- NZNOG - lists.nznog.org

CLEAR Net Tempest
by Neil 12 Aug '01

12 Aug '01

Hi All, Has anyone else had any problems with Clear's 802.11 wireless internet service (http://www.clear.net.nz/services/tempest.html) as a source of interference? They have just done a rollout in Rotorua and totally stoped 3 separate wireless networks that had been running together nicely for the past year or two. Clear have told me that Rotorua is the only place that this has happened in and are being very slow to do anything about it so if this has happened to you could you let me know. Neil Fincham Integral LTD.

2 1

NZNOG List Change Now Effective
by Donald Neal 12 Aug '01

12 Aug '01

NZNOG People, Postings for the NZNOG list should now be accepted only from addresses subscribed to one of the following lists: nznog - this list nznog-digest - the digest version of this list nznog-postonly - a list which exists only to allow addresses subscribed to it to post to the nznog list. Messages will not normally be sent to addresses subscibed to nznog-postonly. To subscribe new addresses to one or more of these lists, send email to majordomo(a)list.waikato.ac.nz where each line of the body of the message has the form subscribe <list name> to subscribe the address from which that message is being sent, or subscribe <list name> <address> to subscribe a different address. More than one subscription request may be sent in the same message. Donald Neal List Administrator --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: CLEAR Net Tempest
by Neil 12 Aug '01

12 Aug '01

Hi all, Sorry about the Spam, I have the displeasure of being on the end of one of these links (the mail client did not get the signoff from the smtp server so it tried again). Neil Fincham Integral LTD ----- Original Message ----- From: Olderon To: Neil Sent: Monday, August 13, 2001 4:47 PM Subject: Re: CLEAR Net Tempest is there something wrong with your mail? youve sent that same email 4times. 4:23 4:28 4:29 4:36 ----- Original Message ----- From: Neil To: nznog(a)list.waikato.ac.nz Sent: Monday, August 13, 2001 4:18 PM Subject: CLEAR Net Tempest Hi All, Has anyone else had any problems with Clear's 802.11 wireless internet service (http://www.clear.net.nz/services/tempest.html) as a source of interference? They have just done a rollout in Rotorua and totally stoped 3 separate wireless networks that had been running together nicely for the past year or two. Clear have told me that Rotorua is the only place that this has happened in and are being very slow to do anything about it so if this has happened to you could you let me know. Neil Fincham Integral LTD.

1 0

CLEAR Net Tempest
by Neil 12 Aug '01

12 Aug '01

Hi All, Has anyone else had any problems with Clear's 802.11 wireless internet service (http://www.clear.net.nz/services/tempest.html) as a source of interference? They have just done a rollout in Rotorua and totally stoped 3 separate wireless networks that had been running together nicely for the past year or two. Clear have told me that Rotorua is the only place that this has happened in and are being very slow to do anything about it so if this has happened to you could you let me know. Neil Fincham Integral LTD.

1 0

CLEAR Net Tempest
by Neil 12 Aug '01

12 Aug '01

Hi All, Has anyone else had any problems with Clear's 802.11 wireless internet service (http://www.clear.net.nz/services/tempest.html) as a source of interference? They have just done a rollout in Rotorua and totally stoped 3 separate wireless networks that had been running together nicely for the past year or two. Clear have told me that Rotorua is the only place that this has happened in and are being very slow to do anything about it so if this has happened to you could you let me know. Neil Fincham Integral LTD.

1 0

Code red logging
by Simon Byrnand 12 Aug '01

12 Aug '01

Thought those of you playing Code Red Detective may find the following URL of some use :) http://salfter.dyndns.org/codered.shtml Regards, Simon --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 3

Abuse@xtra.co.nz now guilty of abuse?
by PhoneNet 11 Aug '01

11 Aug '01

If anyone at Xtra is reading this list please get them to fix the autoresponder for messages to abuse(a)xtra.co.nz... I've now had 5 identical replies over a period of 3 days to my complaint re spam.... Perhaps they think they are supposed to be the abusers? Ian Cousins PhoneNet --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Fwd: Code red infected customers
by Steve Phillips 10 Aug '01

10 Aug '01

FYI, these are the IP's I've collected to date that are in the NZ domain, some of these will be on dynamic dialup accounts, if you would like the actual log entries which should include times they were online let me know, i'll probably clear off the log files and restart the collection at a later date as the time on the server was out by an hour <self fwap> >Date: Sat, 11 Aug 2001 18:57:54 +1200 >From: root <root(a)hangover.nz.asiaonline.net> >To: steve(a)nz.asiaonline.net >Subject: Code red infected customers > >Code Red Infected customers on our network trying to infect remote sites.. > > >202.154.128.18 : 18.128.154.202.IN-ADDR.ARPA domain name pointer >ak-d18.connections.net.nz >202.180.111.174 : 174.111.180.202.IN-ADDR.ARPA domain name pointer >202-180-111-174.nas3.chc.attica.net.nz >202.180.111.18 : 18.111.180.202.IN-ADDR.ARPA domain name pointer >202-180-111-18.nas3.chc.attica.net.nz >202.180.111.77 : 77.111.180.202.IN-ADDR.ARPA domain name pointer >202-180-111-77.nas3.chc.attica.net.nz >202.180.111.95 : 95.111.180.202.IN-ADDR.ARPA domain name pointer >202-180-111-95.nas3.chc.attica.net.nz >202.180.68.127 : 127.68.180.202.IN-ADDR.ARPA domain name pointer >202-180-68-127.nas1.wgn.attica.net.nz >202.180.68.40 : 40.68.180.202.IN-ADDR.ARPA domain name pointer >202-180-68-40.nas1.wgn.attica.net.nz >202.180.69.248 : 248.69.180.202.IN-ADDR.ARPA domain name pointer >202-180-69-248.ipn1.attica.net.nz >202.180.71.36 : 36.71.180.202.IN-ADDR.ARPA domain name pointer >202-180-71-36.nas4.akl.attica.net.nz >202.180.90.163 : 163.90.180.202.IN-ADDR.ARPA domain name pointer >202-180-90-163.nas7.akl.attica.net.nz >202.37.167.38 : 38.167.37.202.IN-ADDR.ARPA domain name pointer >nwp-38.world-net.co.nz >202.37.68.193 : 193.68.37.202.IN-ADDR.ARPA domain name pointer >nw3-193.world-net.co.nz >202.49.144.221 : 221.144.49.202.IN-ADDR.ARPA domain name pointer >storefrontmail.viatx.com >202.49.144.225 : 225.144.49.202.IN-ADDR.ARPA domain name pointer >stage.viatx.com >202.50.111.114 : >202.50.111.91 : >202.50.111.97 : >203.109.193.163 : 163.193.109.203.IN-ADDR.ARPA domain name pointer >203-109-193-163.ihug.net >203.109.203.103 : 103.203.109.203.IN-ADDR.ARPA domain name pointer >203-109-203-103.nzl.ihugultra.co.nz >203.167.132.64 : 64.132.167.203.IN-ADDR.ARPA domain name pointer >203-167-132-64.dialup.clear.net.nz >203.167.161.144 : 144.161.167.203.IN-ADDR.ARPA domain name pointer >203-167-161-144.dialup.clear.net.nz >203.167.164.208 : 208.164.167.203.IN-ADDR.ARPA domain name pointer >203-167-164-208.dialup.clear.net.nz >203.167.166.71 : 71.166.167.203.IN-ADDR.ARPA domain name pointer >203-167-166-71.dialup.clear.net.nz >203.167.171.155 : 155.171.167.203.IN-ADDR.ARPA domain name pointer >203-167-171-155.dialup.clear.net.nz >203.167.214.50 : >203.167.247.214 : 214.247.167.203.IN-ADDR.ARPA domain name pointer >cf4-acld.auckland.clix.net.nz >203.167.254.136 : 136.254.167.203.IN-ADDR.ARPA domain name pointer >napr-m36.dialup.inhb.co.nz >203.79.102.72 : 72.102.79.203.IN-ADDR.ARPA domain name pointer >203-79-102-72.tnt14.paradise.net.nz >203.79.103.179 : 179.103.79.203.IN-ADDR.ARPA domain name pointer >203-79-103-179.tnt14.paradise.net.nz >203.96.106.59 : 59.106.96.203.IN-ADDR.ARPA domain name pointer >203-96-106-59.dialup.xtra.co.nz >203.96.110.172 : 172.110.96.203.IN-ADDR.ARPA domain name pointer >203-96-110-172.dialup.xtra.co.nz >203.96.110.66 : 66.110.96.203.IN-ADDR.ARPA domain name pointer >203-96-110-66.dialup.xtra.co.nz >203.96.62.201 : 201.62.96.203.IN-ADDR.ARPA domain name pointer >203-96-62-201-tollfree.actrix.co.nz >203.96.62.53 : 53.62.96.203.IN-ADDR.ARPA domain name pointer >203-96-62-53-tollfree.actrix.co.nz >203.97.85.108 : 108.85.97.203.IN-ADDR.ARPA domain name pointer >a004-m001-u108.chch.clear.net.nz >210.48.102.170 : 170.102.48.210.IN-ADDR.ARPA domain name pointer >ip-210-48-102-170.iconz.net.nz >210.48.103.150 : 150.103.48.210.IN-ADDR.ARPA domain name pointer >ip-210-48-103-150.iconz.net.nz >210.48.103.4 : 4.103.48.210.IN-ADDR.ARPA domain name pointer >ip-210-48-103-4.iconz.net.nz >210.48.81.19 : 19.81.48.210.IN-ADDR.ARPA domain name pointer >p19.pool1.staticadsl.iconz.net.nz >210.54.121.65 : 65.121.54.210.IN-ADDR.ARPA domain name pointer >210-54-121-65.adsl.xtra.co.nz >210.54.199.115 : 115.199.54.210.IN-ADDR.ARPA domain name pointer >210-54-199-115.dialup.xtra.co.nz >210.54.201.186 : 186.201.54.210.IN-ADDR.ARPA domain name pointer >210-54-201-186.dialup.xtra.co.nz >210.54.201.49 : 49.201.54.210.IN-ADDR.ARPA domain name pointer >210-54-201-49.dialup.xtra.co.nz >210.54.217.216 : 216.217.54.210.IN-ADDR.ARPA domain name pointer >ppp-15.satlan.co.nz >210.54.221.186 : 186.221.54.210.IN-ADDR.ARPA domain name pointer >210-54-221-186.ipnets.xtra.co.nz >210.54.221.194 : 194.221.54.210.IN-ADDR.ARPA domain name pointer >210-54-221-194.ipnets.xtra.co.nz >210.54.224.235 : 235.224.54.210.IN-ADDR.ARPA domain name pointer >210-54-224-235.adsl.xtra.co.nz >210.54.229.174 : 174.229.54.210.IN-ADDR.ARPA domain name pointer >210-54-229-174.dialup.xtra.co.nz >210.54.233.174 : 174.233.54.210.IN-ADDR.ARPA domain name pointer >210-54-233-174.adsl.xtra.co.nz >210.54.242.194 : 194.242.54.210.IN-ADDR.ARPA domain name pointer >210-54-242-194.adsl.xtra.co.nz >210.54.247.251 : 251.247.54.210.IN-ADDR.ARPA domain name pointer >smtp.carolineeve.co.nz >210.54.254.97 : 97.254.54.210.IN-ADDR.ARPA domain name pointer >210-54-254-97.adsl.xtra.co.nz >210.54.76.237 : 237.76.54.210.IN-ADDR.ARPA domain name pointer >210-54-76-237.dialup.xtra.co.nz >210.54.77.98 : 98.77.54.210.IN-ADDR.ARPA domain name pointer >210-54-77-98.dialup.xtra.co.nz >210.54.80.49 : 49.80.54.210.IN-ADDR.ARPA domain name pointer >210-54-80-49.adsl.xtra.co.nz >210.54.80.78 : 78.80.54.210.IN-ADDR.ARPA domain name pointer >210-54-80-78.adsl.xtra.co.nz >210.54.8.148 : >210.54.83.179 : 179.83.54.210.IN-ADDR.ARPA domain name pointer >210-54-83-179.adsl.xtra.co.nz >210.54.84.137 : 137.84.54.210.IN-ADDR.ARPA domain name pointer >210-54-84-137.adsl.xtra.co.nz >210.54.84.211 : 211.84.54.210.IN-ADDR.ARPA domain name pointer >210-54-84-211.adsl.xtra.co.nz >210.54.89.14 : 14.89.54.210.IN-ADDR.ARPA domain name pointer >smtp.insteplimited.com >14.89.54.210.IN-ADDR.ARPA domain name pointer smtp.hanmerinstitute.com >210.54.98.43 : 43.98.54.210.IN-ADDR.ARPA domain name pointer >210-54-98-43.dialup.xtra.co.nz >210.54.99.167 : 167.99.54.210.IN-ADDR.ARPA domain name pointer >210-54-99-167.dialup.xtra.co.nz >210.55.103.213 : 213.103.55.210.IN-ADDR.ARPA domain name pointer >port55-103-213.jetstart.win.co.nz >210.55.106.10 : 10.106.55.210.IN-ADDR.ARPA domain name pointer >ip210-55-106-10.ip.maxnet.co.nz >210.55.106.136 : 136.106.55.210.IN-ADDR.ARPA domain name pointer >ip210-55-106-136.ip.maxnet.co.nz >210.55.123.35 : 35.123.55.210.IN-ADDR.ARPA domain name pointer >210-55-123-35.dialup.xtra.co.nz >210.55.146.39 : 39.146.55.210.IN-ADDR.ARPA domain name pointer >210-55-146-39.dialup.xtra.co.nz >210.55.146.83 : 83.146.55.210.IN-ADDR.ARPA domain name pointer >210-55-146-83.dialup.xtra.co.nz >210.55.159.221 : 221.159.55.210.IN-ADDR.ARPA domain name pointer >210-55-159-221.ipnets.xtra.co.nz >210.55.159.222 : 222.159.55.210.IN-ADDR.ARPA domain name pointer >210-55-159-222.ipnets.xtra.co.nz >210.55.178.166 : 166.178.55.210.IN-ADDR.ARPA domain name pointer >210-55-178-166.dialup.xtra.co.nz >210.55.228.173 : 173.228.55.210.IN-ADDR.ARPA domain name pointer >adsl-173.world-net.co.nz >210.55.57.45 : 45.57.55.210.IN-ADDR.ARPA domain name pointer >210-55-57-45.adsl.xtra.co.nz >210.55.9.105 : >210.86.24.203 : 203.24.86.210.IN-ADDR.ARPA domain name pointer >210-86-24-203.adsl.xtra.co.nz >210.86.24.254 : 254.24.86.210.IN-ADDR.ARPA domain name pointer >210-86-24-254.adsl.xtra.co.nz >210.86.25.142 : 142.25.86.210.IN-ADDR.ARPA domain name pointer >210-86-25-142.adsl.xtra.co.nz > >Total customers Code Red infected so far counted at : 79 -- Steve Systems Admin, Asia Online (NZ) --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Code Red errata
by Brodie Davis 09 Aug '01

09 Aug '01

Has any one else noticed a big drop of traffic related to this. my stats for this week have been so far (pretty low.. but as i only have 2 world viewable port 80's) Monday : 37 (ids was playing up so only partial records) Tuesday : 599 Wednesyday : 511 Today (from 8am) : nill I am just wondering is this the norm.. or I am just lucky. (or has AoL started filting this now?) Cheers, Brodie --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

9 10

Vote Result and NZNOG List Changes
by Donald Neal 09 Aug '01

09 Aug '01

NZNOG People, Voting has now closed on the following proposed addition to this list's acceptable use policy: 10. A person repeatedly breaching list etiquette shall receive warnings from the list administrator. A further breach after the second such warning within thirty days shall result in the offender being unsubscribed from the list. Other action may also be taken to block postings to the list by the offender. Any such unsubscription is to be immediately announced to the list. A total of seventy votes were recieved, with all votes cast in favour of the change. This change is therefore now in effect. During the afternoon of Monday, 13 August, I intend to change the nznog list's settings so that postings will be accepted only from addresses subscribed to one of the following lists: nznog - this list nznog-digest - the digest version of this list nznog-postonly - a new list which exists only to allow addresses subscribed to it to post to the nznog list. Messages will not normally be sent to addresses subscibed to nznog-postonly. To subscribe new addresses to one or more of these lists, send email to majordomo(a)list.waikato.ac.nz where each line of the body of the message has the form subscribe <list name> to subscribe the address from which that message is being sent, or subscribe <list name> <address> to subscribe a different address. More than one subscription request may be sent in the same message. Donald Neal List Administrator --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Given the current topic of discussion in here...
by Chris Rigby 09 Aug '01

09 Aug '01

I though this slashdot article might be on interest. http://slashdot.org/articles/01/08/09/1758200.shtml Chris Rigby Senior Systems Engineer IHUG - Into the Internet --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

[OT] 802.11 and stuff
by James Tyson 08 Aug '01

08 Aug '01

Hi all Just a couple of quick questions to you folks that know so much about 802.11. Firstly, do I really need a base station? I have my new ibook here and I want to grab the airport card to use with the Cisco Aironet base station at work, but I was thinking is it possible to just throw an orinoco card or something in my Linux box gateway and use that in place of a base station while I am at home? If not, does anyone know of any base stations in the sub $500 range that work reasonably? I am not really that worried about WEP and SSID while I am at home, because I will set my DHCP server up to only assign my card an IP address and use an encrypted tunnel to get to the net. Cheers. James Tyson --- Samizdat New Media Solutions --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

8 9

Looking for DialUp RAS Equipment
by Craig Whitmore 08 Aug '01

08 Aug '01

Has anyone got any Spare RAS Equipment they are willing to sell Such as: Cisco 5200/5300/5800 etc (Or Modem Cards to put in them) USR/3Com TotalControl Equipment (or any Cards for the Chassis such as netserver/Quads etc) Shiva LANRover (Whole thing or Spare Modems etc) Max Ascend 4000/6000/3000/TNT? Anything else that will take R2's and work reasonable. If you have any of the above please let me know with estimated price for Sale. Thanks Craig Whitmore Orcon Internet http://www.orcon.net.nz

2 1

Re: Code Red errata
by Steve Phillips 08 Aug '01

08 Aug '01

At 11:20 9/08/2001, James McGlinn wrote: >Is it possible to filter on part of the shell code payload? At least one >CR variant doesn't request default.ida - rendering it useless (I assume), >but that should let you see those hits, and allow genuine default.ida >requests through... yep, the way the filter works is you can enter any string up to 32 characters in length, I used default.ida as it was easier to type, once i had it working and had tested it I was going to parse it on the shell code string :) -- Steve Systems Admin, Asia Online (NZ) --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Proposed Change to Acceptable Use Policy
by Donald Neal 08 Aug '01

08 Aug '01

NZNOG People, Voting is now under way on the following proposed addition to the list''s acceptable use policy. 10. A person repeatedly breaching list etiquette shall receive warnings from the list administrator. A further breach after the second such warning within thirty days shall result in the offender being unsubscribed from the list. Other action may also be taken to block postings to the list by the offender. Any such unsubscription is to be immediately announced to the list. Votes on this change to me (not the list!) by midday tomorrow, Friday 10 August, please. I have so far received fifty-eight votes, and have acknowledged all of them. If you have not received email saying your vote has been recorded, it is not likely that it has been recorded. My access to email between now and some time tomorrow morning may be little variable, as I am engaged in moving offices. This is therefore likely to be the last reminder of the vote. If the change is approved, I intend to make the changes necessary to restrict posting to pre-submitted addresses only on Monday, 13 August. Donald Neal List Administrator --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Proposed Change to Acceptable Use Policy
by Donald Neal 07 Aug '01

07 Aug '01

NZNOG People, Voting is now under way on the following proposed addition to the list''s acceptable use policy. 10. A person repeatedly breaching list etiquette shall receive warnings from the list administrator. A further breach after the second such warning within thirty days shall result in the offender being unsubscribed from the list. Other action may also be taken to block postings to the list by the offender. Any such unsubscription is to be immediately announced to the list. Votes on this change to me (not the list!) by midday, Friday 10 August, please. I have so far received thirty votes, and have acknowledged all of them. If you have not received email saying your vote has been recorded, it is not likely that it has been recorded. Donald Neal List Administrator -- Donald Neal Mobility & Calling Platforms Network Delivery Telecom New Zealand Ltd --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

spammer
by Michael Coates 07 Aug '01

07 Aug '01

Hello Is there a list in NZ I can get a spammer put onto to block them from sending emails with viruses attached? Thanks

3 2

Code Red Stats
by Craig Whitmore 07 Aug '01

07 Aug '01

I've been running a running couter of hits on 1 machine take logs from 500 IP addresses's (2 C Classes). Its Hits/sec has gone up from yesterday from about 3.4->6.9 and growing fast :-( Total Seconds = 8878 Total Unique Machines Infected = 6380 Total Hits = 51169 Total Hits/Sec = 6.89 Also I have it emailing the owners of the Unique IP addresses (automaticlly) (with an ugly script) and telling that their machines are infected and so far have had many happy people repling thanking me. (But the Number of infected machines still increases :-( ) This is only from 2 C Class Addresses.. I can't imagine how many hits/sec NZ is getting in Total from Overseas.. There have only been a few infected machines from inside NZ (mostly from Xtra and WorldNet Dialups) Thanks Craig Whitmore Orcon Internet http://www.orcon.net.nz

1 0

TCP Header Definition help request "Window"
by Mike Sutton [ awacs ] 07 Aug '01

07 Aug '01

TCP Header Could an expert tell me "how" the "window" value is generated and "what" explicitly it means... Appreciate your help as my reference books don't help and I have not been able to locate a precise definition on the Net. Michael Sutton --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 7

root.exe
by Dylan Reeve 07 Aug '01

07 Aug '01

Any ISPs had a look through their proxy logs for "root.exe" or "cmd.exe" so far? I bet there will be a few... Going to go after people for 'hacking'? -- Dylan Reeve - dylan(a)wibble.net "Um, yeah." --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Code Red: NZ vs Canada
by Dan Langille 07 Aug '01

07 Aug '01

I can give you two lots of stats, one from a NZ server, the other from a Canada server: http://www.langille.org/stats-red-worm/ - in Wellington http://www.freebsddiary.org/stats-red-worm/ - in Ottawa Both are updated every 30 minutes, 15 minutes after and after the hour. -- Dan Langille pgpkey - finger dan(a)unixathome.org | http://unixathome.org/finger.php --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 5

Whazzup w/ Ihug?
by Juha Saarinen 06 Aug '01

06 Aug '01

http://www.internettrafficreport.com/cgi-bin/tr_chartpage.pl?203.98.56.1 70 -- Juha Saarinen --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 5

Re: Code Red Weirdness
by Mark Foster 06 Aug '01

06 Aug '01

[Tue Aug 7 13:56:39 2001] [error] [client 203.199.60.10] Invalid URI in request XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u 8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0 Ive had just one today, in the last half hour. None prior to that Did someone try to write a variant and screw up or maybe one of the infectees got weird? At 13:58 7/08/2001 +1200, you wrote: >[Tue Aug 7 13:57:14 2001] [error] [client 203.228.144.15] Invalid URI in >request >XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a >HTTP/1.0 > >Just started getting these. no default.ida?. > >Has the worm turned, again? > > >Tim J. Shackleton ------------------+ +- Business http://www.netlink.co.nz/ >Networks Admin/Programmer ----------+ +- Personal http://www.netnet.net.nz/ >Netlink LTD -- DDI +64 4 922 8476 --+ +------------- Pager 64 +26 253 4356 >+64 29 650 476 -- Cellular ---------+ +------------------------------------ >---- "Cold silence has a tendency to atrophy any sense of compassion" ----- > >--------- >To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz >where the body of your message reads: >unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 4

Code Red Stats
by Neil 06 Aug '01

06 Aug '01

Hi All, After about 30 second's of thinking about how to get rrdtool or mrgt to display what Code Red is up to on my server I decided to use webalizer instead. It defiantly gives you a better view on what is going on, have a look at http://203.97.86.130/codered/usage_200108.html . I have put the script in the cron.hourly directory so check back as often as you like. Neil Fincham Integral LTD.

6 8

Re: Code Red - Network Impact?
by Mark Davies 06 Aug '01

06 Aug '01

From: "Barry Raveendran Greene" <bgreene(a)cisco.com> Date: Mon, 6 Aug 2001 05:18:53 -0700 > Is anyone seeing router impact caused by all the bogus queries sent out by > Code Red? Just wondering if there could be some side effects. We had the cpu running at 100% on our border router till we tuned the access-lists to deal with traffic to port 80 early. cheers mark --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 2

Internet issues for discussion at APEC TEL24
by Frank March 06 Aug '01

06 Aug '01

I have previously posted information about APEC TEL24 to this list inviting people to join the NZ delegation. As a reminder: the meeting will take place 19-21 September in Jeju, Korea. It will be preceeded by two days (17,18 September) of workshops on various areas. I will be there for all five days. Details at http://www.apectel24.org/. Please feel free to pass the contents of this email on to anyone you think may be interested. One workshop area is 'Internet issues'. The first draft of the programme is as follows. I invite anyone to send to me **(off-line)** comments about any of the matters mentioned. Note that this was the first forum to raise the issue of international Internet charging (and that matter is still hanging around). There is an invitation to comment on agenda matters and I will probably take that up in 10 days or so. >From the organisers..... "The Workshop will consist of two parts. The FIRST part will consist of three presentations (20 minutes each) about the following topics: 1.- Presentation about the Current State of the Debate on Internet Issues. 2.- Presentation about the development of traffic flows within and between Latin American countries and other regions. 3.- Presentation about the situation of small ISP's in the Asia-Pacific region. The SECOND part will consist of an open-floor moderated discussion between the delegates. We suggest the following topics. Please we will appreciate if you could indicate your first three issues of more interest: 1.- APEC Contribution to promoting Internet access in the Asia-Pacific Region 2.- Traffic Exchange Models (Current and Next Generation) How is Internet traffic exchanged? What financial mechanisms are in place for the exchange of Internet traffic and how are they encouraging Internet development? What are the trends in content location and how do these factors influence Internet traffic patterns and financial arrangements? 3.- Global Capacity Availability and Trading What are the recent developments in large-scale bandwidth provision? What are the recent developments in retail internet service provision? How do global capacity relate to Internet traffic exchange? 4.- Local Internet Interconnection What are the main principles of the new interconnection frameworks? How much progress has been made in developing interconnection frameworks appropriate to the exchange of Internet traffic? 5.- Role for Regulators Is there a role for regulators? What are the policy implications for some of the directions Internet traffic exchange will take with next generation Internet architecture? 6.- Users Needs How do users view current developments in Internet traffic exchange? How does the financial community view the current state of play? User Needs - IP-based services and content providers. 7.- WTO What is the current state of the debate? How negotiating frameworks from different countries compare? What is the treatment of Internet services in the negotiating frameworks? 8.- Internet Connectivity What policy and regulatory reforms are required to stimulate Internet development and address the international digital divide? What regulatory barriers exist to the development of the Internet including infrastructures such as international connectivity, domestic teledensity and Internet exchange points? How can economies maximise the benefits of their Internet development including lower costs for infrastructure service? (development funds) 9.- Costs and Prices What is going to replace the international settlements system in the new environment? How are countries adapting to the changes in settlement rates? 10.- Quality Voice over IP " Frank March Specialist Advisor, IT Policy Group Ministry of Economic Development, PO Box 1473, Wellington, NZ Ph: (+64 4) 474 2908; Fax: (+64 4) 471 2658 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Re: Code Red - Network Impact?
by Mark Davies 06 Aug '01

06 Aug '01

From: Chris Wedgwood <cw(a)f00f.org> Date: Tue, 7 Aug 2001 11:15:46 +1200 > What IOS version? Are you running compiled ACLs? Don't know, no. Its not actually my box I just get to look at it occasionally when they have issues. > That seems to help a > fair bit if your CPU bound due to access-list activity. I just looked up the docs on compiled access-lists and the reference I found implied that they were only available on 7200's and bigger boxes. > Also, you can > try "show access-list blah" and reorder the most frequent terms to > nearer the top. I've cleaned the lists up several times in the past (as well as they could be) but they keep adding more ugliness to them. cheers mark --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Code Red - Network Impact?
by Barry Raveendran Greene 06 Aug '01

06 Aug '01

Hi Folks, Is anyone seeing router impact caused by all the bogus queries sent out by Code Red? Just wondering if there could be some side effects. Barry --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 5

Re: Code Red - Network Impact?
by Mark Davies 06 Aug '01

06 Aug '01

From: Chris Wedgwood <cw(a)f00f.org> Date: Tue, 7 Aug 2001 10:46:27 +1200 > On Tue, Aug 07, 2001 at 10:36:51AM +1200, Mark Davies wrote: > We had the cpu running at 100% on our border router till we tuned > the access-lists to deal with traffic to port 80 early. > Ouch... what kind of router? Where was all the CPU being spent? A cisco 2600 with a rather ugly set of access-lists having to deal with the probes for an entire Class B net. I was somewhat surprised that it couldn't deal with it as it was only about 100 probes a second (this was last Friday). Tweaking the access-lists got the load down to about 40-50%. cheers mark --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: Code Red V3!?
by Lindsay Druett 06 Aug '01

06 Aug '01

You must be a Bob Jones Fan.... "Location, location, location...." Those poor souls that are topologically near NT servers that have been infected are getting hammered :/ If you're getting hammered, you live in a bad neighbourhood, time to cleanup or move :) --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: NZIX is gone!
by Rob Edkins 06 Aug '01

06 Aug '01

Arron wrote: > Them were the glory days ... New Zealand's routing table in IGRP (no not EIGRP), 24 routers connected via Coax and a 1.5Mbps Frame Relay link to the US.< ...and you tell the kids today that, and they doooooon't believe yer! ;-) Rob __________________________________________________ Do You Yahoo!? Make international calls for as low as $.04/minute with Yahoo! Messenger http://phonecard.yahoo.com/ --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

NZIX is gone !!!
by Lindsay Druett 05 Aug '01

05 Aug '01

Hi, As of 10:45am this morning the last router (HNCR1) was turned off, and by 11:45am NZIX (as far as University of Waikato is concerned) has been fully dismantled. As most providers most providers have stopped peering with NZIX late last year, I thought it would be worth making note that as of this morning, NZIX is now part of New Zealand internet's history books, and is no longer in existence. Kind Regards, Lindsay. Lindsay Druett, CCNA, CCDA, NZTC (Elect.) Network Engineer, Network and Development, Information and Technology Services, University of Waikato, Hamilton, New Zealand. lindsayd(a)waikato.ac.nz Phone 64-7-838 4999 Fax 64-7-838 4416 Mobile 025-276 0700 <<Lindsay Druett.vcf>>

3 2

Wellington 2
by Dean Pemberton 05 Aug '01

05 Aug '01

Well wellington wasn't so dead afterall. Turns out that all we needed as a 1.5 metre tall whip antenna bolted to the top of Simon Blakes car. Yes we have photos I'll get them developed when I get back to Oz. Dean --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

9 20

smtp.xtra.co.nz --- sick?
by Chris Wedgwood 05 Aug '01

05 Aug '01

I'm seeing funnies to smtp.xtra.co.nz --- basically some connections when sending email are terribly slow, while others work perfectly well. Does anyone know if this address is a load-balancer or something? If that's the case then it might be a host behind it is a bit sick or something... I'm seeing 10 second delays or more between having received a TCP ACK and getting an SMTP ACK back. The helpdesk didn't seem too interested, I didn't even ask if they wanted to see my packet dumps[1] :) --cw [1] Another outstanding pickup line. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Code Red V3!?
by Mark Foster 05 Aug '01

05 Aug '01

http://www.idg.net.nz/webhome.nsf/UNID/3B65B7D06B08DB2DCC256AA00001AF76!ope… -.-. --.- Mark Foster - markf(a)intermech.co.nz IT Manager, Intermech Ltd +64-21-499-368 / +64-9-525-2220 http://www.intermech.co.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: NZIX is gone !!!
by Lindsay Druett 05 Aug '01

05 Aug '01

John Houlker will be touched... Everybody should turn off all their routers for a minute, as a mark of resepect. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Different Code Red?
by Juha Saarinen 05 Aug '01

05 Aug '01

I'm getting lots of hits on my home box, unfortunately. 142 since August 1 is the latest count. :-( Noticed that the GET requests look different now: 203.231.234.229 - - [05/Aug/2001:11:46:35 +1200] "GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9 090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0 078%u0000%u00=a HTTP/1.0" 404 283 "-" "-" Whereas earlier on, they looked like this: 65.192.84.7 - - [05/Aug/2001:06:51:26 +1200] "GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNN%u9090%u68 58%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u90 90%u8190%u00c3%u0003%u8b00% u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 400 330 "-" "-" -- Juha Saarinen --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

15 27

idg.net.nz --- IMHO privacy implications of archives are debatable (Paul Brislen)
by Chris Wedgwood 05 Aug '01

05 Aug '01

In light of recent comments WRT a certain IDG article I find: http://www.idg.net.nz/webhome.nsf/UNID/EA33E2992D04A5C0CC256A9E0010FACC!ope… Ah, internet. Bane and boon of my life. What would I do without you, dear old friend? Well, for a start, I wouldn't be following a language tutor's advice quite so often. He told me there are two steps to learning a foreign language. Step one: open mouth. Step two: insert foot. [...] Most entertaining of all, however, is that when I rewrote the story for Computerworld it changed the story as it appears on the web. The old version ("Newsgroups could be breaching privacy act") was effectively replaced with a new one ("Privacy issue over mailing list archives") in a single Orwellian moment. Ironic, really, when you consider the story in the first place was triggered by a question about whether an archive could or should be changed to remove old postings. Pretty reasonable comments this time, certainly worth reading. --cw --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Globe.NET (www.globe.net.nz) Mail Server full
by Craig Whitmore 04 Aug '01

04 Aug '01

If anyone has any contacts for Globe.NET (www.globe.net.nz) (I've tried their 0508 number and no answer) can you please contact them and tell them that their mail server has no space left on its Disk. Thanks Craig Whitmore Orcon Internet http://www.orcon.net.nz

1 0

CodeRed Worm Stats
by Brian Gibbons 04 Aug '01

04 Aug '01

>From: Craig Whitmore >I just did some graphs of the codered worms attacking over today.. and have a look at >http://www.nzdsl.co.nz/codered >Anyone got any similar stats?? Similar stats from one of our boxes that does nothing all day except ignore ARP broadcasts on it's LAN segment. http://www.outersite.co.nz/codered.html This is probably ho hum for many, however I pity those that pay per MB. At NZ retail rates a box infected with CodeRed could easily burn bandwidth at $300 per hour, fairly scary to come back Monday to find your box has burnt $15,000 over the weekend. BG --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Increase in Code Red activity?
by Brian Gibbons 04 Aug '01

04 Aug '01

We have noticed a large increase (10 fold) in CodeRed activity since bang on midnight last night. The probe rate seems to have now leveled off at one probe per IP address every three minutes. This activity was actually noticed from monitoring of broadcast traffic on an ethernet LAN (TCP SYN to Black hole LAN IP address). If WorldNet are listening, these two systems are hitting us regularly 210.55.74.165 210.55.76.51 Cheers BG. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

CodeRed Worm Stats
by Craig Whitmore 04 Aug '01

04 Aug '01

I just did some graphs of the codered worms attacking over today.. and have a look at http://www.nzdsl.co.nz/codered The last batch of attacks started about 11pm last night.. This is from 2 completely different networks in NZ and the results where about the Same The 1st graph is 1 Machine only and the 2nd Graph is a C Class. Pretty Scary.. Anyone got any similar stats?? The worse offenders are a couple of machines @ worldnet so far. Thanks Craig Whitmore Orcon Internet http://www.nzdsl.co.nz

1 0

FW: Alert: New version of Code Red, XXXX
by Chris Woodrow 04 Aug '01

04 Aug '01

Cross posted from the NTBugtraq list -----Original Message----- From: Russ [mailto:Russ.Cooper(a)RC.ON.CA] Sent: Sunday, 5 August 2001 3:48 p.m. To: NTBUGTRAQ(a)LISTSERV.NTBUGTRAQ.COM Subject: Alert: New version of Code Red, XXXX -----BEGIN PGP SIGNED MESSAGE----- Just a quick FYI, there is a new version of Code Red which appears to be spreading rather rapidly. - - Appears to be a new re-write. - - Drops some sort of remote access trojan. - - Turns off System File Checker (Windows File Protection.) - - Moves CMD.EXE to the scripts directory in IIS - - Looks like the way they make the entry into code very differently than before. - - If your IDS is looking for "NNNN", forget it (but then you should have been shot if you used this string anyway) Cheers, Russ - Surgeon General of TruSecure Corporation/NTBugtraq Editor p.s. if we don't respond right away its because we're now going to go and light the fireworks here at my retreat. Might as well have lots of fireworks tonight! -----BEGIN PGP SIGNATURE----- Version: PGP Personal Privacy 6.5.2 iQCVAwUBO2zCARBh2Kw/l7p5AQH95wQAqjGp7vRYK8SYky/ydyU1wxBmCe2c8Mpd DBdxrv+TY9112ZuH663ZspUOXThS9oeEyT4sdbVYNv8Z28nMipbioyTXYa5dw8po 21tkilo6ZoGX+AmKJ6Kz7WDvMpHpEfzDr3JHGtxuev0/rclXeRSN4urypMR3YnRz uw5ZW/F3U/I= =OhCV -----END PGP SIGNATURE----- ---------------------------------------------------------------------------- Delivery co-sponsored by Trend Micro ============================================================================ TREND MICRO REAL-TIME VIRUS ALERTS If you would like to know about a virus outbreak before CNN and ZDNet get Trend Micro Virus Info Feed FREE. Simply copy and paste a small piece of code to give your visitors a real-time top 10 list and the latest virus advisories. Setup takes just 10 minutes and requires no server-side code on your Web site. All content is updated automatically from Trend Micro's Web site. http://www.antivirus.com/banners/tracking.asp?si=8&bi=237&ul=/syndication/ vinfo/ ---------------------------------------------------------------------------- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Different Code Red?
by Thomas Salmen 04 Aug '01

04 Aug '01

For those who havn't seen yet - -----BEGIN PGP SIGNED MESSAGE----- Just a quick FYI, there is a new version of Code Red which appears to be spreading rather rapidly. - - Appears to be a new re-write. - - Drops some sort of remote access trojan. - - Turns off System File Checker (Windows File Protection.) - - Moves CMD.EXE to the scripts directory in IIS - - Looks like the way they make the entry into code very differently than before. - - If your IDS is looking for "NNNN", forget it (but then you should have been shot if you used this string anyway) Cheers, Russ - Surgeon General of TruSecure Corporation/NTBugtraq Editor p.s. if we don't respond right away its because we're now going to go and light the fireworks here at my retreat. Might as well have lots of fireworks tonight! -----BEGIN PGP SIGNATURE----- Version: PGP Personal Privacy 6.5.2 iQCVAwUBO2zCARBh2Kw/l7p5AQH95wQAqjGp7vRYK8SYky/ydyU1wxBmCe2c8Mpd DBdxrv+TY9112ZuH663ZspUOXThS9oeEyT4sdbVYNv8Z28nMipbioyTXYa5dw8po 21tkilo6ZoGX+AmKJ6Kz7WDvMpHpEfzDr3JHGtxuev0/rclXeRSN4urypMR3YnRz uw5ZW/F3U/I= =OhCV -----END PGP SIGNATURE----- Quite exciting really, isn't it? Regards, Thomas Salmen System Administrator Radionet Ltd. 1/72 Paul Matthews Road Albany, Auckland, New Zealand Ph: +64 9 414 0300 ext 718 -----Original Message----- From: Dan Langille [mailto:dan(a)langille.org] Sent: Sunday, 5 August 2001 4:00 p.m. To: Juha Saarinen Cc: nznog(a)list.waikato.ac.nz Subject: Re: Different Code Red? On 5 Aug 2001, at 11:53, Juha Saarinen wrote: > I'm getting lots of hits on my home box, unfortunately. 142 since August > 1 is the latest count. :-( > > Noticed that the GET requests look different now: [snip] Some look different: [dan(a)dev:/var/log] $ grep -c "default.ida?X" /var/log/httpd-access.log 12 [dan(a)dev:/var/log] $ grep -c "default.ida?N" /var/log/httpd-access.log 116 [dan(a)dev:/var/log] $ grep -c "default.ida" /var/log/httpd-access.log 128 The above represents the last 24 hours EST. All hits were against the IP address, not against any known domain (i.e. the HTTP headers did not include a domain name). -- Dan Langille pgpkey - finger dan(a)unixathome.org | http://unixathome.org/finger.php --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Code Red v. II
by Juha Saarinen 03 Aug '01

03 Aug '01

Arrghhh... three times as many hits: pts/0 juha(a)vimfuego:/mnt/hdb6/home/juha$ grep -c default.ida /var/log/httpd/access_log 54 -- Juha Saarinen --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

The Wellington Wander
by Dean Pemberton 02 Aug '01

02 Aug '01

Ok the numbers are in. Wellington scored much less usage on the wireless front Well less on the 'being able to pick up with a dinky antenna on the sidewalk' front I happen to know for certain that there are wireless stations out there that I missed Wellington seems to have a few hot spots rather than a general level of wireless. It does score higher on the security side though. Of the 17 networks that I saw, 9 were using WEP The ones that weren't however did try valiantly to give me IP addresses and invite me onto their networks. This kinda freaked me out (this is not an intrusion attempt remember) so I ended up disabling all protocols on that interface In the spirit of Tim Allen I think I need more power. So I'm on the lookout for a larger antenna, and I think I know just the place to get one on loan =) Later Dean --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

7 8

Re: Dean's Wireless Walkabout
by Dean Pemberton 02 Aug '01

02 Aug '01

HAHAHAHA ROFLMAO Choccie Fish for Joe here. Yes of course I mean 802.11 hahaha - I'm still laughing at that cock up. So how many people were worried that I could see their Vlans from the street? Dean On Wed, Aug 01, 2001 at 10:48:38PM +1200, Joe Lewis wrote: > > Hi, umm feel free to shoot me down but don't you mean 802.11(b)? > > --- > Joe Lewis > > On Wed, 1 Aug 2001, Dean Pemberton wrote: > > > > > Hi all; > > > > Yes this might be a first, I'm going to drag the topic BACK to something network related. > > > > I happen to be in Auckland today. Flew in for customer chit chat which will happen tommorow. > > Had a spare afternoon and no one to see so I thought I might do the geek thing and see how little old Auckland was getting along with it's wireless networking. > > > > SO, I slapped the 802.1Q card into the laptop and strapped the GPS onto the outside of my backpack and went for a walk. > > > > I walked down Queen Street from the top to the water, and then back up to Albert St to Wellesley then back up Symonds to my hotel. > > > > Well. Auckland sure is brimming with wireless. But the concern (and I spose the reason that I posted this at all) was that most of it is insecure. > > > > Now I'm a good guy. I don't want to get access to anything, god knows I see enough internet as it is. I just wanted to see how many places had embraced the 802.1Q fad. > > > > So all in all 29 networks jumped out and grabbed me as I was walking past. only 4 of them were using WEP. > > Now because I didn't actually try to gain access to any of them, I have no idea what the internal security of them is like. But I'm not expecting much. > > > > I don't think I sniffed anything off the sky tower, I was only using the small antenna on the card. > > > > So if you run a wireless network in the center of Auckland and you were using the strategy of "Oh it will never make it down to the street" Then you are wrong and you might like to put some more security on. > > > > I thought about mailing my networklist out as well. But I decided against it. Mainly because it has exact GPS locations and network names. It would make easy pickings for anyone who wanted to gain access. > > If you want to mail me privatly with your network name and/or card MAC address then I will give you a yes or no answer. > > > > Dont feel alone though. I've done the same in North Sydney and come up with similar numbers. > > > > Next week wellington. > > > > Have fun > > > > Dean > > --------- > > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > > where the body of your message reads: > > unsubscribe nznog > > > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

6 10

Proposed Change to Acceptable Use Policy
by Donald Neal 02 Aug '01

02 Aug '01

NZNOG People, It is not always obvious, but this list does have an acceptable use policy. Here it is: ---------- NZNOG Mailing List Acceptable Use Policy The NZNOG mailing list exists to provide a forum for the exchange of technical information and the discussion of implementation issues that require cooperation among New Zealand network service providers. In order to continue to provide a useful forum for discussion of relevant technical issues, users of the list are asked to respect the following guidelines. 1. Discussion will focus on Internet operational and technical issues. 2. Discussion related to meetings of network service providers is appropriate. 3. Discussion unrelated to these topics is not appropriate. 4. Postings to multiple mailing lists are discouraged. 5. Postings that include foul language, character assassination, and lack of respect for other participants are unacceptable. 6. Blatant product or service marketing is unacceptable. 7. Postings of a political, philosophical or legal nature are discouraged. 8. Postings to the list should be in ASCII or MIME encoded as text/plain. Attachments should not be sent to the list. To present a document, a suitable URL may be referred to. For documents of general interest, the use of proprietary file formats is discouraged. 9. Breaches of list etiquette should be dealt with privately with the offending list user, and should not result in complaints being sent to the list. ---------- This has served us well enough for a number of years. I now propose the following addition: 10. A person repeatedly breaching list etiquette shall receive warnings from the list administrator. A further breach after the second such warning within thirty days shall result in the offender being unsubscribed from the list. Other action may also be taken to block postings to the list by the offender. Any such unsubscription is to be immediately announced to the list. Votes on this change to me (not the list!) by midday, Friday 10 August, please. In the interim, I intend to proceed as I outlined previously. I shall issue formal warnings for irrelevant or abusive postings, and shall act to block postings as soon as a third warning within thirty days is issued to any individual. To avoid any appearance of retrospective action, I shall start counting warnings only from the appearance of this posting to the list. NB: This wiping of the slate excludes persons who have during the last week threatened me with legal action or have threatened to approach my employers to get them to influence my issuing of warnings for inappropriate posting. I consider that those involved have received far more warning than most people already. If a majority of votes cast support the change, this will become permanent practice, and the list will switch in the near future to accepting postings only from addresses supplied in advance. If the majority oppose it, we shall return to relying on people's goodwill. Unless someone else has a better idea? Donald --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: IP Address Management software.
by Steve Lang 02 Aug '01

02 Aug '01

Hiya. > Solarwinds (solarwinds.net) have a pretty cool suite of tools > that include > among others, IP management tools. They cost, but if you have > real buisiness > needs they are more cost effective than other commercial > solutions (Ci$co > included), and will quickly justify the cost. I had found them as well. Useful, and not that expensive when compared with others. > Network Address Recovery (This pings all IP address ranges > that you tell it > on a predetermined regular period (default 4 Hours), and > reports on the last > time an IP address was seen on the network) > There is a sample screen shot @ > http://solarwinds.net/Tools/Network_Discovery/Network_Address_ > Recovery/NetAd > Rec-1.gif I tested this, it looked quite good, but it's insistence at pinging things was annoying. > DHCP Scope Monitor (Requires Micro$soft DHCP and SNMP with > obviously NOT > public as the community string) Eeek. That would be interesting. Cheers and thanx. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

IP Address Management software.
by Steve Lang 02 Aug '01

02 Aug '01

Hiya all. 'Been lurking here for a while now, and actually have something worth saying now! I'm looking into IP Address Management packages. I've grazed through google, and a few others, and found pointers to many. It seems that there are a few packages that purport to allow people to manage IP Address space, but many of them focus on the integration of DHCP/DNS. Now, for what I'm after at the moment, this isn't an issue, and all I really want is something that can document allocations and what they're used for. There are some packages that don't exist now, and a couple that have changed hands within the last few years. An understanding of VLSM/CIDR etc. is required, although maybe not an understanding, but an allowance to docuement super/subnets. What do you, the contributors to this list use? And yes, I've done the spreadsheet thing to death... Cheers - -------------------------------------------------------------------------- Steve Lang Telephone: +64-9-309-7918 Consultant DDI: +64-9-307-5584 Optimation New Zealand Limited. Mobile: +64-25-864-653 P.O.Box 106104 Fax: +64-9-309-7919 Auckland E-mail: steve.lang(a)optimation.co.nz New Zealand Web: www.optimation.co.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 4