- NZNOG - lists.nznog.org

As Seen On Slashdot
by Joe Abley 06 Mar '00

06 Mar '00

If anybody else runs intel servers remotely, and thinks this is the best thing they have seen all year: http://www.realweasel.com/intro.html then drop me a line, and maybe we can send one big order over instead of all kinds of little bitty ones. They're doing pretty small fab runs at the moment, and the price per card is US$250 (which would be completely unreasonably out of the question if this wasn't such a good idea). If we can get a big order together maybe we can drag that price down a bit... Anyway. Let me know :) --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Domainz -- Ringing Helpdesk Phones
by Joe Abley 05 Mar '00

05 Mar '00

Domainz have sent a letter to every nameholder under .NZ with details of the new Domainz/Glazier system; it appears that some have already arrived with nameholders this morning. Some definitely haven't (I haven't received anything yet). The letter advises nameholders to contact their ISP for more information. Operators may want to find out from Domainz exactly what nameholders have been told, so that they are able to field questions on the helpdesk. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 4

Re: Domainz -- Ringing Helpdesk Phones
by Rob Isaac 05 Mar '00

05 Mar '00

While we're on the subject... The letter below seems to consistently substitute commas ( , ) for apostrophes ( ' ). Is it just me, or is there some top secret Domainz, character mapping or MIME type I should be using to view this text? Can anyone confirm that the original letter is also formatted this way? Sorry to be pedantic, but when someone sends out a letter like this that has the potential to cause confusion among the herd, I like to make sure I know *exactly* what I'm dealing with. Regards, Rob. >3 March, 2000 > Our ref: >holder_name >holder_contact >holder_address1 >holder_address2 >holder_address3 >holder_city >holder_country >holder_postcode > >Dear .nz Domain Name Holder > >For Your Information - Changes to the .nz Register > >This letter is to advise you as a .nz Name Holder of the changes planned to >the Domain Registration System. > >According to our records you are the holder of the following domain name(s) >currently listed in the .nz Register: > > domain_name > >As part of the change process, we will create a Customer Record and link the >above domain(s) to your record. The latest contact information we have about >you was taken from your domain - domain_name - which we see was last >modified on date_updated. This contains the address information above, plus >your contact details below: > > holder_email > holder_phone > holder_fax > >If your contact details need updating, now is a good time and you may need >to talk to your ISP to help you do this. > >We will keep you informed of the process and once set up you will be emailed >the Customer ID and Password using the above email address. > >If youd like to keep in touch with progress more information can be found >on our website at the following address: > > http://www.domainz.net.nz/DRS_Changes.html > >Yours sincerely, > > >Patrick OBrien >Chief Executive --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Re: Domainz -- Ringing Helpdesk Phones
by Rob Isaac 05 Mar '00

05 Mar '00

>> Regarding dealing to the responses from the letter, most enquiries that we >> are receiving indicate that the Name holder and address is OK, but the >> contact details (typically the representative and email address) are >> incorrect and have not been updated in the .nz Register. > >We are now being swamped with calls from people who have read the letter but >dont understand what it means. They are particularly concerned that DOMAINZ >are talking about a customer ID and password. > >We are advising customers to ring DOMAINZ for an explanation. > >regards > >Peter Mott Presumably, someone at Domainz just made a mistake by telling people to contact their ISPs about something that is really Domainz's doing. In the wider context of what they're doing, it would be easy for them to overlook the inconvenience and time-wasting that one little sentence will cause. Maybe they intended to inform ISPs, registrars and so on before they sent the letters, but simply forgot. Who did this, any idea? Who is the letter signed by? I still haven't seen a copy of it, but since it's being delivered on paper, it will probably take a while to filter through to anyone clueful. Regards, Rob. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

NZ MBONE
by James Tyson 28 Feb '00

28 Feb '00

David Robb from IHUG and I have been talking about setting up a local MBONEesque system across APE or WIX, I was just wanting a show of hands as to who would want it, and how people think it should be implemented. Cheers James Tyson --- Samizdat New Media Solutions --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

12 22

Re: (fwd) History of Internet in NZ
by Mark Davies 28 Feb '00

28 Feb '00

From: Don Stokes <don(a)daedalus.co.nz> Date: Sat, 26 Feb 2000 20:49:43 +1300 > VUW router's change log says the Kawaihiko DDS links were added on > 14 Jun 90; the PC-router links running before that. This was before I > started there; Mark Davies or Michael Newbery may have more info. Jonathan, Andy and I put the PC-router links in in late '89. They were running SLIP over the the DSIR's terminal network (with Tony van der Peet, then at DSIR, making the required changes to their precursors of the ACE boxes to allow for permanent links). The initial link was between Waikato and here followed up by a similar link between here and Massey. We ran a slightly modified version of SLIP to deal with the non 8bit clean nature of the lines and they ran at the glorious speed of 4.8K. cheers mark --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 4

Re: (fwd) History of Internet in NZ
by Michael Newbery 27 Feb '00

27 Feb '00

Mark Davies <mark(a)MCS.VUW.AC.NZ> wrote at 27/2/00 2:47 PM >Jonathan, Andy and I put the PC-router links in in late '89. They were >running SLIP over the the DSIR's terminal network (with Tony van der Peet, >then at DSIR, making the required changes to their precursors of the ACE boxes >to allow for permanent links). The initial link was between Waikato and here >followed up by a similar link between here and Massey. We ran a slightly >modified version of SLIP to deal with the non 8bit clean nature of the lines >and they ran at the glorious speed of 4.8K. And a SHARED 4.8k at that. The theory was that there was sufficient spare capacity on the DSIR network to accomodate the DISR internal traffic and the University use. This proved not to be the case :-) -- Michael Newbery Technology Manager Saturn Communications Tel: +64-4-939 5102 Mobile:021-642 957 Fax:+64-4-939 5100 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 5

ICANN Membership
by Chris Wedgwood 27 Feb '00

27 Feb '00

Most of you will know about this already, but those who do not, here as an opportunity to join ICANN at no cost: http://members.icann.org/ Please see the web page for more details. -cw --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

(fwd) History of Internet in NZ
by DPF 25 Feb '00

25 Feb '00

Off topic but this list seemed the most likely source of information to help me answer the query below. I think Jonathon Stone is now working for a US university. If anyone has any specific info on Jonathon or the old "backbone" that would be appreciated. Ta DPF >I am trying to track down >information about the role that a person called "Jonathon Stone" may >have played in the establishment of the Internet backbone in New >Zealand and wondered if you had ever heard of him. I believe he may >have been in the computer department of Victoria University at the >time but in quite what capacity I do not know. I would be grateful >for any information you might be able to let me have. > >In any case, when exactly was the NZ Internet backbone installed and >who was in charge of it anyway. I seem to recall it was a committee >and not just the one person. Is there a FAQ or URL which covers all >this? ________________________________________________________________________ <david at farrar dot com> NZ Usenet FAQs - http://www.dpf.ac.nz/usenet/nz ICQ 29964527 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Re: RE: More on DDOS Attacks
by Michael Newbery 24 Feb '00

24 Feb '00

Well, I've just gone to 12.0(8) on a 3620, up from 11.3, and that difference is most pleasent. 11.3 did not crash, but had some, um, infelicities. I'm quite happy with 12.0(8). Of course, if you want a stable release, well the following may amuse you (although it's not strictly IOS of couse, its a Catalyst 2926). Tardis> sh sys PS1-Status PS2-Status Fan-Status Temp-Alarm Sys-Status Uptime d,h:m:s Logout ---------- ---------- ---------- ---------- ---------- -------------- --------- faulty ok ok off faulty 737,05:06:53 20 min -- Michael Newbery Technology Manager Saturn Communications Tel: +64-4-939 5102 Mobile:021-642 957 Fax:+64-4-939 5100 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

8 9

Open IP Directed Broadcast List... (fwd)
by Alan Brown 24 Feb '00

24 Feb '00

Supplementary to http://www.netscan.org/ and http://www.powertech.no/smurf/ > ---------- Forwarded message ---------- > Date: Wed, 23 Feb 2000 14:48:10 -0500 > From: dies <dies(a)PULLTHEPLUG.COM> > To: BUGTRAQ(a)SECURITYFOCUS.COM > Subject: Open IP Directed Broadcast List... > > Well I guess I reinvented the wheel here. On that note. > > I've compiled a list of open ip directed broadcasts. I've scanned > down into 26 bit subnet's and found some interesting results. Over > 138,000 broken networks where found. A list of these networks is > currently available at http://www.pulltheplug.com. The reason I did this > was because netscan.org is only hitting 24 bit subnets and with the > recent "Internet Rush" for companies, CIDR, etc I felt it was time to look > deeper into the problem. I've been pulled away from this project as of > late (real job calls) and I have yet to walk the networks through > arin/ripe/apnic and obtain contacts. That will be my next step, > ETA - 2/28/00. After that I'd like to jump down to 27 and 28 bit > subnets. I'd be willing to get some help from anyone that is interested. > > Lastly, for the script kiddies out there. Please do not go and > grab this list and annihilate someone. Take the information and maybe > learn something from it, like just was subnetting is and how it works.. > > dies(a)pulltheplug.com --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: NZ MBONE
by Richard Naylor 24 Feb '00

24 Feb '00

At 12:28 PM 2/25/00 +1300, James Tyson wrote: > >David Robb from IHUG and I have been talking about setting up a local >MBONEesque system across APE or WIX, I was just wanting a show of hands as >to who would want it, and how people think it should be implemented. > cool ! at long last. Count me in as interested/keen, etc. I have the stuff running at home, but haven't had time to bring it into work yet. Do you want to stay with MBONE or use the H.323 stuff thats out there. My experience is that the H.323 stuff is faster and gives better results. I was planning to have an H.323 device in next week which will host a conference call, and have auto answer, and have a TV channel on it so that you can see the latency. Only problem is some copyright issues with the content so it might have to be a live camera from the office or a video tape on a loop. rich richard.naylor(a)citylink.co.nz This mail message contains information that is confidential and which may be subject to legal privilege. If you are not the intended recipient, you must not use, distribute or copy this message. If you have received this message in error, please notify the sender immediately and erase this mail. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

[dangerously off-topic] Government to Regulate Routing!
by Joe Abley 23 Feb '00

23 Feb '00

** Quite Possibly of Negligable Operational Interest ** The Herald has an article about the Telecoms review being carried out (or to be carried out, give me a break, it's early): > The inquiry's brief is to examine interconnection issues, the Kiwi Share > obligation -which guarantees free local calling - number portability > and administration, management of internet traffic and the > development of New Zealand as a knowledge economy. "Management of internet traffic" was the phrase that caught my eye. If this review strays into the issues of routing, traffic filtering and peering at the packet layer, then I am scared. Mind you, this is probably the Herald quoting some government press release, so I wouldn't necessarily expect any the terms contained within it to be accurate. Anyway, just thought I'd share this. Please feel free to return to your usual network-wrangling activities. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Back to Non-Subscriber Postings
by Donald Neal 23 Feb '00

23 Feb '00

NZNOG-People, Yes, it seems restricting postings to subscribed addresses does create substantial inconvenience. I have now turned this off again. My thanks to all of the people who reminded me what a poor MUA I'm using. If I had any plans to do anything about this, I wouldn't be able to tell you about them. Donald Neal NZNOG Muggins --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: More on DDOS Attacks
by Donald Neal 23 Feb '00

23 Feb '00

At one stage we tried 12.0(5)T on 5 different boxes, all five failed with different faults ;-) 12.0(7)T1 is apparently the last in the 12.0T stream with 12.1 being its replacement (apparently within a couple of weeks). I think you should go to 12.0(7)T1 if you need T features. Arron Scott -----Original Message----- From: owner-nznog(a)list.waikato.ac.nz [mailto:owner-nznog(a)list.waikato.ac.nz]On Behalf Of Andrew Cutler Sent: Wednesday, February 23, 2000 08:43 To: nznog(a)list.waikato.ac.nz Subject: Re: More on DDOS Attacks I had a customer with a 2610 running 12.0(4) that had constant random "spurious memory access" errors. I advised him to upgrade to upgrade to 12.0(5) but haven't heard back. Cheers, Andrew Donald Neal wrote: Subject: BOUNCE nznog(a)list.waikato.ac.nz: Non-member submission from [David Zanetti <dave2(a)earthling.net>] Date: Tue, 22 Feb 2000 19:43:41 +1300 From: owner-nznog(a)list.waikato.ac.nz To: owner-nznog(a)list.waikato.ac.nz >From d1nc(a)telecom.co.nz Tue Feb 22 19:43:40 2000 Received: from wakko.burlap.net.nz (p267.tnt1.dialup.the.net.nz [203.110.6.13]) by johnwayne.waikato.ac.nz (8.9.1a/8.9.1/Debian/GNU) with ESMTP id TAA14625 for <nznog(a)list.waikato.ac.nz>; Tue, 22 Feb 2000 19:43:33 +1300 Received: from localhost (dave2(a)localhost) by wakko.burlap.net.nz (8.9.3/8.9.3/Debian/GNU) with ESMTP id TAA08222 for <nznog(a)list.waikato.ac.nz>; Tue, 22 Feb 2000 19:43:31 +1300 X-Authentication-Warning: wakko.burlap.net.nz: dave2 owned process doing -bs Date: Tue, 22 Feb 2000 19:43:30 +1300 (NZDT) From: David Zanetti <dave2(a)earthling.net> X-Sender: dave2(a)wakko.burlap.net.nz To: nznog(a)list.waikato.ac.nz Subject: Re: More on DDOS attacks In-Reply-To: <20000222133907.A5270(a)styx.clear.net.nz> Message-ID: <Pine.LNX.4.10.10002221936550.8170-100000(a)wakko.burlap.net.nz> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII On Tue, 22 Feb 2000, Chris Wedgwood wrote: > > I've been meaning to have another try with a newer version of 12 > > (especially as 12 has gone GD) so your experience is only going to > > encourage me, can I ask what version of IOS and on what platform you lab > > setup was using? [clip] > That's not to say it is very stable, the last I tried 12.0.7(S) > was pretty horrible. I have '9 down but not tested yet. Speaking of the stablity of different IOS versions, we have a 3640 with 12.0(4)T on it that needs rebooting after about 7 weeks of uptime. Starts spamming the console port with memory allocation failures, although still manages to route stuff. It's not a particullarly odd setup, just routing between a couple of FE ports, but we are using dynamic packet filtering on it, ala "permit ... reflect outbound". Ring any bells for anyone? Couldn't see anything that jumped out at me in the later release notes, and wasn't keen on an upgrade just to "try it out".. -- David Zanetti <dave2(a)earthling.net> | (__) Mr Moo says: Moderator, nz.politics.announce | ( oo #include <geek/unix.h> | /L_= ... ( Eat more porridge ) --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

None
by None 22 Feb '00

22 Feb '00

[203.97.2.226]) by johnwayne.waikato.ac.nz (8.9.1a/8.9.1/Debian/GNU) with ESMTP id = KAA06207 for <nznog(a)list.waikato.ac.nz>; Wed, 23 Feb 2000 10:44:28 +1300 Received: from [192.168.0.4] (admin4-admd-skyt.qsi.net.nz [202.89.128.132] = (may be forged)) by tardis.patho.gen.nz (8.9.3/8.9.3) with ESMTP id KAA20340; Wed, 23 Feb 2000 10:44:25 +1300 (NZDT) Message-Id: <200002222144.KAA20340(a)tardis.patho.gen.nz> X-Mailer: Microsoft Outlook Express for Macintosh - 4.01 (295)=20 Date: Tue, 22 Feb 2000 14:37:18 +1300 Subject: 12 good reasons to choose webmail.net.nz [WAS: Media announcement on free webmail] From: "Rob Isaac" <rob(a)terabyte.co.nz> To: nznog(a)list.waikato.ac.nz CC: Joe Abley <jabley(a)patho.gen.nz> Mime-version: 1.0 X-Priority: 3 Content-type: text/plain; charset=3D"US-ASCII" Content-transfer-encoding: 7bit >On Tue, Feb 22, 2000 at 01:40:35PM -1100, reply(a)webmail.net.nz wrote: >> Show Off New Zealand announces the launch of its free web-based Email >> service Webmail.net.nz in conjunction with American Email giant = Commtouch. > >These guys win today's prize for the least clue displayed in a public >forum. I have tried to think of a more moronic way for them to advertise >their product, and I have failed. > >Congratulations! Twelve good reasons to choose webmail.net.nz as *your* web email provider = -- a list of twelve publicly known exploits against Microsoft IIS, version = 3.0, currently being run by 'webmail.net.nz': Bugtraq ID: 978 2000-02-09 NT IIS ASP VBScript Runtime Error Viewable Source Vulnerability Bugtraq ID: 968 2000-02-02 NT IIS idq.dll Directory Traversal Vulnerability Bugtraq ID: 592 1999-07-20 Persits AspUpload Buffer Overflow Vulnerability Bugtraq ID: 529 1999-07-19 NT IIS MDAC RDS Vulnerability Bugtraq ID: 591 1999-07-07 NT IIS SSL DoS Vulnerability Bugtraq ID: 477 1999-06-24 NT IIS Double Byte Code Page Vulnerability Bugtraq ID: 501 1999-03-08 NT IIS ISAPI Extension Vulnerability Bugtraq ID: 230 1999-02-11 NT Using ASP And FSO To Read Server Files Vulnerability Bugtraq ID: 194 1999-01-26 NT IIS IISAPI Extension Enumerate Root Web Server Directory Vulnerability Bugtraq ID: 192 1999-01-24 NT IIS FTP DoS / Buffer Overflow Vulnerability Bugtraq ID: 149 1998-07-01 NT IIS ASP Alternate Data Streams Vulnerability Bugtraq ID: 676 1998-06-26 Multiple Vendor PKCS#1 Vulnerability They're currently vulnerable to 978, 968, 591, 477, 501, 230, 194, 192 and = 149. I can't confirm the others, mainly because their server seems to = lack the needed third party software that makes the exploit possible. Be sure to recommend them to all your friends, just because of their = innovative marketing strategies. By 'your friends', I mean bored fifteen = year olds with ADSL, cable modems or wheel on lots of well connected = machines. *cough* We now return you to your normal, spam-free programming. Regards, Rob. =20 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

12 good reasons to choose webmail.net.nz [WAS: Media announcement]
by Donald Neal 22 Feb '00

22 Feb '00

1 0

Re: More on DDOS Attacks
by Donald Neal 22 Feb '00

22 Feb '00

2 1

[bb@nsimail.com: Regarding Webmail]
by Joe Abley 22 Feb '00

22 Feb '00

In case anybody is still in any doubt as to the sensitivity of these webmail.net.nz people to the issue of spam, see attached message. Apparently it is ok for webmail.net.nz to send commercial, unsolicited mail because it is "useful information", as opposed to other unsolicited, commercial e-mail which is apparently not. Ho hum. File under "moron spam haven" and take appropriate precautions. Joe ----- Forwarded message from bb(a)nsimail.com ----- From: bb(a)nsimail.com Date: 21 Feb 2000 20:50:40 -0800 X-Sent: 22 Feb 2000 04:50:40 GMT To: jabley(a)patho.gen.nz X-Mailer: Web Mail 3.5.1.4 Subject: Regarding Webmail Hi Joe, We have had great feedback and alot of people have joined our service from the general public. We have been offering this state of the art free service to anyone who wishes to use it, and have been astounded by some harsh responses from people who themselves work in the industry. We have offered leading edge technology in NEW ZEALAND for new zealanders and cannot understand some of the hostile responses we have had, almost all from IT proffesionals, when we have had such a great response from the general public. Because of the pressure put on us by a few in the industry we will not be emailing anybody else but feel that the issue of spamming is such a grey area that useful information is being put in the same circle as email suggesting you buy a ticket to africa at your local travel branch in Vancouver. I am sorry if i have caused undue stress by emailing you, but it was only our intention to inform nz'ers of this superior technology that is free for them to operate as they please. Kindest Regards Billy. ------------------------------------------------- Get personalized e-mail and a web address or your own free e-mail at http://www.networksolutions.com. ----- End forwarded message ----- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

None
by None 22 Feb '00

22 Feb '00

13]) by johnwayne.waikato.ac.nz (8.9.1a/8.9.1/Debian/GNU) with ESMTP id = TAA14625 for <nznog(a)list.waikato.ac.nz>; Tue, 22 Feb 2000 19:43:33 +1300 Received: from localhost (dave2(a)localhost) by wakko.burlap.net.nz (8.9.3/8.9.3/Debian/GNU) with ESMTP id TAA08222 for <nznog(a)list.waikato.ac.nz>; Tue, 22 Feb 2000 19:43:31 +1300 X-Authentication-Warning: wakko.burlap.net.nz: dave2 owned process doing = -bs Date: Tue, 22 Feb 2000 19:43:30 +1300 (NZDT) From: David Zanetti <dave2(a)earthling.net> X-Sender: dave2(a)wakko.burlap.net.nz To: nznog(a)list.waikato.ac.nz Subject: Re: More on DDOS attacks In-Reply-To: <20000222133907.A5270(a)styx.clear.net.nz> Message-ID: <Pine.LNX.4.10.10002221936550.8170-100000(a)wakko.burlap.net.nz> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=3DUS-ASCII On Tue, 22 Feb 2000, Chris Wedgwood wrote: > > I've been meaning to have another try with a newer version of 12 > > (especially as 12 has gone GD) so your experience is only going to > > encourage me, can I ask what version of IOS and on what platform you = lab > > setup was using?=20 [clip]=20 > That's not to say it is very stable, the last I tried 12.0.7(S) > was pretty horrible. I have '9 down but not tested yet. Speaking of the stablity of different IOS versions, we have a 3640 with 12.0(4)T on it that needs rebooting after about 7 weeks of uptime. Starts spamming the console port with memory allocation failures, although still manages to route stuff. It's not a particullarly odd setup, just routing between a couple of FE ports, but we are using dynamic packet filtering on it, ala "permit ... reflect outbound".=20 Ring any bells for anyone? Couldn't see anything that jumped out at me in the later release notes, and wasn't keen on an upgrade just to "try it out"..=20 --=20 David Zanetti <dave2(a)earthling.net> | (__) Mr Moo says: Moderator, nz.politics.announce | ( oo #include <geek/unix.h> | /L_=3D ... ( Eat more porridge ) =20 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Media announcement on free webmail. -Reply
by Geoff Thompson 21 Feb '00

21 Feb '00

Keith Davidson wrote: > > > They've presumably been trawling the list archive web pages. I've changed > the list config only to accept postings from subscribers. (Two years without > having had to do that surprises me.) I'll wait and see whether that creates > any problems. > > > > Donald Neal > > Donald, > > Certainly not a trawl of the list archive. I only subscribed to this list > this morning. > > My first message - spam! :-( > > Keith Davidson Guys (and Gals), To add my two penith worth... Both myself and Andrew Donkin here at Waikato have been hit. I was contemplating the fact that they may have just crawled over 'waikato.ac.nz', but then there have been a quite a few people down my corridor that haven't been hit. I'm not sure what source (or part of source) that they've used, but it looks like I'm tending towards it being only the list server, rather than our whole site. Our headers were : From: reply(a)webmail.net.nz Received: from shiraz.x.co.nz (210-55-40-205.adsl.xtra.co.nz [210.55.40.205]) by mailserv.waikato.ac.nz (8.9.3/8.9.0) with ESMTP id NAA13378 for <geofft(a)waikato.ac.nz>; Tue, 22 Feb 2000 13:08:27 +1300 Received: from www.webmail.net.nz ([192.168.0.106]) by shiraz.x.co.nz (8.9.3/8.9.3) with SMTP id MAA27843 for <geofft(a)waikato.ac.nz>; Tue, 22 Feb 2000 12:27:41 +1300 if that helps track down the culprit. The domain 'webmail.co.nz' is owned by 'Andrew Prast <andrew(a)prast.net>', and seems to be registered via ICONZ (using their nameservers). As for 'x.co.nz', we are also talking ownership by Andrew Prast, but this time with the email address of 'andrew(a)nz.com'. This domain seems to be registered via WebNZ Ltd. And yet there's an Xtra ADSL dialup connection in the mix. Does this gel with the messages that you received? Geoff. ---------------------------------- Geoff Thompson <geofft(a)waikato.ac.nz> University of Waikato, Hamilton, New Zealand Ph: (07) 838 4748 Random Quote of the Minute : And now for something completely the same. ---------------------------------- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Media announcement on free webmail. -Reply
by Donald Neal 21 Feb '00

21 Feb '00

>>> "Chris Wedgwood" <chris.wedgwood(a)clear.co.nz> 22/February/2000 01:49pm >>> > These guys win today's prize for the least clue displayed in a public > forum. I have tried to think of a more moronic way for them to advertise > their product, and I have failed. They've presumably been trawling the list archive web pages. I've changed the list config only to accept postings from subscribers. (Two years without having had to do that surprises me.) I'll wait and see whether that creates any problems. Donald Neal List Muggins --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

More on DDOS attacks
by Arron Scott 21 Feb '00

21 Feb '00

>From Cisco, for any one who hasn't seen it already. Title: Distributed Denial of Service (DDoS) News Flash URL: http://www.cisco.com/warp/public/707/newsflash.html Posted: February 9, 2000 Summary: This Security Advisory talks about Distributed Denial of Service (DDoS). More specificvally, it will help you: 1) Recognize programs used to facilitate DDoS attacks 2) Apply measures to prevent the attacks 3) Gather forensic information if you suspect an attack 4) Learn more about host security I have recently had the opportunity to try the "ip verify unicast reverse-path" command in a lab environment, it works with CEF on Cisco IOS 12.0. It seems relatively effective with about a 30% increase in distributed CPU utilisation (ie. 10% becomes 13%, not 40%). We had every packet flooding an interface with bogus source addresses, it happily discarded them all. And yes, it even forwarded the packets with valid source addresses ;-) It seems best suited to run at the edge of the network in from your downstream customers. There is no point running it on links in from upstream providers in most cases. We also lab tested Turbo Access-Lists, and found them very effective on long access-lists, the worst case the CPU increased loading on a VIP by about 40%, as opposed to a 200 entry non-Turbo Access-list which increased distributed CPU utilisation by as much as 95%. Arron Scott Telecom NZ --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 6

Media announcement on free webmail.
by reply＠webmail.net.nz 21 Feb '00

21 Feb '00

Show Off New Zealand announces the launch of its free web-based Email service Webmail.net.nz in conjunction with American Email giant Commtouch. Webmail.net.nz introduces leading edge Email technology that is user friendly, feature rich and fun to use. Moreover, Webmail allows you to access all of your Email, (including old fashioned pop Email), from any web browser in the world. Web-based Email with its easy graphics interface is rapidly overtaking FAX for instant business communication. Find out why for yourself. We cordially invite you to secure your business name, private name, or alias , while there is still good name availability. To check out the service click here http://www.webmail.net.nz Best wishes Billy Brown --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

Large Scale Internet Attacks - Technical article.
by Roger De Salis 20 Feb '00

20 Feb '00

Gentlefolk (are there any women on this list????) I thought this sufficiently interesting to post to the NOG, so that it may help anyone who is considering how to avoid these attacks in the future. I have removed all the sales guff (I hope). I hope this is of use. ==================================================================== At one account they were all Cisco. They were blown up by a massive amount of spoofed SYN flood attacks. The PIX did stop the SYN floods it did see, however most of traffic never reached the PIX because the egress router had a of overflow of traffic. I have personal experience with the account. We had recommended they put anti-spoofing filters and CAR filtering for ICMP on the egress routers. They told us they would not put any filters on the routers because they did not want to lose any performance. The attacks were designed to take advantage of a specific flaw in the network design of the target. This discovered by using an automated tool that tries literality hundreds of different exploits till it finds a successful avenue of attack. Since the hackers tools try over hundred types of exploits, it is possible that if the customer had implemented the egress filtering that we had recommend than the hackers would have been able to crash them with some other attack. However, a continual theme is that there are a large number of sites on the Internet, and the well defended sites tend to get ignored by this type of attack. Since these criminals don't tend to be very clever, in fact they seem downright lazy, they only go after sites that can be assaulted with off the shelf tools. In the case of one web portal, the attack was a BSD UNIX specific attack that rides on port 80 like any other HTTP traffic. It went thought the Cisco router and a Checkpoint firewall, just like it is supposed to do. Had the network administrator patched their Web servers with against this known type of attack, then the exploit would have done not worked at all. In one of the e commerce sites, they were blown up by a Smurf attack. However, the attack was against the upstream ISP, not the e commerce site itself. Had the target insisted the ISP put the "no ip directed broadcast" command on the outgoing line from the ISP to the target, then the Smurf would have not worked. ======================================================================== -- \_ Roger De Salis Cisco Systems NZ Ltd </' +64 25 481 452 L3, 117 Customhouse Qy /) +64 4 473 4912 Wellington, New Zealand (/ roger(a)desalis.gen.nz rdesalis(a)cisco.com ` --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

8 10