- NZNOG - lists.nznog.org

ICANN's Legacy? - The threat to universal Internet connectivity
by Jeff Williams 25 Nov '03

25 Nov '03

All, See: http://www.infoworld.com/article/03/11/21/46FEtrouble_1.html?s=feature The threat to universal Internet connectivity Can -- and should -- blockers, spammers, and domain name overlords be stopped? By David L. Margulius Thank you David for this breath or fresh air, honest evaluation, and interesting report.. Someday maybe Vint, and that "Crowed" will "Get it"... But in the mean time it may be time to throw the rascals out and have a new and inclusive beginning?? Will the NTIA take heed? Will Telstra and AT&T also take heed?? Regards, -- Jeffrey A. Williams Spokesman for INEGroup LLA. - (Over 134k members/stakeholders strong!) "Be precise in the use of words and expect precision from others" - Pierre Abelard "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== CEO/DIR. Internet Network Eng. SR. Eng. Network data security Information Network Eng. Group. INEG. INC. E-Mail jwkckid1(a)ix.netcom.com Contact Number: 214-244-4827 or 214-244-3801

1 0

RE: [nznog] Peering Issue - from a business point of view
by Paul Adshead 25 Nov '03

25 Nov '03

And then if if Telecom did join in and on-charged the more expensive Intl bw, how many customers would end up with Telecom bills like the one linked to below?? http://mike.net.nz/stuff/jetstream.jpg (Not mine by the way.) Paul Adshead Network & Systems OTL Software Ltd -----Original Message----- From: Matt Camp [mailto:gargoyle(a)noise.net.nz] Sent: Wednesday, 26 November 2003 15:29 To: Tikiri Wicks Cc: 'nznog' Subject: Re: [nznog] Peering Issue - from a business point of view [Everything in this email is my own uninformed personal opinion, and has absolutely nothing to do with TelstraClear's official position on anything at all. I'm not involved in any of this stuff, so don't quote me on anything, kthx] On Wed, 26 Nov 2003, Tikiri Wicks wrote: > In that case what about if all the small ISP's as a group peer with one > layer 3 switch at the APE and another one at the WIX. This way Telstra would > have to peer with everyone or not peer with anyone. Ah, but what happens when they choose not to peer with this group? And then what happens when Telecom takes a similar line? All of a sudden you've got a bunch of ISP's who are paying for international bandwidth through one of the other providers like AT&T, probably per byte, and they're having to use that bw to transit domestic traffic to everyone else. The problem is that the people making these decisions DO have reasons for making these changes... the reasons may be totally commercially based and have nothing to do with the feelgood ethos of the internet, but if the suits at TelstraClear are having those thoughts, I'll bet you a dollar there is someone in a suit at Telecom thinking "hey... if they can do it, so can we... and if we both do it, then everyone else will HAVE to buy a connection". > If all the non Telco ISP's were to be lumped into one pile that would be a > lot of such internet services and web sites. But remember, only the people who do not already have a TelstraClear service are potentially at risk of having their peering cut (according to jsr's quoted statement from Mathew Bolland).... How many of the non-telco ISP's in NZ don't have a TelstraClear link? How about if you add in the theory that Telecom takes the same line? All of a sudden your group of people is a whole lot smaller. While its nice to think that many ISP's will join your group trying to force peering, I think you'll find that many of them are still run by people who are more concerned about their business continuing and can't afford to take commercial risks just to uphold the ethos. > If all of these were as a group with rules that state peer with the all or > do not peer at all. Essentially a gigabit Layer 3 switch at the NEW > exchange. What this means is that parties would not peer with individual > small ISP's rather they would peer with the entire group. aka... the route servers? > The Telstra consumer would most probably switch to his friends connection. I think there would be more to it than that. Especially if Telecom took the same line, thus forcing all the non-telco ISP's to use more expensive bw, and charge their customers international rates for what should be domestic traffic. I haven't been involved with any of this peering stuff, but my feeling is that perhaps (as Tony implied), there is a lot more to this than people realise, and in fact its not just TelstraClear trying to be big and bad. --- Matt Camp _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

2 1

Re: [nznog] Peering Issue - from a business point of view
by Tikiri Wicks 25 Nov '03

25 Nov '03

p.s. I have NO affiliation with Maxnet I just use an email address from them. > What would that achieve? It won't solve the problem that John Russell > brought up. There is NO need to set up any other peering exchanges. > > You are confusing the issue. Get someone at the maxnet > nog to explain it to you I'm not trying to look at it from a technical point. What I mean is purely from a business point of view. In that case what about if all the small ISP's as a group peer with one layer 3 switch at the APE and another one at the WIX. This way Telstra would have to peer with everyone or not peer with anyone. New Zealand Internet consumers have great interest in other Internet related services and web sites in New Zealand. For example the earlier reference to nzdating.co.nz A large portion of these New Zealand based ineternet services and websites are physically hosted by ISP's other than Telstra and Telecom. Not to mention the end consumers themselves. If all the non Telco ISP's were to be lumped into one pile that would be a lot of such internet services and web sites. If all of these were as a group with rules that state peer with the all or do not peer at all. Essentially a gigabit Layer 3 switch at the NEW exchange. What this means is that parties would not peer with individual small ISP's rather they would peer with the entire group. In this scenario what would happen ? A Telstra consumer tries to access www.nzdating.co.nz what happens ? it is not accessible for them. The next day (or same day) he/she whines to his/her friends about nzdating not beign there. But his/her friend is on a dialup to ICONZ / Slingshot / _____ and they could access the site with no hassles. Instant conclusion is something is wrong with Telstra. The Telstra consumer would most probably switch to his friends connection. The key is to achieve critical mass. You guys can only achieve this critical mass as a group. Not as individual companies as you are too small alone to make any difference. Only as a group. Cheers Tikiri ----- Original Message ----- From: "Lin Nah" <lin(a)darkmere.gen.nz> To: "Tikiri Wicks" <tcwicks(a)maxnet.co.nz> Cc: "Tony Wicks" <nzog(a)road.gen.nz> Sent: Wednesday, November 26, 2003 12:00 PM Subject: Re: [nznog] Peering Issue - Perhaps a solution > HI Tikiri > > On Wed, 26 Nov 2003, Tikiri Wicks wrote: > > I realize that the APE and the WIX already exist but what I'm talking about > > is setting up a second peering point with different game rules. Namely Give > > as much as you take > What would that achieve? It won't solve the problem that John Russell > brought up. There is NO need to set up any other peering exchanges. > > You are confusing the issue. Get someone at the maxnet > nog to explain it to you > > > What you guys don't seem to understand is that if all the smaller ISP's > > Maxnet, IHUG, Slingshot, etc.... were all combined into one (big lump) that > > is probably way more end consumers than what Telstra has. And probably > > enough to get Telecom thinking as well > > regards > lin > > > > > ----- Original Message ----- > > From: "Tony Wicks" <nzog(a)road.gen.nz> > > To: "'Tikiri Wicks'" <tcwicks(a)maxnet.co.nz> > > Cc: "'nznog'" <nznog(a)list.waikato.ac.nz> > > Sent: Wednesday, November 26, 2003 11:14 AM > > Subject: RE: [nznog] Peering Issue - Perhaps a solution > > > > > > I hate to mention the obvious Tikiri, but that already exsists, they are > > called APE and WIX. > > > > > > > > -----Original Message----- > > From: Tikiri Wicks [mailto:tcwicks(a)maxnet.co.nz] > > Sent: Wednesday, 26 November 2003 11:13 a.m. > > To: Andy Linton; nznog > > Subject: [nznog] Peering Issue - Perhaps a solution > > > > Just a thought here > > > > Since most ISP's in NZ seem to be in agreement over this. What if > > instead of just blowing off steam: > > > > Everyone joins hands and sets up two (or more) peering exchanges. One in > > Auckland and one in Wellington. Then everyone simply drops all peering with > > Telstra (and / or Telecom if and where relevant) and interconnect through > > the two (or more) exchange points. The idea is that no one would pay for > > anything except for the cost of connectiong yourselves to the exchange > > points. Whether this be via tangent / united network / citylink / some big > > SDH radio link / microwave / a whole bunch of people running to the > > exchanges with buckets fileld with packets :) > > > > Peering would be voluntary for anyone and on the condition that each > > provides the same amount of bandwidth under the same conditions from their > > network to the exchange as they do from teh exchange to their network. > > > > That should keep players like Telecom and Telstra from trying to > > manipulate the market. > > > > If Telstra want to peer they would be forced to do so at the same > > conditions that apply to everyone else > > > > Also the costs of interconnectivity between the exchange points could be > > borne by the members based on some simple equation such as for example a > > ratio based on the amount of bandwidth with which they connect to the > > exchanges. Fill in the blanks here ________ > > > > Finally I would think that this would be a great opportunity for > > operators like tangent who have fibre running between the two (or more) > > hypothetical exchanges. > > > > Cheers > > > > Tikiri > > > > ----- Original Message ----- > > From: "Andy Linton" <asjl(a)citylink.co.nz> > > To: "nznog" <nznog(a)list.waikato.ac.nz> > > Sent: Wednesday, November 26, 2003 10:53 AM > > Subject: [nznog] Peering at the APE and WIX - was Re: Irked with > > TelstraClear > > > > > > > I posted some notes yesterday about peering with the APE and WIX route > > > servers and gave a link for application forms which wasn't as useful as > > > it might have been. For reference the forms are at: > > > > > > http://www.citylink.co.nz/cgi-bin/wixape.pl?tmpl=ape.tmpl > > > http://www.citylink.co.nz/cgi-bin/wixape.pl?tmpl=wix.tmpl > > > > > > Joe Abley posted some ideas on peering - one obvious one that he hasn't > > > gone the whole distance with is that if many of the small/medium players > > > work together they will be in a better position to negotiate peering > > > with the two large telcos. > > > > > > Consider the stories here: > > > > > > http://www.tomsdomain.com/aesop/id17.htm > > > > > > > > > > > > _______________________________________________ > > > NZNOG mailing list > > > NZNOG(a)list.waikato.ac.nz > > > http://list.waikato.ac.nz/mailman/listinfo/nznog > > > > _______________________________________________ > > NZNOG mailing list > > NZNOG(a)list.waikato.ac.nz > > http://list.waikato.ac.nz/mailman/listinfo/nznog > > > > _______________________________________________ > > NZNOG mailing list > > NZNOG(a)list.waikato.ac.nz > > http://list.waikato.ac.nz/mailman/listinfo/nznog > >

3 2

RE: [nznog] Peering Issue - Perhaps a solution
by Donald Neal 25 Nov '03

25 Nov '03

> -----Original Message----- > From: nznog-bounces+Donald.Neal=telecom.co.nz(a)list.waikato.ac.nz > [mailto:nznog-bounces+Donald.Neal=telecom.co.nz(a)list.waikato.ac.nz]On > Behalf Of Tikiri Wicks > Sent: Wednesday, 26 November 2003 11:13 > To: Andy Linton; nznog > Subject: [nznog] Peering Issue - Perhaps a solution > > > Just a thought here > > Since most ISP's in NZ seem to be in agreement over this. What if > instead of just blowing off steam: > > Everyone joins hands and sets up two (or more) peering > exchanges. One in > Auckland and one in Wellington. Then everyone simply drops > all peering with > Telstra (and / or Telecom if and where relevant) and > interconnect through > the two (or more) exchange points. As the monthly posting to this list says, >Internet Exchanges >See http://www.ape.net.nz/ for details of the Auckland Peering >Exchange and those connected there, http://www.wix.net.nz/ for the >Wellington Internet Exchange. Donald Neal | "They won't wobble. They won't! Technical Specialist | I shall lean against them Operations Engineering | myself, and I'm 6ft 6in. I will Integration & Services Divn. | personally eliminate wobble." Alcatel NZ Ltd | All opinions mine only. | - Russell T. Davies ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002." ------------------------------------------------------------------------------

1 0

(no subject)
by Ben Martel 25 Nov '03

25 Nov '03

1 0

RE: [nznog] Irked with TelstraClear
by J S Russell 25 Nov '03

25 Nov '03

On Tue, 25 Nov 2003, Neil Gardner wrote: > JSR, Do you have any numbers or names of people that this sort of > (justified, and for gosh sake, please be polite when doing it) enquiry > would be best directed towards? Personally, were I a TelstraClear customer, I would be inclined to treat it as a fault, yes. And I would guess that fault reports should be sent though normal account management channels. JSR -- John S Russell | Big Geek | Doing geek stuff.

2 1

Re: [nznog] Irked with TelstraClear
by Simon Lyall 24 Nov '03

24 Nov '03

On Tue, 25 Nov 2003, J S Russell wrote: > Nope - as I outlined earlier, we treated it as damage and routed around > it. Technology triumphs over stupidity! Huzzah! Hmm, still some customers of TesltraClear [1] might be seeing less than optimal connectivity to Iconz hosted sites. Why not approach them and suggest that they get direct connectivity to APE,WIX or wherever? If they are paying $25 per 64Kbits/sec per month then they don't need much bandwidth to start saving money. As a bonus, next time their bandwidth negotiations come around they'll be able to pick from any ISP that's APE connected for their bandwidth. Here are a few possibles that are fairly big but appear (from a quick glance) to be only domestically routed via TesltraClear currently: aut.ac.nz auckland.ac.nz vuw.ac.nz waikato.ac.nz iserve.co.nz actrix.co.nz scarfies.net wave.co.nz I would guess a few admins from there are already on this list, some might already be getting complaints about domestic connectivity. I'd be interested in their take on the situation. [1] My Spell checker keeps trying to substitute "Testicular" for "TelstraClear" , then again it also tried to do "thug" for "ihug" :) -- Simon J. Lyall | Very Busy | Web: http://www.darkmere.gen.nz/ "To stay awake all night adds a day to your life" - Stilgar | eMT.

1 0

[Fwd: RE: [nznog] Changes to Telecom ADSL Network]
by kyle carter 24 Nov '03

24 Nov '03

I personally am happy with this topic being discussed on list.. however being an anonymous looking sender is a bit off putting. Many of the topic on this list i dont have a problem with, but i do like to know is going on with regards to the internet in NZ. This is a topic i have been asked about by many people i know who arent gamers but have been experiencing many issues with the latency of their connections when nearing max bandwidth usage. I did not experience any problems with the previous traffic shaping with the dropping of packets, however i have experienced some very weird issues with the new packet shaping when nearing the bandwidth limits of my jetstart connection. On Mon, 2003-11-24 at 07:29, Craig Spiers wrote: > Why was this posted to NZNOG? > > If you have gripes with telecom, take it up with telecom? > > I personally don't have a problem with the changes telecom have made.. And I > believe it hasn't been done on purpose, but a side effect from the changing > of equipment vendors.. > > > > -----Original Message----- > From: Anonymous User [mailto:ominona(a)emailaccount.com] > Sent: Sunday, 23 November 2003 6:26 p.m. > To: adsl(a)lists.unixathome.org; nznog(a)list.waikato.ac.nz > Subject: [nznog] Changes to Telecom ADSL Network > > An interesting topic for discussion: > > Telecom is installing new equipment in its ADSL network, which handles > traffic congestion in a slightly different way than previously. > Overview > Telecom is installing new equipment in its network, which handles traffic > congestion in a slightly different way than previously.

4 3

Changes to Telecom ADSL Network
by Anonymous User 22 Nov '03

22 Nov '03

An interesting topic for discussion: Telecom is installing new equipment in its ADSL network, which handles traffic congestion in a slightly different way than previously. Overview Telecom is installing new equipment in its network, which handles traffic congestion in a slightly different way than previously. When a traffic burst exceeds the rated capacity of that connection, any overflow data is now queued temporarily and sent as soon as the congestion is cleared - normally within milliseconds. This change should enhance the experience for most Internet users, however some gaming customers may have increased sensitivity to other applications running in the background. To achieve the best online game playing experience, Telecom is working to ensure that the connections are optimised and queuing is minimised. Users wanting the best gaming experience should avoid running other applications or PCs on the same connection or upgrade their connection to a higher speed to ensure queues are minimised. Frequently Asked Questions: Q. Why can multiple users on one connection now not connect when playing games? A. Telecom is installing new equipment in the network, which handles traffic congestion in a slightly different way than previously. When a traffic burst exceeds the rated capacity of that connection, any overflow data is now queued temporarily and sent as soon as the congestion is cleared - normally within milliseconds. Q. Why has Telecom made this change? A. This change means that packets of data, which previously may have been dropped, will now reach their destination. This change should enhance the experience for most Internet users, however some gaming customers may have increased sensitivity to other applications running in the background. Q. This is obviously having a negative effect on my games experience - why don't you change it back? A. For the majority of customers, the new queue shaping provides them with a better Internet experience. Telecom is working to ensure that the connections are optimised and queuing is minimised. Users wanting the best gaming experience should avoid running other applications or PCs on the same connection or upgrade their existing connection to a higher speed to ensure queues are minimised. Q. Why didn't you notify customers of this change? A. Telecom regularly makes changes to its Network and indeed, announced earlier this year that it was overhauling its JetStream portfolio. With so many changes being made in various parts of the Network, it is impractical to notify all customers whenever a change is made. Q. Isn't this just a ploy to get us on to your 256k plans where we have to pay for all traffic? A. Customers are free to choose the most appropriate plan for their needs. The Xtra JetStream 256k and Full speed plans obviously offer customers a bigger pipe, so the chances of packets getting dropped or queued are less. ~ John Doe _____________________________________________________________ Free, simple, fast, memorable email Become you(a)EmailAccount.com at http://www.emailaccount.com/

2 1

Telehousing
by Craig Spiers 22 Nov '03

22 Nov '03

Anyone know of any telehousing facilitys in auckland CBD? Must be on the citylink or tangent / united networks fiber networks.. Cheers!

1 0

2.4GHz operators - Lincoln/Henderson area
by Michael Hallager 21 Nov '03

21 Nov '03

Hi, Could any operators of 2.4GHz outdoor networks in the Lincoln/Henderson area please contact me offlist for mutual co-operation in channel usage. Michael Hallager Managing Director Networkstuff Limited URL: http://www.networkstuff.co.nz Networkstuff, NZ's leading supplier of high quality used networking equipment. E-Mail: michael @ networkstuff.co.nz Member of the NZ Open Source Society. Member of the Auckland VHF Group. Amateur radio callsign: ZL1VMH.

1 0

ENUM Seminar
by Peter Macaulay 19 Nov '03

19 Nov '03

Just a reminder for those of you who would like to attend, you can still enrol. The $50 is primarily for food. The Number Administration Deed (NAD) Management Committee and Internet NZ are holding a joint seminar on ENUM on Monday 24 November 2003 from 9.00 am - 5.00 pm. The venue is the Level 2 West Lounge at Westpactrust Stadium in Wellington. Programme Tony Holmes of BT is attending as guest speaker. He intends to discuss the following topics: 1. Introduction to ENUM. 2. ENUM Specifications, Rules and Recommendations. 3. An overview of what's happening across the globe. 4. Experience, issues and problems from the UK ENUM trial. 5. The focus for New Zealand - discussion on 'what needs to happen next'. Representatives from the Ministry of Economic Development will also attend to present their views on ENUM. Cost $50.00 per person, which includes the full day ENUM seminar plus morning tea, lunch and afternoon tea. Registration and Contacts Jennifer Neeley (M-co) Phone: 04 498 0026 Fax: 04 473 6950 Email: jennifer.neeley(a)m-co.co.nz -- Peter Macaulay Executive Director InternetNZ Direct +64 4 495 2113

1 0

ICONZ Domestic Peering Update
by John Johnston 19 Nov '03

19 Nov '03

ICONZ have updated their domestic peering advertisements. Any that currently peer with ICONZ please update your prefix lists with attached file or use URL supplied. If there is anyone who would like to peer with ICONZ across APE or WIX please send an email to noc(a)iconz.net http://www.iconz.co.nz/prefix/ Regards ICONZ NOC Email: noc(a)iconz.net Phone: 09 977 3500

1 0

Xtra reverse DNS's
by Michael Hallager 18 Nov '03

18 Nov '03

Hi all, People who are receiving IP space from Global Gateway would be well advsied to check that their IP addresses have not been hijacked by Xtra: bash-2.05b# nslookup 210.55.169.1 Note: nslookup is deprecated and may be removed from future releases. Consider using the `dig' or `host' programs instead. Run nslookup with the `-sil[ent]' option to prevent this message from appearing. Server: 210.55.108.130 Address: 210.55.108.130#53 Non-authoritative answer: 1.169.55.210.in-addr.arpa name = 210-55-169-1.ipnets.xtra.co.nz. Authoritative answers can be found from: 169.55.210.in-addr.arpa nameserver = alien.xtra.co.nz. 169.55.210.in-addr.arpa nameserver = terminator.xtra.co.nz. bash-2.05b# Reminds me of the "old days" when Xtra started up.... Michael Hallager Systems Administrator Vivid Computers Ltd Managing Director Networkstuff Ltd

4 4

NZNOG '04
by Tony McGregor 17 Nov '03

17 Nov '03

Hi All The NZNOG '04 arrangements are coming along well and registration is now open at www.nznog.org. We're pleased to have Geoff Houston (Telstra Aust/APNIC) and Philip Smith (CISCO) as invited speakers. See the conference web pages for more details. Other details about the conference, including the the on campus accommodation etc are also on the web page. It's still possible to put in a talk or tutorial proposal. Please send them to talks(a)nznog.org. We're about to send out letters to various folks asking for sponsorship. We're not looking for lots of money, just ways to add value to the conference through materials, extra international speakers, the bar, etc. If you have any contacts that we could write to please let me know. It's a huge help if people sign up early. The conference fee is lower if you sign up early. Also, there is only limited accommodation with in-room network access, if you want that I suggest you sign up quick! Tony

1 0

New IANA IPv4 allocations and bogon updates: 83/8 and 84/8
by Rob Thomas 17 Nov '03

17 Nov '03

Hi, team. [ Apologies to those who have received this post in other fora. ] The numerous Team Cymru bogon projects have been updated to reflect the following IANA allocations on November 15, 2003: 83/8 Nov 03 RIPE NCC 84/8 Nov 03 RIPE NCC IANA allocations change over time, so please check regularly to ensure you have the latest filters if you are not using the bogon BGP feed(s). We do announce updates to the bogon projects to the FIRST community, as well as on lists such as NANOG, isp-routing, isp-security, isp-bgp, cisco-nsp, and bogon-announce. We can not stress this point strongly enough - these allocations change. If you do not adjust your filters, you will be unable to access perhaps large portions of the Internet. Worse yet, you may end up blocking access for people who transit through you. Please do not blindly apply any filters or blocks to your network without carefully considering the ramifications of doing so. As a point of reference, the master Bogon Reference Page can be found here: http://www.cymru.com/Bogons/index.html A quick summary of the documents and projects that have been updated include the following: HTTP The Bogon List The Text Bogon List, Unaggregated The Text Bogon List, Aggregated Secure BIND Template Secure IOS Template (Cisco) Secure BGP Template (Cisco) Secure JUNOS Template (Juniper) Secure JUNOS BGP Template (Juniper) Ingress Prefix Filter Templates, Loose and Strict (Cisco) Ingress Prefix Filter Template, Loose (Juniper) Ingress Prefix Filter Template, Strict (Juniper) BGP Bogon route-server * RADb fltr-unallocated fltr-martian fltr-bogons DNS Bogon (bogons.cymru.com) zone Monitoring Bogon prefix monitoring * All of the bogon peers have received the appropriate BGP prefix updates. Please feel free to contact Team Cymru with any comments, questions, or concerns. Thanks! Rob, for Team Cymru. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

1 0

Re: Weird spam
by Richard Cox 17 Nov '03

17 Nov '03

On 17 Nov 2003 11:25 UTC "Barry Murphy" <barry(a)unix.co.nz> wrote: | I received the same message 8 times to the same address with about | 2-3 per hour. My spamassasin picked them up but the strange thing was | they all came from different IP addresses and I couldn't traceroute | any of them... You've assumed the handoff between received lines was valid; it wasn't. The "earlier" received line in each case was totally bogus: there is now a variety of custom "spamware" that forges a Received: header and carefully matches the fake details to the reverse DNS of the proxy or trojan machine that the spammer is actually sending from. That makes it almost impossible to know that the line is is in fact forged, unless you spot some little detail that they get wrong ... like (as in some of the cases that you quoted), the fact that the fake sending IP in the forged header is in a block that's either unannounced or completely unroutable! | IP addresses they were sent from: 99.27.67.200 IANA Reserved 202.163.151.24 Assigned but not announced 89.87.209.213 IANA Reserved 112.188.234.68 IANA Reserved 45.38.78.200 Interop Show Network 244.128.164.67 Unroutable 168.80.80.67 UUNET Internet Africa 64.215.105.194 64.215.105.194 | the messages were stopped as they were listed in blacklists. Blocklist tests are normally done on the most recent Received: line, as unless that line is OK, previous lines cannot usually be trusted. | The thing I don't understand is that there was no consistency, all | the emails from different IP's, all different forged header fields, | all not tracerouteable and within 30 minutes of each other to an | address only listed on a new zealand website. I can traceroute to some of the IPs you listed so it may be that traceroute packets have been blocked at your gateway. There are currently very some good reasons why network administrators do that! Because of the level of filtering, spammers now try to send the same mail from different proxies/zombies to be sure of getting it through. Different IPs are in different blocklists, and spammers can't tell what blocklist your ISP - or that of any other victim - uses. They can't even tell whether mail gets through at all because many systems are now configured to drop the mail rather than reject it. I won't pass comment on that policy, but we all know it happens. Hence to get better delivery figures, spammers now have to send out multiple copies. Their systems randomise all the variable factors - fake mail client, fake origin, fake sender name, random subject line etc, and loads of random garbage text in the spam body to foil any checksum detection of bulk mailing. | Weird, sounds very much like the spam system explained on the list | not too long ago. While it may well use that system, multiple proxy/trojan sending boxes are now becoming a standard spammer-modus-operandi! Joe Abley <jabley(a)isc.org> replied: | It seems to be fairly commonplace these days for (a) spam to be | vectored through widely-distributed sets of open proxies or infected | windows drones and (b) for unallocated or normally unadvertised space | to be advertised transiently in order to provide temporary addresses | to bind SMTP clients to. (a) is normal, for sure, but (b) - although theoretically trivial to do - is not yet in common use. Bogus announcements would need to be visible every place the spammer wanted to send to, and would then be visible at the route-collectors which report into systems like RIPE's RIS server and that in turn would allow them to be identified from a lookup at http://www.ripe.net/ripencc/pub-services/np/ris/index.html -- Richard Cox \/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/ Contribute to the SpamCon Legal Fund!! http://www.spamcon.org/legalfund/

1 0

Weird spam
by Barry Murphy 16 Nov '03

16 Nov '03

Hey guys, Anyone else receive this subject on the 14th... "AMERICAN STOCK MARKET: TRHL Retains Sky Investor Relations...edita", where edita was changed with multiple names. Not strange that I received spam, however I received the same message 8 times to the same address with about 2-3 per hour. My spamassasin picked them up but the strange thing was they all came from different IP addresses and I couldn't traceroute any of them... All of them stop at 202.37.246.18 (Global-gateway) eg. traceroute 89.87.209.213 traceroute to 89.87.209.213 (89.87.209.213), 64 hops max, 44 byte packets 1 gateway (219.88.241.241) 1.679 ms 2.403 ms 1.358 ms 2 fe0-0.cr1.idc.orcon.net.nz (219.88.242.250) 0.863 ms 0.872 ms 0.852 ms 3 fe-1.qos2.idc.orcon.net.nz (219.88.242.226) 1.134 ms 1.004 ms 1.128 ms 4 219.88.242.233 (219.88.242.233) 1.774 ms 1.906 ms 1.567 ms 5 202.50.245.33 (202.50.245.33) 39.962 ms 93.651 ms 6.643 ms 6 ge-0-3-0-6.akbr3.global-gateway.net.nz (202.37.246.18) 6.165 ms !N^C Ip addresses they were sent from: 99.27.67.200 202.163.151.24 89.87.209.213 112.188.234.68 45.38.78.200 244.128.164.67 168.80.80.67 64.215.105.194 In all cases the messages were stopped as they were listed in blacklists. RCVD_IN_NJABL (0.9 points) RBL: Received via a relay in dnsbl.njabl.org [RBL check: found 45.38.78.200.dnsbl.njabl.org.,] [type: 127.0.0.9] RCVD_IN_UNCONFIRMED_DSBL (0.5 points) RBL: Received via a relay in unconfirmed.dsbl.org [RBL check: found 45.38.78.200.unconfirmed.dsbl.org.] RCVD_IN_BL_SPAMCOP_NET (3.0 points) RBL: Received via a relay in bl.spamcop.net [RBL check: found 45.38.78.200.bl.spamcop.net.] They were also stopped because of forged headers, some having forged froms, forged MUA Outlook, etc. The thing I don't understand is that there was no consistency, all the emails from different IP's, all different forged header fields, all not tracerouteable and within 30 minutes of eachother to an address only listed on a new zealand website. Weird, sounds very much like the spam system explained on the list not too long ago. Barry Murphy

2 1

Understanding my traceroute?
by Jon Dean 16 Nov '03

16 Nov '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Everybody, I'm trying to get a better understanding of how the DSL network is integrated together in New Zealand. I'm hoping someone can help explain to me why their is such big latency gaps in some of the connections. Below is the output from a traceroute between me on Ihug Jetstart DSL and an Xtra Jetstream connection with a Static IP. 1 192.168.1.2 (192.168.1.2) 0.299 ms 0.148 ms 0.142 ms 2 203-118-173-1.adsl.ihug.co.nz (203.118.173.1) 56.506 ms 57.695 ms 60.022 ms Is 203.118.173.1 an Ihug router or a Telecom router? 3 192.168.253.225 (192.168.253.225) 66.866 ms 58.911 ms 61.027 ms 4 192.168.254.42 (192.168.254.42) 70.011 ms 69.028 ms 59.954 ms 5 v-93-tig-nz-akl-core-1.ihug.net (203.109.156.145) 70.147 ms 69.346 ms 68.020 ms 6 203-109-156-98.ihug.net (203.109.156.98) 69.904 ms 67.363 ms 71.046 ms 7 a5-0-0-40.akcr5.global-gateway.net.nz (202.37.245.165) 210.854 ms 203.399 ms 185.586 ms This is my real question... why is this such a big lag between 6 & 7. 140ms seems to be very high? Is there some type of bandwidth gap between Ihug and Global Gateway? Everything below this point is irrelevant.... Cheers, Jon -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iD8DBQE/uGYITV0Xs0S7UB4RAg8zAJ4yB4wn5iqCWgzhQpljznjnyeTiSQCfaDAu INl9jjcMXNgPbWST7gHB5kE= =qECf -----END PGP SIGNATURE-----

2 2

BreezeNet PRO Serial Adapter...
by Dan Clark 16 Nov '03

16 Nov '03

Hi all, Does anyone happen to have one of those 3 pin serial adapters for a BreezeNet Unit? Or know the pinouts. Please contact offlist. Kind Regards, Dan Clark DunedinWireless Scarfies.Net Ltd

1 0

Apropos Spamcop, and 2day.com before that.
by Juha Saarinen 16 Nov '03

16 Nov '03

http://www.theregister.co.uk/content/6/33724.html -- Juha

3 2

Trademe contact?
by Simon Lyall 15 Nov '03

15 Nov '03

Has anyone got technical contact for trademe? I've tried their whois and 0900 numbers but their not operating today. -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz Ihug Ltd, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz

1 1

Revamp of WIX website
by Andy Linton 15 Nov '03

15 Nov '03

We've redone the WIX website http://www.wix.net.nz/ and it now has links to the Looking Glass tool as well as some explanations of how we do things. I'm working on a similar revamp of the APE website and will announce in due course. andy

5 12

Update to ihug prefixes
by Simon Lyall 14 Nov '03

14 Nov '03

We're updated our prefixes. Current list is attached or available at the following URL: http://www.ihug.net/ihug-prefix-list -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz Ihug Ltd, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz

1 0

Re: [nznog] IPv6 Peering on the WIX
by Simon Lyall 14 Nov '03

14 Nov '03

On Fri, 14 Nov 2003, Joe Abley wrote: > If you want to be able to reach the rest of the IPv6 internet, you will > need a transit provider of some kind. Since it sounds like nobody in > New Zealand is offering IPv6 transit, you'll need to look outside the > country and gain v6 transit via a tunnel plumbed over IPv4. Sprint appear to provide a ipv6, it's via tunnels but they provide direct ipv4 connectivity into NZ so you don't have multiple providers. http://www.sprintv6.net/ http://www.sprintv6.net/Sprintv6.html "Sprint has IPv6 speaking routers in New York City, Washington DC, Seattle, Ft. Worth, and San Jose in the US, and routers in Brussels, Belgium, and Stockholm, Sweden, in Europe. Customers who wish to connect to Sprint's IPv6 backbone may do so, by building a tunnel from their CPE (or any device inside their network) to the nearest Sprint IPv6 router. " -- Simon J. Lyall. | Very Busy | Mail: simon(a)darkmere.gen.nz "To stay awake all night adds a day to your life" - Stilgar | eMT.

1 0