- NZNOG - lists.nznog.org

Code red logging
by Simon Byrnand 12 Aug '01

12 Aug '01

Thought those of you playing Code Red Detective may find the following URL of some use :) http://salfter.dyndns.org/codered.shtml Regards, Simon --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 3

Abuse@xtra.co.nz now guilty of abuse?
by PhoneNet 11 Aug '01

11 Aug '01

If anyone at Xtra is reading this list please get them to fix the autoresponder for messages to abuse(a)xtra.co.nz... I've now had 5 identical replies over a period of 3 days to my complaint re spam.... Perhaps they think they are supposed to be the abusers? Ian Cousins PhoneNet --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Fwd: Code red infected customers
by Steve Phillips 10 Aug '01

10 Aug '01

FYI, these are the IP's I've collected to date that are in the NZ domain, some of these will be on dynamic dialup accounts, if you would like the actual log entries which should include times they were online let me know, i'll probably clear off the log files and restart the collection at a later date as the time on the server was out by an hour <self fwap> >Date: Sat, 11 Aug 2001 18:57:54 +1200 >From: root <root(a)hangover.nz.asiaonline.net> >To: steve(a)nz.asiaonline.net >Subject: Code red infected customers > >Code Red Infected customers on our network trying to infect remote sites.. > > >202.154.128.18 : 18.128.154.202.IN-ADDR.ARPA domain name pointer >ak-d18.connections.net.nz >202.180.111.174 : 174.111.180.202.IN-ADDR.ARPA domain name pointer >202-180-111-174.nas3.chc.attica.net.nz >202.180.111.18 : 18.111.180.202.IN-ADDR.ARPA domain name pointer >202-180-111-18.nas3.chc.attica.net.nz >202.180.111.77 : 77.111.180.202.IN-ADDR.ARPA domain name pointer >202-180-111-77.nas3.chc.attica.net.nz >202.180.111.95 : 95.111.180.202.IN-ADDR.ARPA domain name pointer >202-180-111-95.nas3.chc.attica.net.nz >202.180.68.127 : 127.68.180.202.IN-ADDR.ARPA domain name pointer >202-180-68-127.nas1.wgn.attica.net.nz >202.180.68.40 : 40.68.180.202.IN-ADDR.ARPA domain name pointer >202-180-68-40.nas1.wgn.attica.net.nz >202.180.69.248 : 248.69.180.202.IN-ADDR.ARPA domain name pointer >202-180-69-248.ipn1.attica.net.nz >202.180.71.36 : 36.71.180.202.IN-ADDR.ARPA domain name pointer >202-180-71-36.nas4.akl.attica.net.nz >202.180.90.163 : 163.90.180.202.IN-ADDR.ARPA domain name pointer >202-180-90-163.nas7.akl.attica.net.nz >202.37.167.38 : 38.167.37.202.IN-ADDR.ARPA domain name pointer >nwp-38.world-net.co.nz >202.37.68.193 : 193.68.37.202.IN-ADDR.ARPA domain name pointer >nw3-193.world-net.co.nz >202.49.144.221 : 221.144.49.202.IN-ADDR.ARPA domain name pointer >storefrontmail.viatx.com >202.49.144.225 : 225.144.49.202.IN-ADDR.ARPA domain name pointer >stage.viatx.com >202.50.111.114 : >202.50.111.91 : >202.50.111.97 : >203.109.193.163 : 163.193.109.203.IN-ADDR.ARPA domain name pointer >203-109-193-163.ihug.net >203.109.203.103 : 103.203.109.203.IN-ADDR.ARPA domain name pointer >203-109-203-103.nzl.ihugultra.co.nz >203.167.132.64 : 64.132.167.203.IN-ADDR.ARPA domain name pointer >203-167-132-64.dialup.clear.net.nz >203.167.161.144 : 144.161.167.203.IN-ADDR.ARPA domain name pointer >203-167-161-144.dialup.clear.net.nz >203.167.164.208 : 208.164.167.203.IN-ADDR.ARPA domain name pointer >203-167-164-208.dialup.clear.net.nz >203.167.166.71 : 71.166.167.203.IN-ADDR.ARPA domain name pointer >203-167-166-71.dialup.clear.net.nz >203.167.171.155 : 155.171.167.203.IN-ADDR.ARPA domain name pointer >203-167-171-155.dialup.clear.net.nz >203.167.214.50 : >203.167.247.214 : 214.247.167.203.IN-ADDR.ARPA domain name pointer >cf4-acld.auckland.clix.net.nz >203.167.254.136 : 136.254.167.203.IN-ADDR.ARPA domain name pointer >napr-m36.dialup.inhb.co.nz >203.79.102.72 : 72.102.79.203.IN-ADDR.ARPA domain name pointer >203-79-102-72.tnt14.paradise.net.nz >203.79.103.179 : 179.103.79.203.IN-ADDR.ARPA domain name pointer >203-79-103-179.tnt14.paradise.net.nz >203.96.106.59 : 59.106.96.203.IN-ADDR.ARPA domain name pointer >203-96-106-59.dialup.xtra.co.nz >203.96.110.172 : 172.110.96.203.IN-ADDR.ARPA domain name pointer >203-96-110-172.dialup.xtra.co.nz >203.96.110.66 : 66.110.96.203.IN-ADDR.ARPA domain name pointer >203-96-110-66.dialup.xtra.co.nz >203.96.62.201 : 201.62.96.203.IN-ADDR.ARPA domain name pointer >203-96-62-201-tollfree.actrix.co.nz >203.96.62.53 : 53.62.96.203.IN-ADDR.ARPA domain name pointer >203-96-62-53-tollfree.actrix.co.nz >203.97.85.108 : 108.85.97.203.IN-ADDR.ARPA domain name pointer >a004-m001-u108.chch.clear.net.nz >210.48.102.170 : 170.102.48.210.IN-ADDR.ARPA domain name pointer >ip-210-48-102-170.iconz.net.nz >210.48.103.150 : 150.103.48.210.IN-ADDR.ARPA domain name pointer >ip-210-48-103-150.iconz.net.nz >210.48.103.4 : 4.103.48.210.IN-ADDR.ARPA domain name pointer >ip-210-48-103-4.iconz.net.nz >210.48.81.19 : 19.81.48.210.IN-ADDR.ARPA domain name pointer >p19.pool1.staticadsl.iconz.net.nz >210.54.121.65 : 65.121.54.210.IN-ADDR.ARPA domain name pointer >210-54-121-65.adsl.xtra.co.nz >210.54.199.115 : 115.199.54.210.IN-ADDR.ARPA domain name pointer >210-54-199-115.dialup.xtra.co.nz >210.54.201.186 : 186.201.54.210.IN-ADDR.ARPA domain name pointer >210-54-201-186.dialup.xtra.co.nz >210.54.201.49 : 49.201.54.210.IN-ADDR.ARPA domain name pointer >210-54-201-49.dialup.xtra.co.nz >210.54.217.216 : 216.217.54.210.IN-ADDR.ARPA domain name pointer >ppp-15.satlan.co.nz >210.54.221.186 : 186.221.54.210.IN-ADDR.ARPA domain name pointer >210-54-221-186.ipnets.xtra.co.nz >210.54.221.194 : 194.221.54.210.IN-ADDR.ARPA domain name pointer >210-54-221-194.ipnets.xtra.co.nz >210.54.224.235 : 235.224.54.210.IN-ADDR.ARPA domain name pointer >210-54-224-235.adsl.xtra.co.nz >210.54.229.174 : 174.229.54.210.IN-ADDR.ARPA domain name pointer >210-54-229-174.dialup.xtra.co.nz >210.54.233.174 : 174.233.54.210.IN-ADDR.ARPA domain name pointer >210-54-233-174.adsl.xtra.co.nz >210.54.242.194 : 194.242.54.210.IN-ADDR.ARPA domain name pointer >210-54-242-194.adsl.xtra.co.nz >210.54.247.251 : 251.247.54.210.IN-ADDR.ARPA domain name pointer >smtp.carolineeve.co.nz >210.54.254.97 : 97.254.54.210.IN-ADDR.ARPA domain name pointer >210-54-254-97.adsl.xtra.co.nz >210.54.76.237 : 237.76.54.210.IN-ADDR.ARPA domain name pointer >210-54-76-237.dialup.xtra.co.nz >210.54.77.98 : 98.77.54.210.IN-ADDR.ARPA domain name pointer >210-54-77-98.dialup.xtra.co.nz >210.54.80.49 : 49.80.54.210.IN-ADDR.ARPA domain name pointer >210-54-80-49.adsl.xtra.co.nz >210.54.80.78 : 78.80.54.210.IN-ADDR.ARPA domain name pointer >210-54-80-78.adsl.xtra.co.nz >210.54.8.148 : >210.54.83.179 : 179.83.54.210.IN-ADDR.ARPA domain name pointer >210-54-83-179.adsl.xtra.co.nz >210.54.84.137 : 137.84.54.210.IN-ADDR.ARPA domain name pointer >210-54-84-137.adsl.xtra.co.nz >210.54.84.211 : 211.84.54.210.IN-ADDR.ARPA domain name pointer >210-54-84-211.adsl.xtra.co.nz >210.54.89.14 : 14.89.54.210.IN-ADDR.ARPA domain name pointer >smtp.insteplimited.com >14.89.54.210.IN-ADDR.ARPA domain name pointer smtp.hanmerinstitute.com >210.54.98.43 : 43.98.54.210.IN-ADDR.ARPA domain name pointer >210-54-98-43.dialup.xtra.co.nz >210.54.99.167 : 167.99.54.210.IN-ADDR.ARPA domain name pointer >210-54-99-167.dialup.xtra.co.nz >210.55.103.213 : 213.103.55.210.IN-ADDR.ARPA domain name pointer >port55-103-213.jetstart.win.co.nz >210.55.106.10 : 10.106.55.210.IN-ADDR.ARPA domain name pointer >ip210-55-106-10.ip.maxnet.co.nz >210.55.106.136 : 136.106.55.210.IN-ADDR.ARPA domain name pointer >ip210-55-106-136.ip.maxnet.co.nz >210.55.123.35 : 35.123.55.210.IN-ADDR.ARPA domain name pointer >210-55-123-35.dialup.xtra.co.nz >210.55.146.39 : 39.146.55.210.IN-ADDR.ARPA domain name pointer >210-55-146-39.dialup.xtra.co.nz >210.55.146.83 : 83.146.55.210.IN-ADDR.ARPA domain name pointer >210-55-146-83.dialup.xtra.co.nz >210.55.159.221 : 221.159.55.210.IN-ADDR.ARPA domain name pointer >210-55-159-221.ipnets.xtra.co.nz >210.55.159.222 : 222.159.55.210.IN-ADDR.ARPA domain name pointer >210-55-159-222.ipnets.xtra.co.nz >210.55.178.166 : 166.178.55.210.IN-ADDR.ARPA domain name pointer >210-55-178-166.dialup.xtra.co.nz >210.55.228.173 : 173.228.55.210.IN-ADDR.ARPA domain name pointer >adsl-173.world-net.co.nz >210.55.57.45 : 45.57.55.210.IN-ADDR.ARPA domain name pointer >210-55-57-45.adsl.xtra.co.nz >210.55.9.105 : >210.86.24.203 : 203.24.86.210.IN-ADDR.ARPA domain name pointer >210-86-24-203.adsl.xtra.co.nz >210.86.24.254 : 254.24.86.210.IN-ADDR.ARPA domain name pointer >210-86-24-254.adsl.xtra.co.nz >210.86.25.142 : 142.25.86.210.IN-ADDR.ARPA domain name pointer >210-86-25-142.adsl.xtra.co.nz > >Total customers Code Red infected so far counted at : 79 -- Steve Systems Admin, Asia Online (NZ) --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Code Red errata
by Brodie Davis 09 Aug '01

09 Aug '01

Has any one else noticed a big drop of traffic related to this. my stats for this week have been so far (pretty low.. but as i only have 2 world viewable port 80's) Monday : 37 (ids was playing up so only partial records) Tuesday : 599 Wednesyday : 511 Today (from 8am) : nill I am just wondering is this the norm.. or I am just lucky. (or has AoL started filting this now?) Cheers, Brodie --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

9 10

Vote Result and NZNOG List Changes
by Donald Neal 09 Aug '01

09 Aug '01

NZNOG People, Voting has now closed on the following proposed addition to this list's acceptable use policy: 10. A person repeatedly breaching list etiquette shall receive warnings from the list administrator. A further breach after the second such warning within thirty days shall result in the offender being unsubscribed from the list. Other action may also be taken to block postings to the list by the offender. Any such unsubscription is to be immediately announced to the list. A total of seventy votes were recieved, with all votes cast in favour of the change. This change is therefore now in effect. During the afternoon of Monday, 13 August, I intend to change the nznog list's settings so that postings will be accepted only from addresses subscribed to one of the following lists: nznog - this list nznog-digest - the digest version of this list nznog-postonly - a new list which exists only to allow addresses subscribed to it to post to the nznog list. Messages will not normally be sent to addresses subscibed to nznog-postonly. To subscribe new addresses to one or more of these lists, send email to majordomo(a)list.waikato.ac.nz where each line of the body of the message has the form subscribe <list name> to subscribe the address from which that message is being sent, or subscribe <list name> <address> to subscribe a different address. More than one subscription request may be sent in the same message. Donald Neal List Administrator --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Given the current topic of discussion in here...
by Chris Rigby 09 Aug '01

09 Aug '01

I though this slashdot article might be on interest. http://slashdot.org/articles/01/08/09/1758200.shtml Chris Rigby Senior Systems Engineer IHUG - Into the Internet --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

[OT] 802.11 and stuff
by James Tyson 08 Aug '01

08 Aug '01

Hi all Just a couple of quick questions to you folks that know so much about 802.11. Firstly, do I really need a base station? I have my new ibook here and I want to grab the airport card to use with the Cisco Aironet base station at work, but I was thinking is it possible to just throw an orinoco card or something in my Linux box gateway and use that in place of a base station while I am at home? If not, does anyone know of any base stations in the sub $500 range that work reasonably? I am not really that worried about WEP and SSID while I am at home, because I will set my DHCP server up to only assign my card an IP address and use an encrypted tunnel to get to the net. Cheers. James Tyson --- Samizdat New Media Solutions --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

8 9

Looking for DialUp RAS Equipment
by Craig Whitmore 08 Aug '01

08 Aug '01

Has anyone got any Spare RAS Equipment they are willing to sell Such as: Cisco 5200/5300/5800 etc (Or Modem Cards to put in them) USR/3Com TotalControl Equipment (or any Cards for the Chassis such as netserver/Quads etc) Shiva LANRover (Whole thing or Spare Modems etc) Max Ascend 4000/6000/3000/TNT? Anything else that will take R2's and work reasonable. If you have any of the above please let me know with estimated price for Sale. Thanks Craig Whitmore Orcon Internet http://www.orcon.net.nz

2 1

Re: Code Red errata
by Steve Phillips 08 Aug '01

08 Aug '01

At 11:20 9/08/2001, James McGlinn wrote: >Is it possible to filter on part of the shell code payload? At least one >CR variant doesn't request default.ida - rendering it useless (I assume), >but that should let you see those hits, and allow genuine default.ida >requests through... yep, the way the filter works is you can enter any string up to 32 characters in length, I used default.ida as it was easier to type, once i had it working and had tested it I was going to parse it on the shell code string :) -- Steve Systems Admin, Asia Online (NZ) --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Proposed Change to Acceptable Use Policy
by Donald Neal 08 Aug '01

08 Aug '01

NZNOG People, Voting is now under way on the following proposed addition to the list''s acceptable use policy. 10. A person repeatedly breaching list etiquette shall receive warnings from the list administrator. A further breach after the second such warning within thirty days shall result in the offender being unsubscribed from the list. Other action may also be taken to block postings to the list by the offender. Any such unsubscription is to be immediately announced to the list. Votes on this change to me (not the list!) by midday tomorrow, Friday 10 August, please. I have so far received fifty-eight votes, and have acknowledged all of them. If you have not received email saying your vote has been recorded, it is not likely that it has been recorded. My access to email between now and some time tomorrow morning may be little variable, as I am engaged in moving offices. This is therefore likely to be the last reminder of the vote. If the change is approved, I intend to make the changes necessary to restrict posting to pre-submitted addresses only on Monday, 13 August. Donald Neal List Administrator --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Proposed Change to Acceptable Use Policy
by Donald Neal 07 Aug '01

07 Aug '01

NZNOG People, Voting is now under way on the following proposed addition to the list''s acceptable use policy. 10. A person repeatedly breaching list etiquette shall receive warnings from the list administrator. A further breach after the second such warning within thirty days shall result in the offender being unsubscribed from the list. Other action may also be taken to block postings to the list by the offender. Any such unsubscription is to be immediately announced to the list. Votes on this change to me (not the list!) by midday, Friday 10 August, please. I have so far received thirty votes, and have acknowledged all of them. If you have not received email saying your vote has been recorded, it is not likely that it has been recorded. Donald Neal List Administrator -- Donald Neal Mobility & Calling Platforms Network Delivery Telecom New Zealand Ltd --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

spammer
by Michael Coates 07 Aug '01

07 Aug '01

Hello Is there a list in NZ I can get a spammer put onto to block them from sending emails with viruses attached? Thanks

3 2

Code Red Stats
by Craig Whitmore 07 Aug '01

07 Aug '01

I've been running a running couter of hits on 1 machine take logs from 500 IP addresses's (2 C Classes). Its Hits/sec has gone up from yesterday from about 3.4->6.9 and growing fast :-( Total Seconds = 8878 Total Unique Machines Infected = 6380 Total Hits = 51169 Total Hits/Sec = 6.89 Also I have it emailing the owners of the Unique IP addresses (automaticlly) (with an ugly script) and telling that their machines are infected and so far have had many happy people repling thanking me. (But the Number of infected machines still increases :-( ) This is only from 2 C Class Addresses.. I can't imagine how many hits/sec NZ is getting in Total from Overseas.. There have only been a few infected machines from inside NZ (mostly from Xtra and WorldNet Dialups) Thanks Craig Whitmore Orcon Internet http://www.orcon.net.nz

1 0

TCP Header Definition help request "Window"
by Mike Sutton [ awacs ] 07 Aug '01

07 Aug '01

TCP Header Could an expert tell me "how" the "window" value is generated and "what" explicitly it means... Appreciate your help as my reference books don't help and I have not been able to locate a precise definition on the Net. Michael Sutton --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 7

root.exe
by Dylan Reeve 07 Aug '01

07 Aug '01

Any ISPs had a look through their proxy logs for "root.exe" or "cmd.exe" so far? I bet there will be a few... Going to go after people for 'hacking'? -- Dylan Reeve - dylan(a)wibble.net "Um, yeah." --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Code Red: NZ vs Canada
by Dan Langille 07 Aug '01

07 Aug '01

I can give you two lots of stats, one from a NZ server, the other from a Canada server: http://www.langille.org/stats-red-worm/ - in Wellington http://www.freebsddiary.org/stats-red-worm/ - in Ottawa Both are updated every 30 minutes, 15 minutes after and after the hour. -- Dan Langille pgpkey - finger dan(a)unixathome.org | http://unixathome.org/finger.php --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 5

Whazzup w/ Ihug?
by Juha Saarinen 06 Aug '01

06 Aug '01

http://www.internettrafficreport.com/cgi-bin/tr_chartpage.pl?203.98.56.1 70 -- Juha Saarinen --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 5

Re: Code Red Weirdness
by Mark Foster 06 Aug '01

06 Aug '01

[Tue Aug 7 13:56:39 2001] [error] [client 203.199.60.10] Invalid URI in request XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u 8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0 Ive had just one today, in the last half hour. None prior to that Did someone try to write a variant and screw up or maybe one of the infectees got weird? At 13:58 7/08/2001 +1200, you wrote: >[Tue Aug 7 13:57:14 2001] [error] [client 203.228.144.15] Invalid URI in >request >XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a >HTTP/1.0 > >Just started getting these. no default.ida?. > >Has the worm turned, again? > > >Tim J. Shackleton ------------------+ +- Business http://www.netlink.co.nz/ >Networks Admin/Programmer ----------+ +- Personal http://www.netnet.net.nz/ >Netlink LTD -- DDI +64 4 922 8476 --+ +------------- Pager 64 +26 253 4356 >+64 29 650 476 -- Cellular ---------+ +------------------------------------ >---- "Cold silence has a tendency to atrophy any sense of compassion" ----- > >--------- >To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz >where the body of your message reads: >unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 4

Code Red Stats
by Neil 06 Aug '01

06 Aug '01

Hi All, After about 30 second's of thinking about how to get rrdtool or mrgt to display what Code Red is up to on my server I decided to use webalizer instead. It defiantly gives you a better view on what is going on, have a look at http://203.97.86.130/codered/usage_200108.html . I have put the script in the cron.hourly directory so check back as often as you like. Neil Fincham Integral LTD.

6 8

Re: Code Red - Network Impact?
by Mark Davies 06 Aug '01

06 Aug '01

From: "Barry Raveendran Greene" <bgreene(a)cisco.com> Date: Mon, 6 Aug 2001 05:18:53 -0700 > Is anyone seeing router impact caused by all the bogus queries sent out by > Code Red? Just wondering if there could be some side effects. We had the cpu running at 100% on our border router till we tuned the access-lists to deal with traffic to port 80 early. cheers mark --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 2

Internet issues for discussion at APEC TEL24
by Frank March 06 Aug '01

06 Aug '01

I have previously posted information about APEC TEL24 to this list inviting people to join the NZ delegation. As a reminder: the meeting will take place 19-21 September in Jeju, Korea. It will be preceeded by two days (17,18 September) of workshops on various areas. I will be there for all five days. Details at http://www.apectel24.org/. Please feel free to pass the contents of this email on to anyone you think may be interested. One workshop area is 'Internet issues'. The first draft of the programme is as follows. I invite anyone to send to me **(off-line)** comments about any of the matters mentioned. Note that this was the first forum to raise the issue of international Internet charging (and that matter is still hanging around). There is an invitation to comment on agenda matters and I will probably take that up in 10 days or so. >From the organisers..... "The Workshop will consist of two parts. The FIRST part will consist of three presentations (20 minutes each) about the following topics: 1.- Presentation about the Current State of the Debate on Internet Issues. 2.- Presentation about the development of traffic flows within and between Latin American countries and other regions. 3.- Presentation about the situation of small ISP's in the Asia-Pacific region. The SECOND part will consist of an open-floor moderated discussion between the delegates. We suggest the following topics. Please we will appreciate if you could indicate your first three issues of more interest: 1.- APEC Contribution to promoting Internet access in the Asia-Pacific Region 2.- Traffic Exchange Models (Current and Next Generation) How is Internet traffic exchanged? What financial mechanisms are in place for the exchange of Internet traffic and how are they encouraging Internet development? What are the trends in content location and how do these factors influence Internet traffic patterns and financial arrangements? 3.- Global Capacity Availability and Trading What are the recent developments in large-scale bandwidth provision? What are the recent developments in retail internet service provision? How do global capacity relate to Internet traffic exchange? 4.- Local Internet Interconnection What are the main principles of the new interconnection frameworks? How much progress has been made in developing interconnection frameworks appropriate to the exchange of Internet traffic? 5.- Role for Regulators Is there a role for regulators? What are the policy implications for some of the directions Internet traffic exchange will take with next generation Internet architecture? 6.- Users Needs How do users view current developments in Internet traffic exchange? How does the financial community view the current state of play? User Needs - IP-based services and content providers. 7.- WTO What is the current state of the debate? How negotiating frameworks from different countries compare? What is the treatment of Internet services in the negotiating frameworks? 8.- Internet Connectivity What policy and regulatory reforms are required to stimulate Internet development and address the international digital divide? What regulatory barriers exist to the development of the Internet including infrastructures such as international connectivity, domestic teledensity and Internet exchange points? How can economies maximise the benefits of their Internet development including lower costs for infrastructure service? (development funds) 9.- Costs and Prices What is going to replace the international settlements system in the new environment? How are countries adapting to the changes in settlement rates? 10.- Quality Voice over IP " Frank March Specialist Advisor, IT Policy Group Ministry of Economic Development, PO Box 1473, Wellington, NZ Ph: (+64 4) 474 2908; Fax: (+64 4) 471 2658 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Re: Code Red - Network Impact?
by Mark Davies 06 Aug '01

06 Aug '01

From: Chris Wedgwood <cw(a)f00f.org> Date: Tue, 7 Aug 2001 11:15:46 +1200 > What IOS version? Are you running compiled ACLs? Don't know, no. Its not actually my box I just get to look at it occasionally when they have issues. > That seems to help a > fair bit if your CPU bound due to access-list activity. I just looked up the docs on compiled access-lists and the reference I found implied that they were only available on 7200's and bigger boxes. > Also, you can > try "show access-list blah" and reorder the most frequent terms to > nearer the top. I've cleaned the lists up several times in the past (as well as they could be) but they keep adding more ugliness to them. cheers mark --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Code Red - Network Impact?
by Barry Raveendran Greene 06 Aug '01

06 Aug '01

Hi Folks, Is anyone seeing router impact caused by all the bogus queries sent out by Code Red? Just wondering if there could be some side effects. Barry --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 5

Re: Code Red - Network Impact?
by Mark Davies 06 Aug '01

06 Aug '01

From: Chris Wedgwood <cw(a)f00f.org> Date: Tue, 7 Aug 2001 10:46:27 +1200 > On Tue, Aug 07, 2001 at 10:36:51AM +1200, Mark Davies wrote: > We had the cpu running at 100% on our border router till we tuned > the access-lists to deal with traffic to port 80 early. > Ouch... what kind of router? Where was all the CPU being spent? A cisco 2600 with a rather ugly set of access-lists having to deal with the probes for an entire Class B net. I was somewhat surprised that it couldn't deal with it as it was only about 100 probes a second (this was last Friday). Tweaking the access-lists got the load down to about 40-50%. cheers mark --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: Code Red V3!?
by Lindsay Druett 06 Aug '01

06 Aug '01

You must be a Bob Jones Fan.... "Location, location, location...." Those poor souls that are topologically near NT servers that have been infected are getting hammered :/ If you're getting hammered, you live in a bad neighbourhood, time to cleanup or move :) --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1