- NZNOG - lists.nznog.org

SRS
by Nick Griffin 06 Jun '03

06 Jun '03

SRS and the whois was unavailable this morning as a result of a Citylink outage. SRS came back onstream at around 10:10am. cheers Nick -- Nick Griffin Registry Manager .nz Registry Services PO Box 24361 Wellington New Zealand e nick.griffin(a)nzrs.net.nz p + 64 4 931 6977 m + 64 21 505 229 f + 64 4 931 6979 w www.nzrs.net.nz

1 0

SRS
by Tim John 06 Jun '03

06 Jun '03

Anyone having difficulty connecting to the SRS this morning. I'm not getting there with on 'whois.srs.net.nz' Tim DISCLAIMER: The content of this email is confidential and may contain legally privileged information intended only for the individual or entity named above. Access to this message by anyone else is unauthorised. If you are not the intended recipient, please be advised that the use, distribution and publication of the above information is prohibited. If you have received this email in error, please contact Domainz by returning the email and destroying the original. Thank you.

2 1

Re: [nznog] W32/Bugbear-B
by Matthew Poole 05 Jun '03

05 Jun '03

On Fri, 06 Jun 2003 14:49:37 +1200, Ewen McNeill <ewen(a)naos.co.nz> wrote : > In message <003d01c32bba$88f42940$fd00a8c0(a)morpheus>, "Matthew G Brown" writes: *SNIP* > list at the nai.com URL that Dan Clark gave). Curiously anz.com.au is > there, but anz.co.nz is not, and westpac.com.au is there but > westpac.co.nz is not. > Not particularly curious when you consider the heavy consolidation that both ANZ and Westpac have recently done to move their operations across the Tasman. From experience I know that ANZ's 'net banking site is based in Aus (https://www.anz.com) and would imagine that WPT have probably done the same thing. If there's no secure traffic from the .co.nz domains, will BugBear even pay attention to them? > Obviously it's trying to pretend to be "The Bank" (almost all the > domains in its internal list seem banking related) despite the fact that > almost all banks have "webmail" systems rather than sending actual > email. > I used to hate ANZ's webmail system, until I reflected on the fact that their servers are considerably more secure than my home network - And they've definitely got a better chance of picking up an intrusion and doing something to the instigator. -- Matthew Poole Auckland, New Zealand

1 0

Re: [nznog] W32/Bugbear-B
by Ewen McNeill 05 Jun '03

05 Jun '03

In message <003d01c32bba$88f42940$fd00a8c0(a)morpheus>, "Matthew G Brown" writes: >Dan Clark wrote: >>http://vil.nai.com/vil/content/v_100358.htm > >Interesting, It has the domains asbbank.co.nz bankdirect.co.nz bnz.co.nz >and trustbank.co.nz as its sending domains. Ive had several people open >this already with the bankdirect.co.nz domain suffix. The "nz" bank domains appear to be: asbbank.co.nz bankdirect.co.nz bnz.co.nz nationalbank.co.nz trustbank.co.nz (obtained by grepping for "nz$" in a suitable transformed copy of the list at the nai.com URL that Dan Clark gave). Curiously anz.com.au is there, but anz.co.nz is not, and westpac.com.au is there but westpac.co.nz is not. Obviously it's trying to pretend to be "The Bank" (almost all the domains in its internal list seem banking related) despite the fact that almost all banks have "webmail" systems rather than sending actual email. Ewen

1 0

RE: [nznog] The End Is Nigh... Asia's running out of IP addresses
by Matthew Lamb 05 Jun '03

05 Jun '03

I wont be greedy, ill just take 10 or so, if you can spare them :-) Matt On Thu, 29 May 2003 11:39:11 +1200, "Brett Healy" <fork(a)btw.co.nz> wrote : > ill have it.. ill give it a good home. promise :D > > > Regards, > Brett Healy, > BTW Navigation Systems Ltd > > > -----Original Message----- > From: Kerry Thompson [mailto:kez-nznog(a)crypt.gen.nz] > Sent: Thursday, 29 May 2003 11:18 > To: nznog(a)list.waikato.ac.nz > Subject: Re: [nznog] The End Is Nigh... Asia's running out of IP > addresses > > > David Robb said: > > > > And just how much of that space is actually in use? > > > > And sometimes I wonder how much of the APNIC/NZ space is actually used as > well. > Years ago I registered a /22 off Netgate for a company, who never used it > and it stayed registered to my APNIC handle. I'm still wondering what to > do with it. And there's plenty of other such blocks out there that are > forgotten and unused. > > Kerry > > > -- > Kerry Thompson, CCNA CISSP > Information Systems Security Consultant > http://www.crypt.gen.nz > > > > _______________________________________________ > Nznog mailing list > Nznog(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog > > _______________________________________________ > Nznog mailing list > Nznog(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog > > >

2 1

W32/Bugbear-B
by Pipes Cuchifrito 05 Jun '03

05 Jun '03

Good Morning, Does anyone have any initial information on this virus? Are we looking downt he barrel of another network slow down? (another sleepless weekend?) Cheers, Pipes Rapturesecurity.com

3 3

Xtra Abuse
by Philip D'Ath 05 Jun '03

05 Jun '03

Isn't this typical. I try to report SPAM to Xtra's abuse account, and get an error message back saying that they have exceeded their own quota limit! --- This is a system generated message. Please DO NOT REPLY. Your message was not delivered for the following reason: The user(s) account is temporarily over quota. <responses(a)xtra.co.nz> For more information on why this message wasn't delivered, and an explanation of other common mail delivery errors, visit our Web site at: http://xtra.co.nz/maildelivery Kind regards. The Xtra Messaging Team

2 1

Could a mail admin from Xtra please contact me?
by Juha Saarinen 04 Jun '03

04 Jun '03

Apologies for this message, but I don't have a contact address for anyone there. -- Juha Saarinen

1 0

geek.nz approved in interim decision
by DPF 31 May '03

31 May '03

Many here will be pleased/interested to hear that in a unanimous 14-0 vote the InternetNZ Council voted in favour of creating geek.nz as the 12th 2LD for .nz. The interim decision is subject to further submissions, along with discussion of implementation details. A final decision will be taken at the next Council meeting in early July. DPF -- E-mail: david(a)farrar.com ICQ: 29964527 MSN: dpf666(a)hotmail.com

1 0

Update to the bogon route-server project
by Rob Thomas 29 May '03

29 May '03

Hi, NZNOG folk. We're pleased to announce the release of version 1.7 of the Bogon Route-Server Project. The major change in release 1.7 is the addition of three more bogon route-servers to the bogon route-server project, for a total of four. These are all managed by Team Cymru, and provide additional redundancy for the project. All of the bogon route-servers announce the same bogon prefixes and use the same ASN and community. Folks are free to peer with as many as they like, though we recommend a minimum of two. Peering with the bogon route-servers is *FREE*, though you are welcome to buy a cup of coffee for Rob at the SLC NANOG if you feel kindly. :) You can read more about the project here: <http://www.cymru.com/BGP/bogon-rs.html> You can read more about bogon filtering and tracking here: <http://www.cymru.com/Bogons/> Thanks! Rob, for Team Cymru. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

1 0

The End Is Nigh... Asia's running out of IP addresses
by Juha Saarinen 28 May '03

28 May '03

http://zdnet.com.com/2100-1103_2-1010666.html?tag=fdfeed I guess this means Australia/NZ too. Seems Joe's missive about IPv6 was quite prescient. -- Juha Saarinen

7 8

Re: [nznog] The End Is Nigh... Asia's running out of IP addresses
by Ewen McNeill 28 May '03

28 May '03

In message <Pine.LNX.4.30.0305291823140.17378-100000(a)boggle.ihug.co.nz>, Simon L yall writes: >On Thu, 29 May 2003, Joe Abley wrote: >> So, only 14% of the available IPv4 address space had been assigned to >> RIRs at the time of that presentation. > >Which is fairly meaningless since half those 202 are instead delegated >to Large Organisations, Various Registries etc. For sure. But if push comes to shove IANA can talk quietly (perhaps in the "talk quietly and carry a big stick" sense) to some of those Large Organisations and see if they couldn't perhaps manage with somewhat less than 2**24 addresses. >As the cost of putting a full IP stack and connection drops to only a >couple of dollars or less all sorts of random things will start having >them. And before you say NAT remember that the power company will want to >directly access your meter and hotwater cylinder, your car company the >car, your whiteware company the fridge etc. Did I mention the games >console? For many of those it could easily enough be done with NAT. It seems to me that "phoning home" isn't, inheriently, any more problematic than being able to interogate the devices remotely for the vendor. And it's probably somewhat preferable for the customer too. (Even if everything was globally routable, would you want Joe Random Company connecting in to arbitrary devices your network? This isn't your grandmother's Internet any longer. Sure you can use a firewall. You've just moved the problem to being one of ensuring a million or so firewalls are properly maintained. If I were a vendor, I'd take "phoning home".) >When stuff like that comes along we really want them to be deployed on a >nice ipv6 internet rather than have to suddenly switch cause demand >increases by a factor of 10 overnight. It would be nice to have $1,000,000 tomorrow too. I don't think either of them will happen.[0] Even at the current ease of use the cost/benefit ratio for converting to IPv6 is too low for (m)any(one) to put effort into doing so. It'll only be when there's a whole lot more benefit (eg, lots of IPv6-only services, or stuff which cannot be done with IPv4+NAT) or a lot less effort (works out of the box without even thinking about it, and has for years) that'll actually happen. Especially since we've had the better part of 10 years for everyone to get pretty good at designing IPv4+NAT compatible protocols and networks, thus greatly mitigating the perceived benefit of switching. Ewen [0] Although should someone wish to give me $1,000,000 tomorrow, I'd be willing to look suitably surprised on camera.

1 0

WTS Tracking controler and beacon receiver!
by Latchezar Dinev 28 May '03

28 May '03

1 0

WTS SSE Satellite SM3000modem in perfect condition
by Latchezar Dinev 28 May '03

28 May '03

1 0

WTS SSE Satellite SM3000modem in perfect condition
by Latchezar Dinev 28 May '03

28 May '03

1 0

WTS PM4 with 27E1 ports full loaded
by Latchezar Dinev 28 May '03

28 May '03

1 0

WTS CISCO AS5200-60DM-CH
by Latchezar Dinev 28 May '03

28 May '03

1 0

WTS 3COM Total Control 4E1 ports!
by Latchezar Dinev 28 May '03

28 May '03

1 0

IPv6 at APE
by Joe Abley 27 May '03

27 May '03

is anybody at the APE equipped to do IPv6 peering? Private replies are fine, I'll summarise if there's interest (and if there are replies).

11 18

Netforum Call for Papers
by Donald Neal 27 May '03

27 May '03

Roger De Salis sent this to the list: - - - - - The Netforum conference for 2003 is scheduled for July 10,11,12. The Theme of the conference is Next Generation Internet: Advanced Network Operations and Computer Networking in Aviation The conference will be extremely technical with >2/3 content devoted to advanced networking and related topics. Speakers are invited to submit proposals for papers to the conference committee by sending a synopsis and Title to "netforum(a)fx.net.nz". We look forward to an expanded conference in 2003, and the conference committee will be working very hard to meet or exceed the standard set by the 2002 conference, which I hope many of you enjoyed. The committee looks forward to receiving proposals. ==================================================================== In a similar manner, attendees are welcome to suggest topics or papers they are interested in seeing, and the conference organisers will then be able to help persuade likely speakersto stump up a talk. Send to "suggestions(a)fx.net.nz" Rgds Roger De Salis ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ------------------------------------------------------------------------------

3 2

Re: [nznog] IPv6 at APE
by Ewen McNeill 25 May '03

25 May '03

In message <5.2.0.9.1.20030526172452.055d4380(a)mail.igrin.co.nz>, Simon Byrnand writes: >The problem I can see with the introduction of ipv6 is that its such a >fundamental change, a bit like converting an entire country from imperial >to metric, except that you're trying to convert the WHOLE world :) Which sounds bad, except when you realise that the process doesn't require a "flag day", and has been very carefully designed so that it can happen over the course of several years (dual stacks, tunnels, etc). The major thing which is leading to slow progress, IMHO, is the lack of a really compelling need for it. IPv4 + NAT is a 90% solution. (OTOH there's something approaching a compelling need ofr multicasting, and that hasn't exactly happened much since last year either.) I think you're probably right that it'll take a very long time before IPv4 will be completely gone. But there've been plenty of other network protocols and many of them are nearly extinct. ("Native" windows networking is nearly gone -- haven't seen it in ages -- and even IPX is looking endangered (Novell went IP a couple of versions back), without even looking at protocols which were much less widely deployed.) FWIW, I do still keep meaning to experiment some more with IPv6 given some spare time, especially as most (all?) of the operating systems I'm using support IPv6 out of the box (OpenBSD, Linux, Solaris, etc, all support it out of the box these days). Ewen

1 0

Historical netblock allocation data?
by Juha Saarinen 22 May '03

22 May '03

Is there any publicly accessible repository that keeps information as to changes in netblock allocations? That is, noting to whom e.g. 152.152.0.0/16 or whatever was allocated originally, as opposed to whatever the current info happens to say? -- Juha Saarinen

1 0

Clear Dunedin Routing??
by Dan Clark 22 May '03

22 May '03

Hi guys, Is anyone on a local Clear/Telstra Frame anywhere in Dunedin area? Basicly we can see everything apart from another local ISP here in Dunedin on a similar Clear Frame as us. Its weird, we try connecting to port 25 on their IP and it fails, they try the same thing towards us with similar results. If we trace route to each other we get to an auckland clear router, then sent to wellington, then back to auckland in what seems like a loop. Can anyone shed some light on the situation, or if anyone else has a similar Clear POP in Dunedin area? Regards Dan Clark Network Manager Scarfies.Net Ltd

2 1

New and unacknowledged Exchange / Win2k SMTP vulnerability?
by Neil Gardner 21 May '03

21 May '03

Hi guys - for the last few weeks I've been working with Microsoft to try and track down why on Earth a correctly configured Exchange 2000 Server has been relaying. All of the standard sites report that it's closed, my own telnetting to it says it's closed, and yes, I've accounted for trojans on the LAN - but we're still going to try unplugging the rest of the LAN at some stage for a while and see what happens. But still, it's relaying. I add the IPs as I see them to a blacklist and it quietens down for a while, and MS keep promising they'll find the problem - but I send them SMTP logs, System and App logs and nothing adds up. All tests show it's closed, and all Logs (and complaining recipients) prove it's open for at least one attacker. Most of the reported sender addresses are in the format SMTPxxxx.YAHOO.COM (where xxxx is a random 4 digit number) But all resolve to chinanet or something. Recently though (today), they have been reporting as just 'exploder' or 'range' This is screaming 'vulnerability' to me, but MS refuse to acknowledge anything. I have heard in the last 20 minutes that a different organisation in Wgtn (with a different integrator) is having exactly the same problem, and that "Telecom is talking to Microsoft about it, but is getting nowhere" - I can't substantiate that yet though. No, the client isn't using an SMTP AV gateway, or firewall, Yes, they should be - and this will may in fact be the straw that broke the Financial Controllers back. But my current question is does anyone know WHAT this attack is, or if there's a configuration workaround I can do short of sticking a non win2k SMTP gateway between the net and Exchange? I can't post the SMTP logs publically because of a confidentiality agreement, but if anyone has an idea and would like to see a sample, please let me know and I'll see if the IT admin of the affected site will allow it. Cheers - Neil G.

1 0

Netforum 2003
by Roger De Salis 20 May '03

20 May '03

/* Early bird registrations close on 30th May, so please make sure you have your bookings in, we only have so much space.. */ The following additional talks have been scheduled for the conference Simon Lyall has kindly volunteered a talk about SPAM from an ISP perspective ----------------------------- - Filtering Products and and technology - Customer expectations - Managing Customer expectations ------------------------------------------------------- David Harris, of Pegasus fame is travelling all the way from Dunedin to talk about spam from the MUA persepctive and join a panel discussion on SPAM, and possible ISP and User solutions(?) to SPAM, which we all know is reaching epidemic proportions..... (should there be a small programming competition, the best 5 line perl program which can generate the most eloquent version of "my name is Enkidei Duee, son of Fred Duee, who has some implausible sum in the bank, and needs.....") ----------------------------------------------------------- David Hawke from Genaware is talking about GIS on Linux, and will no doubt have some comments about Linux on the desktop as opposed to linux in a server environment. ------------------------------------------------------------- KC Claffy from Caida in San Diego has indicated a willingness to join us in Auckland, and talk about some of the stuff CAIDA get up to. ------------------------------------------------------------ The flight simulator demo will include a discussion about the power of the internet to accelerate development, and particularly hooking the display (3-5 projectors) to live telemetry data and radio channels, thus effectively hooking yourself into the cockpit of a 737 currently landing at Auckland Airport. ------------------------------------------------------------ As we get closer to the conference, I shall be sending out small notes weekly to add the various talks and information as it comes to hand.. Rgds Roger De Salis -- \_ Roger De Salis rdesalis(a)fx.net.nz </' FX Networks +64 25 481 452 /) Wellington, New Zealand roger(a)desalis.gen.nz (/ ` DSL - the 56k modem technology of 2004

1 0