- NZNOG - lists.nznog.org

RE: [nznog] Peering question
by Donald Neal 27 Nov '03

27 Nov '03

> -----Original Message----- > From: nznog-bounces+Donald.Neal=telecom.co.nz(a)list.waikato.ac.nz > [mailto:nznog-bounces+Donald.Neal=telecom.co.nz(a)list.waikato.ac.nz]On > Behalf Of Ewan Cowie > Sent: Friday, 28 November 2003 10:36 > To: NZ NOG > Subject: RE: [nznog] Peering question > > > What interests me is this statement. > > "Throughout 2002, however, the Commission received complaints > from ISPs who were excluded from the domestic peering > agreements. Generally, the complaints concerned the fact that > none of the Tier 1 service providers paid for use of the > complainants' networks for data transmission yet the > complainants were required to pay fees to use the Tier 1s' networks". > > The Commerce Commission is bound to find similar opinions > locally as the ACCC did in Australia. If this turns into a > poo fight, will everyone just end up charging everyone for > "interconnection" just to avoid the complexities that the > peering issue raises? There also remains the question of the effect on the landscape both politically and technically if the Commerce Commission does proceed to mandate unbundled "Public Data Network Backhaul" among other things, as proposed in their September draft report. I'd hesitate to predict doom at this stage, in part because accurate predications of any kind are a bit of a challenge. Especially when they're about the future. Donald Neal | "They won't wobble. They won't! Technical Specialist | I shall lean against them Operations Engineering | myself, and I'm 6ft 6in. I will Integration & Services Divn. | personally eliminate wobble." Alcatel NZ Ltd | All opinions mine only. | - Russell T. Davies ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002." ------------------------------------------------------------------------------

1 0

RE: [nznog] Peering question
by Ewan Cowie 27 Nov '03

27 Nov '03

What interests me is this statement. "Throughout 2002, however, the Commission received complaints from ISPs who were excluded from the domestic peering agreements. Generally, the complaints concerned the fact that none of the Tier 1 service providers paid for use of the complainants' networks for data transmission yet the complainants were required to pay fees to use the Tier 1s' networks". The Commerce Commission is bound to find similar opinions locally as the ACCC did in Australia. If this turns into a poo fight, will everyone just end up charging everyone for "interconnection" just to avoid the complexities that the peering issue raises? Should this occur it is going to boost cost for the consumer (assuming that ISPs aim to retain the same profit margin - which I am sure many will)and could have negative effects on market growth, and the spread of Internet technology/connectivity in NZ. Of course nothing bad may happen at all, but today I am prophesying doom. Doom Ewan Cowie -----Original Message----- From: nznog-bounces+Ewan.Cowie=telecom.co.nz(a)list.waikato.ac.nz [mailto:nznog-bounces+Ewan.Cowie=telecom.co.nz(a)list.waikato.ac.nz] On Behalf Of Juha Saarinen Sent: Friday, November 28, 2003 8:50 AM Cc: NZ NOG Subject: Re: [nznog] Peering question Juha Saarinen wrote: > http://computerworld.co.nz/news.nsf/UNID/8E589BD9394A5141CC256DEB00084 > 747?OpenDocument A mate spotted this one: 'Thompson points to overseas markets where interconnection and peering are well-established practices. "If you look at the US, the likes of WorldCom or UUNet peer with each other, but they charge smaller players for interconnection."' Yes, I can well imagine that WCOM and UUNET would "peer with each other". ;-) -- Juha _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002." ------------------------------------------------------------------------------

1 0

LoTR auckland webcam streams
by Simon Blake 26 Nov '03

26 Nov '03

Hi all Could somebody in Auckland who peers at APE and recieves 202.7.4.x/24 from the route servers please direct a browser at http://palantir.citylink.co.nz/courtenay/ and http://palantir.citylink.co.nz/reading/ and tell me if you see a particularly miserable piece of courtenay place weather. I believe they're both going, but the anycast makes it a little harder than usual to test. Cheers Si

2 3

Easynet.nl
by Matthew G Brown 26 Nov '03

26 Nov '03

Heads up for people using any of the easynet.nl RBL's , All services will be disabled on 1st Dec PST . Best regards Matthew G Brown B & R Holdings LIMITED Nelson, New Zealand DDI: + 64 3 544 9116 MOB: 027 4807731 http://www.brh.co.nz http://www.backupserver.co.nz

1 0

Peering at the APE and WIX - was Re: Irked with TelstraClear
by Andy Linton 26 Nov '03

26 Nov '03

I posted some notes yesterday about peering with the APE and WIX route servers and gave a link for application forms which wasn't as useful as it might have been. For reference the forms are at: http://www.citylink.co.nz/cgi-bin/wixape.pl?tmpl=ape.tmpl http://www.citylink.co.nz/cgi-bin/wixape.pl?tmpl=wix.tmpl Joe Abley posted some ideas on peering - one obvious one that he hasn't gone the whole distance with is that if many of the small/medium players work together they will be in a better position to negotiate peering with the two large telcos. Consider the stories here: http://www.tomsdomain.com/aesop/id17.htm

7 10

ICANN's Legacy? - The threat to universal Internet connectivity
by Jeff Williams 25 Nov '03

25 Nov '03

All, See: http://www.infoworld.com/article/03/11/21/46FEtrouble_1.html?s=feature The threat to universal Internet connectivity Can -- and should -- blockers, spammers, and domain name overlords be stopped? By David L. Margulius Thank you David for this breath or fresh air, honest evaluation, and interesting report.. Someday maybe Vint, and that "Crowed" will "Get it"... But in the mean time it may be time to throw the rascals out and have a new and inclusive beginning?? Will the NTIA take heed? Will Telstra and AT&T also take heed?? Regards, -- Jeffrey A. Williams Spokesman for INEGroup LLA. - (Over 134k members/stakeholders strong!) "Be precise in the use of words and expect precision from others" - Pierre Abelard "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== CEO/DIR. Internet Network Eng. SR. Eng. Network data security Information Network Eng. Group. INEG. INC. E-Mail jwkckid1(a)ix.netcom.com Contact Number: 214-244-4827 or 214-244-3801

1 0

RE: [nznog] Peering Issue - from a business point of view
by Paul Adshead 25 Nov '03

25 Nov '03

And then if if Telecom did join in and on-charged the more expensive Intl bw, how many customers would end up with Telecom bills like the one linked to below?? http://mike.net.nz/stuff/jetstream.jpg (Not mine by the way.) Paul Adshead Network & Systems OTL Software Ltd -----Original Message----- From: Matt Camp [mailto:gargoyle(a)noise.net.nz] Sent: Wednesday, 26 November 2003 15:29 To: Tikiri Wicks Cc: 'nznog' Subject: Re: [nznog] Peering Issue - from a business point of view [Everything in this email is my own uninformed personal opinion, and has absolutely nothing to do with TelstraClear's official position on anything at all. I'm not involved in any of this stuff, so don't quote me on anything, kthx] On Wed, 26 Nov 2003, Tikiri Wicks wrote: > In that case what about if all the small ISP's as a group peer with one > layer 3 switch at the APE and another one at the WIX. This way Telstra would > have to peer with everyone or not peer with anyone. Ah, but what happens when they choose not to peer with this group? And then what happens when Telecom takes a similar line? All of a sudden you've got a bunch of ISP's who are paying for international bandwidth through one of the other providers like AT&T, probably per byte, and they're having to use that bw to transit domestic traffic to everyone else. The problem is that the people making these decisions DO have reasons for making these changes... the reasons may be totally commercially based and have nothing to do with the feelgood ethos of the internet, but if the suits at TelstraClear are having those thoughts, I'll bet you a dollar there is someone in a suit at Telecom thinking "hey... if they can do it, so can we... and if we both do it, then everyone else will HAVE to buy a connection". > If all the non Telco ISP's were to be lumped into one pile that would be a > lot of such internet services and web sites. But remember, only the people who do not already have a TelstraClear service are potentially at risk of having their peering cut (according to jsr's quoted statement from Mathew Bolland).... How many of the non-telco ISP's in NZ don't have a TelstraClear link? How about if you add in the theory that Telecom takes the same line? All of a sudden your group of people is a whole lot smaller. While its nice to think that many ISP's will join your group trying to force peering, I think you'll find that many of them are still run by people who are more concerned about their business continuing and can't afford to take commercial risks just to uphold the ethos. > If all of these were as a group with rules that state peer with the all or > do not peer at all. Essentially a gigabit Layer 3 switch at the NEW > exchange. What this means is that parties would not peer with individual > small ISP's rather they would peer with the entire group. aka... the route servers? > The Telstra consumer would most probably switch to his friends connection. I think there would be more to it than that. Especially if Telecom took the same line, thus forcing all the non-telco ISP's to use more expensive bw, and charge their customers international rates for what should be domestic traffic. I haven't been involved with any of this peering stuff, but my feeling is that perhaps (as Tony implied), there is a lot more to this than people realise, and in fact its not just TelstraClear trying to be big and bad. --- Matt Camp _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

2 1

Re: [nznog] Peering Issue - from a business point of view
by Tikiri Wicks 25 Nov '03

25 Nov '03

p.s. I have NO affiliation with Maxnet I just use an email address from them. > What would that achieve? It won't solve the problem that John Russell > brought up. There is NO need to set up any other peering exchanges. > > You are confusing the issue. Get someone at the maxnet > nog to explain it to you I'm not trying to look at it from a technical point. What I mean is purely from a business point of view. In that case what about if all the small ISP's as a group peer with one layer 3 switch at the APE and another one at the WIX. This way Telstra would have to peer with everyone or not peer with anyone. New Zealand Internet consumers have great interest in other Internet related services and web sites in New Zealand. For example the earlier reference to nzdating.co.nz A large portion of these New Zealand based ineternet services and websites are physically hosted by ISP's other than Telstra and Telecom. Not to mention the end consumers themselves. If all the non Telco ISP's were to be lumped into one pile that would be a lot of such internet services and web sites. If all of these were as a group with rules that state peer with the all or do not peer at all. Essentially a gigabit Layer 3 switch at the NEW exchange. What this means is that parties would not peer with individual small ISP's rather they would peer with the entire group. In this scenario what would happen ? A Telstra consumer tries to access www.nzdating.co.nz what happens ? it is not accessible for them. The next day (or same day) he/she whines to his/her friends about nzdating not beign there. But his/her friend is on a dialup to ICONZ / Slingshot / _____ and they could access the site with no hassles. Instant conclusion is something is wrong with Telstra. The Telstra consumer would most probably switch to his friends connection. The key is to achieve critical mass. You guys can only achieve this critical mass as a group. Not as individual companies as you are too small alone to make any difference. Only as a group. Cheers Tikiri ----- Original Message ----- From: "Lin Nah" <lin(a)darkmere.gen.nz> To: "Tikiri Wicks" <tcwicks(a)maxnet.co.nz> Cc: "Tony Wicks" <nzog(a)road.gen.nz> Sent: Wednesday, November 26, 2003 12:00 PM Subject: Re: [nznog] Peering Issue - Perhaps a solution > HI Tikiri > > On Wed, 26 Nov 2003, Tikiri Wicks wrote: > > I realize that the APE and the WIX already exist but what I'm talking about > > is setting up a second peering point with different game rules. Namely Give > > as much as you take > What would that achieve? It won't solve the problem that John Russell > brought up. There is NO need to set up any other peering exchanges. > > You are confusing the issue. Get someone at the maxnet > nog to explain it to you > > > What you guys don't seem to understand is that if all the smaller ISP's > > Maxnet, IHUG, Slingshot, etc.... were all combined into one (big lump) that > > is probably way more end consumers than what Telstra has. And probably > > enough to get Telecom thinking as well > > regards > lin > > > > > ----- Original Message ----- > > From: "Tony Wicks" <nzog(a)road.gen.nz> > > To: "'Tikiri Wicks'" <tcwicks(a)maxnet.co.nz> > > Cc: "'nznog'" <nznog(a)list.waikato.ac.nz> > > Sent: Wednesday, November 26, 2003 11:14 AM > > Subject: RE: [nznog] Peering Issue - Perhaps a solution > > > > > > I hate to mention the obvious Tikiri, but that already exsists, they are > > called APE and WIX. > > > > > > > > -----Original Message----- > > From: Tikiri Wicks [mailto:tcwicks(a)maxnet.co.nz] > > Sent: Wednesday, 26 November 2003 11:13 a.m. > > To: Andy Linton; nznog > > Subject: [nznog] Peering Issue - Perhaps a solution > > > > Just a thought here > > > > Since most ISP's in NZ seem to be in agreement over this. What if > > instead of just blowing off steam: > > > > Everyone joins hands and sets up two (or more) peering exchanges. One in > > Auckland and one in Wellington. Then everyone simply drops all peering with > > Telstra (and / or Telecom if and where relevant) and interconnect through > > the two (or more) exchange points. The idea is that no one would pay for > > anything except for the cost of connectiong yourselves to the exchange > > points. Whether this be via tangent / united network / citylink / some big > > SDH radio link / microwave / a whole bunch of people running to the > > exchanges with buckets fileld with packets :) > > > > Peering would be voluntary for anyone and on the condition that each > > provides the same amount of bandwidth under the same conditions from their > > network to the exchange as they do from teh exchange to their network. > > > > That should keep players like Telecom and Telstra from trying to > > manipulate the market. > > > > If Telstra want to peer they would be forced to do so at the same > > conditions that apply to everyone else > > > > Also the costs of interconnectivity between the exchange points could be > > borne by the members based on some simple equation such as for example a > > ratio based on the amount of bandwidth with which they connect to the > > exchanges. Fill in the blanks here ________ > > > > Finally I would think that this would be a great opportunity for > > operators like tangent who have fibre running between the two (or more) > > hypothetical exchanges. > > > > Cheers > > > > Tikiri > > > > ----- Original Message ----- > > From: "Andy Linton" <asjl(a)citylink.co.nz> > > To: "nznog" <nznog(a)list.waikato.ac.nz> > > Sent: Wednesday, November 26, 2003 10:53 AM > > Subject: [nznog] Peering at the APE and WIX - was Re: Irked with > > TelstraClear > > > > > > > I posted some notes yesterday about peering with the APE and WIX route > > > servers and gave a link for application forms which wasn't as useful as > > > it might have been. For reference the forms are at: > > > > > > http://www.citylink.co.nz/cgi-bin/wixape.pl?tmpl=ape.tmpl > > > http://www.citylink.co.nz/cgi-bin/wixape.pl?tmpl=wix.tmpl > > > > > > Joe Abley posted some ideas on peering - one obvious one that he hasn't > > > gone the whole distance with is that if many of the small/medium players > > > work together they will be in a better position to negotiate peering > > > with the two large telcos. > > > > > > Consider the stories here: > > > > > > http://www.tomsdomain.com/aesop/id17.htm > > > > > > > > > > > > _______________________________________________ > > > NZNOG mailing list > > > NZNOG(a)list.waikato.ac.nz > > > http://list.waikato.ac.nz/mailman/listinfo/nznog > > > > _______________________________________________ > > NZNOG mailing list > > NZNOG(a)list.waikato.ac.nz > > http://list.waikato.ac.nz/mailman/listinfo/nznog > > > > _______________________________________________ > > NZNOG mailing list > > NZNOG(a)list.waikato.ac.nz > > http://list.waikato.ac.nz/mailman/listinfo/nznog > >

3 2

RE: [nznog] Peering Issue - Perhaps a solution
by Donald Neal 25 Nov '03

25 Nov '03

> -----Original Message----- > From: nznog-bounces+Donald.Neal=telecom.co.nz(a)list.waikato.ac.nz > [mailto:nznog-bounces+Donald.Neal=telecom.co.nz(a)list.waikato.ac.nz]On > Behalf Of Tikiri Wicks > Sent: Wednesday, 26 November 2003 11:13 > To: Andy Linton; nznog > Subject: [nznog] Peering Issue - Perhaps a solution > > > Just a thought here > > Since most ISP's in NZ seem to be in agreement over this. What if > instead of just blowing off steam: > > Everyone joins hands and sets up two (or more) peering > exchanges. One in > Auckland and one in Wellington. Then everyone simply drops > all peering with > Telstra (and / or Telecom if and where relevant) and > interconnect through > the two (or more) exchange points. As the monthly posting to this list says, >Internet Exchanges >See http://www.ape.net.nz/ for details of the Auckland Peering >Exchange and those connected there, http://www.wix.net.nz/ for the >Wellington Internet Exchange. Donald Neal | "They won't wobble. They won't! Technical Specialist | I shall lean against them Operations Engineering | myself, and I'm 6ft 6in. I will Integration & Services Divn. | personally eliminate wobble." Alcatel NZ Ltd | All opinions mine only. | - Russell T. Davies ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002." ------------------------------------------------------------------------------

1 0

(no subject)
by Ben Martel 25 Nov '03

25 Nov '03

1 0

RE: [nznog] Irked with TelstraClear
by J S Russell 25 Nov '03

25 Nov '03

On Tue, 25 Nov 2003, Neil Gardner wrote: > JSR, Do you have any numbers or names of people that this sort of > (justified, and for gosh sake, please be polite when doing it) enquiry > would be best directed towards? Personally, were I a TelstraClear customer, I would be inclined to treat it as a fault, yes. And I would guess that fault reports should be sent though normal account management channels. JSR -- John S Russell | Big Geek | Doing geek stuff.

2 1

Re: [nznog] Irked with TelstraClear
by Simon Lyall 24 Nov '03

24 Nov '03

On Tue, 25 Nov 2003, J S Russell wrote: > Nope - as I outlined earlier, we treated it as damage and routed around > it. Technology triumphs over stupidity! Huzzah! Hmm, still some customers of TesltraClear [1] might be seeing less than optimal connectivity to Iconz hosted sites. Why not approach them and suggest that they get direct connectivity to APE,WIX or wherever? If they are paying $25 per 64Kbits/sec per month then they don't need much bandwidth to start saving money. As a bonus, next time their bandwidth negotiations come around they'll be able to pick from any ISP that's APE connected for their bandwidth. Here are a few possibles that are fairly big but appear (from a quick glance) to be only domestically routed via TesltraClear currently: aut.ac.nz auckland.ac.nz vuw.ac.nz waikato.ac.nz iserve.co.nz actrix.co.nz scarfies.net wave.co.nz I would guess a few admins from there are already on this list, some might already be getting complaints about domestic connectivity. I'd be interested in their take on the situation. [1] My Spell checker keeps trying to substitute "Testicular" for "TelstraClear" , then again it also tried to do "thug" for "ihug" :) -- Simon J. Lyall | Very Busy | Web: http://www.darkmere.gen.nz/ "To stay awake all night adds a day to your life" - Stilgar | eMT.

1 0

[Fwd: RE: [nznog] Changes to Telecom ADSL Network]
by kyle carter 24 Nov '03

24 Nov '03

I personally am happy with this topic being discussed on list.. however being an anonymous looking sender is a bit off putting. Many of the topic on this list i dont have a problem with, but i do like to know is going on with regards to the internet in NZ. This is a topic i have been asked about by many people i know who arent gamers but have been experiencing many issues with the latency of their connections when nearing max bandwidth usage. I did not experience any problems with the previous traffic shaping with the dropping of packets, however i have experienced some very weird issues with the new packet shaping when nearing the bandwidth limits of my jetstart connection. On Mon, 2003-11-24 at 07:29, Craig Spiers wrote: > Why was this posted to NZNOG? > > If you have gripes with telecom, take it up with telecom? > > I personally don't have a problem with the changes telecom have made.. And I > believe it hasn't been done on purpose, but a side effect from the changing > of equipment vendors.. > > > > -----Original Message----- > From: Anonymous User [mailto:ominona(a)emailaccount.com] > Sent: Sunday, 23 November 2003 6:26 p.m. > To: adsl(a)lists.unixathome.org; nznog(a)list.waikato.ac.nz > Subject: [nznog] Changes to Telecom ADSL Network > > An interesting topic for discussion: > > Telecom is installing new equipment in its ADSL network, which handles > traffic congestion in a slightly different way than previously. > Overview > Telecom is installing new equipment in its network, which handles traffic > congestion in a slightly different way than previously.

4 3

Changes to Telecom ADSL Network
by Anonymous User 22 Nov '03

22 Nov '03

An interesting topic for discussion: Telecom is installing new equipment in its ADSL network, which handles traffic congestion in a slightly different way than previously. Overview Telecom is installing new equipment in its network, which handles traffic congestion in a slightly different way than previously. When a traffic burst exceeds the rated capacity of that connection, any overflow data is now queued temporarily and sent as soon as the congestion is cleared - normally within milliseconds. This change should enhance the experience for most Internet users, however some gaming customers may have increased sensitivity to other applications running in the background. To achieve the best online game playing experience, Telecom is working to ensure that the connections are optimised and queuing is minimised. Users wanting the best gaming experience should avoid running other applications or PCs on the same connection or upgrade their connection to a higher speed to ensure queues are minimised. Frequently Asked Questions: Q. Why can multiple users on one connection now not connect when playing games? A. Telecom is installing new equipment in the network, which handles traffic congestion in a slightly different way than previously. When a traffic burst exceeds the rated capacity of that connection, any overflow data is now queued temporarily and sent as soon as the congestion is cleared - normally within milliseconds. Q. Why has Telecom made this change? A. This change means that packets of data, which previously may have been dropped, will now reach their destination. This change should enhance the experience for most Internet users, however some gaming customers may have increased sensitivity to other applications running in the background. Q. This is obviously having a negative effect on my games experience - why don't you change it back? A. For the majority of customers, the new queue shaping provides them with a better Internet experience. Telecom is working to ensure that the connections are optimised and queuing is minimised. Users wanting the best gaming experience should avoid running other applications or PCs on the same connection or upgrade their existing connection to a higher speed to ensure queues are minimised. Q. Why didn't you notify customers of this change? A. Telecom regularly makes changes to its Network and indeed, announced earlier this year that it was overhauling its JetStream portfolio. With so many changes being made in various parts of the Network, it is impractical to notify all customers whenever a change is made. Q. Isn't this just a ploy to get us on to your 256k plans where we have to pay for all traffic? A. Customers are free to choose the most appropriate plan for their needs. The Xtra JetStream 256k and Full speed plans obviously offer customers a bigger pipe, so the chances of packets getting dropped or queued are less. ~ John Doe _____________________________________________________________ Free, simple, fast, memorable email Become you(a)EmailAccount.com at http://www.emailaccount.com/

2 1

Telehousing
by Craig Spiers 22 Nov '03

22 Nov '03

Anyone know of any telehousing facilitys in auckland CBD? Must be on the citylink or tangent / united networks fiber networks.. Cheers!

1 0

2.4GHz operators - Lincoln/Henderson area
by Michael Hallager 21 Nov '03

21 Nov '03

Hi, Could any operators of 2.4GHz outdoor networks in the Lincoln/Henderson area please contact me offlist for mutual co-operation in channel usage. Michael Hallager Managing Director Networkstuff Limited URL: http://www.networkstuff.co.nz Networkstuff, NZ's leading supplier of high quality used networking equipment. E-Mail: michael @ networkstuff.co.nz Member of the NZ Open Source Society. Member of the Auckland VHF Group. Amateur radio callsign: ZL1VMH.

1 0

ENUM Seminar
by Peter Macaulay 19 Nov '03

19 Nov '03

Just a reminder for those of you who would like to attend, you can still enrol. The $50 is primarily for food. The Number Administration Deed (NAD) Management Committee and Internet NZ are holding a joint seminar on ENUM on Monday 24 November 2003 from 9.00 am - 5.00 pm. The venue is the Level 2 West Lounge at Westpactrust Stadium in Wellington. Programme Tony Holmes of BT is attending as guest speaker. He intends to discuss the following topics: 1. Introduction to ENUM. 2. ENUM Specifications, Rules and Recommendations. 3. An overview of what's happening across the globe. 4. Experience, issues and problems from the UK ENUM trial. 5. The focus for New Zealand - discussion on 'what needs to happen next'. Representatives from the Ministry of Economic Development will also attend to present their views on ENUM. Cost $50.00 per person, which includes the full day ENUM seminar plus morning tea, lunch and afternoon tea. Registration and Contacts Jennifer Neeley (M-co) Phone: 04 498 0026 Fax: 04 473 6950 Email: jennifer.neeley(a)m-co.co.nz -- Peter Macaulay Executive Director InternetNZ Direct +64 4 495 2113

1 0

ICONZ Domestic Peering Update
by John Johnston 19 Nov '03

19 Nov '03

ICONZ have updated their domestic peering advertisements. Any that currently peer with ICONZ please update your prefix lists with attached file or use URL supplied. If there is anyone who would like to peer with ICONZ across APE or WIX please send an email to noc(a)iconz.net http://www.iconz.co.nz/prefix/ Regards ICONZ NOC Email: noc(a)iconz.net Phone: 09 977 3500

1 0

Xtra reverse DNS's
by Michael Hallager 18 Nov '03

18 Nov '03

Hi all, People who are receiving IP space from Global Gateway would be well advsied to check that their IP addresses have not been hijacked by Xtra: bash-2.05b# nslookup 210.55.169.1 Note: nslookup is deprecated and may be removed from future releases. Consider using the `dig' or `host' programs instead. Run nslookup with the `-sil[ent]' option to prevent this message from appearing. Server: 210.55.108.130 Address: 210.55.108.130#53 Non-authoritative answer: 1.169.55.210.in-addr.arpa name = 210-55-169-1.ipnets.xtra.co.nz. Authoritative answers can be found from: 169.55.210.in-addr.arpa nameserver = alien.xtra.co.nz. 169.55.210.in-addr.arpa nameserver = terminator.xtra.co.nz. bash-2.05b# Reminds me of the "old days" when Xtra started up.... Michael Hallager Systems Administrator Vivid Computers Ltd Managing Director Networkstuff Ltd

4 4

NZNOG '04
by Tony McGregor 17 Nov '03

17 Nov '03

Hi All The NZNOG '04 arrangements are coming along well and registration is now open at www.nznog.org. We're pleased to have Geoff Houston (Telstra Aust/APNIC) and Philip Smith (CISCO) as invited speakers. See the conference web pages for more details. Other details about the conference, including the the on campus accommodation etc are also on the web page. It's still possible to put in a talk or tutorial proposal. Please send them to talks(a)nznog.org. We're about to send out letters to various folks asking for sponsorship. We're not looking for lots of money, just ways to add value to the conference through materials, extra international speakers, the bar, etc. If you have any contacts that we could write to please let me know. It's a huge help if people sign up early. The conference fee is lower if you sign up early. Also, there is only limited accommodation with in-room network access, if you want that I suggest you sign up quick! Tony

1 0

New IANA IPv4 allocations and bogon updates: 83/8 and 84/8
by Rob Thomas 17 Nov '03

17 Nov '03

Hi, team. [ Apologies to those who have received this post in other fora. ] The numerous Team Cymru bogon projects have been updated to reflect the following IANA allocations on November 15, 2003: 83/8 Nov 03 RIPE NCC 84/8 Nov 03 RIPE NCC IANA allocations change over time, so please check regularly to ensure you have the latest filters if you are not using the bogon BGP feed(s). We do announce updates to the bogon projects to the FIRST community, as well as on lists such as NANOG, isp-routing, isp-security, isp-bgp, cisco-nsp, and bogon-announce. We can not stress this point strongly enough - these allocations change. If you do not adjust your filters, you will be unable to access perhaps large portions of the Internet. Worse yet, you may end up blocking access for people who transit through you. Please do not blindly apply any filters or blocks to your network without carefully considering the ramifications of doing so. As a point of reference, the master Bogon Reference Page can be found here: http://www.cymru.com/Bogons/index.html A quick summary of the documents and projects that have been updated include the following: HTTP The Bogon List The Text Bogon List, Unaggregated The Text Bogon List, Aggregated Secure BIND Template Secure IOS Template (Cisco) Secure BGP Template (Cisco) Secure JUNOS Template (Juniper) Secure JUNOS BGP Template (Juniper) Ingress Prefix Filter Templates, Loose and Strict (Cisco) Ingress Prefix Filter Template, Loose (Juniper) Ingress Prefix Filter Template, Strict (Juniper) BGP Bogon route-server * RADb fltr-unallocated fltr-martian fltr-bogons DNS Bogon (bogons.cymru.com) zone Monitoring Bogon prefix monitoring * All of the bogon peers have received the appropriate BGP prefix updates. Please feel free to contact Team Cymru with any comments, questions, or concerns. Thanks! Rob, for Team Cymru. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

1 0

Re: Weird spam
by Richard Cox 17 Nov '03

17 Nov '03

On 17 Nov 2003 11:25 UTC "Barry Murphy" <barry(a)unix.co.nz> wrote: | I received the same message 8 times to the same address with about | 2-3 per hour. My spamassasin picked them up but the strange thing was | they all came from different IP addresses and I couldn't traceroute | any of them... You've assumed the handoff between received lines was valid; it wasn't. The "earlier" received line in each case was totally bogus: there is now a variety of custom "spamware" that forges a Received: header and carefully matches the fake details to the reverse DNS of the proxy or trojan machine that the spammer is actually sending from. That makes it almost impossible to know that the line is is in fact forged, unless you spot some little detail that they get wrong ... like (as in some of the cases that you quoted), the fact that the fake sending IP in the forged header is in a block that's either unannounced or completely unroutable! | IP addresses they were sent from: 99.27.67.200 IANA Reserved 202.163.151.24 Assigned but not announced 89.87.209.213 IANA Reserved 112.188.234.68 IANA Reserved 45.38.78.200 Interop Show Network 244.128.164.67 Unroutable 168.80.80.67 UUNET Internet Africa 64.215.105.194 64.215.105.194 | the messages were stopped as they were listed in blacklists. Blocklist tests are normally done on the most recent Received: line, as unless that line is OK, previous lines cannot usually be trusted. | The thing I don't understand is that there was no consistency, all | the emails from different IP's, all different forged header fields, | all not tracerouteable and within 30 minutes of each other to an | address only listed on a new zealand website. I can traceroute to some of the IPs you listed so it may be that traceroute packets have been blocked at your gateway. There are currently very some good reasons why network administrators do that! Because of the level of filtering, spammers now try to send the same mail from different proxies/zombies to be sure of getting it through. Different IPs are in different blocklists, and spammers can't tell what blocklist your ISP - or that of any other victim - uses. They can't even tell whether mail gets through at all because many systems are now configured to drop the mail rather than reject it. I won't pass comment on that policy, but we all know it happens. Hence to get better delivery figures, spammers now have to send out multiple copies. Their systems randomise all the variable factors - fake mail client, fake origin, fake sender name, random subject line etc, and loads of random garbage text in the spam body to foil any checksum detection of bulk mailing. | Weird, sounds very much like the spam system explained on the list | not too long ago. While it may well use that system, multiple proxy/trojan sending boxes are now becoming a standard spammer-modus-operandi! Joe Abley <jabley(a)isc.org> replied: | It seems to be fairly commonplace these days for (a) spam to be | vectored through widely-distributed sets of open proxies or infected | windows drones and (b) for unallocated or normally unadvertised space | to be advertised transiently in order to provide temporary addresses | to bind SMTP clients to. (a) is normal, for sure, but (b) - although theoretically trivial to do - is not yet in common use. Bogus announcements would need to be visible every place the spammer wanted to send to, and would then be visible at the route-collectors which report into systems like RIPE's RIS server and that in turn would allow them to be identified from a lookup at http://www.ripe.net/ripencc/pub-services/np/ris/index.html -- Richard Cox \/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/ Contribute to the SpamCon Legal Fund!! http://www.spamcon.org/legalfund/

1 0

Weird spam
by Barry Murphy 17 Nov '03

17 Nov '03

Hey guys, Anyone else receive this subject on the 14th... "AMERICAN STOCK MARKET: TRHL Retains Sky Investor Relations...edita", where edita was changed with multiple names. Not strange that I received spam, however I received the same message 8 times to the same address with about 2-3 per hour. My spamassasin picked them up but the strange thing was they all came from different IP addresses and I couldn't traceroute any of them... All of them stop at 202.37.246.18 (Global-gateway) eg. traceroute 89.87.209.213 traceroute to 89.87.209.213 (89.87.209.213), 64 hops max, 44 byte packets 1 gateway (219.88.241.241) 1.679 ms 2.403 ms 1.358 ms 2 fe0-0.cr1.idc.orcon.net.nz (219.88.242.250) 0.863 ms 0.872 ms 0.852 ms 3 fe-1.qos2.idc.orcon.net.nz (219.88.242.226) 1.134 ms 1.004 ms 1.128 ms 4 219.88.242.233 (219.88.242.233) 1.774 ms 1.906 ms 1.567 ms 5 202.50.245.33 (202.50.245.33) 39.962 ms 93.651 ms 6.643 ms 6 ge-0-3-0-6.akbr3.global-gateway.net.nz (202.37.246.18) 6.165 ms !N^C Ip addresses they were sent from: 99.27.67.200 202.163.151.24 89.87.209.213 112.188.234.68 45.38.78.200 244.128.164.67 168.80.80.67 64.215.105.194 In all cases the messages were stopped as they were listed in blacklists. RCVD_IN_NJABL (0.9 points) RBL: Received via a relay in dnsbl.njabl.org [RBL check: found 45.38.78.200.dnsbl.njabl.org.,] [type: 127.0.0.9] RCVD_IN_UNCONFIRMED_DSBL (0.5 points) RBL: Received via a relay in unconfirmed.dsbl.org [RBL check: found 45.38.78.200.unconfirmed.dsbl.org.] RCVD_IN_BL_SPAMCOP_NET (3.0 points) RBL: Received via a relay in bl.spamcop.net [RBL check: found 45.38.78.200.bl.spamcop.net.] They were also stopped because of forged headers, some having forged froms, forged MUA Outlook, etc. The thing I don't understand is that there was no consistency, all the emails from different IP's, all different forged header fields, all not tracerouteable and within 30 minutes of eachother to an address only listed on a new zealand website. Weird, sounds very much like the spam system explained on the list not too long ago. Barry Murphy

2 1

Understanding my traceroute?
by Jon Dean 16 Nov '03

16 Nov '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Everybody, I'm trying to get a better understanding of how the DSL network is integrated together in New Zealand. I'm hoping someone can help explain to me why their is such big latency gaps in some of the connections. Below is the output from a traceroute between me on Ihug Jetstart DSL and an Xtra Jetstream connection with a Static IP. 1 192.168.1.2 (192.168.1.2) 0.299 ms 0.148 ms 0.142 ms 2 203-118-173-1.adsl.ihug.co.nz (203.118.173.1) 56.506 ms 57.695 ms 60.022 ms Is 203.118.173.1 an Ihug router or a Telecom router? 3 192.168.253.225 (192.168.253.225) 66.866 ms 58.911 ms 61.027 ms 4 192.168.254.42 (192.168.254.42) 70.011 ms 69.028 ms 59.954 ms 5 v-93-tig-nz-akl-core-1.ihug.net (203.109.156.145) 70.147 ms 69.346 ms 68.020 ms 6 203-109-156-98.ihug.net (203.109.156.98) 69.904 ms 67.363 ms 71.046 ms 7 a5-0-0-40.akcr5.global-gateway.net.nz (202.37.245.165) 210.854 ms 203.399 ms 185.586 ms This is my real question... why is this such a big lag between 6 & 7. 140ms seems to be very high? Is there some type of bandwidth gap between Ihug and Global Gateway? Everything below this point is irrelevant.... Cheers, Jon -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iD8DBQE/uGYITV0Xs0S7UB4RAg8zAJ4yB4wn5iqCWgzhQpljznjnyeTiSQCfaDAu INl9jjcMXNgPbWST7gHB5kE= =qECf -----END PGP SIGNATURE-----

2 2

BreezeNet PRO Serial Adapter...
by Dan Clark 16 Nov '03

16 Nov '03

Hi all, Does anyone happen to have one of those 3 pin serial adapters for a BreezeNet Unit? Or know the pinouts. Please contact offlist. Kind Regards, Dan Clark DunedinWireless Scarfies.Net Ltd

1 0

Apropos Spamcop, and 2day.com before that.
by Juha Saarinen 16 Nov '03

16 Nov '03

http://www.theregister.co.uk/content/6/33724.html -- Juha

3 2

Trademe contact?
by Simon Lyall 15 Nov '03

15 Nov '03

Has anyone got technical contact for trademe? I've tried their whois and 0900 numbers but their not operating today. -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz Ihug Ltd, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz

1 1

Revamp of WIX website
by Andy Linton 15 Nov '03

15 Nov '03

We've redone the WIX website http://www.wix.net.nz/ and it now has links to the Looking Glass tool as well as some explanations of how we do things. I'm working on a similar revamp of the APE website and will announce in due course. andy

5 12

Update to ihug prefixes
by Simon Lyall 14 Nov '03

14 Nov '03

We're updated our prefixes. Current list is attached or available at the following URL: http://www.ihug.net/ihug-prefix-list -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz Ihug Ltd, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz

1 0

Re: [nznog] IPv6 Peering on the WIX
by Simon Lyall 14 Nov '03

14 Nov '03

On Fri, 14 Nov 2003, Joe Abley wrote: > If you want to be able to reach the rest of the IPv6 internet, you will > need a transit provider of some kind. Since it sounds like nobody in > New Zealand is offering IPv6 transit, you'll need to look outside the > country and gain v6 transit via a tunnel plumbed over IPv4. Sprint appear to provide a ipv6, it's via tunnels but they provide direct ipv4 connectivity into NZ so you don't have multiple providers. http://www.sprintv6.net/ http://www.sprintv6.net/Sprintv6.html "Sprint has IPv6 speaking routers in New York City, Washington DC, Seattle, Ft. Worth, and San Jose in the US, and routers in Brussels, Belgium, and Stockholm, Sweden, in Europe. Customers who wish to connect to Sprint's IPv6 backbone may do so, by building a tunnel from their CPE (or any device inside their network) to the nearest Sprint IPv6 router. " -- Simon J. Lyall. | Very Busy | Mail: simon(a)darkmere.gen.nz "To stay awake all night adds a day to your life" - Stilgar | eMT.

1 0

FW: Windows 2000/XP Remote exploit - High Severity
by Barry Murphy 12 Nov '03

12 Nov '03

Thought people would like to be advised. Kindest Regards Barry Murphy Subject: Windows 2000/XP Remote exploit - High Severity Dear Barry Murphy, Summary ------- Products affected: Windows 2000/Windows XP Severity: High (Remote Execution) Ports: 139,445 (TCP) Patch: http://www.microsoft.com/technet/security/bulletin/MS03-049.asp Read more: http://www.eeye.com/html/Research/Advisories/AD20031111.html Discovered by: EEYE Digital Security EEYE Digital Security has discovered a bug in the Windows Workstation Service. This bug can lead to the remote exploitation of any Windows 2000 or Windows XP machines. The attacker needs access to ports 139/445. These ports are by default open on a Windows 2000 or XP host. SensePost has access to a proof of concept script that will determine if a host is vulnerable. For more information about the script please contact research(a)sensepost.com. Let's get this hole plugged before the next worm comes along. Regards, SensePost Research Team. ======================================================= SensePost Research research(a)sensepost.com http://www.sensepost.com (tel) +27 12 667 4737 =======================================================

2 1

For postmaster at asiaonline
by jfp 11 Nov '03

11 Nov '03

I have tried sending this to the proper channels and have been ignored. mail.asiaonline.net.nz's spam filter instead of rejecting emails it doesn't like defers them which mean they sit in our mail queue for a week retrying every 4 hours and clogging our and their mailservers. This seems to me like a rather nonsensical thing to do. > Sep 3 15:26:33 tiny sendmail[26020]: h7V3CIlM028321: > to=<ADDRESSREMOVED>, delay=3+00:13:59, > xdelay=00:00:06, mailer=esmtp, pri=25950368, > relay=mail.asiaonline.net.nz., dsn=4.0.0, stat=Deferred: 450 > <Feeljl(a)163.net>... 163.net,Known spam domain PS: This went thru our mailserver because we are forwarding that email address and obviously have different spam filter's than asiaonline. jfp. ------------------------------------------------------------------------ Jean-Francois Pirus <jfp(a)clearfield.com> Clearfield Software Ltd Phone (+64-9) 358 2081 4th Floor 8-10 Whitaker Place Fax (+64-9) 358 2083 P O Box 2348 Auckland, New Zealand ------------------------------------------------------------------------

2 1

Route announcements on APE and WIX
by Andy Linton 10 Nov '03

10 Nov '03

Citylink are announcing the following networks on APE from AS23755: 202.7.4.0/24, 203.118.144.80/28 and on WIX from AS23755: 202.7.4.0/24 The 202.7.4.0/24 block will be used to host the webcam and MMS sites associated with the Lord of the Rings premiere during the period leading up to 1 December. Last year we moved around 600 Gbytes of data in the fortnight preceding the premiere and around 4 Tbytes on the day itself. To avoid a potentially higher traffic bill this year we are making arrangements to use anycast (for more details see http://www.isc.org/tn/isc-tn-2003-1.html) to make 202.7.4.0/24 available in three locations, North America, Auckland via the APE route servers and in Wellington via the WIX route servers. We will not be advertising this block via any of the ISPs who provide us with transit. If you are not peering locally in New Zealand and your users access this content they will retrieve it from servers in North America with potential overload of your international circuits. You should consider peering with the APE and/or WIX route servers and accepting these prefixes. In addition, the 203.118.144.80/28 network is used to host media content for NZOOM. While this traffic is available via IHUG, listening to this announcement will optimise your customer's experience.

2 1

Re: [nznog] Procedure for making an ISP take responsibility ?
by Ewen McNeill 06 Nov '03

06 Nov '03

In message <003601c3a4f2$449210d0$230515ac(a)JOVE>, "jfp" writes: >Obviously that ISP is not going to do anything, So: >- Permanently block said ISP to your linux box. That and/or properly patching/securing the Windows box would be my first two suggestions. Trying to get "hackers" shut down is a bit like wack a mole even at the best of times. >- I assume you are using ipchains on your linux box, I would recommend >upgrading to iptables which would mean not having to open incoming ports >above 1024 as the session tracking should take care of that. H.323 (and friends), as used by NetMeeting, etc, are rather difficult to firewall well, because it opens connections in arbitrary directions to arbitrary ports (as negotiated through a control channel) -- a bit like FTP, but worse. The control channel is encoded via ASN.1 (ie, binary) rather than being text like FTP. IMHO it's shameful that a "modern" protocol isn't designed for at least easy state tracking if not to work easily with outgoing-only firewalls and NAT boxes. There is an (experimental) H.323 tracking module for Linux iptables which can be downloaded and compiled up (from some of the netfilter development sites), but it's a bit of a hack. I've not tried it, but have read that it works reasonably well for a single H.323 endpoint behind the firewall. Alternatively application layer proxying may be more appropriate. GNU Gatekeeper, Open H.323 Proxy, Asterisk, etc, are capable of proxying H.323 sessions at the application level. Some of them (eg, Asterisk) are pretty much voice only (Asterisk is fundamentally PBX software which supports H.323 amongst other things), and some of them (eg, GNU Gatekeeper) will proxy video as well. Ewen

1 0

Max TNT Two IP Pools
by vashdev talk 06 Nov '03

06 Nov '03

Hi I have Two Dialin Number (UIN) for my two PRIs (E1). I want to assign different ip pool to different UIN Number. Can any one guide me how can i do this on Max TNT Vashdev http://www.malhinet.com --------------------------------- Do you Yahoo!? Protect your identity with Yahoo! Mail AddressGuard

1 0

Procedure for making an ISP take responsibility ?
by Tikiri Wicks 06 Nov '03

06 Nov '03

Hi Is there a procedure for forcing an ISP to take responsibility for hackers on their network ? I've got this one windows PC hidden behind a unix box. Ports above 1024 are forwarded from the Linux box to the windows box because of netmeeting and a few other things. This PC keeps getting hacked from a subscriber on an Israeli ISP. I've cleaned it 3 times now. Essentially the machine gets compromised with a hacktool and then opens a channel to the IP in Israel after which there is a continous stream at 40 kbps. Dialup modem speed perhaps ? I've emailed the ISP ( barak.net.il ) a couple times and get absolutely no response. Forum messages also indicate that this ISP does not respond to such messages. Norton Antivirus picks up a hack tool only when the pc is scanned but even then cannot identify it beyond stating that it is a hacktool. The filename is disguised as scan.exe in one of the winnt\installer folders If anyone is interested please email me off the list and I'll email you the packet logs. The following is the state of the afected PC when the firewall is not blocking traffic to 82-166-172-38.barak.net.il Example 1 winmgnt.exe:1200 TCP zoo:1337 82-166-172-38.barak.net.il:4241 ESTABLISHED winmgnt.exe:1200 TCP zoo:1336 82-166-172-38.barak.net.il:4273 TIME_WAIT winmgnt.exe:1200 TCP zoo:1336 82-166-172-38.barak.net.il:4276 ESTABLISHED winmgnt.exe:1200 TCP zoo:1337 zoo:0 LISTENING winmgnt.exe:1200 TCP zoo:43958 zoo:0 LISTENING Example 2 winmgnt.exe:1200 TCP zoo:1336 82-166-172-38.barak.net.il:2388 TIME_WAIT winmgnt.exe:1200 TCP zoo:1337 82-166-172-38.barak.net.il:2542 ESTABLISHED winmgnt.exe:1200 TCP zoo:1336 82-166-172-38.barak.net.il:2579 TIME_WAIT winmgnt.exe:1200 TCP zoo:1336 82-166-172-38.barak.net.il:2586 ESTABLISHED winmgnt.exe:1200 TCP zoo:1337 zoo:0 LISTENING winmgnt.exe:1200 TCP zoo:43958 zoo:0 LISTENING Once traffic to 82.166.172.38/24 is blocked then the trojan kept attempting a connection once every few seconds as follows System:8 TCP zoo:1337 82-166-172-38.barak.net.il:4530 SYN_RCVD 3 seconds later System:8 TCP zoo:1337 82-166-172-38.barak.net.il:4569 SYN_RCVD 3 seconds later System:8 TCP zoo:1337 82-166-172-38.barak.net.il:4607 SYN_RCVD 3 seconds later System:8 TCP zoo:1337 82-166-172-38.barak.net.il:4640 SYN_RCVD and so on.

3 2

RE: [nznog] Procedure for making an ISP take responsibility ?
by jfp 06 Nov '03

06 Nov '03

My 2 cents worth. Obviously that ISP is not going to do anything, So: - Permanently block said ISP to your linux box. - I assume you are using ipchains on your linux box, I would recommend upgrading to iptables which would mean not having to open incoming ports above 1024 as the session tracking should take care of that. jfp. ------------------------------------------------------------------------ Jean-Francois Pirus <jfp(a)clearfield.com> Clearfield Software Ltd Phone (+64-9) 358 2081 4th Floor 8-10 Whitaker Place Fax (+64-9) 358 2083 P O Box 2348 Auckland, New Zealand ------------------------------------------------------------------------

1 0

VPN with paq 5500 & pocket pc 2003
by Barry Murphy 05 Nov '03

05 Nov '03

Hi, This may be a bit off-topic but I thought someone on the list may have some idea on this. I've recently purchased an HP ipaq 5500 which comes with Pocket PC 2003 which has a VPN client built in. I'm trying to connect it to the VPN server but can't find the method of authentication it uses. All other windows clients can connect to the poptop VPN with no problem. HP Doesn't know & MS doesn't know where to direct my call to, I'm waiting for someone to call me back still. Server: enable MSCHAPv2 pap set mppe 128 stateless IPaq Client: Slip (Off by default) Software compression (tried with on & off) IP Header compression (tried with on & off) I guess my question is, what authentication method does the pocket pc 2003 use, does it support GRE? It connects but doesn't send any data. <snip from logs> Nov 6 11:08:35 ns pptpd[46749]: CTRL: PTY read or GRE write failed (pty,gre)=(6,5) Nov 6 11:08:35 ns pptpd[46749]: CTRL: Client 210.86.20.17 control connection finished Nov 6 11:08:35 ns ppp[46750]: Phase: deflink: Connect time: 16 secs: 0 octets in, 305 octets out Nov 6 11:08:35 ns ppp[46750]: Phase: deflink: 0 packets in, 5 packets out Nov 6 11:08:35 ns ppp[46750]: Phase: total 19 bytes/sec, peak 24 bytes/sec on Thu Nov 6 11:08:23 2003 </snip> <snip from logs for windows 2003> Nov 6 11:10:13 ns ppp[47125]: Phase: bundle: Authenticate Nov 6 11:10:13 ns ppp[47125]: Phase: deflink: his = none, mine = CHAP 0x81 Nov 6 11:10:13 ns ppp[47125]: Phase: Chap Output: CHALLENGE Nov 6 11:10:13 ns pptpd[47124]: CTRL: Ignored a SET LINK INFO packet with real ACCMs! Nov 6 11:10:13 ns ppp[47125]: Phase: Chap Input: RESPONSE (49 bytes from barry) Nov 6 11:10:13 ns ppp[47125]: Phase: Chap Output: SUCCESS </snip> Thanks Kindest Regards Barry Murphy

2 2

Joker nukes SPEWS
by Juha Saarinen 04 Nov '03

04 Nov '03

Domain ID:D74783489-LROR Domain Name:SPEWS.ORG Created On:07-Jul-2001 19:50:12 UTC Last Updated On:03-Nov-2003 15:44:43 UTC Expiration Date:07-Jul-2008 19:50:12 UTC Sponsoring Registrar:R25-LROR Status:INACTIVE Registrant ID:CORG-1195 Registrant Name:chip level domains Registrant Organization:Visit Lake Biakal! Registrant Street1:po box 61, Baikalsk-2 Registrant City:Irkutsk region, -- 665914 Registrant Postal Code:665914 Registrant Country:RU Registrant Phone:+7.3952348335 Registrant FAX:+7.3952348335 Registrant Email:chip(a)sendmail.ru Admin ID:CORG-58588 Admin Name:Sergei ''Chip'' Didorenko Admin Organization:Visit Lake Baikal! ~ http://baikal.irkutsk.org Admin Street1:po box 61, Baikalsk-2 Admin City:Irkutsk region Admin Postal Code:665914 Admin Country:RU Admin Phone:+7.3952348335 Admin Email:chip(a)sendmail.ru Billing ID:CORG-58588 Billing Name:Sergei ''Chip'' Didorenko Billing Organization:Visit Lake Baikal! ~ http://baikal.irkutsk.org Billing Street1:po box 61, Baikalsk-2 Billing City:Irkutsk region Billing Postal Code:665914 Billing Country:RU Billing Phone:+7.3952348335 Billing Email:chip(a)sendmail.ru Tech ID:CORG-58588 Tech Name:Sergei ''Chip'' Didorenko Tech Organization:Visit Lake Baikal! ~ http://baikal.irkutsk.org Tech Street1:po box 61, Baikalsk-2 Tech City:Irkutsk region Tech Postal Code:665914 Tech Country:RU Tech Phone:+7.3952348335 Tech Email:chip(a)sendmail.ru Name Server:INVALID-ADDRESS.JOKER.COM -- Juha

2 1

another phish
by David Miller 03 Nov '03

03 Nov '03

Hi Craig, If it's of interest to you, here's another example (forwarded separately.) This one's a Citibank phish - and where the westpac one was clearly sent direct, this one has a received line which would suggest that it was routed through a relay. I don't believe it. The relay, if that's what it was, appeared to be a student dorm at a french speaking university also in canada. The first received: line alleges to be from "pormexico.com", but the IP address belongs to Hewlett Packard according to whois. I think those URLs are kind of interesting. The citibank one references an IP address belonging in Korea (according to whois). The westpac one refers to at least a URL redirection service in russia (www.da.ru) and to something calling itself jablow.kir.jp, which on the face of it appears to be a legitimate site of some kind. I wonder if this is some kind of worm-like infestation, which would account for the broad number of connection attempts, IP addresses and the apparent lack of relays. A student dorm, a dial up/DSL address and an HP address seem like an unlikely real source for these things. Dave.

3 3

nsp-security
by Joe Abley 03 Nov '03

03 Nov '03

There is an invitation-only list run by Jared Mauch called nsp-security which has an extremely useful membership of enable-wielding ops people who never sleep. It's very useful for things like "I am under attack from address X.X.X.X which is in AS Y", infinitely more so than trying to get action from remote NOCs through the front door. https://puck.nether.net/mailman/listinfo/nsp-security It's a closed list, and you need to be recommended by people who are already on the list before your subscription will be approved. I'd be very happy to recommend anybody here who is interested (that I know). Note that nsp-sec isn't a conversational list; it's a terse, to-the-point, get-work-done list (unlike this one). Joe

1 0

Phishing expedition - Westpac heads-up!
by Andy Gardner 02 Nov '03

02 Nov '03

Had a friend who connect via ihug forward me an email - someone phishing for Westpac user ID's. They're blanket spamming it because he isn't even a Westpac customer. Might be an idea for all your ISP's to send out a warning message to your clients - good PR exercise. >> Reply-To: Westpac <verifyXX(a)westpac.com.nz> >> Sender: Westpac <verifyXX(a)westpac.com.nz> >> MIME-Version: 1.0 >> Content-Type: text/plain >> Content-Transfer-Encoding: 8bit >> >> Dear Westpac Bank Member, >> >> This email was sent by the Westpac server to verify your e-mail >> address. You must complete this process by clicking on the link >> below and entering in the small window your Westpac Banking >> Customer ID and Password. >> This is done for your protection --- because some of >> our members no longer have access to their email addresses and >> we must verify it. >> >> To verify your e-mail address and access your bank account, >> click on the link below. If nothing happens when you click on >> the link, copy and paste the link into the address bar of your >> web browser. >> >> >> http://www.westpac.com.nz:ac-XXXXXXXXXXXXXXXXXX(a)XXXXXXXXX.Da.rU/ >> ?XXXXXXXXXXX >> >> >> -------------------------------------------------- >> Thank you for using Westpac Bank! >> --------------------------------------------------

6 6

Re: [nznog] Phishing expedition - Westpac heads-up!
by Craig Whitmore 02 Nov '03

02 Nov '03

Yes I am seeing those emails as well: Nov 2 17:40:10 dbmail-mx3 sm-mta[26879]: hA24di60026879: ruleset=check_mail, arg1=<martin.williams(a)citibank.net>, relay=c-65-97-16-13.va.client2.attbi.com [65.97.16.13], reject=451 4.1.8 Domain of sender address martin.williams(a)citibank.net does not resolve Nov 3 13:41:28 dbmail-mx3 sm-mta[27391]: hA30ebfg027391: ruleset=check_mail, arg1=<martin.williams(a)citibank.net>, relay=adsl-66-120-247-125.dsl.lsan03.pacbell.net [66.120.247.125], reject=451 4.1.8 Domain of sender address martin.williams(a)citibank.net does not resolve (but not as many of them at all) Thanks Craig ----- Original Message ----- From: "Mark Piper" <Mark.Piper(a)nec.co.nz> To: "Craig Whitmore" <lennon(a)orcon.net.nz> Cc: <nznog(a)list.waikato.ac.nz> Sent: Monday, November 03, 2003 1:35 PM Subject: Re: [nznog] Phishing expedition - Westpac heads-up! > http://lists.insecure.org/lists/fulldisclosure/2003/Oct/1429.html > > Two more banks according to the above URL are having almost identical mailouts (citybank and natwest). >

1 0

The New Zealand Network Operators' Group
by Donald Neal 02 Nov '03

02 Nov '03

The New Zealand Network Operators' Group The New Zealand Network Operators' Group (NZNOG) has no king, president or formal membership. At present it consists of the subscribers to this mailing list, which anyone is free to join. A face-to-face gathering is to take place in Hamilton on January 29 and 30 2004, hosted by the WAND group. See http://www.nznog.org/ for more details, including the Call for Presenters. Also see http://thursdaynightcurry.com/about.html if you live in or near Wellington or Auckland. Operators' Contact List See http://www.usenet.net.nz/noc/ for operational contact details for most New Zealand ISP's. These are intended for use by other network operators rather than by most customers. Internet Exchanges See http://www.ape.net.nz/ for details of the Auckland Peering Exchange and those connected there, http://www.wix.net.nz/ for the Wellington Internet Exchange. About This Mailing List This list has around 550 addresses subscribed. You may only post to the list from a subscribed address. A number of people subscribe addresses which do not receive email purely to allow posting from them. The NZNOG mailing list is provided through a server at The University of Waikato, and is administered by an employee of Alcatel NZ Ltd. Neither of these organisations, nor the administrator, is responsible for its content. NZNOG Mailing List Acceptable Use Policy The NZNOG mailing list exists to provide a forum for the exchange of technical information and the discussion of implementation issues that require cooperation among New Zealand network service providers. In order to continue to provide a useful forum for discussion of relevant technical issues, users of the list are asked to respect the following guidelines. 1. Discussion will focus on Internet operational and technical issues. 2. Discussion related to meetings of network service providers is appropriate. 3. Discussion unrelated to these topics is not appropriate. 4. Postings to multiple mailing lists are discouraged. 5. Postings that include foul language, character assassination, and lack of respect for other participants are unacceptable. 6. Blatant product or service marketing is unacceptable. 7. Postings of a political, philosophical or legal nature are discouraged. 8. Postings to the list should be in ASCII or MIME encoded as text/plain. Attachments should not be sent to the list. To present a document, a suitable URL may be referred to. For documents of general interest, the use of proprietary file formats is discouraged. 9. Breaches of list etiquette should be dealt with privately with the offending list user, and should not result in complaints being sent to the list. 10. A person repeatedly breaching list etiquette shall receive warnings from the list administrator. A further breach after the second such warning within thirty days shall result in the offender being unsubscribed from the list. Other action may also be taken to block postings to the list by the offender. Any such unsubscription is to be immediately announced to the list. Mailing List Archives A full archive is available at http://list.waikato.ac.nz/archives/nznog/ Any message sent to the list will be archived and made available on the web automatically. Changes are not made to the archive on request, though the administrator remains happy to assist the Office of the Privacy Commissioner should any complaint be laid with that office. One way to search the archive is to use google and prefix your search with site:list.waikato.ac.nz . Subscribing to the List See http://list.waikato.ac.nz/mailman/listinfo/nznog to subscribe. Donald Neal NZNOG Mailing List Owner/Administrator/Muggins ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ------------------------------------------------------------------------------ ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ------------------------------------------------------------------------------

1 0

Strange BGP 'problem'
by Nathan Ward 01 Nov '03

01 Nov '03

At the risk of posting something on topic.. I have 2 routers (lets call them A and B), talking to different upstream providers, advertising 202.6.75.0/24 via BGP. 202.6.75.0/24 is subnetted, each subnet is on a different VLAN. These routers talk to each other with iBGP, giving each other everything (including 202.6.75.0/24 le 32). I run HSRP between the 2 routers. Router B prepends my ASN several times before advertising 202.6.75.0. Relevant stuff (on both boxes): router bgp 23729 network 202.6.75.0 no synchronization ! ip route 202.6.75.0 255.255.255.0 Null0 With this config, reachability for 202.6.75.0/24 hosts alternates on and off roughly every minute. 47% total loss over 10 minutes (ie 5 'bursts' of loss). These packets are all hitting my AS at router A. I've turned HSRP off and on again to see if that was causing problems (it wasn't). Several solutions I've found: - Turning the iBGP session to router B off. (uhh..) - Turning syncronization on. My understanding of BGP synchronization, is that BGP will only re-advertise with eBGP prefixes learned via iBGP after learning them via another IGP if one is running. <snip> ec-br-1(config-router)#do sh run | inc router router bgp 23729 bgp router-id 202.6.75.1 </snip> I'm not running any IGPs, so synchronization shouldn't be part of the equation. In any case, I'm not a transit provider. And, there seems to be no relation to readvertising routes here, the packets AFAICT are getting to router A and being dropped. I've got no problem running running with synchronization on at the moment, but thats not the point. :-) Any ideas/thoughts? -- Nathan Ward

3 3

RE: [nznog] Domain Names NZ scam
by Tim John - Domainz 01 Nov '03

01 Nov '03

Yep ! Had calls dribbling in here all morning ... The DNC is aware and I'm sure things will be taken up by her. Tim -----Original Message----- From: jfp [mailto:jfp(a)clearfield.com] Sent: Wednesday, 29 October 2003 10:42 a.m. To: nznog(a)list.waikato.ac.nz Subject: [nznog] Domain Names NZ scam Some of our customers have just received scam domain renewal letters from Domain Names NZ. ($237 for two years) (www.domainnamesnz.com) People might want to warn their customers. jfp. ------------------------------------------------------------------------ Jean-Francois Pirus <jfp(a)clearfield.com> Clearfield Software Ltd Phone (+64-9) 358 2081 4th Floor 8-10 Whitaker Place Fax (+64-9) 358 2083 P O Box 2348 Auckland, New Zealand ------------------------------------------------------------------------ _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog DISCLAIMER: The content of this email is confidential and may contain legally privileged information intended only for the individual or entity named above. Access to this message by anyone else is unauthorised. If you are not the intended recipient, please be advised that the use, distribution and publication of the above information is prohibited. If you have received this email in error, please contact Domainz by returning the email and destroying the original. Thank you.

9 10

RE: [nznog] Domain Names NZ scam
by Geoff Williams 31 Oct '03

31 Oct '03

We have been through this here on the other side of the creek. Some years ago when this guy first started this scam I actually spoke to him trying to recover money that a client had inadvertently paid. Even though the money had not been passed to the sole registrar of .au domains at that time (we had already paid for the domain's renewal) the most that we were able to threaten was a civil action for not refunding monies that had not been applied for the purpose that they were collected. He just didn't give a @#$% about it and continued on his merry way. Unfortunately the problem is that the person paying the money doesn't know enough about what the invoice means and also they don't read the thing in detail. The most success was had here when the registrar used the domain contacts list and emailed a warning to all domain owners. Perhaps your registrar should consider something similar. The warning is probably still on the site at www.inww.com if you need text. The other thing is to get it into the tabloid press, perhaps someone should approach some of your shock jocks to run the story. Maybe Holmes could turn it into a global news story :)) -----Original Message----- From: Tikiri Wicks [mailto:tcwicks(a)maxnet.co.nz] Sent: Saturday, 1 November 2003 3:21 PM To: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] Domain Names NZ scam Re: Domain Names NZ scam Just wondering is anyone on this list a lawyer I just got my second mail from these bastards. It's made out just like an invoice telling me to register my domain.net.nz Unauthorized use of the domain name registry for commercial solicitation perhaps ? New Zealand Privacy law perhaps ? Is there anything like class action lawsuits in New Zealand and Australia? ----- Original Message ----- From: "Juha Saarinen" <juha(a)saarinen.org> To: "Steven Heath" <sheath(a)paradise.net.nz> Cc: <nznog(a)list.waikato.ac.nz>; "'Matthew G Brown'" <Matt(a)Brh.Co.Nz> Sent: Thursday, October 30, 2003 3:09 PM Subject: Re: [nznog] Domain Names NZ scam > Steven Heath wrote: > > > In my opinion it is just more of the many scum aussie operators that just > > extend thier scams to include NZ. > > Was just informed that the AuDA and ACCC court proceedings against > Domain Names Pty Ltd will be heard on the 19th of next month. > > -- > Juha > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Spamcop.net DNS
by Peter Macaulay 31 Oct '03

31 Oct '03

Looks like someone has killed spamcop. Can anyone explain how this happened? I can't see their registrar (joker.com) doing it unless they have been conned. -- Peter Macaulay Executive Director InternetNZ Direct +64 4 495 2113

6 5

elevated icmp traffic
by Anton Smith 29 Oct '03

29 Oct '03

Hi guys, Was just wondering if anyone else has been experiencing a lot of icmp traffic (pings) lately, seems to a lot of pinging of entire ranges going on. Another new worm or the left overs from the last lot? Regards, Anton Smith nzwireless Ltd

2 1

RE: [nznog] New and unacknowledged Exchange / Win2k SMTPvulnerability?
by Geoff Williams 28 Oct '03

28 Oct '03

Right, but due to no SMTP AUTH logging in Exchange 2000, we cannot easily track any attempt to intrude using the brute force password crack method. We only get to see badmail folders filling up and so on. Additionaly we cannot see exactly which account's password has been compromised. A more comprehensive anti-relay option which checked for the existence of the recipient and/or sender in Active Directory, as this ORF thing does, would be beneficial in future releases. I haven't seen Exchange 2003 yet so can't comment on whether it has any such functionality. Regards Geoff Williams -----Original Message----- From: Nathan Mercer [mailto:nmercer(a)microsoft.com] Sent: Wednesday, 29 October 2003 10:27 AM To: Geoff Williams; nznog(a)list.waikato.ac.nz Subject: RE: [nznog] New and unacknowledged Exchange / Win2k SMTPvulnerability? So just to be clear, a new and unacknowledged Exchange or Windows 2000 vulnerability has not been discovered here right? We want to know about vulnerabilities (not mis-configurations) If you do wish to report a suspected security vulnerability please either contact myself directly, log the details on https://s.microsoft.com/technet/security/bulletin/alertus.asp or email secure(a)microsoft.com (PGP key is on https://s.microsoft.com/technet/security/MSRC.asc ) Details of our vulnerability handling processes are on http://microsoft.com/technet/security/bulletin/msrpracs.asp Regards Nathan Technology Specialist Microsoft NZ _____ From: Geoff Williams [mailto:geoff(a)katnet.com.au] Sent: Tuesday, 28 October 2003 11:26 a.m. To: nznog(a)list.waikato.ac.nz Subject: FW: [nznog] New and unacknowledged Exchange / Win2k SMTPvulnerability? Further to my earlier post, Neil G has pointed me correctly to an SMTP AUTH attack. I have used the logs of the ORF tool to pinpoint which accounts have been compromised. Strangely the spammers are trying to work out why, even if they authenticate, they can't relay, so there is a lot of traffic to watch and learn from. A large number of their connections are being blocked by the IP blacklists I have selected. I had originally blocked 2 Class A IP ranges at our router after watching the traffic and finding that they were allocated to a provider in China. But I am not 100% sure that IP addresses are not being spoofed as they seem to have a huge range of Class A and B addresses available to them and I was really chasing my tail trying to block them at that level. So now I have a new password generator and will start training the mind to work with 12 or more character passwords. Hope this is of assistance to others. Geoff Williams -----Original Message----- From: Geoff Williams Sent: Monday, 27 October 2003 11:01 PM To: nznog(a)list.waikato.ac.nz Subject: [nznog] New and unacknowledged Exchange / Win2k SMTP vulnerability? Hi All I have exactly the same open-relay problem, including the sending servers and addresses, and have been struggling to diagnose for a few weeks. I had a hunch that the hack may involve the SystemMailbox account (which of course is disabled), but this was based on checking security logs and seeing who was logged in at the same time as the spam was dumped into the queue. I have got around it for the moment (I hope) by loading the ORF relay and spam tool but I would really like to know how this hack is being perpetrated as I have a whole stack of other Exchange servers to look after and I really don't want this to get out of control... So if anyone has made any progress I would really appreciated you sharing your experience. Thanks ______________ Geoffrey Williams KAT International T: 02 9904 3137 F: 02 9904 0232 M: 0417 281 905 _____ size=2 width="100%" align=center> This email is confidential and intended for the recipient only. If you have received it in error please delete it immediately.

1 0