- NZNOG - lists.nznog.org

Xtra APE circuit down
by Peter Fitchett 22 May '02

22 May '02

FYI Xtra's APE circuit went down this morning at about 4.20am The fault is under action. regards peter - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RPSL on rs2.ape.net.nz - a request for help.
by Simon Blake 21 May '02

21 May '02

Hi Folks ASJL and I are working on RPSL on the second route server on APE, we're investigating ways of making the route servers better, stronger, more trustworthy, and easier to use for the ISP's out there. To that end, we need as many peers advertising routes into the route server as we can lay our grubby mitts on. So, a request please - if you're on APE, can you set up a peering session with 192.203.154.2 on ASN 9560, and drop me a line with your prefix list in it. At this stage, I'd recommend ignoring everything you receive from the route servers. Thanks muchly Si - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 1

RE: Red Alert - sharp increase port 1433 (MS SQL) scans
by Arjen De Landgraaf 21 May '02

21 May '02

For those who are interested, a rolling update on the 1433/SQL Snake outbreak is published in "Latest Security News" at www.e-secure-it.us The document Port 1433/SQL Snake Update(text)is updated whenever new details become available. Arjen - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Red Alert - sharp increase port 1433 (MS SQL) scans
by Michael Bordignon 21 May '02

21 May '02

we've been getting alot of these too - 3 connections from each host, 21 so far (all today, between 11am and 4pm) - michael -----Original Message----- From: Arjen De Landgraaf [mailto:arjen.de.landgraaf(a)cologic.co.nz] Sent: Tuesday, 21 May 2002 3:44 PM To: nznog(a)list.waikato.ac.nz Subject: Red Alert - sharp increase port 1433 (MS SQL) scans Importance: High We just issued a "Red Alert" on a rapid and sharp increase in port 1433 TCP probes. If you have MS SQL Server behind web services, you should monitor. Further information will be available shortly under newsitems at: www.e-secure-it.us www.e-secure-it.co.nz Arjen de Landgraaf E-Secure-IT - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

Red Alert - sharp increase port 1433 (MS SQL) scans
by Arjen De Landgraaf 20 May '02

20 May '02

We just issued a "Red Alert" on a rapid and sharp increase in port 1433 TCP probes. If you have MS SQL Server behind web services, you should monitor. Further information will be available shortly under newsitems at: www.e-secure-it.us www.e-secure-it.co.nz Arjen de Landgraaf E-Secure-IT - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Cisco 2610
by Leon Toh 19 May '02

19 May '02

Hi Folks, I'm looking for a Cisco 2610 to purchase. If anyone out there happen to have 1 and willing to part with it please drop me a line than (off the list). Best Regards, Leon - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Resources
by James Tyson 19 May '02

19 May '02

Hey folks. I thought I would do a quick whip-around and ask if anyone knows of any recruitment companies, etc that specialise in our high-level expertise? Or is it always who you know and not what you know? -- Cheers. --- James Tyson Moebius Systems Ltd http://www.moebius.co.nz/

4 4

Forcing TTL expirey in bind
by Donovan Jones 15 May '02

15 May '02

Hi I'm a new subscriber to the list. I have a few questions I believe are appropriate for this list. On a non-authoritative nameserver running BIND is it possible (when sshed onto the server): 1. to view the current TTL on a cached record? 2. to force a cached record with some time still to run to expire, i.e. to re query the record. Using the nslookup or host commands is it possible to: query a nameserver to get the time till a cached name will be looked up host -t SOA domain.net returns the initial TTL, but not the time remaining Donovan Jones - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

NZNOG 2002 Speakers - Updated Draft List
by Donald Neal 14 May '02

14 May '02

Here's the current draft list of NZNOG speakers for 11 and 12 July. Work is continuing on clarifying one or two other contributions. This looks to me like a strong two-day programme. 802.11a - Matthew G. Brown, B & R Holdings Distributed Denial of Service: The current state and counter measures - Juergen Brendel, Esphion Ltd IPv6 for Dummies (and not so Dummies) - Dean Pemberton, Juniper Networks (Aust.) Multicast Development - Greg Shephard, Juniper Networks (USA) Multicasting - an Introduction to the Technology and Applications - David Robb, Telecom NZ Multitenanted VoIP and the VoIP Market in New Zealand - Roger De Salis, Cisco Systems NLANR Active Measurement Project - Tony McGregor, The University of Waikato Providing Outsourced Network Security Solutions - Arron Scott, Cisco Systems Residential Ethernet-on-Fibre - Colin Goodwin, Ericsson NZ RPSL - Andy Linton, Lionra Strategies for Managing Denial of Service - Ian Quinn, Juniper Networks Tracking and Quantifying DDoS Attacks - David Moore, CAIDA (USA) Any substantial addition - and such an addition is possible - would mean that we'd need to go to a third day. If that were done, Thursday and Friday 11 and 12 July would remain the days for papers, with tutorial time on Saturday 13th. A registration announcement should follow shortly. - Donald Neal "MMS <telecom.co.nz>" made the following annotations on 05/13/02 10:52:50 ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ------------------------------------------------------------------------------ - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 5

Job Opening.
by Roger De Salis 13 May '02

13 May '02

Tired of the same-old same-old meetings. Bothered by 5 minutes of creative programming, and 168 hours of mindless meetings to explain a simple concept to a weird guy in a suit.... Here is your opportunity... Recommend your favourite telecom executive to the career opportunity of a lifetime, think about how the Monday morning meetings will look when everyone at the table has a Kalashnikov...... think about project overruns when the result is likely to be impacted by the arrival of B52's.... :-) /R Subject: Short term assignment: Afghanistan Ministry of Communications Date: Tue, 14 May 2002 02:07:34 +1000 (EST) Draft Terms of Reference, Adviser to Afghan Ministry for Communications I. Introduction Internews Network, through its leadership of the USAID-funded dot-GOV program, has been asked to identify and recruit an adviser to work directly with the Ministry of Communications, Government of Afghanistan. This position will be for three to six months. Additional work may be needed, depending upon the political and economic situation. The need to place an experienced individual with the Ministry to provide technical assistance to advise the Minister and his staff is acute. The adviser would receive additional support through the dot-GOV program in terms of specialized technical information needed to help the Minister and Ministry. Current situation. The infrastructure for telecommunications in Afghanistan is virtually nonexistent on a national basis. There are currently several thousand analog and Chinese supplied digital phones in Kabul. Kandahar and Herat have only a few thousand operating phones. There is great interest in the role of VSATs for network expansion. Additionally, there are high expectations for a new mobile cellular. There are plans to develop a microwave long distance network linking six major metropolitan hubs from which the network could be gradually expanded to villages and towns. Development needs. With the need for Afghans to rebuild infrastructure and restore a knowledge base in all sectors (health, agriculture, education, industry, finance and banking, the arts, trade), it is essential that Afghan citizens be provided with telecommunications access and the physical infrastructure for development of the Internet, radio and TV. Access to telephones and the Internet for women are critical factors for stimulating local markets and alternative educational and health services, and reintegrating, at their own pace, women back into public life. Afghans living in remote villages cut off by areas heavily infested with land mines need to know what is happening in various parts of the country and have the capacity for two-way communication. A functional and effective transparent telecommunications system is fundamental to rebuilding infrastructure in each sector of the economy and to discouraging consolidation of power over ICT technologies that limit the use and access to these by the average citizen. Market forces. Leaving aside security and military concerns, international telecommunication firms are currently trying to advise the Afghan government on which set of systems or alternative technologies to invest in and which systems and equipment to purchase. Without a strategic policy framework built by the Ministry staff and a related legislative framework for telecommunications, the Afghan government could find itself frozen into inappropriate technologies and bad system and vendor initial choices. Given the dire need for reconstruction and development of alternative small and medium sized economic activities it will not be possible for the Afghan government to achieve realistic economic development goals and rebuild civil society without an active and knowledgeable Ministry of Communications. II. Illustrative Tasks This individual will advise the Minister of Communications and his designates on developing a policy and regulatory environment needed to build on and evolve an operative telecommunications system in Afghanistan. Ideally the individual will have experience working in with the legal, technical, regulatory, and financial areas of telecommunications. However, what perhaps is equally important is an adviser who has experience working with governments in transition, with very poor physical infrastructure, a diverse and geographically and socially isolated population. Key to the success of this technical assistance assignment is the development of: 1. A clear strategic plan that the policy and technical staff of the Ministry can make operative through various steps (depending upon the political environment) that will address at the minimum: Licensing policy Spectrum management Interconnection management Consumer protection The need for a regulatory agency and role of regulation Internet issues 2. Intensive follow-on mentoring and advising the Afghans that have been supported by the US government for short-term training in the U.S., Afghanistan, and elsewhere. 3. Day-to-day assistance advising on the administrative and management plans for the Ministry. 4. Supporting the Ministry through active liaison with international aid agencies and UN organizations for the purpose of implementing a telecommunications infrastructure, and developing effective mechanisms for dealing with the private sector telecommunications industry. 5. Identify additional needs for technical assistance and training in telecommunications. 6. Any other tasks that will materially assist the Ministry with progress toward its goal of achieving a critical set of competencies in telecommunications management and regulation. III. Deliverables A set of concrete, realistic deliverables will be formalized within the first week of the assignment, related to the tasks illustrative tasks listed above. These will be agreed upon with the Minister of Communications, the USAID Mission, the dot-GOV CTO, and dot-GOV technical team. Please contact any of the following if you have possible candidates: 1. Dr. Sarah J. Tisch, dot-GOV Project Director 202-833-5740, ext. 203 stisch(a)internews.org 2. Dr. George Sadowsky, dot-GOV Senior Technical Adviser 202-415-1933 george.sadowsky(a)internews.org 3. Ms. Mariana Ovtcharova, dot-GOV Program Associate 202-833-5740, ext. 206 mariana(a)internews.org -- \_ Roger De Salis rdesalis(a)cisco.com </' Cisco Systems NZ Ltd +64 25 481 452 /) L8, ASB Tower, 2 Hunter St +64 4 496 9003 (/ Wellington, New Zealand roger(a)desalis.gen.nz ` In October 2001, the 5th most important product line by value for Cisco is - the telephone. Cisco 79x0 IP telephones. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Domain name spammers
by Simon Byrnand 12 May '02

12 May '02

Hi all, Just wondering if anyone else is getting spammed to death lately by a company calling themselves "Internic Online" http://www.interniconline.com trying to peddle "cheap" domain name registration. The fact that they're sending their junk through dozens of different open relays makes them hard to block, and I fail to see how any legitimate company would send "advertising" material through open relays.... Anyone ever tried to contact them and tell them to go away ? :) Regards, Simon - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Connection problems to SMTP servers
by Tracy Briscoe 11 May '02

11 May '02

Ordinary I would not post to this list, but as I could not get any useful help out of the two ISPs help desks I called, I will go to those who actually can provide some help. One of our clients is running MDaemon version 2.8.5.0, and has it set up to do a DNS lookup, and send the mail to the appropriate SMTP server as indicated by the MX record. On Thursday we were notified that mail was not getting to Ihug or Tranz Rail. Upon investigating on Friday, I found that they could connect to zuul.ihug.co.nz (I Telneted into port 25 for this diagnosis), but the welcome message "220 mx1.ihug.co.nz ESMTP Exim 3.22 #1 Sat, 11 May 2002 21:29:37 +1200" took between 1 and 1.5 minutes to come up. Connections to mxtrlwn1.tranzrail.co.nz could be made, but I gave up waiting for the welcome message. Connections to other SMTP servers work fine. I have got around the problem by forwarding all their mail to their ISP's SMTP server for distribution, but would like to know what may have caused this so that it can be fixed properly. I have included any info that I thought might be useful below. Any help gratefully received. -Tracy Briscoe -Network Engineer -Patcom Ltd ---------------------------------------------------------------------------- ---------------------------------------------------------------- Windows NT 4.00.1381 running as a proxy server, ie not as their fileserver Running: MDaemon version 2.8.5.0, netmaster 2.4.1, proxy 2 Connecting via ISDN to Xtra route print =========================================================================== Interface List 0x1 ........................... MS TCP Loopback interface 0x2 ...00 90 27 f7 1b 0d ...... Intel(R) PRO PCI Adapter 0x3 ...00 90 bc 01 48 0a ...... SkyMedia-200D Ethernet Adapter. 0x4 ...00 01 f0 ab d6 80 ...... NdisWan Adapter =========================================================================== =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 210.54.227.49 210.54.227.49 1 100.100.100.0 255.255.255.0 100.100.100.100 100.100.100.100 2 100.100.100.100 255.255.255.255 127.0.0.1 127.0.0.1 1 100.255.255.255 255.255.255.255 100.100.100.100 100.100.100.100 1 127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1 192.168.11.0 255.255.255.0 192.168.11.2 192.168.11.2 2 192.168.11.2 255.255.255.255 127.0.0.1 127.0.0.1 1 192.168.11.255 255.255.255.255 192.168.11.2 192.168.11.2 1 210.54.227.0 255.255.255.0 210.54.227.49 210.54.227.49 1 210.54.227.49 255.255.255.255 127.0.0.1 127.0.0.1 1 224.0.0.0 224.0.0.0 100.100.100.100 100.100.100.100 1 224.0.0.0 224.0.0.0 192.168.11.2 192.168.11.2 1 224.0.0.0 224.0.0.0 210.54.227.49 210.54.227.49 1 255.255.255.255 255.255.255.255 192.168.11.2 192.168.11.2 1 =========================================================================== ipconfig Windows NT IP Configuration Host Name . . . . . . . . . : jdwnt2 DNS Servers . . . . . . . . : 202.27.184.5 202.27.184.3 Node Type . . . . . . . . . : Hybrid NetBIOS Scope ID. . . . . . : IP Routing Enabled. . . . . : Yes WINS Proxy Enabled. . . . . : No NetBIOS Resolution Uses DNS : No Ethernet adapter E100B1: Description . . . . . . . . : Intel(R) PRO PCI Adapter Physical Address. . . . . . : 00-90-27-F7-1B-0D DHCP Enabled. . . . . . . . : No IP Address. . . . . . . . . : 192.168.11.2 Subnet Mask . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . : Primary WINS Server . . . . : 192.168.11.1 Secondary WINS Server . . . : 192.168.11.2 Ethernet adapter sm200dtp4: Description . . . . . . . . : SkyMedia-200D Ethernet Adapter. Physical Address. . . . . . : 00-90-BC-01-48-0A DHCP Enabled. . . . . . . . : No IP Address. . . . . . . . . : 100.100.100.100 Subnet Mask . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . : PPP adapter NdisWan5: Description . . . . . . . . : NdisWan Adapter Physical Address. . . . . . : 00-01-f0-ab-d6-80 DHCP Enabled. . . . . . . . : No IP Address. . . . . . . . . : 210.54.227.49 Subnet Mask . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . : 210.54.227.49 traceroute Tracing route to zuul.ihug.co.nz [203.109.252.10] over a maximum of 30 hops: 1 63 ms 78 ms 78 ms 192.168.9.200 2 187 ms 110 ms 125 ms 192.168.9.3 3 78 ms 78 ms 78 ms 203.96.111.230 4 94 ms 94 ms 78 ms f0-0-0-1.IPNAK1-B3.xtra.co.nz [203.96.111.145] 5 78 ms 78 ms 78 ms ihug1.ape.net.nz [192.203.154.36] 6 79 ms 93 ms 94 ms mx2.ihug.co.nz [203.109.252.10] Trace complete. Tracing route to mxtrlwn1.tranzrail.co.nz [202.135.38.132] over a maximum of 30 hops: 1 78 ms 78 ms 79 ms 192.168.9.200 2 219 ms 203 ms 110 ms 192.168.9.3 3 78 ms 63 ms 78 ms 203.96.111.230 4 78 ms 78 ms 78 ms f0-0-0-1.IPNAK1-B3.xtra.co.nz [203.96.111.145] 5 78 ms 78 ms 78 ms att.ape.net.nz [192.203.154.74] 6 93 ms 79 ms 78 ms auck1br1-fe-4-0-0.nz.prserv.net [152.158.255.222] 7 78 ms 94 ms 93 ms well1br1-0-0.we.nz.prserv.net [152.158.254.85] 8 125 ms 125 ms 109 ms nz-tranz.nz.prserv.net [152.158.254.73] 9 * * * Request timed out. 10 * * * Request timed out. 11 * * * Request timed out. 12 * * * Request timed out. 13 * * * Request timed out. 14 * * * Request timed out. 15 * * * Request timed out. 16 * * * Request timed out. 17 * * * Request timed out. 18 * * * Request timed out. 19 * * * Request timed out. 20 * * * Request timed out. 21 * * * Request timed out. 22 * * * Request timed out. 23 * * * Request timed out. 24 * * * Request timed out. 25 * * * Request timed out. 26 * * * Request timed out. 27 * * * Request timed out. 28 * * * Request timed out. 29 * * * Request timed out. 30 * * * Request timed out. Trace complete. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 4

List of ADSL providers
by Dalibor Andzakovic 10 May '02

10 May '02

Hello, I'm trying to compile a complete list of nz's ADSL providers for an onlinan sale site. Can anyone point me to the one, or post one on this list? Tia dali - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

6 6

NZNOG 2002 Speakers - Draft List
by Donald Neal 10 May '02

10 May '02

Here's the current draft list of speakers for the NZNOG gathering of 11 and 12 July 2002. Work is continuing (thanks, Dean) on clarifying the contributions of other speakers. Announcements of further speakers and of registration arrangements should follow shortly. - Donald Neal Papers ―---- 802.11a - Matthew G. Brown, B & R Holdings DDoS - Juergen Brendel, Esphion Ltd DoS - Ian Quinn, Juniper Networks IPv6 for Dummies - Dean Pemberton, Juniper Networks (Aust.) Multi-Tenanted VoIP and the VoIP market in New Zealand - Roger De Salis, Cisco Systems NLANR Active Measurement Project - Tony McGregor, The University of Waikato Tracking and Quantifying DoS Attacks - David Moore, CAIDA (USA) Voice over DSL - Colin Goodwin, Ericsson NZ Tutorial ―------ RPSL - Andy Linton, APNIC -- Donald Neal Special Operations Network Delivery Telecom New Zealand Ltd "MMS <telecom.co.nz>" made the following annotations on 05/10/02 15:26:14 ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ------------------------------------------------------------------------------ - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: List of ADSL providers
by Zanetti David 09 May '02

09 May '02

Joe Abley [mailto:jabley(a)automagic.org] wrote: > On Fri, May 10, 2002 at 10:47:17AM +1200, Dalibor Andzakovic wrote: > > I'm trying to compile a complete list of nz's ADSL providers for an > > onlinan sale site. > > The Onlinans are lucky, as the list of generally-available DSL > providers is quite manageable: > > 1. Telecom New Zealand. > 2. Certain customers of Telecom New Zealand. Don't Clear do DSL over their own copper. Approximately of no useful availability, but that's beside the point. :) -- David Zanetti <david.zanetti(a)nzpost.co.nz> Security Engineer, New Zealand Post Desk: +64-4-496-4005 Mobile: +64-25-832-572 "Hope.. is a dangerous thing" This email with any attachments is confidential and may be subject to legal privilege. If it is not intended for you please reply immediately, destroy it and do not copy, disclose or use it in any way. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

RE: Carriers blocking IPSec...official policy?
by rob.edkins＠axon.co.nz 09 May '02

09 May '02

> We do IPSec VPNs on a weekly basis, and have never struck any > carrier in NZ blocking ESP traffic. > Nor had we until we did ;-) It's probably more accidental than intentional, like I say, 'catch all' rules that occaisonally bite. It's something to look out for though. We wasted a lot of time on debugging the first one. Rob -- The information contained in this e-mail message is intended only for the use of the person or entity to whom it is addressed and may contain information that is CONFIDENTIAL and may be exempt from disclosure under applicable laws. If you read this message and are not the addressee you are notified that use, dissemination, distribution, or reproduction of this message is prohibited. If you have received this message in error, please notify us immediately and delete the original message. You should scan this message and any attached files for viruses. Axon Computertime accepts no liability for any loss caused either directly or indirectly by a virus arising from the use of this message or any attached file. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Off-Topic : MainStream Internet Solutions Limited
by Sahil Gupta - Net4U Limited 08 May '02

08 May '02

This applies to clients/wholesalers of MainStream Internet Solutions Limited. This is to inform the people of this industry that Net4U Limited has formerly ceased all dealings with MainStream Internet Solutions Limited. Dialup Internet Accounts were terminated at 6pm on 8th May, 2002 and ADSL Accounts shall be terminated by 6pm on 9th May, 2002. The domain name "faster.net.nz" still remains property of "Francois Computer Systems Limited". Wholesalers are advised not to deal with the company for various reasons, if require any further information you are welcome to contact me off-list, if necessary. Regards, Sahil Gupta Net4U Limited - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 2

Carriers blocking IPSec...official policy?
by rob.edkins＠axon.co.nz 08 May '02

08 May '02

Greetings folks, We have had several instances recently of problems with IPSec VPNs that turned out to be caused by ACL's at the ISP or carrier level blocking ESP traffic, or rather any IP traffic that isn't TCP, UDP, ICMP or routing stuff. There is no one particular network provider involved (one was offshore), and it doesn't seem to be a general practice, but we seem to be getting caught occaisonally by default "deny all IP" catch-all rules of the kind you stick at the bottom of the access list. Sometimes, it's only one interface in a particular direction. We've wasted a large amount of time and effort debugging and trying to get people to check their router configs for us, with varying degrees of co-operation. Has anyone else struck similar issues? Can anyone comment on whether this is a general 'no VPNs on our turf' policy, as one provider's help desk has (not terribly helpfully) suggested? Rgds, Rob Edkins Systems Consultant Axon Computertime email: rob.edkins(a)axon.co.nz -- The information contained in this e-mail message is intended only for the use of the person or entity to whom it is addressed and may contain information that is CONFIDENTIAL and may be exempt from disclosure under applicable laws. If you read this message and are not the addressee you are notified that use, dissemination, distribution, or reproduction of this message is prohibited. If you have received this message in error, please notify us immediately and delete the original message. You should scan this message and any attached files for viruses. Axon Computertime accepts no liability for any loss caused either directly or indirectly by a virus arising from the use of this message or any attached file. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Traffic Magnet At It Again
by Mark Foster 06 May '02

06 May '02

I got hit by Traffic Magnet again.. spamcrawlers are nasty. I noticed a coupla quirks... Firstly, when I traceroute to the IP concerned, clix are sending me to LA first.. whats up with that? :) Next... 26. 202.106.192.222 0% 38 38 418 415 438 469 27. GSR01-ToBTO-02.tynoc.bj.capitalnet 22% 30 38 420 409 442 496 28. RSM04-ToGSR01.TY.bj.capitalnet.com.cn 0% 38 38 441 433 481 542 29. 211.101.236.29 0% 38 38 417 417 438 466 Interesting hostname on hop 27 there.. :) I know this host has been discussed in the past, did anyone make any progress pursuing this? Im about to block capitalnet from connecting to my MTA... Mark. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 3

Mailwasher.
by Simon Lyall 06 May '02

06 May '02

Are other people having problems with customers using this program? It has a function for "bounce" spam which forges bounces from MAILER-DAEMON at the ISP's domain. I seem to only have a very small number of customers using it but the queues on my mail smtp servers are growing a bit with emails to bogus addresses waiting to time out (which is why there is a seperate server for bounces in the first place). I'm really worried that if use of the program takes off I'll have to re-resource ($$$) my mail servers to take account of a few 10,000s emails sitting in the outgoing queues or else the same customers will start blaming me for not delivering their emails in less than 10 seconds. I think the author is from New Zealand, anybody know them , an address where I can send a bill would be great. I also really object to the concept of the program forging email addresses on emails. -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

RE: Mailwasher.
by Darrin Cooke 06 May '02

06 May '02

-----Original Message----- From: Simon Byrnand [mailto:simon(a)igrin.co.nz] >Maybe the author of the program needs a friendly but firm whack with a clue >stick to remove the offending functions of the program. The last thing we >need is more undeliverable crap sitting in outbound queues. The spammers >themselves provide ample quantity there :) >Regards, >Simon I just dicovered that the Netguide magazine has half a page about mailwasher, They seem to be recommending it; "Mailwasher (insert URL here) analyses each email as is arrives and warns you if it is suspected junkmail or a virus. But not only does it let you delete unwanted emails before you download them, it also bounces them back so it looks like your email address is invalid." etc etc etc. They credit a "Christchurch businessman Nick Bolton" with the idea. <insert comments regarding LART'ing with large clue stick here> Cheers, Darrin - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Mailwasher.
by Gordon Smith 06 May '02

06 May '02

Hi Simon, I had a couple of customers using it, until I informed them that technically they were breaching our AUP (forging headers). I don't care if they want to use it for filtering, but trying to bounce to domains with bogus MX pointers just causes me problems. Once they understood the issue, they were quite happy to just use the filtering functions. Cheers, Gordon - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Re: FW: Walker Wireless attacking other ISPs?
by Steve Phillips 04 May '02

04 May '02

Sorry, this was supposed to hit the list Friday, but due to posting restrictions it never made it through :-) -- As the owner of this IP block, we were made aware of the issue, we requested that we be given until the end of the working day to obtain a response from the customer involved. We personally appreciate Gordon's restraint in agreeing not to post details on this until such time as the deadline was met or the formal response was obtained. Sadly, we did not manage to get a formal response to Gordon about this issue. The customer in question was null routed at the time, the block was removed pending comment from the customer but if this causes an issue for anyone else in the Internet community then please let us know and the null will be re-instated. Thanks, -- Steve. Systems Admin, ICONZ At 16:15 3/05/2002, Juha Saarinen wrote: >On 3 May 2002, Dean Pemberton wrote: > > > > > I REALLY hope that you made Walker Wireless aware of this before you > > posted it to the whole list. > >That would've spoilt the ensuing flame war though, wouldn't it? > >-- >Juha Saarinen > >- >To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz >where the body of your message reads: >unsubscribe nznog -- Steve Systems Admin, ICONZ - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

FW: Walker Wireless attacking other ISPs?
by Gordon Smith 02 May '02

02 May '02

Hi all, Has anyone else been seeing mail1.walkerwireless.com attempting to break in to their border routers? Picked this up on a routine log audit. Although we actively block and log this sort of activity, others may not be aware of it. Of particular concern is the attempted use of the ILMI exploit, detailed at http://www.kb.cert.org/vuls/id/976280 which has no legitimate reason to be seen. Attacking machine is running Checkpoint FW-1 mail server! Cheers, Gordon Smith CCNA Network Operations Manager MoreNet Ltd. Fingerprint: 4093 91BC 0055 46B9 1B1A EDBA 45AD 2381 7B1D E4BE Log extract (multiple occurrances of this): 04/23/2002 15:38.24 <WARN:SNMP> last message repeated 2 times 04/23/2002 15:38.14 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "ILMI" 04/23/2002 15:38.14 <WARN:SNMP> last message repeated 2 times 04/23/2002 15:38.02 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "DHdW7tr5nP" 04/23/2002 15:38.02 <WARN:SNMP> last message repeated 2 times 04/23/2002 15:37.52 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "P8nD8l1n7" 04/23/2002 15:37.52 <WARN:SNMP> last message repeated 2 times 04/23/2002 15:37.44 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "wd1h2dt2d" 04/23/2002 15:37.44 <WARN:SNMP> last message repeated 2 times 04/23/2002 15:37.34 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "private" 04/23/2002 15:37.34 <WARN:SNMP> last message repeated 2 times 04/23/2002 15:37.24 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "public" 04/23/2002 11:37.42 <WARN:SNMP> last message repeated 2 times 04/23/2002 11:37.32 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "ILMI" 04/23/2002 11:37.32 <WARN:SNMP> last message repeated 2 times 04/23/2002 11:37.18 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "DHdW7tr5nP" 04/23/2002 11:37.18 <WARN:SNMP> last message repeated 2 times 04/23/2002 11:37.10 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "P8nD8l1n7" - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

RE: Walker Wireless attacking other ISPs?
by Richard Watson 02 May '02

02 May '02

We have noticed this and have taken action to stop these SNMP polls from reaching other ISPs. The polling of addresses blocks managed by other ISPs was purely accidental and should not happen again. Walker Wireless is more than willing to investigate incidents like this directly. If anyone has concerns about unusual activity orginating from anywhere in the Walker Wireless network please contact our Network Operations Centre on 0800-WWCARE or myself directly. Thank you, Richard Watson Network Infrastructure Engineer WALKER WIRELESS LIMITED Tel: +64 (9) 522 3674 Fax: +64 (9) 520 3447 Mob: +6427 286 6681 Email: rwatson(a)walkerwireless.com 0800 NO NETLAG Get high speed wireless internet and private network connectivity with Walker Wireless. Visit www.walkerwireless.com for information. The information in this electronic mail and its attachments is legally privileged and confidential. If the reader of this electronic mail and attachments is not the intended recipient, you are hereby notified that any use, dissemination or reproduction of this electronic mail its contents and attachments is prohibited. This email is personal and may not reflect Walker Wireless', Walker Corporation's subsidiaries or affiliated companies' position. -----Original Message----- From: Gordon Smith [mailto:gordons(a)morenet.net.nz] Sent: Friday, 3 May 2002 4:09 p.m. To: Nznog Subject: FW: Walker Wireless attacking other ISPs? Hi all, Has anyone else been seeing mail1.walkerwireless.com attempting to break in to their border routers? Picked this up on a routine log audit. Although we actively block and log this sort of activity, others may not be aware of it. Of particular concern is the attempted use of the ILMI exploit, detailed at http://www.kb.cert.org/vuls/id/976280 which has no legitimate reason to be seen. Attacking machine is running Checkpoint FW-1 mail server! Cheers, Gordon Smith CCNA Network Operations Manager MoreNet Ltd. Fingerprint: 4093 91BC 0055 46B9 1B1A EDBA 45AD 2381 7B1D E4BE Log extract (multiple occurrances of this): 04/23/2002 15:38.24 <WARN:SNMP> last message repeated 2 times 04/23/2002 15:38.14 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "ILMI" 04/23/2002 15:38.14 <WARN:SNMP> last message repeated 2 times 04/23/2002 15:38.02 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "DHdW7tr5nP" 04/23/2002 15:38.02 <WARN:SNMP> last message repeated 2 times 04/23/2002 15:37.52 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "P8nD8l1n7" 04/23/2002 15:37.52 <WARN:SNMP> last message repeated 2 times 04/23/2002 15:37.44 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "wd1h2dt2d" 04/23/2002 15:37.44 <WARN:SNMP> last message repeated 2 times 04/23/2002 15:37.34 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "private" 04/23/2002 15:37.34 <WARN:SNMP> last message repeated 2 times 04/23/2002 15:37.24 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "public" 04/23/2002 11:37.42 <WARN:SNMP> last message repeated 2 times 04/23/2002 11:37.32 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "ILMI" 04/23/2002 11:37.32 <WARN:SNMP> last message repeated 2 times 04/23/2002 11:37.18 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "DHdW7tr5nP" 04/23/2002 11:37.18 <WARN:SNMP> last message repeated 2 times 04/23/2002 11:37.10 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "P8nD8l1n7" - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1