- NZNOG - lists.nznog.org

'we should all be uncomfortable with the extent to which luck..'
by k claffy 24 Jul '01

24 Jul '01

david moore's analysis of code red: episode 0/1 is at http://www.caida.org/analysis/security/code-red/ [funded by DARPA's ITO office NGI/NMS programs, NSF ANIR, and CAIDA members, david a caida PI] definitely check out jeff brown's animation at bottom; watch carefully around 15:00 for pretty ominous elbow in infection rate (get an epidemiologist to look at it without telling them what it is...) 360,000 machines (well, IP addresses) infected in under 14 hours. from conclusion: // ..in the final analysis, we should all be uncomfortable with the extent to which luck, rather than proactive diligence, maintains the stability of the Internet infrastructure. // it goes without saying that many hosts are still vulnerable. and will likely remain so (to this or the next poison) until our luck runs out. do we expect the next version to have the two weaknesses christopher pointed out today? do we expect the next version won't clear every 3rd bit on the hard drive? almost makes me wonder if some white hat might (should?) have been behind CodeRed as some 'vaccination' attempt. "The bad news is, nobody will do anything about critical infrastructure protection until there's a global catastrophic failure," said Rasch. The good news is, there will be a global catastrophic failure." -- http://www.nando.net/technology/story/44887p-694372c.html the worse news is: protecting 'critical infrastructure' is far from enough. again from http://www.caida.org/analysis/security/code-red/ This assault also demonstrates that machines operated by home users or small businesses (hosts less likely to be maintained by a professional sysadmin) are integral to the robustness of the global Internet. As is the case with biologically active pathogens, vulnerable hosts can and do put everyone at risk, regardless of the significance of their role in the population. fwiw, caida trying to do gentle survey of patching speed, see http://worm-security-survey.caida.org/ k ps: john maddog hall (linux int'l) had a great slide a few months ago at UCSD talk; upshot something like INSTALLED BASE (EARTH) + 20 million linux systems + 450 million gates licenses ==> 4.4 - 6.6 % of the population total ... world population: ~6B ==> 5.4 billion people haven't selected an OS yet [k: maybe we can get them on OS-antioxidants before it's too late] --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: anything going?
by Simon Lyall 24 Jul '01

24 Jul '01

On Wed, 25 Jul 2001, Matt Camp wrote: > Anyone know of any jobs going for experienced > IP/Cisco/Lucent/Unix/perl/php/database/networky type engineers that > don't suck? > > This ones getting kinda old, (the job, not the engineer) and the pay is > actually decreasing. You could apply at ihug Matt, someone with NT experience would be useful :) Actually does anyone know the best places to find jobs in the industry? , I notice that Telecom and I assume most of the others don't advertise a lot of their jobs online (or on their own websites). ObOperational: www.whitehouse.gov has akamai's themselves. Resume online here. | | V -- Simon J. Lyall | Very Busy | Web: http://www.darkmere.gen.nz/ "To stay awake all night adds a day to your life" - Stilgar | eMT. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

6 5

Re: anything going?
by Donald Neal 24 Jul '01

24 Jul '01

Simon Lyall: >You could apply at ihug Matt, someone with NT experience would be useful :) >Actually does anyone know the best places to find jobs in the industry? , I >notice that Telecom and I assume most of the others don't advertise a lot >of their jobs online (or on their own websites). Telecom's jobs are at http://telecomnz.hire.com/joblist.html, which is linked to from the official web site. Donald Neal (who works for Telecom but generally does not speak for them) -- Donald Neal Mobility & Calling Platforms Network Delivery Telecom New Zealand Ltd --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

anything going?
by Matt Camp 24 Jul '01

24 Jul '01

Anyone know of any jobs going for experienced IP/Cisco/Lucent/Unix/perl/php/database/networky type engineers that don't suck? This ones getting kinda old, (the job, not the engineer) and the pay is actually decreasing. --- Matt Camp Head Geek Mercury/Quicksilver --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

SuSe Linux Mirrors
by Matthew G Brown 23 Jul '01

23 Jul '01

Anyone Mirroring SuSe 7.x ? , 3.0 isn't cutting the mustard :) Matthew G Brown Tasman Solutions LTD --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Blank vendor letter
by Andrea Moran 23 Jul '01

23 Jul '01

Hi! How are you? I send you this file in order to have your advice See you later. Thanks

5 5

Fax to vendor
by Andrea Moran 23 Jul '01

23 Jul '01

Hi! How are you? I send you this file in order to have your advice See you later. Thanks

5 4

NZNOG Posting Policy
by Donald Neal 23 Jul '01

23 Jul '01

NZNOG People, At present, NZNOG accepts postings from anywhere. A previous effort to switch to accepting mail only from subscribed addresses was abandoned due to the inconveince caused. If anyone wishes another attempt made at that change, please contact me directly. Donald Neal List Administrator -- Donald Neal Mobility & Calling Platforms Network Delivery Telecom New Zealand Ltd --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Antigen found Win32.SirCam.137216 (CA(Vet)) virus
by Antigen 23 Jul '01

23 Jul '01

Antigen for Exchange found Blank vendor letter.doc~pif infected with Win32.SirCam.137216 (CA(Vet)) virus. The file is currently Removed. The message, "Blank vendor letter", was sent from Andrea Moran and was discovered in SMTP Messages\Inbound located at JUNIPER/AMERICAS/BETA. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Antigen found Win32.SirCam.137216 (CA(Vet)) virus
by Antigen 23 Jul '01

23 Jul '01

Antigen for Exchange found Fax to vendor.doc~bat infected with Win32.SirCam.137216 (CA(Vet)) virus. The file is currently Removed. The message, "Fax to vendor", was sent from Andrea Moran and was discovered in SMTP Messages\Inbound located at JUNIPER/AMERICAS/BETA. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Fax to vendor
by Steven Perich 23 Jul '01

23 Jul '01

Guys, Anyone with half a brain who's concerned about security wouldn't open this, I know, but I thought I'ld inform the masses of this as a friendly, public service announcement :-) Scan type: Realtime Protection Scan Event: Virus Found! Virus name: W32.Sircam.Worm(a)mm File: Fax to vendor.doc.bat Location: Mail System Action taken: Clean failed : Quarantine succeeded : Date found: Tue Jul 24 09:22:26 2001 Steve > -----Original Message----- > From: owner-nznog(a)list.waikato.ac.nz > [mailto:owner-nznog(a)list.waikato.ac.nz]On Behalf Of Andrea Moran > Sent: Tuesday, July 24, 2001 09:06 > To: nznog(a)list.waikato.ac.nz > Subject: Fax to vendor > > > Hi! How are you? > > I send you this file in order to have your advice > > See you later. Thanks > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Fax to vendor
by Greg Clare 23 Jul '01

23 Jul '01

WARNING:- This message contained a virus (W32.Sircam.Worm(a)mm). For more details refer:- http://service1.symantec.com/SUPPORT/nav.nsf/aab56492973adccd882569450055235 5/f75929f63f73df5f882569a80022dbd0?OpenDocument Norton Virus definitions dated 17 July 2001 or later will detect this recent worm. Regards Greg > -----Original Message----- > From: Andrea Moran [mailto:andrea(a)petrinamoran.freeserve.co.uk] > Sent: Tuesday, 24 July 2001 9:06 am > To: nznog(a)list.waikato.ac.nz > Subject: Fax to vendor > > > Hi! How are you? > > I send you this file in order to have your advice > > See you later. Thanks > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

(no subject)
by AngelaMcIntee＠aol.com 23 Jul '01

23 Jul '01

Can anyone tell me the physical address of the Sprint NAP in Pennsauken, NJ? Thanks, Angela --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Julian Angelo - Conclusion
by Donald Neal 22 Jul '01

22 Jul '01

<Multimedia>If you wish this posting to be a multimedia experience, go to http://www.netspace.org/~dmacks/internet-songbook/lart-lart-lart-the-spamme… and sing the contents of that page to yourself while reading.</Multimedia> NZNOG People, Three days ago I posted to this list, saying >Just over a year ago, there was discussion on this list of spamming by >one Julian Angelo. He has now approached me, asking to have these >references removed from the NZNOG archive. It seems that prospective >employers who look up his name on the web find these archive entries, a >fact which may not be helping his career any. >If any network operator has an objection to these entries being removed >from the archive, could they please contact me directly. I had a number of reasons for doing things in this way. For one thing, I do not see myself as owner in the usual sense of that word of this list or its archive. For another, the content of email sent to me in response to such an enquiry might conceivably be actionable. I also take the view that spammers are thieves who must be shown the error of their ways and encouraged to live useful, constructive lives. I am in principle very happy with the idea of editing the names of the guilty out of publicly-readable archives a suitable period after their offending ceases. The chance to gain useful employment would then be one of the reasons why they would give up their vile activities in the first place. My request to be contacted directly was followed by close to fifty emails to the list. Some had particularly disappointing content. The acceptable use policy for this list states that character assassination is unacceptable. It also states that discussion unrelated to Internet technical and operational matters is not appropriate. Discussions of a legal nature are particularly discouraged. This has not been a good week for this list's s/n ratio, nor for constructive discussion. I am all in favour of a certain amount of humour of questionable relevance, but there was little of that here. The only such contribution was Matt Camp's, which observed "I'm sure there's a lesson there. f33r the far-reaching p0w3rz of NZNOG! [...] we shall [...] smite the career prospects of spammers and script kiddies with our flaming LARTting tool of justice!" I have doubts about his spelling of LARTing, but I too am sure there's a lesson here. As I've already said, I see publicity and its withdrawal as a useful tool in encouraging spammers into the paths of righteousness. Regrettably, the point was not taken up by others. My thanks to those who did respond directly to me. The suggestion that by altering the archive's contents on any occasion I might become responsible for all of its content was one I had not previously considered. Other opinions expressed fell into two groups. Some subscribers believed that an apology was called for before Mr Angelo's name was removed from the archive, while others felt that archives should not ever be altered. Some of this latter group observed that archiving an apology from Julian Angelo would give prospective employers a full piucture of events. I count four subscribers in the first group and thirteen in the second. Removing from the count people I believe not to be staff of network operators, and the subscriber who expressed both opinions, leaves three in the first group and eight in the second. I feel myself to be bound by this expression of the views of subscribers, and will not seek to have the archives changed. At no point has anyone even implied to me that Julian Angelo has done anything wrong since the events of July 2000. I went into this thinking that was the question. Donald Neal List Administrator/Muggins <Multimedia>You can stop singing now.</Multimedia> -- Donald Neal Mobility & Calling Platforms Network Delivery Telecom New Zealand Ltd --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

12 21

[dranch@trinnet.net: How the IIS Red Worm works..]
by Dean Pemberton 21 Jul '01

21 Jul '01

> so which ISP in Wellington was it that is reported to have lost its servers > as a result of thei worm (reported in the Herald).... and did it really > infect/affect 250000 sites? > > Ian Dunno about the first one - but there is a portion in this article that talks to your second point. Dean ----- Forwarded message ----- Interesting.. From http://www.w2knews.com/subscribe.cfm?id=W2K -- Explanation As stated earlier the .ida "Code Red" worm is spreading throughout IIS Web servers on the Internet via the .ida buffer-overflow attack that was published last month. The following are the steps that the worm takes once it has infected a vulnerable Web server: Setup initial worm environment on infected system. Setup 100 threads of the worm. Use the first 99 threads to spread the worm (infect other Web servers). � The worm spreads itself by creating a sequence of random IP addresses. However, the worm's list of IP addresses to attack is not all together random. In fact, there seems to be a static seed (a beginning IP address that is always the same) that the worm uses when generating new IP addresses. Therefore every computer infected by this worm is going to go through the same list of "random" IP addresses. Because of this feature, the worm will end up re-infecting the same systems multiple times, and traffic will cross traffic back and forth between hosts ultimately creating a denial-of-service type effect. The denial-of-service will be due to the amount of data being transferred between all of the IP addresses in the sequence of random IP addresses. The worm could have done truly random IP generation and that would have allowed it to infect many more systems much faster. We are not sure why this was not done, but a friend of ours did pose an interesting idea: If the person who wrote this worm owned an IP address that was one of the first hundred or thousand to be scanned, then they could setup a "sniffer" and anytime and IP address tried to connect to port 80 on their server they would get confirmation that the IP address that connected to them was infected with the worm. With this knowledge, they would be able to create a list of the majority of systems that were infected by this worm. The 100th thread checks to see if it is running on an English (US) Windows NT/2000 system. � If the infected system is found to be a English (US) system, the worm will proceed to deface the infected system's website. The local Web server's Web page will be changed to a message that says: "Welcome to http://www.worm.com!, Hacked By Chinese!". This hacked Web page message will stay "live" on the Web server for 10 hours and then disappear. The message will not appear again unless the system is re-infected by another computer. � If the system is not an English (US) Windows NT/2000 system, the 100th worm thread is also used to infect other systems. Each worm thread checks for c:\notworm. � If the file c:\notworm is found, the worm goes dormant. � If the file is not found, each thread will continue to attempt to infect more systems. Each worm thread checks the infected computer's system time. � If the date is past the 20th of the month (GMT), the thread will stop searching for systems to infect and will instead attack www.whitehouse.gov. The attack consists of the infected system sending 100k bytes of data (1 byte at a time + 40 bytes overheard for the actually TCP/IP packet) to port 80 of www.whitehouse.gov. This flood of data (410 megabytes of data every 4 and a half hours per instance of the worm) would potentially amount to a denial-of- service attack against www.whitehouse.gov. � If the date is between the 1st and the 19th of the month, this worm thread will not attack www.whitehouse.gov and will continue to try to find and infect new Web servers. We have calculated that the worm can attempt to infect roughly half a million IP addresses a day. This is a rough estimate generated by testing on a very slow network. At the time of writing this document (July 19th, 3:00pm), we have had reports from administrators that have been probed by over 196 thousand unique hosts. This leads us to believe that this worm has infected at least 196 thousand computers. During testing we noticed that sometimes the worm does not execute "normally" and will continue to spawn new threads until the infected machine crashes and has to be rebooted, effectively killing itself. We have not been able to isolate the cause of this behavior. ----- End forwarded message ----- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: the .ida "Code Red" worm - ISP suffers?
by PhoneNet 21 Jul '01

21 Jul '01

so which ISP in Wellington was it that is reported to have lost its servers as a result of thei worm (reported in the Herald).... and did it really infect/affect 250000 sites? Ian --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

China-diesel fuel injection 7/20
by china-lutong.com 20 Jul '01

20 Jul '01

hi: My name is ChenHua, and I'm writing on behalf of the China-Lutong mechanical company. Located in the south east of China, we specialize in hydraulic heads for the VE distributor pump. We can supply standard, good quality units at a very competitive price. The following types are available: Engine model VE PUMS code NO UNIT PRICE(EX WORK) ISUZU 4JB1 NP-VE4/11F1800LNP777 146402-0920 $USD40 ISUZU 4JB1 NP-VE4/11L(DENSO) 096400-1600 $USD40 ISUZU 4JB1 NP-VE4/11R 146402-0820 $USD45 ISUZU 4JA1 NP-VE4/11R 146402-3820 $USD45 ISUZU 4JA1 NP-VE4/12R 146430-1420 $USD45 CUMMINS 6BT NP-VE6/12F1050R381-7 1 468 336 423 $USD45 IVECO 8140 NP-VE4/11FR1900R127 1 468 334 798 $USD45 We use precision forging technology to create our products and surface treat them using an imported shot-blasting machine. The constant grinding process guarantees identical clearance in each plunger. Because we have been in the field of diesel fuel injection systems for quite a few years, we are acquainted with many domestic manufacturers of, and sales agents for, parts such as injector nozzles, plungers, delivery valves and so on. If you are interested in our products, please contact me. Thank you for your interest in our company. Best regards! C.Hua Sale & purchasing department director HTTP://WWW.China-LuTong.COM C.H(a)CHINA-LUTONG.COM

1 0

Full analysis of the .ida "Code Red" worm.
by Chris Rigby 19 Jul '01

19 Jul '01

I think this is something we should all be aware of for those of you not on bugtraq (which I hope most of you are.) This attack has gone from something like 0 hits in my web logs yesterday to 11 in the last 4 hours Some people are estimating over 12,000 hosts infected already. Also to worry about are later announcements that : "A notable side effect of this.. the worm signature is wreaking havoc with Cisco 675, 677, and 678 DSL routers that have the Web Based Configuration Interface enabled." since they lock up when "?" is sent to them in a URL. And apparently has issues for some 7500 size routers. The main thing I'm concenred over is that the worm is programmed to flood www.whitehouse.gov between 20:00pm and 23:59 (local system time). I'm not looking forward to what effect this might have on the internet. Escpecially the small outbound links in NZ. Chris Rigby Senior Systems Engineer IHUG - Into the Internet ---------- Forwarded message ---------- Date: Wed, 18 Jul 2001 22:40:11 -0700 From: Marc Maiffret <marc(a)eeye.com> To: BUGTRAQ <BUGTRAQ(a)securityfocus.com> Subject: Full analysis of the .ida "Code Red" worm. The following is a detailed analysis of the "Code Red" .ida worm that we reported on July 17th 2001. This analysis was performed by Ryan Permeh and Marc Maiffret of eEye Digital Security. The disassembly (complete with comments) was done by Ryan "Shellcode Ninja" Permeh. Table of Contents ================= 1. Introduction 2. Explanation 3. Commentary 4. Deep Analysis 5. Conclusion 6. Appendix 7. Credits You can get a copy of this analysis, commented disassembly, full IDA database, and binary of worm from http://www.eeye.com/html/advisories/codered.zip Introduction ============ On Friday July 13th we received packet logs and information from 2 network administrators that were experiencing large amounts of attacks targeting the recent .ida vulnerability that eEye Digital Security discovered (http://www.eeye.com/html/Research/Advisories/AD20010618.html) on June 18, 2001. After reviewing the logs sent to us we determined that in fact someone had released a worm into the Internet that was spreading rapidly through IIS web servers. The full analysis of the .ida "Code Red" worm has provided numerous new details as to the functionality and method of propagation of this worm. For instance this worms purpose ultimately seems to be to perform a denial of service attack against www.whitehouse.gov. Also it has been found that only US English Windows NT/2000 systems will show the defaced ("Hacked by Chinese !") web page. We've designated this the .ida "Code Red" worm, because part of the worm is designed to deface web pages with the text "Hacked by Chinese" and also because code red mountain dew was the only thing that kept us awake all last night to be able to disassemble this exploit even further. Explanation =========== As stated earlier the .ida "Code Red" worm is spreading throughout IIS web servers on the Internet via the .ida buffer overflow attack that was published weeks ago. The following are the steps that the worm takes once it has infected a vulnerable web server. 1. Setup initial worm environment on infected system. 2. Setup a 100 threads of the worm 3. The first 99 threads are used to spread the worm (infect other web servers). -The worm spreads itself by creating a sequence of random IP addresses. However, the worm's randomization of IP addresses to attack is not all together random. In fact there seems to be a static seed that the worm uses when generating new IP addresses to try to attack. Therefore every computer infected by this worm is going to go through the same list of random IP addresses to try to infect. The "problem" with that is that the worm is going to end up reinfecting systems and also end up crossing traffic back and forth between hosts to end up creating a denial of service type affect because of the amount of data that will be transferred between all the IP addresses in the sequence of random IP addresses. The worm could have done truly random IP generation and that would have allowed it to infect a lot more systems a lot faster. We are not sure why that was not done but a friend of ours did pose an interesting idea... If the person who wrote this worm owned an IP address that was one of the first hundred or thousand etc... to be scanned then they could setup a sniffer and anytime and IP address tried to connect to port 80 on their IP address they would know that the IP address that connected to them was infected with the worm and they would therefore be able to create a list of the majority of systems that were infected by this worm. 4. The 100th thread checks to see if it is running on a English (US) Windows NT/2000 system. -If the infected system is found to be a English (US) system then the worm will proceed to deface the infected systems website. That means... the local web servers web page will be changed to a message that says Welcome to http://www.worm.com !, Hacked By Chinese!. This hacked web page message will stay "live" on the web server for 10 hours and then disappear and never appear again unless the infected system is re-infected by another host. -If the system is not a English (US) Windows NT/2000 system then the 100th worm thread is also used to infect other systems. 5. Each worm thread checks for c:\notworm -If the file c:\notworm is found, the worm goes dormant. -If the file is not found then each thread will continue to attempt to infect more systems. 6. Each worm thread will now check the infected computers time. -If the time is between 20:00 UTC and 23:59 UTC then the worm will proceed to use this thread to attack www.whitehouse.gov. The attack consists of the infected system sending 100k bytes of data to port 80 of www.whitehouse.gov therefore potentially performing a denial of service attack against www.whitehouse.gov. -If the time is below 20:00 UTC then this worm thread will try to find and infect new web servers. In testing we have calculated that the worm can attempt to infect roughly half a million IP addresses a day and that was a ruff estimate made from using a very slow network. As of writing this document (July 18 6:49pm) we have had reports from administrators that have been probed by over 12 thousand unique hosts. That basically means at least 12 thousand hosts have been infected by this worm. In testing we have seen that sometimes the worm does not execute correctly and will continue to spawn new threads until the infected machine crashes and has to be rebooted. We have not been able to isolate the cause of this behavior. Commentary ========== As we sat and watched this worm spread itself through the Internet we were somewhat dumbfounded as to the number of reported systems being infected. The main reason for that is that this worm is using a, what we thought to be, very well known vulnerability. A patch for this vulnerability has been available for over a month now and at the time of the release of the vulnerability many news agencies ran stories about it therefore trying to spread awareness. Even with all of that though there have still been, at the very least, 12 thousand web servers infected by this worm. So we once again encourage administrators to pay attention to security issues and patch their systems as soon as patches are available for holes. All of this research would not be available if we were not a Full Disclosure company and if the many people who helped us research this worm were against full disclosure. Although we did not release any exploit code for the .ida vulnerability, the computer underground still had no problem creating a devastating worm. In the past we have seen a much higher percentage of patched systems when example exploit code was provided. System administrators do not believe vulnerabilities exist without a public exploit, or until something like this worm happens forcing them to patch their systems. We feel that if the security community moves away from Full Disclosure more incidents like this will happen and everyone will be left in the dark as to what is going on. An example of why full disclosure is so important would be this worm itself. Chances are this worm would have not been discovered if we had not fully disclosed details about the .ida vulnerability, allowing Intrusion Detection System vendors to create signatures for the .ida buffer overflow attack. Because of the way that IIS performs logging (logging a request after processing it), servers hit with this worm will actually have no traces of information left in the IIS log files making tracking this worm (via IIS logs) virtually impossible. The first instances of _anyone_ learning anything useful about this worm was via Intrusion Detection Systems that had signatures based on our .ida vulnerability research which would not have been there if not for full disclosure. The computer underground continues to find vulnerabilities everyday. If full disclosure goes away, then the general security community is left in the dark, and therefore so are administrators. More and more we are seeing an increase in worms attacking the Internet. There have been about 2 or 3 worms in as many months. Worms force computer security to become a global issue. With the rise of the Internet, not only do you have to worry about securing your own systems, you must also be careful of your "neighbors" systems. For instance with this worm even if you have done everything right (installed the .ida patch etc...) your network connection could still be taken down because of the amount of data flooding you from all of the "other guys" who hadn't applied patches and were infected by this worm. It is important to not only maintain your own security but make sure that other people you come in contact with secure their sites. Only with global cooperation to maintain security will the threat of worms start disappear. We received information from "friends" that leads us to believe that this worm is actually a derivative of another worm which was written to exploit the first ever remote IIS buffer overflow (also discovered by eEye Digital Security), the .htr buffer overflow. From reports, the .htr worm had a much smaller infection base and seemed to go under the radar probably because the .htr vulnerability was/is very old. Deep Analysis ============= The following is a very detailed analysis of what the worm is doing at each step of its infection. Full disassembled and commented worm code is available at our website at http://www.eeye.com/html/advisories/codered.zip. It will be provided as both a assembly text dump and as a IDA (Interactive Disassembler) database file. We have chosen not distribute the worm code in this eMail as to not clog up your bandwidth anymore then we already are >:-] Note: We will use CODEREF comments in the analysis to reference where we are in the disassembled code so you can "follow along" with us. The tools that we used to perform this detailed analysis were: IDA (Interactive Disassembler) from www.datarescue.com. IDA is an advanced disassembler that made this analysis possible. MS VC++ debugging environment. We used this to monitor modified pieces of the worm as they interacted with IIS. Ryan's brain + Marc's brain + private eEye tools. No... you cant have any of those. We will be heavily referencing the disassembled worm code in the following analysis. In an attempt to make this easier to understand we have broken the functionality of the worm into 3 parts. The core worm functionality, the worm hack web page functionality and the attack www.whitehouse.gov functionality. Core worm functionality ----------------------- 1. Initial infection vector (i.e. host is vulnerable to the .ida attack and gets hit with this worm). The initial infection starts to take place when a web server, vulnerable to the .ida attack, is hit with a HTTP get request that contains the necessary code to exploit the .ida attack and uses this worm as its payload. At the time of the .ida overflow a systems stack memory will look like the following: <MORE 4E 00> 4E 00 4E 00 4E 00 4E 00 4E 00 4E 00 4E 00 4E 00 4E 00 4E 00 4E 00 4E 00 92 90 58 68 4E 00 4E 00 4E 00 4E 00 4E 00 4E 00 FA 00 00 00 90 90 58 68 D3 CB 01 78 90 90 58 68 D3 CB 01 78 90 90 58 68 D3 CB 01 78 90 90 90 90 90 81 C3 00 03 00 00 8B 1B 53 FF 53 78 EIP is overwritten with 0x7801CBD3 which an address within msvcrt.dll. The code at 0x7801CBD3 disassembles to: call ebx When EIP is overwritten with call ebx it then causes program flow to divert back to the stack. The code on the stack jumps into the worm code that's held in the body of the initial HTTP request. 2. Sets up some initial stack variables CODEREF: seg000:000001D6 WORM At this point we are executing the initial code of the worm. The first thing to happen is that the worm sets up a new stack for its own use. The new stack is 218h bytes, filled with CCh. The worm code then moves on to initialize its function jump table. The entire worm heavily uses an EBP stack based memory offset system. This means that all variables are referenced as EBP-X values. On our website we have a document called worm-ebp.txt that attempts to track stack usage throughout the course of the worm code. 3. Load functions (create the "jump table") CODEREF: seg000:00000203 DataSetup The first thing the worm code does is reference the data portion of the exploit code at EBP-198h. The worm then needs to setup its internal function jump table. A function jump table is a stack based table used to store function addresses. It allows the worm to generate the function addresses at run time (This makes the worm have a better chance of executing cleanly on more systems). The technique used by this worm is what is called an RVA (Relative Virtual Addresses) lookup. Basically this means that all functions, or specifically GetProcAddress, are found within IIS itself. For more details on RVA please consult any good PE (Portable Executable, the executable file format for Microsoft platforms) documentation, or read through the assembly code of this worm. In a nutshell, RVA techniques are used to get the address of GetProcAddress. GetProcAddress is then used to get the address of LoadLibraryA. Between these two functions all other functions that the worm may need can be easily found. The worm uses these two functions to load the following functions: >From kernel32.dll: GetSystemTime CreateThread CreateFileA Sleep GetSystemDefaultLangID VirtualProtect >From infocomm.dll: TcpSockSend >From WS2_32.dll: socket connect send recv closesocket Finally the worm stores the base address of w3svc.dll which it will later use to potentially deface the infected website. 4. Check the number of threads the worm has created. CODEREF: seg000:00000512 FUNC_LOAD_DONE Here the worm seems to perform a WriteClient (Part of the ISAPI Extension API), sending "GET" back to the attacking worm. This possibly could be a way of telling attacking worms that they have successfully infected a new host. Next the worm code will count the number of worm threads already in action. If the number of threads is 100 then control is shifted to the Worm hack web page functionality. If the number of threads is below 100 then the worm creates a new thread. Each new thread is an exact replica of the worm (Using the same code base). The worm now continues its path of execution. 6. Checks for the existence of c:\notworm CODEREF: seg000:0000079D DO_THE_WORK There seems to be a to be built in "lysine deficiency" (See Jurassic Park, or Caesar's paper on this at www.rootkit.com) A "lysine deficiency" is a built in check to keep malicious code from spreading further. In this case the "lysine deficiency" is a check for the existence of the file c:\notworm. If this file exists then the worm will become dormant. This means it will not attempt to make connections out to other IP addresses to try to infect. If this file does not exist then the worm continues onto the next step. 7. Check the infected systems time (computer clock) CODEREF: seg000:00000803 NOTWORM_NO The worm will now check the infected systems local time (in UTC). If the hour is greater then 20:00 UTC then the worm will proceed to goto the first step of the attack www.whitehouse.gov functionality. If the time is less than 20:00 UTC then the worm will attempt to continue to try to infect new systems. 8. Infect a new host (send .ida worm to a "random" IP address on port 80). At this point the worm will resend itself to any IP addresses which it can connect to port 80 on. It uses multiple send()'s so packet traffic may be broken up. On a successful completion of send, it closes the socket and goes to step 6... therefore repeating this loop infinitely. Worm hack webpage functionality ------------------------------- This functionality is called after a hundred threads are spawned within the worm. 1. Check if local system default language is English us then goto step 6 of core worm functionality. CODEREF: seg000:000005FE TOO_MANY_THREADS The first thing the worm does is get the local codepage. A codepage specifies the local operating system language (I.E. English (US), Chinese, German etc...). It then compares the local codepage against 0x409. 0x409 is the codepage for English (US) systems. If the infected system is an English (US) system then the worm will proceed to deface the local systems webpage. If the local codepage is not English (US) then this worm thread will goto step 6 of core worm functionality. 2. Sleep for 2 hours. CODEREF: seg000:00000636 IS_AMERICAN This worm thread now sleeps for 2 hours. We anticipate that this is to allow the other worm threads to attempt to spread the infection before making a presence known via defacing the infected systems webpage. 3. Attempt to modify infected systems webpages in memory. CODEREF: seg000:0000064F HACK_PAGE This worm uses an interesting technique called "hooking" to effectively deface (alter) an infected systems webpages. Hooking is modifying code in memory to point to code that the worm provides. In this case the worm is modifying w3svc.dll to change the normal operation of a function called TcpSockSend. TcpSockSend is what w3svc.dll (IIS core engine) uses to send information back to the client. By modifying this, the worm is able to change data being written back to clients who request web pages of an infected server. To perform hooking, first the worm makes the first 4000h bytes of w3svc.dll's memory writable. In a normal situation the memory for w3svc.dll (and basically all mapped dll's) is read-only. It uses the function VirtualProtect to change the memory of w3svc.dll to be writable, saving the old state to a stack variable. It then uses the saved codebase of w3svc.dll (from step 3 of core worm functionality) as a start point to search the import table (again see PE header documentation) for the address of TcpSockSend. Once the address for TcpSockSend is located the worm then replaces TcpSockSend's actual address with an address within the worm. The address that TcpSockSend now points to is a function within the worm that will return the "Hacked by Chinese !" webpage. The CODEREF for this function is seg000:00000C9A FAKE_TCPSOCKSEND. This thread of the worm now sleeps for 10 hours. During this 10 hours all web requests to the infected server will return the "Hacked by chinese !" webpage. After the 10 hours is up this thread will return w3svc.dll to its original state, including re-protecting memory. Execution after this proceeds to step 6 of the core worm functionality. Attack www.whitehouse.gov functionality --------------------------------------- Sooner or later every thread within the worm seems to shift its attacking focus to www.whitehouse.gov. 1. create socket and connect to www.whitehouse.gov on port 80 and send 100k byes of data CODEREF: seg000:000008AD WHITEHOUSE_SOCKET_SETUP Initially the worm will create a socket and connect to 198.137.240.91 (www.whitehouse.gov/www1.whitehouse.gov) on port 80. CODEREF: seg000:0000092F WHITEHOUSE_SOCKET_SEND If this connection is made then the worm will create a loop that performs 18000h single byte send()'s to www.whitehouse.gov. CODEREF: seg000:00000972 WHITEHOUSE_SLEEP_LOOP After 18000h send()'s the worm will sleep for about 4 and a half hours. It will then repeat the attack against www.whitehouse.gov (goto step one of Attack www.whitehouse.gov functionality). Appendix ======== This is associated information about the "Code Red" worm including how to stop the worm, commentary on the worm, and dispelling common misconceptions about this worm. How to secure your system from this .ida "Code Red" worm? --------------------------------------------------------- Microsoft patch for this .ida vulnerability http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/ bulletin/MS01-033.asp The worm spreads itself to new vulnerable systems via the .ida vulnerability. Applying this patch will keep your server from being infected. However, as stated earlier, because of the way the worm creates its list of "random" IP addresses to attack, you could still be affected by a high traffic overload denial of service. eEye Digital Security Advisory for .ida vulnerability http://www.eeye.com/html/Research/Advisories/AD20010618.html We initially discovered the .ida vulnerability which is being used by this worm as its infection vector. The above advisory details our research of that specific vulnerability. We worked with Microsoft to help them create a patch for the .ida vulnerability. SecureIIS - Application firewall, stops known and unknown IIS vulnerabilities. http://wwww.eeye.com/secureiis We do produce a product that protects IIS web servers from attack which is one of the reasons that we were so quick to research this worm. Funny enough in our initial testing we couldn't get the worm to work because we forgot we had SecureIIS enabled on the lab web server. heh. I have been infected by this worm what can I do? ------------------------------------------------ The first thing you must do is goto the Microsoft security site, as referenced above, and install the .ida patch ASAP. The worm will remain in memory until you reboot your server so make sure to reboot after installing the .ida patch. I think I am infected, how can I tell? -------------------------------------- An infected system will show an increase in load (processor/network). It will also show a number of external connections (or attempts) to port 80 of random IP addresses. You can see this by doing a "netstat -an" from a MS-DOS prompt. Either way do not take any chances... if your system is missing the .ida patch then install it ASAP and reboot. How to setup your IDS to detect this specific worm? --------------------------------------------------- The following is part of the packet data that is sent for this .ida "Code Red" worm attack: GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3% u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0 Just add that to your IDS signature database. What are some common misconceptions about the "Code Red" worm? -------------------------------------------------------------- 1. It connects to worm.com. This worm only specifies www.worm.com in the initial HTTP GET request HOST: header and in the defaced page show on English (US) systems. This worm does _not_ connect to www.worm.com. This worm operates completely independent and can spread and infect systems without having a single point of failure. What that means is that this worm will be wild on the Internet until there is a _VERY_ high degree of systems that go and install the .ida patch. 2. This worm is based off of hsj's "proof of concept" .ida exploit. This worm is _NOT_ based off of hsj's "proof of concept" .ida exploit. His exploit code had no worm functionality. It was a simple exploit shell that had little to no implicit functionality. It was designed to prove to administrators the seriousness of this vulnerability so that they would install patches ASAP. Credits ======= Ken Eichman of Chemical Abstracts Service Matthew Asham of Left Coast Systems Corp and a large handful of administrators who gave us much needed data to piece this together. Signed, eEye Digital Security T.949.349.9062 F.949.349.9538 http://eEye.com/Retina - Network Security Scanner http://eEye.com/Iris - Network Traffic Analyzer http://eEye.com/SecureIIS - Stop known and unknown IIS vulnerabilities "Its not a virus! Its a worm!" - z3r0 c00l "Whats this one eat?" - l0rd n1k0n "th1s 0n3 34ts 11S s3rv3rs!" - ch4m3l30n h4ck3rs --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

17 35

Code Red --- request for logs (from NANOG)
by Chris Wedgwood 19 Jul '01

19 Jul '01

>From NANOG: From: "Steven M. Bellovin" <smb(a)research.att.com> To: nanog(a)merit.edu Cc: Balachander Krishnamurthy <bala(a)research.att.com> Subject: Re: Code Red -> Router Memory depletion? Date: Thu, 19 Jul 2001 20:39:31 -0400 Message-Id: <20010720003931.77D057B57(a)berkshire.research.att.com> X-Mailer: exmh version 2.1.1 10/15/1999 A colleague of mine, Balachander Krishnamurthy, is looking for Web server logs from sites that have been attacked by Code Red. He's working on analysis techniques to detect flash crowds, DDoS attacks, etc. Please reply directly to him (bala(a)research.att.com) if you can supply any data. (You can see the kind of stuff he's been doing by looking at some of his recent papers, at www.research.att.com/~bala/papers) --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Full analysis of the .ida "Code Red" worm.
by Greg Clare 19 Jul '01

19 Jul '01

Hits on my home connection started at 4:51am, with 17 unique source addresses logged so far. Greg > -----Original Message----- > From: Juha Saarinen [mailto:juha(a)saarinen.org] > Sent: Friday, 20 July 2001 9:50 am > To: 'Dean Pemberton'; 'Chris Rigby' > Cc: nznog(a)list.waikato.ac.nz > Subject: RE: Full analysis of the .ida "Code Red" worm. > > > 12 hits on my home server only... many more on the IDG ones :-( > > -- > > Juha --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 4

RE: Full analysis of the .ida "Code Red" worm - Attacks stop
by Lindsay Druett 19 Jul '01

19 Jul '01

www.microsoft.com got hit today. I went to their site and had the message "Hacked by Chinese" in red letters. Pity, next time I logged in, I got the normal web page, a bit disappointing.... But I logged in again later, in the same web page, and got the "Hacked by Chinese", so it must be only a few of their servers. So much for "round robin" load sharing, they should be using a Cisco content switch. After 6days The attacks have stoped hitting my server in the past 10 minutes ... Who did what to whom... where is the corpse.... Michael --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Help with survey needed
by Frank March 19 Jul '01

19 Jul '01

I have been asked to assist with recruitment for an online survey of ISPs and IT companies in New Zealand. The survey is being conducted by the Information Technology Group at the Center for International Development, Harvard University in conjunction with the World Economic Forum and will be used to compile the Global Information Technology Readiness Report (GITRR). The survey for Internet Service Providers (ISPs) can be found at: http://www.cid.harvard.edu/ciditg/isp The survey for other kinds of IT companies can be found at: http://www.cid.harvard.edu/ciditg/it It is suggested that the survey should be completed by someone in a senior management position in your company or organisation. If you do not feel you 'qualify' please pass this on in your organisation to someone who does. I am distributing this to the NZNOG, InternetNZ members, and GOVIS email lists (apologies for duplications). Please feel free to further distribute to other contacts if you think it would be useful. If you want to find out more, I have appended below the unexpurgated and (largely) unedited text sent to me by Indran Ratnathicam, who is in charge of the survey. Thank you Frank March Specialist Advisor, IT Policy Group Ministry of Economic Development, PO Box 1473, Wellington, NZ Ph: (+64 4) 474 2908; Fax: (+64 4) 471 2658 <from Indran> You are invited to become a collaborator and participant in a major research project, the Global Information Technology Readiness Report (GITRR). The GITRR, a new venture between Harvard University and the World Economic Forum, aims to make an important contribution to the understanding of the New Economy and global IT usage. This report will be published in the Fall 2001, and will assess the global IT situation for nearly 100 countries, including New Zealand. The GITRR will provide: · A background for policy discussions by your government and international bodies that will influence the IT and economic development in your country, including your company's activities. · A clearly identified list of your country's relative IT strengths that may spur investment or become a source of competitive advantage in your industry or region. · A clearly identified list of your country's areas for IT development, which can be used to focus future development initiatives by both the public and private sectors. · A tool for international IT companies to increase their understanding of local markets, their opportunities and their challenges. As an IT leader of New Zealand, you are in a unique position to accurately portray where your country stands with regard to the adoption and use of IT within the global context. Your cooperation is essential in adding value to the GITRR and in guaranteeing inclusion of your country in the Report. All you need to do is fill out an online survey. The survey for Internet Service Providers (ISPs) can be found at: http://www.cid.harvard.edu/ciditg/isp The survey for other kinds of IT companies can be found at: http://www.cid.harvard.edu/ciditg/it It will take no more than 30 min of your time to complete and you will not have to necessarily stay logged on to the Internet while you are filling it out. Please fill out the survey by August 3, 2001. If you have additional comments/ queries, please do not hesitate to get in touch with me at Indran_Ratnathicam(a)ksg.harvard.edu. Please rest assured that individual questionnaires remain strictly confidential. Thank you in advance for taking the time to complete this survey. With best regards, Indran Ratnathicam Global IT Readiness Report Information Technologies Group Center for International Development at Harvard University Further details about the Global IT Readiness Report can be found at: http://www.cid.harvard.edu/ciditg/gitrr/ PS: If you are aware of other IT leaders in your country please direct them to the survey --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

None
by Ivan Walker 19 Jul '01

19 Jul '01

subscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Code Red
by Thomas Salmen 19 Jul '01

19 Jul '01

Niiiice... [root(a)proxy1 /root]# grep -c default.ida access.log 721522 [root(a)proxy2 /root]# grep -c default.ida access.log 717971 Cheers, Thomas Salmen System Administrator Radionet Ltd. 1/72 Paul Matthews Road Albany, Auckland, New Zealand Ph: +64 9 414 0300 ext 718 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

FW: Update to "Code Red" Worm. Its a date bomb, not time.
by Greg Clare 19 Jul '01

19 Jul '01

>-----Original Message----- >From: Marc Maiffret [mailto:marc(a)eeye.com] >Sent: Friday, 20 July 2001 8:55 a.m. >To: BUGTRAQ >Subject: Update to "Code Red" Worm. Its a date bomb, not time. > > >Thanks to Eric from Symantec for tossing us a note about the >worm being Date >based and not Time based. > >We made an error in our last analysis and said the worm would start >attacking whitehouse.gov based on a certain time. In reality >its based on a >date (the 20th UTC) which is tomorrow. > >If the worm infects your system between the 1st and the 19th >it will attempt >to deface the infected servers web page or try to propogate >itself to other >systems. On the 20th all infected threads will attempt to attack >www.whitehouse.gov. This seems to continue until the worm is >removed from >the infected system. > >Any new infection that happens between the 20th and 28th will >most likely be >someone "hand infecting" your system as all other worms should >be attacking >whitehouse.gov. If for some reason you are infected between >the 20th and the >28th then the worm will begin attacking whitehouse.gov without >trying to >infect other systems. This attack will continue indefinitly. > >The following are rough numbers, but we felt that it was important to >illustrate the affects this worm can _possibly_ have. > >The worm has a timeline like this: > >day of the month: >1-19: infect other hosts using the worm >20-27: attack whitehouse.gov forever >28-end of month: eternal sleep > >Presumably, this could restart at any point in a new month again. > >Also, some stats for the attack: > >Each infection has 100 threads >Each thread is going to send about 100k, a byte at a time, >which means you >have a (40 for ip + 1 for each byte) which means you have 4.1 >megs of data >per thread >100 threads * 4.1megs = 410 Megabytes >This will be repeated again every 4.5 hours or so > >Remember, each host can be infected multiple times, meaning >that a single >host can send 410MB * # of infections. > >We have had reports between 15 thousand and 196 thousand unique hosts >infected with the "Code Red" worm. However, there has been >cross infection >and we have heard reports of at least 300+ thousand >infections/instances >(machines with multiple infections etc..) of this worm. > >If there are 300 thousand infections then that means you have >(300,000 * 410 >megabytes) that is going to be attempted to be flooded against >whitehouse.gov every 4 and a half hours. If this is true and >the worm "works >as advertised" then the fact that whitehouse.gov goes offline >is only the >begining of what _can_ possibly happen... > >---- > >I am actually writing this part of the eMail about 45 minutes after the >first part because our Internet connection here in california >has been going >up and down. We have also heard reports of internet >connectivity going down >in parts of northern california and new york. > >Signed, >eEye Digital Security >T.949.349.9062 >F.949.349.9538 >http://eEye.com/Retina - Network Security Scanner >http://eEye.com/Iris - Network Traffic Analyzer >http://eEye.com/SecureIIS - Stop known and unknown IIS vulnerabilities > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

FW: Full analysis of the .ida "Code Red" worm.
by Tony Wicks 19 Jul '01

19 Jul '01

-----Original Message----- From: Juha Saarinen [mailto:juha(a)saarinen.org] Sent: Friday, July 20, 2001 10:12 AM To: tony.wicks(a)telstrasaturn.co.nz Subject: RE: Full analysis of the .ida "Code Red" worm. Well, Tony, to be quite frank, you annoy me even more. Who the fuck appointed you as the content-cop on NZNOG, and told you to stalk me with rude replies each time I post something? Nobody else complains about my posts, and I bet you haven't got the courage to be rude to anyone else. -- Juha :: -----Original Message----- :: From: Tony Wicks [mailto:tony.wicks(a)telstrasaturn.co.nz] :: Sent: Friday, 20 July 2001 10:07 :: To: Juha Saarinen :: Subject: RE: Full analysis of the .ida "Code Red" worm. :: :: :: Well, it's a bit rich, you posting back to the list telling :: me to cut a few :: lines out of a posting when you send so many useless posts :: there. Quite :: frankly, that annoyed me quite a bit ! :: :: -----Original Message----- :: From: Juha Saarinen [mailto:juha(a)saarinen.org] :: Sent: Friday, July 20, 2001 9:59 AM :: To: tony.wicks(a)telstrasaturn.co.nz; nznog(a)list.waikato.ac.nz :: Subject: RE: Full analysis of the .ida "Code Red" worm. :: :: :: Don't exaggerate Tony. :: :: -- :: :: Juha :: :: :: -----Original Message----- :: :: From: Tony Wicks [mailto:tony.wicks(a)telstrasaturn.co.nz] :: :: Sent: Friday, 20 July 2001 09:57 :: :: To: Juha Saarinen; nznog(a)list.waikato.ac.nz :: :: Subject: RE: Full analysis of the .ida "Code Red" worm. :: :: :: :: :: :: Ok, tell you what, I'll trim my posts if you cut your posts :: :: to just relevant :: :: stuff, not 10-20 mails a day of off topic drivel, hows that :: :: for a deal. :: :: :: --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

SPAM/SCAM alert
by Michael Newbery 19 Jul '01

19 Jul '01

This piece of ordure just showed up in my mailbox. Just a heads-up in case anyone hasn't already seen it and might decide to alert the customers. Now, where did I put that nuclear weapon? At 5:34 PM +0100 19/7/01, <webhosting(a)associate.co.uk> wrote: >Received: from moonof.saturn.co.nz > (rata.saturn.co.nz [172.20.18.220]) > by wlg-gwia-nw-01.saturn.co.nz; Fri, 20 Jul 2001 04:44:56 +1200 >Received: from cmailg6.svr.pol.co.uk (cmailg6.svr.pol.co.uk [195.92.195.176]) > by moonof.saturn.co.nz (Postfix) with ESMTP id A3A629C12 > for <michaeln(a)saturn.co.nz>; Fri, 20 Jul 2001 04:34:49 +1200 (NZST) >Received: from harrya.fsnet.co.uk ([217.134.134.196] helo=andrewal) > by cmailg6.svr.pol.co.uk with smtp (Exim 3.13 #0) > id 15NGl1-0002jE-00 > for michaeln(a)saturn.co.nz; Thu, 19 Jul 2001 17:34:35 +0100 >To: <michaeln(a)saturn.co.nz> >From: <webhosting(a)associate.co.uk> >Subject: notice from your webhost >MIME-Version: 1.0 >Content-Type: text/plain; charset=unknown-8bit >Message-Id: <E15NGl1-0002jE-00.2001-07-19-17-34-35(a)cmailg6.svr.pol.co.uk> >Date: Thu, 19 Jul 2001 17:34:35 +0100 > ><x-charset unknown-8bit> > >This email is being sent to you on behalf of your current webspace provider. >This message is not a spam or junk email, your email address was >supplied to WebHosting.com >You will not receive any more messages from WebHosting.com this is a >one time special offer notice. > >WebHosting.com is offering a selected number of webhost's member's >the following special offer. This offer is not available on our >website at www.webhosting.com or anywhere else, this is a special >offer and is valid only for a limitied time. Read on to learn more >about this amazing offer. > >For only $6.25 (one time fee) you can get: > >> 500mb webspace >> unlimited pop3 email addresses >> cgi-bin >> full ftp access >> php, ssi, my-sql, asp support >> mySQL database >> FREE DOMAIN REGISTRATION (.com .net .org) >> unlimited bandwidth >> miva merchant account >> secure server for transactions >> accept credit cards >> 24hour technical support > >You did read it right, all this will only cost you only $6.25. There >are no monthly fees or any other costs. You are probably wondering >how WebHosting.com can offer all this for the very low price of only >$6.25, the answer is that WebHosting.com will make a lot of revenue >from extra webspace charges - people wishing to have more than 500mb >can pay $10 per 10mb per month. > >If you would like to receive this excellent offer all you have to do >is send your details to the following email address and your >username and password will be emailed to you within 5 business days. >Then you will be able to login at the members area of WebHosting.com >and configure your account (add domains, setup scripts etc.). > >Please send all of the following details: > >Your Full Name >Your Full Address >Your Phone Number >Your Email Address >Your Credit Card Number >Your Credit Card Expiry Date >Your Credit Card Type (eg. visa, mastercard etc.) > >Send all of the above to webhosting(a)associate.co.uk > > > > >Thank you and I hope you enjoy this very special offer > >John Simmons >Head of Special Promotions, Webhosting.com > >------------------------------------------------------------------------------------- >WebHosting.com is a member of the CNS International Internet >Businesses Association > > ></x-charset> -- Michael Newbery Technical Specialist TelstraSaturn Limited Tel: +64-4-939 5102 Mobile: +64-29-939 5102 Fax: +64-4-922 8401 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Problems accessing sites in china
by Lin Nah 18 Jul '01

18 Jul '01

HI all I wonder if anyone here has had complains from their customers/helpdesk regarding inability to access certain chinese websites. For example the last 5 hops of a trace to www.china.com shows it disappearing after 201.176.155.238 15 hkt.ser4-0.core1.sun.cais.net (63.216.17.73) 245.372 ms 240.922 ms 237.96 0 ms 16 202.84.249.29 (202.84.249.29) 236.565 ms 235.41 ms 234.18 ms 17 207.176.97.134 (207.176.97.134) 245.263 ms 235.18 ms 238.485 ms 18 f5-1.tmh12.hkt.net (205.252.128.238) 245.80 ms 239.694 ms 243.223 ms 19 210.176.155.238 (210.176.155.238) 244.516 ms 246.827 ms 235.416 ms 20 * * * There's also been problems with some other sites ( can't remember names but perhaps one of them is cn.yahoo.com) Any ideas? regards Lin --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 4

RE: IPv6...Fact or Fiction?
by Gavin Cato 18 Jul '01

18 Jul '01

>> NAT is a broken idea, as are firewalls. Just because it works, >> doesn't change this. I wouldn't call it broken. A band-aid solution perhaps but not broken. It does what it intended to do quite well. Gav --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

6 14

This list, or an alternative? was RE: Julian Angelo - Conclusion
by Frank March 18 Jul '01

18 Jul '01

I am not a network operative, yet I lurk here (with intent, since I v occasionally post). I have always considered that off-topic posts (like, I suppose, this one) come into the permissible area, as allowed for in the mention of beer in the AUP. I have always had an excellent range of helpful responses from NZNOG subscribers when I have posed policy related questions to this list even though they are unrelated to beer. I find being on this list extremely useful. At the same time, a point made in another post in the parent thread by Matt Camp about a non-operational companion list could be considered although I dont think the noise level is that serious. Frank March Specialist Advisor, IT Policy Group Ministry of Economic Development, PO Box 1473, Wellington, NZ Ph: (+64 4) 474 2908; Fax: (+64 4) 471 2658 > -----Original Message----- > From: Dean Pemberton [SMTP:dean(a)flatnet.gen.nz] > Sent: Thursday, 19 July 2001 11:43 > To: Matt Camp > Cc: nznog(a)list.waikato.ac.nz > Subject: Re: Julian Angelo - Conclusion > > On Thu, Jul 19, 2001 at 11:22:41AM +1200, Matt Camp wrote: > > > > > thirteen in the second. Removing from the count people I believe not > to > > > be staff of network operators, and the subscriber who expressed both > > > > Hrm... good point here. I know I don't have an official sig on this > email > > address, so might have been placed in the 'not a network op' basket > > here... yet I am. > > And I'm not - if anyone thinks that this makes me unsuitable for inclusion > by the 'network operator elite' then let me know and I'll unsubscribe. > > > Dean > --------- > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > where the body of your message reads: > unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Could this be why your 827s are retraining?
by Juha Saarinen 18 Jul '01

18 Jul '01

http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121relnt /800/800yb/rn800yb.htm Resolved Caveats for Release 12.1(5)YB1 This section describes possibly unexpected behavior by software releases prior to Release 12.1(5)YB1 that have been resolved in Release 12.1(5)YB1 and above. CSCdt19816 A router retrains when an LOM is detected-a critical condition message is sent out, resulting in an unnecessary reboot. A LOM alone is not sufficient to require a critical condition message or router reset. This problem is fixed in Cisco IOS Software Release 12.1(5)YB1 My version is: ROM: System Bootstrap, Version 12.1(1r)XB1, RELEASE SOFTWARE (fc1) ROM: C820 Software (C820-Y6-M), Version 12.1(5)YC, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1 -- Juha Saarinen --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

unsubscribe nznog
by Melanie McAllister 18 Jul '01

18 Jul '01

-----Original Message----- From: James Tyson [mailto:james(a)samizdat.co.nz] Sent: Thursday, 19 July 2001 10:13 a.m. To: Juha Saarinen Cc: 'Simon Allard'; 'James Tyson'; nznog(a)list.waikato.ac.nz Subject: RE: IPv6...Fact or Fiction? > Yes, yes, but what does that mean? Details, man, details. ;-) > > I have found that with either the Nokia MW1122 and the Cisco 827 plugged > in, my Jetstream connection suffers from "micro outages", usually once a > day. It'd be interesting to discover if these outages are caused by the > adapter or by a fault/flaw in Jetstream. > > Here's what the 827 logs: > > Jul 12 03:00:16 router 23: Jul 12 03:00:16.373 NZ: %LINK-3-UPDOWN: > Interface ATM0, changed state to down > Jul 12 03:00:16 router 24: Jul 12 03:00:16.381 NZ: %LINK-3-UPDOWN: > Interface Virtual-Access1, changed state to down <snip /> Juha, Try "debug atm errors" and email me the output - I'll bet your getting the same thing as me. Cheers. James Tyson --- Samizdat New Media Solutions --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

DNS & email hosting
by Chris Wedgwood 18 Jul '01

18 Jul '01

I'm looking for a list of people who offer basic DNS and Email hosting. Nothing fancy, basically a service that a few people can use so that <everything>@some.domain.com will end up in their Xtra mailbox. It occurred to me there must be about fifty difference places who can do this, but I've never seen a list of services compiled list who can provide what. Right now, there is no talk of needing mailboxes, web-sites or indeed anything of the sort, but knowing that this is trivially possible is probably worth-while. Does such a list exist? --cw --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Re: Optical Gig NICs
by Richard Naylor 17 Jul '01

17 Jul '01

At 10:35 PM 7/17/2001 +1200, Roger De Salis wrote: >Ah, the joys of my favourite and personal network provider..... > >There is one vital fact that has been missed though.... any financial >advantage accrued through the economics espoused above, is completely >negated by the scale of the PC wreckage around Simon's desk. I've >seen it... in fact it run's over two desks....., around the floor >past the aerials, over the carpet.... who needs $25 NIC cards >when you can sidle up to Si's desk and suggest humbly that >"this has been here 6 months.....would you mind if I tested it..." > >Dean can vouch for me, so this email can be seen to vendor >independenet........ Its a part of our policy of encouraging an environment of open experimentation in the area of interoperability, especially between vendors. But to set the record (and the archive) straight we did tidy up - once, when we shifted buildings. richard.naylor(a)citylink.co.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 3

Re: Optical Gig NICs
by Richard Naylor 17 Jul '01

17 Jul '01

At 10:35 PM 7/17/2001 +1200, Roger De Salis wrote: >Ah, the joys of my favourite and personal network provider..... > >There is one vital fact that has been missed though.... any financial >advantage accrued through the economics espoused above, is completely >negated by the scale of the PC wreckage around Simon's desk. I've >seen it... in fact it run's over two desks....., around the floor >past the aerials, over the carpet.... who needs $25 NIC cards >when you can sidle up to Si's desk and suggest humbly that >"this has been here 6 months.....would you mind if I tested it..." > >Dean can vouch for me, so this email can be seen to vendor >independenet........ Its a part of our policy of encouraging an environment of open experimentation in the area of interoperability, especially between vendors. But to set the record (and the archive) straight we did tidy up - once, when we shifted buildings. richard.naylor(a)citylink.co.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Optical Gig NICs
by J S Russell 17 Jul '01

17 Jul '01

Possibly slightly off topic, but does anyone (Hi Richard! Hi Si!) know of a New Zealand source for gigabit nics (optical, not copper) which are (a) not priced at defence department levels, and (b) supported by linux? JSR -- John S Russell | "What the hell is he building in there... Operations Manager | he has a router...and a table saw..." Attica/Callplus NZ | - Tom Waits, Mule Variations --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

9 15

IPv6...Fact or Fiction?
by Craig Whitmore 17 Jul '01

17 Jul '01

Hi people.... When do people think we (the Internet) will run out of IPv4 addresses and people will be forced to move over and use IPv6? Or will people use the IPv4 addresses in a much more conservative way? Do you think it will really take off in the near future? Has there really been a standardized IPV6 Format yet? Has anyone actually used it in a production enviornment? Should I "Apply" for some IPv6 addreeses now or will there be plenty of time to implement it? Thanks Craig Whitmore Orcon Internet http://www.orcon.net.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 6

Julian Angelo
by Donald Neal 17 Jul '01

17 Jul '01

NZNOG People, Just over a year ago, there was discussion on this list of spamming by one Julian Angelo. He has now approached me, asking to have these references removed from the NZNOG archive. It seems that prospective employers who look up his name on the web find these archive entries, a fact which may not be helping his career any. If any network operator has an objection to these entries being removed from the archive, could they please contact me directly. Donald Neal NZNOG Mailing List Administrator --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

21 40

Re: Optical Gig NICs
by Chris Wedgwood 16 Jul '01

16 Jul '01

On Tue, Jul 17, 2001 at 11:11:21PM +1200, Chris Hellberg wrote: is that using that RAW NIC to NIC option in the linux kernel? If you mean Alexey's fastroute stuff, then no. Fast route only makes sense for a router and only works on a very limited number of cards. --cw --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Optical Gig NICs
by Chris Hellberg 16 Jul '01

16 Jul '01

>>> "Chris Wedgwood" <cw(a)f00f.org> 07/17/01 10:41p.m. >>> On Tue, Jul 17, 2001 at 09:40:01PM +1200, Richard Naylor wrote: Dick Smith. Maybe decent was the qualifer......I think we pay $35 for D-Link. The only D-Link cards I've ever used are 530TX or something. They are not even close to what I call decent. What chipset do the ones you have use? Last time I shifted a file from the edit pc to the server (both on GbE) it took 6 minutes for 1.6 Gig. I wonder if I can get a GbE PC card for the laptop ? Ah.. this is why I say decent card. I expect a 100mbps card to run at 100mbps or very near to it. 1.6G in 6 minutes, that's 4.5 megabytes/s or so? Earlier this year I did some testing or various NICs and could sustain over 12 megabytes/s for several hours, even when this data came off a disk one one machine and onto a disk on another machine. is that using that RAW NIC to NIC option in the linux kernel? <<snipped>> --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Julian Angelo
by Lindsay Druett 16 Jul '01

16 Jul '01

Read a bit of that... you're not kidding. About 5 pages of it.... Hey ! He forgot to mention to his prayer chain about NZNOG ! :: Would it not suffice for Mr Angelo to publish an apology :: here on NZNOG, thus when prospective employers discover his :: chequered past, they will also discover his contrition. http://www.datasync.com/~mbowie/archive29.html -- read a bit of that... seems the NZNOG archives are the least of Mr Angelo's worries. -- Juha --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Julian Angelo
by david＠farrar.com 16 Jul '01

16 Jul '01

There seem to be a few lessons one can learn from this. 1) Don't spam 2) Don't spam ISPs 3) In case of 1 or 2 apologise 4) Asking for archives to be removed is a bad idea 5) Asking a group of system admins to remove archives is a *really* bad idea 6) This is because anything that can be found about you will and has been 7) Also because the discussion on your request leads to 30 times as many hits as the original thread 8) Juha does have too much time on his hands 9) Refer to 1 10) There is no 10. DPF Gordon Smith wrote: > Good grief!! > > You know Juha, you really have too much free time... :-) > > > > -----Original Message----- > > From: owner-nznog(a)list.waikato.ac.nz > > [mailto:owner-nznog(a)list.waikato.ac.nz]On Behalf Of Juha Saarinen > > Sent: Tuesday, 17 July 2001 12:33 > > To: 'Hamish MacEwan'; nznog(a)list.waikato.ac.nz > > Subject: RE: Julian Angelo > > > > > > :: Would it not suffice for Mr Angelo to publish an apology > > :: here on NZNOG, thus when prospective employers discover his > > :: chequered past, they will also discover his contrition. > > > > http://www.datasync.com/~mbowie/archive29.html > > > > -- read a bit of that... seems the NZNOG archives are the least of Mr > > Angelo's worries. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

RE: Julian Angelo
by Greg Clare 16 Jul '01

16 Jul '01

Just an observation... In requesting the archive purge, a whole new thread of discussion relating to this topic is currently being created... Therefore, the next request will be for the current discussion to be purged... ad infinitum! This leads to the obvious paradox that the only way to undo history is to travel back in time and not do what should not have been did in the first place! ;) Another observation... An apology post would also be recorded in the archives. Greg > -----Original Message----- > From: Juha Saarinen [mailto:juha(a)saarinen.org] > Sent: Tuesday, 17 July 2001 12:04 pm > To: 'Michael Newbery'; nznog(a)list.waikato.ac.nz > Subject: RE: Julian Angelo > > > :: An interesting point. The image of 'Memory Holes' sprang > :: instantly to mind. > :: > :: While the article below is rather extreme > :: (http://www.thefire.org/offsite/data/mcelroy042000.html) it > :: does make > :: the point that an archive is supposed to be, well, an archive. > > Good point. I think that "sanitising" archives might set an > unfortunate > precedent, but ultimately, it's up to the listadmin to decide. > > However, even if the messages referring to Mr Angelo were > expunged from > the archives, haven't they been stored elsewhere? I seem to remember > that Google spiders NZNOG... hang on... yep, so it does. > > In fact, a Google search on "Julian Angelo" reveals plenty more than > just NZNOG... see for yourself. I think he's just going to > have to live > with his fifteen seconds of Internet infamy. > > > -- > Juha > > --------- > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > where the body of your message reads: > unsubscribe nznog > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

re: Julian Angelo
by Matthew G Brown 16 Jul '01

16 Jul '01

I have also read about this person . If he could come up with a good reason and apology he could have his sentence shortened by the ISP Justice system. Spam is Spam and from what I know he did quite the nice job of it all . Sincere apologies time. Matthew G Brown Wireless Network Specialist Tasman Solutions LTD Http://www.ts.co.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Who are these at APE?
by Craig Whitmore 16 Jul '01

16 Jul '01

Anyone be able to tell me who these are at ape?? ????.ape.net.nz (192.203.154.7) dts1.ape.net.nz (192.203.154.68) dts2.ape.net.nz (192.203.154.69) ssc.ape.net.nz (192.203.154.76) They are not on the www.ape.net.nz website for contact to peer with? (if they want to is a different question) Thanks Craig Whitmore Orcon Internet http://www.orcon.net.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

Re: IP express
by David Anso 15 Jul '01

15 Jul '01

I take the last bit back. International access seems quite good again. Regards David Anso Systems Administrator - ZIP Internet Email: sysadmin(a)zip.co.nz ----- Original Message ----- From: "David Anso" <sysadmin(a)zip.co.nz> To: "Chris Wedgwood" <cw(a)f00f.org> Cc: "NZNOG Mailing List" <nznog(a)list.waikato.ac.nz> Sent: Monday, July 09, 2001 3:22 PM Subject: Re: IP express > Clint said that there was a fibre cut between Auckland and Hamilton. > Apparently it's Telecom fibre, not Clear fibre. > > It's seems CLIX and Netgate peer at Waikato, so now I'm getting 600ms ping > times to Netgate connections from CLIX :-( > > That on top of total loss of bandwidth at 13:00, which has now improved to > dog slow international access. :-( > > > Regards > > David Anso > Systems Administrator - ZIP Internet > > Email: sysadmin(a)zip.co.nz > > ----- Original Message ----- > From: "Chris Wedgwood" <cw(a)f00f.org> > To: "J S Russell" <jsr(a)jsr.com> > Cc: "David Robb" <david.robb(a)staff.ihug.co.nz>; "NZNOG Mailing List" > <nznog(a)list.waikato.ac.nz> > Sent: Monday, July 09, 2001 2:19 PM > Subject: Re: IP express > > > > On Mon, Jul 09, 2001 at 01:39:56PM +1200, J S Russell wrote: > > > > The Clear Communications operations dude just told us that "some > fibres > > have been cut, somewhere." and that "he didn't have much info at this > > time." > > > > *who* said that? > > > > > > > > --cw > > --------- > > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > > where the body of your message reads: > > unsubscribe nznog > > > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

I'm off!
by Phill Groom 11 Jul '01

11 Jul '01

Lunch seems to have gone on a bit longer than normal today and since I am now at home and not at my desk I don't have access to all of the email addresses of the people I would like to personally say goodbye to. A general broadcast to nznog seems like the best way out of this predicament. Apologies to those that don't know me or do know me but don't care! I have left TelstraSaturn and will be returning to Telstra Corp. in Hobart next week. To all of the customers, potential customers, peers and competitors (not necessarily in that order) that I have had the pleasure of working with over the last two years I say thank you. I have learnt truck loads of stuff from all of you and will treasure the friendships I have made. This industry in New Zealand is unique. There are so many cluefull people who are prepared to put competition aside for the good of the general Internet community. I could make lots of Kiwi jokes, but I won't because I may want a job back here one day. Goodbye and good luck. Regards, Phill. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: IP express
by Seeby - Orcon Internet 10 Jul '01

10 Jul '01

Yes we are having problems with our IPExpress cct. we thought that it was just us. we have lodged a fault with Clear they haven't given us an ETA Cheers Seeby Orcon Internet - www.orcon.net.nz ----- Original Message ----- From: "Simon Lyall" <simon.lyall(a)ihug.co.nz> To: <nznog(a)list.waikato.ac.nz> Sent: Monday, July 09, 2001 10:51 AM Subject: ip express? > Looks like it's down going off who has died on APE. Can anyone confirm? > > -- > Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz > Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz > ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz > > --------- > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > where the body of your message reads: > unsubscribe nznog > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

8 11

Australian Bill - "10 years for hacker toolkits, scanners and virus code."
by Hamish MacEwan 08 Jul '01

08 Jul '01

I've read some of the discussion at, http://slashdot.org/article.pl?sid=01/07/07/0132226 and wonder if anyone has any reassurance to offer about the NZ bill? I'm presuming the practitioners on this list will be in some kind of grey area in this legislation, unless the State wishes to introduce a form of licensing, a la Car Salesmen, Security Guards, Doctor, and Network Operator who is granted specific exemptions regarding the general provisions of the law. The other, supra-legislative, issue that might have an operational impact on the operation of the Internet in NZ is this Hague Treaty expansion, at the behest of the usual beneficiaries, to encompass content law. Is there any concern that NZ ISPs will become liable, if the law is so elsewhere in the world? Hamish. -- The only real voyage of discovery consists not in seeking new landscapes but in having new eyes. -- Marcel Proust --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

7 11

Re: IP express
by Donald Neal 08 Jul '01

08 Jul '01

-- Donald Neal Mobility & Calling Platforms Network Delivery Telecom New Zealand Ltd >>> "Rob Isaac" <rob(a)automagic.org> 07/09/01 12:38 >>> >*Steps up to the plate* >Seeby sends email >having problems with IP >a fault is lodged I express suprise Spare time is so extensive for operations staff - Donald Neal --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Australian Bill - "10 years for hacker toolkits, scanners and virus code."
by Frank March 08 Jul '01

08 Jul '01

The well considered (and widely consulted) InternetNZ/ISOCNZ submission on SOP 85 (the 'antihacking' provisions) put together by Ewen McNeil and others is available at http://www.isocnz.org.nz/issues/iswg010209submsm_crimes-amend-bill-6.html The SOP itself and other links are to be found under 'Legislation' at: http://www.isocnz.org.nz/issues/index.html But to save everyone from the need to search, I can summarise by noting that the issues raised by the Australian Bill are not part of any NZ legislation currently before Parliament, or contemplated. On the other hand, I do believe that Hamish is correct to draw attention to the position of ISPs should NZ be placed in a position of being required to harmonise our laws with international movements. There will be an ISP Forum organised by InternetNZ later this year and these matters should be discussed there. Frank March Specialist Advisor, IT Policy Group Ministry of Economic Development, PO Box 1473, Wellington, NZ Ph: (+64 4) 474 2908; Fax: (+64 4) 471 2658 > -----Original Message----- > From: Hamish MacEwan [SMTP:nznog(a)Hamish.MacEwan.gen.nz] > Sent: Sunday, 8 July 2001 16:21 > To: nznog(a)list.waikato.ac.nz > Subject: Australian Bill - "10 years for hacker toolkits, scanners > and virus code." > > > I've read some of the discussion at, > http://slashdot.org/article.pl?sid=01/07/07/0132226 > > and wonder if anyone has any reassurance to offer about the > NZ bill? > > I'm presuming the practitioners on this list will be in some > kind of grey area in this legislation, unless the State > wishes to introduce a form of licensing, a la Car Salesmen, > Security Guards, Doctor, and Network Operator who is granted > specific exemptions regarding the general provisions of the > law. > > The other, supra-legislative, issue that might have an > operational impact on the operation of the Internet in NZ is > this Hague Treaty expansion, at the behest of the usual > beneficiaries, to encompass content law. > > Is there any concern that NZ ISPs will become liable, if the > law is so elsewhere in the world? > > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Cache peering via WIX/APE
by David Robb 08 Jul '01

08 Jul '01

If anyone else[1] is interested in cache peering across either WIX or APE, let me know. [1] ie, anyone I'm not already peering caches with David Robb --- Senior Network Engineer DDI +64-9-359-2710 ihug (AS7657) NOC +64-9-359-2708 "The Earth is a single point of failure" --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: ip express?
by Seeby - Orcon Internet 08 Jul '01

08 Jul '01

Did they lose it? ;-) or did you mean "fixing" the Clear IP express switch Cheers Seeby Orcon Internet - www.orcon.net.nz > According to someone else, The Clear tech is having problems finding the > IPexpress switch. > > -- > Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz > Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz > ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

ip express?
by Simon Lyall 08 Jul '01

08 Jul '01

Looks like it's down going off who has died on APE. Can anyone confirm? -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: ip express?
by Lindsay Druett 08 Jul '01

08 Jul '01

Did someone say there was a dead cat in the router ? -----Original Message----- From: Simon Lyall [mailto:simon.lyall(a)ihug.co.nz] Sent: Monday, 9 July 2001 10:51 To: nznog(a)list.waikato.ac.nz Subject: ip express? Looks like it's down going off who has died on APE. Can anyone confirm? -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

The New Zealand Network Operators' Group
by Donald Neal 08 Jul '01

08 Jul '01

The New Zealand Network Operators' Group The New Zealand Network Operators' Group (NZNOG) has no king, president or formal membership. At present it consists of the subscribers to this mailing list, which anyone is free to join. This list has a little under 250 subscribers, growing by a handful each month. The NZNOG mailing list is provided through a server at The University of Waikato, and is administered by an employee of Telecom NZ Ltd. Neither of these organisations (nor the administrator) is responsible for its content. The following non-working email addresses were recently removed from the list. Their owners are welcome to re-subscribe with working addresses. aleki097(a)student.otago.ac.nz brett.telfer(a)telecom.co.nz steve.hawken(a)ngtmail1.netgate.net.nz NZNOG Mailing List Acceptable Use Policy The NZNOG mailing list exists to provide a forum for the exchange of technical information and the discussion of implementation issues that require cooperation among New Zealand network service providers. In order to continue to provide a useful forum for discussion of relevant technical issues, users of the list are asked to respect the following guidelines. 1. Discussion will focus on Internet operational and technical issues. 2. Discussion related to meetings of network service providers is appropriate. 3. Discussion unrelated to these topics is not appropriate. 4. Postings to multiple mailing lists are discouraged. 5. Postings that include foul language, character assassination, and lack of respect for other participants are unacceptable. 6. Blatant product or service marketing is unacceptable. 7. Postings of a political, philosophical or legal nature are discouraged. 8. Postings to the list should be in ASCII or MIME encoded as text/plain. Attachments should not be sent to the list. To present a document, a suitable URL may be referred to. For documents of general interest, the use of proprietary file formats is discouraged. 9. Breaches of list etiquette should be dealt with privately with the offending list user, and should not result in complaints being sent to the list. Mailing List Archives A full archive is available at http://list.waikato.ac.nz/archives/nznog/ To search the archive, see http://list.waikato.ac.nz/archives/search.html (and remember to select nznog). Subscribing to the List To subscribe to the NZNOG list, send email to majordomo(a)list.waikato.ac.nz, where the body of the message reads subscribe nznog There are at present no restrictions on who may subscribe to the list, or even on who may post to the list. Digest Mailing List If you don't wish to receive postings as they are sent, you can instead subscribe to the nznog-digest mailiing list, on which all postings are sent out in a single "digest" every couple of days. Other Activities NZNOG does not at present have other regular activities than this mailing list. Donald Neal NZNOG Mailing List Owner/Administrator/Muggins --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

ORBS probes continue...
by cw＠f00f.org 06 Jul '01

06 Jul '01

I'm still seeing ORBS probe-messages... when I spoke to Alan last he told me ORBS would probably die as a result of the QSI takeover the the MIS user base. Now, these probe-messages are from one of the offshore probes, so I am left to wonder, migjt ORBS life on, are these remote probes still running waitning to be turned down? --cw --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 9

FW: Shared Registry System Implementation
by Peter Mott 01 Jul '01

01 Jul '01

Please bring this to the attention of folk in your organisation who may have an interest: > -----Original Message----- > From: Donna Hiser [mailto:d.hiser(a)domainz.net.nz] > Sent: Wednesday, 27 June 2001 11:22 a.m. > To: dns(a)2day.com > Subject: Shared Registry System Implementation > > SHARED REGISTRY SYSTEM IMPLEMENTATION > > As you may know ISOCNZ has appointed an SRS Implementation Manager, Rose > Percival, to manage the planning, design and rollout of the new shared > registry system. > > Rose has now drafted high level requirements for the SRS and has set up a > mailing list as a vehicle for those who wish to provide input into the > different aspects of the SRS as they are developed. > > The SRS Implementation Committee have now asked me to advise you of the > existence of this list, and to invite you on their behalf, to subscribe to > it. To do so, please go to > http://www.isocnz.org.nz/mailman/listinfo/srs-implementation. They also > invite you to consider the requirements definition document (at > http://www.isocnz.org.nz/srs ) and to provide any feedback either directly > to Rose or via the SRS Implementation list. > > If you have any concerns or queries about this, please contact the SRS > Implementation Manager (Rose Percival) directly at > rose.percival(a)isocnz.org.nz. Peter Mott Chief Enthusiast 2day.com -/- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 1

Re: Any Xtra mail admins on NZNOG?
by Ted Grenfell 25 Jun '01

25 Jun '01

That IP is in use by smtp.jabmail.net and is not an Xtra MTA. Jabmail.com NZ Ltd are apparently having some problems with their DNS server(s) at the moment. At 10:19 26/06/2001, Juha Saarinen wrote: >If so, could you please contact me? We have a problem with one MTA >(210.54.238.40) bouncing *all* mail going to it with a "550 - Relaying >prohibited". > >Other MTAs at Xtra receive mail fine. > >-- >Regards, > > >Juha > >PGP fingerprint: >B7E1 CC52 5FCA 9756 B502 10C8 4CD8 B066 12F3 9544 > > > > >--------- >To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz >where the body of your message reads: >unsubscribe nznog -- Ted Grenfell Xtra ISP Performance Manager Mob 025 435 455; DDI 09 359 5854; Fax 09 362 8100 Level 13, Telecom Tower, 16 Kingston St, Private Bag 92028, Auckland

2 1

Any Xtra mail admins on NZNOG?
by Juha Saarinen 25 Jun '01

25 Jun '01

If so, could you please contact me? We have a problem with one MTA (210.54.238.40) bouncing *all* mail going to it with a "550 - Relaying prohibited". Other MTAs at Xtra receive mail fine. -- Regards, Juha PGP fingerprint: B7E1 CC52 5FCA 9756 B502 10C8 4CD8 B066 12F3 9544 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

nz bgp stats, first puny attempt
by Joe Abley 25 Jun '01

25 Jun '01

Hello, I have a few bgp sessions up with a corresponding number of friendly people around the place, and have what I think is a reasonable view of the NZ network. I haven't amassed enough data to do anything particularly interesting yet, but I thought I'd hack one thing together quickly since I've heard a few people asking for it: see http://maggie.automagic.org/ for lists of "NZ networks" and "NZ ASNs" (there are some more precise descriptions on that page). People interested in delineating national and international traffic every month, for example, might find http://maggie.automagic.org/nzbgp/aggregates.month (or one of the specific-month snapshots) useful. Possibly even more useful when it has more than a few hours' worth of data in it. If anybody feels like donating additional views of the BGP table, so that I can try to keep this (and future) data as representative as possible, all I need is a multi-hop ebgp session terminating on 202.89.128.76 in AS65517; drop me a line if you feel like setting something up. Many thanks to those who have set one up for me already. Oh, and if you see something in the data that is clearly wrong, please let me know that too :) Joe --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 5

Open Letter to all NZ ISPs and users of NZNOG
by T McC 18 Jun '01

18 Jun '01

Please find attached an Open Letter to all ISPs in New Zealand and all users of NZNOG. This is in no way to be treated as SPAM. It is in response to the many misconceptions and uninformed comments made by ISPs in New Zealand and users of NZNOG as a result of the email I sent to ISPs in New Zealand asking them to adjust their server settings to accept access to the .z extension. Please read it and if any one has any comments or requires any further information please contact me. Yours Trevarr McCarthy President The Wapterix Internet Group -- _______________________________________________ FREE Personalized E-mail at Mail.com http://www.mail.com/?sr=signup Make PC-to-Phone calls with Net2Phone. Sign-up today at: http://www.net2phone.com/cgi-bin/link.cgi?121 -- _______________________________________________ FREE Personalized E-mail at Mail.com http://www.mail.com/?sr=signup Make PC-to-Phone calls with Net2Phone. Sign-up today at: http://www.net2phone.com/cgi-bin/link.cgi?121

20 37

Proxy ARP on APE
by Simon Blake 17 Jun '01

17 Jun '01

Evening all simon(a)magellan:~$ nmap -sP 192.203.154.0/24 -n ... Nmap run completed -- 256 IP addresses (145 hosts up) scanned in 23 seconds simon(a)magellan:~$ sudo arp -van | grep 00:E0:34:B9:C4:45 | wc 128 896 7295 Whoever has 00:E0:34:B9:C4:45 (I'm guessing either Zivo or QSI, since it's on the Clear IP Express interconnect), please make it stop, or I *will* drop it in a MAC filter to make the problem go away. Cheers Si --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 1

(no subject)
by Adam Moore 17 Jun '01

17 Jun '01

subscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 2

the ALT.ROOTS an introduction
by !Dr. Joe Baptista 17 Jun '01

17 Jun '01

Hi: I've recently noticed some discussion here on alt.roots. A topic of some interest to me. Don Stokes wishes they would go away, however i know they are here to stay. The ALT.ROOTS started as an experiment. The question was could the root be removed from DOC USG control (Department of Commerce, United States Government) and is it possible to expend namespace - and if so - what are the technical limitations. The experiment is now over. The ALT.ROOTS or expanded namespace works very well and the technical limitations to the growth of the root file are no different then the technical limitations seen at the .com zone file level. Now the ALT.ROOTS are experiencing a social experiment which seems to be working. They are co-ordinating the allocation of namespace in a reasonably open fashion. Some commercial ventures in fact now offer expanded root services. Certainly there have been some problems - but the expanded namespace is evolving at a rapid pace and i anticipate in excess of one million top level domains by next year. Much of this is due to various european ISP's who are activily co-ordinating local government resources to establish claims to namespace for specific and general purpose top level domains. I would actively encourage any ISP in NZ to participate. However - I advise some precautions when selecting a root provider or in listing your tlds on various root services. I speak from experience. I recently took control and shutdown about 80% of all root service traffic to the Open Root Server Confederation (ORSC). This affected organizations like znet.com - a large ISP in California, various University of California computer labs and sites, including the university president's office. Other affected parties included some ISP called Grasshoppernet, most of croatia (yes - i mean the country), and the Ministry of Education for the Grand Dutchy of Luxemburge. There were many others but these were the most interesting I found in my logs. My decision to shut down the roots was due mainly to bad planning on the part of the root operator. We enterted into an agreement with a Diebold Incorporated to provide arpa (network) infrastructure. During the period that Diebold used the arpas they made arrangements with the ORSC root operator to establish two roots on our networks. When our agreement expired we relocated our networks and examined them for traffic. We found alot of dns traffic for the old ORSC roots. As some of you may know - once a root is established it becomes a permanent fixture on the internet. Roots are pointed to using their internet protocol addresses. This put us in a sticky position. We were now in control of every answer to every question by every user attached to our infrastructure. As some of you may know a root service is a trusted service and the abuse of this trust can result in violation of a networks integrity. Our immediate concern was the what if question. What if a hacker who knew our sites once carried a root server - and understood the power of root - decided to break in and take over the root. They could essentially redirect traffic while capturing user password, names, addresses, credit card information - etc. etc. etc. This is a scary position to be left in and i'm sure you can all appreciate that. So as to avoid any potential liability we collapsed the root and redirected users attempting to access port 80 on any host to one web page which provided them with assistance on reconfiguring their computers or networks. So in picking a root I think it is very important to find one in which the infrastructure is captured by the root operator. This means that the IP numbers used to identify the root are stable and under the administrative control of the root operator - or secured by legal agreement. Many ALT.ROOT lack this. The ORSC has no legal obligation in place to provide service, they are not for profit, the ALTERNIC was established by a known felon and operate some of their infrastructure on @Home IP addresses, the OPENNIC is the same with network hardware addresses being outside their immediate control. So with roots operating on @Home infrastructure the possibility that an old but still active root can fall into the wrong hands is an uncomfortable probability. There is only one commercial root service - the largest of which is pacificroot and they have captured infrastructure. CINICS in france is building infrastructure for french governments and associations at various levels. So the push is on and the momentum unleashed. The only question is who do you trust when you don't have a report card on the players. And I include the USG root system in that question of trust. They have the same power to redirect users as I had when I made the decision to close down portions of the ORSC root infrastructure. And I find that power to be scarier in the hands of one government entity then i do in the hands of a nauty hacker. Those of you who want to explore alt roots can find more data at the Independent Root Operator's Network http://root-dns.org/ regards joe baptista The dot.GOD Registry, Limited The Executive Plaza, Suite 908 150 West 51st Street Tel: 1 (208) 330-4173 Manhattan Island NYC 10019 USA Fax: 1 (208) 293-9773 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

6 9

Re: Orcon's Ranges
by Simon Blake 17 Jun '01

17 Jun '01

Mmm, most likely. I need to go on a subscription drive - you'll get routes only from the these peers at the mo: Plain (192.203.154.12) 4 9559 0/0 0/0 0/0 0.01 Active Actrix (192.203.154.16) 4 9872 0/23 1/0 1/0 0.91 Established QSI (192.203.154.28) 4 9727 9/21 0/0 1/0 0.91 Established Telstra (192.203.154.32) 4 4763 0/0 0/0 0/0 0.01 Active IHUG (192.203.154.36) 4 7657 43/29 0/0 1/0 0.91 Established AOL (192.203.154.44) 4 4770 19/13 0/0 1/0 0.91 Established Zivo (192.203.154.45) 4 9495 4/19 0/0 1/0 0.91 Established Attica (192.203.154.46) 4 9790 3/20 0/0 1/0 0.91 Established WalkWire (192.203.154.49) 4 17412 1/29 0/0 1/0 0.91 Established Quest (192.203.154.64) 4 64512 0/23 0/0 1/0 0.91 Established Orcon (192.203.154.66) 4 17746 3/58 0/0 3/2 0.49 Established Some ISP's don't peer with the route servers, for a variety of reasons. I'm expecting that to change as the number of peers increase, as I put in place some more automated procedures for updating the route servers, and as I place some more pressure on the ISP's. Which is a long winded way of saying, nobody is obligated to peer with the route servers, you still may need to negotiate some bilateral arrangements. Anybody else who wants to peer with the route servers on APE, please sing out. Cheers Si On Mon, 18 Jun 2001, Craig Whitmore wrote: > I'm seeing...Is that all? > > Thanks > Craig > > * 138.235.0.0 192.203.154.44 0 9560 4770 i > * 192.173.16.0/21 192.203.154.44 0 9560 4770 i > * 202.6.84.0 192.203.154.44 0 9560 4770 i > * 202.12.70.0 192.203.154.44 0 9560 4770 i > * 202.14.100.0 192.203.154.44 0 9560 4770 i > *> 202.27.100.0/22 192.203.154.45 0 9560 9495 i > *> 202.36.45.0 192.203.154.45 0 9560 9495 i > * 202.37.85.0 192.203.154.44 0 9560 4770 i > * 202.37.140.0/22 192.203.154.44 0 9560 4770 i > * 202.37.144.0/21 192.203.154.44 0 9560 4770 i > * 202.37.197.0 192.203.154.44 0 9560 4770 i > * 202.37.200.0/22 192.203.154.44 0 9560 4770 i > * 202.37.224.0/21 192.203.154.44 0 9560 4770 i > * 202.49.144.0 192.203.154.44 0 9560 4770 i > * 202.50.16.0/20 192.203.154.44 0 9560 4770 i > *> 202.78.128.0/21 192.203.154.45 0 9560 9495 i > *> 202.89.128.0/19 192.203.154.28 0 9560 9727 i > * 202.180.64.0/19 192.203.154.46 0 9560 9790 i > * 202.180.64.0/18 192.203.154.46 0 9560 9790 i > * 202.180.96.0/19 192.203.154.46 0 9560 9790 i > *> 203.96.120.0/23 192.203.154.45 0 9560 9495 i > * 203.99.65.0 192.203.154.44 0 9560 4770 9511 > i > * 203.99.66.0 192.203.154.44 0 9560 4770 9511 > i > * 203.99.71.0 192.203.154.44 0 9560 4770 9511 > i > * 210.48.0.0/17 192.203.154.44 0 9560 4770 i > *> 210.54.0.0/22 192.203.154.44 0 9560 4770 17427 > i > * 210.55.254.0 192.203.154.46 0 9560 9727 9790 > i > > ----- Original Message ----- > From: "Simon Blake" <simon(a)citylink.co.nz> > To: "Craig Whitmore" <lennon(a)orcon.net.nz> > Sent: Monday, June 18, 2001 1:51 PM > Subject: Re: Orcon's Ranges > > > > Hokay, .1 is peering, I'm seeing this from you: > > > > magellan MRTd# sh bgp neigh 192.203.154.66 route in > > > > Peer 192.203.154.66 ip unicast 11 routes > > P Pref Time Destination Next Hop If > > B 0 00:09:22 202.27.188.128/25 192.203.154.66 eth0 > > B 0 00:09:22 210.54.13.0/24 192.203.154.66 eth0 > > B 0 00:09:22 210.54.142.0/23 192.203.154.66 eth0 > > B 0 00:09:22 210.54.148.0/22 192.203.154.66 eth0 > > B 0 00:09:22 210.55.8.0/24 192.203.154.66 eth0 > > B 0 00:09:22 210.55.12.0/24 192.203.154.66 eth0 > > B 0 00:09:22 210.55.13.0/24 192.203.154.66 eth0 > > B 0 00:09:22 210.55.14.0/24 192.203.154.66 eth0 > > B 0 00:09:22 210.55.15.0/24 192.203.154.66 eth0 > > B 0 00:09:22 210.55.18.0/24 192.203.154.66 eth0 > > B 0 00:09:22 210.55.199.0/24 192.203.154.66 eth0 > > > > So, looks pretty good, you should be getting assorted stuff from the other > > ISP's viz the route server now. I'll have .2 going later in the > > afternoon. > > > > Cheers > > Si > > > > On Mon, 18 Jun 2001, Craig Whitmore wrote: > > > > > Hi Simon. Here are the prefix lists for Orcon. We will also be > advertising > > > Datacom's Ranges to APE (via our AS Number) > > > > > > Do we peer with rs1.ape.net.nz and rs2.ape.net.nz with APE's (9560) > > > Number... > > > > > > Orcon: As 17746 IP : 192.203.154.6 > > > > > > ip prefix-list ORCON-networks description Orcon Internet > <noc(a)orcon.net.nz> > > > ip prefix-list ORCON-networks seq 5 permit 202.27.188.128/25 > > > ip prefix-list ORCON-networks seq 10 permit 210.54.13.0/24 > > > ip prefix-list ORCON-networks seq 15 permit 210.54.142.0/23 > > > ip prefix-list ORCON-networks seq 20 permit 210.54.148.0/23 > > > ip prefix-list ORCON-networks seq 25 permit 210.55.8.0/24 > > > ip prefix-list ORCON-networks seq 30 permit 210.55.12.0/24 > > > ip prefix-list ORCON-networks seq 35 permit 210.55.13.0/24 > > > ip prefix-list ORCON-networks seq 40 permit 210.55.14.0/24 > > > ip prefix-list ORCON-networks seq 45 permit 210.55.15.0/24 > > > ip prefix-list ORCON-networks seq 50 permit 210.55.18.0/24 > > > ip prefix-list ORCON-networks seq 55 permit 210.55.199.0/24 > > > > > > ip prefix-list DATACOM-networks description Datacom Network > > > <noc(a)orcon.net.nz> > > > ip prefix-list DATACOM-networks seq 5 permit 202.14.20.0/22 > > > ip prefix-list DATACOM-networks seq 10 permit 202.27.76.0/23 > > > ip prefix-list DATACOM-networks seq 15 permit 202.27.140.0/22 > > > ip prefix-list DATACOM-networks seq 20 permit 210.27.250.0/24 > > > > > > > > > > > > > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Peering with Orcon Internet
by Craig Whitmore 17 Jun '01

17 Jun '01

Any ISP wanting to Peer with Orcon Internet Directly @ APE please let me know to arrange it. Thanks Craig Whitmore Orcon Internet http://www.orcon.net.nz -------------------------------------------------------------------- APE IP: 192.203.154.66 AS:17746 ip prefix-list ORCON-networks description Orcon Internet <noc(a)orcon.net.nz> ip prefix-list ORCON-networks seq 5 permit 210.55.12.0/24 ip prefix-list ORCON-networks seq 10 permit 210.55.13.0/24 ip prefix-list ORCON-networks seq 15 permit 210.55.14.0/24 ip prefix-list ORCON-networks seq 20 permit 210.55.15.0/24 ip prefix-list ORCON-networks seq 25 permit 210.55.18.0/24 ip prefix-list ORCON-networks seq 30 permit 210.54.13.0/24 ip prefix-list ORCON-networks seq 35 permit 210.54.142.0/23 ip prefix-list ORCON-networks seq 40 permit 210.54.148.0/23 ip prefix-list ORCON-networks seq 45 permit 210.55.8.0/24 ip prefix-list ORCON-networks seq 50 permit 210.55.199.0/24 ip prefix-list ORCON-networks seq 55 permit 202.14.20.0/22 ip prefix-list ORCON-networks seq 60 permit 202.27.76.0/23 ip prefix-list ORCON-networks seq 65 permit 202.27.140.0/22 ip prefix-list ORCON-networks seq 70 permit 210.27.250.0/24 ip prefix-list ORCON-networks seq 75 permit 202.27.188.128/25

2 1

Public providers and ASN on WIX
by Simon Blake 17 Jun '01

17 Jun '01

Matthew Grant from Plain was asking who the WIX route servers pee with, I figured the results may be of interest to others peering or considering peering on WIX: neighbor 202.7.0.1 remote-as 9439 neighbor 202.7.0.1 description Citylink neighbor 202.7.0.49 remote-as 2687 neighbor 202.7.0.49 description AT-T ! neighbor 202.7.0.65 remote-as 7714 ! neighbor 202.7.0.65 description Netlink1 neighbor 202.7.0.76 remote-as 9736 neighbor 202.7.0.76 description Domainz neighbor 202.7.0.78 remote-as 9718 neighbor 202.7.0.78 description Chello neighbor 202.7.0.129 remote-as 9343 neighbor 202.7.0.129 description Actrix neighbor 202.7.0.130 remote-as 9872 neighbor 202.7.0.130 description Actrix-LH neighbor 202.7.0.177 remote-as 9495 neighbor 202.7.0.177 description Clearview neighbor 202.7.0.192 remote-as 4768 neighbor 202.7.0.192 description Clear neighbor 202.7.0.241 remote-as 7657 neighbor 202.7.0.241 description IHUG neighbor 202.7.1.1 remote-as 4770 neighbor 202.7.1.1 description ICONZ neighbor 202.7.1.49 remote-as 9436 neighbor 202.7.1.49 description Globe-Net neighbor 202.7.1.65 remote-as 9445 neighbor 202.7.1.65 description Saturn neighbor 202.7.1.110 remote-as 4740 neighbor 202.7.1.110 description Voyager neighbor 202.7.1.129 remote-as 9345 neighbor 202.7.1.129 description Paradise neighbor 202.7.1.176 remote-as 9503 neighbor 202.7.1.176 description Comnet neighbor 202.7.1.193 remote-as 9338 neighbor 202.7.1.193 description NLNZ neighbor 202.7.1.241 remote-as 9325 neighbor 202.7.1.241 description Xtra neighbor 202.7.1.244 remote-as 9559 neighbor 202.7.1.244 description Plain Cheers Si --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

XTRA, blacklisted by 'mail.com' --- WHY?
by Chris Wedgwood 17 Jun '01

17 Jun '01

At present, some of my outband email is sent through XTRA's mail-server(s) as they block outgoing SMTP access when you are inflicted with Jetstream/Jetstart through Xtra. Not that I really mind all that much, it works pretty much flawlessly and Xtra are arguably being good people by blocking nasty evil users from injecting spam into other peoples open-relays (perhaps they block other ports too --- maybe someone from Xtra can comment?). Now, this just occured, which again doesn't really bother me in this instance, but I am curious as to _why_ this was blocked. The DSN I received says this: Reporting-MTA: dns; balthamel.xtra.co.nz Arrival-Date: Sun, 17 Jun 2001 23:13:47 +1200 Received-From-MTA: dns; tapu (210.55.42.93) Final-Recipient: RFC822; <wapterix(a)mail.com> Action: failed Status: 5.1.3 Remote-MTA: dns; mail-com-bk.mr.outblaze.com (205.158.62.36) Diagnostic-Code: smtp; 553 5.3.0 Mail from 203.96.92.15 refused. Blacklisted. yet when I check the common 'blacklisting' mechanisms I find nothing: tapu:~$ rblcheck 203.96.92.15 203.96.92.15 not RBL filtered by blackholes.mail-abuse.org 203.96.92.15 not RBL filtered by dialups.mail-abuse.org 203.96.92.15 not RBL filtered by relays.mail-abuse.org 203.96.92.15 not RBL filtered by inputs.orbs.org 203.96.92.15 not RBL filtered by outputs.orbs.org 203.96.92.15 not RBL filtered by manual.orbs.org 203.96.92.15 not RBL filtered by spamsources.orbs.org 203.96.92.15 not RBL filtered by untestable-netblocks.orbs.org 203.96.92.15 not RBL filtered by spamsource-netblocks.orbs.org so I wonder what else is out there that is used to blacklist evil people? And why is Xtra in this list? --cw --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 5

Lots of broken mail at Xtra
by Martin D Kealey 14 Jun '01

14 Jun '01

Has anyone else noticed a recent downturn in mail deliverability for domains hosted by Xtra? In particular, in the last month I have had 3 mailing lists royally screwed by having various clients of Xtra decide to disregard the envelope addressee and send the mail back into the list injection point. The common features in all cases have been the primary MX is mta.xtra.co.nz the mail is collected from there using a POP client the mail is then fed to an Exchange Server The first one was the worst because they were on a full-time IP connection, which meant that the mail loop just went berserk; to make it worse they had changed the domain, and therefore there was *no* identifying information in the list to figure out what had gone wrong. The others since have been easier because they've been on various dial-up connections (and therefore slower) and have had useful identifying information in the report headers. Is this a problem with Xtra, or is there a new (broken) version of Exchange that is flavour of the month for installing? -Martin -- CAUTION: The information contained in this message is consequential and subject to legacy provenance. If you are the intended recipient you are hereby notified that reading this message is permitted. If you have not received this message please notarise the sender and destroy the originator. Help Microsoft stamp out software piracy: give Linux to a friend today... --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

16 29

Orcon APE connection - FIXED :-)
by Seeby Woodhouse - Orcon 13 Jun '01

13 Jun '01

Hi there everyone Our connection to APE now works properly :-) The problem was a faulty Fibre to Ethernet tranciever at Clear's end of the link. We have been doing tests for several hours, and the link looks stable enough to start putting traffic on. We are interested in peering with as many people as possible up here - because after all - that's what APE is for. I will post our ASN, prefixes etc tomorrow Cheers Seeby Orcon Internet - www.orcon.net.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Re: Orcon APE connection woes
by Seeby Woodhouse - Orcon 13 Jun '01

13 Jun '01

Hmm we have forced full-duplex and turned off auto-negotiation on our Catalyst 5000 switch - but we have also tried all the other settings possible. Clear have told us to set it to 10Mbps Full-Duplex - so that's what it is at present. Cheers Seeby Orcon Internet - www.orcon.net.nz ----- Original Message ----- From: "Ian Quinn" <iquinn(a)juniper.net> To: "Seeby Woodhouse - Orcon" <seeby(a)orcon.net.nz> Sent: Wednesday, June 13, 2001 6:42 PM Subject: RE: Orcon APE connection woes > > I had some problems recently that were marginally similar. Although I had > the speed and duplex settings configured, it didn't come right until I > turned off auto negotiation as well (eg no negotiation or something along > those lines). > > No idea if it's your problem - just seems familiar. > > Good luck :-) > > Regards / Ian > > -----Original Message----- > > From: Seeby Woodhouse - Orcon [mailto:seeby(a)orcon.net.nz] > > Sent: Wednesday, 13 June 2001 6:27 p.m. > > To: NZNOG Mailing List > > Subject: Orcon APE connection woes > > > > > > Hi there everyone > > > > Orcon has just had a 10Mbit IPExpress connection to APE > > completed, and I > > have been fighting with it all day. > > > > If we ping anyone on APE, then we get around 2/3's of the > > pings through, and > > 1/3 are dropped. > > This happens in a pattern of 1/3 drop, 2/3 get through. > > > > I talked with Clear and they said that it could be the > > IPExpress connection > > re-negotiating because of what is on our end, so we have been > > playing with > > the settings on our Catalyst 5000 switch - we have forced the > > port to our > > IPExpress connection full duplex / half duplex / 100mb / 10mb > > but they all > > seem to give the same results. > > > > Clear has advised us to set our equipment to 10Mbit full > > duplex - so that's > > what it is at present. > > > > The connection from IPExpress is then VLan'd from our > > Catalyst switch into > > our core Cisco 7505 router. > > > > A ping report of 300 pings to ihug.ape.net.nz looks like this > > > > --------------------------------------------------- > > ORCON7505#ping > > Protocol [ip]: > > Target IP address: ihug.ape.net.nz > > Repeat count [5]: 300 > > Datagram size [100]: > > Timeout in seconds [2]: > > Extended commands [n]: > > Sweep range of sizes [n]: > > Type escape sequence to abort. > > Sending 300, 100-byte ICMP Echos to 192.203.154.36, timeout > > is 2 seconds: > > ........!!!!!!!!!!!!!!!!!!!!!..........!!!!!!!!!!!!!!!!..........!!!!! > > !!!!!!!!!!!!!!!...........!!!!!!!!!!!!!!!!!!!!!!...........!!!!!!!!!!! > > !!!!!!!!!!!!...........!!!!!!!!!!!!!!!!!!!!!!!!!...........!!!!!!!!!!! > > !!!!!!!!!...........!!!!!!!!!!!!!!!!!!!!!..........!!!!!!!!!!!!!!!!!!! > > !!..........!!!!!!!! > > Success rate is 65 percent (197/300), round-trip min/avg/max > > = 1/3/24 ms > > -------------------------------------------------- > > > > Can anyone shed any light on this? > > > > Is this related the the spanning tree problems that have been > > happening up > > at APE recently? > > Or should we be hassling Clear about the service..... > > > > Cheers > > Seeby > > > > Orcon Internet - www.orcon.net.nz > > > > > > --------- > > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > > where the body of your message reads: > > unsubscribe nznog > > > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 6

Zfree Delibratley slowing down access to Orcon's network
by Seeby Woodhouse - Orcon 13 Jun '01

13 Jun '01

It seems that Zfree is delibratley slowing down Internet access to some of Orcon's internal network. If we test by dialing up using a Zfree account, most of our network is blazingly fast, however access to our Mail server and FreeHost server is painfully slow. (mail.orcon.net.nz and freehost.orcon.net.nz) Last time we informed them of this problem, the issue mysteriously went away - but now it is back again a week later. I suspect that Zfree is delibratley rate-shaping the amount of traffic that can go to our mail server and our freehost server from their network to prevent people from accessing them. It is quite frustrating when it is our helpdesk that is recieving all the calls (because theirs is 0900), when it is actually their problem - especially when the customers that are calling us are not actually using us for dialup. Any system administrators for Clear got something to say about this? ;-) -- Cheers Seeby Orcon Internet - www.orcon.net.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Re: Orcon APE connection woes
by Seeby Woodhouse - Orcon 12 Jun '01

12 Jun '01

Hi there Tim I don't want to put any traffic over to APE until this link is working properly. As you know, BGP won't detect packet loss, so it is still better to keep sticking all our Traffic via Telecom until this issue is resolved. As soon as the link works reliably - then we will want to peer with everyone that we can. Hopefully we'll be able to get sub 10ms pings to most ISP's in the country at the end of this ;-) Cheers Seeby Orcon Internet - www.orcon.net.nz ----- Original Message ----- From: "Tim Philips" <tim.philips(a)attica.co.nz> To: "Seeby Woodhouse - Orcon" <seeby(a)orcon.net.nz> Sent: Wednesday, June 13, 2001 6:52 PM Subject: Re: Orcon APE connection woes > On Wed, 13 Jun 2001, Seeby Woodhouse - Orcon wrote: > > Seeby, > > We have had this problem before. Well are still having it with our > Tangent 100Mb. I will see what I can find. Would you like to peer with > us also once your link is up and running. > > If you do provide us with a prefix list and I or one of the other guys > will sort it all out. > > > Hi there everyone > > > > Orcon has just had a 10Mbit IPExpress connection to APE completed, and I > > have been fighting with it all day. > > > > If we ping anyone on APE, then we get around 2/3's of the pings through, and > > 1/3 are dropped. > > This happens in a pattern of 1/3 drop, 2/3 get through. > > > > I talked with Clear and they said that it could be the IPExpress connection > > re-negotiating because of what is on our end, so we have been playing with > > the settings on our Catalyst 5000 switch - we have forced the port to our > > IPExpress connection full duplex / half duplex / 100mb / 10mb but they all > > seem to give the same results. > > > > Clear has advised us to set our equipment to 10Mbit full duplex - so that's > > what it is at present. > > > > The connection from IPExpress is then VLan'd from our Catalyst switch into > > our core Cisco 7505 router. > > > > A ping report of 300 pings to ihug.ape.net.nz looks like this > > > > --------------------------------------------------- > > ORCON7505#ping > > Protocol [ip]: > > Target IP address: ihug.ape.net.nz > > Repeat count [5]: 300 > > Datagram size [100]: > > Timeout in seconds [2]: > > Extended commands [n]: > > Sweep range of sizes [n]: > > Type escape sequence to abort. > > Sending 300, 100-byte ICMP Echos to 192.203.154.36, timeout is 2 seconds: > > ........!!!!!!!!!!!!!!!!!!!!!..........!!!!!!!!!!!!!!!!..........!!!!! > > !!!!!!!!!!!!!!!...........!!!!!!!!!!!!!!!!!!!!!!...........!!!!!!!!!!! > > !!!!!!!!!!!!...........!!!!!!!!!!!!!!!!!!!!!!!!!...........!!!!!!!!!!! > > !!!!!!!!!...........!!!!!!!!!!!!!!!!!!!!!..........!!!!!!!!!!!!!!!!!!! > > !!..........!!!!!!!! > > Success rate is 65 percent (197/300), round-trip min/avg/max = 1/3/24 ms > > -------------------------------------------------- > > > > Can anyone shed any light on this? > > > > Is this related the the spanning tree problems that have been happening up > > at APE recently? > > Or should we be hassling Clear about the service..... > > > > Cheers > > Seeby > > > > Orcon Internet - www.orcon.net.nz > > > > > > --------- > > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > > where the body of your message reads: > > unsubscribe nznog > > > > -- > Thanks, > Tim Philips > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Orcon APE connection woes
by Seeby Woodhouse - Orcon 12 Jun '01

12 Jun '01

Hi there everyone Orcon has just had a 10Mbit IPExpress connection to APE completed, and I have been fighting with it all day. If we ping anyone on APE, then we get around 2/3's of the pings through, and 1/3 are dropped. This happens in a pattern of 1/3 drop, 2/3 get through. I talked with Clear and they said that it could be the IPExpress connection re-negotiating because of what is on our end, so we have been playing with the settings on our Catalyst 5000 switch - we have forced the port to our IPExpress connection full duplex / half duplex / 100mb / 10mb but they all seem to give the same results. Clear has advised us to set our equipment to 10Mbit full duplex - so that's what it is at present. The connection from IPExpress is then VLan'd from our Catalyst switch into our core Cisco 7505 router. A ping report of 300 pings to ihug.ape.net.nz looks like this --------------------------------------------------- ORCON7505#ping Protocol [ip]: Target IP address: ihug.ape.net.nz Repeat count [5]: 300 Datagram size [100]: Timeout in seconds [2]: Extended commands [n]: Sweep range of sizes [n]: Type escape sequence to abort. Sending 300, 100-byte ICMP Echos to 192.203.154.36, timeout is 2 seconds: ........!!!!!!!!!!!!!!!!!!!!!..........!!!!!!!!!!!!!!!!..........!!!!! !!!!!!!!!!!!!!!...........!!!!!!!!!!!!!!!!!!!!!!...........!!!!!!!!!!! !!!!!!!!!!!!...........!!!!!!!!!!!!!!!!!!!!!!!!!...........!!!!!!!!!!! !!!!!!!!!...........!!!!!!!!!!!!!!!!!!!!!..........!!!!!!!!!!!!!!!!!!! !!..........!!!!!!!! Success rate is 65 percent (197/300), round-trip min/avg/max = 1/3/24 ms -------------------------------------------------- Can anyone shed any light on this? Is this related the the spanning tree problems that have been happening up at APE recently? Or should we be hassling Clear about the service..... Cheers Seeby Orcon Internet - www.orcon.net.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

WHOIS Survey - DNSO
by Andy Linton 12 Jun '01

12 Jun '01

The DNSO is conducting a survey on ICANN's WHOIS policy. http://www.icann.org/dnso/whois-survey-en-10jun01.htm --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: subscribe NZOG
by Lindsay Druett 12 Jun '01

12 Jun '01

How does the subscribe kit work ? > -----Original Message----- > From: Michael White [mailto:MWHITE(a)clear.co.nz] > Sent: Wednesday, 13 June 2001 14:40 > To: Michael White; nznog(a)list.waikato.ac.nz; 'Juha Saarinen' > Subject: RE: subscribe NZOG > > Damn, wrong kit. > > Mike > > ---------- > From: Juha Saarinen > Sent: Wednesday, 13 June 2001 2:33 PM > To: 'Michael White'; nznog(a)list.waikato.ac.nz > Subject: RE: subscribe NZOG > > Heres how to unsubscribe: > > > Errr... I think the person wants to subscribe. > > -- Juha > > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: subscribe NZOG
by Michael White 12 Jun '01

12 Jun '01

Damn, wrong kit. Mike > ---------- > From: Juha Saarinen > Sent: Wednesday, 13 June 2001 2:33 PM > To: 'Michael White'; nznog(a)list.waikato.ac.nz > Subject: RE: subscribe NZOG > > Heres how to unsubscribe: > > > Errr... I think the person wants to subscribe. > > -- Juha > >

2 1

RE: subscribe NZOG
by Michael White 12 Jun '01

12 Jun '01

> ---------- > From: Te Aroha > Sent: Wednesday, 13 June 2001 2:13 PM > To: nznog(a)list.waikato.ac.nz > Subject: subscribe NZOG > > Hi there > > Can you please subscribe me to this mailing list. > > Cheers > > > Te Aroha > Maxnet Support Team > Customer Services Supervisor > support(a)maxnet.co.nz > Ph: 0508 MAXNET > Ph: (09) 300-7555 Tech Support > Ph: (09) 300-7222 Office > > > > Heres how to unsubscribe: > > First, ask your Internet Provider to mail you an Unsubscribing Kit. > Then follow these directions. > > The kit will most likely be the standard no-fault type. Depending on > requirements, System A and/or System B can be used. When operating > System A, depress lever and a plastic dalkron unsubscriber will be > dispensed through the slot immediately underneath. When you have > fastened the adhesive lip, attach connection marked by the large "X" > outlet hose. Twist the silver- coloured ring one inch below the > connection point until you feel it lock. > > The kit is now ready for use. The Cin-Eliminator is activated by the > small switch on the lip. When securing, twist the ring back to its > initial condition, so that the two orange lines meet. Disconnect. > Place the dalkron unsubscriber in the vacuum receptacle to the rear. > Activate by pressing the blue button. > > The controls for System B are located on the opposite side. The red > release switch places the Cin-Eliminator into position; it can be > adjusted manually up or down by pressing the blue manual release > button. The opening is self- adjusting. To secure after use, press > the green button, which simultaneously activates the evaporator and > returns the Cin-Eliminator to its storage position. > > You may log off if the green exit light is on over the evaporator . > If the red light is illuminated, one of the Cin-Eliminator > requirements has not been properly implemented. Press the "List Guy" > call button on the right of the evaporator . He will secure all > facilities from his control panel. > > To use the Auto-Unsub, first undress and place all your clothes in > the clothes rack. Put on the velcro slippers located in the cabinet > immediately below. Enter the shower, taking the entire kit with you. > On the control panel to your upper right upon entering you will see a > "Shower seal" button. Press to activate. A green light will then be > illuminated immediately below. On the intensity knob, select the > desired setting. Now depress the Auto-Unsub activation lever. Bathe > normally. > > The Auto-Unsub will automatically go off after three minutes unless > you activate the "Manual off" override switch by flipping it up. When > you are ready to leave, press the blue "Shower seal" release button. > The door will open and you may leave. Please remove the velcro > slippers and place them in their container. > > If you prefer the ultrasonic log-off mode, press the indicated blue > button. When the twin panels open, pull forward by rings A & B. The > knob to the left, just below the blue light, has three settings, low, > medium or high. For normal use, the medium setting is suggested. > > After these settings have been made, you can activate the device by > switching to the "ON" position the clearly marked red switch. If > during the unsubscribing operation, you wish to change the settings, > place the "manual off" override switch in the "OFF" position. You may > now make the change and repeat the cycle. When the green exit light > goes on, you may log off and have lunch. Please close the door behind > you. > > > >

2 1

My Bad
by Te Aroha 12 Jun '01

12 Jun '01

OK ppl's My Bad I submitted to this list instead of majordomo...Cheers to Brendan Willis, Mark Little, Gavin Quayle and crew for sorting me out...I guess supervising you guys taught me nothing. :) Te Aroha Maxnet Support Team tearoha(a)maxnet.co.nz t(a)maxnet.co.nz

1 0

subscribe NZOG
by Te Aroha 12 Jun '01

12 Jun '01

Hi there Can you please subscribe me to this mailing list. Cheers Te Aroha Maxnet Support Team Customer Services Supervisor support(a)maxnet.co.nz Ph: 0508 MAXNET Ph: (09) 300-7555 Tech Support Ph: (09) 300-7222 Office

1 0

Problem at Clear???
by Craig Whitmore 12 Jun '01

12 Jun '01

Anyone notice that Clear are unreachable from the Internet?? (Overseas/Orcon/Win Internet/etc) Thanks Craig Whitmore I Talk for Myself

5 7

RE: Lots of broken mail at Xtra
by Olof Olsson 11 Jun '01

11 Jun '01

> From: Joe Abley [mailto:jabley(a)automagic.org] > Sent: Tuesday, June 12, 2001 6:59 AM > > ETRN is actually optional with mailbagging, too. Connection attempts > will begin shortly after the mailbagging user connects, and > will repeat > at regular intervals if there is mail to deliver. > > The following script may be useful: > > for n in ${things_involving_mail} > do > olof ${n} > done > Thanks for blowing my cover Joe! :-) Basically, what we do for CLEAR Net Mail is: 1) Add X-Envelope-To: headers to all inbound messages. This allows for POP3 retrieval of messages for one or more domains/users etc, without having lost the envelope recipients. (Many POP3 <=> SMTP gateways have the capabilities of performing deliveries on these kind of custom headers.) Is POP3 the right mechanism for this? Maybe not, but a lot of our customers want to do just this. And of course, the customer is always right. :-) But a nicer way is mailbagging... For mailbagging: 2a) For mailbagging customers we delivery messages into a separate mailbagging store. This store is designed so that it can efficiently queue large number of messages for each customer. It also (of course) preserves envelope information. 2b) Customers configure a "mailbagging pick-up user-id" via our self-provisioning interface. 2c) When a customers logs on using his pick-up user-id, we kick off outbound SMTP delivery. Once all the mail has been delivered, we check for new incoming mail every 60 seconds, and deliver appropriately. (For as long as the user stays logged on.) Some notes: *** We can do this for both static _and_ dynamic IP assignments. (However, we only offer customers dynamic IP addresses. Static addresses for dial-up customers are bad, for many reasons.) *** Handling dynamic IP addresses (obviously) requires us to keep track, in real-time, of who is assigned what IP address. We do this via a real-time database. Delivery via SMTP is triggered from this database when a user-id record is added that is tagged as a "mailbagging pick-up user-id". *** There are some racing conditions which makes it hard to safely use a standard MTA to implement mailbagging with dynamic IP addresses. Hence, we use a custom MTA. *** We ignore ETRNs. --Olof --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Lots of broken mail at Xtra
by Ben Martel 11 Jun '01

11 Jun '01

Don, > If you really must use POP to retrieve multiple users' mail, use > multiple mailboxes and query 'em all. Better still, use a real > transport protocol. SMTP with ETRN or dial-up triggering > strikes me as a > *much* better (if not perfect) solution. <infomercial>Take a look @ CLEARs mailbagging product. It even does it on dialup connect or dial-up triggering as you suggested :)</infomercial> ~benm --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

FW: Rootserver Change Request
by Peter Mott 06 Jun '01

06 Jun '01

Anybody got anything to say about this? Peter Mott Chief Enthusiast 2day.com -/- > ***************************************************************** > This message is being sent to 70 ISP's in New Zealand > It's a request for your company to change it's Root Server setup. > ***************************************************************** > > > To whom it may concern, > > > The Wapterix Internet Group is in the process of setting up it's online > presence. > > We are looking to offer a number of online services including hosting, > domain registration and web design to name a view. One area we > will not be > entering into is that of an ISP. We feel that there is already a good > selection and number of ISP's operating in New Zealand and for us to enter > into this sort of service would dilute our energies from the provision of > services that will be profitable for us. > > The reason for our contacting you is that we have a number of domains > relevant to our business operation that have been registered > under the ".z" > domain extension. As this extension is an alternative extension, and not > recognised by the A-Root Server, we are writing to ask that you > adjust your > name servers and resolvers to allow New Zealand internet users access to > this extension. > > The extension is controlled by ADNS.net through their site, www.adns.net, > where you will be able to find information on how, as an ISP, you > can change > your servers so that domains under this extension are visible to the > internet users of New Zealand. > > ADNS use the ORSC Root Server (www.open-rsc.org) rather than the A Root > Server given that they are an alternative extension. This Root > Server has a > large number of internet users accessing it, and offers the added > advantage > that users, while being able to access alternative extensions > covered by the > ORSC Root Server, they can also access all generic extensions - > .com, .net, > .org, .co.nz - and so on. > > We have chosen to operate domains under the ".z" extension in > support of our > belief that the internet should be not be controlled by one > governing body, > and that individuals should be free to choose any extension that > suits their > operation and/or operate their own extensions, provided those > extensions do > not legally interfere with the operation of extensions operated by other > individuals or organisations. We hope you accept our view and > will support > us in our operation by changing your servers accordingly allowing us to > operate our domains, and New Zealand internet users the ability to access > our domains. > > Should you have any querries please do not hesitate to contact me. I will > be more than willing to answer any questions you may have. > > > Yours > > Trevarr McCarthy > President > The Wapterix Internet Group --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

7 7

VOIP, the next big test.
by Roger De Salis 05 Jun '01

05 Jun '01

This is sufficiently thought provoking and on-topic that I thought it worthy of posting. RDS. The article disses Cisco fairly thoroughly (there are also some compliments as well). I've added some comments at the bottom. Feel free to discard my comments as appropriate. -----Original Message----- From: Peter Ecclesine [mailto:petere(a)aimnet.com] Sent: Monday, 4 June 2001 9:59 PM To: wireless Subject: Comments on Australia's VOIP nets From: Frank A. Coluccio Thursday, May 31, 2001 12:35 PM Glenn Turner, who apparently operates the Australian Academic and Research Network has some very interesting IMO things to say about running voice over the Internet. This is from the ongoing discussion on NANOG that questions: QOS or More Bandwidth? Enjoy, FAC ================snip begins: <so and so> wrote: > > > Whenever I did the cost of deploying and managing fancy QoS > > and compared it with the cost of getting and managing more > > capacity, it was always MUCH MUCH cheaper to get and manage > > more capacity than to mess with more QoS. > > We did one VoIP network deployment, and I tried each of the > different QoS services in IOS at that time (about 18 months ago) > both in the lab and in the field, and more bandwidth was the > answer then. Interesting. We have a national VoIP network which handles long-distance calls for the Australian universities. It's not a trial, it's a real VoIP rollout that interconnects the PBXs of the universities. We think that's about 300,000 handsets. More bandwidth doesn't cut it, as the voice calls then fail during DDOS attacks upon the network infrastructure. It's not too hard to fill even a 2.5Gbps link when new web servers come with gigabit interfaces and when GbE campus backbones are being rolled out. If these DDOS attacks use protocols like UDP DNS then traffic shaping the protocol is problematic and the source IP subnet from where the attack is launched needs to be filtered instead. Just finding and filtering a DDOS source can easily take more than five minutes, which pushes the availability to less than 99.999% and leads to legal issues with telecommunications regulators about access to emergency services. We found the Cisco low latency queuing to be adequate. It still has a fair amount of jitter, but not enough to matter for VoIP calls with a diameter of 4,000Km. We do have issues with Cisco's 7500: dCEF is still problematic, but needed for the LLQ feature. The QoS features are too linked to the hardware (you can't configure a service-policy that is enacted on the VIP or main CPU, depending upon the hardware). Despite QoS being most needed on cheap E1/T1 links, they expect you to upgrade to a many thousand dollar VIP4 to support QoS. We police access to QoS by source IP address, mapping non-conforming traffic to DSCP=0. As this requires an access list executed for each packet, the number of VoIP-speaking connecting sites to 50 or so, and requires H.323/SIP proxies at the edge of the sites. We don't use IntServ. When a link is down RSVP takes so long to find an alternative path that the telephone user hangs up. So what we are really waiting for is the implementation of the combined IntServ/DiffServ model so that hosts on member networks can do local authentication and bandwidth reservation and we can police the amount of QoS traffic presented at each edge interface. "Local authentication and bandwidth reservation" also hides a host of issues that are yet to be fully addressed. Most universities don't even *have* an authentication source that covers everyone that can use IP telephony. In practice, even with our deliberately simplistic implementation this whole area is a IOS version nightmare. There's no excuse for a monolithic statically-linked executable in this day and age. Hopefully Juniper's success with monolithic kernel and user-space programs will lead to Cisco looking to leapfrog the competition and adopt the on-the-fly upgradable software modules as described in Active Bridging (1997). Having dissed Cisco, I should point out that their H.323/ISDN gateway software that runs on their RAS boxes (5300, etc) was the most solid of all the manufacturers we tested and Cisco was the vendor most willing to fix the differing interpretations of ISDN we enountered when we connected the North American-developed RAS to our European-developed PABXs (Ericsson MD110, Alcatel, etc). ------------------------- As far as the "engineering staff costs" argument goes, we have found that they the real engineering time goes into hardening the existing infrastructure. When carrying voice every engineering shortcut you have taken comes back to haunt you -- clocking problems, a low percentage of CRCs, ATM links with no OAM, synchronous links with carrier nailed high. Very little of the costs were due to the configuration of the routers. Most of the cost was incurred at the edge of the network, where there is a greater variety of devices, less correct engineering, and worse configuration control. > The trans-Pacific problem is being solved. Give it another > 6-18 months and fibre between US/CA and ANZ or JP or SG should > drop significantly in price. Although the price will drop, it will never drop to the levels of trans-Atlantic prices. Even then, countries like Fiji which have landing points would find it hard to raise the millions required to buy an STM-1 from that landing point. You can make a case that North America is unique. It doesn't have 2,000Km expanses with no population centers. It isn't split off from the remainder of the world by mountain ranges so high that to do an hour's lifting can take a week. It doesn't have a population so huge that training people to lay fiber is in itself a massive undertaking. In these cases, no amount of money will buy you more bandwidth tomorrow and the engineering costs of QoS and TE are immediately worthwhile. VoIP and QoS let you use all of the long-haul optical capacity for IP, whereas the slower growth of the Internet in North America allowed the running parallel Internet and PSTN networks. -- end snip -- 'Time doesn't fool around.' 'without prejudice' U.C.C. 1-207 ======= End of Article ============================================= Comments by Rog. Please discard if you think not appropriate to this list. Cisco 7500, this was a pretty cool box 5 years ago. You all bought lots of them. We acknowledge it is now struggling to keep up, due to all the bandwidth. We'll trade it at favourable rates to help. Current thinking within Cisco is.... 7500 is a 5Gbps box. (really 4 x 1.25Gbps box). 6509/7600OSR is a 256Gbps box. Sufficient horsepower for long and complex ACL lists to counter DDOS attacks (but how do you find and load the source of the attack into the ACL swiftly?) 16 port GE cards means price of GE is slightly below US$1K/port. (7600-OSR appears to me to be 6509 with Optical Service Modules, STM-4, STM-16, GigE blades????? No we don't know why they did this either?) Fiji. The cost of an STM-1 card is about 5-10K. Double it for reliable service. So the millions referred to is really about how the Southern Cross consortium recover their investment dosh. Doing a sweet-heart deal for Fiji, and setting a price that Fiji can afford, sets a very unwelcome precedent for negotiations with other countries. So effectively Fiji misses out, and the country most in need of low-cost communications cannot have it. This is of interest to me as the same economic situation occurs in rural NZ. If rural NZ had widely available, fast communications infrastructure (10mpbs customer access minimum), then the choice of where to run a new-economy business would be much wider. The alternative is building more roads in Auckland. London built the M25 as a possible solution, but it simply created more traffic. Yeah, you have to have both, but comms networks are cheaper to build than road networks. R -- \_ Roger De Salis Cisco Systems NZ Ltd </' +64 25 481 452 L8, ASB Tower, 2 Hunter St /) +64 4 496 9003 Wellington, New Zealand (/ roger(a)desalis.gen.nz rdesalis(a)cisco.com ` 4/4/01. Mike Volpi, Cisco's chief strategy officer, announces four key markets: VOIP, wireless LANs, content networking, streaming media. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Number of AS's and Networks in NZ?
by Craig Whitmore 04 Jun '01

04 Jun '01

Has anyone a list of AS's in New Zealand I should see and the number of Networks associated with each AS? I want to make sure I am going Nationally for every place that is in New Zealand Thanks Craig Whitmore

9 14

Paradise Not Announcing Routes to Telecom?
by Craig Whitmore 04 Jun '01

04 Jun '01

I don't think paradise is announcing all their ranges to Global-gateway/telecom/netgate ... All I can see coming from Paradise's AS via Global-Gateway's AS is.. 202.0.32.0/21 202.0.40.0 202.49.136.0 202.49.137.0 202.50.109.0 203.96.144.0/20 Which means going to a few of there sites takes the long way around This is from 210.55.71.10 (Netgate DSL Ports) [root(a)lennon /root]# traceroute 203.79.66.5 traceroute to 203.79.66.5 (203.79.66.5), 30 hops max, 38 byte packets 1 210-55-71-254.adsl.netgate.net.nz (210.55.71.254) 46.917 ms 45.328 ms 47.723 ms 2 gateway.adsl.netgate.net.nz (192.168.253.1) 42.951 ms 45.873 ms 46.387 ms 3 202.37.247.253 (202.37.247.253) 247.152 ms 293.514 ms 228.592 ms 4 p1-1.akbr2.global-gateway.net.nz (202.50.116.161) 129.325 ms 170.006 ms 162.937 ms 5 202.50.116.170 (202.50.116.170) 168.543 ms 176.873 ms 181.526 ms 6 a4-1-0-3.sybr1.netgate.net.nz (202.50.116.82) 195.767 ms 191.548 ms 195.817 ms 7 connect.sybr1.netgate.net.nz (202.50.116.115) 200.465 ms 216.558 ms 229.336 ms 8 atm0-1-0-27.bdr1.syd.connect.com.au (210.8.219.237) 236.039 ms 233.281 ms 169.433 ms 9 Fddi1-0-0.pad13.Sydney.telstra.net (139.130.32.5) 179.480 ms 184.586 ms 197.406 ms 10 GigabitEthernet4-0.pad-core3.Sydney.telstra.net (139.130.249.240) 197.091 ms 222.966 ms 226.596 ms 11 Pos6-0-0.nzsx-core1.Auckland.net.reach.com (203.50.126.50) 251.709 ms 244.772 ms 259.497 ms 12 FE4-1-0.b2.sxb.akl.tsnz.net (203.98.4.2) 237.052 ms 247.860 ms 192.220 ms 13 bertha.lqy.tsnz.net (203.98.21.29) 219.672 ms 203.286 ms 217.687 ms 14 fe0-0-0.kelly.paradise.net.nz (203.96.152.1) 221.610 ms 243.152 ms 240.241 ms 15 ipnet.ipnet2.paradise.net.nz (203.96.155.157) 259.118 ms 244.233 ms 225.757 ms 16 * * * 17 203-79-66-5.adsl-wns.paradise.net.nz (203.79.66.5) 219.332 ms 220.679 ms 234.058 ms Paradises announced ranges works well ... traceroute to 202.49.136.1 (202.49.136.1), 30 hops max, 38 byte packets 1 210-55-71-254.adsl.netgate.net.nz (210.55.71.254) 48.527 ms 45.405 ms 49.883 ms 2 gateway.adsl.netgate.net.nz (192.168.253.1) 45.382 ms 45.137 ms 47.048 ms 3 a3-0-1.tkcr1.netgate.net.nz (202.50.245.162) 44.982 ms 47.008 ms 45.924 ms 4 paradise.akcr1.netgate.net.nz (202.37.246.74) 57.388 ms 56.106 ms 57.412 ms 5 fe7-0-1.bertha.paradise.net.nz (203.96.152.254) 55.865 ms 55.924 ms 58.631 ms 6 203-96-144-21.cable.paradise.net.nz (203.96.144.21) 67.965 ms * 66.898 ms Thanks Craig Whitmore --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 4

The New Zealand Network Operators' Group
by Donald Neal 03 Jun '01

03 Jun '01

The New Zealand Network Operators' Group The New Zealand Network Operators' Group (NZNOG) has no king, president or formal membership. At present it consists of the subscribers to this mailing list, which anyone is free to join. This list has around 230 subscribers, growing by a handful each month. The NZNOG mailing list is provided through a server at The University of Waikato, and is administered by an employee of Telecom NZ Ltd. Neither of these organisations (nor the administrator) is responsible for its content. NZNOG Mailing List Acceptable Use Policy The NZNOG mailing list exists to provide a forum for the exchange of technical information and the discussion of implementation issues that require cooperation among New Zealand network service providers. In order to continue to provide a useful forum for discussion of relevant technical issues, users of the list are asked to respect the following guidelines. 1. Discussion will focus on Internet operational and technical issues. 2. Discussion related to meetings of network service providers is appropriate. 3. Discussion unrelated to these topics is not appropriate. 4. Postings to multiple mailing lists are discouraged. 5. Postings that include foul language, character assassination, and lack of respect for other participants are unacceptable. 6. Blatant product or service marketing is unacceptable. 7. Postings of a political, philosophical or legal nature are discouraged. 8. Postings to the list should be in ASCII or MIME encoded as text/plain. Attachments should not be sent to the list. To present a document, a suitable URL may be referred to. For documents of general interest, the use of proprietary file formats is discouraged. 9. Breaches of list etiquette should be dealt with privately with the offending list user, and should not result in complaints being sent to the list. Mailing List Archives A full archive is available at http://list.waikato.ac.nz/archives/nznog/ To search the archive, see http://list.waikato.ac.nz/archives/search.html (and remember to select nznog). Subscribing to the List To subscribe to the NZNOG list, send email to majordomo(a)list.waikato.ac.nz, where the body of the message reads subscribe nznog There are at present no restrictions on who may subscribe to the list, or even on who may post to the list. Digest Mailing List If you don't wish to receive postings as they are sent, you can instead subscribe to the nznog-digest mailiing list, on which all postings are sent out in a single "digest" every couple of days. Other Activities NZNOG does not at present have other regular activities than this mailing list. Donald Neal NZNOG Mailing List Owner/Administrator/Muggins --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

(fwd) Re: NOTICE TO ALL (fwd)
by Matt Camp 02 Jun '01

02 Jun '01

Posted to nz.net.admin: -- forwarded message -- I think that this will clear it all up. As the letter was sent to ALL MIS cutomers I will presume that it is not confidential in anyway, if it is I humbly appologise Alan. ######################################################################## The rumour mill is doing overtime, so it is time to make some announcements. 1: Manawatu Internet Services Ltd is closing down. 2: There will be no loss of service for MIS or Flatnet customers. The last 9 years of operation of Manawatu Internet Services Ltd (Dawghaus BBS up until 1994) have been enjoyable and entertaining, however the stress levels associated with operating a small ISP have been taking their toll on my health for the last 2-3 years and it really has become time to move on to different fields. Mercury Telecommunications Ltd have acquired all MIS operations and will take over all DNS hosting, Webhosting and dialup accounts previously handled by Manawatu Internet Services Ltd. I am aware that almost all MIS/MFN customers have been with us for a long time, so I have been at pains to ensure that the best deal has been struck for our customers. For 95% of MIS dialup clients, the transition will be seamless. The exceptions are those people running Windows 3.* or Macintosh machines, as these machines have nameserver settings manually entered and will need to be edited. Please contact me for more details if you feel you will need assistance to change things. There are also 5-10 account names which clash with existing Quicksilver account names so changes may need to be made for checking mail - we're still working out how to resolve this small problem. Noone will have any changes made to their email address. As a great benefit of the changeover, national dialup coverage will again be available and Mercury also offer some very good toll deals. The changeover of dialup access will take place during the coming week and official notice from Mercury Telecommunications will be sent by paper mail to all MIS/MFN clients shortly. If you have any queries, please contact me by email, or by phone. I extend my thanks to all clients for their support over the years and I hope that you will all continue to support your new ISP - they _will_ provide you with continued good service and support. Alan Brown Director, Manawatu Internet Services. -- end of forwarded message -- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

What's up at ORBS
by Andy Linton 31 May '01

31 May '01

Looking at www.orbs.org this morning (as I frequently do (;-)) I see: Due to circumstances beyond our control, the ORBS website is no longer available. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

6 5

FW: BLOCK: ORBS down?
by Juha Saarinen 31 May '01

31 May '01

-----Original Message----- From: Bill Maloy [mailto:Bill.Maloy(a)GOLDINC.COM] Sent: Friday, 1 June 2001 14:12 Subject: Re: BLOCK: ORBS down? > I downloaded the ORBS output_current.txt database on the May 22, 2001. Umm ... Data Size Updated ---------------------------------------------- ---------- ------------ http://homepages.tcp.co.uk/~rjb/in_curr.zip 1346297 2001/05/26 http://www.tlh.com.ar/spambusters/in_curr.zip 1346297 2001/05/26 http://orbsdata.1st.net/inputs.zip 4861634 2001/05/26 http://www.tlh.com.ar/spambusters/inputs.zip 376540 2001/05/27 http://homepages.tcp.co.uk/~rjb/out_curr.zip 1143119 2001/05/26 http://orbsdata.1st.net/out_curr.zip 1143119 2001/05/26 http://orbs.southcot.com/outputs.zip 3681170 2001/05/26 http://homepages.tcp.co.uk/~rjb/manual.zip 69842 2001/05/26 http://www.tlh.com.ar/spambusters/manual.zip 69842 2001/05/26 http://orbs.southcot.com/ok.zip 10806456 2001/03/21 -- Bill Maloy (brm4) And no, akcf1.xtra.co.nz, the right-angle-bracket is NOT part of the URL. "GET /db.orbs.dorkslayers.com.1998.11.30.gz> HTTP/1.0" 404 540 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Asiaonline Peering
by Chris Hellberg 30 May '01

30 May '01

This trace is coming from a netgate-connected PC via DSL to iconz.: odysseus(a)ns1:~$ traceroute www.iconz.co.nz traceroute to www.iconz.co.nz (210.48.1.113), 30 hops max, 38 byte packets 1 gateway (192.168.100.2) 1.214 ms 1.058 ms 1.001 ms 2 172.18.0.37 (172.18.0.37) 18.447 ms 16.481 ms 16.707 ms 3 172.18.4.2 (172.18.4.2) 28.454 ms 18.017 ms 17.485 ms 4 asiaonlinenz.ape.net.nz (192.203.154.44) 18.131 ms 18.229 ms 18.473 ms 5 202.14.100.33 (202.14.100.33) 19.081 ms 18.982 ms 18.945 ms 6 202.14.100.33 (202.14.100.33) 19.144 ms !A * * >From what I can gather there's peering between the two at ape. If reverse name look-ups aren't reliable enough to go to, the number of hops has certainly decreased so I'll go on that. :) Chris --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

8 9

NZ BGP stats
by Joe Abley 30 May '01

30 May '01

I'd like to collect some BGP data from NZ ISPs to see if I can see the same trends in RIB growth, de-aggregation and multi-homing that other people are seeing in other parts of the world. An NZ perspective might be interestingly different because of the history of pervasive peering that is absent from other environments. If possible, I'd like to take as full a BGP feed as possible from as many people as possible. Something like this, in fact: router bgp xxxx neighbor 202.89.128.76 description jabley(a)automagic.org neighbor 202.89.128.76 remote-as 65517 neighbor 202.89.128.76 ebgp-multihop 254 neighbor 202.89.128.76 send-community or perhaps protocols { bgp { group jabley { type external; description "jabley(a)automagic.org"; peer-as 65517; multihop ttl 254; neighbor 202.89.128.76; } } if that suits you better. If anybody thinks they might be happy to send me some data like this for a while, please let me know. Thanks! Joe --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 9

Prefix's
by James Tyson 30 May '01

30 May '01

ip prefix-list attica-networks description contact: noc(a)noc.attica.net.nz ip prefix-list attica-networks permit 202.50.60.0/22 ip prefix-list attica-networks permit 202.50.170.0/24 ip prefix-list attica-networks permit 202.180.64.0/18 ip prefix-list attica-networks permit 210.55.5.0/24 ip prefix-list attica-networks permit 210.55.111.0/24 ip prefix-list attica-networks permit 210.55.157.0/24 ip prefix-list attica-networks permit 210.55.202.0/24 ip prefix-list attica-networks permit 210.55.254.0/24 policy-options { policy-statement attica-networks { term accept { from { # contact: noc(a)noc.attica.net.nz route-filter 202.50.60.0/22 exact; route-filter 202.50.170.0/24 exact; route-filter 202.180.64.0/18 exact; route-filter 210.55.5.0/24 exact; route-filter 210.55.111.0/24 exact; route-filter 210.55.157.0/24 exact; route-filter 210.55.202.0/24 exact; route-filter 210.55.254.0/24 exact; } then accept; } term reject { then reject; } } } Cheers. James Tyson. Self-Deluded Governing Minority, Attica Network Operations. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

New improved prefix list :)
by David Robb 28 May '01

28 May '01

Now with free steak knives! [1] ip prefix-list ihug-networks seq 5 permit 202.36.94.0/23 le 24 ip prefix-list ihug-networks seq 10 permit 202.37.129.0/24 ip prefix-list ihug-networks seq 15 permit 202.37.136.0/24 ip prefix-list ihug-networks seq 20 permit 202.37.182.0/24 ip prefix-list ihug-networks seq 25 permit 202.37.194.0/24 ip prefix-list ihug-networks seq 30 permit 202.49.59.0/24 ip prefix-list ihug-networks seq 35 permit 202.49.88.0/23 le 24 ip prefix-list ihug-networks seq 40 permit 202.49.148.0/23 le 24 ip prefix-list ihug-networks seq 45 permit 202.49.176.0/23 le 24 ip prefix-list ihug-networks seq 50 permit 202.49.180.0/23 le 24 ip prefix-list ihug-networks seq 55 permit 202.49.186.0/24 ip prefix-list ihug-networks seq 60 permit 202.49.240.0/22 le 24 ip prefix-list ihug-networks seq 65 permit 202.49.249.0/24 ip prefix-list ihug-networks seq 70 permit 202.49.252.0/22 le 24 ip prefix-list ihug-networks seq 75 permit 202.50.84.0/24 ip prefix-list ihug-networks seq 80 permit 202.50.103.0/24 ip prefix-list ihug-networks seq 85 permit 202.50.255.0/24 ip prefix-list ihug-networks seq 90 permit 203.109.128.0/17 le 24 ip prefix-list ihug-networks seq 95 permit 203.173.128.0/17 le 24 ip prefix-list ihug-networks seq 100 permit 210.55.184.0/24 ip prefix-list ihug-networks seq 105 permit 210.55.203.0/24 ip prefix-list ihug-networks seq 110 permit 210.55.248.0/21 le 24 As you can see, these allow for variable masks. If anyone requires specific prefixes, let me know and I'll see what I can do. We change them from time to time, and its easier this way. [1] Ok, I was kidding about the steak knives. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

8 11

Search engines
by Jean-Francois Pirus 28 May '01

28 May '01

As anybody noticed any recent excess local search engine traffic. Since saturday we suddenly seem to be 'heavily indexed' by 203.97.86.133 (aka: ASDF Search NZ) and 210.48.127.49 (aka: kupe.searchnz.co.nz). It's quite obvious on our traffic graph between midnight and 6:30 am. One of them is obviously behing a 256K pipe. jfp. ------------------------------------------------------------------------ Jean-Francois Pirus <jfp(a)clearfield.com> Clearfield Software Ltd Phone (+64-9) 358 2081 4th Floor 8-10 Whitaker Place Fax (+64-9) 358 2083 P O Box 2348 Auckland, New Zealand ------------------------------------------------------------------------ --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Telecom "Size Core" Phone lines
by Chris Rigby 28 May '01

28 May '01

I just had to deal with Telecom over a customer of ours who was having trouble getting connected and I was wondering if anyone here had experience with or had heard of the excuse Telecom gave me. The customer in question lives on Wahiki Island and cannot connect to our pool at anything greater than 13200 (if that). After excluding all the usual problems (bad lines, bad modem etc etc) we opened a fault with Telecom who quite happily informed us that the reason it wouldn't connect at a decent speed was that the homeowner was on "Size Core" lines instead of normal phone lines, due to being so remote. When pressed for an explanation the person in question could only tell me that "It was a method for making 8 home lines go over a single normal line". They said they couldn't give me a better explanation and didn't want to hand me to someone who could. And that was pretty much that. Has anyone else had any experience with this sort of technology (or lack of it) and could anyone shed anymore light on the widespereadness of it's use and if it's going to become more so. Chris Rigby Senior Systems Engineer IHUG - Into the Internet --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

7 7

SkillMap(tm) Assessment and Development Guidebooks
by Frontline Learning 27 May '01

27 May '01

How do you help a salesperson improve his or her selling ability if you don't know which SPECIFIC skills, habits or attitudes need to be developed or enhanced? How do you help ANY employee improve productivity unless you focus on developing SPECIFIC new abilities and behaviors? You and I have not met, but because youre a respected business professional with an interest in improving employee productivity, I would like to offer you a free preview of Frontline Learning's new SkillMap(tm) Assessment and Development Guidebooks. These new resources can help you bring added value to your current training initiatives by targeting each employee's individual development needs. This is a truly unique approach to training, and if you're open to learning more, please read on. If this is NOT an area of interest for you, I won't take up any more of your time, and I wish you continued success. Please note - upon receipt of this message you have automatically been removed from our email marketing list. You will not receive further communication from Frontline Learning unless you proactively respond to the message that follows. Kindest regards, David Kirkeby VP, Business Development Frontline Learning MORE ABOUT SKILLMAPS ... SkillMaps are available focusing on Sales, Customer Service, Team Building, Emotional Intelligence and Professional Communication. For example, the Professional Selling SkillMap helps salespeople, sales managers and trainers pinpoint the specific selling skills, habits and attitudes they should focus on for improved performance. It includes an assessment of selling skills in 20 categories, providing a graphical representation of each individuals unique selling strengths and growth opportunities. SkillMaps can be easily integrated into your existing training program or used as a stand-alone training tool for facilitated group training sessions, self-paced individual learning and one-on-one coaching. Based upon extensive research and field validation, each skill assessment measures strengths and growth opportunities in a broad range of skill categories. Upon completion of the Assessment, a Development Guidebook provides helpful tips, methods and strategies focused on each respondents specific development needs. A Facilitation and Coaching Guide provides detailed instructions for administering the Assessment along with fully scripted 1-hour workshops (one for each skill category) including handouts, overhead masters and PowerPoint® presentations. Audio programs are available for each skill category to provide post-training skill reinforcement or enhance the effectiveness of self-paced learning and one-on-one coaching. SkillMaps and other learning resources are available exclusively through our network of Affiliates - you can visit www.frontlinelearning.com for more information on any of our SkillMaps and our Affiliate program. You can request a free preview at: http://www.frontlinelearning.com/contactus1.htm I appreciate the time you've taken to read through this, and again, wish you continued success. Sincerely, David Kirkeby 763-404-9555 Please note - upon receipt of this message you have automatically been removed from our email marketing list. You will not receive further communication from Frontline Learning unless you proactively respond to this message. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Re: MAC Address
by Richard Naylor 24 May '01

24 May '01

Someone wrote > > Someone told me Matt Camp from QSI has access into you rack, is this > > correct? > >No idea :-(. Richard Naylor or Paul Scantlebury at Citylink are the folks >to talk to about physical access, I never need it. Please DO NOT go into the CityLink APE Cabinet. It is now alarmed and monitored. Keys are in AKL but not for the alarm and we can get people up there if required. We try to give some degree of security to APE users and are feeling fairly aggressive towards unauthorised access into our cabinet. The correct process is to contact the CityLink NOC and arrange for us to do the work. Richard richard.naylor(a)citylink.co.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Spot the broadcast storms..
by Simon Lyall 24 May '01

24 May '01

10 23

Netgate peering and weirdness...
by Matt Camp 24 May '01

24 May '01

netgate.ape.net.nz is now live and accepting traffic? Because clear seem to be trying to tell me that i should be sending stuff to it... pity it doesn't even seem to exist. (at least, i can't ping it or anything from my ape gateway) gateway1# sh ip bgp 202.37.240.22 *202.37.240.0/23 Neighbor: 192.203.154.8 ASPath: 4768 4648(IGP) Nexthop: 192.203.154.48 Weight: 0 Localpref: 100 Last update: Thu May 24 12:02:56 2001 bash-2.03# ping netgate.ape.net.nz PING netgate.ape.net.nz (192.203.154.48): 56 data bytes ping: sendto: Host is down ping: sendto: Host is down ^C --- netgate.ape.net.nz ping statistics --- 2 packets transmitted, 0 packets received, 100% packet loss --- Matt Camp --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

9 18

RIPE-181 parser source anyone?
by Chris Wedgwood 23 May '01

23 May '01

Anyone know of a ripe-181 parser (available is source) somewhere that doesn't completely suck[1]. I wrote one last night, but when I was done I decided I didn't like it very much, so alternatives are sought in preference to a rewrite. --cw [1] i.e. fault tolerant and flexible, 3 lines of perl probably doesn't count --- but 5 might :) --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 4

subscribe
by Reg Gentle 23 May '01

23 May '01

--------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Netgate peering and weirdness...
by Matthew G Brown 23 May '01

23 May '01

Just don't crash your router in Chinese cyberspace, They pull it to bits and don't give it back until you say sorry . >"ISOCNZ Member calls for Hacker's Heads On Silver Platter! Chinese >government complies with request!" >JSR Matthew G Brown Wireless Network Specialist Tasman Solutions LTD Http://www.ts.co.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Seeking contact details
by david＠farrar.com 23 May '01

23 May '01

The Hunter Group who are doing the review of DOMAINZ's DRS system are having some problems contacting a few people who commented on it during the rollout period. If anyone here has contact details or knowledge of where people are now it would be great if you can e-mail me with them. William Stuart Hugh McKellar Kerry Topp The name of anyone currently at Asiaonline who deals with the DRS and may want to comment Also Bob Baal's DDI would be great. I have it somewhere but not on me. Ta DPF --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Telecom Peering again :)
by Steve Phillips 23 May '01

23 May '01

After having a rather large and ever increasing number of customers complaining to us about increased traffic bills due to telecoms lack of peering, we have started down the road of "Lets simply block all telecom connected customer IP's at our International Border router" most of our customers so far have been agreeable to this strategy and I am wondering what the effect would be if everyone that peered at APE were to take a similar stance. Anyone think this may prompt telecom to peer if we say "we will allow you to send us national traffic only over agreed peering points yet not internationally" ? Just a thought.. -- Steve. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 5

Re: Telecom Peering again :)
by Jamie Baddeley 22 May '01

22 May '01

Hi All, Noting the discussions regarding peering lately, may I suggest that the following info is of value: http://www.cisco.com/warp/public/759/ipj_2-1/ipj_2-1_ps1.html and http://www.cisco.com/warp/public/759/ipj_2-2/ipj_2-2_ps1.html Happy Reading! jb (Who has Finally Stopped Lurking) --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Attica Prefix List update
by James Tyson 22 May '01

22 May '01

Hi all. Attica's got new networks to advertise: ip prefix-list attica-networks description Attica Communications Ltd, contact: noc(a)noc.attica.net.nz ip prefix-list attica-networks seq 5 permit 202.180.96.0/19 ip prefix-list attica-networks seq 10 permit 202.180.64.0/18 le 19 ip prefix-list attica-networks seq 15 permit 210.55.254.0/24 ip prefix-list attica-networks seq 20 permit 210.55.5.0/24 ip prefix-list attica-networks seq 25 permit 202.50.170.0/24 ip prefix-list attica-networks seq 30 permit 210.55.111.0/24 ip prefix-list attica-networks seq 35 permit 202.50.60.0/22 Cheers. James Tyson. Self-Deluded Governing Minority, Attica Network Operations. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: SPAM & OFF TOPIC BLATHERING
by Donald Neal 18 May '01

18 May '01

-- Donald Neal Mobility & Calling Platforms Network Delivery Telecom New Zealand Ltd >>> "Simon Lyall" <simon.lyall(a)ihug.co.nz> 05/18/01 01:49 >>> [...] >I was going to do a count of the number of posts to the list each month >this year so far but it appears the web archive is broken (only about the >first 30 articles for each month are kept). [...] Try the link that says "Next Page". :{)* By the use of advanced deci-digital counting methods, I get something like: January: Postings 60, Busiest Day 16 February: Postings 101, Busiest Day 24 March: Postings 133, Busiest Day 30 April: Postings 91, Busiest Day 35 May to yesterday (i.e .last sixteen days): Postings 134, Busiest Day 30 We've gone from an average of roughly three to four postings per day up till 7th May to 113 postings in the nine days starting 8th May. Those 113 postings appear to come from 31 different people. The most frequent posters were: Chris Wedgwood, Juha Saarinen: 12 Dean Pemberton: 8 Joe Abley, Simon Blake: 7 Simon Lyall: 6 Andy Gardner, Craig Whitmire: 5 That's a respectable number of people posting, but half of all messages from eight people and a quarter from three people. This may be a strong argument for another mailing list. Maybe not a very big one? On the other hand, there are 224 addresses on the nznog list, and all of three on nznog-digest. And I'm only on the latter to make sure it's working. If over 99% of subscribers choose not to take digests, maybe they're all happy. - Donald Neal --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

RE: SPAM & OFF TOPIC BLATHERING
by Donald Neal 17 May '01

17 May '01

-- Donald Neal Mobility & Calling Platforms Network Delivery Telecom New Zealand Ltd >>> "Simon Lyall" <simon.lyall(a)ihug.co.nz> 05/18/01 01:49 >>> On Fri, 18 May 2001, Philip Beckmann wrote: > you missed one: > > isp flaming This is actually quite a useful exercise sometimes. Considering the number of people on the list (200 last time I looked) and their positions an ISP will usually at least look at publicly made complaints. Although I don't the majority of complaints tend to cast the complainer in a worse light than the complainee. I was going to do a count of the number of posts to the list each month this year so far but it appears the web archive is broken (only about the first 30 articles for each month are kept). I doubt email to this list makes up more than 10% of the mail for anyone on it. -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

SPAM & OFF TOPIC BLATHERING
by Chris Wedgwood 17 May '01

17 May '01

OK, this list is not getting full of noise and lots of off-topic messages... which is sure to upsets lots of people (like me on a bad day, except I'm as much to blame as anyone at present!). Is there any interest in creating another more informal list for these purposes, something as an alternative to what Usenet was once used for before many of us here gave up on it. Suitable ideas for the list might be: -- vendor flaming -- telco flaming -- domainz flaming -- OS flaming -- extreme levels of buffoonery -- 'classifieds' for hardware and jobs sort of thing. Comments? --cw -- Chris Wedgwood chris.wedgwood(a)clear.co.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

9 9

RE: SPAM & OFF TOPIC BLATHERING
by hkraemer＠prismac.co.nz 17 May '01

17 May '01

Is that Gau_leiter or Gaul_Eiter (...sorry couldn't resist) -----Original Message----- From: Juha Saarinen [mailto:juha(a)saarinen.org] Sent: Friday, 18 May 2001 13:56 To: Peter Mott Cc: nznog(a)list.waikato.ac.nz Subject: RE: SPAM & OFF TOPIC BLATHERING On Fri, 18 May 2001, Peter Mott wrote: > I can donate nznog-discuss(a)2day.com as long as somebody else wants to be the > list admin (not that it needs much!) What are you using? Mailman I hope? Just finished setting up a list server for IDG, so I could volunteer to be the list-Gauleiter... -- Regards, Juha PGP fingerprint: B7E1 CC52 5FCA 9756 B502 10C8 4CD8 B066 12F3 9544 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

TelstraSaturn subscriber with Autospammer^H^H^H^H^H^H^Hresponder set to NZNOG
by Juha Saarinen 17 May '01

17 May '01

Could someone at TSNZ kindly turn off Suzanne Wecke's autoresponder? Also, having a postmaster(a)telstrasaturn.co.nz account might be a good idea: The message that you sent was undeliverable to the following: postmaster(a)[172.20.18.38] (user not found) Possibly truncated original message follows: -- Juha The malformed orange Fails to satisfy the eye: Segmentation fault. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: Fun with IOS
by Lindsay Druett 17 May '01

17 May '01

Yeah...Righto Rog...!!! In peak hour traffic too... Why not !!?? > Anyone know of any magical IOS commands to kill -9 a process? :) Someone's > managed to crash a couple of sessions on a router here while they're > holding a lock on the nvram. Ahh. You want the "reload" command. However you may find that the "reload" feature is unavailable in your current version of IOS as it is a restricted feature set. Please upgrade to 12.2(1)XD. Cheers. James Tyson --- Samizdat New Media Solutions --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

12 28

Telecom Peering - Query
by Steve Phillips 16 May '01

16 May '01

Hiya, After bailing our Telecom account manager up about the latest excuse as to why Telecom are not willing to peer, it came back that the Tax Dept are claiming that the people peering at APE are committing tax fraud due to the traffic traveling across the APE link having a real dollar value associated with it. Telecom claim that the Tax Dept have contacted everyone about this issue and that we should all be paying each other for the privilege of peering in order to recover the costs associated with traffic across APE. Then each of us should be paying GST on the traffic to/from each of our peers. Can anyone out there verify this latest myth ? :-) We are apparently going to get an answer to this latest problem within the next 90 min's, I wonder what the next excuse will be.. To date (since I took over from Tony on the "beatup the account manager about peering" a few weeks ago) I have had: * There are legal issues * There is a contract you need to sign which we cant show you as Telstra and Clear said it was rubbish * We have the connectivity up there but are not allowed to use it yet (ironically this was a few hours after the post showing the interface traffic stats) * We are considering dropping the domestic service offering as it's not viable * The tax dept wont allow us (or anyone else) to peer as they require us to pay GST on the traffic I must say, if nothing else its entertaining watching the excuses.. -- Steve. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

14 21

RE: Fun with IOS
by Lindsay Druett 15 May '01

15 May '01

:: Seriously, the only reason anyone would want this slow crap is that it's :: all the telcos want to provide because they've got this huge legacy :: investment in that technology and most of the people working in them have :: their heads too far up their asses. Remember when ISDN stood for :: Incredibly Slow Dumb Networking - that label now applies to this. Hey come on, Legacy is good.... as long as it comes on four wheels, powered by a boxer motor which powers all four wheels.... --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Fun with IOS
by David Robb 15 May '01

15 May '01

Anyone know of any magical IOS commands to kill -9 a process? :) Someone's managed to crash a couple of sessions on a router here while they're holding a lock on the nvram. David Robb --- Senior Network Engineer IHUG NZ "The Earth is a single point of failure" --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 7

RE: Fun with IOS
by Lindsay Druett 15 May '01

15 May '01

I almost forgot, the only IOS restriction on the "reload" command is enable access. I might add that this is for a for a very good reason too. Yeah...Righto Rog...!!! In peak hour traffic too... Why not !!?? > Anyone know of any magical IOS commands to kill -9 a process? :) Someone's > managed to crash a couple of sessions on a router here while they're > holding a lock on the nvram. Ahh. You want the "reload" command. However you may find that the "reload" feature is unavailable in your current version of IOS as it is a restricted feature set. Please upgrade to 12.2(1)XD. Cheers. James Tyson --- Samizdat New Media Solutions --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: NNTP Access for APE connected machines.
by Ted Grenfell 13 May '01

13 May '01

At 11:07 14/05/2001, James Tyson wrote: >That's a fairly fine line your walking there. Careful you dont trip. Okay Mum. -- Ted Grenfell Xtra ISP Performance Manager Mob 025 435 455; DDI 09 359 5854; Fax 09 362 8100 Level 13, Telecom Tower, 16 Kingston St, Private Bag 92028, Auckland --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

NNTP Access for APE connected machines.
by Mark Derricutt 13 May '01

13 May '01

Hi, I was wondering if any APE connected ISPs allow read/write NNTP access to other APE connected machines? Our connection here at work goes via Zivo, and I'm wanting to connect to a news server that carries comp.* and nz.*. Apologies if this is offtopic, but I thought this would be the best place to ask about such access. Mark --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

11 23

Re: Update to DNS question
by Andy Gardner 11 May '01

11 May '01

Just to lower the S/N ratio even further, I am pleased to announce that enigma.cypher.co.nz is now registered for NS use at OpenSRS/Tucows. -- Andrew P. Gardner barcelona.com stolen, stmoritz.com stays. What's uniform about the UDRP? We could ask ICANN to send WIPO a clue, but do they have any to spare? Get active: http://www.domain-owners.org http://www.tldlobby.com --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Update to DNS question
by Gavin 11 May '01

11 May '01

Hi, Thanks to all those who responded to my DNS problem -- 2 weeks of dicking about, and finally some clear answers. For those who asked the details are: NZ domain: cypher.co.nz NS: enigma.cypher.co.nz IP: 202.37.176.1 .COM domain: cypher-international.com, and cypherinternational.com I simply want to point both of these back here. They are held by domains.com, also called dns4less.com, also called tucows.com, and I cannot pry our name off them for 60 days. The issue is more that they WONT add A record(s) until the nameservers are registered with the internic, and while I am aware that other US registrars (such as Network Solutions) can do this -- they can't/wont -- the nameservers have to be registered first. After 60 days I can pry our domain name off them and transfer it to someone useful, but for now..... This is what happens when over enthusiastic co-workers decide to establish a international presence without looking first...... Sigh. PS:- I am not a DNS expert -- I can only just swim in this end of the pool. -- Regards, Gavin Melville, gavin(a)cypher.co.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

6 6

OT - sort of
by Richard Naylor 10 May '01

10 May '01

Since its Friday, here is a little snippet relayed on from another list....and to confirm rumours - I do have a GbE network at home. Actually there are 3 GbE - me and my machines 100Mbps - the family 10mbps - Jeremy (who gets punished for doing 5GB of DSL traffic to Napster) + the neighbours http://www.iec.org/tutorials/opt_ethernet/images/figure05.jpg and just so you know how REAL this is, the 10Gig crew are starting forming the 100Gig group...... richard.naylor(a)citylink.co.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 4

Maybe this is off-topic... maybe not...
by Juha Saarinen 10 May '01

10 May '01

... but are there problems with Asia Online again? Can't get to the Hirrold's site: # traceroute 203.99.65.227 traceroute to 203.99.65.227 (203.99.65.227), 30 hops max, 38 byte packets 1 router (192.168.1.254) 2.750 ms 1.192 ms 1.507 ms 2 203-79-82-254.adsl-wns.paradise.net.nz (203.79.82.254) 18.281 ms 14.204 ms 16.725 ms 3 192.168.253.225 (192.168.253.225) 16.452 ms 18.624 ms 19.962 ms 4 kelly.ipnet2.paradise.net.nz (203.96.155.158) 21.254 ms 19.058 ms 20.029 ms 5 fe7-0-1.bertha.paradise.net.nz (203.96.152.254) 19.570 ms 17.970 ms 19.780 ms 6 iconz1.wix.net.nz (202.7.1.1) 23.588 ms 22.142 ms 23.435 ms 7 f0-0.core1.wn.nz.asiaonline.net (210.48.3.244) 23.251 ms 21.369 ms 19.085 ms 8 f2-0.core2.ak.nz.asiaonline.net (210.48.12.1) 35.686 ms 34.319 ms 31.018 ms 9 f0-0.core3.ak.nz.asiaonline.net (202.14.100.220) 37.003 ms 64.375 ms 40.895 ms 10 * * * 11 * * * 12 * * * 13 * * f0-0.core3.ak.nz.asiaonline.net (202.14.100.220) 38.050 ms !X 14 * * * 15 * And my ssh sessions with IDG freeze and die. Some hosts (on Clear and Above.net) have no problems reaching AOL, but others (Paradise, TSNZ) can't get to AOL. -- Juha The malformed orange Fails to satisfy the eye: Segmentation fault. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Complex DNS problem
by Ewen McNeill 09 May '01

09 May '01

In message <3AFAC212.31837.13D86B0(a)localhost>, "Gavin" writes: >We now have a .com name and wish to redirect accesses to this domain name >back to our .nz address, and to do this we have to register our nameserver(s) >with the Internic. NSI used to have forms for doing this (registering the nameservers names against a particular IP address), which you could download and submit. IIRC there was no chargge. But it did take a week or two to process. Once done you can use your .co.nz (etc) nameserver names that you've registered in your .com zone files, delegation recorsd, etc. If you don't want to wait that long, the quick hack (which I've used before) is smiply to add some extra A records into your .com zone for the nameservers (ns1.example.com, ns2.example.com pointing at the correct IP addresses), and then register the .com zone with those nameservers as the ones for the delegation. At least the NSI system, and maybe others, can then insert the necessary glue records when you do it that way. But it does mean you have two names for your nameservers. Ewen --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Complex DNS problem
by Gavin 09 May '01

09 May '01

Hi, I am not sure if this is the right place to ask this, but domainz have not been able to help and suggested this list. We are a ChCh company with our own class C address, and as we were active on the net long before there were registrars or agents we do not have one -- I presume we are in effect our own registrar for the .nz namespace. We now have a .com name and wish to redirect accesses to this domain name back to our .nz address, and to do this we have to register our nameserver(s) with the Internic. The US registrar for our .com address cannot do this for us -- they say our registrar must do this for us -- but we don't have one. Domainz cannot do this either. I didn't choose the US registrar, and the particular registrar that was chosen for me in the US cannot register ccTLD's -- is this the root of the problem ?. Is anyone able to point me in the right direction ? TIA, -- Regards, Gavin Melville, gavin(a)cypher.co.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

What the NZ Internet looks like
by Juha Saarinen 08 May '01

08 May '01

http://www.cs.bell-labs.com/who/ches/map/gallery/tld/nz.gif I think I'm there, just below uummm.... you know, that other node. -- Juha The malformed orange Fails to satisfy the eye: Segmentation fault. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

7 13

Unknown IP's on APE
by Simon Blake 07 May '01

07 May '01

Hi Folks would the entities using 192.203.154.10 192.203.154.30 please get in contact with me, so that I can complete my population of the APE DNS. Cheers Si --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: Asia On-line not?
by Richard Parry 07 May '01

07 May '01

-----BEGIN PGP SIGNED MESSAGE----- Hey Phillip; > As one of Asia On Lines upstreams, I would like to make it clear > that TelstraSaturn do not have any current issues within our > network. Interesting. Personally I don't mind either way, just relating what we've been told. The latest is that they believe it's a possible attack on their network of some kind, but this is markedly different information than what's been flowing through until earlier today. As an aside, do you count Wellington's cable modem network as a part of your network? :) > I would suggest that AONZ themselves are probably best placed > to comment on any > problems they may be experiencing. Absolutely, however in an instance where someone (Peter) can't get to their network, it may be unlikely that they can effectively respond. Just trying to help. Richard - -- Richard Parry richard.parry(a)optimation.co.nz Phone: +64 4 470 5814 x 848 Optimation New Zealand Limited Pager: richardp.pager(a)optimation.co.nz Fax: +64 4 472 7219 PGP Fingerprint: 603F ECBD B38B 09F8 9601 F438 6131 D23F -----BEGIN PGP SIGNATURE----- Version: PGP 7.0 iQEVAwUBOvdW8vVxtQ5VlW2tAQHmZQf/WTMzdLIEddx1jKDfQAbE5ek4h2KEw34T 4dZWnnvEBHW4eD6x/eDBzfkONYoo9wseLHeb229vNxpXprQmQbn14Z6sdEcqlAID BozXGgGfSD5sv+bGW+YEEKrc/ZIH0EJOfA5sFvKVNwkvvLzvhuFxpwJSppTCB08Q JlawalZ5HqkOPJeIDfGnOo+J2Z+9AZXHegWVs5GPcK+1AP+KQtW/TnE8ZWGwVDH3 Jk7aYUmAtCx/lGv42UgZJZ13IdhgkjLrrcibJFsJDr1VfztugWRNaVB3XzIPLgDv o4qsDfvJ0fl40gLkwsAYvzh9TRQ6cHDQstLw00tUXysTq2JngI0kWg== =6uRe -----END PGP SIGNATURE----- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Asia On-line not?
by Richard Parry 07 May '01

07 May '01

-----BEGIN PGP SIGNED MESSAGE----- Hi Peter; We're an AOL (ho ho) customer, and have been experiencing problems of various nature over the past few days. I understand that mostly, it is related to their upstream provider, and a lot of problems may have had to do with their caching engine. Probably the best bet is to contact them with your concerns. We're having some intermittent DNS issues, but mostly it's to do with ftp and http (http over ssl, and other services like email, mostly work 100%). Kind regards Richard Parry - -- Richard Parry richard.parry(a)optimation.co.nz Phone: +64 4 470 5814 x 848 Optimation New Zealand Limited Pager: richardp.pager(a)optimation.co.nz Fax: +64 4 472 7219 PGP Fingerprint: 603F ECBD B38B 09F8 9601 F438 6131 D23F > -----Original Message----- > From: Peter Mott [mailto:peter.mott(a)2day.com] > Sent: Tuesday, 8 May 2001 8:59 a.m. > To: nznog(a)list.waikato.ac.nz > Subject: Asia On-line not? > > > Does anybody here have any routing problems to iconz at this time? > > We dont appear to be seeing ns1.iconz.co.nz which may be > needed to resolve > names to numbers from time to time > > <cant get www.idg.net.nz daily fix!> > > Peter Mott > Chief Enthusiast > 2day.com > -/- > > --------- > To unsubscribe from nznog, send email to > majordomo(a)list.waikato.ac.nz where the body of your message reads: > unsubscribe nznog > -----BEGIN PGP SIGNATURE----- Version: PGP 7.0 iQEVAwUBOvcjTvVxtQ5VlW2tAQHoRgf/TIgiHRcZrB0RE+mTeK9Cec3H+uVt9zT2 NaazytIVysuajt6A25rl5ngA/qbcnl9Eh8Ev0iLDvnsW3KUj7LZsSliWRZWccb3r LMJD0a37L0sEpQlOm4+eqMZVviN0HXPD6iVVEuJfPzb+iD44idwgcL84GtE6Mvyu cKOaEnVU90Ntk/BbbnX7QKV0Qf+DGIvocoiBUJn1qEHkFk4PgCCBNJgxZoBhhZR0 K0/nyQBHgqf8+wDWMfWIfu2/IOsUUswG/JbO/7KKvANhhVpPra9yVv4NwjoRSObO 6X8Jlhr+SFKajrOa+RNmVPgJSxGnqW7beAksAuJmLy2HJ4fFOi6Bsg== =OHax -----END PGP SIGNATURE----- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

YOUR GROUND FLOOR BLAST TO 7 FIGURES B/4 CHRISTMAS!
by Reginald Tchume 07 May '01

07 May '01

=============== VERY EXCLUSIVE! =============== http://cybh.com Your exclusive invitation to earn seven figures b/4 Christmas is our urgent announcement, if you can use the money! This is NEW .. . . and GROUND FLOOR! A simple, systematic use of leverage to generate large incomes from multiple businesses is your tool at http://cybh.com This full automation on 24/7 autopilots allows you to work one hour a day referring customers and earn up to six figures monthly with the CybH. It's totally risk-free! And for a meager $39.95 of a one time start-up cost, you should blast pass every obstacle to secure your position now! Get your CybH now at http://CybH.com You can start making money with it right away. Thank you greatly! Your CybH team http://cybH.com --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

Outage at APE Monday 7 May 2001
by Richard Naylor 06 May '01

06 May '01

Switch Outage at APE - Monday 7 May 2001. There MAY be a small outage of the APE core switch on Monday morning, 7 May, while the switch is replaced with one of larger capacity. We expect this to be at around 10am. The replacement will be done live so the visible outage will be only the time the switch takes to notice that MAC addresses have shifted ports. There will be other work done in the APE facility at the same time, including the addition of several new connections and at least one upgrade. Any business hours questions should be via 04-917-0200, after hours via 04-385-9003 or I can be contacted on 021 897 089. Of course email works and I will check it over the week end. On a different subject, I am close to installing an ATM interface on the APE switch. I am interested in the level of interest in the network community for users to connect to APE (or WIX) via the various ATM networks. Anyone interested in ATM access to APE or WIX, please let me know ASAP. It won't happen on Monday, but as soon as I can lay my hands on some cards. Richard richard.naylor(a)citylink.co.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 1

APE switching -- L2 topology
by Chris Wedgwood 05 May '01

05 May '01

Can people with APE connectivity (privately, off the list) give me some idea of what kind of connectivity they have, whether it is a switch belonging to CLEAR, Citylink or whatever if they don't mind? I'd like to produce some kind of L2 'map' of the topology up there and also wonder if we are at the point were spanning tree might rears it ugly head. Thanks, --cw --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Apologies
by Frank Tyson 05 May '01

05 May '01

I apologies concerning my query on Proxy Servers I've had a couple of people email me privately suggesting it was off topic For me it was a question more about the Operational or Technical aspects of why some ISP's disallow access this way ___ [| |=|{)__ |___| \/ ) /|\ /| / | \ | \ For all your Web Design and Photography Frank Tyson Stokes Valley New Zealand Mobile 021 134 1826 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Issues regarding Access through Proxy Servers to clients homepages via FTP
by Frank Tyson 04 May '01

04 May '01

I understand various providers restrict access to their clients homepages via FTP e.g Slingshot doesnt allow you to access your pages through a proxy server at Polytechnic or University This is a pain in the proverbial A**se because the course Im completing is Cybertech/E Commerce /Web Design and as part of my project I am required to create and maintain my own site Sure its fine when this can be done from home but in some cases I need to be able to do this from class An example would be creating the site at home then zipping it up uploading the zip to my homepages, extracting it at polytech to work on a particular section then loading the completed site back to my provider Currently the only way to load it is by having 2 email addresses and transfering stuff between them unless anyone has a different idea Ok you may suggest using an outfit like Tripod etc but I dont want my project cluttered with thier adverts popups etc When one looks at some of the public domain sites they have the faciality for transfering stuff via FTP built into the site rather than having to run a seperate program Maybe its something that could be looked at hear with NZ ISP's If one of you is running a server which allows access via FTP through Proxy Servers and of course rates and conditions are reasonable let me know I may have to consider switching providers who knows lol ___ [| |=|{)__ |___| \/ ) /|\ /| / | \ | \ For all your Web Design and Photography Frank Tyson Stokes Valley New Zealand Mobile 021 134 1826 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 3

��Flying Shose!!��Flying Shose!!
by t169668736＠yahoo.com 03 May '01

03 May '01

1 0

RE: Connection to APE
by Brett Telfer 01 May '01

01 May '01

We can provide you an alternative BB solution, as we also have close relationships with a number of ISP's, and have a presence at the APE. Without getting into a sales pitch, we may also be able to offer you some local benefits as well :-) Contact me off-line if you're interested. Regards Brett Telfer Development Project Manager WALKER WIRELESS LIMITED Tel: +64 (9) 522 3699 Fax: +64 (21) 559 833 Mobile: +64 (21) 434 600 0800 NO NETLAG --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Connection to APE
by Seeby Woodhouse - Orcon 01 May '01

01 May '01

Hi there People We (Orcon Internet) have been considering a connection to APE for quite some time, and it is becoming more and more important for us to get this set up. The reason is that our Global Gateway domestic connection does not connect satisfactorily to a number of NZ ISP's (e.g. Asia Online), and this is important to us because otherwise we have to pay International rates to connect to them. Additionally, we have 30 NZ ISP's that sit behind our network and some of them have been expressing a desire for us to have a connection at APE as well. Because of the amount of traffic that we foward domestically, I don't think that a 2Mbit connection will surfice - so we will probably have to put in a 10Mbit link. Obviously a 10Mbit link needs to be carried over ATM or IPExpress. we don't want to use IPExpress to connect to the sky tower as I am concerned that if the quality of the service gets bad (packet loss / latency - Clear make no QoS guarantees on IPExpress), then BGP is not going to fall over to our Global Gateway Domestic - even if that is faster. So our only other option is to use ATM. However, Telecom tell us that if we want to purchase a 10Mbit PVC up the sky tower, then we need to have an ATM to terminate it on (which is going to cost us $4k for the ATM + The PVC charge + An ATM router + telehousing - which is expensive!) Clear offer a service where if you purchase a Frame Relay, IPExpress or ATM, then you can get a connection to APE for free (they just terminate it up the sky tower on their own equipment I guess) - but Telecom does not seem to do this. Anyone know how we can get a 10Mbit connection to APE via our Telecom ATM without having to pay for all the associated access fees at the sky tower end? Cheers Seeby Orcon Internet - www.orcon.net.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

The New Zealand Network Operators' Group
by Donald Neal 30 Apr '01

30 Apr '01

The New Zealand Network Operators' Group The New Zealand Network Operators' Group (NZNOG) has no king, president or formal membership. At present it consists of the subscribers to this mailing list, which anyone is free to join. This list has around 220 subscribers, growing by a handful each month. The NZNOG mailing list is provided through a server at The University of Waikato, and is administered by an employee of Telecom NZ Ltd. Neither of these organisations (nor the administrator) is responsible for its content. NZNOG Mailing List Acceptable Use Policy The NZNOG mailing list exists to provide a forum for the exchange of technical information and the discussion of implementation issues that require cooperation among New Zealand network service providers. In order to continue to provide a useful forum for discussion of relevant technical issues, users of the list are asked to respect the following guidelines. 1. Discussion will focus on Internet operational and technical issues. 2. Discussion related to meetings of network service providers is appropriate. 3. Discussion unrelated to these topics is not appropriate. 4. Postings to multiple mailing lists are discouraged. 5. Postings that include foul language, character assassination, and lack of respect for other participants are unacceptable. 6. Blatant product or service marketing is unacceptable. 7. Postings of a political, philosophical or legal nature are discouraged. 8. Postings to the list should be in ASCII or MIME encoded as text/plain. Attachments should not be sent to the list. To present a document, a suitable URL may be referred to. For documents of general interest, the use of proprietary file formats is discouraged. 9. Breaches of list etiquette should be dealt with privately with the offending list user, and should not result in complaints being sent to the list. Some discussion is taking place on the list at present regarding the acceptability of postings advertising for sale second-hand networking equipment. Mailing List Archives A full archive is available at http://list.waikato.ac.nz/archives/nznog/ To search the archive, see http://list.waikato.ac.nz/archives/search.html (and remember to select nznog). Subscribing to the List To subscribe to the NZNOG list, send email to majordomo(a)list.waikato.ac.nz, where the body of the message reads subscribe nznog There are at present no restrictions on who may subscribe to the list, or even on who may post to the list. Digest Mailing List If you don't wish to receive postings as they are sent, you can instead subscribe to the nznog-digest mailiing list, on which all postings are sent out in a single "digest" every couple of days. Other Activities NZNOG does not at present have other regular activities than this mailing list. Donald Neal NZNOG Mailing List Owner/Administrator/Muggins --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Off topic.... but .......
by Roger De Salis 29 Apr '01

29 Apr '01

April 27, 2001 Sony to release Linux for PS2 By STEPHEN SHANKLAND, CNET NEWS.COM Linux fans who want to run their favorite operating system on the Sony PlayStation 2 game console apparently will get what they've been hoping for. On Friday, Sony posted information on the Beta Release 1 of its PlayStation 2 Linux Kit, including a press release on its Japanese site that puts its price tag at 25,000 yen, or about $200. The kit includes a DVD with software, 40GB hard drive, keyboard and mouse. The beta, or test, version will be available in June. More than 6,000 people signed a petition earlier this year to encourage Sony to work on the project. The PlayStation 2 is powered by a MIPS chip. One of the benefits of Linux is that it's comparatively easy to get it working on different CPUs. Sony selected Linux to help game developers simulate the PlayStation 2 so they could get a jump on creating games before the actual hardware was available. Running Linux on the game console itself, though, is a different matter entirely. Rumors of the possibility have been circulating on Slashdot, a news and discussion site popular with Linux fans. The programming blueprints, or source code, for the kernel--the heart of Linux--is included on the DVD, Sony said. But the source code for a proprietary "runtime environment" that lets games play on the system is not. -- \_ Roger De Salis Cisco Systems NZ Ltd </' +64 25 481 452 L8, ASB Tower, 2 Hunter St /) +64 4 496 9003 Wellington, New Zealand (/ roger(a)desalis.gen.nz rdesalis(a)cisco.com ` 4/4/01. Mike Volpi, Cisco's chief strategy officer, announces four key markets: VOIP, wireless LANs, content networking, streaming media. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Buy & Sale of used network equipment
by Bart Kindt 26 Apr '01

26 Apr '01

I often feel the need to either put up for sale network related equipment, or parts thereof, or ask for certain gear. For example, routers, Max boxes, Cisco routers cards (we have some which we don't use anymore, and others we may need), etc. The nznog list is not to be used for 'commercial' purposes... But it is silly if the NZ network managers could all benefit of trading used equipment, but we cannot use this mailing list for it. So, I would like to suggest that either this list is ammended to allow 'trading' of used network related equipment, or that we set up a separate list for this purpose. Comments? Bart Bart Kindt Director, Network Operations The Internet Group Limited New Zealand --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

7 8

Max 4000 Power Supplies
by Matt Camp 25 Apr '01

25 Apr '01

Anyone know where to source some reasonably cheap Max 4000 Power Supplies? Or a good place to get some fixed? I've got a bunch here all with the same transformer-sans-MagicSmoke. --- Matt Camp --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

RE: Buy & Sale of used network equipment
by Lindsay Druett 25 Apr '01

25 Apr '01

Flyin Shose! Flyin Shose! How much ? --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Max 4000 Power Supplies
by Bart Kindt 25 Apr '01

25 Apr '01

At 09:30 26/04/01 +1200, Matt Camp wrote: > >Anyone know where to source some reasonably cheap Max 4000 Power Supplies? > >Or a good place to get some fixed? I've got a bunch here all with the same >transformer-sans-MagicSmoke. We have some max4000-V34 for sale, $2000 a piece. Could be your solution ?? Bart Bart Kindt Director, Network Operations The Internet Group Limited New Zealand --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

How to make $500,000+ with $25
by nshasy＠sinaman.com 25 Apr '01

25 Apr '01

Dear Friends & Future Millionaires: AS SEEN ON NATIONAL TV: Making over half million dollars every 4 to 5 months from your home for an investment of only $25. Dollars expense one time. THANKS TO THE COMPUTER AGE AND THE INTERNET ! -------------------------------------------------------------------------------- BE A MILLIONAIRE LIKE THESE OTHERS WITHIN A YEAR!!! Before you say ''Bull'', please read the following. This is the letter you have been hearing about on the news lately. Due to the popularity of this letter on the Internet, a national weekly news program recently devoted an entire show to the investigation of this program described below, to see if it really can make people money. The show also investigated whether or not the program was legal. Their findings proved once and for all that there are ''absolutely NO Laws prohibiting the participation in the program and if people can -follow the simple instructions, they are sound to make some mega bucks with only $25 out of pocket cost''. DUE TO THE RECENT INCREASE OF POPULARITY & RESPECT THIS PROGRAM HAS ATTAINED, IT IS CURRENTLY WORKING BETTER THAN EVER. This is what one had to say: '' Thanks to this profitable opportunity. I was approached many times before but each time I passed on it. I am so glad I finally joined just to see what one could expect in return for the minimal effort and money required. To my astonishment, I received total $ 610,470. 00 in 21 weeks, with money still coming in''. Pam Hedland. Fort Lee, New Jersey. -------------------------------------------------------------------------------- Here is another testimonial: ''' this program has been around for a long time but I never believed in it. But one day when I received this again in the mail I decided to gamble my $25 on it. I followed the simple instructions and walaa ..... 3 weeks later the money started to come in. First month I only made $240.00 but the next 2 months after that I made a total of $290,000.00. So far, in the past 8 months by re-entering the program, I have made over $710,000.00 and I am playing it again. The key to success in this program is to follow the simple steps and NOT change anything.'' More testimonials later but first, %% PRINT THIS NOW FOR YOUR FUTURE REFERENCE $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ If you would like to make at least $500,000 every 4 to 5 months easily and comfortably, please read the following...THEN READ IT AGAIN and AGAIN !! $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ FOLLOW THE SIMPLE INSTRUCTION BELOW AND YOUR FINANCIAL DREAMS WILL COME TRUE, GUARANTEED! INSTRUCTIONS: =====Please order all 5 reports as shown on the list below ===== For each report, send $5 CASH, THE NAME & NUMBER OF THE REPORT YOU ARE ORDERING and YOUR E-MAIL ADDRESS to the person whose name appears ON THAT LIST next to the report. MAKE SURE YOUR RETURN ADDRESS IS ON YOUR ENVELOPE TOP LEFT CORNER in case of any mail problems. When you place your order, make sure you order each of the 5 reports. You will need all 5 reports so that you can save them on your computer and resell them. YOUR TOTAL COST $5 X 5=$25.00. Within a few days you will receive, vie email, each of the 5 reports from these 5 different individuals. Save them on your computer so they will be accessible for you to send to the 1,000's of people who will order them from you. Also make a floppy of these reports and keep it on your desk in case something happen to your computer. IMPORTANT - DO NOT alter the names of the people who are listed next to each report, or their sequence on the list, in any way other than what is instructed below in step '' 1 through 6 '' or you will loose out on majority of your profits. Once you understand the way this works, you will also see how it does not work if you change it. Remember, this method has been tested, and if you alter, it will NOT work !!! People have tried to put their friends/relatives names on all five thinking they could get all the money. But it does not work this way. Believe us, we all have tried to be greedy and then nothing happened. So Do Not try to change anything other than what is instructed. Because if you do, it will not work for you. Remember, honesty reaps the reward!!! 1.... After you have ordered all 5 reports, take this advertisement and REMOVE the name & address of the person in REPORT # 5. This person has made it through the cycle and is no doubt counting their fortune. 2.... Move the name & address in REPORT # 4 down TO REPORT # 5 3.... Move the name & address in REPORT # 3 down TO REPORT # 4 4.... Move the name & address in REPORT # 2 down TO REPORT # 3 5.... Move the name & address in REPORT # 1 down TO REPORT # 2 6.... Insert YOUR name & address in the REPORT # 1 Position. PLEASE MAKE SURE you copy every name & address ACCURATELY! -------------------------------------------------------------------------------- **** Take this entire letter, with the modified list of names, and save it on your computer. DO NOT MAKE ANY OTHER CHANGES. Save this on a disk as well just in case if you loose any data. To assist you with marketing your business on the internet, the 5 reports you purchase will provide you with invaluable marketing information which includes how to send bulk e-mails llegally, where to find thousands of free classified ads and much more. there are 2 Primary methods to get this venture going: METHOD # 1: BY SENDING BULK E-MAIL LEGALLY -------------------------------------------------------------------------------- Let's say that you decide to start small, just to see how it goes, and we will assume You and those involved send out only 5,000 e-mails each. Let's also assume that the mailing receive only a 0.2% response (the response could be much better but lets just say it is only 0.2%. Also many people will send out hundreds of thousands e-mails instead of only 5,000 each). continuing with this example, you send out only 5,000 e-mails. With a 0.2% response, that is only 10 orders for report # 1. Those 10 people responded by sending out 5,000 e-mail each for a total of 50,000. Out of those 50,000 emails only 0.2% responded with orders. That's 100 people responded and ordered Report # 2. Those 100 people mail out 5,000 e-mails each for a total of 100,000 e-mails. The 0.2% response to that is 1000 orders for Report # 3. Those 1000 people send out 5,000 e-mails each for a total of 5 million e-mails sent out. The 0.2% response to that is 10,000 orders for Report. Those 10,000 people send out 5,000 e-mails each for a total of 50,000,000 (50 million) e-mails. The 0.2% response to that is 100,000 orders for Report # 5 THAT'S 100,000 ORDERS TIMES $5 EACH $500,000.00 (half million). Your total income in this example is: 1..... $50 + 2..... $500 + 3..... $5, 000 + =..... $50,000 + 5..... $500,000 ........ Grand Total $555,550. 00 NUMBERS DO NOT LIE. LET A PENCIL & PAPER AND FIGURE OUT THE WORST POSSIBLE RESPONSES AND NO MATTER HOW YOU CALCULATE IT, YOU WILL STILL MAKE A LOT OF MONEY ! -------------------------------------------------------------------------------- REMEMBER FRIEND, THIS IS ASSUMING ONLY 10 PEOPLE ORDERING OUT OF 5,000 YOU MAILED TO. Dare to think for a moment what would happen if everyone or half or even one 4th of those people mailed 100,000 e-mails each or more? there are over 150 million people on the Internet worldwide and counting. Believe me, many people will do just that, and more! METHOD # 2 : BY PLACING FREE ADS ON THE INTERNET -------------------------------------------------------------------------------- Advertising on the net is very very inexpensive and there are hundreds of FREE places to advertise. Placing a lot of free ads on the internet will easily get a larger response. We strongly suggest you start with method # 1 and add METHOD # 2 as you go along. For every $5 you receive, all you just do is e-mail them the Report they ordered. That's it. Always provide same day service on all orders. This will guarantee that the e-mail they send out, with your name and address on it, will be prompt because they can not advertise until they receive the report. ===========AVAILABLE REPORTS ==================== ORDER EACH REPORT BY ITS NUMBER & NAME ONLY. Notes: Always send $5 cash (U.S. CURRENCY) for each Report. Checks NOT accepted. Make sure the cash is concealed by wrapping it in at least 2 sheets of paper. On one of those sheets of paper, Write the NUMBER & the NAME of the Report you are ordering, YOUR E-MAIL ADDRESS and your name and postal address. PLACE YOUR ORDER FOR THESE REPORTS NOW : -------------------------------------------------------------------------------- Report #1: The Insider's Guide To Advertising for Free On The Net. Order Report #1 from: Stephen Au Flat D, 10/F, Block 5, Locwood Court Kingswood Villas, Tin Shui Wai Yuen Long Hong Kong ___________________________________________________ REPORT #2: The Insider's Guide To Sending Bulk Email On The Net. Order report #2 from: Marc Hansen 615, Avenue Mozart F-13100 Aix-en-Provence France Europe ___________________________________________________ REPORT #3: Secret To Multilevel Marketing On The Net. Order Report #3 from : Pete Gallagher 2082 Newbury Rd. #14 Newbury Pk., CA 91320 ___________________________________________________ REPORT #4: How To Become A Millionaire Utilizing MLM & The Net. Order Report #4 from: Sonja MacKenzie RR#25 1032 Orange Rd. Roberts Creek, BC VON 2W5 CANADA ___________________________________________________ REPORT #5: How To Send Out One Million Emails For Free. Order Report #5 From: Kimik P. O. Box 175 Alta Loma, CA 91701-0175 USA ___________________________________________________ $$$$$$$$$ YOUR SUCCESS GUIDELINES $$$$$$$$$$$ Follow these guidelines to guarantee your success: === If you do not receive at least 10 orders for Report #1 within 2 weeks, continue sending e-mails until you do. === After you have received 10 orders, 2 to 3 weeks after that you should receive 100 orders or more for REPORT # 2. If you did not, continue advertising or sending e-mails until you do. === Once you have received 100 or more orders for report # 2, YOU CAN RELAX, because the system is already working for you, and the cash will continue to roll in ! THIS IS IMPORTANT TO REMEMBER: Every time your name is moved down on the list, you are placed in front of a Different report. You can KEEP TRACK of your PROGRESS by watching which report people are ordering from you. IF YOU WANT TO GENERATE MORE INCOME SEND ANOTHER BATCH OF E-MAILS AND START THE WHOLE PROCESS AGAIN. There is NO LIMIT to the income you can generate from this business !!! -------------------------------------------------------------------------------- FOLLOWING IS A NOTE FROM THE ORIGINATOR OF THIS PROGRAM: You have just received information that can give you financial freedom for the rest of your life, with NO RISK and JUST A LITTLE BIT OF EFFORT. You can make more money in the next few weeks and months than you have ever imagined. Follow the program EXACTLY AS INSTRUCTED. Do Not change it in any way. It works exceedingly well as it is now. Remember to e-mail a copy of this exciting report after you have put your name and address in Report #1 and moved others to #2 ..........# 5 as instructed above. One of the people you send this to may send out 100,000 or more e-mails and your name will be on every one of them. Remember though, the more you send out the more potential customers you will reach. So my friend, I have given you the ideas, information, materials and opportunity to become financially independent. IT IS UP TO YOU NOW ! ============MORE TESTIMONIALS================== '' My name is Mitchell. My wife, Jody and I live in Chicago. I am an accountant with a major U.S. Corporation and I make pretty good money. When I received =his program I grumbled to Jody about receiving ''junk mail''. I made =un of the whole thing, spouting my knowledge of the population and percentages involved. I ''knew'' it wouldn't work. Jody totally ignored my supposed intelligence and few days later she jumped in with both feet. I made merciless fun of her, and was ready to lay the old ''I told you so'' on her when the thing didn't work. Well, the laugh was on me! Within 3 weeks she had received 50 responses. within the next 45 days she had received total $ 147,200.00 .......... all cash! I was shocked. I have joined Jody in her ''hobby''. Mitchell Wolf, M.D. Chicago, Illinois. =================================================== '' Not being the gambling type, it took me several weeks to wake up my mind to participate in this plan. But conservative that I am, I decided that the initial investment was so little that there was just no way that I couldn't get enough orders to at least get my money back''. '' I was surprised when I found my medium size post office box crammed with orders. I made =319,210. 00 in the first 12 weeks. The nice thing about this deal is that it does not matter where people live. There simply isn't a better investment with a faster return and so big''. Dan Sondstrom. Alberta, Canada. =================================================== '' I had received this program before. I deleted it, but later I wondered if I should have given it a try. Of course, I had no idea who do contact to get another copy, so I had to wait until I was e-mailed again by someone else.........11 months passed then it luckily came again...... I did not delete this one! I made more than $490,000 on my first try and all the money came within 22 weeks''. Susan De Suza. New York, N.Y. -------------------------------------------------------------------------------- '' It really is a great opportunity to make relatively easy money with little cost to you. I followed the simple instructions carefully and within 10 days the money started to come in. My first month I made $ 20, 560.00 and by the end of third month my total cash count was $ 362,840.00. Life is beautiful, Thanx to internet''. Fred Dellaca. Westport, New Zealand. -------------------------------------------------------------------------------- ORDER YOUR REPORTS TODAY AND GET STARTED ON YOUR ROAD TO FINANCIAL FREEDOM ! -------------------------------------------------------------------------------- FOR YOUR INFORMATION.... If you need help with starting a business, registering a business name, learning how income tax is handled, etc., contact your local office of the Small Business Administration (a Federal agency) 1-(800)827-5722 for free help and answers to questions. Also, the Internal Revenue Service offers free help via telephone and free seminars about business tax requirements. Under Bill S1618 Title III passed by the 105th US Congress this letter cannot be considered spam as long as the sender includes contact information and a method of removal. This is a one time e-mail transmission. No request for removal is necessary. If you have any questions of the legality of this program, contact the Office of Associate Director for Marketing Practices, Federal Trade Commission, Bureau of Consumer Protection, Washington, D.C. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Flying Shose!!��Flying Shose!!
by i46157184＠hotmail.com 21 Apr '01

21 Apr '01

1 0

MBGP
by James Tyson 16 Apr '01

16 Apr '01

Sorry about the cross-posting. I wanted to ask who would be willing to set up MBGP across APE or WIX (it's pretty easy, you just need to extend the capabilities of your current sessions with a new address-family). All interested say "Aye" and I will post instructions on the mbone-nz list for IOS<12.1 IOS>12.1 (they changed it) and Zebra I was really hoping that the guys at Citylink would be willing to set the route-reflectors up to do it also. Cheers. James Tyson --- Samizdat New Media Solutions --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Re: MBGP
by James Tyson 16 Apr '01

16 Apr '01

#include <tumbleweed.h> Cheers. James Tyson --- Samizdat New Media Solutions --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Humour
by Roger De Salis 15 Apr '01

15 Apr '01

In these possibly humour impaired times...... it is not often one gets a giggle at competitors equipment. Here is a picture of a recently announced IP phone from a Canadian vendor :-) (Hard hat-on, iron-underpants in place, Cisco product abuse shields operational.... Warp speed Mr Sulu.......) :-) -- \_ Roger De Salis Cisco Systems NZ Ltd </' +64 25 481 452 L8, ASB Tower, 2 Hunter St /) +64 4 496 9003 Wellington, New Zealand (/ roger(a)desalis.gen.nz rdesalis(a)cisco.com ` 4/4/01. Mike Volpi, Cisco's chief strategy officer, announces four key markets: VOIP, wireless LANs, content networking, streaming media.

7 10

Make your web site fun to view!
by joan343＠wilcox.org 14 Apr '01

14 Apr '01

Make your Web Site fun to visit while increasing your traffic by adding iCards Greetings. For as little as $19.95 per month you can have iCards Greetings running on your web site. Give your visitors a reason to keep coming back again and again, all while creating new first time visitor. And best of all, we do all the work. 1. All pages customized with your background, colors and logo. 2. New iCard Greetings added regularly. 3. All bandwidth is on our server. 4. Application maintenance and updates are all done by us. 5. Statistical Reports to monitor activity. Once set up, usually within 24 hours, just sit back and watch your traffic grow. Each time a visitor sends an iCard Greeting to a friend or family, you have just created a new visitor to your web site. As time goes on the 'snow ball' effect will increase your web site traffic tremendously. Best of all it requires absolutely no work of any kind on your part, everything is done automatically. No long term commitment or obligation. You have nothing to lose and everything to gain. Mention this email and receive the first month FREE. Take a look at www.SendiCards.com and see for yourself how much fun iCard Greetings can be. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 4

Slingshot Having Security Problems
by slingshot 11 Apr '01

11 Apr '01

As a customer I see there was major issues with security on the network Today they were down at least 12 hours from around 6am - 6pm All customers have been asked to change passwords Frank --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 2

RE: Cisco Field Notice: 12SP+/30VIP Phone Intl. Pwr. Cube Potenti al
by Lindsay Druett 09 Apr '01

09 Apr '01

(Hard hat-on, iron-underpants in place, Cisco product abuse shields operational.... Warp speed Mr Sulu.......) -----Original Message----- From: imnot telling [mailto:tellingimnot(a)hotmail.com] Sent: Tuesday, 10 April 2001 09:44 To: nznog(a)list.waikato.ac.nz Subject: Cisco Field Notice: 12SP+/30VIP Phone Intl. Pwr. Cube Potential "user may be exposed to live terminals at high voltage", but at least they look neater than an unamed Canadian competitors product. -----Original Message----- From: CCO Field Notice [mailto:cco-valet(a)cisco.com] Subject: Cisco Field Notice: 12SP+/30VIP Phone Intl. Pwr. Cube Potential Safety Hazard --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 4

Cisco Field Notice: 12SP+/30VIP Phone Intl. Pwr. Cube Potential
by imnot telling 09 Apr '01

09 Apr '01

"user may be exposed to live terminals at high voltage", but at least they look neater than an unamed Canadian competitors product. -----Original Message----- From: CCO Field Notice [mailto:cco-valet(a)cisco.com] Subject: Cisco Field Notice: 12SP+/30VIP Phone Intl. Pwr. Cube Potential Safety Hazard The product affected is currently NOT IN ANY PROFILE therefore a mass mailing to our entire mailing list is necessary. This e-mail is coming to you courtesy of the Cisco Connection Online Field Notice tool. Thank you for indicating through your interest profile that you wish to receive these alerts. For information, features or helpful hints about Cisco's Field Notices, please go to: http://www.cisco.com/cgi-bin/Support/FieldNoticeTool/field-notice?action=he… Want to change your Alert Profile or create a new one? Please go to: http://www.cisco.com/cgi-bin/Support/FieldNoticeTool/field-notice Title: Field Notice: 12SP+/30VIP Telephone International Power Cube Potential Safety Hazard URL: http://www.cisco.com/warp/customer/770/fn13042.shtml Posted: April 5, 2001 Summary: A potential safety hazard may occur when the 12SP+/30VIP telephone is not used with international power converter cubes and power cords provided by Cisco. Some non-Cisco-approved power cords may fit too snugly into the cube AC power supply inlet receptacle ("the receptacle"). In this situation the receptacle may be dislodged from the cube housing when attempts are made to extract the power cord plug. If the receptacle becomes dislodged, the user may be exposed to live terminals at high voltage. _________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

NZ Undernet server
by Pete 07 Apr '01

07 Apr '01

Hi all Does anyone know of a public Undernet IRC server within 'NZ' ? After receiving a HUGE bill from my isp for traffic to the SanDiego server I'm keen to find another 'local' relay. I note that auckland.nz.undernet.org is non-existant now. Thanks in advance Pete Pete Mundy - Technician Advanced Communications +64-3-546-9169 / +64-25-480-840 E-Mail: Pete(a)AdvComm.Co.NZ --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

14 25

Fwd: Make a lot of money from your computer
by Leon Toh 06 Apr '01

06 Apr '01

Hi, It's good to see NZ have a Internet network list where most ISP's are subscribe to it. I still haven't locate 1 for Australia. I believe what this person did can be consider as spamming. From the mail header can anyone tell as to where this mail originated from. Are we able to do something about it. Best Regards, Leon >X-Persona: <Optus> >Return-Path: <owner-megaco(a)fore.com> >Received: from mx2.optushome.com.au ([203.164.2.11]) > by mss.rdc2.nsw.optushome.com.au > (InterMail vM.4.01.03.20 201-229-121-120-20010223) with ESMTP > id > <20010406140639.CVBV17266.mss.rdc2.nsw.optushome.com.au(a)mx2.optushome.com.au> > for <leontoh(a)optushome.com.au>; Sat, 7 Apr 2001 00:06:39 +1000 >Received: from prserv.net (in5.prserv.net [32.97.166.41]) > by mx2.optushome.com.au (8.9.1/8.9.1) with ESMTP id AAA15381 > for <leontoh(a)optushome.com.au>; Sat, 7 Apr 2001 00:06:38 +1000 (EST) >Received: from mailgate.pit.comms.marconi.com ([169.144.68.6]) > by prserv.net (in5) with ESMTP > id <2001040614063610504kuur8e>; Fri, 6 Apr 2001 14:06:36 +0000 >Received: from mailman.pit.comms.marconi.com >(mailman.pit.comms.marconi.com [169.144.2.12]) > by mailgate.pit.comms.marconi.com (8.9.3/8.9.3) with ESMTP id > JAA28605; > Fri, 6 Apr 2001 09:57:35 -0400 (EDT) >Received: (from majordom(a)localhost) > by mailman.pit.comms.marconi.com (8.9.3/8.9.3) id JAA11559 > for megaco-list; Fri, 6 Apr 2001 09:55:02 -0400 (EDT) >Received: from mailgate.pit.comms.marconi.com >(mailgate.pit.comms.marconi.com [169.144.68.6]) > by mailman.pit.comms.marconi.com (8.9.3/8.9.3) with ESMTP id JAA11555 > for <megaco(a)fore.com>; Fri, 6 Apr 2001 09:55:00 -0400 (EDT) >From: quickwaynz(a)e247.com >Received: from mta6-rme.xtra.co.nz (mta6-rme.xtra.co.nz [203.96.92.19]) > by mailgate.pit.comms.marconi.com (8.9.3/8.9.3) with ESMTP id > JAA28233 > for <megaco(a)fore.com>; Fri, 6 Apr 2001 09:54:55 -0400 (EDT) >Received: from mail.xtra.co.nz ([210.54.103.7]) by mta6-rme.xtra.co.nz > with SMTP > id > <20010406134330.KNRK9352737.mta6-rme.xtra.co.nz(a)mail.xtra.co.nz>; > Sat, 7 Apr 2001 01:43:30 +1200 >To: Friend(a)public.com >Date: Sat, 07 Apr 01 01:28:31 EST >Subject: Make a lot of money from your computer >Message-Id: <20010406134330.KNRK9352737.mta6-rme.xtra.co.nz(a)mail.xtra.co.nz> >Sender: owner-megaco(a)pit.comms.marconi.com >Precedence: bulk > >Hi There >My name is Tim, I live in New Zealand. A few weeks ago I was sent a bulk >email and just >for a change I decided to read it. What it shows is a genuine way to make >thousands of >dollars in a very short time using the immense power of the internet. >Yes, it's a multi level marketing scheme. Yes, it's legal and YES, it >works. Rather than >bombard you with information by email, all I ask is that you click on my >site at >http://mysite.xtra.co.nz/~fastwaynz . There you will find all the >information you need . If you >have any questions WHATSOEVER, you can contact me by clicking EMAIL from >my site. >I will help make this work for you, just like it has for thousands of >people before us. >Please reserve your skepticism until after you have readhow it works. >Taking the plunge >is paying off better than I could have imagined. So thanks for reading >this far. Now check >out my site - it'll be the best ten minute read of your life. >Tim --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Fwd: RE: New hacking laws
by Mark Foster 02 Apr '01

02 Apr '01

I assume this was supposed to go to the list. >Delivered-To: blakjak-net-blakjak(a)blakjak.net >From: "David Buckingham" <david.buckingham(a)xtra.co.nz> >To: "Chris Wedgwood" <cw(a)f00f.org> >Subject: RE: New hacking laws >Date: Mon, 2 Apr 2001 19:37:34 +1200 >X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) >Importance: Normal >Sender: owner-nznog(a)list.waikato.ac.nz > >Hello All, > >Aardvark (aardvark.co.nz) made a comment this morning, which touched >directly on something I put to the select committee (Law and Order) in my >submission on the new hacking laws. > >That is - that with the law proposed (which is the result of a law >commission report 54 - "computer misuse" - May 1999 see www.lawcom.govt.nz >for a copy) governing hacking, interception and so on, soon to come into >force, how is it going to be enforced? > >Enforcement of criminal law is by police prosecuting after an investigation. >Which poses one of the most important questions of all - do the police have >the resources, background and skills to make investigations into serious >computer crime?, or computer crime for that matter? > >My recommendation to the select committee was to have a special unit for >computer crime, which is adequately funded, which solely investigates these >types of offences. > >I am interested to hear some feedback. - I have copies of a number of >documents related to this issue - and if you would like for me to let you >know how to get your hands on this information please let me know. > >David Buckingham > >-----Original Message----- >From: owner-nznog(a)list.waikato.ac.nz >[mailto:owner-nznog(a)list.waikato.ac.nz]On Behalf Of Chris Wedgwood >Sent: Monday, 2 April 2001 5:57 p.m. >To: David Buckingham >Cc: nznog(a)list.waikato.ac.nz >Subject: Re: New hacking laws > >On Mon, Apr 02, 2001 at 04:01:20PM +1200, David Buckingham wrote: > > Would it be off topic to discuss the proposed new hacking laws? > > I am referring to the Crimes Amendment Bill (No.6) and its SOP 85. > >I see no reason why not... it's certainly more relevant than a lot of >what is discussed here. > > > > --cw >--------- >To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz >where the body of your message reads: >unsubscribe nznog > >--------- >To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz >where the body of your message reads: >unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

9 8

Re: Fwd: RE: New hacking laws
by Mark Foster 01 Apr '01

01 Apr '01

except that I didnt see a copy from the list.. :) At 20:07 2/04/2001 +1200, you wrote: >Fear, and respect the beauty of Bcc: > > >On Mon, 2 Apr 2001, Mark Foster wrote: > > > I assume this was supposed to go to the list. > > > > >Delivered-To: blakjak-net-blakjak(a)blakjak.net > > >From: "David Buckingham" <david.buckingham(a)xtra.co.nz> > > >To: "Chris Wedgwood" <cw(a)f00f.org> > > >Subject: RE: New hacking laws > > >Date: Mon, 2 Apr 2001 19:37:34 +1200 > > >X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) > > >Importance: Normal > > >Sender: owner-nznog(a)list.waikato.ac.nz > > > > > >Hello All, > > > > > >Aardvark (aardvark.co.nz) made a comment this morning, which touched > > >directly on something I put to the select committee (Law and Order) in my > > >submission on the new hacking laws. > > > > > >That is - that with the law proposed (which is the result of a law > > >commission report 54 - "computer misuse" - May 1999 see www.lawcom.govt.nz > > >for a copy) governing hacking, interception and so on, soon to come into > > >force, how is it going to be enforced? > > > > > >Enforcement of criminal law is by police prosecuting after an > investigation. > > >Which poses one of the most important questions of all - do the police > have > > >the resources, background and skills to make investigations into serious > > >computer crime?, or computer crime for that matter? > > > > > >My recommendation to the select committee was to have a special unit for > > >computer crime, which is adequately funded, which solely investigates > these > > >types of offences. > > > > > >I am interested to hear some feedback. - I have copies of a number of > > >documents related to this issue - and if you would like for me to let you > > >know how to get your hands on this information please let me know. > > > > > >David Buckingham > > > > > >-----Original Message----- > > >From: owner-nznog(a)list.waikato.ac.nz > > >[mailto:owner-nznog(a)list.waikato.ac.nz]On Behalf Of Chris Wedgwood > > >Sent: Monday, 2 April 2001 5:57 p.m. > > >To: David Buckingham > > >Cc: nznog(a)list.waikato.ac.nz > > >Subject: Re: New hacking laws > > > > > >On Mon, Apr 02, 2001 at 04:01:20PM +1200, David Buckingham wrote: > > > > > > Would it be off topic to discuss the proposed new hacking laws? > > > > > > I am referring to the Crimes Amendment Bill (No.6) and its SOP 85. > > > > > >I see no reason why not... it's certainly more relevant than a lot of > > >what is discussed here. > > > > > > > > > > > > --cw > > >--------- > > >To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > > >where the body of your message reads: > > >unsubscribe nznog > > > > > >--------- > > >To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > > >where the body of your message reads: > > >unsubscribe nznog > > > > --------- > > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > > where the body of your message reads: > > unsubscribe nznog > > > > >Tim J. Shackleton ------------------+ +- Business http://www.netlink.co.nz/ >Networks Admin/Programmer ----------+ +- Personal http://www.netnet.net.nz/ >Netlink LTD -- DDI +64 4 922 8476 --+ +------------- Pager 64 +26 253 4356 >+64 29 650 476 -- Cellular ---------+ +------------------------------------ >----------------- " All your base are belong to us! " --------------------- > >--------- >To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz >where the body of your message reads: >unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

New hacking laws
by David Buckingham 01 Apr '01

01 Apr '01

Afternoon, Would it be off topic to discuss the proposed new hacking laws? I am referring to the Crimes Amendment Bill (No.6) and its SOP 85. David Buckingham --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 2

RE: NZ Undernet server
by Steve Phillips 01 Apr '01

01 Apr '01

At 15:58 2/04/2001, Tim Shackleton wrote: >Nothing an old-fashioned lynching won't fix :) I'll donate the rope/baseball bat -- Steve. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

The New Zealand Network Operators' Group
by Donald Neal 01 Apr '01

01 Apr '01

The New Zealand Network Operators' Group The New Zealand Network Operators' Group (NZNOG) has no king, president or formal membership. At present it consists of the subscribers to this mailing list, which anyone is free to join. This list has just under 220 subscribers, growing by a handful each month. The NZNOG mailing list is provided through a server at The University of Waikato, and is administered by an employee of Telecom NZ Ltd. Neither of these organisations (nor the administrator) is responsible for its content. NZNOG Mailing List Acceptable Use Policy The NZNOG mailing list exists to provide a forum for the exchange of technical information and the discussion of implementation issues that require cooperation among New Zealand network service providers. In order to continue to provide a useful forum for discussion of relevant technical issues, users of the list are asked to respect the following guidelines. 1. Discussion will focus on Internet operational and technical issues. 2. Discussion related to meetings of network service providers is appropriate. 3. Discussion unrelated to these topics is not appropriate. 4. Postings to multiple mailing lists are discouraged. 5. Postings that include foul language, character assassination, and lack of respect for other participants are unacceptable. 6. Blatant product or service marketing is unacceptable. 7. Postings of a political, philosophical or legal nature are discouraged. 8. Postings to the list should be in ASCII or MIME encoded as text/plain. Attachments should not be sent to the list. To present a document, a suitable URL may be referred to. For documents of general interest, the use of proprietary file formats is discouraged. 9. Breaches of list etiquette should be dealt with privately with the offending list user, and should not result in complaints being sent to the list. Mailing List Archives A full archive is available at http://list.waikato.ac.nz/archives/nznog/ To search the archive, see http://list.waikato.ac.nz/archives/search.html (and remember to select nznog). Subscribing to the List To subscribe to the NZNOG list, send email to majordomo(a)list.waikato.ac.nz, where the body of the message reads subscribe nznog There are at present no restrictions on who may subscribe to the list, or even on who may post to the list. Digest Mailing List If you don't wish to receive postings as they are sent, you can instead subscribe to the nznog-digest mailiing list, on which all postings are sent out in a single "digest" every couple of days. Other Activities NZNOG does not at present have other regular activities than this mailing list, though the administrator is on the hunt for presenters for the annual Uniforum NZ conference, to be held in the second half of the year. Donald Neal NZNOG Mailing List Owner/Administrator/Muggins --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Time for a change
by Andy Linton 29 Mar '01

29 Mar '01

Today's my last day at TelstraSaturn. I think it's also the end of an era for me. I've decided to take a break from being at the pointy end of IP operations - too many bellheads and not enough netheads for my liking. Of course, when the money runs out I may well be back grovelling for work. I'll still be on the list, lurking in a dark corner. So long and thanks for all the fish! andy --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

Re: History of Internet in New Zealand to current date (Off Topic, but what the hell..)
by Mark Davies 29 Mar '01

29 Mar '01

From: "fwetyson" <fwetyson(a)slingshot.co.nz> Date: Wed, 28 Mar 2001 22:58:13 +1200 > Would be interested in the dates regarding VUW and Massey 1989 - about 6 months after the international link went in to Waikato having got fed up waiting for the computer centers to get something working. > Did these take place before Kawahiko and Tuia got on line > via NZGate? Yes. cheers mark --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

7 6

Re: History of Internet in New Zealand to current date (Off Topic, but what the hell..)
by Mark Davies 28 Mar '01

28 Mar '01

From: Geoff Huston <gih(a)telstra.net> Date: Wed, 28 Mar 2001 17:50:40 +1000 > Just a quick note from the other side of the Tasman - the earliest efforts > appeared to be at the Victoria University, Wellington, where the Computer > Science Department operated a modem-based trans-Tasman messaging service > through the eighties - I'm not sure whether the link used the uunet > protocols or the acsnet protocols, but I'm not sure thats all that > relevant. It linked up to a comparable Computer Science messaging network > in Australia. It was ACSnet to melbourne as well as uucp to Calgary and to uunet (actually it was initially seismo back in the pre uunet days). There was even a short period when email between here and canterbury went via calgary. > The first link was, as I recall, a 14.4Kbps analog modem > connection, installed in late 88 (or thereabouts) with NASA and NZ > funding. And the first NZ IP link out of Waikato was a slip link between here and there running over the DSIR's internal serial network with an 8086 based PCrouter at each end. That link ran at 9.6K though the DSIR constrained it to only 4.8K. That was quickly followed by a similar link from here to Massey. cheers mark --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Re Messages from this list
by fwetyson 28 Mar '01

28 Mar '01

I checked my end and not CCing myself messages Whats the email command for checking my settings in the list Some lists allow you to change or reset your status this way Thanks in advance Frank Tyson Phone: 64211341826 Fax:+6445635927 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

www.ape.net.nz
by Simon Lyall 28 Mar '01

28 Mar '01

I've recently taken this over from Joe and it's now up on usenet.net.nz. Can people take a quick look and please email me any suggestions, updates and corrections for it. There are some errors and missing bits for participants on APE and other stuff needs fixed as well. http://www.ape.net.nz/ -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | | Home: simon(a)darkmere.gen.nz ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

late DEW - 2q2001
by Bill Manning 28 Mar '01

28 Mar '01

Hi, I appologize for duplicates. Its almost time for the next quarterly walk of the inverse tree of the DNS. Since 1997, I've been walking the in-addr tree looking for numbers of delegations, accurate delegations, and types and styles of error conditions. So... this is a heads up that you will be seeing zone transfers being generated by a couple of the collecter machines here. For those of you who utilize BINDs access controls, I'd appreciate your inclusion of the collector machines in allowed transfers. The expectation is that they will be the following IP addresses: 128.9.160.57 and 198.32.4.13 If there are any questions or concerns, I'd be happy to talk about them. Past data has been presented at IEPG, Apricot and RIPE meetings. The expectation is that future data will be presented in the same and similar forums. Past data may be viewed at: http://www.isi.edu/~bmanning/in-addr-audit.html --bill 310.322.8102 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: History of Internet in New Zealand to current date (Off Topic, but what the hell..)
by Mark Davies 27 Mar '01

27 Mar '01

> > Did these take place before Kawahiko and Tuia got on line > > via NZGate? > Yes. I should have added "before any of these existed." mark --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: History of Internet in New Zealand to current date (Off Topic, but what the hell..)
by fwetyson 27 Mar '01

27 Mar '01

Thanks for the feed back folks Would be interested in the dates regarding VUW and Massey Did these take place before Kawahiko and Tuia got on line via NZGate? Frank Tyson Phone: 64211341826 Fax:+6445635927 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: History of Internet in New Zealand to current date (Off Topic)
by fwetyson 27 Mar '01

27 Mar '01

Thanks for the assistance some of you have given I see a note next to the thread that this subject is Off Topic Does that mean I cant raise the question here? If so thats a pity considering the major inovators of Internet here in NZ Appologies Frank Tyson Phone: 64211341826 Fax:+6445635927 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Messages from this list
by fwetyson 27 Mar '01

27 Mar '01

Could someone advise me why I get two copies of every posting to the list Thanks in advance Frank Tyson Phone: 64211341826 Fax:+6445635927 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Attica/Tranzpeer Prefix List
by James Tyson 27 Mar '01

27 Mar '01

Hi all! Attached is an updated prefix list for Tranzpeer[1], which includes Attica and Tranzpeer's customers. Tranzpeer will be moving to it's own AS number shortly, so those of you peering with us will recieve an email shortly asking you to change your peering session with us[2]. Cheers. James Tyson. Self-Deluded Governing Minority, Attica Network Operations. --- [1] Tranzpeer Limited is a wholesale bandwidth provider run by Attica [2] Does anyone know how to make a crisco router run multiple instances of BGP, because that would make it so much easier!

4 6

RE: History of Internet in New Zealand to current date
by Lindsay Druett 27 Mar '01

27 Mar '01

I would have thought the best person to ask about this subject would be John Haulker. Tim Williams seems to remember a lot about what happened... -----Original Message----- From: fwetyson [mailto:fwetyson(a)slingshot.co.nz] Sent: Wednesday, 28 March 2001 09:13 To: nznog(a)list.waikato.ac.nz Subject: History of Internet in New Zealand to current date Ive been lurking around watching the postings and discussions here for the last few months and felt this was the place to pose the following question? Where does one find accurate information regarding the History and Development of the Internet here in NZ ? Most information Ive read (with the exception of postings here) is circa 1997 In recent times there has been many courses in IT commencing in the various technical institutions and locating accurate up to date information has been a major effort The most recent I could find was at http://www.iscr.org.nz/documents/enright.pdf Most others as I said havent been updated prior to 1997 Considering the many years of experience here and the wide range of organisations maybe this needs to be reviewed Finally I appologise if this isnt the place to raise this discussion Frank Tyson Student CyberTechnology Hutt Valley Polytech --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

10 14

RE: History of Internet in New Zealand to current date
by Bart Kindt 27 Mar '01

27 Mar '01

At 09:14 28/03/01 +1200, Lindsay Druett wrote: >I would have thought the best person to ask about this subject would be John >Haulker. > >Tim Williams seems to remember a lot about what happened... > I started Efficient Software Internet in Dunedin in August 1994. Got my backbone via University of Otago, who got theirs from Waikato. John Haulker I talked a lot with in those days :) Nostalgia... Bart Bart Kindt Director The Internet Group Limited --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

History of Internet in New Zealand to current date
by fwetyson 27 Mar '01

27 Mar '01

Ive been lurking around watching the postings and discussions here for the last few months and felt this was the place to pose the following question? Where does one find accurate information regarding the History and Development of the Internet here in NZ ? Most information Ive read (with the exception of postings here) is circa 1997 In recent times there has been many courses in IT commencing in the various technical institutions and locating accurate up to date information has been a major effort The most recent I could find was at http://www.iscr.org.nz/documents/enright.pdf Most others as I said havent been updated prior to 1997 Considering the many years of experience here and the wide range of organisations maybe this needs to be reviewed Finally I appologise if this isnt the place to raise this discussion Frank Tyson Student CyberTechnology Hutt Valley Polytech --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

APE Switch
by Tony Wicks 26 Mar '01

26 Mar '01

Hi all, I note the 2912 switch that constitutes APE is full and has now been supplemented by a Dlink one. While Dick Smith may be quite happy selling these devices to their customers, I don't think it is entirely appropriate to be a central point for New Zealand's Internet traffic. Perhaps the nice people at Cisco ( or another civic minded manufacturer ) would like to donate something more appropriate for the task, like a 3548xl say ? --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

12 14

Ignore: Testing my mailfilter; sorry ;)
by Bart Kindt 25 Mar '01

25 Mar '01

To filter or not to filter, thats the question! Bart Bart Kindt Director The Internet Group Limited --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

mbone stuff
by James Tyson 24 Mar '01

24 Mar '01

Hi all. Just letting everyone know that I have set up a mailling list for NZ Network Operators that wish to discuss the nzmbone stuff without spamming this list. You can subscribe at: https://secure.samizdat.co.nz/mailman/listinfo/mbone-nz or by sending a subscribe message to mbone-nz-request(a)samizdat.co.nz Status update: IHUG & Attica are now live and streaming MP3 content, all content has been restricted to 233/8 space while formulation of a NZ mbone addressing schema. I am still waiting to hear from other ISP's wishing to become involved (hint hint). Cheers. James Tyson --- Samizdat New Media Solutions --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

7 8

New prefix list
by Tony Wicks 19 Mar '01

19 Mar '01

Below is a new prefix list for all of you that we are peering with. Can someone at Clear please post their current list, I get the feeling that my copy is a bit out of date. notes - added - 210.185.16.0/20 le 21,203.9.179.0/24 removed - several cheers ip prefix-list AONZ-networks description networks(a)nz.asiaonline.net ip prefix-list AONZ-networks seq 5 permit 202.14.100.0/24 ip prefix-list AONZ-networks seq 10 permit 210.48.0.0/17 le 18 ip prefix-list AONZ-networks seq 15 permit 192.173.16.0/21 ip prefix-list AONZ-networks seq 25 permit 202.6.84.0/24 ip prefix-list AONZ-networks seq 30 permit 202.12.70.0/24 ip prefix-list AONZ-networks seq 45 permit 202.36.76.0/23 ip prefix-list AONZ-networks seq 60 permit 202.37.85.0/24 ip prefix-list AONZ-networks seq 75 permit 202.37.140.0/22 ip prefix-list AONZ-networks seq 85 permit 202.37.144.0/21 ip prefix-list AONZ-networks seq 115 permit 202.37.197.0/24 ip prefix-list AONZ-networks seq 120 permit 202.37.200.0/22 ip prefix-list AONZ-networks seq 130 permit 202.37.224.0/21 ip prefix-list AONZ-networks seq 150 permit 202.49.144.0/24 ip prefix-list AONZ-networks seq 155 permit 202.50.16.0/20 ip prefix-list AONZ-networks seq 160 permit 203.99.65.0/24 ip prefix-list AONZ-networks seq 165 permit 203.99.66.0/24 ip prefix-list AONZ-networks seq 170 permit 203.99.71.0/24 ip prefix-list AONZ-networks seq 175 permit 210.54.0.0/22 ip prefix-list AONZ-networks seq 180 permit 138.235.0.0/16 ip prefix-list AONZ-networks seq 185 permit 203.9.179.0/24 ip prefix-list AONZ-networks seq 190 permit 203.9.180.0/24 ip prefix-list AONZ-networks seq 195 permit 210.185.16.0/20 le 21 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Wireless Internet Training Program Development
by Paul Ravi Kumar 15 Mar '01

15 Mar '01

Sir, I am a wireless consultant from India with about 8 years of communications experience. I am conducting research on "Anywhere anytime mobile/wireless Internet". I wish to know the details of your Wireless Internet Training Program Development. Kindly respond with necessary details as to enable me to enrol for the program. Regards Paul Ravi Kumar _________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

(Fwd) The Webserver Plan
by Sue Leader 15 Mar '01

15 Mar '01

Greetings all - We have what I'm sure will be good news.... ------- Forwarded message follows ------- From: John Vorstermans <tech(a)isocnz.org.nz> Organization: Internet Society of NZ On Friday evening 16th March ISOCNZ will be moving their webserver in-house to their new premises. At this time the new "look and feel" site will come live. The changeover requires alterations to the ISOCNZ DNS which can take anywhere from several hours to several days to filter around the different ISPs etc. (depending on DNS refresh settings). This means that some people may not be able to get to the new site till later in the weekend. Cheers John -- John Vorstermans - Technical Manager ISOCNZ (Internet Society of New Zealand Inc) PO Box 11-881, Wellington ------- End of forwarded message ------- Cheers Sue Sue Leader - Executive Director Internet Society of New Zealand Inc PLEASE NOTE CHANGES: Voice: +64-4-472-1600 Fax: +64-4-472-1207 Level 4, Hibernian Building, 89 Willis Street (P.O.Box 11-881) Wellington http://www.isocnz.org.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 4

VOTE: .bank.nz
by Sue Leader 14 Mar '01

14 Mar '01

Greetings all I've just returned from the Melbourne ICANN meeting and have been offline because of equipment failure, so I apologise for the delay in posting this. The voting for the .bank.nz opened on Monday morning. If you wish to vote on this application please read the 'how to vote' information at: http://www.isocnz.org.nz/consult/2LD/how_to_vote.html. Please note to vote you must have an email address that ends in .nz. Voting will be open for 14 days and any questions regarding the voting can be sent to the Voting Officer at vote-help(a)isocnz.org.nz Cheers Sue Sue Leader - Executive Director ISOCNZ (Internet Society of New Zealand Inc) Exe.Dir(a)isocnz.org.nz Voice: +64-4-801-6256 http://www.isocnz.org.nz PLEASE NOTE CHANGE: P.O.Box 11-881, Wellington --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: Kiwi spammer "Deco Marketing Solutions"
by Michael White 13 Mar '01

13 Mar '01

Just what the Internet needs, more bad press. Be careful the media is evil :) Mike > ---------- > From: Juha Saarinen > Sent: Wednesday, 14 March 2001 10:26 AM > To: Martin D Kealey; nznog(a)list.waikato.ac.nz > Cc: Russell_Brown(a)idg. co. nz; Paul_Brislen(a)idg. co. nz; Darren > Greenwood; Stephen Bell > Subject: RE: Kiwi spammer "Deco Marketing Solutions" > > Martin, > > I've cc'ed some IDG reporters, in the hope that they might pick up on this > and cobble together a "Scourge Of The Internet" type of expose... ;-) > > -- Juha > > :: -----Original Message----- > :: From: owner-nznog(a)list.waikato.ac.nz > :: [mailto:owner-nznog(a)list.waikato.ac.nz]On Behalf Of Martin D Kealey > :: Sent: Wednesday, March 14, 2001 10:07 AM > :: To: nznog(a)list.waikato.ac.nz > :: Subject: Kiwi spammer "Deco Marketing Solutions" > :: > :: > :: Heads up, a local spam operation... > :: > :: Has anyone else been receiving spam from "email-prom.net" [12.42.24.22] > :: lately? The usual crap about how X million addressesee will buy > stuff... > :: > :: In this latest case the phone and fax numbers given are in > Ponsonby/Grey > :: Lynn and Orewa/Silverdale/Whangaparaoa areas respectively. > :: > :: A quick scan on call-minder for 09-3608038 reveals a mailbox > :: labelled "Deco > :: Marketing Solutions" (no information for the fax number 09-4268337). > The > :: previous message used a mailbox in North America, so I don't expect > they > :: actually live here, but on the off chance that they do, does anyone > know > :: anything about these guys? > :: > :: Normally I'd just firewall the IP, but if there's a chance of nailing > :: someone local I'll give them enough rope to hang themselves... > :: > :: And any suggestions as to what we should do with these two phone > numbers? > :: > :: -Martin > :: > :: ---------- Forwarded message ---------- > :: Received: from email-prom.net ([12.42.24.23]) > :: by smtp.sig.net.nz (8.9.3/NZSFI-20000705) with SMTP id VAA01285 > :: for <martin(a)kurahaupo.gen.nz>; Tue, 13 Mar 2001 21:01:37 +1300 > :: X-Authentication-Warning: mae.sub.net.nz: Host [12.42.24.23] > :: claimed to be > :: email-prom.net > :: Subject: FWD: Last Biz To Business Disc > :: Content-Type: text/plain; > :: charset=us-ascii > :: Content-Transfer-Encoding: 8BIT > :: X-Mailer: QI03122001MDNZ > :: Message-Id: <gcbinx81s4pg0grx.142o5n3n(a)email-prom.net> > :: Date: Tue, 13 Mar 2001 03:06:31 +0000 > :: Reply-To: md2000nz(a)email-prom.net > :: To: md2000nz(a)email-prom.net > :: > :: > :: You can now access contact data for over 8.5 Million Records. > :: All of them > :: have their own .com .org or .net domain name, making them > :: serious prospects > :: for Internet business. > :: > :: Our data base readily accessible on CD-Rom, list the Names, Contact > :: Information, Physical Address, Phone #, Fax #, SIC Industry > :: Code, URL (Domain > :: Name), and Contact Email Address which you can use to efficiently > target > :: companies worldwide. > :: > :: Over 8.5 Million Physical Addresses let you target businesses by > :: Country, > :: State, City, Province, Zip Code, Area Code or by using the SIC > :: Industry Code. > :: The data comes in a Comma-Delimited ASCII format which makes it easy to > :: manipulate and Import/Export records to your Contact-Management, > :: Spreadsheet, > :: analysis and Broadcasting Applications. > :: > :: > :: Please send me more info about: > :: > :: [ ] Master Disc 2000 8.5 Million Records, Cost US$799.00 > :: [ ] Online Updates & Download Access Cost US$199.00 (Annually) > :: [ ] Commercial Email Services & Products > :: > :: Note: Not all records contain complete data, call for breakdowns. > :: > :: For more details on Database, please call: > :: > :: #011-649-360-7038 (International) > :: > :: or fax form below to: > :: #011-649-426-8337 > :: > :: (Make Sure To Mention Reseller Id #1629 When Calling) > :: > :: > :: Company name: ___________________________________________ > :: > :: > :: Web Site Url: ___________________________________________ > :: > :: > :: Contact name: ___________________________________________ > :: > :: > :: Email: __________________________________________________ > :: > :: > :: Phone: __________________________________________________ > :: > :: > :: Fax: ___________________________________________________ > :: > :: > :: Street address: _________________________________________ > :: > :: > :: City, Zip, State: _______________________________________ > :: > :: > :: Country: ________________________________________________ > :: > :: > :: Check the following that apply: > :: > :: _____ Please Notify Me Of Online Web Site & Register Me > :: For Access Using The > :: Information Above. > :: > :: > :: Also Please, Send Additional Information on: > :: > :: _____ Online Adult & Gaming Owner/Operaters > :: _____ Online Adult Subscribers & Online Gamers Databases > :: _____ Online Billing/Credit Card Processing > :: _____ Emailing Services and Databases > :: _____ Search Engine Positioning > :: _____ International Contact Lists > :: _____ Buying / Selling Traffic > :: _____ Web Site Hosting Services > :: _____ Other:_______________________________ > :: > :: > :: ####################################################################### > :: To discontinue receipt of further notice and to be removed from our > :: database, please reply with the word "Remove" in subject. > :: > :: Any attempts to disrupt the removal email address etc., will not allow > :: us to be able to retrieve and process the remove requests. > :: ####################################################################### > :: > :: > :: .031201 > :: > :: --------- > :: To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > :: where the body of your message reads: > :: unsubscribe nznog > > > --------- > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > where the body of your message reads: > unsubscribe nznog > > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Anybody know of a 3Ware importer in NZ?
by Simon Blake 13 Mar '01

13 Mar '01

Apologies for the non netops related, but this seems a good place to ask - does anybody know of an importer of 3Ware IDE raid cards in NZ? Cheers Si --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Kiwi spammer "Deco Marketing Solutions"
by Martin D Kealey 13 Mar '01

13 Mar '01

Heads up, a local spam operation... Has anyone else been receiving spam from "email-prom.net" [12.42.24.22] lately? The usual crap about how X million addressesee will buy stuff... In this latest case the phone and fax numbers given are in Ponsonby/Grey Lynn and Orewa/Silverdale/Whangaparaoa areas respectively. A quick scan on call-minder for 09-3608038 reveals a mailbox labelled "Deco Marketing Solutions" (no information for the fax number 09-4268337). The previous message used a mailbox in North America, so I don't expect they actually live here, but on the off chance that they do, does anyone know anything about these guys? Normally I'd just firewall the IP, but if there's a chance of nailing someone local I'll give them enough rope to hang themselves... And any suggestions as to what we should do with these two phone numbers? -Martin ---------- Forwarded message ---------- Received: from email-prom.net ([12.42.24.23]) by smtp.sig.net.nz (8.9.3/NZSFI-20000705) with SMTP id VAA01285 for <martin(a)kurahaupo.gen.nz>; Tue, 13 Mar 2001 21:01:37 +1300 X-Authentication-Warning: mae.sub.net.nz: Host [12.42.24.23] claimed to be email-prom.net Subject: FWD: Last Biz To Business Disc Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 8BIT X-Mailer: QI03122001MDNZ Message-Id: <gcbinx81s4pg0grx.142o5n3n(a)email-prom.net> Date: Tue, 13 Mar 2001 03:06:31 +0000 Reply-To: md2000nz(a)email-prom.net To: md2000nz(a)email-prom.net You can now access contact data for over 8.5 Million Records. All of them have their own .com .org or .net domain name, making them serious prospects for Internet business. Our data base readily accessible on CD-Rom, list the Names, Contact Information, Physical Address, Phone #, Fax #, SIC Industry Code, URL (Domain Name), and Contact Email Address which you can use to efficiently target companies worldwide. Over 8.5 Million Physical Addresses let you target businesses by Country, State, City, Province, Zip Code, Area Code or by using the SIC Industry Code. The data comes in a Comma-Delimited ASCII format which makes it easy to manipulate and Import/Export records to your Contact-Management, Spreadsheet, analysis and Broadcasting Applications. Please send me more info about: [ ] Master Disc 2000 8.5 Million Records, Cost US$799.00 [ ] Online Updates & Download Access Cost US$199.00 (Annually) [ ] Commercial Email Services & Products Note: Not all records contain complete data, call for breakdowns. For more details on Database, please call: #011-649-360-7038 (International) or fax form below to: #011-649-426-8337 (Make Sure To Mention Reseller Id #1629 When Calling) Company name: ___________________________________________ Web Site Url: ___________________________________________ Contact name: ___________________________________________ Email: __________________________________________________ Phone: __________________________________________________ Fax: ___________________________________________________ Street address: _________________________________________ City, Zip, State: _______________________________________ Country: ________________________________________________ Check the following that apply: _____ Please Notify Me Of Online Web Site & Register Me For Access Using The Information Above. Also Please, Send Additional Information on: _____ Online Adult & Gaming Owner/Operaters _____ Online Adult Subscribers & Online Gamers Databases _____ Online Billing/Credit Card Processing _____ Emailing Services and Databases _____ Search Engine Positioning _____ International Contact Lists _____ Buying / Selling Traffic _____ Web Site Hosting Services _____ Other:_______________________________ ####################################################################### To discontinue receipt of further notice and to be removed from our database, please reply with the word "Remove" in subject. Any attempts to disrupt the removal email address etc., will not allow us to be able to retrieve and process the remove requests. ####################################################################### .031201 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

PIM
by James Tyson 13 Mar '01

13 Mar '01

Can anyone who fires up a pim router on APE or WIX please email me so that I can update the website. Cheers. James Tyson. Self-Deluded Governing Minority, Attica Network Operations. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 4

Re: Telecom - Clear peering bandwidth
by Peter Mott 12 Mar '01

12 Mar '01

> -----Original Message----- > From: Alan Mitford-Taylor [mailto:Alan.Mitford-Taylor(a)telecom.co.nz] > Sent: Wednesday, 7 March 2001 11:52 a.m. > To: peter.mott(a)2day.com > > the planned improvement in the Clear peering bandwidth still awaits > clear's signature on a contract, we have link in place and ready to go > but can not proceed without legal sign off, unfortunately this has been > situation since last October so I don't know when it will be resolved, > but continue to chase it. I guess the same contract is also waiting Telecom's sig Peter Mott Chief Enthusiast 2day.com -/- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

7 7

traffic analysis by protocol
by Craig Anderson 12 Mar '01

12 Mar '01

Hi. I'm looking for off the shelf commercial or otherwise software for monitoring traffic. In particular, i'd like graphs showing the total traffic and the % traffic that is HTTP, SMTP, FTP, etc., and TCP, UDP, ICMP etc. splits. Of course also split by inbound/outbound, remote site location (NZ, International), and local network (i.e. by client of an ISP). Both near real-time data and historical analysis. I've found several protocol analysers that will give real-time and historical graphs by protocol, but don't seem to have any real facilities for breaking this down much further. Does anyone know of where i can find such software? Thanks, -Craig --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

8 9

Mbone pages
by James Tyson 12 Mar '01

12 Mar '01

I have updated: http://mbone.samizdat.co.nz/isps.html Cheers. James Tyson. Self-Deluded Governing Minority, Attica Network Operations. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

nzmbone
by James Tyson 12 Mar '01

12 Mar '01

Hey matey-peeps. Just letting you all know that I am right now listening to a multicast MP3 stream of BFM kindly casted over APE by IHUG (Thanks David). I'm still getting the greeblies out of my multicast routing, but it's getting there. So who else feels like putting up some content? (I was thinking of casting Triangle TV). Cheers. James Tyson. Self-Deluded Governing Minority, Attica Network Operations. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Spammers like Xtra?
by Keith Davidson 06 Mar '01

06 Mar '01

Is anyone else experiencing problems with Xtra failing to take meaningful action against spammers? My ISP has had complaints about an Xtra user, computerkids(a)xtra.co.nz and traditional contact with abuse(a)xtra results in nothing more than slaps over the wrist with wet bus tickets. HISTORY OF UCE FROM Mark Lancaster Nightingale Press 335 Beechey Street, Pirongia Tel/Fax: 07 871 9691 Email computerkidz(a)xtra.co.nz First UCE from him received on 13 February. Complaint lodged abuse(a)xtra. Second UCE received on 18 February. Complaint lodged abuse(a)xtra Third UCE received on 7 March. Actual copy of UCE below sig. My complainant states: "I then rang Xtra (finally got through to Customer Support desk) and advised that I wished to verbally complain about one of their customers spamming and that I had laid complaints on two occasions and seemingly no action had been taken. The person on their help desk took the email address of the spammer and then advised me that this person had had two warnings and I should email abuse(a)xtra again. I said that was not satisfactory and wondered how many warnings one of their users had to get before any action was taken by xtra. The Help Desk clerk said he would check and put me on hold for a few minutes. When he came back he advised me that quite a number of warnings had to be issued before any action was taken. He suggested I filter the perpetrator and I told him that that didn't fix the problem. He asked if there was anything abusive or rude in the email and I advised that whilst there was nothing along those lines that I personally found uce offensive. He advised me to lodge a further complaint with abuse(a)xtra.co.nz and I told him that I had warned xtra on a previous occasion that if no action was forthcoming to solve the problem that I intended to take the matter further." Does anyone in Xtra take these issues seriously? It is just nonsensical for Xtra staff to suggest filtering etc - it doesn't stop the source. Is the $25 per month so important to Xtra's revenue that they wont take real action? Or does Xtra like being known as a "spam friendly" ISP? Most ISP's seem to work on "2 strikes and you're out", mine included. Just what does it take for Xtra to kick someone? Anyone else having similar problems from this quarter? Any suggestions of a method of escalating the issue that might get a resolution? Keith Davidson ________________________________________________ Return-Path: <computerkidz(a)xtra.co.nz> Received: from mta1-rme.xtra.co.nz (mta1-rme.xtra.co.nz [203.96.92.1]) by kiwi.wise.net.nz (8.9.3/8.9.3/Debian/GNU) with ESMTP id KAA32673 for <office(a)wairarapa.school.nz>; Wed, 7 Mar 2001 10:15:02 +1300 Received: from marklanc ([210.54.202.229]) by mta1-rme.xtra.co.nz with SMTP id <20010306211551.EQOL2261674.mta1-rme.xtra.co.nz(a)marklanc>; Wed, 7 Mar 2001 10:15:51 +1300 From: "Mark Lancaster" <computerkidz(a)xtra.co.nz> To: <computerkidz(a)xtra.co.nz> Subject: PLEASE FORWARD THIS TO THE MATHS DEPT. - THANK YOU Date: Wed, 7 Mar 2001 10:10:19 +1300 Message-ID: <NCBBJGLIOPJEFADAPBMEIEANIJAA.computerkidz(a)xtra.co.nz> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0014_01C0A6EE.D1102F60" X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 X-UIDL: +lP!!HH!#!/9d!!D:("! This is a multi-part message in MIME format. ------=_NextPart_000_0014_01C0A6EE.D1102F60 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Nightingale Press 335 Beechey Street, Pirongia Tel/Fax: 07 871 9691 Hi I would just like to tell you about a new series of Blackline Masters we have just released called "MATHS OUTCOMES". The strands they cover throughout the series are - SPACE, MEASUREMENT, NUMBER and WORKING MATHEMATICALLY. There are 7 books in the series starting from Kindy (early stage 1) right through to Upper Primary levels. Each book contains 53 pages of photocopiable worksheets covering all the above topics. All the activities in this set of Blackline Masters are used to support lessons introduced by the teacher in class. The work presented on each page has been carefully designed to provide a different approach to maths by involving memory games , matching activities and it allows the child to offer reasoning for their answers and choices. It is designed to help children understand, consolidate and extend concepts and skills. The price is $29.95 per book and they are all available on approval. If you would like to order any (or all) of the books in this superb series, please just return this email stating copies required, the name and address of your school and any order numbers, or you could order by fax/phone. Many thanks for taking the time to read this email. Mark ------=_NextPart_000_0014_01C0A6EE.D1102F60 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <snip endless html rubbish> --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

NLX PSU's
by Matt Camp 06 Mar '01

06 Mar '01

Might be slightly off topic, but does anyone know where to source power supplies for NLX type PC cases? Insite used to have them, but since their merger with Renaissance, have obsoleted the product line. --- Matt Camp --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Telecom Peering
by Tony Wicks 05 Mar '01

05 Mar '01

Hi all, I have been chasing my Telecom account Manager for months to get some progress on this, so I thought I would throw it out here and see where every one else is with this. We currently peer with all major ISP's and backbone providors over either or both WIX and APE. The notable exception being Telecom Netgate ( we do peer directly with Xtra on WIX ). We are paying Telecom currently for a PVC to Netgate for peering with them and I am unhappy for this to continue. ( especially as we have almost twice the outgoing traffic to them as we recieve from them ! ). I have had nothing more than "I'll get back to you" when attempting to initiate peering with Telecom ( not Xtra ). It seems very strange to me that Clear, Telstra and everyone else is responsive and happy to work for the greater good of the Internet users in the country, but Telecom only seems interested if someone else is paying for it. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 7

www.apnic.net
by Tony Wicks 04 Mar '01

04 Mar '01

Can anyone get to this website at the moment ? I can't seem to make a connection ( apart from cached objects ) from NZ, AU or the US to the site. kappa:staff/tonyw 4:45pm > dig www.apnic.net ; <<>> DiG 8.3 <<>> www.apnic.net ;; res options: init recurs defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 6 ;; QUERY SECTION: ;; www.apnic.net, type = A, class = IN ;; ANSWER SECTION: www.apnic.net. 30m36s IN A 203.37.255.97 ;; AUTHORITY SECTION: apnic.net. 30m36s IN NS ns.apnic.net. apnic.net. 30m36s IN NS svc00.apnic.net. apnic.net. 30m36s IN NS ns.ripe.net. apnic.net. 30m36s IN NS rs.arin.net. ;; ADDITIONAL SECTION: ns.apnic.net. 1h5m19s IN A 203.37.255.97 ns.apnic.net. 30m36s IN AAAA ::ffff:203.37.255.97 svc00.apnic.net. 1d18h6m27s IN A 202.12.28.131 svc00.apnic.net. 30m36s IN AAAA ::ffff:202.12.28.131 ns.ripe.net. 1d9h57m19s IN A 193.0.0.193 rs.arin.net. 1d18h6m27s IN A 192.149.252.21 ;; Total query time: 35 msec ;; FROM: kappa to SERVER: default -- 205.201.44.9 ;; WHEN: Sun Mar 4 16:45:14 2001 ;; MSG SIZE sent: 31 rcvd: 248 kappa:staff/tonyw 4:45pm > traceroute 203.37.255.97 traceroute to 203.37.255.97 (203.37.255.97), 30 hops max, 40 byte packets 1 master-gw.lm.net (205.201.1.1) 24.433 ms 19.029 ms 4.986 ms 2 263.ATM1-0.GW5.PIT1.alter.net (157.130.22.193) 516.424 ms 453.962 ms 502.864 ms 3 539.at-2-0-0.XR2.DCA1.ALTER.NET (152.63.38.178) 33.179 ms 25.498 ms 13.896 ms 4 294.at-7-1-0.XR2.DCA8.ALTER.NET (146.188.163.26) 22.794 ms 28.986 ms 25.275 ms 5 POS7-0.BR5.DCA8.ALTER.NET (152.63.37.45) 9.957 ms 10.352 ms 12.454 ms 6 137.39.52.158 (137.39.52.158) 429.94 ms 552.788 ms 521.643 ms 7 so-3-0-0.washdc3-nbr1.bbnplanet.net (4.24.4.169) 105.349 ms 188.541 ms 155.406 ms 8 so-7-0-0.washdc3-nbr2.bbnplanet.net (4.24.10.30) 134.572 ms 190.48 ms 183.578 ms 9 p9-0.phlapa1-br2.bbnplanet.net (4.24.10.186) 154.443 ms 135.832 ms 139.77 ms 10 p15-0.phlapa1-br1.bbnplanet.net (4.24.10.89) 476.805 ms 521.494 ms 458.769 ms 11 p13-0.nycmny1-nbr2.bbnplanet.net (4.24.10.178) 36.583 ms 34.301 ms 14.657 ms 12 p15-0.nycmny1-nbr1.bbnplanet.net (4.24.10.209) 492.356 ms 481.979 ms 427.66 ms 13 p4-0.snjpca1-br1.bbnplanet.net (4.24.9.157) 141.027 ms 100.905 ms 105.643 ms 14 p10-0.lsanca2-br1.bbnplanet.net (4.24.8.26) 510.23 ms 562.834 ms 580.358 ms 15 p15-0.lsanca2-br2.bbnplanet.net (4.24.5.46) 549.424 ms 535.577 ms 563.447 ms 16 p1-0.lsanca1-cr9.bbnplanet.net (4.24.5.202) 558.399 ms 468.532 ms 507.453 ms 17 p0-0.telstra4.bbnplanet.net (4.24.206.42) 137.123 ms 203.719 ms 207.281 ms 18 Pos2-3.pad-core3.Sydney.telstra.net (203.50.126.45) 749.915 ms 654.554 ms 735.379 ms 19 GigabitEthernet4-1.chw-core2.Sydney.telstra.net (203.50.6.201) 612.906 ms 660.024 ms 715.141 ms 20 Pos2-0.cha-core4.Brisbane.telstra.net (203.50.6.118) 357.183 ms 262.34 ms 264.331 ms 21 GigabitEthernet4-0.cha-core3.Brisbane.telstra.net (203.50.45.1) 307.158 ms 318.389 ms 412.24 ms 22 Fddi0-0.cha8.Brisbane.telstra.net (139.130.247.230) 349.427 ms 305.048 ms 260.397 ms 23 apnic1.lnk.telstra.net (139.130.64.98) 835.272 ms 726.571 ms 770.458 ms 24 ns.apnic.net (203.37.255.97) 711.432 ms 782.982 ms 735.846 ms kappa:staff/tonyw 4:46pm > lynx www.apnic.net Alert!: Unable to connect to remote host. lynx: Can't access startfile http://www.apnic.net/ kappa:staff/tonyw 4:48pm > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 5

The New Zealand Network Operators' Group
by Donald Neal 01 Mar '01

01 Mar '01

The New Zealand Network Operators' Group The New Zealand Network Operators' Group (NZNOG) has no king, president or formal membership. At present it consists of the subscribers to this mailing list, which anyone is free to join. This list has just over 210 subscribers, growing by a handful each month. The NZNOG mailing list is provided through a server at The University of Waikato, and is administered by an employee of Telecom NZ Ltd. Neither of these organisations (nor the administrator) is responsible for its content. NZNOG Mailing List Acceptable Use Policy The NZNOG mailing list exists to provide a forum for the exchange of technical information and the discussion of implementation issues that require cooperation among New Zealand network service providers. In order to continue to provide a useful forum for discussion of relevant technical issues, users of the list are asked to respect the following guidelines. 1. Discussion will focus on Internet operational and technical issues. 2. Discussion related to meetings of network service providers is appropriate. 3. Discussion unrelated to these topics is not appropriate. 4. Postings to multiple mailing lists are discouraged. 5. Postings that include foul language, character assassination, and lack of respect for other participants are unacceptable. 6. Blatant product or service marketing is unacceptable. 7. Postings of a political, philosophical or legal nature are discouraged. 8. Postings to the list should be in ASCII or MIME encoded as text/plain. Attachments should not be sent to the list. To present a document, a suitable URL may be referred to. For documents of general interest, the use of proprietary file formats is discouraged. 9. Breaches of list etiquette should be dealt with privately with the offending list user, and should not result in complaints being sent to the list. Mailing List Archives A full archive is available at http://list.waikato.ac.nz/archives/nznog/ To search the archive, see http://list.waikato.ac.nz/archives/search.html (and remember to select nznog). Subscribing to the List To subscribe to the NZNOG list, send email to majordomo(a)list.waikato.ac.nz, where the body of the message reads subscribe nznog There are at present no restrictions on who may subscribe to the list, or even on who may post to the list. Digest Mailing List If you don't wish to receive postings as they are sent, you can instead subscribe to the nznog-digest mailiing list, on which all postings are sent out in a single "digest" every couple of days. Other Activities NZNOG does not at present have other regular activities than this mailing list, though the administrator is on the hunt for presenters for the annual Uniforum NZ conference, to be held in the second half of the year. Donald Neal NZNOG Mailing List Owner/Administrator/Muggins --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Reminder: SRS Green Paper Closes Tomorrow
by Sue Leader 01 Mar '01

01 Mar '01

Greetings Just a reminder that submissions for the SRS Green Paper close at 5pm tomorrow Friday March 2. Submissions should be sent direct to exe.dir(a)isocnz.org.nz. Cheers Sue Sue Leader - Executive Director ISOCNZ (Internet Society of New Zealand Inc) Exe.Dir(a)isocnz.org.nz Voice: +64-4-801-6256 http://www.isocnz.org.nz PLEASE NOTE CHANGE: P.O.Box 11-881, Wellington --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

NZ Network List
by Pete 01 Mar '01

01 Mar '01

Hiyas Does anyone on here keep an up-to-date list of IP networks that are considered to be 'inside NZ'. Ie some carriers charge for International traffic but not National and I was wondering if anyone had a list of what is considered 'National' ? Rgds, Pete Pete Mundy - Technician Advanced Communications +64-3-546-9169 / +64-25-480-840 E-Mail: Pete(a)AdvComm.Co.NZ --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

Cisco IOS Advisory
by Roger De Salis 27 Feb '01

27 Feb '01

Here is the official word... - We all agree that ATM is evil (thanks to Chris Wedgewood for those thoughts) and Arron agrees that he won't let Dean wind him up over the respective merits of the larger C and J boxes. (and they promise to conduct this meaningful dialog off-line) >Sender: nobody(a)cisco.com >From: Cisco Systems Product Security Incident Response Team <psirt(a)cisco.com> >To: internal-security-announce(a)cisco.com >Cc: psirt(a)cisco.com >Subject: Cisco Security Advisory: Cisco IOS Software SNMP Read-Write > ILMI Community String Vulnerability >Date: Tuesday, 27 Feb 2001 04:00:00 -0500 (EST) > > Cisco IOS Software SNMP Read-Write ILMI Community String Vulnerability > Revision 1.0: INTERIM > For Public Release 2001 February 27 04:00 US/Eastern (UTC+0500) > _______________________________________________________________ > >Summary > > Cisco IOS software releases based on versions 11.x and 12.0 contain > a defect that allows a limited number of SNMP objects to be viewed > and modified without authorization using a undocumented ILMI > community string. Some of the modifiable objects are confined to the > MIB-II system group, such as "sysContact", "sysLocation", and > "sysName", that do not affect the device's normal operation but that > may cause confusion if modified unexpectedly. The remaining objects > are contained in the LAN-EMULATION-CLIENT and PNNI MIBs, and > modification of those objects may affect ATM configuration. An > affected device might be vulnerable to a denial-of-service attack if > it is not protected against unauthorized use of the ILMI community > string. > > The vulnerability is only present in certain combinations of IOS > releases on Cisco routers and switches. ILMI is a necessary > component for ATM, and the vulnerability is present in every IOS > release that contains the supporting software for ATM and ILMI > without regard to the actual presence of an ATM interface or the > physical ability of the device to support an ATM connection. > > To remove this vulnerability, Cisco is offering free software > upgrades for all affected platforms. The defect is documented in > DDTS record CSCdp11863. > > In lieu of a software upgrade, a workaround can be applied to > certain IOS releases by disabling the ILMI community or "*ilmi" view > and applying an access list to prevent unauthorized access to SNMP. > Any affected system, regardless of software release, may be > protected by filtering SNMP traffic at a network perimeter or on > individual devices. > > This notice will be posted at > http://www.cisco.com/warp/public/707/ios-snmp-ilmi-vuln-pub.shtml. > >Affected Products > > The vulnerability is present only in certain releases of Cisco IOS > Software versions 11.x and 12.0 for router and switch products that > include support for Asynchronous Transfer Mode (ATM) networking and > Interim Local Management Interface (ILMI), and it is present without > regard to any physical capability for supporting an ATM interface. > > Cisco IOS Software versions based on 10.3 and earlier do not contain > the vulnerability. The defect was introduced in 11.0(0.2). All Cisco > IOS software releases of 12.1 and later have been repaired and are > not vulnerable to the defect described in this advisory. > > To determine the software running on a Cisco product, log in to the > device and issue the command "show version" to display the system > banner. Cisco IOS software will identify itself as "Internetwork > Operating System Software" or simply "IOS (tm)". The image name will > be displayed between parentheses, usually on the next line of > output, followed by "Version" and the IOS release name. Other Cisco > devices will not have the "show version" command or will give > different output. > > The following example identifies a Cisco product running IOS release > 12.0(3) with an installed image name of C2500-IS-L: > > Cisco Internetwork Operating System Software IOS (tm) > 2500 Software (C2500-IS-L), Version 12.0(3), RELEASE SOFTWARE > > The device is not vulnerable to the defect described in this > advisory since the model 2500 router is specifically excluded in the > list of unaffected products shown below. > > Cisco devices that may be running an affected IOS software release > include, but are not limited to: > > * Cisco 1400 and 1700 series. > > * Cisco 2600 (except that c2600-c-mz, c2600-d-mz, c2600-i-mz, > c2600-io3-mz, and c2600-ix-mz images are not vulnerable). > > * Catalyst 2900 ATM, 2900XL, and 2948g series. > > * Cisco 3620 (except that c3620-d-mz, c3620-i-mz, c3620-io3-mz, > and c3620-ix-mz images are not vulnerable). > > * Cisco 3640 (except that c3640-d-mz, c3640-i-mz, c3640-io3-mz, > and c3640-ix-mz images are not vulnerable). > > * Cisco 3660 (except that c3660-d-mz, c3660-i-mz, and c3660-ix-mz > images are not vulnerable). > > * Cisco MC3810 (except that mc3810-i-mz, mc3810-is-mz, > mc3810-is56i-mz, and mc3810-js-mz images are not vulnerable). > > * Catalyst 4232, 4840g, 5000 RSFC series switches. > > * Cisco 4500, 4700, and 5800 DSC series. > > * Cisco 6200, 6400 NRP, and 6400 NSP series. > > * Catalyst MSM (c6msm), 6000 Hybrid Mode (c6msfc), and 6000 Native > Mode (c6sup). > > * Cisco RSM, 7000, 7010, 7100, 7200, ubr7200, and 7500 series. > > * Catalyst 8510CSR, 8510MSR, 8540CSR, and 8540MSR series. > > * Cisco 10000 ESR and 12000 GSR series. > > * LS1010 and Cisco 6260-NI2. > > * DistributedDirector (except that igs-w3 images are not > vulnerable). > > Cisco products that are not affected by this vulnerability either > because they have no support for ATM and ILMI, or because they do > not run IOS include, but are not limited to: > > * Catalyst ATM blade (runs possibly affected code, but an SNMP > connection to the blade is not possible). > > * Cisco 800 and 805 series. > > * Cisco Universal Broadband Routers ubr900 and ubr920. > > * Cisco 1003, 1004, and 1005 series. > > * Cisco 1600, 2500, 2800, 4000 series. > > * Cisco 2500 Fixed Frad. > > * Cisco 3800 (not to be confused with MC3810). > > * Cisco 5100, 5200, and 5300 series access servers. > > * Catalyst 6000 Supervisor Module. > > * Cisco PIX Firewall. > > * Aironet and Cisco/Aironet wireless products. > > * CS11000, Cache Engine, LocalDirector, and network scaling > products (except that the Distributed Director might be > affected). > > * VPN products such as Altiga concentrators. > > * Host-based network management or access management products. > > * Cisco IP Telephony and telephony management software (except > those that are hosted on a vulnerable IOS platform). > > * Voice gateways and convergence platforms (except those that are > hosted on a vulnerable IOS platform). > > * Optical switch products such as the ONS 15000 series. > >Details > > ILMI (Interim Local Management Interface) is an independent industry > standard used for configuration of ATM (Asynchronous Transfer Mode) > interfaces. The standard specifies the use of mechanisms and formats > previously defined by SNMP (Simple Network Management Protocol). > Although it is based on SNMP, ILMI communication actually occurs > using a transport other than IP (Internet Protocol) that traverses > only the physical ATM link. ILMI is essential to functions such as > ATM auto-discovery and LANE (LAN Emulation). > > SNMP "objects" are variables that are organized into a MIB > (Management Information Base). The MIB has a tree structure and > contains both operational (read-only) data as well as configuration > (read-write) options. By specifying a community string of "ILMI" in > an SNMP request, access can be obtained to read the objects in three > specific parts of the overall management tree structure on any > device affected by this vulnerability: the MIB-II system group, the > LAN-EMULATION-CLIENT MIB, and the PNNI (Private Network-to-Network > Interface) MIB. A subset of objects in each part can be modified > using the same "ILMI" community string. > > The MIB-II system group contains basic information about the device > itself. The number of objects that can be modified is limited. > Examples include: > > * system.sysContact: The contact information for the person or > organization responsible for managing the device. > > * system.sysLocation: A description of the physical location where > the device is installed or operating. > > * system.sysName: The hostname of the device, how it identifies > itself at the console prompt. (This might not be the same name > by which the device is known to other hosts on the network.) > > Most of the objects in the system MIB are read-only and cannot be > changed via SNMP, such as the time elapsed since the previous > restart and textual descriptions of the device's hardware and > software. > > Numerous objects can be viewed in the LAN-EMULATION-CLIENT MIB and > PNNI MIB, and modification of some of the read-write objects can > have an affect on ATM operation of the device. The objects in the > LAN-EMULATION-CLIENT MIB can only be viewed or modified if LANE has > already been configured on the device. > > Access to SNMP in Cisco IOS software can be limited by applying > access control lists (ACLs), by modifying or removing the SNMP view, > by removing the community string from the running configuration, or > by disabling the SNMP service. Any SNMP query that does not meet the > criteria for access is promptly discarded when such protective > measures are in place. If a query does meet the criteria for access, > then a response is formulated and sent. > > It is possible to configure the device so that the ILMI community > string is unavailable in all IOS 11.1 and higher releases. The > particular method selected to accomplish this depends on the > specific IOS release and configuration. > > This defect is documented as CSCdp11863. The vulnerability is > repaired by imposing a test such that an SNMP request using the > "ILMI" community string will only be recognized if it has been > transported by ILMI. > > ATM functionality was added in various 10.x releases of Cisco IOS > software. However, the function containing the defect was introduced > when support for ILMI and other ATM features was added in IOS > release 11.0(0.2). Therefore, all prior releases are not vulnerable. > >Impact > > If SNMP requests can be received by an affected device, then certain > MIB objects can be viewed without proper authorization, causing a > violation of confidentiality. > > A subset of the readable MIB objects can be modified without > authorization to cause a failure of integrity. For example, the > hostname can be modified so as to confuse network adminstrators, or > the contact and location information could be changed with a goal of > disrupting operations or embarassing whoever is responsible for the > device. > > Objects in the LAN-EMULATION-CLIENT and PNNI MIBs can be viewed and > modified, thus resulting in changes to the operation of ATM > functions. If ATM is in use on the device, this may result in a > failure of availability. > > Any affected device that is not otherwise protected against the > receipt of SNMP packets is vulnerable to a denial-of-service (DoS) > attack by flooding the SNMP port with read or write requests. > >Software Versions and Fixes > > The following table summarizes the known affected Cisco IOS software > releases and the earliest estimated dates of availability for fixed > releases. All dates are tentative and subject to change. > > Each row of the table describes a release train and the platforms or > products for which it is intended. If a given release train is > vulnerable, then the earliest possible releases that contain the fix > and the anticipated date of availability for each are listed in the > "Rebuild", "Interim", and "Maintenance" columns. If a device is > running an earlier release that is known to be vulnerable, it should > be upgraded to at least the indicated version. > > When selecting a release, keep in mind the following definitions: > > Maintenance > Most heavily tested and highly recommended release of any > label in a given row of the table. > > Rebuild > Constructed from the previous maintenance or major release in > the same train, it contains the fix for a specific defect. > Although it receives less testing, it contains only the > minimal changes necessary to effect the repair. > > Interim > Built at regular intervals between maintenance releases and > receive less testing. Interims should be selected only if > there is no other suitable release that addresses the > vulnerability. Interim releases are usually not available for > customer download via CCO without prior arrangement. > > In all cases, customers should exercise caution to be certain the > devices to be upgraded contain sufficient memory and that current > hardware and software configurations will continue to be supported > properly by the new release. If the information is not clear, > contact the Cisco TAC for assistance as shown in the following > section. > > More information on IOS release names and abbreviations is available > at http://www.cisco.com/warp/public/620/1.html. > > +===========================================================================+ > | Train | Description of | Availability of Fixed Releases* | > | | Image or Platform | | > +===========================================================================+ > | 10.3-based Releases and | | | | > | Earlier | Rebuild | Interim** | Maintenance | > +===========================================================================+ > | 10.3 and | | | > | earlier |All |Not affected | > +===========================================================================+ > | 11.0-based Releases | Rebuild | Interim** | Maintenance | > +===========================================================================+ > | | |11.0(22a) | | | > | 11.0 |Major GD release | | | | > | |for all platforms |2001-Mar-05 | | | > +===========================================================================+ > | 11.1-based Releases | Rebuild | Interim** | Maintenance | > +===========================================================================+ > | | |11.1(24a) | | | > | 11.1 |Major release for | | | | > | |all platforms |2001-Mar-05 | | | > +----------+-------------------+------------+---------------+---------------+ > | |ED release for | | |12.1(7) | > | 11.1AA |access servers: | | | | > | |1600, 3200, and | | | | > | |5200 series. | | |2001-Feb-26 | > +----------+-------------------+------------+---------------+---------------+ > | |Platform-specific |11.1(36)CA1 | | | > | 11.1CA |support for 7500, | | | | > | |7200, 7000, and RSP|2001-Mar-02 | | | > +----------+-------------------+------------+---------------+---------------+ > | |ISP train: added | | | | > | |support for FIB, |11.1(36)CC1 | | | > | 11.1CC |CEF, and NetFlow on| | | | > | |7500, 7200, 7000, |2001-Mar-02 | | | > | |and RSP | | | | > +----------+-------------------+------------+---------------+---------------+ > | |Added support for |12.0(11)ST2 | | | > | 11.1CT |Tag Switching on | | | | > | |7500, 7200, 7000, | | | | > | |and RSP |2001-Feb-26 | | | > +----------+-------------------+------------+---------------+---------------+ > | | |11.1(28)IA1 | | | > | 11.1IA |DistributedDirector| | | | > | |only |2001-Feb-26 | | | > +===========================================================================+ > | 11.2-based Releases | Rebuild | Interim** | Maintenance | > +===========================================================================+ > | | |11.2(25a) | | | > | 11.2 |Major release, | | | | > | |general deployment |2001-Mar-05 | | | > +----------+-------------------+------------+---------------+---------------+ > | |Platform-specific | | | | > | |support for IBM | | |12.1(7) | > | 11.2BC |networking, CIP, | | | | > | |and TN3270 on 7500,| | |2001-Feb-26 | > | |7000, and RSP | | | | > +----------+-------------------+------------+---------------+---------------+ > | |Early deployment |12.0(15)S1 | | | > | 11.2GS |release to support | | | | > | |12000 GSR |2001-Feb-20 | | | > +----------+-------------------+------------+---------------+---------------+ > | | |11.2(25a)P | | | > | 11.2P |New platform | | | | > | |support |2001-Mar-05 | | | > +----------+-------------------+------------+---------------+---------------+ > | | | | |12.1WC | > | 11.2SA |Catalyst 2900XL | | | | > | |switch only | | |2001-Apr-12 | > +----------+-------------------+------------+---------------+---------------+ > | | | | |12.0(10)W5(18c)| > | 11.2WA3 |LS1010 ATM switch | | | | > | | | | |Available | > +----------+-------------------+------------+---------------+---------------+ > | | |11.2(25a)P | | | > |11.2(4)XA |Initial release for| | | | > | |the 1600 and 3600 |2001-Mar-05 | | | > +----------+-------------------+------------+---------------+---------------+ > | |Initial release for| | | | > | |the 5300 and |11.2(9)XA1 | | | > |11.2(9)XA |digital modem | | | | > | |support for the |Unscheduled | | | > | |3600 | | | | > +===========================================================================+ > | 11.3-based Releases | Rebuild | Interim** | Maintenance | > +===========================================================================+ > | | |11.3(11b) | | | > | 11.3 |Major release for | | | | > | |all platforms |2001-Mar-05 | | | > +----------+-------------------+------------+---------------+---------------+ > | |ED for dial | | | | > | |platforms and |11.3(11a)AA | | | > | 11.3AA |access servers: | | | | > | |5800, 5200, 5300, |2001-Mar-05 | | | > | |7200 | | | | > +----------+-------------------+------------+---------------+---------------+ > | |Early deployment |12.1(5)DA1 | | | > | 11.3DA |train for ISP DSLAM| | | | > | |6200 platform |2001-Feb-28 | | | > +----------+-------------------+------------+---------------+---------------+ > | |Early deployment | | | | > | |train for |12.1(4)DB1 | | | > | |ISP/Telco/PTT xDSL | | | | > | 11.3DB |broadband | | | | > | |concentrator | | | | > | |platform, (NRP) for|2001-Feb-26 | | | > | |6400 | | | | > +----------+-------------------+------------+---------------+---------------+ > | |Short-lived ED | | > | 11.3HA |release for ISR |Not Vulnerable | > | |3300 (SONET/SDH | | > | |router) | | > +----------+-------------------+------------+---------------+---------------+ > | | |11.3(1)MA8 | | | > | 11.3MA |MC3810 | | | | > | |functionality only |Unscheduled | | | > +----------+-------------------+------------+---------------+---------------+ > | |Voice over IP, |12.1(7) | | | > | 11.3NA |media convergence, | | | | > | |various platforms |2001-Mar-05 | | | > +----------+-------------------+------------+---------------+---------------+ > | |Early deployment |11.3(11b)T1 | | | > | 11.3T |major release, | | | | > | |feature-rich for | | | | > | |early adopters |2001-Mar-05 | | | > +----------+-------------------+------------+---------------+---------------+ > | |Multilayer | | | | > | |Switching and | | |12.0(14)W5(20) | > | |Multiprotocol over | | | | > | 11.3WA4 |ATM functionality | | | | > | |for Catalyst 5000 | | | | > | |RSM, 4500, 4700, | | |2001-Feb-28 | > | |7200, 7500, LS1010 | | | | > +----------+-------------------+------------+---------------+---------------+ > | | |11.3(11b)T1 | | | > |11.3(2)XA |Introduction of | | | | > | |ubr7246 and 2600 |2001-Mar-05 | | | > +===========================================================================+ > | 12.0-based Releases | Rebuild | Interim** | Maintenance | > +===========================================================================+ > | |General deployment | |12.0(7.1) |12.0(16) | > | 12.0 |release for all | | | | > | |platforms | |Available |2001-Feb-20 | > +----------+-------------------+------------+---------------+---------------+ > | | | |12.0(7.1)T | | > | 12.0DA |xDSL support: 6100,| | | | > | |6200 | |Available | | > +----------+-------------------+------------+---------------+---------------+ > | |ISP/Telco/PTT xDSL |12.1(4)DB1 | | | > | 12.0DB |broadband | | | | > | |concentrator | | | | > | |platforms |2001-Feb-26 | | | > +----------+-------------------+------------+---------------+---------------+ > | | |12.1(4)DC2 | | | > | 12.0DC |6400 Access | | | | > | |Concentrator |2001-Feb-26 | | | > +----------+-------------------+------------+---------------+---------------+ > | | |12.0(15)S1 | | | > | 12.0S |Core/ISP support: | | | | > | |GSR, RSP, c7200 |2001-Feb-20 | | | > +----------+-------------------+------------+---------------+---------------+ > | | |12.0(15)SC1 | | | > | 12.0SC |Cable/broadband | | | | > | |ISP: ubr7200 |2001-Feb-26 | | | > +----------+-------------------+------------+---------------+---------------+ > | | |12.0(14)SL1 | | | > | 12.0SL |10000 ESR: c10k | | | | > | | |2001-Feb-26 | | | > +----------+-------------------+------------+---------------+---------------+ > | |General deployment |12.0(11)ST2 | | | > | 12.0ST |release for all | | | | > | |platforms |2001-Feb-26 | | | > +----------+-------------------+------------+---------------+---------------+ > | | |12.1(5c)E8 | | | > | 12.0SX |Early Deployment | | | | > | |(ED) |2001-Feb-26 | | | > +----------+-------------------+------------+---------------+---------------+ > | |Early | | | | > | |Deployment(ED): | | |12.1(7) | > | 12.0T |VPN, Distributed | | | | > | |Director, various | | |2001-Feb-26 | > | |platforms | | | | > +----------+-------------------+------------+---------------+---------------+ > | |cat8510c, cat8540c,| | | | > | |ls1010, cat8510m, | |12.0(10)W5(18c)|12.0(14)W5(20) | > | |cat8540m, c5atm, | | | | > | |c5atm, c3620, | | | | > | |c3640, c4500, | | | | > | 12.0W5 |c5rsfc, c5rsm, | |Available |2001-Feb-28 | > | |c7200, rsp, | | | | > | |cat2948g, cat4232 | | | | > | +-------------------+------------+---------------+---------------+ > | | | |12.0(10)W5(18d)|12.0(14)W5(20) | > | |c6msm | | | | > | | | |Available |2001-Feb-28 | > +----------+-------------------+------------+---------------+---------------+ > | |General deployment | | |12.0(13)WT6(1) | > | 12.0WT |release for all | | | | > | |platforms | | |2001-Feb-20 | > +----------+-------------------+------------+---------------+---------------+ > | |Early Deployment | | |12.1(7) | > | 12.0XA |(ED): limited | | | | > | |platforms | | |2001-Feb-26 | > +----------+-------------------+------------+---------------+---------------+ > | | | | |12.1(7) | > | 12.0XB |Short-lived early | | | | > | |deployment release | | |2001-Feb-26 | > +----------+-------------------+------------+---------------+---------------+ > | |Early Deployment | | |12.1(7) | > | 12.0XC |(ED): limited | | | | > | |platforms | | |2001-Feb-26 | > +----------+-------------------+------------+---------------+---------------+ > | |Early Deployment | | |12.1(7) | > | 12.0XD |(ED): limited | | | | > | |platforms | | |2001-Feb-26 | > +----------+-------------------+------------+---------------+---------------+ > | |Early Deployment |12.1(5c)E8 | | | > | 12.0XE |(ED): limited | | | | > | |platforms |2001-Feb-26 | | | > +----------+-------------------+------------+---------------+---------------+ > | |Early Deployment | | |12.1(7) | > | 12.0XF |(ED): limited | | | | > | |platforms | | |2001-Feb-26 | > +----------+-------------------+------------+---------------+---------------+ > | |Early Deployment | | |12.1(7) | > | 12.0XG |(ED): limited | | | | > | |platforms | | |2001-Feb-26 | > +----------+-------------------+------------+---------------+---------------+ > | |Early Deployment |12.0(4)XH5 | | | > | 12.0XH |(ED): limited | | | | > | |platforms |2001-Mar-05 | | | > +----------+-------------------+------------+---------------+---------------+ > | |Early Deployment | | |12.1(7) | > | 12.0XI |(ED): limited | | | | > | |platforms | | |2001-Feb-26 | > +----------+-------------------+------------+---------------+---------------+ > | |Early Deployment | | |12.1(7) | > | 12.0XJ |(ED): limited | | | | > | |platforms | | |2001-Feb-26 | > +----------+-------------------+------------+---------------+---------------+ > | |Early Deployment |12.0(7)XK4 | | | > | 12.0XK |(ED): limited | | | | > | |platforms |Unscheduled | | | > +----------+-------------------+------------+---------------+---------------+ > | |Early Deployment |12.0(4)XH5 | | | > | 12.0XL |(ED): limited | | | | > | |platforms |2001-Mar-05 | | | > +----------+-------------------+------------+---------------+---------------+ > | | | | |12.1(7) | > | 12.0XM |Short-lived early | | | | > | |deployment release | | |2001-Feb-26 | > +----------+-------------------+------------+---------------+---------------+ > | |Early Deployment | | | | > | 12.0XN |(ED): limited | | | | > | |platforms | | | | > +----------+-------------------+------------+---------------+---------------+ > | |Early Deployment | | |12.1WC | > | 12.0XP |(ED): limited | | | | > | |platforms | | |2001-Apr-12 | > +----------+-------------------+------------+---------------+---------------+ > | | | | |12.1(7) | > | 12.0XQ |Short-lived early | | | | > | |deployment release | | |2001-Feb-26 | > +----------+-------------------+------------+---------------+---------------+ > | | |12.1(5)T5 | | | > | 12.0XR |Short-lived early | | | | > | |deployment release |2001-Mar-05 | | | > +----------+-------------------+------------+---------------+---------------+ > | | |12.1(5c)E8 | | | > | 12.0XS |Short-lived early | | | | > | |deployment release |2001-Feb-26 | | | > +----------+-------------------+------------+---------------+---------------+ > | |Early Deployment | | |12.1WC | > | 12.0XU |(ED): limited | | | | > | |platforms | | |2001-Apr-12 | > +----------+-------------------+------------+---------------+---------------+ > | | |12.1(5)T5 | | | > | 12.0XV |Short-lived early | | | | > | |deployment release |2001-Mar-05 | | | > +===========================================================================+ > |12.1-based and Later Releases | Rebuild | Interim** | Maintenance | > +===========================================================================+ > | All 12.1 | | | > | Releases |Various platforms |Not Vulnerable | > +===========================================================================+ > | Notes | > +===========================================================================+ > | * All dates are estimated and Subject to change. | > | | > |** Interim releases are subjected to less rigorous testing than regular | > | maintenance releases, and may have serious bugs. | > +===========================================================================+ > >Obtaining Fixed Software > > Cisco is offering free software upgrades to remedy this > vulnerability for all affected customers. Customers with service > contracts may upgrade to any software release. Customers without > contracts may upgrade only within a single row of the table above, > except that any available fixed software release will be provided to > any customer who can use it and for whom the standard fixed software > release is not yet available. Customers may install only the feature > sets they have purchased. > > Note that not all fixed software may be available as of the release > date of this notice. > > Customers with contracts should obtain upgraded software through > their regular update channels. For most customers, this means that > upgrades should be obtained via Cisco's Software Center at > http://www.cisco.com/. > > Customers without contracts or warranty should get their upgrades by > contacting the Cisco Technical Assistance Center (TAC) as shown > below: > * (800) 553-2447 (toll-free in North America) > * +1 408 526 7209 (toll call from anywhere in the world) > * e-mail: tac(a)cisco.com > > See http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for > additional TAC contact information, including instructions and > e-mail addresses for use in various languages. > > Give the URL of this notice as evidence of your entitlement to a > free upgrade. Free upgrades for non-contract customers must be > requested through the TAC. Please do not contact either > "psirt(a)cisco.com" or "security-alert(a)cisco.com" for software > upgrades; faster results will be obtained by contacting the TAC > directly. > >Workarounds > > Several workarounds are available based on customer needs, > equipment, and software features. The usefulness and practicality of > each workaround depends on the IOS release running on the device and > many variables in the customer's environment. Customers are urged to > consider each of the following alternatives carefully before > deploying. These workarounds are only needed if it is not possible > to upgrade to an unaffected release of IOS software. > > A. Default workaround for use with releases for which no other > workarounds are effective: > > 1. Applying access lists to all the interfaces of the > vulnerable device blocking SNMP from all hosts but those > authorized to manage the devices. > > 2. Blocking SNMP access at the edge of the network to prevent > undesirable SNMP traffic from entering the network > containing the vulnerable device. > > Access lists should be deployed with careful consideration of > the possible effects on network operation and performance. Also > note that authentication based on an IP source address is weak, > so the preceding method will not protect against certain types > of attacks in which the IP source address has been spoofed. > Further information can be found in the Cisco document > "Improving Security on Cisco Routers", available at > http://www.cisco.com/warp/public/707/21.html > > B. For affected releases based on IOS 11.1: > > 1. Remove the view so that the ILMI community cannot be > reached: > > no snmp-server view *ilmi > > 2. This configuration will not survive a system reload. The > command must be re-entered after every restart of the > system. > > C. For affected releases of IOS 11.2 through 11.3(8) NOT REQUIRING > ATM: > > In this affected range of releases, the ILMI community string > can be modified or deleted. However, the changes will not > persist through a reboot of the device. These instructions must > be re-applied following every system reload of the affected > device: > > 1. Expose the undocumented ILMI community string so it can be > modified: > > snmp-server community ILMI RW > > The preceding command may cause an error that can be safely > ignored. > > 2. Disable read-write capability for the same community: > > no snmp-server community ILMI RW > > If an error is displayed, then this workaround cannot be > applied to the device. Use the default workarounds > presented in the first item above. > > 3. Since this configuration will not survive a system reload, > the command must be re-entered after every restart of the > system. > > If the command in item 2 above did not generate an error and ATM > is not needed on this device, then this workaround is complete. > > D. For affected releases of IOS 11.2 through 11.3(8) THAT REQUIRE > ATM: > > This workaround will allow ILMI to continue to function for ATM > while constraining who may reconfigure the device by way of the > ILMI community string: > > 1. Create a simple ACL to deny access using the following > command. If "66" is already in use, choose a different > two-digit number: > > access-list 66 deny any > > 2. Apply it generally to the ILMI community to restrict its > view: > > snmp community ILMI view *ilmi RW 66 > > An error will be reported if the *ilmi view doesn't exist. > If that occurs, then use the following command to > explicitly restrict the ILMI view: > > snmp community ILMI RW 66 > > If the preceding command produces persistent errors, then > this workaround cannot be applied to this device. Use the > default workarounds presented in the first item above. > > E. For affected releases of IOS 11.3(9) through 12.0(2)T NOT > REQUIRING ATM: > > All versions of IOS in this range will accept this workaround, > and the change will remain in place after a system reload. > > 1. Expose the undocumented ILMI community string so it can be > modified: > > snmp-server community ILMI RW > > The preceding command may cause an error that can be safely > ignored. > > 2. Disable read-write capability for the same community: > > no snmp-server community ILMI RW > > If an error is displayed, then this workaround cannot be > applied to the device. Stop this procedure and use the > default workarounds presented in the first item above. > > F. For affected releases of IOS 11.3(9) through 12.0(2)T THAT > REQUIRE ATM: > > This workaround will allow ILMI to continue to function for ATM > while constraining who may reconfigure the device by way of the > ILMI community string: > > 1. Create a simple ACL to deny access using the following > command. If "66" is already in use, choose a different > two-digit number: > > access-list 66 deny any > > 2. Apply it generally to the ILMI community to restrict its > view: > > snmp community ILMI view *ilmi RW 66 > > An error will be reported if the *ilmi view doesn't exist. > If that occurs, then use the following command to > explicitly restrict the ILMI view: > > snmp community ILMI RW 66 > > If the preceding command produces persistent errors, then > this workaround cannot be applied to this device. Use the > default workaround presented in the first item above. > > G. For affected releases of IOS 12.0(3)T and later: > These releases of IOS include support for Simple Network > Management Protocol version 3 (SNMPv3), which is required for > this workaround. > > 1. Confirm the presence of SNMPv3 support by asking the > console CLI (command-line interpreter) for assistance with > options to complete the snmp-server command. Enter config > mode, enter the command shown below, and note the expected > response: > > snmp-server user test test ? > > remote Specify a remote SNMP entity to which the user belongs > v1 user using the v1 security model > v2c user using the v2c security model > v3 user using the v3 security model > > If the preceding command did not produce the expected > results, then SNMPv3 is not supported in the release and > this workaround cannot be applied. Stop this procedure and > consider applying the default workaround presented above in > the first item. > > Otherwise, if the device responded as expected, continue > with the following explanation and instructions. > > In these IOS releases (12.0(3)T and later), ILMI packets are > processed by the SNMP engine in the same manner as ordinary IP > SNMP packets. An access control list or a view applied to the > ILMI community string will be processed whether the transport is > ILMI or IP. However, the only types of access control lists that > can be applied to a community string are via IP access-list > statements, which when applied, block ALL non-IP packets, > including ILMI packets. Modifying or deleting the *ilmi view > will also affect the packets transported by ILMI, so workarounds > that change the view are equally ineffective at permitting ILMI > while denying SNMP. In this range of releases, it is not > possible to apply a workaround that denies IP SNMP packets that > does not also deny ILMI SNMP packets. > > H. For affected releases of IOS 12.0(3)T and later NOT REQUIRING > ATM: > > 1. Expose the undocumented ILMI community string so it can be > modified: > > snmp-server community ILMI RW > > The preceding command may cause an error that can be safely > ignored. > > 2. Disable read-write capability for the same community: > > no snmp-server community ILMI RW > > If an error is displayed, then this workaround cannot be > applied to the device. Stop this procedure and consider > using the default workaround. > > I. For affected releases of IOS 12.0(3)T and later THAT REQUIRE > ATM: > > NOTE: This section also applies to 12.0-based ATM switch > software such as for the LS1010 and the 8500 series. > > The only effective workaround for systems in this category is > the default workaround: > > 1. Applying access lists to all the interfaces of the > vulnerable device blocking SNMP from all hosts but those > authorized to manage the devices. > > 2. Blocking SNMP access at the edge of the network to prevent > undesirable SNMP traffic from entering the network > containing the vulnerable device. > > Access lists should be deployed with careful consideration of > the possible effects on network operation and performance. Also > note that authentication based on an IP source address is weak, > so the preceding method will not protect against certain types > of attacks in which the IP source address has been spoofed. > In this range of releases it is not possible to block IP SNMP > packets while permitting ILMI SNMP packets. The alternative > workarounds presented previously will almost certainly cause a > failure of ATM ILMI communications resulting in a loss of ATM > connectivity, either immediately upon configuration, or > unexpectedly at some later time. Either use the default > workaround or upgrade to fixed software. > >Exploitation and Public Announcements > > This vulnerability is known to the engineering staff of several > Cisco customers. Cisco considers it known to the public prior to the > publication of this notice. > > Cisco is aware of one recent incident involving the unauthorized > modification of a router that appears to have resulted from this > vulnerability. However, it may have been the unintended side-effect > of a test of the vulnerability. > > Cisco is not aware of any available tools specifically designed to > make use of this vulnerability. However, various off-the-shelf > network management programs could easily be used to test for this > vulnerability and to exploit it. Certain widely-available programs > known to the cracker community could be modified by any reasonably > competent programmer to automate the abuse of this vulnerability. > > Cisco is not aware of any general public discussion of this > vulnerability other than the exceptions previously noted. > >Status of This Notice: INTERIM > > This is an interim security advisory. Cisco anticipates issuing > updated versions of this notice at irregular intervals as there are > material changes in the facts, and will continue to update this > notice as necessary. The reader is warned that this notice may > contain inaccurate or incomplete information. Although Cisco cannot > guarantee the accuracy of all statements in this notice, all of the > facts have been checked to the best of our ability. Cisco > anticipates issuing monthly updates of this notice until it reaches > FINAL status. > > A standalone copy or paraphrase of the text of this security > advisory that omits the distribution URL in the following section is > an uncontrolled copy, and may lack important information or contain > factual errors. > >Distribution > > This notice will be posted at > http://www.cisco.com/warp/public/707/ios-snmp-ilmi-vuln-pub.shtml . > > In addition to Worldwide Web posting, a text version of this notice > will be clear-signed with the Cisco PSIRT PGP key and will be posted > to the following e-mail and Usenet news recipients: > > * cust-security-announce(a)cisco.com > > * bugtraq(a)securityfocus.com > > * firewalls(a)lists.gnac.com > > * first-teams(a)first.org (including CERT/CC) > > * cisco(a)spot.colorado.edu > > * cisco-nsp(a)puck.nether.net > > * comp.dcom.sys.cisco > > * Various internal Cisco mailing lists > > Future updates of this notice, if any, will be placed on Cisco's > Worldwide Web server, but may or may not be actively announced on > mailing lists or newsgroups. Users concerned about this problem are > encouraged to check the URL given above for any updates. > >Revision History > > Revision 1.0 2001-Feb-27 First interim public version > >Cisco Product Security Incident Procedures > > Instructions for reporting product security vulnerabilities in Cisco > products, obtaining assistance with customer security incidents, and > registering to receive security information from Cisco can be found > at http://www.cisco.com/warp/public/707/sec_incident_response.shtml > , including instructions for press inquiries regarding Cisco > Security Advisories. > _______________________________________________________________ > > Copyright 2001 by Cisco Systems, Inc. This notice may be > redistributed freely after the release date given at the top of the > text, provided that redistributed copies are complete and > unmodified, and include all date and version information. > _______________________________________________________________ > -- \_ Roger De Salis Cisco Systems NZ Ltd </' +64 25 481 452 L8, ASB Tower, 2 Hunter St /) +64 4 496 9003 Wellington, New Zealand (/ roger(a)desalis.gen.nz rdesalis(a)cisco.com ` --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Fw: Re: Warning: Cisco RW community backdoor.
by Joe Abley 27 Feb '01

27 Feb '01

More details below. -----Original Message----- From: "James A. T. Rice" <jamesr(a)rd.bbc.co.uk> Date: Tue, 27 Feb 2001 01:46:37 +0000 (GMT) Subject: Re: Warning: Cisco RW community backdoor. To: <members(a)lonap.net>, , , <ops(a)linx.net> Just a couple of things to note, I've been asked what the backdoor is, if its the community "ILMI" or if that was just an example, the answer is yes - "ILMI" is the backdoor which gives read-write access to parts of the SNMP base. Its looks like parts of my earlier email are somewhat misleading, the ILMI community appears to only allow RW access to the system object and possibly some more objects. Its not a 'standard' open RW community. hence the damage caused by this backdoor is limited. There is still some write access however, so the fix mentioned below is still highly recommended. And of course - it allows people to read what IOS/model cisco you have, which could be used to find exploitable bugs in that particular release. Oh I wonder what the chances of having a router stolen due to discovery of system.sysLocation is! :-) Warm Regards James -- James A. T. Rice | Email: jamesr(a)rd.bbc.co.uk Internet Operations Engineer | Phone: 01737 839 737 BBC Internet Services, Kingswood Warren, Tadworth, Surrey, UK. On Tue, 27 Feb 2001, it was written: > If your router responds to `snmpwalk router.isp.net.uk ILMI`, you > probabally will want to do the following to disable it: > conf t > snmp-server community ILMI RO 99 > access-list 99 deny any log > (pick another spare access-list if 99 isn't available) > > If you dont, assuming your ios/hardware combination supports it, > (most of the bigger routers do) anyone can do things like: > `snmpset router.isp.net.uk ILMI system.sysName.0 s \ > "ALL YOUR ROUTER ARE BELONG TO US."` > Thats a harmless example. You can do almost anything with RW snmp. > > Warm Regards > James > > -- > James A. T. Rice | Email: jamesr(a)rd.bbc.co.uk > Internet Operations Engineer | Phone: 01737 839 737 > BBC Internet Services, Kingswood Warren, Tadworth, Surrey, UK. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

6 7

FW: [nsp] Cisco Security Advisory: Cisco IOS Software SNMP Read-Write ILMI Community String Vulnerability
by Barry Raveendran Greene 27 Feb '01

27 Feb '01

-----Original Message----- From: nobody(a)cisco.com [mailto:nobody(a)cisco.com]On Behalf Of Cisco Systems Product Security Incident Response Team Sent: Tuesday, February 27, 2001 1:00 AM To: cisco-nsp(a)puck.nether.net Cc: psirt(a)cisco.com Subject: [nsp] Cisco Security Advisory: Cisco IOS Software SNMP Read-Write ILMI Community String Vulnerability -----BEGIN PGP SIGNED MESSAGE----- Cisco Security Advisory: Cisco IOS Software SNMP Read-Write ILMI Community String Vulnerability Revision 1.0: INTERIM For Public Release 2001 February 27 04:00 US/Eastern (UTC+0500) _______________________________________________________________ Summary Cisco IOS software releases based on versions 11.x and 12.0 contain a defect that allows a limited number of SNMP objects to be viewed and modified without authorization using a undocumented ILMI community string. Some of the modifiable objects are confined to the MIB-II system group, such as "sysContact", "sysLocation", and "sysName", that do not affect the device's normal operation but that may cause confusion if modified unexpectedly. The remaining objects are contained in the LAN-EMULATION-CLIENT and PNNI MIBs, and modification of those objects may affect ATM configuration. An affected device might be vulnerable to a denial-of-service attack if it is not protected against unauthorized use of the ILMI community string. The vulnerability is only present in certain combinations of IOS releases on Cisco routers and switches. ILMI is a necessary component for ATM, and the vulnerability is present in every IOS release that contains the supporting software for ATM and ILMI without regard to the actual presence of an ATM interface or the physical ability of the device to support an ATM connection. To remove this vulnerability, Cisco is offering free software upgrades for all affected platforms. The defect is documented in DDTS record CSCdp11863. In lieu of a software upgrade, a workaround can be applied to certain IOS releases by disabling the ILMI community or "*ilmi" view and applying an access list to prevent unauthorized access to SNMP. Any affected system, regardless of software release, may be protected by filtering SNMP traffic at a network perimeter or on individual devices. This notice will be posted at http://www.cisco.com/warp/public/707/ios-snmp-ilmi-vuln-pub.shtml. Affected Products The vulnerability is present only in certain releases of Cisco IOS Software versions 11.x and 12.0 for router and switch products that include support for Asynchronous Transfer Mode (ATM) networking and Interim Local Management Interface (ILMI), and it is present without regard to any physical capability for supporting an ATM interface. Cisco IOS Software versions based on 10.3 and earlier do not contain the vulnerability. The defect was introduced in 11.0(0.2). All Cisco IOS software releases of 12.1 and later have been repaired and are not vulnerable to the defect described in this advisory. To determine the software running on a Cisco product, log in to the device and issue the command "show version" to display the system banner. Cisco IOS software will identify itself as "Internetwork Operating System Software" or simply "IOS (tm)". The image name will be displayed between parentheses, usually on the next line of output, followed by "Version" and the IOS release name. Other Cisco devices will not have the "show version" command or will give different output. The following example identifies a Cisco product running IOS release 12.0(3) with an installed image name of C2500-IS-L: Cisco Internetwork Operating System Software IOS (tm) 2500 Software (C2500-IS-L), Version 12.0(3), RELEASE SOFTWARE The device is not vulnerable to the defect described in this advisory since the model 2500 router is specifically excluded in the list of unaffected products shown below. Cisco devices that may be running an affected IOS software release include, but are not limited to: * Cisco 1400 and 1700 series. * Cisco 2600 (except that c2600-c-mz, c2600-d-mz, c2600-i-mz, c2600-io3-mz, and c2600-ix-mz images are not vulnerable). * Catalyst 2900 ATM, 2900XL, and 2948g series. * Cisco 3620 (except that c3620-d-mz, c3620-i-mz, c3620-io3-mz, and c3620-ix-mz images are not vulnerable). * Cisco 3640 (except that c3640-d-mz, c3640-i-mz, c3640-io3-mz, and c3640-ix-mz images are not vulnerable). * Cisco 3660 (except that c3660-d-mz, c3660-i-mz, and c3660-ix-mz images are not vulnerable). * Cisco MC3810 (except that mc3810-i-mz, mc3810-is-mz, mc3810-is56i-mz, and mc3810-js-mz images are not vulnerable). * Catalyst 4232, 4840g, 5000 RSFC series switches. * Cisco 4500, 4700, and 5800 DSC series. * Cisco 6200, 6400 NRP, and 6400 NSP series. * Catalyst MSM (c6msm), 6000 Hybrid Mode (c6msfc), and 6000 Native Mode (c6sup). * Cisco RSM, 7000, 7010, 7100, 7200, ubr7200, and 7500 series. * Catalyst 8510CSR, 8510MSR, 8540CSR, and 8540MSR series. * Cisco 10000 ESR and 12000 GSR series. * LS1010 and Cisco 6260-NI2. * DistributedDirector (except that igs-w3 images are not vulnerable). Cisco products that are not affected by this vulnerability either because they have no support for ATM and ILMI, or because they do not run IOS include, but are not limited to: * Catalyst ATM blade (runs possibly affected code, but an SNMP connection to the blade is not possible). * Cisco 800 and 805 series. * Cisco Universal Broadband Routers ubr900 and ubr920. * Cisco 1003, 1004, and 1005 series. * Cisco 1600, 2500, 2800, 4000 series. * Cisco 2500 Fixed Frad. * Cisco 3800 (not to be confused with MC3810). * Cisco 5100, 5200, and 5300 series access servers. * Catalyst 6000 Supervisor Module. * Cisco PIX Firewall. * Aironet and Cisco/Aironet wireless products. * CS11000, Cache Engine, LocalDirector, and network scaling products (except that the Distributed Director might be affected). * VPN products such as Altiga concentrators. * Host-based network management or access management products. * Cisco IP Telephony and telephony management software (except those that are hosted on a vulnerable IOS platform). * Voice gateways and convergence platforms (except those that are hosted on a vulnerable IOS platform). * Optical switch products such as the ONS 15000 series. Details ILMI (Interim Local Management Interface) is an independent industry standard used for configuration of ATM (Asynchronous Transfer Mode) interfaces. The standard specifies the use of mechanisms and formats previously defined by SNMP (Simple Network Management Protocol). Although it is based on SNMP, ILMI communication actually occurs using a transport other than IP (Internet Protocol) that traverses only the physical ATM link. ILMI is essential to functions such as ATM auto-discovery and LANE (LAN Emulation). SNMP "objects" are variables that are organized into a MIB (Management Information Base). The MIB has a tree structure and contains both operational (read-only) data as well as configuration (read-write) options. By specifying a community string of "ILMI" in an SNMP request, access can be obtained to read the objects in three specific parts of the overall management tree structure on any device affected by this vulnerability: the MIB-II system group, the LAN-EMULATION-CLIENT MIB, and the PNNI (Private Network-to-Network Interface) MIB. A subset of objects in each part can be modified using the same "ILMI" community string. The MIB-II system group contains basic information about the device itself. The number of objects that can be modified is limited. Examples include: * system.sysContact: The contact information for the person or organization responsible for managing the device. * system.sysLocation: A description of the physical location where the device is installed or operating. * system.sysName: The hostname of the device, how it identifies itself at the console prompt. (This might not be the same name by which the device is known to other hosts on the network.) Most of the objects in the system MIB are read-only and cannot be changed via SNMP, such as the time elapsed since the previous restart and textual descriptions of the device's hardware and software. Numerous objects can be viewed in the LAN-EMULATION-CLIENT MIB and PNNI MIB, and modification of some of the read-write objects can have an affect on ATM operation of the device. The objects in the LAN-EMULATION-CLIENT MIB can only be viewed or modified if LANE has already been configured on the device. Access to SNMP in Cisco IOS software can be limited by applying access control lists (ACLs), by modifying or removing the SNMP view, by removing the community string from the running configuration, or by disabling the SNMP service. Any SNMP query that does not meet the criteria for access is promptly discarded when such protective measures are in place. If a query does meet the criteria for access, then a response is formulated and sent. It is possible to configure the device so that the ILMI community string is unavailable in all IOS 11.1 and higher releases. The particular method selected to accomplish this depends on the specific IOS release and configuration. This defect is documented as CSCdp11863. The vulnerability is repaired by imposing a test such that an SNMP request using the "ILMI" community string will only be recognized if it has been transported by ILMI. ATM functionality was added in various 10.x releases of Cisco IOS software. However, the function containing the defect was introduced when support for ILMI and other ATM features was added in IOS release 11.0(0.2). Therefore, all prior releases are not vulnerable. Impact If SNMP requests can be received by an affected device, then certain MIB objects can be viewed without proper authorization, causing a violation of confidentiality. A subset of the readable MIB objects can be modified without authorization to cause a failure of integrity. For example, the hostname can be modified so as to confuse network adminstrators, or the contact and location information could be changed with a goal of disrupting operations or embarassing whoever is responsible for the device. Objects in the LAN-EMULATION-CLIENT and PNNI MIBs can be viewed and modified, thus resulting in changes to the operation of ATM functions. If ATM is in use on the device, this may result in a failure of availability. Any affected device that is not otherwise protected against the receipt of SNMP packets is vulnerable to a denial-of-service (DoS) attack by flooding the SNMP port with read or write requests. Software Versions and Fixes The following table summarizes the known affected Cisco IOS software releases and the earliest estimated dates of availability for fixed releases. All dates are tentative and subject to change. Each row of the table describes a release train and the platforms or products for which it is intended. If a given release train is vulnerable, then the earliest possible releases that contain the fix and the anticipated date of availability for each are listed in the "Rebuild", "Interim", and "Maintenance" columns. If a device is running an earlier release that is known to be vulnerable, it should be upgraded to at least the indicated version. When selecting a release, keep in mind the following definitions: Maintenance Most heavily tested and highly recommended release of any label in a given row of the table. Rebuild Constructed from the previous maintenance or major release in the same train, it contains the fix for a specific defect. Although it receives less testing, it contains only the minimal changes necessary to effect the repair. Interim Built at regular intervals between maintenance releases and receive less testing. Interims should be selected only if there is no other suitable release that addresses the vulnerability. Interim releases are usually not available for customer download via CCO without prior arrangement. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco TAC for assistance as shown in the following section. More information on IOS release names and abbreviations is available at http://www.cisco.com/warp/public/620/1.html. +=========================================================================== + | Train | Description of | Availability of Fixed Releases* | | | Image or Platform | | +=========================================================================== + | 10.3-based Releases and | | | | | Earlier | Rebuild | Interim** | Maintenance | +=========================================================================== + | 10.3 and | | | | earlier |All |Not affected | +=========================================================================== + | 11.0-based Releases | Rebuild | Interim** | Maintenance | +=========================================================================== + | | |11.0(22a) | | | | 11.0 |Major GD release | | | | | |for all platforms |2001-Mar-05 | | | +=========================================================================== + | 11.1-based Releases | Rebuild | Interim** | Maintenance | +=========================================================================== + | | |11.1(24a) | | | | 11.1 |Major release for | | | | | |all platforms |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | |ED release for | | |12.1(7) | | 11.1AA |access servers: | | | | | |1600, 3200, and | | | | | |5200 series. | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | |Platform-specific |11.1(36)CA1 | | | | 11.1CA |support for 7500, | | | | | |7200, 7000, and RSP|2001-Mar-02 | | | +----------+-------------------+------------+---------------+--------------- + | |ISP train: added | | | | | |support for FIB, |11.1(36)CC1 | | | | 11.1CC |CEF, and NetFlow on| | | | | |7500, 7200, 7000, |2001-Mar-02 | | | | |and RSP | | | | +----------+-------------------+------------+---------------+--------------- + | |Added support for |12.0(11)ST2 | | | | 11.1CT |Tag Switching on | | | | | |7500, 7200, 7000, | | | | | |and RSP |2001-Feb-26 | | | +----------+-------------------+------------+---------------+--------------- + | | |11.1(28)IA1 | | | | 11.1IA |DistributedDirector| | | | | |only |2001-Feb-26 | | | +=========================================================================== + | 11.2-based Releases | Rebuild | Interim** | Maintenance | +=========================================================================== + | | |11.2(25a) | | | | 11.2 |Major release, | | | | | |general deployment |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | |Platform-specific | | | | | |support for IBM | | |12.1(7) | | 11.2BC |networking, CIP, | | | | | |and TN3270 on 7500,| | |2001-Feb-26 | | |7000, and RSP | | | | +----------+-------------------+------------+---------------+--------------- + | |Early deployment |12.0(15)S1 | | | | 11.2GS |release to support | | | | | |12000 GSR |2001-Feb-20 | | | +----------+-------------------+------------+---------------+--------------- + | | |11.2(25a)P | | | | 11.2P |New platform | | | | | |support |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | | | | |12.1WC | | 11.2SA |Catalyst 2900XL | | | | | |switch only | | |2001-Apr-12 | +----------+-------------------+------------+---------------+--------------- + | | | | |12.0(10)W5(18c)| | 11.2WA3 |LS1010 ATM switch | | | | | | | | |Available | +----------+-------------------+------------+---------------+--------------- + | | |11.2(25a)P | | | |11.2(4)XA |Initial release for| | | | | |the 1600 and 3600 |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | |Initial release for| | | | | |the 5300 and |11.2(9)XA1 | | | |11.2(9)XA |digital modem | | | | | |support for the |Unscheduled | | | | |3600 | | | | +=========================================================================== + | 11.3-based Releases | Rebuild | Interim** | Maintenance | +=========================================================================== + | | |11.3(11b) | | | | 11.3 |Major release for | | | | | |all platforms |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | |ED for dial | | | | | |platforms and |11.3(11a)AA | | | | 11.3AA |access servers: | | | | | |5800, 5200, 5300, |2001-Mar-05 | | | | |7200 | | | | +----------+-------------------+------------+---------------+--------------- + | |Early deployment |12.1(5)DA1 | | | | 11.3DA |train for ISP DSLAM| | | | | |6200 platform |2001-Feb-28 | | | +----------+-------------------+------------+---------------+--------------- + | |Early deployment | | | | | |train for |12.1(4)DB1 | | | | |ISP/Telco/PTT xDSL | | | | | 11.3DB |broadband | | | | | |concentrator | | | | | |platform, (NRP) for|2001-Feb-26 | | | | |6400 | | | | +----------+-------------------+------------+---------------+--------------- + | |Short-lived ED | | | 11.3HA |release for ISR |Not Vulnerable | | |3300 (SONET/SDH | | | |router) | | +----------+-------------------+------------+---------------+--------------- + | | |11.3(1)MA8 | | | | 11.3MA |MC3810 | | | | | |functionality only |Unscheduled | | | +----------+-------------------+------------+---------------+--------------- + | |Voice over IP, |12.1(7) | | | | 11.3NA |media convergence, | | | | | |various platforms |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | |Early deployment |11.3(11b)T1 | | | | 11.3T |major release, | | | | | |feature-rich for | | | | | |early adopters |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | |Multilayer | | | | | |Switching and | | |12.0(14)W5(20) | | |Multiprotocol over | | | | | 11.3WA4 |ATM functionality | | | | | |for Catalyst 5000 | | | | | |RSM, 4500, 4700, | | |2001-Feb-28 | | |7200, 7500, LS1010 | | | | +----------+-------------------+------------+---------------+--------------- + | | |11.3(11b)T1 | | | |11.3(2)XA |Introduction of | | | | | |ubr7246 and 2600 |2001-Mar-05 | | | +=========================================================================== + | 12.0-based Releases | Rebuild | Interim** | Maintenance | +=========================================================================== + | |General deployment | |12.0(7.1) |12.0(16) | | 12.0 |release for all | | | | | |platforms | |Available |2001-Feb-20 | +----------+-------------------+------------+---------------+--------------- + | | | |12.0(7.1)T | | | 12.0DA |xDSL support: 6100,| | | | | |6200 | |Available | | +----------+-------------------+------------+---------------+--------------- + | |ISP/Telco/PTT xDSL |12.1(4)DB1 | | | | 12.0DB |broadband | | | | | |concentrator | | | | | |platforms |2001-Feb-26 | | | +----------+-------------------+------------+---------------+--------------- + | | |12.1(4)DC2 | | | | 12.0DC |6400 Access | | | | | |Concentrator |2001-Feb-26 | | | +----------+-------------------+------------+---------------+--------------- + | | |12.0(15)S1 | | | | 12.0S |Core/ISP support: | | | | | |GSR, RSP, c7200 |2001-Feb-20 | | | +----------+-------------------+------------+---------------+--------------- + | | |12.0(15)SC1 | | | | 12.0SC |Cable/broadband | | | | | |ISP: ubr7200 |2001-Feb-26 | | | +----------+-------------------+------------+---------------+--------------- + | | |12.0(14)SL1 | | | | 12.0SL |10000 ESR: c10k | | | | | | |2001-Feb-26 | | | +----------+-------------------+------------+---------------+--------------- + | |General deployment |12.0(11)ST2 | | | | 12.0ST |release for all | | | | | |platforms |2001-Feb-26 | | | +----------+-------------------+------------+---------------+--------------- + | | |12.1(5c)E8 | | | | 12.0SX |Early Deployment | | | | | |(ED) |2001-Feb-26 | | | +----------+-------------------+------------+---------------+--------------- + | |Early | | | | | |Deployment(ED): | | |12.1(7) | | 12.0T |VPN, Distributed | | | | | |Director, various | | |2001-Feb-26 | | |platforms | | | | +----------+-------------------+------------+---------------+--------------- + | |cat8510c, cat8540c,| | | | | |ls1010, cat8510m, | |12.0(10)W5(18c)|12.0(14)W5(20) | | |cat8540m, c5atm, | | | | | |c5atm, c3620, | | | | | |c3640, c4500, | | | | | 12.0W5 |c5rsfc, c5rsm, | |Available |2001-Feb-28 | | |c7200, rsp, | | | | | |cat2948g, cat4232 | | | | | +-------------------+------------+---------------+---------------+ | | | |12.0(10)W5(18d)|12.0(14)W5(20) | | |c6msm | | | | | | | |Available |2001-Feb-28 | +----------+-------------------+------------+---------------+--------------- + | |General deployment | | |12.0(13)WT6(1) | | 12.0WT |release for all | | | | | |platforms | | |2001-Feb-20 | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | |12.1(7) | | 12.0XA |(ED): limited | | | | | |platforms | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | | | | |12.1(7) | | 12.0XB |Short-lived early | | | | | |deployment release | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | |12.1(7) | | 12.0XC |(ED): limited | | | | | |platforms | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | |12.1(7) | | 12.0XD |(ED): limited | | | | | |platforms | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment |12.1(5c)E8 | | | | 12.0XE |(ED): limited | | | | | |platforms |2001-Feb-26 | | | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | |12.1(7) | | 12.0XF |(ED): limited | | | | | |platforms | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | |12.1(7) | | 12.0XG |(ED): limited | | | | | |platforms | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment |12.0(4)XH5 | | | | 12.0XH |(ED): limited | | | | | |platforms |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | |12.1(7) | | 12.0XI |(ED): limited | | | | | |platforms | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | |12.1(7) | | 12.0XJ |(ED): limited | | | | | |platforms | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment |12.0(7)XK4 | | | | 12.0XK |(ED): limited | | | | | |platforms |Unscheduled | | | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment |12.0(4)XH5 | | | | 12.0XL |(ED): limited | | | | | |platforms |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | | | | |12.1(7) | | 12.0XM |Short-lived early | | | | | |deployment release | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | | | | 12.0XN |(ED): limited | | | | | |platforms | | | | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | |12.1WC | | 12.0XP |(ED): limited | | | | | |platforms | | |2001-Apr-12 | +----------+-------------------+------------+---------------+--------------- + | | | | |12.1(7) | | 12.0XQ |Short-lived early | | | | | |deployment release | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | | |12.1(5)T5 | | | | 12.0XR |Short-lived early | | | | | |deployment release |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | | |12.1(5c)E8 | | | | 12.0XS |Short-lived early | | | | | |deployment release |2001-Feb-26 | | | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | |12.1WC | | 12.0XU |(ED): limited | | | | | |platforms | | |2001-Apr-12 | +----------+-------------------+------------+---------------+--------------- + | | |12.1(5)T5 | | | | 12.0XV |Short-lived early | | | | | |deployment release |2001-Mar-05 | | | +=========================================================================== + |12.1-based and Later Releases | Rebuild | Interim** | Maintenance | +=========================================================================== + | All 12.1 | | | | Releases |Various platforms |Not Vulnerable | +=========================================================================== + | Notes | +=========================================================================== + | * All dates are estimated and Subject to change. | | | |** Interim releases are subjected to less rigorous testing than regular | | maintenance releases, and may have serious bugs. | +=========================================================================== + Obtaining Fixed Software Cisco is offering free software upgrades to remedy this vulnerability for all affected customers. Customers with service contracts may upgrade to any software release. Customers without contracts may upgrade only within a single row of the table above, except that any available fixed software release will be provided to any customer who can use it and for whom the standard fixed software release is not yet available. Customers may install only the feature sets they have purchased. Note that not all fixed software may be available as of the release date of this notice. Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained via Cisco's Software Center at http://www.cisco.com/. Customers without contracts or warranty should get their upgrades by contacting the Cisco Technical Assistance Center (TAC) as shown below: * (800) 553-2447 (toll-free in North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com See http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including instructions and e-mail addresses for use in various languages. Give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Please do not contact either "psirt(a)cisco.com" or "security-alert(a)cisco.com" for software upgrades; faster results will be obtained by contacting the TAC directly. Workarounds Several workarounds are available based on customer needs, equipment, and software features. The usefulness and practicality of each workaround depends on the IOS release running on the device and many variables in the customer's environment. Customers are urged to consider each of the following alternatives carefully before deploying. These workarounds are only needed if it is not possible to upgrade to an unaffected release of IOS software. A. Default workaround for use with releases for which no other workarounds are effective: 1. Applying access lists to all the interfaces of the vulnerable device blocking SNMP from all hosts but those authorized to manage the devices. 2. Blocking SNMP access at the edge of the network to prevent undesirable SNMP traffic from entering the network containing the vulnerable device. Access lists should be deployed with careful consideration of the possible effects on network operation and performance. Also note that authentication based on an IP source address is weak, so the preceding method will not protect against certain types of attacks in which the IP source address has been spoofed. Further information can be found in the Cisco document "Improving Security on Cisco Routers", available at http://www.cisco.com/warp/public/707/21.html B. For affected releases based on IOS 11.1: 1. Remove the view so that the ILMI community cannot be reached: no snmp-server view *ilmi 2. This configuration will not survive a system reload. The command must be re-entered after every restart of the system. C. For affected releases of IOS 11.2 through 11.3(8) NOT REQUIRING ATM: In this affected range of releases, the ILMI community string can be modified or deleted. However, the changes will not persist through a reboot of the device. These instructions must be re-applied following every system reload of the affected device: 1. Expose the undocumented ILMI community string so it can be modified: snmp-server community ILMI RW The preceding command may cause an error that can be safely ignored. 2. Disable read-write capability for the same community: no snmp-server community ILMI RW If an error is displayed, then this workaround cannot be applied to the device. Use the default workarounds presented in the first item above. 3. Since this configuration will not survive a system reload, the command must be re-entered after every restart of the system. If the command in item 2 above did not generate an error and ATM is not needed on this device, then this workaround is complete. D. For affected releases of IOS 11.2 through 11.3(8) THAT REQUIRE ATM: This workaround will allow ILMI to continue to function for ATM while constraining who may reconfigure the device by way of the ILMI community string: 1. Create a simple ACL to deny access using the following command. If "66" is already in use, choose a different two-digit number: access-list 66 deny any 2. Apply it generally to the ILMI community to restrict its view: snmp community ILMI view *ilmi RW 66 An error will be reported if the *ilmi view doesn't exist. If that occurs, then use the following command to explicitly restrict the ILMI view: snmp community ILMI RW 66 If the preceding command produces persistent errors, then this workaround cannot be applied to this device. Use the default workarounds presented in the first item above. E. For affected releases of IOS 11.3(9) through 12.0(2)T NOT REQUIRING ATM: All versions of IOS in this range will accept this workaround, and the change will remain in place after a system reload. 1. Expose the undocumented ILMI community string so it can be modified: snmp-server community ILMI RW The preceding command may cause an error that can be safely ignored. 2. Disable read-write capability for the same community: no snmp-server community ILMI RW If an error is displayed, then this workaround cannot be applied to the device. Stop this procedure and use the default workarounds presented in the first item above. F. For affected releases of IOS 11.3(9) through 12.0(2)T THAT REQUIRE ATM: This workaround will allow ILMI to continue to function for ATM while constraining who may reconfigure the device by way of the ILMI community string: 1. Create a simple ACL to deny access using the following command. If "66" is already in use, choose a different two-digit number: access-list 66 deny any 2. Apply it generally to the ILMI community to restrict its view: snmp community ILMI view *ilmi RW 66 An error will be reported if the *ilmi view doesn't exist. If that occurs, then use the following command to explicitly restrict the ILMI view: snmp community ILMI RW 66 If the preceding command produces persistent errors, then this workaround cannot be applied to this device. Use the default workaround presented in the first item above. G. For affected releases of IOS 12.0(3)T and later: These releases of IOS include support for Simple Network Management Protocol version 3 (SNMPv3), which is required for this workaround. 1. Confirm the presence of SNMPv3 support by asking the console CLI (command-line interpreter) for assistance with options to complete the snmp-server command. Enter config mode, enter the command shown below, and note the expected response: snmp-server user test test ? remote Specify a remote SNMP entity to which the user belongs v1 user using the v1 security model v2c user using the v2c security model v3 user using the v3 security model If the preceding command did not produce the expected results, then SNMPv3 is not supported in the release and this workaround cannot be applied. Stop this procedure and consider applying the default workaround presented above in the first item. Otherwise, if the device responded as expected, continue with the following explanation and instructions. In these IOS releases (12.0(3)T and later), ILMI packets are processed by the SNMP engine in the same manner as ordinary IP SNMP packets. An access control list or a view applied to the ILMI community string will be processed whether the transport is ILMI or IP. However, the only types of access control lists that can be applied to a community string are via IP access-list statements, which when applied, block ALL non-IP packets, including ILMI packets. Modifying or deleting the *ilmi view will also affect the packets transported by ILMI, so workarounds that change the view are equally ineffective at permitting ILMI while denying SNMP. In this range of releases, it is not possible to apply a workaround that denies IP SNMP packets that does not also deny ILMI SNMP packets. H. For affected releases of IOS 12.0(3)T and later NOT REQUIRING ATM: 1. Expose the undocumented ILMI community string so it can be modified: snmp-server community ILMI RW The preceding command may cause an error that can be safely ignored. 2. Disable read-write capability for the same community: no snmp-server community ILMI RW If an error is displayed, then this workaround cannot be applied to the device. Stop this procedure and consider using the default workaround. I. For affected releases of IOS 12.0(3)T and later THAT REQUIRE ATM: NOTE: This section also applies to 12.0-based ATM switch software such as for the LS1010 and the 8500 series. The only effective workaround for systems in this category is the default workaround: 1. Applying access lists to all the interfaces of the vulnerable device blocking SNMP from all hosts but those authorized to manage the devices. 2. Blocking SNMP access at the edge of the network to prevent undesirable SNMP traffic from entering the network containing the vulnerable device. Access lists should be deployed with careful consideration of the possible effects on network operation and performance. Also note that authentication based on an IP source address is weak, so the preceding method will not protect against certain types of attacks in which the IP source address has been spoofed. In this range of releases it is not possible to block IP SNMP packets while permitting ILMI SNMP packets. The alternative workarounds presented previously will almost certainly cause a failure of ATM ILMI communications resulting in a loss of ATM connectivity, either immediately upon configuration, or unexpectedly at some later time. Either use the default workaround or upgrade to fixed software. Exploitation and Public Announcements This vulnerability is known to the engineering staff of several Cisco customers. Cisco considers it known to the public prior to the publication of this notice. Cisco is aware of one recent incident involving the unauthorized modification of a router that appears to have resulted from this vulnerability. However, it may have been the unintended side-effect of a test of the vulnerability. Cisco is not aware of any available tools specifically designed to make use of this vulnerability. However, various off-the-shelf network management programs could easily be used to test for this vulnerability and to exploit it. Certain widely-available programs known to the cracker community could be modified by any reasonably competent programmer to automate the abuse of this vulnerability. Cisco is not aware of any general public discussion of this vulnerability other than the exceptions previously noted. Status of This Notice: INTERIM This is an interim security advisory. Cisco anticipates issuing updated versions of this notice at irregular intervals as there are material changes in the facts, and will continue to update this notice as necessary. The reader is warned that this notice may contain inaccurate or incomplete information. Although Cisco cannot guarantee the accuracy of all statements in this notice, all of the facts have been checked to the best of our ability. Cisco anticipates issuing monthly updates of this notice until it reaches FINAL status. A standalone copy or paraphrase of the text of this security advisory that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution This notice will be posted at http://www.cisco.com/warp/public/707/ios-snmp-ilmi-vuln-pub.shtml . In addition to Worldwide Web posting, a text version of this notice will be clear-signed with the Cisco PSIRT PGP key and will be posted to the following e-mail and Usenet news recipients: * cust-security-announce(a)cisco.com * bugtraq(a)securityfocus.com * firewalls(a)lists.gnac.com * first-teams(a)first.org (including CERT/CC) * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * comp.dcom.sys.cisco * Various internal Cisco mailing lists Future updates of this notice, if any, will be placed on Cisco's Worldwide Web server, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the URL given above for any updates. Revision History Revision 1.0 2001-Feb-27 First interim public version Cisco Product Security Incident Procedures Instructions for reporting product security vulnerabilities in Cisco products, obtaining assistance with customer security incidents, and registering to receive security information from Cisco can be found at http://www.cisco.com/warp/public/707/sec_incident_response.shtml , including instructions for press inquiries regarding Cisco Security Advisories. _______________________________________________________________ Copyright 2001 by Cisco Systems, Inc. This notice may be redistributed freely after the release date given at the top of the text, provided that redistributed copies are complete and unmodified, and include all date and version information. _______________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.2 iQEVAwUBOpuPFWiN3BRdFxkbAQEmvAf+Ng5nJtzMpp2Dl/N+ZDp4/4Ul1nqMt89P IcNr/9AKa/jCMKNE8z20/tql78f0oniJ3YfR2GcoFfgfRCRKEVJ5QvzH3r+8BLA2 9YRsmxg/96aVwMP9gLoh4RiO4+qoTwSZkOBJ/DlZFzM7TG8SjKvgtjqcHWiLH9wx /YnxrVWg0jmnY9NvsRQSmS4KvKjFXZXaUBzlH8pOcrY9+vScS6ol+HwCiQOynQYn 2sG+KEapKP/ld2iDcHZPjbFfVsKm+iCtMzcroqpA+ND3ezBeNe2yjJXZG9oWUiVR zLYima8yuU5Mm18b3BoBkM2npf5QP/zRinis9A8d+mlnPemAWVoWug== =xM8n -----END PGP SIGNATURE----- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0