his workload. The Abstract was in a word document which I will obviously not forward. I have cut and pastes the text into the bottom of this email. Please contact lech if you wish to attend or to find out more about it. regards Lin From: "Aoki, Reiko" <r.aoki(a)auckland.ac.nz> Subject: E-Com Workshop (29/11) Internet Security Date: Sun, 19 Nov 2000 13:29:58 +1300 Next E-Commerce Workshop will be on 29 November (Wed) from noon. Continuing with the theme of internet security, Lech Janczewski (MSIS and New Zealand Information Security Forum) will present the facts and lead a discussion on the plans for a new law announced recently by Hon. Paul Swain, Information Technology Minister (please see attached abstract). The workshop will be at Vice-Chancellor's Room (OGH ground floor). Because of great public interest in the topic, we are inviting experts from outside the University to the workshop. We have asked them to pay for lunch since the Team Development Grant is limited. But please don't be confused...lunch is free to members of the University community as usual. For catering purposes, please reply to Lech ( lech(a)auckland.ac.nz <mailto:lech(a)auckland.ac.nz> ) via email (from university address) by 28 November (Tues) noon. This is the last workshop for this year. The first workshop of the new year will be lead by Ian King (Economics). He will be talking about different methods of selling goods on the internet (auctions and posting prices) and how revenues differ according the market conditions. You can find his working paper (related but not the content of his discussion) on the Workshop website. (Website will be updated as soon as I can figure out how to under the new regime. There is a link from economics department site.) See you on 29th. Thank you. Reiko and Mia << From Janczweski Abstract.doc>> Government power to intercept electronic communication Lech Janczweski (MSIS) Hon. Paul Swain, Information Technology Minister revealed plans of introducing a law giving power to government agencies, like police or the Security Intelligence Service, to intercept electronic communications. Presumably, this legislation will be similar to that existing already in the UK. For a quick reference look into NZ Herald form 16.11.2000 ("Big brother eying your e-mail", [Herald] and "Cyber world fears snoop law", [Business Herald]) That decision would have a significant impact on citizens of this country, our trading partners, as well as law enforcement agencies. We believe that such an important law necessitates a wide discussion not necessary limited to the NZ government and parliamentary circles. Especially electronic commerce and information security specialists need to voice their opinion. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 4

Jobs and stuff
by James Tyson 27 Nov '00

27 Nov '00

Hey all. I am just posting to see if anyone has any jobs available at the moment, I realise this is a bad time of year to be trying to find a job, but when your broke your broke. Anyway, my resume is available at http://www.samizdat.co.nz/resume.pdf I am looking for something sysadminly at an ISP or similar, or possibly some (interesting) web-dev. I would prefer not to work with NT and want to work somewhere where I can tweak routers and unix boxen, and not be pushed into the "router guy" or "unix guy" boxes. Thanks for your time. James Tyson --- Samizdat New Media Solutions --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Auck. Seminar on Swain anti-hacking/internet surveillance bil l
by David Katz 27 Nov '00

27 Nov '00

Would it be at all possible for somebody to do an mp3 recording or the likes of tommorow's discussion? I know it would be much appreciated... David Katz -----Original Message----- From: Lin Nah [mailto:lin(a)darkmere.gen.nz] Sent: Tuesday, November 28, 2000 12:18 PM To: nznog(a)list.waikato.ac.nz Subject: Auck. Seminar on Swain anti-hacking/internet surveillance bill Due to the big interest in this topic, I am posting this for the 2nd (and last time). The seminar is TOMORROW! Only a short thing - ie won't drag on. There will be opportunity for Q&A between audience and speaker(s). After that we have to see if there are questions, discussions etc we need to cover in another session. The seminar will be at Old Govt House. RSVP due to catering ($10 for lunch is all this will cost IIRC). Hope to see a few there. regards Lin On Wed, 22 Nov 2000, Lin Nah wrote: > Hi All, > > As mentioned, there's to be a seminar on the Swain bill. > > Lech Janczewski will be conducting the seminar. He has been on a fact > finding mission, talking to as many people who know anything about this > as he can. He wished to present the information gathered "straight from > the horses mouth". > > When I spoke to Lech, he was quite candid in his concerns over this. > He didn't know whether the hype was due to media playing it up or whether > some of the concerns are true. > > Lech has had a keen interest in Data security. He was my lecturer in > information security a couple of years back and is still teaching the > paper. He is also the organiser for the Information Security Forum. > He has also been teaching the Data Communications paper ever since I have > known him (and probably before that too) in 1990. I am not sure if he's > still teaching this paper as I did remember him trying to reduce his workload. > > The Abstract was in a word document which I will obviously not forward. > I have cut and pastes the text into the bottom of this email. > > Please contact lech if you wish to attend or to find out more about it. > > > regards > Lin > > > From: "Aoki, Reiko" <r.aoki(a)auckland.ac.nz> > Subject: E-Com Workshop (29/11) Internet Security > Date: Sun, 19 Nov 2000 13:29:58 +1300 > > Next E-Commerce Workshop will be on 29 November (Wed) from noon. Continuing > with the theme of internet security, Lech Janczewski (MSIS and New Zealand > Information Security Forum) will present the facts and lead a discussion on > the plans for a new law announced recently by Hon. Paul Swain, Information > Technology Minister (please see attached abstract). > > The workshop will be at Vice-Chancellor's Room (OGH ground floor). Because > of great public interest in the topic, we are inviting experts from outside > the University to the workshop. We have asked them to pay for lunch since > the Team Development Grant is limited. But please don't be confused...lunch > is free to members of the University community as usual. > For catering purposes, please reply to Lech ( lech(a)auckland.ac.nz > <mailto:lech(a)auckland.ac.nz> ) via email (from university address) by 28 > November (Tues) noon. > > This is the last workshop for this year. The first workshop of the new year > will be lead by Ian King (Economics). He will be talking about different > methods of selling goods on the internet (auctions and posting prices) and > how revenues differ according the market conditions. You can find his > working paper (related but not the content of his discussion) on the > Workshop website. (Website will be updated as soon as I can figure out how > to under the new regime. There is a link from economics department site.) > > See you on 29th. Thank you. > > Reiko and Mia > > << From Janczweski Abstract.doc>> > > Government power to intercept electronic communication > > Lech Janczweski (MSIS) > > Hon. Paul Swain, Information Technology Minister revealed plans of > introducing a law giving power to government agencies, like police or > the Security Intelligence Service, to intercept electronic communications. > Presumably, this legislation will be similar to that existing already in > the UK. For a quick reference look into NZ Herald form 16.11.2000 ("Big > brother eying your e-mail", [Herald] and "Cyber world fears snoop law", > [Business Herald]) > > That decision would have a significant impact on citizens of this country, > our trading partners, as well as law enforcement agencies. We believe that > such an important law necessitates a wide discussion not necessary limited > to the NZ government and parliamentary circles. Especially electronic > commerce and information security specialists need to voice their opinion. > > > --------- > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > where the body of your message reads: > unsubscribe nznog > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Aus problems.
by Simon Lyall 21 Nov '00

21 Nov '00

According to the word Telstra have had a cable cut near Singapore which is badly affecting them and some other Aussie ISPs. Nothing on the outages page of course, but it's been happening all evening. "Telstra expect to have their core routers operational within approximately two hours" Also bad flooding in NSW. -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | | Home: simon(a)darkmere.gen.nz ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Fwd: Swain's anti-hacking Bill to Select Committee - Paul Swain
by Andy Linton 21 Nov '00

21 Nov '00

>From: Ministerial Announcements <announce(a)ministers.govt.nz> >To: "All Ministerial releases" <all-releases(a)executive.govt.nz> >Subject: Swain's anti-hacking Bill to Select Committee - Paul Swain >Date: Tue, 21 Nov 2000 09:18:32 +1300 >List-Unsubscribe: <mailto:leave-swain-releases-15379N(a)executive.govt.nz> >List-Unsubscribe: <mailto:leave-all-releases-8282Y(a)executive.govt.nz> >Reply-To: "All Ministerial releases" <all-releases(a)executive.govt.nz> >Sender: owner-nznog(a)list.waikato.ac.nz > >17 November 2000 >Swain's anti-hacking Bill to Select Committee - Paul Swain > >Associate Minister of Justice Paul Swain has welcomed the passage of his >'anti-hacking' bill to the Law and Order Select Committee. I'm not happy that this is spammed to the NZNOG list. It's interesting but it's not an operational issue. It's a press release and I'd be quite happy to read about this in the press. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

Swain's anti-hacking Bill to Select Committee - Paul Swain
by Ministerial Announcements 21 Nov '00

21 Nov '00

17 November 2000 Swain's anti-hacking Bill to Select Committee - Paul Swain Associate Minister of Justice Paul Swain has welcomed the passage of his 'anti-hacking' bill to the Law and Order Select Committee. This afternoon Parliament voted to send the Supplementary Order Paper to Crimes Amendement Bill (Number 6) to the Law and Order Select Committee for submissions and deliberation. "The overarching purpose of this SOP is to make hacking illegal in New Zealand - I think that is vital for every New Zealander who owns a computer. We need to send a strong message that hacking is not cool, it is not clever, it is a serious crime," Paul Swain said. "If it proceeds, this legislation would make accessing a computer system without authorisation a criminal offence punishable by a maximum of two years imprisonment. "At the moment computer hacking is not an offence in New Zealand. "The process now is for the Law and Order Select Committee to hear submissions on the SOP and make deliberations, this is a vital part of the process. This is the stage when the public get to have their say about the Bill. " For that reason I have ensured that there is a lengthy process for consideration by, and submission to the select committee. I propose asking the select committee to report back by the 30th May, which should give ample time for this process. "I have given an absolute assurance that law abiding citizens who are not involved in criminal activity have nothing to fear from this legislation. People will be looking for proof of that assurance when the select committee reports back," Paul Swain said. --- You are currently subscribed to swain-releases as: all-releases(a)executive.govt.nz To unsubscribe send a blank email to leave-swain-releases-15379N(a)executive.govt.nz --- You are currently subscribed to all-releases as: EpistlesFromTheState(a)Hamish.MacEwan.gen.nz To unsubscribe send a blank email to leave-all-releases-8282Y(a)executive.govt.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

NZ Broadband mailing list
by Dan Langille 19 Nov '00

19 Nov '00

I send this message was sent to nz.comp last night. I figured more than one list member would be interested: I've just created the New Zealand broadband mailing list. Given that the ADSL mailing list has grown quite a bit, it's time to split the list. adsl(a)unixathome.org will continue to deal with ADSL. broadband(a)unixathome.org will deal with broadband in general and delivery methods such as ISDN, satellite, Saturn cable, chello, IHUG Ultra, etc. Those who wish to subscribe to the new list should send a message to majordomo(a)unixathome.org with "subscribe broadband" in the body of the message. The archives for the new list, once there is something to archive, will go online later this week at http://unixathome.org/broadband/ cheers -- Dan Langille The FreeBSD Diary - http://www.freebsddiary.org/ FreshPorts - http://freshports.org/ --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Internet Surveillance
by Joe Abley 15 Nov '00

15 Nov '00

Hi, ISOCNZ have a working group looking at Internet Surveillance, and are attempting to decide on a position from which to make recommendations to the Government. It hasn't been running long. http://listserver.actrix.co.nz/mailman/listinfo/isocnz-iswg There was some noise in the press about police powers with respect to internet surveillance recently (although not much signal). I'm trying to look at the operational impact of legislation in this area. Ignoring the philosophical debate about what is and what isn't appropriate about surveillance in general, or about police powers to gather evidence from ISPs: + suppose the police have sufficient cause to be suspicious about the antics of one of your customers that they obtain a court order which entitles them to "tap their internet traffic". Suppose you decided (or were compelled) to facilitate the "tap". o what is reasonable for them to tap? Incoming (to-customer) e-mail? Outgoing (from-customer) e-mail? A complete packet dump? o If you have customers who don't have static IP addresses, is it feasible to collect data from an individual subscriber without collecting it from a whole bunch of others at the same time? o would you be happy letting someone from the police connect her own equipment to your network in order to gather the evidence the court order entitled them to collect? Would you prefer to do it yourself? o would your company expect to be reimbursed for the time spent facilitating the "tap"? o how easy would it be for you to insert something in your network to capture all packets to/from one of your customers? (scale of 1 [trivial] to 10 [impossible]) o assuming it was possible, how much inconvenience would it cause to other customers to put the tap in place? (scale of 1 [none] to 10 [take them off the air for the duration of the tap]) + suppose all interception of network traffic was prohibited across the board without a court order; i.e. you were compelled to shift your customers' traffic blindfolded, and were absolutely not allowed to look at it. Would this be feasible? How much troubleshooting would be impossible under these kinds of conditions? + do you have a clause in your contract with your customers which permits you to inspect customer traffic for operational (or other) purposes? + are you aware of hooks in your network hardware which are designed to allow customer traffic to be intercepted? Joe --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

16 21

RE: Internet Surveillance
by David Katz 15 Nov '00

15 Nov '00

One just needs to look at the US and the whole fiasco that Carnivore has created to find out that this will be much more difficult than it appears... ;) -----Original Message----- From: Michael Newbery [mailto:Michael.Newbery(a)telstrasaturn.co.nz] Sent: Thursday, November 16, 2000 3:58 PM To: nznog(a)list.waikato.ac.nz Subject: Re: Internet Surveillance At 11:22 AM -0500 6/11/00, Joe Abley wrote: > >I'm trying to look at the operational impact of legislation in >this area. Ignoring the philosophical debate about what is and >what isn't appropriate about surveillance in general, or about >police powers to gather evidence from ISPs: [After not a lot of people responded, Joe attempted to shame us into replying. For the record, I'm too busy (excuse #2)] > > + suppose the police have sufficient cause to be suspicious > about the antics of one of your customers that they obtain > a court order which entitles them to "tap their internet > traffic". Suppose you decided (or were compelled) to > facilitate the "tap". > > o what is reasonable for them to tap? Incoming (to-customer) > e-mail? Outgoing (from-customer) e-mail? A complete packet > dump? Email, probably. A complete packet dump could present problems. I would be unwilling to do anything that would cost us money--without appropriate recompense---or that would impact network performance---in any event. I am unwilling to slow my STM-1024 down to V.24 speeds so I can wiretap. > o would you be happy letting someone from the police connect > her own equipment to your network in order to gather the > evidence the court order entitled them to collect? Would > you prefer to do it yourself? In general, no. I doubt their laptop has a suitable STM-1024 interface. Where possible, yes, under our supervision. > > o would your company expect to be reimbursed for the time > spent facilitating the "tap"? Of course. Actually, I'd expect that my company could and therefor should just write the cost off to civic welfare, but I think that a struggling ISP might not appreciate having to stump up overtime for several people to make the tap work. > > o how easy would it be for you to insert something in your > network to capture all packets to/from one of your customers? > (scale of 1 [trivial] to 10 [impossible]) 1-10. It depends on which customer and where in the network. > + suppose all interception of network traffic was prohibited > across the board without a court order; i.e. you were compelled > to shift your customers' traffic blindfolded, and were absolutely > not allowed to look at it. Would this be feasible? How much > troubleshooting would be impossible under these kinds of > conditions? Depends on how it's worded. In the extreme case, if I can't look at my customers' packets, I (my routers) can't read the address headers and the packets never make it past the first RJ-45! I would consider the wording in the current radio regs for amateurs has the right flavour. In the event that you intercept communications not intended for you, you are required to act as if you had not in fact intercepted the communications. In particular you must not communicate them to a third party. What's the statement? "Hard cases make bad law"? I shudder to think how to draught legislation that accurately and unambiguously sets out the rights and obligations of all parties and also keep up with technology. Let's just promote PGP a lot :-) -- Michael Newbery Technical Specialist Telstra Saturn Tel: +64-4-939 5102 Mobile:02-939 5102 Fax:+64-4-939 5100 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

FBI responds to Carnivore criticism will deploy "Childsaver"
by Hamish MacEwan 15 Nov '00

15 Nov '00

WASHINGTON, D.C. (Routers) -- FBI Director Louis Freeh announced today that the Federal Bureau of Investigation takes the criticism of its wiretapping computer sniffer Carnivore "very seriously." In a hastily-called press conference, he acknowledged that the FBI had "underestimated the importance of the Constitution to the citizen-units.' "We are withdrawing Carnivore at this time," he said to an assembled audience of journalists, activists, and visiting death squad officials from South America. "Simply put, we expected citizen-units to simply shrug off our latest surveillance measures. That, and the name. Apparently we insulted the vegetarian and vegan contingent," he joked. Director Freeh announced that while Carnivore was being withdrawn, the FBI would go ahead with deployment of a much more powerful system called "Childsaver." "Childsaver is our next-generation "first mover advantage" product," said Freeh, adopting the FBI's new dotcom-friendly jargon. "Childsaver is a best-of-breed product. It gives us a powerful edge in the surveillance space, and we think our investors will be happy." Childsaver, as Director Freeh explained it, will require suppliers of browsers and mail programs to install the Childsaver plug-in in every program shipped. "Childsaver will allow the legitimate needs of law enforcement by enabling lawful surveillance orders to be carried out swiftly and undetectably." When asked by a reporter if Carnivore had always been intended as a sacrifice move, to be abandoned and replaced by the better-sounding Childsaver, Director Freeh referred all such questions to the Ministry of Truth. Check the source. Hamish. -- We are each of us angels with only one wing, and we can only fly by embracing one another. -Luciano de Crescenzo --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Seminar by Dr Christophe (Sprint)
by Tony McGregor 13 Nov '00

13 Nov '00

The following seminar is being hosted by the Waikato University network research group (WAND). NZNOG visitors are welcome, let me know if you plan to attend so we can lay in supplies. Tony ---- Experiences Monitoring Backbone IP Networks Conducted by Dr Christophe Diot IP research Group, Sprint We present our experiences with monitoring traffic on the Sprint IP backbone network using the passive monitoring DAG OC-3/OC-12 card developed at the University of Waikato. We currently have 11 monitoring systems installed at one location, however managing a monitoring system of this scale is a challenging task since each link monitored can generate up to 100 GB of data each day. We discuss techniques for transferring the data to the lab, storing the data, and efficiently processing. Finally we present results that demonstrate the capabilities of our system and provide information which is useful in developing future measurement systems. Christophe Diot received a Ph.D. degree in Computer Science from INP Grenoble in 1991. From 1993 to 1998, he was a research scientist at INRIA Sophia Antipolis, working on new Internet architecture and protocols. Diot moved to Sprint Advanced Technology Laboratory in October 1998 to take the lead of the IP research group. His current interest is in deployable multicast (SSM) and Internet resource control. Diot is also member of IEEE and ACM, member of the COST 264 action, and serves as an editor for ACM/IEEE Transactions on Networking. Presented on Thursday 16 Nov 2000 at 4:00pm School Meeting Room, GG-12 ---- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Internet Surveillance
by Tony Wicks 12 Nov '00

12 Nov '00

yes, prepaid - http://www.mysurf.net.nz btw, users on mysurf ( which has just ben launched ) are address translated and blocked from accessing Asia Online Mail servers or news servers. They only have web-based mail. if you have any problems with anti-social activities from mysurf pre-paid users please email helpdesk(a)nz.asiaonline.net -----Original Message----- From: owner-nznog(a)list.waikato.ac.nz [mailto:owner-nznog(a)list.waikato.ac.nz]On Behalf Of Joe Abley Sent: Monday, 13 November 2000 9:01 a.m. To: Shane Cole Cc: nznog(a)list.waikato.ac.nz Subject: Re: Internet Surveillance On Mon, Nov 13, 2000 at 08:53:43AM +1300, Shane Cole wrote: > Just one thing, what are they going to do about people using prepaid ^^^^^^^ > internet on prepaid cellular to do there naughtyness... Prepaid? --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

7 10

RE: Internet Surveillance
by Sid Jones 12 Nov '00

12 Nov '00

At 21:53 12/11/2000 +0000, Jeremy Clyma wrote: >BTW isn't it time for a NZNOG pissu^H^H^H meeting again soon? Wellington or Auckland? -- Sid --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

FW: Internet Surveillance
by Tony Wicks 12 Nov '00

12 Nov '00

Actually, what I meant is that if there proves to be a significant number of complaints then Asia Online / Vodaphone management will need to take another look at the policy ( not me ! ). -----Original Message----- From: Joe Abley [mailto:jabley(a)automagic.org] Sent: Monday, 13 November 2000 10:13 a.m. To: Jeremy Clyma Cc: Tony Wicks Subject: Re: Internet Surveillance On Sun, Nov 12, 2000 at 08:41:09PM +0000, Jeremy Clyma wrote: > No, its not only a problem if you run an open relay.... > > Certain individuals provide lists of badly secured smtp servers which I > can just see a prepaid spammer for hire, abusing to their hearts content. Ah, but as Tony pointed out, you can always complain to the asia online helpdesk. "I'm sorry, we have no idea who that user is, so I guess they might well do it again. Yes, that does suck. Goodbye, thanks for calling." :) --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Further to Australian Domain Name allocation policies and CER
by Frank March 09 Nov '00

09 Nov '00

An obvious follow up question winged my way within minutes of my post on acquisition of a domain name in the .com.au space: how does one acquire an ABN? Basically you need to fill in a form (AFAIK online registration is not possible, roll on e-Govt :-). Buckets of forms are held by TradeNZ and the contact is David Robertson, (04) 496 6414. I am informed that the forms may raise some questions as they are intended for Australians (for example, the form asks for Australian addresses but apparently NZ addresses will do just as well). The Manufacturers' Association and the Export Institute of NZ also have copies of the forms. Further information may be found at the MFAT Australian Division pages at http://www.mft.govt.nz/foreign/regions/australia.html Good hunting. Frank March Specialist Advisor, IT Policy Group Ministry of Economic Development, PO Box 1473, Wellington, NZ Ph: (+64 4) 474 2908; Fax: (+64 4) 471 2658 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Australian Domain Name allocation policies and CER
by Frank March 09 Nov '00

09 Nov '00

Not a technical issue but one which will nevertheless be of interest to subscribers to this list. At the July summit held by ISOCNZ to discuss issues relating to ICANN and DNS policies, a member raised a question about the apparent lack of reciprococity between Australian DN allocation policies and those of NZ and whether this was an issue which should be dealt with under the CER arrangements. Because there is no restriction on who may register in .co.nz, any Australian firm wanting to e-trade in NZ using an apparently indigenous address can do so. But, because registration in .com.au is restricted to Australian firms, NZ firms wishing to trade in Australia using an apparently Australian indigenous address may be disadvantaged. We (MED) raised this as an issue in the context of the biennial review of CER arrangements but it was somehow sidelined. We have finally got an answer to the question. While this has been a problem in the past, New Zealand firms are now able to acquire an Australian Business Number (ABN) for GST registration purposes. The converse has long been true: Australian firms can register in NZ for GST and thus acquire a NZ GST number. I have received confirmation today from Jan Webster, Manager, Policy Implementation, Internet Names WorldWide, a division of Melbourne IT Ltd, that any firm with an ABN qualifies for registration in the .com.au space. They also accept applications from foreign companies which have an ARBN and are therefore registered to trade in Australia. In both cases there are other non-residency requirements that need to be met as well, of course. You may wish to pass this information on to anyone with an interest in this area. Frank March Specialist Advisor, IT Policy Group Ministry of Economic Development, PO Box 1473, Wellington, NZ Ph: (+64 4) 474 2908; Fax: (+64 4) 471 2658 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: IHUG MX records
by Tech Support 07 Nov '00

07 Nov '00

For Netlink/Telstra try us on 04 922 8499 or (preferably) tech(a)tsnz.net FWIW I'm sure our phone system would cut you off waaaaay before 1/2 an hour ;) If Gary or myself can't help, we can usually find the person who can, and (as long as you say who you are and where you are from) we won't ask for account numbers. Peter Mott wrote: <snip> But many of the problems we experience are at another layer, dns mail web etc. None of us here have the time or enthusiasm to wait for the standard 1/2 hour so so to get an answer on a help desk and then try to get the person to stop demanding our ISP account number and what version of windows we are running. Maybe each ISP needs to appoint a technical advocate that can be the contact point for other ISP's. The advocate can then run around with some internal knowledge and find the person responsible for solving the problem, whilst making sure the issue gets resolved. <snip> Cheers, Peter Gray Telstra Saturn Tech Support E-mail: tech(a)tsnz.net Phone: 0800 949 000 Fax: 04 922 8401 Website: www.netlink.net.nz PO Box 5358, Wellington, New Zealand "Smile," they said "things could be worse!" So I smiled, and things were worse.... --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

netscan.org has query by AS
by Simon Lyall 07 Nov '00

07 Nov '00

It's seems to be fairly new, so people might want to have a look especially the people from AS 4768 . Just goto http://www.netscan.org/ and put your ASN in the box. -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | | Home: simon(a)darkmere.gen.nz ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

10 16

RE: IHUG MX records
by David Katz 02 Nov '00

02 Nov '00

I would have to agree with this... When dealing with zone files, and their modifications, I have found 2day.com (a direct competitor to our business) to be much swifter in response and more co-operative than IHUG albeit they are also a direct competitor - but at least in the time of internetworking we really need to be able to have a bit of the "inter" part working to keep the whole "network" running...and I've found 2day to be very helpful in that regard. Dave. -----Original Message----- From: Peter Mott [mailto:peter(a)2day.com] Sent: Friday, November 03, 2000 5:50 PM To: Simon Lyall Cc: nznog(a)list.waikato.ac.nz Subject: RE: IHUG MX records > On Fri, 3 Nov 2000, Peter Mott wrote: > > p.s. Dont ring the IHUG operator and ask for NOC. I got put through to > > somebody who had never heard of 2day.com > > The guy on duty can't be expected to have heard of every little ISP in the > country, especially those that we don't exchange money with or peer with. Given the size of the New Zealand market and the fact that we manage more zones than IHUG, not to mention our visibility in the market, I think this is a little rich. > > and was more interested in finding > > out how I managed to get connected to the NOC from the outside world. > > People are NOT supposed to be put through to the NOC without announcing > them and without at least trying to work out what their problem is first. I am not people. I am not even a poor IHUG customer. I am a fellow ISP expecting a little cooperation and respect. My motive was to get a mutual customer back on the air. > People can ring our NOC number in emergancies (ie our filters have gone > bad and a full routing table is melting your router) but I think the duty > NOC guy thought you were some customer who had bluffed his way through the > helpdesk. He may well have, but I made myself very clear about who I was. There is a world beyond IHUG. Suggest you lot open your eyes. Not everybody is the enemy in your war. Regards Peter Mott Chief Enthusiast 2day.com -/- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

The New Zealand Network Operators' Group
by Donald Neal 02 Nov '00

02 Nov '00

The New Zealand Network Operators' Group The New Zealand Network Operators' Group (NZNOG) has no king, president or formal membership. At present it consists of the subscribers to this mailing list, which anyone is free to join. At last count the list had just under 180 subscribers, with the count growing by around five each month. The NZNOG mailing list is provided through a server at The University of Waikato, and is administered by an employee of Telecom NZ Ltd. Neither of these organisations (nor the administrator) is responsible for its content. NZNOG Mailing List Acceptable Use Policy The NZNOG mailing list exists to provide a forum for the exchange of technical information and the discussion of implementation issues that require cooperation among New Zealand network service providers. In order to continue to provide a useful forum for discussion of relevant technical issues, users of the list are asked to respect the following guidelines. 1. Discussion will focus on Internet operational and technical issues. 2. Discussion related to meetings of network service providers is appropriate. 3. Discussion unrelated to these topics is not appropriate. 4. Postings to multiple mailing lists are discouraged. 5. Postings that include foul language, character assassination, and lack of respect for other participants are unacceptable. 6. Blatant product or service marketing is unacceptable. 7. Postings of a political, philosophical or legal nature are discouraged. 8. Postings to the list should be in ASCII or MIME encoded as text/plain. Attachments should not be sent to the list. To present a document, a suitable URL may be referred to. For documents of general interest, the use of proprietary file formats is discouraged. 9. Breaches of list etiquette should be dealt with privately with the offending list user, and should not result in complaints being sent to the list. Mailing List Archives A full archive is available at http://list.waikato.ac.nz/archives/nznog/ To search the archive, see http://list.waikato.ac.nz/archives/search.html (and remember to select nznog). Subscribing to the List To subscribe to the NZNOG list, send email to majordomo(a)list.waikato.ac.nz, where the body of the message reads subscribe nznog There are at present no restrictions on who may subscribe to the list, or even on who may post to the list. Digest Mailing List If you don't wish to receive postings as they are sent, you can instead subscribe to the nznog-digest mailiing list, on which all postings are sent out in a single "digest" every couple of days. Other Activities NZNOG does not at present have other regular activities than this mailing list, though some Auckland subscribers have been known to meet over beer. Donald Neal NZNOG Mailing List Owner/Administrator/Muggins --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Final Agenda - ICANN Outreach Seminar - Nov 7-9
by Sue Leader 02 Nov '00

02 Nov '00

Greetings Further to my previous email the final agenda for the Seminar is available at: http://www.isocnz.org.nz/aptld_icann_outreach_001102.html. The plain text is below. The event is free and open to the public. Cheers Sue ++++++++++++ Text version APTLD/APNIC PACIFIC OUTREACH PROGRAM This Event is Free and Open to the Public - to find out how to get to UNITEC please go to UNITEC's maps page http://www.unitec.ac.nz/services/maps/howtoget.html If you plan to attend an RSVP to sguest(a)mail.nu would be appreciated Tuesday, November 7: Red Room UNITEC Auckland 0900 0915 Welcome - Gael McDonald, Dean, Faculty of Business, UNITEC 0915 1015 Introduction to ICANN - Jennifer Northover, Councilor, Internet Society of New Zealand Inc (ISOCNZ) - history - constituents - working groups - why you should participate - how to participate 1015 1045 APTLD - Dr Byung Kyu Kim of KRNIC (Korea) - history - structure - why you should participate - how you can participate 1045--1100 Morning tea break 1100 --1200 ASO - Paul Wilson, APNIC - History of IP Address Management - Introduction to the Regional Internet Registries - Address Supporting Organisation 1200 1300 LUNCH 1300 -- 1430 Voluntary Reports from Pacific ccTLDs: Niue, Cook Islands, Fiji, Vanuatu, Tuvalu, Solomons, Samoa, American Samoa, Tonga, Norfolk Island (Facilitator: Stafford Guest: ".nu") 1430 1530 Government Advisory Committee (GAC) Governments role in internet governance - Frank March, Senior IT Policy Advisor, NZ Ministry of Economic Development 1530 1600 AFTERNOON TEA 1600 1630 New Zealands Shared Registry Project: status report - Rick Shera, SRS Working Group, Lowndes Jordan, Auckland 1630 Networking (CSI sponsors) Wednesday, November 8 0900 1100 APNIC - Paul Wilson and Anne Lord - Introduction to APNIC - APNIC Status Report - Introduction to IP Address Management - APNIC Policies and Procedures - How to be an APNIC Member 1100 1115 MORNING TEA 1115 -- 1145 A Coming Issue: Multi Lingual Domain Names Ray Brownrigg, Victoria University, Wellington 1145 1230 Protection of Famous Names Trade Marks and the Internet - Bryan Thompson, Partner, A J Park, Auckland 1230 1330 LUNCH 1330-1400 Uniform Dispute Resolution Process Stafford Guest Internet Users Society Niue (IUS-N) 1400-1500 Country Code Registries and ICANN - Sue Leader Executive Director - ISOCNZ - do they need contracts with ICANN? - Best Practice models 1500 1530 AFTERNOON TEA 1530 -- 1700 Issues for the Internet in the Pacific: Shared Problems plenary discussion. Chair: Jim Higgins, New Zealand 1700 Networking Thursday, November 9: Blue Room APNIC training seminar. Organised by APNIC. (Attendance By Invitation) Sue Leader - Executive Director ISOCNZ (Internet Society of New Zealand Inc) Exe.Dir(a)isocnz.org.nz Voice: +64-4-801-6256 http://www.isocnz.org.nz Postal: Level 1, (e)-Vision Centre, 282 Wakefield St, Wellington "Error: Press any key to continue or any other key to quit..." --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Cisco 2514
by James Tyson 29 Oct '00

29 Oct '00

Hey all. I'm looking to get hold of a second hand 2514 (you know, 1RU, 2 ethernet ports) second hand. If anyone has one then let me know. Cheers. --- James Tyson Moebius Systems Ltd http://www.moebius.co.nz/ --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 6

Waikato University secondary name server shutdown -- LAST WARNING
by Andrew McGhie 26 Oct '00

26 Oct '00

On Tuesday, 31 October 2000, the Waikato University secondary name service for .nz domains (ns1.waikato.ac.nz) will be shut down. Users of this service should migrate to the Domainz public secondary (pubsec.domainz.net.nz) or other secondary name services. Domains that have not been migrated from ns1.waikato.ac.nz by 5pm on 31 October will be re-delegated to use pubsec.domainz.net.nz, and secondary service set up accordingly. However, since this change can not update configurations of primary name servers for name holder domains, the following adverse effects may be noted: (1) The delegation information at the .nz name servers will not match the delegation records held at the primary, and queries may still be directed to ns1.waikato.ac.nz due to caching; (2) The public secondary (pubsec.domainz.net.nz) may not be able to transfer domains from the primary servers. This may be due to firewalls or the primary name servers being configured to only permit name transfers from ns1.waikato.ac.nz. (The IP address for ns1.waikato.ac.nz is 140.200.128.13; for pubsec.domainz.net.nz it is 202.46.160.4.) To avoid these problems, please update your name service before the closedown. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Route Advertisments
by Tony Wicks 25 Oct '00

25 Oct '00

Hi all below is an updated prexix list of the Asia Online NZ ( ICONZ ) networks. Can those of you who we peer with please update your access lists.Note, the changes are the last two lines. cheers ip prefix-list AONZ-networks description networks(a)nz.asiaonline.net ip prefix-list AONZ-networks seq 5 permit 202.14.100.0/24 ip prefix-list AONZ-networks seq 10 permit 210.48.0.0/17 ip prefix-list AONZ-networks seq 15 permit 192.173.16.0/21 ip prefix-list AONZ-networks seq 20 permit 192.188.185.0/24 ip prefix-list AONZ-networks seq 25 permit 202.6.84.0/24 ip prefix-list AONZ-networks seq 30 permit 202.12.70.0/24 ip prefix-list AONZ-networks seq 35 permit 202.27.99.0/24 ip prefix-list AONZ-networks seq 40 permit 202.36.36.0/22 ip prefix-list AONZ-networks seq 45 permit 202.36.76.0/24 ip prefix-list AONZ-networks seq 50 permit 202.36.77.0/24 ip prefix-list AONZ-networks seq 55 permit 202.37.76.0/24 ip prefix-list AONZ-networks seq 60 permit 202.37.85.0/24 ip prefix-list AONZ-networks seq 65 permit 202.37.132.0/24 ip prefix-list AONZ-networks seq 70 permit 202.37.138.0/23 ip prefix-list AONZ-networks seq 75 permit 202.37.140.0/22 ip prefix-list AONZ-networks seq 80 permit 202.37.148.0/24 ip prefix-list AONZ-networks seq 85 permit 202.37.144.0/21 ip prefix-list AONZ-networks seq 90 permit 202.37.163.0/24 ip prefix-list AONZ-networks seq 95 permit 202.37.171.0/24 ip prefix-list AONZ-networks seq 100 permit 202.37.184.0/23 ip prefix-list AONZ-networks seq 105 permit 202.37.186.0/24 ip prefix-list AONZ-networks seq 110 permit 202.37.192.0/23 ip prefix-list AONZ-networks seq 115 permit 202.37.197.0/24 ip prefix-list AONZ-networks seq 120 permit 202.37.200.0/22 ip prefix-list AONZ-networks seq 125 permit 202.37.229.0/24 ip prefix-list AONZ-networks seq 130 permit 202.37.224.0/21 ip prefix-list AONZ-networks seq 135 permit 202.37.249.0/24 ip prefix-list AONZ-networks seq 140 permit 202.37.248.0/22 ip prefix-list AONZ-networks seq 145 permit 202.37.252.0/24 ip prefix-list AONZ-networks seq 150 permit 202.49.144.0/24 ip prefix-list AONZ-networks seq 155 permit 202.50.16.0/20 ip prefix-list AONZ-networks seq 160 permit 203.99.65.0/24 ip prefix-list AONZ-networks seq 165 permit 203.99.66.0/24 ip prefix-list AONZ-networks seq 170 permit 203.99.71.0/24 ip prefix-list AONZ-networks seq 175 permit 210.54.0.0/22 <--- Changed ip prefix-list AONZ-networks seq 180 permit 138.235.0.0/16 <--- New --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Enz of an Era
by Dean Pemberton 19 Oct '00

19 Oct '00

Most of you are not going to care about this in the slightest, but I've just resigned at Lucent. I'll be starting with a small company called Juniper Networks helping to set up their regional support center in Sydney in late November. Maybe some you have heard of them =). Later Dean -- ----------------------------------------------------------------------- Dean Pemberton - dp(a)lucent.com Linux User# 157870 Guy who does stuff at Lucent Technologies - Bell Labs Innovations Lvl 38, 55 Collins St, Melbourne 3000, Australia Current Location - 144d58.391'E 37d48.737'S (Work) ----------------------------------------------------------------------- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RFC's
by James Tyson 19 Oct '00

19 Oct '00

Can anyone think of any RFC's that should be mentioned inside a networks Abuse/Security policy? All I have so far is RFC2142. Cheers. James Tyson --- Samizdat New Media Solutions --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

bgp
by Tony Wicks 19 Oct '00

19 Oct '00

Hi all, just to let you all know ( for those doing bgp filtering ) Asia online ( as4770 ) is now advertising the downstream as17427. an up to date prefix list is - ip prefix-list AONZ-networks description networks(a)nz.asiaonline.net ip prefix-list AONZ-networks seq 5 permit 202.14.100.0/24 ip prefix-list AONZ-networks seq 10 permit 210.48.0.0/17 ip prefix-list AONZ-networks seq 15 permit 192.173.16.0/21 ip prefix-list AONZ-networks seq 20 permit 192.188.185.0/24 ip prefix-list AONZ-networks seq 25 permit 202.6.84.0/24 ip prefix-list AONZ-networks seq 30 permit 202.12.70.0/24 ip prefix-list AONZ-networks seq 35 permit 202.27.99.0/24 ip prefix-list AONZ-networks seq 40 permit 202.36.36.0/22 ip prefix-list AONZ-networks seq 45 permit 202.36.76.0/24 ip prefix-list AONZ-networks seq 50 permit 202.36.77.0/24 ip prefix-list AONZ-networks seq 55 permit 202.37.76.0/24 ip prefix-list AONZ-networks seq 60 permit 202.37.85.0/24 ip prefix-list AONZ-networks seq 65 permit 202.37.132.0/24 ip prefix-list AONZ-networks seq 70 permit 202.37.138.0/23 ip prefix-list AONZ-networks seq 75 permit 202.37.140.0/22 ip prefix-list AONZ-networks seq 80 permit 202.37.148.0/24 ip prefix-list AONZ-networks seq 85 permit 202.37.144.0/21 ip prefix-list AONZ-networks seq 90 permit 202.37.163.0/24 ip prefix-list AONZ-networks seq 95 permit 202.37.171.0/24 ip prefix-list AONZ-networks seq 100 permit 202.37.184.0/23 ip prefix-list AONZ-networks seq 105 permit 202.37.186.0/24 ip prefix-list AONZ-networks seq 110 permit 202.37.192.0/23 ip prefix-list AONZ-networks seq 115 permit 202.37.197.0/24 ip prefix-list AONZ-networks seq 120 permit 202.37.200.0/22 ip prefix-list AONZ-networks seq 125 permit 202.37.229.0/24 ip prefix-list AONZ-networks seq 130 permit 202.37.224.0/21 ip prefix-list AONZ-networks seq 135 permit 202.37.249.0/24 ip prefix-list AONZ-networks seq 140 permit 202.37.248.0/22 ip prefix-list AONZ-networks seq 145 permit 202.37.252.0/24 ip prefix-list AONZ-networks seq 150 permit 202.49.144.0/24 ip prefix-list AONZ-networks seq 155 permit 202.50.16.0/20 ip prefix-list AONZ-networks seq 160 permit 203.99.65.0/24 ip prefix-list AONZ-networks seq 165 permit 203.99.66.0/24 ip prefix-list AONZ-networks seq 170 permit 203.99.71.0/24 ip prefix-list AONZ-networks seq 175 permit 210.54.0.0/23 ip prefix-list AONZ-networks seq 180 permit 210.54.2.0/24 I expect to be adding another class b network ( belonging to a customer unfortunately ) next week. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0