- NZNOG - lists.nznog.org

RE: Fax to vendor
by Greg Clare 23 Jul '01

23 Jul '01

WARNING:- This message contained a virus (W32.Sircam.Worm(a)mm). For more details refer:- http://service1.symantec.com/SUPPORT/nav.nsf/aab56492973adccd882569450055235 5/f75929f63f73df5f882569a80022dbd0?OpenDocument Norton Virus definitions dated 17 July 2001 or later will detect this recent worm. Regards Greg > -----Original Message----- > From: Andrea Moran [mailto:andrea(a)petrinamoran.freeserve.co.uk] > Sent: Tuesday, 24 July 2001 9:06 am > To: nznog(a)list.waikato.ac.nz > … [View More]

1 0

(no subject)
by AngelaMcIntee＠aol.com 23 Jul '01

23 Jul '01

Can anyone tell me the physical address of the Sprint NAP in Pennsauken, NJ? Thanks, Angela --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Julian Angelo - Conclusion
by Donald Neal 22 Jul '01

22 Jul '01

<Multimedia>If you wish this posting to be a multimedia experience, go to http://www.netspace.org/~dmacks/internet-songbook/lart-lart-lart-the-spamme… and sing the contents of that page to yourself while reading.</Multimedia> NZNOG People, Three days ago I posted to this list, saying >Just over a year ago, there was discussion on this list of spamming by >one Julian Angelo. He has now approached me, asking to have these >references removed from the NZNOG archive. It … [View More]seems that prospective >employers who look up his name on the web find these archive entries, a >fact which may not be helping his career any. >If any network operator has an objection to these entries being removed >from the archive, could they please contact me directly. I had a number of reasons for doing things in this way. For one thing, I do not see myself as owner in the usual sense of that word of this list or its archive. For another, the content of email sent to me in response to such an enquiry might conceivably be actionable. I also take the view that spammers are thieves who must be shown the error of their ways and encouraged to live useful, constructive lives. I am in principle very happy with the idea of editing the names of the guilty out of publicly-readable archives a suitable period after their offending ceases. The chance to gain useful employment would then be one of the reasons why they would give up their vile activities in the first place. My request to be contacted directly was followed by close to fifty emails to the list. Some had particularly disappointing content. The acceptable use policy for this list states that character assassination is unacceptable. It also states that discussion unrelated to Internet technical and operational matters is not appropriate. Discussions of a legal nature are particularly discouraged. This has not been a good week for this list's s/n ratio, nor for constructive discussion. I am all in favour of a certain amount of humour of questionable relevance, but there was little of that here. The only such contribution was Matt Camp's, which observed "I'm sure there's a lesson there. f33r the far-reaching p0w3rz of NZNOG! [...] we shall [...] smite the career prospects of spammers and script kiddies with our flaming LARTting tool of justice!" I have doubts about his spelling of LARTing, but I too am sure there's a lesson here. As I've already said, I see publicity and its withdrawal as a useful tool in encouraging spammers into the paths of righteousness. Regrettably, the point was not taken up by others. My thanks to those who did respond directly to me. The suggestion that by altering the archive's contents on any occasion I might become responsible for all of its content was one I had not previously considered. Other opinions expressed fell into two groups. Some subscribers believed that an apology was called for before Mr Angelo's name was removed from the archive, while others felt that archives should not ever be altered. Some of this latter group observed that archiving an apology from Julian Angelo would give prospective employers a full piucture of events. I count four subscribers in the first group and thirteen in the second. Removing from the count people I believe not to be staff of network operators, and the subscriber who expressed both opinions, leaves three in the first group and eight in the second. I feel myself to be bound by this expression of the views of subscribers, and will not seek to have the archives changed. At no point has anyone even implied to me that Julian Angelo has done anything wrong since the events of July 2000. I went into this thinking that was the question. Donald Neal List Administrator/Muggins <Multimedia>You can stop singing now.</Multimedia> -- Donald Neal Mobility & Calling Platforms Network Delivery Telecom New Zealand Ltd --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog [View Less]

12 21

[dranch@trinnet.net: How the IIS Red Worm works..]
by Dean Pemberton 21 Jul '01

21 Jul '01

> so which ISP in Wellington was it that is reported to have lost its servers > as a result of thei worm (reported in the Herald).... and did it really > infect/affect 250000 sites? > > Ian Dunno about the first one - but there is a portion in this article that talks to your second point. Dean ----- Forwarded message ----- Interesting.. From http://www.w2knews.com/subscribe.cfm?id=W2K -- Explanation As stated earlier the .ida "Code Red" worm is spreading throughout … [View More]IIS Web servers on the Internet via the .ida buffer-overflow attack that was published last month. The following are the steps that the worm takes once it has infected a vulnerable Web server: Setup initial worm environment on infected system. Setup 100 threads of the worm. Use the first 99 threads to spread the worm (infect other Web servers). � The worm spreads itself by creating a sequence of random IP addresses. However, the worm's list of IP addresses to attack is not all together random. In fact, there seems to be a static seed (a beginning IP address that is always the same) that the worm uses when generating new IP addresses. Therefore every computer infected by this worm is going to go through the same list of "random" IP addresses. Because of this feature, the worm will end up re-infecting the same systems multiple times, and traffic will cross traffic back and forth between hosts ultimately creating a denial-of-service type effect. The denial-of-service will be due to the amount of data being transferred between all of the IP addresses in the sequence of random IP addresses. The worm could have done truly random IP generation and that would have allowed it to infect many more systems much faster. We are not sure why this was not done, but a friend of ours did pose an interesting idea: If the person who wrote this worm owned an IP address that was one of the first hundred or thousand to be scanned, then they could setup a "sniffer" and anytime and IP address tried to connect to port 80 on their server they would get confirmation that the IP address that connected to them was infected with the worm. With this knowledge, they would be able to create a list of the majority of systems that were infected by this worm. The 100th thread checks to see if it is running on an English (US) Windows NT/2000 system. � If the infected system is found to be a English (US) system, the worm will proceed to deface the infected system's website. The local Web server's Web page will be changed to a message that says: "Welcome to http://www.worm.com!, Hacked By Chinese!". This hacked Web page message will stay "live" on the Web server for 10 hours and then disappear. The message will not appear again unless the system is re-infected by another computer. � If the system is not an English (US) Windows NT/2000 system, the 100th worm thread is also used to infect other systems. Each worm thread checks for c:\notworm. � If the file c:\notworm is found, the worm goes dormant. � If the file is not found, each thread will continue to attempt to infect more systems. Each worm thread checks the infected computer's system time. � If the date is past the 20th of the month (GMT), the thread will stop searching for systems to infect and will instead attack www.whitehouse.gov. The attack consists of the infected system sending 100k bytes of data (1 byte at a time + 40 bytes overheard for the actually TCP/IP packet) to port 80 of www.whitehouse.gov. This flood of data (410 megabytes of data every 4 and a half hours per instance of the worm) would potentially amount to a denial-of- service attack against www.whitehouse.gov. � If the date is between the 1st and the 19th of the month, this worm thread will not attack www.whitehouse.gov and will continue to try to find and infect new Web servers. We have calculated that the worm can attempt to infect roughly half a million IP addresses a day. This is a rough estimate generated by testing on a very slow network. At the time of writing this document (July 19th, 3:00pm), we have had reports from administrators that have been probed by over 196 thousand unique hosts. This leads us to believe that this worm has infected at least 196 thousand computers. During testing we noticed that sometimes the worm does not execute "normally" and will continue to spawn new threads until the infected machine crashes and has to be rebooted, effectively killing itself. We have not been able to isolate the cause of this behavior. ----- End forwarded message ----- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog [View Less]

2 1

RE: the .ida "Code Red" worm - ISP suffers?
by PhoneNet 21 Jul '01

21 Jul '01

so which ISP in Wellington was it that is reported to have lost its servers as a result of thei worm (reported in the Herald).... and did it really infect/affect 250000 sites? Ian --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

China-diesel fuel injection 7/20
by china-lutong.com 19 Jul '01

19 Jul '01

hi: My name is ChenHua, and I'm writing on behalf of the China-Lutong mechanical company. Located in the south east of China, we specialize in hydraulic heads for the VE distributor pump. We can supply standard, good quality units at a very competitive price. The following types are available: Engine model VE PUMS code NO UNIT PRICE(EX WORK) ISUZU 4JB1 NP-VE4/11F1800LNP777 146402-0920 $USD40 ISUZU 4JB1 NP-VE4/11L(DENSO) 096400-1600 $USD40 ISUZU 4JB1 NP-… [View More]

1 0

Full analysis of the .ida "Code Red" worm.
by Chris Rigby 19 Jul '01

19 Jul '01

I think this is something we should all be aware of for those of you not on bugtraq (which I hope most of you are.) This attack has gone from something like 0 hits in my web logs yesterday to 11 in the last 4 hours Some people are estimating over 12,000 hosts infected already. Also to worry about are later announcements that : "A notable side effect of this.. the worm signature is wreaking havoc with Cisco 675, 677, and 678 DSL routers that have the Web Based Configuration Interface enabled.… [View More]

17 35

Code Red --- request for logs (from NANOG)
by Chris Wedgwood 19 Jul '01

19 Jul '01

>From NANOG: From: "Steven M. Bellovin" <smb(a)research.att.com> To: nanog(a)merit.edu Cc: Balachander Krishnamurthy <bala(a)research.att.com> Subject: Re: Code Red -> Router Memory depletion? Date: Thu, 19 Jul 2001 20:39:31 -0400 Message-Id: <20010720003931.77D057B57(a)berkshire.research.att.com> X-Mailer: exmh version 2.1.1 10/15/1999 A colleague of mine, Balachander Krishnamurthy, is looking for Web server logs from sites that have been attacked by Code Red. He's … [View More]

1 0

RE: Full analysis of the .ida "Code Red" worm.
by Greg Clare 19 Jul '01

19 Jul '01

Hits on my home connection started at 4:51am, with 17 unique source addresses logged so far. Greg > -----Original Message----- > From: Juha Saarinen [mailto:juha(a)saarinen.org] > Sent: Friday, 20 July 2001 9:50 am > To: 'Dean Pemberton'; 'Chris Rigby' > Cc: nznog(a)list.waikato.ac.nz > Subject: RE: Full analysis of the .ida "Code Red" worm. > > > 12 hits on my home server only... many more on the IDG ones :-( > > -- > > Juha --------- To … [View More]

5 4

RE: Full analysis of the .ida "Code Red" worm - Attacks stop
by Lindsay Druett 19 Jul '01

19 Jul '01

www.microsoft.com got hit today. I went to their site and had the message "Hacked by Chinese" in red letters. Pity, next time I logged in, I got the normal web page, a bit disappointing.... But I logged in again later, in the same web page, and got the "Hacked by Chinese", so it must be only a few of their servers. So much for "round robin" load sharing, they should be using a Cisco content switch. After 6days The attacks have stoped hitting my server in the past 10 minutes ... Who did … [View More]

1 0

Help with survey needed
by Frank March 19 Jul '01

19 Jul '01

I have been asked to assist with recruitment for an online survey of ISPs and IT companies in New Zealand. The survey is being conducted by the Information Technology Group at the Center for International Development, Harvard University in conjunction with the World Economic Forum and will be used to compile the Global Information Technology Readiness Report (GITRR). The survey for Internet Service Providers (ISPs) can be found at: http://www.cid.harvard.edu/ciditg/isp The survey for other … [View More]kinds of IT companies can be found at: http://www.cid.harvard.edu/ciditg/it It is suggested that the survey should be completed by someone in a senior management position in your company or organisation. If you do not feel you 'qualify' please pass this on in your organisation to someone who does. I am distributing this to the NZNOG, InternetNZ members, and GOVIS email lists (apologies for duplications). Please feel free to further distribute to other contacts if you think it would be useful. If you want to find out more, I have appended below the unexpurgated and (largely) unedited text sent to me by Indran Ratnathicam, who is in charge of the survey. Thank you Frank March Specialist Advisor, IT Policy Group Ministry of Economic Development, PO Box 1473, Wellington, NZ Ph: (+64 4) 474 2908; Fax: (+64 4) 471 2658 <from Indran> You are invited to become a collaborator and participant in a major research project, the Global Information Technology Readiness Report (GITRR). The GITRR, a new venture between Harvard University and the World Economic Forum, aims to make an important contribution to the understanding of the New Economy and global IT usage. This report will be published in the Fall 2001, and will assess the global IT situation for nearly 100 countries, including New Zealand. The GITRR will provide: · A background for policy discussions by your government and international bodies that will influence the IT and economic development in your country, including your company's activities. · A clearly identified list of your country's relative IT strengths that may spur investment or become a source of competitive advantage in your industry or region. · A clearly identified list of your country's areas for IT development, which can be used to focus future development initiatives by both the public and private sectors. · A tool for international IT companies to increase their understanding of local markets, their opportunities and their challenges. As an IT leader of New Zealand, you are in a unique position to accurately portray where your country stands with regard to the adoption and use of IT within the global context. Your cooperation is essential in adding value to the GITRR and in guaranteeing inclusion of your country in the Report. All you need to do is fill out an online survey. The survey for Internet Service Providers (ISPs) can be found at: http://www.cid.harvard.edu/ciditg/isp The survey for other kinds of IT companies can be found at: http://www.cid.harvard.edu/ciditg/it It will take no more than 30 min of your time to complete and you will not have to necessarily stay logged on to the Internet while you are filling it out. Please fill out the survey by August 3, 2001. If you have additional comments/ queries, please do not hesitate to get in touch with me at Indran_Ratnathicam(a)ksg.harvard.edu. Please rest assured that individual questionnaires remain strictly confidential. Thank you in advance for taking the time to complete this survey. With best regards, Indran Ratnathicam Global IT Readiness Report Information Technologies Group Center for International Development at Harvard University Further details about the Global IT Readiness Report can be found at: http://www.cid.harvard.edu/ciditg/gitrr/ PS: If you are aware of other IT leaders in your country please direct them to the survey --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog [View Less]

1 0

None
by Ivan Walker 19 Jul '01

19 Jul '01

subscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Code Red
by Thomas Salmen 19 Jul '01

19 Jul '01

Niiiice... [root(a)proxy1 /root]# grep -c default.ida access.log 721522 [root(a)proxy2 /root]# grep -c default.ida access.log 717971 Cheers, Thomas Salmen System Administrator Radionet Ltd. 1/72 Paul Matthews Road Albany, Auckland, New Zealand Ph: +64 9 414 0300 ext 718 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

FW: Update to "Code Red" Worm. Its a date bomb, not time.
by Greg Clare 19 Jul '01

19 Jul '01

>-----Original Message----- >From: Marc Maiffret [mailto:marc(a)eeye.com] >Sent: Friday, 20 July 2001 8:55 a.m. >To: BUGTRAQ >Subject: Update to "Code Red" Worm. Its a date bomb, not time. > > >Thanks to Eric from Symantec for tossing us a note about the >worm being Date >based and not Time based. > >We made an error in our last analysis and said the worm would start >attacking whitehouse.gov based on a certain time. In reality >its based on a >… [View More]date (the 20th UTC) which is tomorrow. > >If the worm infects your system between the 1st and the 19th >it will attempt >to deface the infected servers web page or try to propogate >itself to other >systems. On the 20th all infected threads will attempt to attack >www.whitehouse.gov. This seems to continue until the worm is >removed from >the infected system. > >Any new infection that happens between the 20th and 28th will >most likely be >someone "hand infecting" your system as all other worms should >be attacking >whitehouse.gov. If for some reason you are infected between >the 20th and the >28th then the worm will begin attacking whitehouse.gov without >trying to >infect other systems. This attack will continue indefinitly. > >The following are rough numbers, but we felt that it was important to >illustrate the affects this worm can _possibly_ have. > >The worm has a timeline like this: > >day of the month: >1-19: infect other hosts using the worm >20-27: attack whitehouse.gov forever >28-end of month: eternal sleep > >Presumably, this could restart at any point in a new month again. > >Also, some stats for the attack: > >Each infection has 100 threads >Each thread is going to send about 100k, a byte at a time, >which means you >have a (40 for ip + 1 for each byte) which means you have 4.1 >megs of data >per thread >100 threads * 4.1megs = 410 Megabytes >This will be repeated again every 4.5 hours or so > >Remember, each host can be infected multiple times, meaning >that a single >host can send 410MB * # of infections. > >We have had reports between 15 thousand and 196 thousand unique hosts >infected with the "Code Red" worm. However, there has been >cross infection >and we have heard reports of at least 300+ thousand >infections/instances >(machines with multiple infections etc..) of this worm. > >If there are 300 thousand infections then that means you have >(300,000 * 410 >megabytes) that is going to be attempted to be flooded against >whitehouse.gov every 4 and a half hours. If this is true and >the worm "works >as advertised" then the fact that whitehouse.gov goes offline >is only the >begining of what _can_ possibly happen... > >---- > >I am actually writing this part of the eMail about 45 minutes after the >first part because our Internet connection here in california >has been going >up and down. We have also heard reports of internet >connectivity going down >in parts of northern california and new york. > >Signed, >eEye Digital Security >T.949.349.9062 >F.949.349.9538 >http://eEye.com/Retina - Network Security Scanner >http://eEye.com/Iris - Network Traffic Analyzer >http://eEye.com/SecureIIS - Stop known and unknown IIS vulnerabilities > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog [View Less]

1 0

FW: Full analysis of the .ida "Code Red" worm.
by Tony Wicks 19 Jul '01

19 Jul '01

-----Original Message----- From: Juha Saarinen [mailto:juha(a)saarinen.org] Sent: Friday, July 20, 2001 10:12 AM To: tony.wicks(a)telstrasaturn.co.nz Subject: RE: Full analysis of the .ida "Code Red" worm. Well, Tony, to be quite frank, you annoy me even more. Who the fuck appointed you as the content-cop on NZNOG, and told you to stalk me with rude replies each time I post something? Nobody else complains about my posts, and I bet you haven't got the courage to be rude to anyone else. -… [View More]

2 1

SPAM/SCAM alert
by Michael Newbery 19 Jul '01

19 Jul '01

This piece of ordure just showed up in my mailbox. Just a heads-up in case anyone hasn't already seen it and might decide to alert the customers. Now, where did I put that nuclear weapon? At 5:34 PM +0100 19/7/01, <webhosting(a)associate.co.uk> wrote: >Received: from moonof.saturn.co.nz > (rata.saturn.co.nz [172.20.18.220]) > by wlg-gwia-nw-01.saturn.co.nz; Fri, 20 Jul 2001 04:44:56 +1200 >Received: from cmailg6.svr.pol.co.uk (cmailg6.svr.pol.co.uk [195.92.195.176]) > … [View More]by moonof.saturn.co.nz (Postfix) with ESMTP id A3A629C12 > for <michaeln(a)saturn.co.nz>; Fri, 20 Jul 2001 04:34:49 +1200 (NZST) >Received: from harrya.fsnet.co.uk ([217.134.134.196] helo=andrewal) > by cmailg6.svr.pol.co.uk with smtp (Exim 3.13 #0) > id 15NGl1-0002jE-00 > for michaeln(a)saturn.co.nz; Thu, 19 Jul 2001 17:34:35 +0100 >To: <michaeln(a)saturn.co.nz> >From: <webhosting(a)associate.co.uk> >Subject: notice from your webhost >MIME-Version: 1.0 >Content-Type: text/plain; charset=unknown-8bit >Message-Id: <E15NGl1-0002jE-00.2001-07-19-17-34-35(a)cmailg6.svr.pol.co.uk> >Date: Thu, 19 Jul 2001 17:34:35 +0100 > ><x-charset unknown-8bit> > >This email is being sent to you on behalf of your current webspace provider. >This message is not a spam or junk email, your email address was >supplied to WebHosting.com >You will not receive any more messages from WebHosting.com this is a >one time special offer notice. > >WebHosting.com is offering a selected number of webhost's member's >the following special offer. This offer is not available on our >website at www.webhosting.com or anywhere else, this is a special >offer and is valid only for a limitied time. Read on to learn more >about this amazing offer. > >For only $6.25 (one time fee) you can get: > >> 500mb webspace >> unlimited pop3 email addresses >> cgi-bin >> full ftp access >> php, ssi, my-sql, asp support >> mySQL database >> FREE DOMAIN REGISTRATION (.com .net .org) >> unlimited bandwidth >> miva merchant account >> secure server for transactions >> accept credit cards >> 24hour technical support > >You did read it right, all this will only cost you only $6.25. There >are no monthly fees or any other costs. You are probably wondering >how WebHosting.com can offer all this for the very low price of only >$6.25, the answer is that WebHosting.com will make a lot of revenue >from extra webspace charges - people wishing to have more than 500mb >can pay $10 per 10mb per month. > >If you would like to receive this excellent offer all you have to do >is send your details to the following email address and your >username and password will be emailed to you within 5 business days. >Then you will be able to login at the members area of WebHosting.com >and configure your account (add domains, setup scripts etc.). > >Please send all of the following details: > >Your Full Name >Your Full Address >Your Phone Number >Your Email Address >Your Credit Card Number >Your Credit Card Expiry Date >Your Credit Card Type (eg. visa, mastercard etc.) > >Send all of the above to webhosting(a)associate.co.uk > > > > >Thank you and I hope you enjoy this very special offer > >John Simmons >Head of Special Promotions, Webhosting.com > >------------------------------------------------------------------------------------- >WebHosting.com is a member of the CNS International Internet >Businesses Association > > ></x-charset> -- Michael Newbery Technical Specialist TelstraSaturn Limited Tel: +64-4-939 5102 Mobile: +64-29-939 5102 Fax: +64-4-922 8401 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog [View Less]

1 0

Problems accessing sites in china
by Lin Nah 18 Jul '01

18 Jul '01

HI all I wonder if anyone here has had complains from their customers/helpdesk regarding inability to access certain chinese websites. For example the last 5 hops of a trace to www.china.com shows it disappearing after 201.176.155.238 15 hkt.ser4-0.core1.sun.cais.net (63.216.17.73) 245.372 ms 240.922 ms 237.96 0 ms 16 202.84.249.29 (202.84.249.29) 236.565 ms 235.41 ms 234.18 ms 17 207.176.97.134 (207.176.97.134) 245.263 ms 235.18 ms 238.485 ms 18 f5-1.tmh12.hkt.net (205.252.128.… [View More]

5 4

RE: IPv6...Fact or Fiction?
by Gavin Cato 18 Jul '01

18 Jul '01

>> NAT is a broken idea, as are firewalls. Just because it works, >> doesn't change this. I wouldn't call it broken. A band-aid solution perhaps but not broken. It does what it intended to do quite well. Gav --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

6 14

This list, or an alternative? was RE: Julian Angelo - Conclusion
by Frank March 18 Jul '01

18 Jul '01

I am not a network operative, yet I lurk here (with intent, since I v occasionally post). I have always considered that off-topic posts (like, I suppose, this one) come into the permissible area, as allowed for in the mention of beer in the AUP. I have always had an excellent range of helpful responses from NZNOG subscribers when I have posed policy related questions to this list even though they are unrelated to beer. I find being on this list extremely useful. At the same time, a point … [View More]

1 0

Could this be why your 827s are retraining?
by Juha Saarinen 18 Jul '01

18 Jul '01

http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121relnt /800/800yb/rn800yb.htm Resolved Caveats for Release 12.1(5)YB1 This section describes possibly unexpected behavior by software releases prior to Release 12.1(5)YB1 that have been resolved in Release 12.1(5)YB1 and above. CSCdt19816 A router retrains when an LOM is detected-a critical condition message is sent out, resulting in an unnecessary reboot. A LOM alone is not sufficient to require a critical condition message … [View More]

1 0

unsubscribe nznog
by Melanie McAllister 18 Jul '01

18 Jul '01

-----Original Message----- From: James Tyson [mailto:james(a)samizdat.co.nz] Sent: Thursday, 19 July 2001 10:13 a.m. To: Juha Saarinen Cc: 'Simon Allard'; 'James Tyson'; nznog(a)list.waikato.ac.nz Subject: RE: IPv6...Fact or Fiction? > Yes, yes, but what does that mean? Details, man, details. ;-) > > I have found that with either the Nokia MW1122 and the Cisco 827 plugged > in, my Jetstream connection suffers from "micro outages", usually once a > day. It'd be interesting to … [View More]

1 0

DNS & email hosting
by Chris Wedgwood 18 Jul '01

18 Jul '01

I'm looking for a list of people who offer basic DNS and Email hosting. Nothing fancy, basically a service that a few people can use so that <everything>@some.domain.com will end up in their Xtra mailbox. It occurred to me there must be about fifty difference places who can do this, but I've never seen a list of services compiled list who can provide what. Right now, there is no talk of needing mailboxes, web-sites or indeed anything of the sort, but knowing that this is trivially … [View More]

2 1

Re: Optical Gig NICs
by Richard Naylor 17 Jul '01

17 Jul '01

At 10:35 PM 7/17/2001 +1200, Roger De Salis wrote: >Ah, the joys of my favourite and personal network provider..... > >There is one vital fact that has been missed though.... any financial >advantage accrued through the economics espoused above, is completely >negated by the scale of the PC wreckage around Simon's desk. I've >seen it... in fact it run's over two desks....., around the floor >past the aerials, over the carpet.... who needs $25 NIC cards >when you can … [View More]

3 3

Re: Optical Gig NICs
by Richard Naylor 17 Jul '01

17 Jul '01

At 10:35 PM 7/17/2001 +1200, Roger De Salis wrote: >Ah, the joys of my favourite and personal network provider..... > >There is one vital fact that has been missed though.... any financial >advantage accrued through the economics espoused above, is completely >negated by the scale of the PC wreckage around Simon's desk. I've >seen it... in fact it run's over two desks....., around the floor >past the aerials, over the carpet.... who needs $25 NIC cards >when you can … [View More]

1 0

Optical Gig NICs
by J S Russell 17 Jul '01

17 Jul '01

Possibly slightly off topic, but does anyone (Hi Richard! Hi Si!) know of a New Zealand source for gigabit nics (optical, not copper) which are (a) not priced at defence department levels, and (b) supported by linux? JSR -- John S Russell | "What the hell is he building in there... Operations Manager | he has a router...and a table saw..." Attica/Callplus NZ | - Tom Waits, Mule Variations --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where … [View More]

9 15

IPv6...Fact or Fiction?
by Craig Whitmore 17 Jul '01

17 Jul '01

Hi people.... When do people think we (the Internet) will run out of IPv4 addresses and people will be forced to move over and use IPv6? Or will people use the IPv4 addresses in a much more conservative way? Do you think it will really take off in the near future? Has there really been a standardized IPV6 Format yet? Has anyone actually used it in a production enviornment? Should I "Apply" for some IPv6 addreeses now or will there be plenty of time to implement it? Thanks Craig Whitmore … [View More]

5 6

Julian Angelo
by Donald Neal 17 Jul '01

17 Jul '01

NZNOG People, Just over a year ago, there was discussion on this list of spamming by one Julian Angelo. He has now approached me, asking to have these references removed from the NZNOG archive. It seems that prospective employers who look up his name on the web find these archive entries, a fact which may not be helping his career any. If any network operator has an objection to these entries being removed from the archive, could they please contact me directly. Donald Neal NZNOG … [View More]

21 40

Re: Optical Gig NICs
by Chris Wedgwood 16 Jul '01

16 Jul '01

On Tue, Jul 17, 2001 at 11:11:21PM +1200, Chris Hellberg wrote: is that using that RAW NIC to NIC option in the linux kernel? If you mean Alexey's fastroute stuff, then no. Fast route only makes sense for a router and only works on a very limited number of cards. --cw --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Optical Gig NICs
by Chris Hellberg 16 Jul '01

16 Jul '01

>>> "Chris Wedgwood" <cw(a)f00f.org> 07/17/01 10:41p.m. >>> On Tue, Jul 17, 2001 at 09:40:01PM +1200, Richard Naylor wrote: Dick Smith. Maybe decent was the qualifer......I think we pay $35 for D-Link. The only D-Link cards I've ever used are 530TX or something. They are not even close to what I call decent. What chipset do the ones you have use? Last time I shifted a file from the edit pc to the server (both on GbE) it took 6 minutes for 1.6 Gig. I … [View More]

1 0

RE: Julian Angelo
by Lindsay Druett 16 Jul '01

16 Jul '01

Read a bit of that... you're not kidding. About 5 pages of it.... Hey ! He forgot to mention to his prayer chain about NZNOG ! :: Would it not suffice for Mr Angelo to publish an apology :: here on NZNOG, thus when prospective employers discover his :: chequered past, they will also discover his contrition. http://www.datasync.com/~mbowie/archive29.html -- read a bit of that... seems the NZNOG archives are the least of Mr Angelo's worries. -- Juha --------- To unsubscribe from nznog, … [View More]

1 0

RE: Julian Angelo
by david＠farrar.com 16 Jul '01

16 Jul '01

There seem to be a few lessons one can learn from this. 1) Don't spam 2) Don't spam ISPs 3) In case of 1 or 2 apologise 4) Asking for archives to be removed is a bad idea 5) Asking a group of system admins to remove archives is a *really* bad idea 6) This is because anything that can be found about you will and has been 7) Also because the discussion on your request leads to 30 times as many hits as the original thread 8) Juha does have too much time on his hands 9) Refer to 1 10) There is no … [View More]

3 2

RE: Julian Angelo
by Greg Clare 16 Jul '01

16 Jul '01

Just an observation... In requesting the archive purge, a whole new thread of discussion relating to this topic is currently being created... Therefore, the next request will be for the current discussion to be purged... ad infinitum! This leads to the obvious paradox that the only way to undo history is to travel back in time and not do what should not have been did in the first place! ;) Another observation... An apology post would also be recorded in the archives. Greg > -----… [View More]

2 1

re: Julian Angelo
by Matthew G Brown 16 Jul '01

16 Jul '01

I have also read about this person . If he could come up with a good reason and apology he could have his sentence shortened by the ISP Justice system. Spam is Spam and from what I know he did quite the nice job of it all . Sincere apologies time. Matthew G Brown Wireless Network Specialist Tasman Solutions LTD Http://www.ts.co.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Who are these at APE?
by Craig Whitmore 16 Jul '01

16 Jul '01

Anyone be able to tell me who these are at ape?? ????.ape.net.nz (192.203.154.7) dts1.ape.net.nz (192.203.154.68) dts2.ape.net.nz (192.203.154.69) ssc.ape.net.nz (192.203.154.76) They are not on the www.ape.net.nz website for contact to peer with? (if they want to is a different question) Thanks Craig Whitmore Orcon Internet http://www.orcon.net.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

Re: IP express
by David Anso 15 Jul '01

15 Jul '01

I take the last bit back. International access seems quite good again. Regards David Anso Systems Administrator - ZIP Internet Email: sysadmin(a)zip.co.nz ----- Original Message ----- From: "David Anso" <sysadmin(a)zip.co.nz> To: "Chris Wedgwood" <cw(a)f00f.org> Cc: "NZNOG Mailing List" <nznog(a)list.waikato.ac.nz> Sent: Monday, July 09, 2001 3:22 PM Subject: Re: IP express > Clint said that there was a fibre cut between Auckland and Hamilton. > Apparently it's … [View More]

3 2

I'm off!
by Phill Groom 11 Jul '01

11 Jul '01

Lunch seems to have gone on a bit longer than normal today and since I am now at home and not at my desk I don't have access to all of the email addresses of the people I would like to personally say goodbye to. A general broadcast to nznog seems like the best way out of this predicament. Apologies to those that don't know me or do know me but don't care! I have left TelstraSaturn and will be returning to Telstra Corp. in Hobart next week. To all of the customers, potential customers, peers … [View More]

1 0

Re: IP express
by Seeby - Orcon Internet 10 Jul '01

10 Jul '01

Yes we are having problems with our IPExpress cct. we thought that it was just us. we have lodged a fault with Clear they haven't given us an ETA Cheers Seeby Orcon Internet - www.orcon.net.nz ----- Original Message ----- From: "Simon Lyall" <simon.lyall(a)ihug.co.nz> To: <nznog(a)list.waikato.ac.nz> Sent: Monday, July 09, 2001 10:51 AM Subject: ip express? > Looks like it's down going off who has died on APE. Can anyone confirm? > > -- > Simon Lyall. … [View More]

8 11

Australian Bill - "10 years for hacker toolkits, scanners and virus code."
by Hamish MacEwan 08 Jul '01

08 Jul '01

I've read some of the discussion at, http://slashdot.org/article.pl?sid=01/07/07/0132226 and wonder if anyone has any reassurance to offer about the NZ bill? I'm presuming the practitioners on this list will be in some kind of grey area in this legislation, unless the State wishes to introduce a form of licensing, a la Car Salesmen, Security Guards, Doctor, and Network Operator who is granted specific exemptions regarding the general provisions of the law. The other, supra-legislative, issue … [View More]

7 11

Re: IP express
by Donald Neal 08 Jul '01

08 Jul '01

-- Donald Neal Mobility & Calling Platforms Network Delivery Telecom New Zealand Ltd >>> "Rob Isaac" <rob(a)automagic.org> 07/09/01 12:38 >>> >*Steps up to the plate* >Seeby sends email >having problems with IP >a fault is lodged I express suprise Spare time is so extensive for operations staff - Donald Neal --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Australian Bill - "10 years for hacker toolkits, scanners and virus code."
by Frank March 08 Jul '01

08 Jul '01

The well considered (and widely consulted) InternetNZ/ISOCNZ submission on SOP 85 (the 'antihacking' provisions) put together by Ewen McNeil and others is available at http://www.isocnz.org.nz/issues/iswg010209submsm_crimes-amend-bill-6.html The SOP itself and other links are to be found under 'Legislation' at: http://www.isocnz.org.nz/issues/index.html But to save everyone from the need to search, I can summarise by noting that the issues raised by the Australian Bill are not part of any … [View More]

1 0

Cache peering via WIX/APE
by David Robb 08 Jul '01

08 Jul '01

If anyone else[1] is interested in cache peering across either WIX or APE, let me know. [1] ie, anyone I'm not already peering caches with David Robb --- Senior Network Engineer DDI +64-9-359-2710 ihug (AS7657) NOC +64-9-359-2708 "The Earth is a single point of failure" --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: ip express?
by Seeby - Orcon Internet 08 Jul '01

08 Jul '01

Did they lose it? ;-) or did you mean "fixing" the Clear IP express switch Cheers Seeby Orcon Internet - www.orcon.net.nz > According to someone else, The Clear tech is having problems finding the > IPexpress switch. > > -- > Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz > Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz > ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz > --------- … [View More]

1 0

ip express?
by Simon Lyall 08 Jul '01

08 Jul '01

Looks like it's down going off who has died on APE. Can anyone confirm? -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: ip express?
by Lindsay Druett 08 Jul '01

08 Jul '01

Did someone say there was a dead cat in the router ? -----Original Message----- From: Simon Lyall [mailto:simon.lyall(a)ihug.co.nz] Sent: Monday, 9 July 2001 10:51 To: nznog(a)list.waikato.ac.nz Subject: ip express? Looks like it's down going off who has died on APE. Can anyone confirm? -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz ihug, Auckland, NZ | Asst Doorman | Web: … [View More]

1 0

The New Zealand Network Operators' Group
by Donald Neal 08 Jul '01

08 Jul '01

The New Zealand Network Operators' Group The New Zealand Network Operators' Group (NZNOG) has no king, president or formal membership. At present it consists of the subscribers to this mailing list, which anyone is free to join. This list has a little under 250 subscribers, growing by a handful each month. The NZNOG mailing list is provided through a server at The University of Waikato, and is administered by an employee of Telecom NZ Ltd. Neither of these organisations (nor the … [View More]administrator) is responsible for its content. The following non-working email addresses were recently removed from the list. Their owners are welcome to re-subscribe with working addresses. aleki097(a)student.otago.ac.nz brett.telfer(a)telecom.co.nz steve.hawken(a)ngtmail1.netgate.net.nz NZNOG Mailing List Acceptable Use Policy The NZNOG mailing list exists to provide a forum for the exchange of technical information and the discussion of implementation issues that require cooperation among New Zealand network service providers. In order to continue to provide a useful forum for discussion of relevant technical issues, users of the list are asked to respect the following guidelines. 1. Discussion will focus on Internet operational and technical issues. 2. Discussion related to meetings of network service providers is appropriate. 3. Discussion unrelated to these topics is not appropriate. 4. Postings to multiple mailing lists are discouraged. 5. Postings that include foul language, character assassination, and lack of respect for other participants are unacceptable. 6. Blatant product or service marketing is unacceptable. 7. Postings of a political, philosophical or legal nature are discouraged. 8. Postings to the list should be in ASCII or MIME encoded as text/plain. Attachments should not be sent to the list. To present a document, a suitable URL may be referred to. For documents of general interest, the use of proprietary file formats is discouraged. 9. Breaches of list etiquette should be dealt with privately with the offending list user, and should not result in complaints being sent to the list. Mailing List Archives A full archive is available at http://list.waikato.ac.nz/archives/nznog/ To search the archive, see http://list.waikato.ac.nz/archives/search.html (and remember to select nznog). Subscribing to the List To subscribe to the NZNOG list, send email to majordomo(a)list.waikato.ac.nz, where the body of the message reads subscribe nznog There are at present no restrictions on who may subscribe to the list, or even on who may post to the list. Digest Mailing List If you don't wish to receive postings as they are sent, you can instead subscribe to the nznog-digest mailiing list, on which all postings are sent out in a single "digest" every couple of days. Other Activities NZNOG does not at present have other regular activities than this mailing list. Donald Neal NZNOG Mailing List Owner/Administrator/Muggins --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog [View Less]

1 0

ORBS probes continue...
by cw＠f00f.org 05 Jul '01

05 Jul '01

I'm still seeing ORBS probe-messages... when I spoke to Alan last he told me ORBS would probably die as a result of the QSI takeover the the MIS user base. Now, these probe-messages are from one of the offshore probes, so I am left to wonder, migjt ORBS life on, are these remote probes still running waitning to be turned down? --cw --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 9

FW: Shared Registry System Implementation
by Peter Mott 01 Jul '01

01 Jul '01

Please bring this to the attention of folk in your organisation who may have an interest: > -----Original Message----- > From: Donna Hiser [mailto:d.hiser(a)domainz.net.nz] > Sent: Wednesday, 27 June 2001 11:22 a.m. > To: dns(a)2day.com > Subject: Shared Registry System Implementation > > SHARED REGISTRY SYSTEM IMPLEMENTATION > > As you may know ISOCNZ has appointed an SRS Implementation Manager, Rose > Percival, to manage the planning, design and rollout of the … [View More]

1 1

Re: Any Xtra mail admins on NZNOG?
by Ted Grenfell 25 Jun '01

25 Jun '01

That IP is in use by smtp.jabmail.net and is not an Xtra MTA. Jabmail.com NZ Ltd are apparently having some problems with their DNS server(s) at the moment. At 10:19 26/06/2001, Juha Saarinen wrote: >If so, could you please contact me? We have a problem with one MTA >(210.54.238.40) bouncing *all* mail going to it with a "550 - Relaying >prohibited". > >Other MTAs at Xtra receive mail fine. > >-- >Regards, > > >Juha > >PGP fingerprint: >B7E1 CC52 … [View More]

2 1

Any Xtra mail admins on NZNOG?
by Juha Saarinen 25 Jun '01

25 Jun '01

If so, could you please contact me? We have a problem with one MTA (210.54.238.40) bouncing *all* mail going to it with a "550 - Relaying prohibited". Other MTAs at Xtra receive mail fine. -- Regards, Juha PGP fingerprint: B7E1 CC52 5FCA 9756 B502 10C8 4CD8 B066 12F3 9544 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

nz bgp stats, first puny attempt
by Joe Abley 24 Jun '01

24 Jun '01

Hello, I have a few bgp sessions up with a corresponding number of friendly people around the place, and have what I think is a reasonable view of the NZ network. I haven't amassed enough data to do anything particularly interesting yet, but I thought I'd hack one thing together quickly since I've heard a few people asking for it: see http://maggie.automagic.org/ for lists of "NZ networks" and "NZ ASNs" (there are some more precise descriptions on that page). People interested in … [View More]

3 5