- NZNOG - lists.nznog.org

RE: History of Internet in New Zealand to current date (Off Topic)
by fwetyson 27 Mar '01

27 Mar '01

Thanks for the assistance some of you have given I see a note next to the thread that this subject is Off Topic Does that mean I cant raise the question here? If so thats a pity considering the major inovators of Internet here in NZ Appologies Frank Tyson Phone: 64211341826 Fax:+6445635927 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Messages from this list
by fwetyson 27 Mar '01

27 Mar '01

Could someone advise me why I get two copies of every posting to the list Thanks in advance Frank Tyson Phone: 64211341826 Fax:+6445635927 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Attica/Tranzpeer Prefix List
by James Tyson 27 Mar '01

27 Mar '01

Hi all! Attached is an updated prefix list for Tranzpeer[1], which includes Attica and Tranzpeer's customers. Tranzpeer will be moving to it's own AS number shortly, so those of you peering with us will recieve an email shortly asking you to change your peering session with us[2]. Cheers. James Tyson. Self-Deluded Governing Minority, Attica Network Operations. --- [1] Tranzpeer Limited is a wholesale bandwidth provider run by Attica [2] Does anyone know how to make a crisco router run multiple instances of BGP, because that would make it so much easier!

4 6

RE: History of Internet in New Zealand to current date
by Lindsay Druett 27 Mar '01

27 Mar '01

I would have thought the best person to ask about this subject would be John Haulker. Tim Williams seems to remember a lot about what happened... -----Original Message----- From: fwetyson [mailto:fwetyson(a)slingshot.co.nz] Sent: Wednesday, 28 March 2001 09:13 To: nznog(a)list.waikato.ac.nz Subject: History of Internet in New Zealand to current date Ive been lurking around watching the postings and discussions here for the last few months and felt this was the place to pose the following question? Where does one find accurate information regarding the History and Development of the Internet here in NZ ? Most information Ive read (with the exception of postings here) is circa 1997 In recent times there has been many courses in IT commencing in the various technical institutions and locating accurate up to date information has been a major effort The most recent I could find was at http://www.iscr.org.nz/documents/enright.pdf Most others as I said havent been updated prior to 1997 Considering the many years of experience here and the wide range of organisations maybe this needs to be reviewed Finally I appologise if this isnt the place to raise this discussion Frank Tyson Student CyberTechnology Hutt Valley Polytech --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

10 14

RE: History of Internet in New Zealand to current date
by Bart Kindt 27 Mar '01

27 Mar '01

At 09:14 28/03/01 +1200, Lindsay Druett wrote: >I would have thought the best person to ask about this subject would be John >Haulker. > >Tim Williams seems to remember a lot about what happened... > I started Efficient Software Internet in Dunedin in August 1994. Got my backbone via University of Otago, who got theirs from Waikato. John Haulker I talked a lot with in those days :) Nostalgia... Bart Bart Kindt Director The Internet Group Limited --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

History of Internet in New Zealand to current date
by fwetyson 27 Mar '01

27 Mar '01

Ive been lurking around watching the postings and discussions here for the last few months and felt this was the place to pose the following question? Where does one find accurate information regarding the History and Development of the Internet here in NZ ? Most information Ive read (with the exception of postings here) is circa 1997 In recent times there has been many courses in IT commencing in the various technical institutions and locating accurate up to date information has been a major effort The most recent I could find was at http://www.iscr.org.nz/documents/enright.pdf Most others as I said havent been updated prior to 1997 Considering the many years of experience here and the wide range of organisations maybe this needs to be reviewed Finally I appologise if this isnt the place to raise this discussion Frank Tyson Student CyberTechnology Hutt Valley Polytech --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

APE Switch
by Tony Wicks 26 Mar '01

26 Mar '01

Hi all, I note the 2912 switch that constitutes APE is full and has now been supplemented by a Dlink one. While Dick Smith may be quite happy selling these devices to their customers, I don't think it is entirely appropriate to be a central point for New Zealand's Internet traffic. Perhaps the nice people at Cisco ( or another civic minded manufacturer ) would like to donate something more appropriate for the task, like a 3548xl say ? --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

12 14

Ignore: Testing my mailfilter; sorry ;)
by Bart Kindt 25 Mar '01

25 Mar '01

To filter or not to filter, thats the question! Bart Bart Kindt Director The Internet Group Limited --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

mbone stuff
by James Tyson 24 Mar '01

24 Mar '01

Hi all. Just letting everyone know that I have set up a mailling list for NZ Network Operators that wish to discuss the nzmbone stuff without spamming this list. You can subscribe at: https://secure.samizdat.co.nz/mailman/listinfo/mbone-nz or by sending a subscribe message to mbone-nz-request(a)samizdat.co.nz Status update: IHUG & Attica are now live and streaming MP3 content, all content has been restricted to 233/8 space while formulation of a NZ mbone addressing schema. I am still waiting to hear from other ISP's wishing to become involved (hint hint). Cheers. James Tyson --- Samizdat New Media Solutions --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

7 8

New prefix list
by Tony Wicks 19 Mar '01

19 Mar '01

Below is a new prefix list for all of you that we are peering with. Can someone at Clear please post their current list, I get the feeling that my copy is a bit out of date. notes - added - 210.185.16.0/20 le 21,203.9.179.0/24 removed - several cheers ip prefix-list AONZ-networks description networks(a)nz.asiaonline.net ip prefix-list AONZ-networks seq 5 permit 202.14.100.0/24 ip prefix-list AONZ-networks seq 10 permit 210.48.0.0/17 le 18 ip prefix-list AONZ-networks seq 15 permit 192.173.16.0/21 ip prefix-list AONZ-networks seq 25 permit 202.6.84.0/24 ip prefix-list AONZ-networks seq 30 permit 202.12.70.0/24 ip prefix-list AONZ-networks seq 45 permit 202.36.76.0/23 ip prefix-list AONZ-networks seq 60 permit 202.37.85.0/24 ip prefix-list AONZ-networks seq 75 permit 202.37.140.0/22 ip prefix-list AONZ-networks seq 85 permit 202.37.144.0/21 ip prefix-list AONZ-networks seq 115 permit 202.37.197.0/24 ip prefix-list AONZ-networks seq 120 permit 202.37.200.0/22 ip prefix-list AONZ-networks seq 130 permit 202.37.224.0/21 ip prefix-list AONZ-networks seq 150 permit 202.49.144.0/24 ip prefix-list AONZ-networks seq 155 permit 202.50.16.0/20 ip prefix-list AONZ-networks seq 160 permit 203.99.65.0/24 ip prefix-list AONZ-networks seq 165 permit 203.99.66.0/24 ip prefix-list AONZ-networks seq 170 permit 203.99.71.0/24 ip prefix-list AONZ-networks seq 175 permit 210.54.0.0/22 ip prefix-list AONZ-networks seq 180 permit 138.235.0.0/16 ip prefix-list AONZ-networks seq 185 permit 203.9.179.0/24 ip prefix-list AONZ-networks seq 190 permit 203.9.180.0/24 ip prefix-list AONZ-networks seq 195 permit 210.185.16.0/20 le 21 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Wireless Internet Training Program Development
by Paul Ravi Kumar 15 Mar '01

15 Mar '01

Sir, I am a wireless consultant from India with about 8 years of communications experience. I am conducting research on "Anywhere anytime mobile/wireless Internet". I wish to know the details of your Wireless Internet Training Program Development. Kindly respond with necessary details as to enable me to enrol for the program. Regards Paul Ravi Kumar _________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

(Fwd) The Webserver Plan
by Sue Leader 15 Mar '01

15 Mar '01

Greetings all - We have what I'm sure will be good news.... ------- Forwarded message follows ------- From: John Vorstermans <tech(a)isocnz.org.nz> Organization: Internet Society of NZ On Friday evening 16th March ISOCNZ will be moving their webserver in-house to their new premises. At this time the new "look and feel" site will come live. The changeover requires alterations to the ISOCNZ DNS which can take anywhere from several hours to several days to filter around the different ISPs etc. (depending on DNS refresh settings). This means that some people may not be able to get to the new site till later in the weekend. Cheers John -- John Vorstermans - Technical Manager ISOCNZ (Internet Society of New Zealand Inc) PO Box 11-881, Wellington ------- End of forwarded message ------- Cheers Sue Sue Leader - Executive Director Internet Society of New Zealand Inc PLEASE NOTE CHANGES: Voice: +64-4-472-1600 Fax: +64-4-472-1207 Level 4, Hibernian Building, 89 Willis Street (P.O.Box 11-881) Wellington http://www.isocnz.org.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 4

VOTE: .bank.nz
by Sue Leader 14 Mar '01

14 Mar '01

Greetings all I've just returned from the Melbourne ICANN meeting and have been offline because of equipment failure, so I apologise for the delay in posting this. The voting for the .bank.nz opened on Monday morning. If you wish to vote on this application please read the 'how to vote' information at: http://www.isocnz.org.nz/consult/2LD/how_to_vote.html. Please note to vote you must have an email address that ends in .nz. Voting will be open for 14 days and any questions regarding the voting can be sent to the Voting Officer at vote-help(a)isocnz.org.nz Cheers Sue Sue Leader - Executive Director ISOCNZ (Internet Society of New Zealand Inc) Exe.Dir(a)isocnz.org.nz Voice: +64-4-801-6256 http://www.isocnz.org.nz PLEASE NOTE CHANGE: P.O.Box 11-881, Wellington --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: Kiwi spammer "Deco Marketing Solutions"
by Michael White 13 Mar '01

13 Mar '01

Just what the Internet needs, more bad press. Be careful the media is evil :) Mike > ---------- > From: Juha Saarinen > Sent: Wednesday, 14 March 2001 10:26 AM > To: Martin D Kealey; nznog(a)list.waikato.ac.nz > Cc: Russell_Brown(a)idg. co. nz; Paul_Brislen(a)idg. co. nz; Darren > Greenwood; Stephen Bell > Subject: RE: Kiwi spammer "Deco Marketing Solutions" > > Martin, > > I've cc'ed some IDG reporters, in the hope that they might pick up on this > and cobble together a "Scourge Of The Internet" type of expose... ;-) > > -- Juha > > :: -----Original Message----- > :: From: owner-nznog(a)list.waikato.ac.nz > :: [mailto:owner-nznog(a)list.waikato.ac.nz]On Behalf Of Martin D Kealey > :: Sent: Wednesday, March 14, 2001 10:07 AM > :: To: nznog(a)list.waikato.ac.nz > :: Subject: Kiwi spammer "Deco Marketing Solutions" > :: > :: > :: Heads up, a local spam operation... > :: > :: Has anyone else been receiving spam from "email-prom.net" [12.42.24.22] > :: lately? The usual crap about how X million addressesee will buy > stuff... > :: > :: In this latest case the phone and fax numbers given are in > Ponsonby/Grey > :: Lynn and Orewa/Silverdale/Whangaparaoa areas respectively. > :: > :: A quick scan on call-minder for 09-3608038 reveals a mailbox > :: labelled "Deco > :: Marketing Solutions" (no information for the fax number 09-4268337). > The > :: previous message used a mailbox in North America, so I don't expect > they > :: actually live here, but on the off chance that they do, does anyone > know > :: anything about these guys? > :: > :: Normally I'd just firewall the IP, but if there's a chance of nailing > :: someone local I'll give them enough rope to hang themselves... > :: > :: And any suggestions as to what we should do with these two phone > numbers? > :: > :: -Martin > :: > :: ---------- Forwarded message ---------- > :: Received: from email-prom.net ([12.42.24.23]) > :: by smtp.sig.net.nz (8.9.3/NZSFI-20000705) with SMTP id VAA01285 > :: for <martin(a)kurahaupo.gen.nz>; Tue, 13 Mar 2001 21:01:37 +1300 > :: X-Authentication-Warning: mae.sub.net.nz: Host [12.42.24.23] > :: claimed to be > :: email-prom.net > :: Subject: FWD: Last Biz To Business Disc > :: Content-Type: text/plain; > :: charset=us-ascii > :: Content-Transfer-Encoding: 8BIT > :: X-Mailer: QI03122001MDNZ > :: Message-Id: <gcbinx81s4pg0grx.142o5n3n(a)email-prom.net> > :: Date: Tue, 13 Mar 2001 03:06:31 +0000 > :: Reply-To: md2000nz(a)email-prom.net > :: To: md2000nz(a)email-prom.net > :: > :: > :: You can now access contact data for over 8.5 Million Records. > :: All of them > :: have their own .com .org or .net domain name, making them > :: serious prospects > :: for Internet business. > :: > :: Our data base readily accessible on CD-Rom, list the Names, Contact > :: Information, Physical Address, Phone #, Fax #, SIC Industry > :: Code, URL (Domain > :: Name), and Contact Email Address which you can use to efficiently > target > :: companies worldwide. > :: > :: Over 8.5 Million Physical Addresses let you target businesses by > :: Country, > :: State, City, Province, Zip Code, Area Code or by using the SIC > :: Industry Code. > :: The data comes in a Comma-Delimited ASCII format which makes it easy to > :: manipulate and Import/Export records to your Contact-Management, > :: Spreadsheet, > :: analysis and Broadcasting Applications. > :: > :: > :: Please send me more info about: > :: > :: [ ] Master Disc 2000 8.5 Million Records, Cost US$799.00 > :: [ ] Online Updates & Download Access Cost US$199.00 (Annually) > :: [ ] Commercial Email Services & Products > :: > :: Note: Not all records contain complete data, call for breakdowns. > :: > :: For more details on Database, please call: > :: > :: #011-649-360-7038 (International) > :: > :: or fax form below to: > :: #011-649-426-8337 > :: > :: (Make Sure To Mention Reseller Id #1629 When Calling) > :: > :: > :: Company name: ___________________________________________ > :: > :: > :: Web Site Url: ___________________________________________ > :: > :: > :: Contact name: ___________________________________________ > :: > :: > :: Email: __________________________________________________ > :: > :: > :: Phone: __________________________________________________ > :: > :: > :: Fax: ___________________________________________________ > :: > :: > :: Street address: _________________________________________ > :: > :: > :: City, Zip, State: _______________________________________ > :: > :: > :: Country: ________________________________________________ > :: > :: > :: Check the following that apply: > :: > :: _____ Please Notify Me Of Online Web Site & Register Me > :: For Access Using The > :: Information Above. > :: > :: > :: Also Please, Send Additional Information on: > :: > :: _____ Online Adult & Gaming Owner/Operaters > :: _____ Online Adult Subscribers & Online Gamers Databases > :: _____ Online Billing/Credit Card Processing > :: _____ Emailing Services and Databases > :: _____ Search Engine Positioning > :: _____ International Contact Lists > :: _____ Buying / Selling Traffic > :: _____ Web Site Hosting Services > :: _____ Other:_______________________________ > :: > :: > :: ####################################################################### > :: To discontinue receipt of further notice and to be removed from our > :: database, please reply with the word "Remove" in subject. > :: > :: Any attempts to disrupt the removal email address etc., will not allow > :: us to be able to retrieve and process the remove requests. > :: ####################################################################### > :: > :: > :: .031201 > :: > :: --------- > :: To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > :: where the body of your message reads: > :: unsubscribe nznog > > > --------- > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > where the body of your message reads: > unsubscribe nznog > > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Anybody know of a 3Ware importer in NZ?
by Simon Blake 13 Mar '01

13 Mar '01

Apologies for the non netops related, but this seems a good place to ask - does anybody know of an importer of 3Ware IDE raid cards in NZ? Cheers Si --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Kiwi spammer "Deco Marketing Solutions"
by Martin D Kealey 13 Mar '01

13 Mar '01

Heads up, a local spam operation... Has anyone else been receiving spam from "email-prom.net" [12.42.24.22] lately? The usual crap about how X million addressesee will buy stuff... In this latest case the phone and fax numbers given are in Ponsonby/Grey Lynn and Orewa/Silverdale/Whangaparaoa areas respectively. A quick scan on call-minder for 09-3608038 reveals a mailbox labelled "Deco Marketing Solutions" (no information for the fax number 09-4268337). The previous message used a mailbox in North America, so I don't expect they actually live here, but on the off chance that they do, does anyone know anything about these guys? Normally I'd just firewall the IP, but if there's a chance of nailing someone local I'll give them enough rope to hang themselves... And any suggestions as to what we should do with these two phone numbers? -Martin ---------- Forwarded message ---------- Received: from email-prom.net ([12.42.24.23]) by smtp.sig.net.nz (8.9.3/NZSFI-20000705) with SMTP id VAA01285 for <martin(a)kurahaupo.gen.nz>; Tue, 13 Mar 2001 21:01:37 +1300 X-Authentication-Warning: mae.sub.net.nz: Host [12.42.24.23] claimed to be email-prom.net Subject: FWD: Last Biz To Business Disc Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 8BIT X-Mailer: QI03122001MDNZ Message-Id: <gcbinx81s4pg0grx.142o5n3n(a)email-prom.net> Date: Tue, 13 Mar 2001 03:06:31 +0000 Reply-To: md2000nz(a)email-prom.net To: md2000nz(a)email-prom.net You can now access contact data for over 8.5 Million Records. All of them have their own .com .org or .net domain name, making them serious prospects for Internet business. Our data base readily accessible on CD-Rom, list the Names, Contact Information, Physical Address, Phone #, Fax #, SIC Industry Code, URL (Domain Name), and Contact Email Address which you can use to efficiently target companies worldwide. Over 8.5 Million Physical Addresses let you target businesses by Country, State, City, Province, Zip Code, Area Code or by using the SIC Industry Code. The data comes in a Comma-Delimited ASCII format which makes it easy to manipulate and Import/Export records to your Contact-Management, Spreadsheet, analysis and Broadcasting Applications. Please send me more info about: [ ] Master Disc 2000 8.5 Million Records, Cost US$799.00 [ ] Online Updates & Download Access Cost US$199.00 (Annually) [ ] Commercial Email Services & Products Note: Not all records contain complete data, call for breakdowns. For more details on Database, please call: #011-649-360-7038 (International) or fax form below to: #011-649-426-8337 (Make Sure To Mention Reseller Id #1629 When Calling) Company name: ___________________________________________ Web Site Url: ___________________________________________ Contact name: ___________________________________________ Email: __________________________________________________ Phone: __________________________________________________ Fax: ___________________________________________________ Street address: _________________________________________ City, Zip, State: _______________________________________ Country: ________________________________________________ Check the following that apply: _____ Please Notify Me Of Online Web Site & Register Me For Access Using The Information Above. Also Please, Send Additional Information on: _____ Online Adult & Gaming Owner/Operaters _____ Online Adult Subscribers & Online Gamers Databases _____ Online Billing/Credit Card Processing _____ Emailing Services and Databases _____ Search Engine Positioning _____ International Contact Lists _____ Buying / Selling Traffic _____ Web Site Hosting Services _____ Other:_______________________________ ####################################################################### To discontinue receipt of further notice and to be removed from our database, please reply with the word "Remove" in subject. Any attempts to disrupt the removal email address etc., will not allow us to be able to retrieve and process the remove requests. ####################################################################### .031201 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

PIM
by James Tyson 13 Mar '01

13 Mar '01

Can anyone who fires up a pim router on APE or WIX please email me so that I can update the website. Cheers. James Tyson. Self-Deluded Governing Minority, Attica Network Operations. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 4

Re: Telecom - Clear peering bandwidth
by Peter Mott 12 Mar '01

12 Mar '01

> -----Original Message----- > From: Alan Mitford-Taylor [mailto:Alan.Mitford-Taylor(a)telecom.co.nz] > Sent: Wednesday, 7 March 2001 11:52 a.m. > To: peter.mott(a)2day.com > > the planned improvement in the Clear peering bandwidth still awaits > clear's signature on a contract, we have link in place and ready to go > but can not proceed without legal sign off, unfortunately this has been > situation since last October so I don't know when it will be resolved, > but continue to chase it. I guess the same contract is also waiting Telecom's sig Peter Mott Chief Enthusiast 2day.com -/- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

7 7

traffic analysis by protocol
by Craig Anderson 12 Mar '01

12 Mar '01

Hi. I'm looking for off the shelf commercial or otherwise software for monitoring traffic. In particular, i'd like graphs showing the total traffic and the % traffic that is HTTP, SMTP, FTP, etc., and TCP, UDP, ICMP etc. splits. Of course also split by inbound/outbound, remote site location (NZ, International), and local network (i.e. by client of an ISP). Both near real-time data and historical analysis. I've found several protocol analysers that will give real-time and historical graphs by protocol, but don't seem to have any real facilities for breaking this down much further. Does anyone know of where i can find such software? Thanks, -Craig --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

8 9

Mbone pages
by James Tyson 12 Mar '01

12 Mar '01

I have updated: http://mbone.samizdat.co.nz/isps.html Cheers. James Tyson. Self-Deluded Governing Minority, Attica Network Operations. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

nzmbone
by James Tyson 12 Mar '01

12 Mar '01

Hey matey-peeps. Just letting you all know that I am right now listening to a multicast MP3 stream of BFM kindly casted over APE by IHUG (Thanks David). I'm still getting the greeblies out of my multicast routing, but it's getting there. So who else feels like putting up some content? (I was thinking of casting Triangle TV). Cheers. James Tyson. Self-Deluded Governing Minority, Attica Network Operations. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Spammers like Xtra?
by Keith Davidson 06 Mar '01

06 Mar '01

Is anyone else experiencing problems with Xtra failing to take meaningful action against spammers? My ISP has had complaints about an Xtra user, computerkids(a)xtra.co.nz and traditional contact with abuse(a)xtra results in nothing more than slaps over the wrist with wet bus tickets. HISTORY OF UCE FROM Mark Lancaster Nightingale Press 335 Beechey Street, Pirongia Tel/Fax: 07 871 9691 Email computerkidz(a)xtra.co.nz First UCE from him received on 13 February. Complaint lodged abuse(a)xtra. Second UCE received on 18 February. Complaint lodged abuse(a)xtra Third UCE received on 7 March. Actual copy of UCE below sig. My complainant states: "I then rang Xtra (finally got through to Customer Support desk) and advised that I wished to verbally complain about one of their customers spamming and that I had laid complaints on two occasions and seemingly no action had been taken. The person on their help desk took the email address of the spammer and then advised me that this person had had two warnings and I should email abuse(a)xtra again. I said that was not satisfactory and wondered how many warnings one of their users had to get before any action was taken by xtra. The Help Desk clerk said he would check and put me on hold for a few minutes. When he came back he advised me that quite a number of warnings had to be issued before any action was taken. He suggested I filter the perpetrator and I told him that that didn't fix the problem. He asked if there was anything abusive or rude in the email and I advised that whilst there was nothing along those lines that I personally found uce offensive. He advised me to lodge a further complaint with abuse(a)xtra.co.nz and I told him that I had warned xtra on a previous occasion that if no action was forthcoming to solve the problem that I intended to take the matter further." Does anyone in Xtra take these issues seriously? It is just nonsensical for Xtra staff to suggest filtering etc - it doesn't stop the source. Is the $25 per month so important to Xtra's revenue that they wont take real action? Or does Xtra like being known as a "spam friendly" ISP? Most ISP's seem to work on "2 strikes and you're out", mine included. Just what does it take for Xtra to kick someone? Anyone else having similar problems from this quarter? Any suggestions of a method of escalating the issue that might get a resolution? Keith Davidson ________________________________________________ Return-Path: <computerkidz(a)xtra.co.nz> Received: from mta1-rme.xtra.co.nz (mta1-rme.xtra.co.nz [203.96.92.1]) by kiwi.wise.net.nz (8.9.3/8.9.3/Debian/GNU) with ESMTP id KAA32673 for <office(a)wairarapa.school.nz>; Wed, 7 Mar 2001 10:15:02 +1300 Received: from marklanc ([210.54.202.229]) by mta1-rme.xtra.co.nz with SMTP id <20010306211551.EQOL2261674.mta1-rme.xtra.co.nz(a)marklanc>; Wed, 7 Mar 2001 10:15:51 +1300 From: "Mark Lancaster" <computerkidz(a)xtra.co.nz> To: <computerkidz(a)xtra.co.nz> Subject: PLEASE FORWARD THIS TO THE MATHS DEPT. - THANK YOU Date: Wed, 7 Mar 2001 10:10:19 +1300 Message-ID: <NCBBJGLIOPJEFADAPBMEIEANIJAA.computerkidz(a)xtra.co.nz> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0014_01C0A6EE.D1102F60" X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 X-UIDL: +lP!!HH!#!/9d!!D:("! This is a multi-part message in MIME format. ------=_NextPart_000_0014_01C0A6EE.D1102F60 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Nightingale Press 335 Beechey Street, Pirongia Tel/Fax: 07 871 9691 Hi I would just like to tell you about a new series of Blackline Masters we have just released called "MATHS OUTCOMES". The strands they cover throughout the series are - SPACE, MEASUREMENT, NUMBER and WORKING MATHEMATICALLY. There are 7 books in the series starting from Kindy (early stage 1) right through to Upper Primary levels. Each book contains 53 pages of photocopiable worksheets covering all the above topics. All the activities in this set of Blackline Masters are used to support lessons introduced by the teacher in class. The work presented on each page has been carefully designed to provide a different approach to maths by involving memory games , matching activities and it allows the child to offer reasoning for their answers and choices. It is designed to help children understand, consolidate and extend concepts and skills. The price is $29.95 per book and they are all available on approval. If you would like to order any (or all) of the books in this superb series, please just return this email stating copies required, the name and address of your school and any order numbers, or you could order by fax/phone. Many thanks for taking the time to read this email. Mark ------=_NextPart_000_0014_01C0A6EE.D1102F60 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <snip endless html rubbish> --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

NLX PSU's
by Matt Camp 06 Mar '01

06 Mar '01

Might be slightly off topic, but does anyone know where to source power supplies for NLX type PC cases? Insite used to have them, but since their merger with Renaissance, have obsoleted the product line. --- Matt Camp --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Telecom Peering
by Tony Wicks 05 Mar '01

05 Mar '01

Hi all, I have been chasing my Telecom account Manager for months to get some progress on this, so I thought I would throw it out here and see where every one else is with this. We currently peer with all major ISP's and backbone providors over either or both WIX and APE. The notable exception being Telecom Netgate ( we do peer directly with Xtra on WIX ). We are paying Telecom currently for a PVC to Netgate for peering with them and I am unhappy for this to continue. ( especially as we have almost twice the outgoing traffic to them as we recieve from them ! ). I have had nothing more than "I'll get back to you" when attempting to initiate peering with Telecom ( not Xtra ). It seems very strange to me that Clear, Telstra and everyone else is responsive and happy to work for the greater good of the Internet users in the country, but Telecom only seems interested if someone else is paying for it. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 7

www.apnic.net
by Tony Wicks 04 Mar '01

04 Mar '01

Can anyone get to this website at the moment ? I can't seem to make a connection ( apart from cached objects ) from NZ, AU or the US to the site. kappa:staff/tonyw 4:45pm > dig www.apnic.net ; <<>> DiG 8.3 <<>> www.apnic.net ;; res options: init recurs defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 6 ;; QUERY SECTION: ;; www.apnic.net, type = A, class = IN ;; ANSWER SECTION: www.apnic.net. 30m36s IN A 203.37.255.97 ;; AUTHORITY SECTION: apnic.net. 30m36s IN NS ns.apnic.net. apnic.net. 30m36s IN NS svc00.apnic.net. apnic.net. 30m36s IN NS ns.ripe.net. apnic.net. 30m36s IN NS rs.arin.net. ;; ADDITIONAL SECTION: ns.apnic.net. 1h5m19s IN A 203.37.255.97 ns.apnic.net. 30m36s IN AAAA ::ffff:203.37.255.97 svc00.apnic.net. 1d18h6m27s IN A 202.12.28.131 svc00.apnic.net. 30m36s IN AAAA ::ffff:202.12.28.131 ns.ripe.net. 1d9h57m19s IN A 193.0.0.193 rs.arin.net. 1d18h6m27s IN A 192.149.252.21 ;; Total query time: 35 msec ;; FROM: kappa to SERVER: default -- 205.201.44.9 ;; WHEN: Sun Mar 4 16:45:14 2001 ;; MSG SIZE sent: 31 rcvd: 248 kappa:staff/tonyw 4:45pm > traceroute 203.37.255.97 traceroute to 203.37.255.97 (203.37.255.97), 30 hops max, 40 byte packets 1 master-gw.lm.net (205.201.1.1) 24.433 ms 19.029 ms 4.986 ms 2 263.ATM1-0.GW5.PIT1.alter.net (157.130.22.193) 516.424 ms 453.962 ms 502.864 ms 3 539.at-2-0-0.XR2.DCA1.ALTER.NET (152.63.38.178) 33.179 ms 25.498 ms 13.896 ms 4 294.at-7-1-0.XR2.DCA8.ALTER.NET (146.188.163.26) 22.794 ms 28.986 ms 25.275 ms 5 POS7-0.BR5.DCA8.ALTER.NET (152.63.37.45) 9.957 ms 10.352 ms 12.454 ms 6 137.39.52.158 (137.39.52.158) 429.94 ms 552.788 ms 521.643 ms 7 so-3-0-0.washdc3-nbr1.bbnplanet.net (4.24.4.169) 105.349 ms 188.541 ms 155.406 ms 8 so-7-0-0.washdc3-nbr2.bbnplanet.net (4.24.10.30) 134.572 ms 190.48 ms 183.578 ms 9 p9-0.phlapa1-br2.bbnplanet.net (4.24.10.186) 154.443 ms 135.832 ms 139.77 ms 10 p15-0.phlapa1-br1.bbnplanet.net (4.24.10.89) 476.805 ms 521.494 ms 458.769 ms 11 p13-0.nycmny1-nbr2.bbnplanet.net (4.24.10.178) 36.583 ms 34.301 ms 14.657 ms 12 p15-0.nycmny1-nbr1.bbnplanet.net (4.24.10.209) 492.356 ms 481.979 ms 427.66 ms 13 p4-0.snjpca1-br1.bbnplanet.net (4.24.9.157) 141.027 ms 100.905 ms 105.643 ms 14 p10-0.lsanca2-br1.bbnplanet.net (4.24.8.26) 510.23 ms 562.834 ms 580.358 ms 15 p15-0.lsanca2-br2.bbnplanet.net (4.24.5.46) 549.424 ms 535.577 ms 563.447 ms 16 p1-0.lsanca1-cr9.bbnplanet.net (4.24.5.202) 558.399 ms 468.532 ms 507.453 ms 17 p0-0.telstra4.bbnplanet.net (4.24.206.42) 137.123 ms 203.719 ms 207.281 ms 18 Pos2-3.pad-core3.Sydney.telstra.net (203.50.126.45) 749.915 ms 654.554 ms 735.379 ms 19 GigabitEthernet4-1.chw-core2.Sydney.telstra.net (203.50.6.201) 612.906 ms 660.024 ms 715.141 ms 20 Pos2-0.cha-core4.Brisbane.telstra.net (203.50.6.118) 357.183 ms 262.34 ms 264.331 ms 21 GigabitEthernet4-0.cha-core3.Brisbane.telstra.net (203.50.45.1) 307.158 ms 318.389 ms 412.24 ms 22 Fddi0-0.cha8.Brisbane.telstra.net (139.130.247.230) 349.427 ms 305.048 ms 260.397 ms 23 apnic1.lnk.telstra.net (139.130.64.98) 835.272 ms 726.571 ms 770.458 ms 24 ns.apnic.net (203.37.255.97) 711.432 ms 782.982 ms 735.846 ms kappa:staff/tonyw 4:46pm > lynx www.apnic.net Alert!: Unable to connect to remote host. lynx: Can't access startfile http://www.apnic.net/ kappa:staff/tonyw 4:48pm > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 5

The New Zealand Network Operators' Group
by Donald Neal 01 Mar '01

01 Mar '01

The New Zealand Network Operators' Group The New Zealand Network Operators' Group (NZNOG) has no king, president or formal membership. At present it consists of the subscribers to this mailing list, which anyone is free to join. This list has just over 210 subscribers, growing by a handful each month. The NZNOG mailing list is provided through a server at The University of Waikato, and is administered by an employee of Telecom NZ Ltd. Neither of these organisations (nor the administrator) is responsible for its content. NZNOG Mailing List Acceptable Use Policy The NZNOG mailing list exists to provide a forum for the exchange of technical information and the discussion of implementation issues that require cooperation among New Zealand network service providers. In order to continue to provide a useful forum for discussion of relevant technical issues, users of the list are asked to respect the following guidelines. 1. Discussion will focus on Internet operational and technical issues. 2. Discussion related to meetings of network service providers is appropriate. 3. Discussion unrelated to these topics is not appropriate. 4. Postings to multiple mailing lists are discouraged. 5. Postings that include foul language, character assassination, and lack of respect for other participants are unacceptable. 6. Blatant product or service marketing is unacceptable. 7. Postings of a political, philosophical or legal nature are discouraged. 8. Postings to the list should be in ASCII or MIME encoded as text/plain. Attachments should not be sent to the list. To present a document, a suitable URL may be referred to. For documents of general interest, the use of proprietary file formats is discouraged. 9. Breaches of list etiquette should be dealt with privately with the offending list user, and should not result in complaints being sent to the list. Mailing List Archives A full archive is available at http://list.waikato.ac.nz/archives/nznog/ To search the archive, see http://list.waikato.ac.nz/archives/search.html (and remember to select nznog). Subscribing to the List To subscribe to the NZNOG list, send email to majordomo(a)list.waikato.ac.nz, where the body of the message reads subscribe nznog There are at present no restrictions on who may subscribe to the list, or even on who may post to the list. Digest Mailing List If you don't wish to receive postings as they are sent, you can instead subscribe to the nznog-digest mailiing list, on which all postings are sent out in a single "digest" every couple of days. Other Activities NZNOG does not at present have other regular activities than this mailing list, though the administrator is on the hunt for presenters for the annual Uniforum NZ conference, to be held in the second half of the year. Donald Neal NZNOG Mailing List Owner/Administrator/Muggins --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Reminder: SRS Green Paper Closes Tomorrow
by Sue Leader 01 Mar '01

01 Mar '01

Greetings Just a reminder that submissions for the SRS Green Paper close at 5pm tomorrow Friday March 2. Submissions should be sent direct to exe.dir(a)isocnz.org.nz. Cheers Sue Sue Leader - Executive Director ISOCNZ (Internet Society of New Zealand Inc) Exe.Dir(a)isocnz.org.nz Voice: +64-4-801-6256 http://www.isocnz.org.nz PLEASE NOTE CHANGE: P.O.Box 11-881, Wellington --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

NZ Network List
by Pete 01 Mar '01

01 Mar '01

Hiyas Does anyone on here keep an up-to-date list of IP networks that are considered to be 'inside NZ'. Ie some carriers charge for International traffic but not National and I was wondering if anyone had a list of what is considered 'National' ? Rgds, Pete Pete Mundy - Technician Advanced Communications +64-3-546-9169 / +64-25-480-840 E-Mail: Pete(a)AdvComm.Co.NZ --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

Cisco IOS Advisory
by Roger De Salis 27 Feb '01

27 Feb '01

Here is the official word... - We all agree that ATM is evil (thanks to Chris Wedgewood for those thoughts) and Arron agrees that he won't let Dean wind him up over the respective merits of the larger C and J boxes. (and they promise to conduct this meaningful dialog off-line) >Sender: nobody(a)cisco.com >From: Cisco Systems Product Security Incident Response Team <psirt(a)cisco.com> >To: internal-security-announce(a)cisco.com >Cc: psirt(a)cisco.com >Subject: Cisco Security Advisory: Cisco IOS Software SNMP Read-Write > ILMI Community String Vulnerability >Date: Tuesday, 27 Feb 2001 04:00:00 -0500 (EST) > > Cisco IOS Software SNMP Read-Write ILMI Community String Vulnerability > Revision 1.0: INTERIM > For Public Release 2001 February 27 04:00 US/Eastern (UTC+0500) > _______________________________________________________________ > >Summary > > Cisco IOS software releases based on versions 11.x and 12.0 contain > a defect that allows a limited number of SNMP objects to be viewed > and modified without authorization using a undocumented ILMI > community string. Some of the modifiable objects are confined to the > MIB-II system group, such as "sysContact", "sysLocation", and > "sysName", that do not affect the device's normal operation but that > may cause confusion if modified unexpectedly. The remaining objects > are contained in the LAN-EMULATION-CLIENT and PNNI MIBs, and > modification of those objects may affect ATM configuration. An > affected device might be vulnerable to a denial-of-service attack if > it is not protected against unauthorized use of the ILMI community > string. > > The vulnerability is only present in certain combinations of IOS > releases on Cisco routers and switches. ILMI is a necessary > component for ATM, and the vulnerability is present in every IOS > release that contains the supporting software for ATM and ILMI > without regard to the actual presence of an ATM interface or the > physical ability of the device to support an ATM connection. > > To remove this vulnerability, Cisco is offering free software > upgrades for all affected platforms. The defect is documented in > DDTS record CSCdp11863. > > In lieu of a software upgrade, a workaround can be applied to > certain IOS releases by disabling the ILMI community or "*ilmi" view > and applying an access list to prevent unauthorized access to SNMP. > Any affected system, regardless of software release, may be > protected by filtering SNMP traffic at a network perimeter or on > individual devices. > > This notice will be posted at > http://www.cisco.com/warp/public/707/ios-snmp-ilmi-vuln-pub.shtml. > >Affected Products > > The vulnerability is present only in certain releases of Cisco IOS > Software versions 11.x and 12.0 for router and switch products that > include support for Asynchronous Transfer Mode (ATM) networking and > Interim Local Management Interface (ILMI), and it is present without > regard to any physical capability for supporting an ATM interface. > > Cisco IOS Software versions based on 10.3 and earlier do not contain > the vulnerability. The defect was introduced in 11.0(0.2). All Cisco > IOS software releases of 12.1 and later have been repaired and are > not vulnerable to the defect described in this advisory. > > To determine the software running on a Cisco product, log in to the > device and issue the command "show version" to display the system > banner. Cisco IOS software will identify itself as "Internetwork > Operating System Software" or simply "IOS (tm)". The image name will > be displayed between parentheses, usually on the next line of > output, followed by "Version" and the IOS release name. Other Cisco > devices will not have the "show version" command or will give > different output. > > The following example identifies a Cisco product running IOS release > 12.0(3) with an installed image name of C2500-IS-L: > > Cisco Internetwork Operating System Software IOS (tm) > 2500 Software (C2500-IS-L), Version 12.0(3), RELEASE SOFTWARE > > The device is not vulnerable to the defect described in this > advisory since the model 2500 router is specifically excluded in the > list of unaffected products shown below. > > Cisco devices that may be running an affected IOS software release > include, but are not limited to: > > * Cisco 1400 and 1700 series. > > * Cisco 2600 (except that c2600-c-mz, c2600-d-mz, c2600-i-mz, > c2600-io3-mz, and c2600-ix-mz images are not vulnerable). > > * Catalyst 2900 ATM, 2900XL, and 2948g series. > > * Cisco 3620 (except that c3620-d-mz, c3620-i-mz, c3620-io3-mz, > and c3620-ix-mz images are not vulnerable). > > * Cisco 3640 (except that c3640-d-mz, c3640-i-mz, c3640-io3-mz, > and c3640-ix-mz images are not vulnerable). > > * Cisco 3660 (except that c3660-d-mz, c3660-i-mz, and c3660-ix-mz > images are not vulnerable). > > * Cisco MC3810 (except that mc3810-i-mz, mc3810-is-mz, > mc3810-is56i-mz, and mc3810-js-mz images are not vulnerable). > > * Catalyst 4232, 4840g, 5000 RSFC series switches. > > * Cisco 4500, 4700, and 5800 DSC series. > > * Cisco 6200, 6400 NRP, and 6400 NSP series. > > * Catalyst MSM (c6msm), 6000 Hybrid Mode (c6msfc), and 6000 Native > Mode (c6sup). > > * Cisco RSM, 7000, 7010, 7100, 7200, ubr7200, and 7500 series. > > * Catalyst 8510CSR, 8510MSR, 8540CSR, and 8540MSR series. > > * Cisco 10000 ESR and 12000 GSR series. > > * LS1010 and Cisco 6260-NI2. > > * DistributedDirector (except that igs-w3 images are not > vulnerable). > > Cisco products that are not affected by this vulnerability either > because they have no support for ATM and ILMI, or because they do > not run IOS include, but are not limited to: > > * Catalyst ATM blade (runs possibly affected code, but an SNMP > connection to the blade is not possible). > > * Cisco 800 and 805 series. > > * Cisco Universal Broadband Routers ubr900 and ubr920. > > * Cisco 1003, 1004, and 1005 series. > > * Cisco 1600, 2500, 2800, 4000 series. > > * Cisco 2500 Fixed Frad. > > * Cisco 3800 (not to be confused with MC3810). > > * Cisco 5100, 5200, and 5300 series access servers. > > * Catalyst 6000 Supervisor Module. > > * Cisco PIX Firewall. > > * Aironet and Cisco/Aironet wireless products. > > * CS11000, Cache Engine, LocalDirector, and network scaling > products (except that the Distributed Director might be > affected). > > * VPN products such as Altiga concentrators. > > * Host-based network management or access management products. > > * Cisco IP Telephony and telephony management software (except > those that are hosted on a vulnerable IOS platform). > > * Voice gateways and convergence platforms (except those that are > hosted on a vulnerable IOS platform). > > * Optical switch products such as the ONS 15000 series. > >Details > > ILMI (Interim Local Management Interface) is an independent industry > standard used for configuration of ATM (Asynchronous Transfer Mode) > interfaces. The standard specifies the use of mechanisms and formats > previously defined by SNMP (Simple Network Management Protocol). > Although it is based on SNMP, ILMI communication actually occurs > using a transport other than IP (Internet Protocol) that traverses > only the physical ATM link. ILMI is essential to functions such as > ATM auto-discovery and LANE (LAN Emulation). > > SNMP "objects" are variables that are organized into a MIB > (Management Information Base). The MIB has a tree structure and > contains both operational (read-only) data as well as configuration > (read-write) options. By specifying a community string of "ILMI" in > an SNMP request, access can be obtained to read the objects in three > specific parts of the overall management tree structure on any > device affected by this vulnerability: the MIB-II system group, the > LAN-EMULATION-CLIENT MIB, and the PNNI (Private Network-to-Network > Interface) MIB. A subset of objects in each part can be modified > using the same "ILMI" community string. > > The MIB-II system group contains basic information about the device > itself. The number of objects that can be modified is limited. > Examples include: > > * system.sysContact: The contact information for the person or > organization responsible for managing the device. > > * system.sysLocation: A description of the physical location where > the device is installed or operating. > > * system.sysName: The hostname of the device, how it identifies > itself at the console prompt. (This might not be the same name > by which the device is known to other hosts on the network.) > > Most of the objects in the system MIB are read-only and cannot be > changed via SNMP, such as the time elapsed since the previous > restart and textual descriptions of the device's hardware and > software. > > Numerous objects can be viewed in the LAN-EMULATION-CLIENT MIB and > PNNI MIB, and modification of some of the read-write objects can > have an affect on ATM operation of the device. The objects in the > LAN-EMULATION-CLIENT MIB can only be viewed or modified if LANE has > already been configured on the device. > > Access to SNMP in Cisco IOS software can be limited by applying > access control lists (ACLs), by modifying or removing the SNMP view, > by removing the community string from the running configuration, or > by disabling the SNMP service. Any SNMP query that does not meet the > criteria for access is promptly discarded when such protective > measures are in place. If a query does meet the criteria for access, > then a response is formulated and sent. > > It is possible to configure the device so that the ILMI community > string is unavailable in all IOS 11.1 and higher releases. The > particular method selected to accomplish this depends on the > specific IOS release and configuration. > > This defect is documented as CSCdp11863. The vulnerability is > repaired by imposing a test such that an SNMP request using the > "ILMI" community string will only be recognized if it has been > transported by ILMI. > > ATM functionality was added in various 10.x releases of Cisco IOS > software. However, the function containing the defect was introduced > when support for ILMI and other ATM features was added in IOS > release 11.0(0.2). Therefore, all prior releases are not vulnerable. > >Impact > > If SNMP requests can be received by an affected device, then certain > MIB objects can be viewed without proper authorization, causing a > violation of confidentiality. > > A subset of the readable MIB objects can be modified without > authorization to cause a failure of integrity. For example, the > hostname can be modified so as to confuse network adminstrators, or > the contact and location information could be changed with a goal of > disrupting operations or embarassing whoever is responsible for the > device. > > Objects in the LAN-EMULATION-CLIENT and PNNI MIBs can be viewed and > modified, thus resulting in changes to the operation of ATM > functions. If ATM is in use on the device, this may result in a > failure of availability. > > Any affected device that is not otherwise protected against the > receipt of SNMP packets is vulnerable to a denial-of-service (DoS) > attack by flooding the SNMP port with read or write requests. > >Software Versions and Fixes > > The following table summarizes the known affected Cisco IOS software > releases and the earliest estimated dates of availability for fixed > releases. All dates are tentative and subject to change. > > Each row of the table describes a release train and the platforms or > products for which it is intended. If a given release train is > vulnerable, then the earliest possible releases that contain the fix > and the anticipated date of availability for each are listed in the > "Rebuild", "Interim", and "Maintenance" columns. If a device is > running an earlier release that is known to be vulnerable, it should > be upgraded to at least the indicated version. > > When selecting a release, keep in mind the following definitions: > > Maintenance > Most heavily tested and highly recommended release of any > label in a given row of the table. > > Rebuild > Constructed from the previous maintenance or major release in > the same train, it contains the fix for a specific defect. > Although it receives less testing, it contains only the > minimal changes necessary to effect the repair. > > Interim > Built at regular intervals between maintenance releases and > receive less testing. Interims should be selected only if > there is no other suitable release that addresses the > vulnerability. Interim releases are usually not available for > customer download via CCO without prior arrangement. > > In all cases, customers should exercise caution to be certain the > devices to be upgraded contain sufficient memory and that current > hardware and software configurations will continue to be supported > properly by the new release. If the information is not clear, > contact the Cisco TAC for assistance as shown in the following > section. > > More information on IOS release names and abbreviations is available > at http://www.cisco.com/warp/public/620/1.html. > > +===========================================================================+ > | Train | Description of | Availability of Fixed Releases* | > | | Image or Platform | | > +===========================================================================+ > | 10.3-based Releases and | | | | > | Earlier | Rebuild | Interim** | Maintenance | > +===========================================================================+ > | 10.3 and | | | > | earlier |All |Not affected | > +===========================================================================+ > | 11.0-based Releases | Rebuild | Interim** | Maintenance | > +===========================================================================+ > | | |11.0(22a) | | | > | 11.0 |Major GD release | | | | > | |for all platforms |2001-Mar-05 | | | > +===========================================================================+ > | 11.1-based Releases | Rebuild | Interim** | Maintenance | > +===========================================================================+ > | | |11.1(24a) | | | > | 11.1 |Major release for | | | | > | |all platforms |2001-Mar-05 | | | > +----------+-------------------+------------+---------------+---------------+ > | |ED release for | | |12.1(7) | > | 11.1AA |access servers: | | | | > | |1600, 3200, and | | | | > | |5200 series. | | |2001-Feb-26 | > +----------+-------------------+------------+---------------+---------------+ > | |Platform-specific |11.1(36)CA1 | | | > | 11.1CA |support for 7500, | | | | > | |7200, 7000, and RSP|2001-Mar-02 | | | > +----------+-------------------+------------+---------------+---------------+ > | |ISP train: added | | | | > | |support for FIB, |11.1(36)CC1 | | | > | 11.1CC |CEF, and NetFlow on| | | | > | |7500, 7200, 7000, |2001-Mar-02 | | | > | |and RSP | | | | > +----------+-------------------+------------+---------------+---------------+ > | |Added support for |12.0(11)ST2 | | | > | 11.1CT |Tag Switching on | | | | > | |7500, 7200, 7000, | | | | > | |and RSP |2001-Feb-26 | | | > +----------+-------------------+------------+---------------+---------------+ > | | |11.1(28)IA1 | | | > | 11.1IA |DistributedDirector| | | | > | |only |2001-Feb-26 | | | > +===========================================================================+ > | 11.2-based Releases | Rebuild | Interim** | Maintenance | > +===========================================================================+ > | | |11.2(25a) | | | > | 11.2 |Major release, | | | | > | |general deployment |2001-Mar-05 | | | > +----------+-------------------+------------+---------------+---------------+ > | |Platform-specific | | | | > | |support for IBM | | |12.1(7) | > | 11.2BC |networking, CIP, | | | | > | |and TN3270 on 7500,| | |2001-Feb-26 | > | |7000, and RSP | | | | > +----------+-------------------+------------+---------------+---------------+ > | |Early deployment |12.0(15)S1 | | | > | 11.2GS |release to support | | | | > | |12000 GSR |2001-Feb-20 | | | > +----------+-------------------+------------+---------------+---------------+ > | | |11.2(25a)P | | | > | 11.2P |New platform | | | | > | |support |2001-Mar-05 | | | > +----------+-------------------+------------+---------------+---------------+ > | | | | |12.1WC | > | 11.2SA |Catalyst 2900XL | | | | > | |switch only | | |2001-Apr-12 | > +----------+-------------------+------------+---------------+---------------+ > | | | | |12.0(10)W5(18c)| > | 11.2WA3 |LS1010 ATM switch | | | | > | | | | |Available | > +----------+-------------------+------------+---------------+---------------+ > | | |11.2(25a)P | | | > |11.2(4)XA |Initial release for| | | | > | |the 1600 and 3600 |2001-Mar-05 | | | > +----------+-------------------+------------+---------------+---------------+ > | |Initial release for| | | | > | |the 5300 and |11.2(9)XA1 | | | > |11.2(9)XA |digital modem | | | | > | |support for the |Unscheduled | | | > | |3600 | | | | > +===========================================================================+ > | 11.3-based Releases | Rebuild | Interim** | Maintenance | > +===========================================================================+ > | | |11.3(11b) | | | > | 11.3 |Major release for | | | | > | |all platforms |2001-Mar-05 | | | > +----------+-------------------+------------+---------------+---------------+ > | |ED for dial | | | | > | |platforms and |11.3(11a)AA | | | > | 11.3AA |access servers: | | | | > | |5800, 5200, 5300, |2001-Mar-05 | | | > | |7200 | | | | > +----------+-------------------+------------+---------------+---------------+ > | |Early deployment |12.1(5)DA1 | | | > | 11.3DA |train for ISP DSLAM| | | | > | |6200 platform |2001-Feb-28 | | | > +----------+-------------------+------------+---------------+---------------+ > | |Early deployment | | | | > | |train for |12.1(4)DB1 | | | > | |ISP/Telco/PTT xDSL | | | | > | 11.3DB |broadband | | | | > | |concentrator | | | | > | |platform, (NRP) for|2001-Feb-26 | | | > | |6400 | | | | > +----------+-------------------+------------+---------------+---------------+ > | |Short-lived ED | | > | 11.3HA |release for ISR |Not Vulnerable | > | |3300 (SONET/SDH | | > | |router) | | > +----------+-------------------+------------+---------------+---------------+ > | | |11.3(1)MA8 | | | > | 11.3MA |MC3810 | | | | > | |functionality only |Unscheduled | | | > +----------+-------------------+------------+---------------+---------------+ > | |Voice over IP, |12.1(7) | | | > | 11.3NA |media convergence, | | | | > | |various platforms |2001-Mar-05 | | | > +----------+-------------------+------------+---------------+---------------+ > | |Early deployment |11.3(11b)T1 | | | > | 11.3T |major release, | | | | > | |feature-rich for | | | | > | |early adopters |2001-Mar-05 | | | > +----------+-------------------+------------+---------------+---------------+ > | |Multilayer | | | | > | |Switching and | | |12.0(14)W5(20) | > | |Multiprotocol over | | | | > | 11.3WA4 |ATM functionality | | | | > | |for Catalyst 5000 | | | | > | |RSM, 4500, 4700, | | |2001-Feb-28 | > | |7200, 7500, LS1010 | | | | > +----------+-------------------+------------+---------------+---------------+ > | | |11.3(11b)T1 | | | > |11.3(2)XA |Introduction of | | | | > | |ubr7246 and 2600 |2001-Mar-05 | | | > +===========================================================================+ > | 12.0-based Releases | Rebuild | Interim** | Maintenance | > +===========================================================================+ > | |General deployment | |12.0(7.1) |12.0(16) | > | 12.0 |release for all | | | | > | |platforms | |Available |2001-Feb-20 | > +----------+-------------------+------------+---------------+---------------+ > | | | |12.0(7.1)T | | > | 12.0DA |xDSL support: 6100,| | | | > | |6200 | |Available | | > +----------+-------------------+------------+---------------+---------------+ > | |ISP/Telco/PTT xDSL |12.1(4)DB1 | | | > | 12.0DB |broadband | | | | > | |concentrator | | | | > | |platforms |2001-Feb-26 | | | > +----------+-------------------+------------+---------------+---------------+ > | | |12.1(4)DC2 | | | > | 12.0DC |6400 Access | | | | > | |Concentrator |2001-Feb-26 | | | > +----------+-------------------+------------+---------------+---------------+ > | | |12.0(15)S1 | | | > | 12.0S |Core/ISP support: | | | | > | |GSR, RSP, c7200 |2001-Feb-20 | | | > +----------+-------------------+------------+---------------+---------------+ > | | |12.0(15)SC1 | | | > | 12.0SC |Cable/broadband | | | | > | |ISP: ubr7200 |2001-Feb-26 | | | > +----------+-------------------+------------+---------------+---------------+ > | | |12.0(14)SL1 | | | > | 12.0SL |10000 ESR: c10k | | | | > | | |2001-Feb-26 | | | > +----------+-------------------+------------+---------------+---------------+ > | |General deployment |12.0(11)ST2 | | | > | 12.0ST |release for all | | | | > | |platforms |2001-Feb-26 | | | > +----------+-------------------+------------+---------------+---------------+ > | | |12.1(5c)E8 | | | > | 12.0SX |Early Deployment | | | | > | |(ED) |2001-Feb-26 | | | > +----------+-------------------+------------+---------------+---------------+ > | |Early | | | | > | |Deployment(ED): | | |12.1(7) | > | 12.0T |VPN, Distributed | | | | > | |Director, various | | |2001-Feb-26 | > | |platforms | | | | > +----------+-------------------+------------+---------------+---------------+ > | |cat8510c, cat8540c,| | | | > | |ls1010, cat8510m, | |12.0(10)W5(18c)|12.0(14)W5(20) | > | |cat8540m, c5atm, | | | | > | |c5atm, c3620, | | | | > | |c3640, c4500, | | | | > | 12.0W5 |c5rsfc, c5rsm, | |Available |2001-Feb-28 | > | |c7200, rsp, | | | | > | |cat2948g, cat4232 | | | | > | +-------------------+------------+---------------+---------------+ > | | | |12.0(10)W5(18d)|12.0(14)W5(20) | > | |c6msm | | | | > | | | |Available |2001-Feb-28 | > +----------+-------------------+------------+---------------+---------------+ > | |General deployment | | |12.0(13)WT6(1) | > | 12.0WT |release for all | | | | > | |platforms | | |2001-Feb-20 | > +----------+-------------------+------------+---------------+---------------+ > | |Early Deployment | | |12.1(7) | > | 12.0XA |(ED): limited | | | | > | |platforms | | |2001-Feb-26 | > +----------+-------------------+------------+---------------+---------------+ > | | | | |12.1(7) | > | 12.0XB |Short-lived early | | | | > | |deployment release | | |2001-Feb-26 | > +----------+-------------------+------------+---------------+---------------+ > | |Early Deployment | | |12.1(7) | > | 12.0XC |(ED): limited | | | | > | |platforms | | |2001-Feb-26 | > +----------+-------------------+------------+---------------+---------------+ > | |Early Deployment | | |12.1(7) | > | 12.0XD |(ED): limited | | | | > | |platforms | | |2001-Feb-26 | > +----------+-------------------+------------+---------------+---------------+ > | |Early Deployment |12.1(5c)E8 | | | > | 12.0XE |(ED): limited | | | | > | |platforms |2001-Feb-26 | | | > +----------+-------------------+------------+---------------+---------------+ > | |Early Deployment | | |12.1(7) | > | 12.0XF |(ED): limited | | | | > | |platforms | | |2001-Feb-26 | > +----------+-------------------+------------+---------------+---------------+ > | |Early Deployment | | |12.1(7) | > | 12.0XG |(ED): limited | | | | > | |platforms | | |2001-Feb-26 | > +----------+-------------------+------------+---------------+---------------+ > | |Early Deployment |12.0(4)XH5 | | | > | 12.0XH |(ED): limited | | | | > | |platforms |2001-Mar-05 | | | > +----------+-------------------+------------+---------------+---------------+ > | |Early Deployment | | |12.1(7) | > | 12.0XI |(ED): limited | | | | > | |platforms | | |2001-Feb-26 | > +----------+-------------------+------------+---------------+---------------+ > | |Early Deployment | | |12.1(7) | > | 12.0XJ |(ED): limited | | | | > | |platforms | | |2001-Feb-26 | > +----------+-------------------+------------+---------------+---------------+ > | |Early Deployment |12.0(7)XK4 | | | > | 12.0XK |(ED): limited | | | | > | |platforms |Unscheduled | | | > +----------+-------------------+------------+---------------+---------------+ > | |Early Deployment |12.0(4)XH5 | | | > | 12.0XL |(ED): limited | | | | > | |platforms |2001-Mar-05 | | | > +----------+-------------------+------------+---------------+---------------+ > | | | | |12.1(7) | > | 12.0XM |Short-lived early | | | | > | |deployment release | | |2001-Feb-26 | > +----------+-------------------+------------+---------------+---------------+ > | |Early Deployment | | | | > | 12.0XN |(ED): limited | | | | > | |platforms | | | | > +----------+-------------------+------------+---------------+---------------+ > | |Early Deployment | | |12.1WC | > | 12.0XP |(ED): limited | | | | > | |platforms | | |2001-Apr-12 | > +----------+-------------------+------------+---------------+---------------+ > | | | | |12.1(7) | > | 12.0XQ |Short-lived early | | | | > | |deployment release | | |2001-Feb-26 | > +----------+-------------------+------------+---------------+---------------+ > | | |12.1(5)T5 | | | > | 12.0XR |Short-lived early | | | | > | |deployment release |2001-Mar-05 | | | > +----------+-------------------+------------+---------------+---------------+ > | | |12.1(5c)E8 | | | > | 12.0XS |Short-lived early | | | | > | |deployment release |2001-Feb-26 | | | > +----------+-------------------+------------+---------------+---------------+ > | |Early Deployment | | |12.1WC | > | 12.0XU |(ED): limited | | | | > | |platforms | | |2001-Apr-12 | > +----------+-------------------+------------+---------------+---------------+ > | | |12.1(5)T5 | | | > | 12.0XV |Short-lived early | | | | > | |deployment release |2001-Mar-05 | | | > +===========================================================================+ > |12.1-based and Later Releases | Rebuild | Interim** | Maintenance | > +===========================================================================+ > | All 12.1 | | | > | Releases |Various platforms |Not Vulnerable | > +===========================================================================+ > | Notes | > +===========================================================================+ > | * All dates are estimated and Subject to change. | > | | > |** Interim releases are subjected to less rigorous testing than regular | > | maintenance releases, and may have serious bugs. | > +===========================================================================+ > >Obtaining Fixed Software > > Cisco is offering free software upgrades to remedy this > vulnerability for all affected customers. Customers with service > contracts may upgrade to any software release. Customers without > contracts may upgrade only within a single row of the table above, > except that any available fixed software release will be provided to > any customer who can use it and for whom the standard fixed software > release is not yet available. Customers may install only the feature > sets they have purchased. > > Note that not all fixed software may be available as of the release > date of this notice. > > Customers with contracts should obtain upgraded software through > their regular update channels. For most customers, this means that > upgrades should be obtained via Cisco's Software Center at > http://www.cisco.com/. > > Customers without contracts or warranty should get their upgrades by > contacting the Cisco Technical Assistance Center (TAC) as shown > below: > * (800) 553-2447 (toll-free in North America) > * +1 408 526 7209 (toll call from anywhere in the world) > * e-mail: tac(a)cisco.com > > See http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for > additional TAC contact information, including instructions and > e-mail addresses for use in various languages. > > Give the URL of this notice as evidence of your entitlement to a > free upgrade. Free upgrades for non-contract customers must be > requested through the TAC. Please do not contact either > "psirt(a)cisco.com" or "security-alert(a)cisco.com" for software > upgrades; faster results will be obtained by contacting the TAC > directly. > >Workarounds > > Several workarounds are available based on customer needs, > equipment, and software features. The usefulness and practicality of > each workaround depends on the IOS release running on the device and > many variables in the customer's environment. Customers are urged to > consider each of the following alternatives carefully before > deploying. These workarounds are only needed if it is not possible > to upgrade to an unaffected release of IOS software. > > A. Default workaround for use with releases for which no other > workarounds are effective: > > 1. Applying access lists to all the interfaces of the > vulnerable device blocking SNMP from all hosts but those > authorized to manage the devices. > > 2. Blocking SNMP access at the edge of the network to prevent > undesirable SNMP traffic from entering the network > containing the vulnerable device. > > Access lists should be deployed with careful consideration of > the possible effects on network operation and performance. Also > note that authentication based on an IP source address is weak, > so the preceding method will not protect against certain types > of attacks in which the IP source address has been spoofed. > Further information can be found in the Cisco document > "Improving Security on Cisco Routers", available at > http://www.cisco.com/warp/public/707/21.html > > B. For affected releases based on IOS 11.1: > > 1. Remove the view so that the ILMI community cannot be > reached: > > no snmp-server view *ilmi > > 2. This configuration will not survive a system reload. The > command must be re-entered after every restart of the > system. > > C. For affected releases of IOS 11.2 through 11.3(8) NOT REQUIRING > ATM: > > In this affected range of releases, the ILMI community string > can be modified or deleted. However, the changes will not > persist through a reboot of the device. These instructions must > be re-applied following every system reload of the affected > device: > > 1. Expose the undocumented ILMI community string so it can be > modified: > > snmp-server community ILMI RW > > The preceding command may cause an error that can be safely > ignored. > > 2. Disable read-write capability for the same community: > > no snmp-server community ILMI RW > > If an error is displayed, then this workaround cannot be > applied to the device. Use the default workarounds > presented in the first item above. > > 3. Since this configuration will not survive a system reload, > the command must be re-entered after every restart of the > system. > > If the command in item 2 above did not generate an error and ATM > is not needed on this device, then this workaround is complete. > > D. For affected releases of IOS 11.2 through 11.3(8) THAT REQUIRE > ATM: > > This workaround will allow ILMI to continue to function for ATM > while constraining who may reconfigure the device by way of the > ILMI community string: > > 1. Create a simple ACL to deny access using the following > command. If "66" is already in use, choose a different > two-digit number: > > access-list 66 deny any > > 2. Apply it generally to the ILMI community to restrict its > view: > > snmp community ILMI view *ilmi RW 66 > > An error will be reported if the *ilmi view doesn't exist. > If that occurs, then use the following command to > explicitly restrict the ILMI view: > > snmp community ILMI RW 66 > > If the preceding command produces persistent errors, then > this workaround cannot be applied to this device. Use the > default workarounds presented in the first item above. > > E. For affected releases of IOS 11.3(9) through 12.0(2)T NOT > REQUIRING ATM: > > All versions of IOS in this range will accept this workaround, > and the change will remain in place after a system reload. > > 1. Expose the undocumented ILMI community string so it can be > modified: > > snmp-server community ILMI RW > > The preceding command may cause an error that can be safely > ignored. > > 2. Disable read-write capability for the same community: > > no snmp-server community ILMI RW > > If an error is displayed, then this workaround cannot be > applied to the device. Stop this procedure and use the > default workarounds presented in the first item above. > > F. For affected releases of IOS 11.3(9) through 12.0(2)T THAT > REQUIRE ATM: > > This workaround will allow ILMI to continue to function for ATM > while constraining who may reconfigure the device by way of the > ILMI community string: > > 1. Create a simple ACL to deny access using the following > command. If "66" is already in use, choose a different > two-digit number: > > access-list 66 deny any > > 2. Apply it generally to the ILMI community to restrict its > view: > > snmp community ILMI view *ilmi RW 66 > > An error will be reported if the *ilmi view doesn't exist. > If that occurs, then use the following command to > explicitly restrict the ILMI view: > > snmp community ILMI RW 66 > > If the preceding command produces persistent errors, then > this workaround cannot be applied to this device. Use the > default workaround presented in the first item above. > > G. For affected releases of IOS 12.0(3)T and later: > These releases of IOS include support for Simple Network > Management Protocol version 3 (SNMPv3), which is required for > this workaround. > > 1. Confirm the presence of SNMPv3 support by asking the > console CLI (command-line interpreter) for assistance with > options to complete the snmp-server command. Enter config > mode, enter the command shown below, and note the expected > response: > > snmp-server user test test ? > > remote Specify a remote SNMP entity to which the user belongs > v1 user using the v1 security model > v2c user using the v2c security model > v3 user using the v3 security model > > If the preceding command did not produce the expected > results, then SNMPv3 is not supported in the release and > this workaround cannot be applied. Stop this procedure and > consider applying the default workaround presented above in > the first item. > > Otherwise, if the device responded as expected, continue > with the following explanation and instructions. > > In these IOS releases (12.0(3)T and later), ILMI packets are > processed by the SNMP engine in the same manner as ordinary IP > SNMP packets. An access control list or a view applied to the > ILMI community string will be processed whether the transport is > ILMI or IP. However, the only types of access control lists that > can be applied to a community string are via IP access-list > statements, which when applied, block ALL non-IP packets, > including ILMI packets. Modifying or deleting the *ilmi view > will also affect the packets transported by ILMI, so workarounds > that change the view are equally ineffective at permitting ILMI > while denying SNMP. In this range of releases, it is not > possible to apply a workaround that denies IP SNMP packets that > does not also deny ILMI SNMP packets. > > H. For affected releases of IOS 12.0(3)T and later NOT REQUIRING > ATM: > > 1. Expose the undocumented ILMI community string so it can be > modified: > > snmp-server community ILMI RW > > The preceding command may cause an error that can be safely > ignored. > > 2. Disable read-write capability for the same community: > > no snmp-server community ILMI RW > > If an error is displayed, then this workaround cannot be > applied to the device. Stop this procedure and consider > using the default workaround. > > I. For affected releases of IOS 12.0(3)T and later THAT REQUIRE > ATM: > > NOTE: This section also applies to 12.0-based ATM switch > software such as for the LS1010 and the 8500 series. > > The only effective workaround for systems in this category is > the default workaround: > > 1. Applying access lists to all the interfaces of the > vulnerable device blocking SNMP from all hosts but those > authorized to manage the devices. > > 2. Blocking SNMP access at the edge of the network to prevent > undesirable SNMP traffic from entering the network > containing the vulnerable device. > > Access lists should be deployed with careful consideration of > the possible effects on network operation and performance. Also > note that authentication based on an IP source address is weak, > so the preceding method will not protect against certain types > of attacks in which the IP source address has been spoofed. > In this range of releases it is not possible to block IP SNMP > packets while permitting ILMI SNMP packets. The alternative > workarounds presented previously will almost certainly cause a > failure of ATM ILMI communications resulting in a loss of ATM > connectivity, either immediately upon configuration, or > unexpectedly at some later time. Either use the default > workaround or upgrade to fixed software. > >Exploitation and Public Announcements > > This vulnerability is known to the engineering staff of several > Cisco customers. Cisco considers it known to the public prior to the > publication of this notice. > > Cisco is aware of one recent incident involving the unauthorized > modification of a router that appears to have resulted from this > vulnerability. However, it may have been the unintended side-effect > of a test of the vulnerability. > > Cisco is not aware of any available tools specifically designed to > make use of this vulnerability. However, various off-the-shelf > network management programs could easily be used to test for this > vulnerability and to exploit it. Certain widely-available programs > known to the cracker community could be modified by any reasonably > competent programmer to automate the abuse of this vulnerability. > > Cisco is not aware of any general public discussion of this > vulnerability other than the exceptions previously noted. > >Status of This Notice: INTERIM > > This is an interim security advisory. Cisco anticipates issuing > updated versions of this notice at irregular intervals as there are > material changes in the facts, and will continue to update this > notice as necessary. The reader is warned that this notice may > contain inaccurate or incomplete information. Although Cisco cannot > guarantee the accuracy of all statements in this notice, all of the > facts have been checked to the best of our ability. Cisco > anticipates issuing monthly updates of this notice until it reaches > FINAL status. > > A standalone copy or paraphrase of the text of this security > advisory that omits the distribution URL in the following section is > an uncontrolled copy, and may lack important information or contain > factual errors. > >Distribution > > This notice will be posted at > http://www.cisco.com/warp/public/707/ios-snmp-ilmi-vuln-pub.shtml . > > In addition to Worldwide Web posting, a text version of this notice > will be clear-signed with the Cisco PSIRT PGP key and will be posted > to the following e-mail and Usenet news recipients: > > * cust-security-announce(a)cisco.com > > * bugtraq(a)securityfocus.com > > * firewalls(a)lists.gnac.com > > * first-teams(a)first.org (including CERT/CC) > > * cisco(a)spot.colorado.edu > > * cisco-nsp(a)puck.nether.net > > * comp.dcom.sys.cisco > > * Various internal Cisco mailing lists > > Future updates of this notice, if any, will be placed on Cisco's > Worldwide Web server, but may or may not be actively announced on > mailing lists or newsgroups. Users concerned about this problem are > encouraged to check the URL given above for any updates. > >Revision History > > Revision 1.0 2001-Feb-27 First interim public version > >Cisco Product Security Incident Procedures > > Instructions for reporting product security vulnerabilities in Cisco > products, obtaining assistance with customer security incidents, and > registering to receive security information from Cisco can be found > at http://www.cisco.com/warp/public/707/sec_incident_response.shtml > , including instructions for press inquiries regarding Cisco > Security Advisories. > _______________________________________________________________ > > Copyright 2001 by Cisco Systems, Inc. This notice may be > redistributed freely after the release date given at the top of the > text, provided that redistributed copies are complete and > unmodified, and include all date and version information. > _______________________________________________________________ > -- \_ Roger De Salis Cisco Systems NZ Ltd </' +64 25 481 452 L8, ASB Tower, 2 Hunter St /) +64 4 496 9003 Wellington, New Zealand (/ roger(a)desalis.gen.nz rdesalis(a)cisco.com ` --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Fw: Re: Warning: Cisco RW community backdoor.
by Joe Abley 27 Feb '01

27 Feb '01

More details below. -----Original Message----- From: "James A. T. Rice" <jamesr(a)rd.bbc.co.uk> Date: Tue, 27 Feb 2001 01:46:37 +0000 (GMT) Subject: Re: Warning: Cisco RW community backdoor. To: <members(a)lonap.net>, , , <ops(a)linx.net> Just a couple of things to note, I've been asked what the backdoor is, if its the community "ILMI" or if that was just an example, the answer is yes - "ILMI" is the backdoor which gives read-write access to parts of the SNMP base. Its looks like parts of my earlier email are somewhat misleading, the ILMI community appears to only allow RW access to the system object and possibly some more objects. Its not a 'standard' open RW community. hence the damage caused by this backdoor is limited. There is still some write access however, so the fix mentioned below is still highly recommended. And of course - it allows people to read what IOS/model cisco you have, which could be used to find exploitable bugs in that particular release. Oh I wonder what the chances of having a router stolen due to discovery of system.sysLocation is! :-) Warm Regards James -- James A. T. Rice | Email: jamesr(a)rd.bbc.co.uk Internet Operations Engineer | Phone: 01737 839 737 BBC Internet Services, Kingswood Warren, Tadworth, Surrey, UK. On Tue, 27 Feb 2001, it was written: > If your router responds to `snmpwalk router.isp.net.uk ILMI`, you > probabally will want to do the following to disable it: > conf t > snmp-server community ILMI RO 99 > access-list 99 deny any log > (pick another spare access-list if 99 isn't available) > > If you dont, assuming your ios/hardware combination supports it, > (most of the bigger routers do) anyone can do things like: > `snmpset router.isp.net.uk ILMI system.sysName.0 s \ > "ALL YOUR ROUTER ARE BELONG TO US."` > Thats a harmless example. You can do almost anything with RW snmp. > > Warm Regards > James > > -- > James A. T. Rice | Email: jamesr(a)rd.bbc.co.uk > Internet Operations Engineer | Phone: 01737 839 737 > BBC Internet Services, Kingswood Warren, Tadworth, Surrey, UK. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

6 7

FW: [nsp] Cisco Security Advisory: Cisco IOS Software SNMP Read-Write ILMI Community String Vulnerability
by Barry Raveendran Greene 27 Feb '01

27 Feb '01

-----Original Message----- From: nobody(a)cisco.com [mailto:nobody(a)cisco.com]On Behalf Of Cisco Systems Product Security Incident Response Team Sent: Tuesday, February 27, 2001 1:00 AM To: cisco-nsp(a)puck.nether.net Cc: psirt(a)cisco.com Subject: [nsp] Cisco Security Advisory: Cisco IOS Software SNMP Read-Write ILMI Community String Vulnerability -----BEGIN PGP SIGNED MESSAGE----- Cisco Security Advisory: Cisco IOS Software SNMP Read-Write ILMI Community String Vulnerability Revision 1.0: INTERIM For Public Release 2001 February 27 04:00 US/Eastern (UTC+0500) _______________________________________________________________ Summary Cisco IOS software releases based on versions 11.x and 12.0 contain a defect that allows a limited number of SNMP objects to be viewed and modified without authorization using a undocumented ILMI community string. Some of the modifiable objects are confined to the MIB-II system group, such as "sysContact", "sysLocation", and "sysName", that do not affect the device's normal operation but that may cause confusion if modified unexpectedly. The remaining objects are contained in the LAN-EMULATION-CLIENT and PNNI MIBs, and modification of those objects may affect ATM configuration. An affected device might be vulnerable to a denial-of-service attack if it is not protected against unauthorized use of the ILMI community string. The vulnerability is only present in certain combinations of IOS releases on Cisco routers and switches. ILMI is a necessary component for ATM, and the vulnerability is present in every IOS release that contains the supporting software for ATM and ILMI without regard to the actual presence of an ATM interface or the physical ability of the device to support an ATM connection. To remove this vulnerability, Cisco is offering free software upgrades for all affected platforms. The defect is documented in DDTS record CSCdp11863. In lieu of a software upgrade, a workaround can be applied to certain IOS releases by disabling the ILMI community or "*ilmi" view and applying an access list to prevent unauthorized access to SNMP. Any affected system, regardless of software release, may be protected by filtering SNMP traffic at a network perimeter or on individual devices. This notice will be posted at http://www.cisco.com/warp/public/707/ios-snmp-ilmi-vuln-pub.shtml. Affected Products The vulnerability is present only in certain releases of Cisco IOS Software versions 11.x and 12.0 for router and switch products that include support for Asynchronous Transfer Mode (ATM) networking and Interim Local Management Interface (ILMI), and it is present without regard to any physical capability for supporting an ATM interface. Cisco IOS Software versions based on 10.3 and earlier do not contain the vulnerability. The defect was introduced in 11.0(0.2). All Cisco IOS software releases of 12.1 and later have been repaired and are not vulnerable to the defect described in this advisory. To determine the software running on a Cisco product, log in to the device and issue the command "show version" to display the system banner. Cisco IOS software will identify itself as "Internetwork Operating System Software" or simply "IOS (tm)". The image name will be displayed between parentheses, usually on the next line of output, followed by "Version" and the IOS release name. Other Cisco devices will not have the "show version" command or will give different output. The following example identifies a Cisco product running IOS release 12.0(3) with an installed image name of C2500-IS-L: Cisco Internetwork Operating System Software IOS (tm) 2500 Software (C2500-IS-L), Version 12.0(3), RELEASE SOFTWARE The device is not vulnerable to the defect described in this advisory since the model 2500 router is specifically excluded in the list of unaffected products shown below. Cisco devices that may be running an affected IOS software release include, but are not limited to: * Cisco 1400 and 1700 series. * Cisco 2600 (except that c2600-c-mz, c2600-d-mz, c2600-i-mz, c2600-io3-mz, and c2600-ix-mz images are not vulnerable). * Catalyst 2900 ATM, 2900XL, and 2948g series. * Cisco 3620 (except that c3620-d-mz, c3620-i-mz, c3620-io3-mz, and c3620-ix-mz images are not vulnerable). * Cisco 3640 (except that c3640-d-mz, c3640-i-mz, c3640-io3-mz, and c3640-ix-mz images are not vulnerable). * Cisco 3660 (except that c3660-d-mz, c3660-i-mz, and c3660-ix-mz images are not vulnerable). * Cisco MC3810 (except that mc3810-i-mz, mc3810-is-mz, mc3810-is56i-mz, and mc3810-js-mz images are not vulnerable). * Catalyst 4232, 4840g, 5000 RSFC series switches. * Cisco 4500, 4700, and 5800 DSC series. * Cisco 6200, 6400 NRP, and 6400 NSP series. * Catalyst MSM (c6msm), 6000 Hybrid Mode (c6msfc), and 6000 Native Mode (c6sup). * Cisco RSM, 7000, 7010, 7100, 7200, ubr7200, and 7500 series. * Catalyst 8510CSR, 8510MSR, 8540CSR, and 8540MSR series. * Cisco 10000 ESR and 12000 GSR series. * LS1010 and Cisco 6260-NI2. * DistributedDirector (except that igs-w3 images are not vulnerable). Cisco products that are not affected by this vulnerability either because they have no support for ATM and ILMI, or because they do not run IOS include, but are not limited to: * Catalyst ATM blade (runs possibly affected code, but an SNMP connection to the blade is not possible). * Cisco 800 and 805 series. * Cisco Universal Broadband Routers ubr900 and ubr920. * Cisco 1003, 1004, and 1005 series. * Cisco 1600, 2500, 2800, 4000 series. * Cisco 2500 Fixed Frad. * Cisco 3800 (not to be confused with MC3810). * Cisco 5100, 5200, and 5300 series access servers. * Catalyst 6000 Supervisor Module. * Cisco PIX Firewall. * Aironet and Cisco/Aironet wireless products. * CS11000, Cache Engine, LocalDirector, and network scaling products (except that the Distributed Director might be affected). * VPN products such as Altiga concentrators. * Host-based network management or access management products. * Cisco IP Telephony and telephony management software (except those that are hosted on a vulnerable IOS platform). * Voice gateways and convergence platforms (except those that are hosted on a vulnerable IOS platform). * Optical switch products such as the ONS 15000 series. Details ILMI (Interim Local Management Interface) is an independent industry standard used for configuration of ATM (Asynchronous Transfer Mode) interfaces. The standard specifies the use of mechanisms and formats previously defined by SNMP (Simple Network Management Protocol). Although it is based on SNMP, ILMI communication actually occurs using a transport other than IP (Internet Protocol) that traverses only the physical ATM link. ILMI is essential to functions such as ATM auto-discovery and LANE (LAN Emulation). SNMP "objects" are variables that are organized into a MIB (Management Information Base). The MIB has a tree structure and contains both operational (read-only) data as well as configuration (read-write) options. By specifying a community string of "ILMI" in an SNMP request, access can be obtained to read the objects in three specific parts of the overall management tree structure on any device affected by this vulnerability: the MIB-II system group, the LAN-EMULATION-CLIENT MIB, and the PNNI (Private Network-to-Network Interface) MIB. A subset of objects in each part can be modified using the same "ILMI" community string. The MIB-II system group contains basic information about the device itself. The number of objects that can be modified is limited. Examples include: * system.sysContact: The contact information for the person or organization responsible for managing the device. * system.sysLocation: A description of the physical location where the device is installed or operating. * system.sysName: The hostname of the device, how it identifies itself at the console prompt. (This might not be the same name by which the device is known to other hosts on the network.) Most of the objects in the system MIB are read-only and cannot be changed via SNMP, such as the time elapsed since the previous restart and textual descriptions of the device's hardware and software. Numerous objects can be viewed in the LAN-EMULATION-CLIENT MIB and PNNI MIB, and modification of some of the read-write objects can have an affect on ATM operation of the device. The objects in the LAN-EMULATION-CLIENT MIB can only be viewed or modified if LANE has already been configured on the device. Access to SNMP in Cisco IOS software can be limited by applying access control lists (ACLs), by modifying or removing the SNMP view, by removing the community string from the running configuration, or by disabling the SNMP service. Any SNMP query that does not meet the criteria for access is promptly discarded when such protective measures are in place. If a query does meet the criteria for access, then a response is formulated and sent. It is possible to configure the device so that the ILMI community string is unavailable in all IOS 11.1 and higher releases. The particular method selected to accomplish this depends on the specific IOS release and configuration. This defect is documented as CSCdp11863. The vulnerability is repaired by imposing a test such that an SNMP request using the "ILMI" community string will only be recognized if it has been transported by ILMI. ATM functionality was added in various 10.x releases of Cisco IOS software. However, the function containing the defect was introduced when support for ILMI and other ATM features was added in IOS release 11.0(0.2). Therefore, all prior releases are not vulnerable. Impact If SNMP requests can be received by an affected device, then certain MIB objects can be viewed without proper authorization, causing a violation of confidentiality. A subset of the readable MIB objects can be modified without authorization to cause a failure of integrity. For example, the hostname can be modified so as to confuse network adminstrators, or the contact and location information could be changed with a goal of disrupting operations or embarassing whoever is responsible for the device. Objects in the LAN-EMULATION-CLIENT and PNNI MIBs can be viewed and modified, thus resulting in changes to the operation of ATM functions. If ATM is in use on the device, this may result in a failure of availability. Any affected device that is not otherwise protected against the receipt of SNMP packets is vulnerable to a denial-of-service (DoS) attack by flooding the SNMP port with read or write requests. Software Versions and Fixes The following table summarizes the known affected Cisco IOS software releases and the earliest estimated dates of availability for fixed releases. All dates are tentative and subject to change. Each row of the table describes a release train and the platforms or products for which it is intended. If a given release train is vulnerable, then the earliest possible releases that contain the fix and the anticipated date of availability for each are listed in the "Rebuild", "Interim", and "Maintenance" columns. If a device is running an earlier release that is known to be vulnerable, it should be upgraded to at least the indicated version. When selecting a release, keep in mind the following definitions: Maintenance Most heavily tested and highly recommended release of any label in a given row of the table. Rebuild Constructed from the previous maintenance or major release in the same train, it contains the fix for a specific defect. Although it receives less testing, it contains only the minimal changes necessary to effect the repair. Interim Built at regular intervals between maintenance releases and receive less testing. Interims should be selected only if there is no other suitable release that addresses the vulnerability. Interim releases are usually not available for customer download via CCO without prior arrangement. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco TAC for assistance as shown in the following section. More information on IOS release names and abbreviations is available at http://www.cisco.com/warp/public/620/1.html. +=========================================================================== + | Train | Description of | Availability of Fixed Releases* | | | Image or Platform | | +=========================================================================== + | 10.3-based Releases and | | | | | Earlier | Rebuild | Interim** | Maintenance | +=========================================================================== + | 10.3 and | | | | earlier |All |Not affected | +=========================================================================== + | 11.0-based Releases | Rebuild | Interim** | Maintenance | +=========================================================================== + | | |11.0(22a) | | | | 11.0 |Major GD release | | | | | |for all platforms |2001-Mar-05 | | | +=========================================================================== + | 11.1-based Releases | Rebuild | Interim** | Maintenance | +=========================================================================== + | | |11.1(24a) | | | | 11.1 |Major release for | | | | | |all platforms |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | |ED release for | | |12.1(7) | | 11.1AA |access servers: | | | | | |1600, 3200, and | | | | | |5200 series. | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | |Platform-specific |11.1(36)CA1 | | | | 11.1CA |support for 7500, | | | | | |7200, 7000, and RSP|2001-Mar-02 | | | +----------+-------------------+------------+---------------+--------------- + | |ISP train: added | | | | | |support for FIB, |11.1(36)CC1 | | | | 11.1CC |CEF, and NetFlow on| | | | | |7500, 7200, 7000, |2001-Mar-02 | | | | |and RSP | | | | +----------+-------------------+------------+---------------+--------------- + | |Added support for |12.0(11)ST2 | | | | 11.1CT |Tag Switching on | | | | | |7500, 7200, 7000, | | | | | |and RSP |2001-Feb-26 | | | +----------+-------------------+------------+---------------+--------------- + | | |11.1(28)IA1 | | | | 11.1IA |DistributedDirector| | | | | |only |2001-Feb-26 | | | +=========================================================================== + | 11.2-based Releases | Rebuild | Interim** | Maintenance | +=========================================================================== + | | |11.2(25a) | | | | 11.2 |Major release, | | | | | |general deployment |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | |Platform-specific | | | | | |support for IBM | | |12.1(7) | | 11.2BC |networking, CIP, | | | | | |and TN3270 on 7500,| | |2001-Feb-26 | | |7000, and RSP | | | | +----------+-------------------+------------+---------------+--------------- + | |Early deployment |12.0(15)S1 | | | | 11.2GS |release to support | | | | | |12000 GSR |2001-Feb-20 | | | +----------+-------------------+------------+---------------+--------------- + | | |11.2(25a)P | | | | 11.2P |New platform | | | | | |support |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | | | | |12.1WC | | 11.2SA |Catalyst 2900XL | | | | | |switch only | | |2001-Apr-12 | +----------+-------------------+------------+---------------+--------------- + | | | | |12.0(10)W5(18c)| | 11.2WA3 |LS1010 ATM switch | | | | | | | | |Available | +----------+-------------------+------------+---------------+--------------- + | | |11.2(25a)P | | | |11.2(4)XA |Initial release for| | | | | |the 1600 and 3600 |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | |Initial release for| | | | | |the 5300 and |11.2(9)XA1 | | | |11.2(9)XA |digital modem | | | | | |support for the |Unscheduled | | | | |3600 | | | | +=========================================================================== + | 11.3-based Releases | Rebuild | Interim** | Maintenance | +=========================================================================== + | | |11.3(11b) | | | | 11.3 |Major release for | | | | | |all platforms |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | |ED for dial | | | | | |platforms and |11.3(11a)AA | | | | 11.3AA |access servers: | | | | | |5800, 5200, 5300, |2001-Mar-05 | | | | |7200 | | | | +----------+-------------------+------------+---------------+--------------- + | |Early deployment |12.1(5)DA1 | | | | 11.3DA |train for ISP DSLAM| | | | | |6200 platform |2001-Feb-28 | | | +----------+-------------------+------------+---------------+--------------- + | |Early deployment | | | | | |train for |12.1(4)DB1 | | | | |ISP/Telco/PTT xDSL | | | | | 11.3DB |broadband | | | | | |concentrator | | | | | |platform, (NRP) for|2001-Feb-26 | | | | |6400 | | | | +----------+-------------------+------------+---------------+--------------- + | |Short-lived ED | | | 11.3HA |release for ISR |Not Vulnerable | | |3300 (SONET/SDH | | | |router) | | +----------+-------------------+------------+---------------+--------------- + | | |11.3(1)MA8 | | | | 11.3MA |MC3810 | | | | | |functionality only |Unscheduled | | | +----------+-------------------+------------+---------------+--------------- + | |Voice over IP, |12.1(7) | | | | 11.3NA |media convergence, | | | | | |various platforms |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | |Early deployment |11.3(11b)T1 | | | | 11.3T |major release, | | | | | |feature-rich for | | | | | |early adopters |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | |Multilayer | | | | | |Switching and | | |12.0(14)W5(20) | | |Multiprotocol over | | | | | 11.3WA4 |ATM functionality | | | | | |for Catalyst 5000 | | | | | |RSM, 4500, 4700, | | |2001-Feb-28 | | |7200, 7500, LS1010 | | | | +----------+-------------------+------------+---------------+--------------- + | | |11.3(11b)T1 | | | |11.3(2)XA |Introduction of | | | | | |ubr7246 and 2600 |2001-Mar-05 | | | +=========================================================================== + | 12.0-based Releases | Rebuild | Interim** | Maintenance | +=========================================================================== + | |General deployment | |12.0(7.1) |12.0(16) | | 12.0 |release for all | | | | | |platforms | |Available |2001-Feb-20 | +----------+-------------------+------------+---------------+--------------- + | | | |12.0(7.1)T | | | 12.0DA |xDSL support: 6100,| | | | | |6200 | |Available | | +----------+-------------------+------------+---------------+--------------- + | |ISP/Telco/PTT xDSL |12.1(4)DB1 | | | | 12.0DB |broadband | | | | | |concentrator | | | | | |platforms |2001-Feb-26 | | | +----------+-------------------+------------+---------------+--------------- + | | |12.1(4)DC2 | | | | 12.0DC |6400 Access | | | | | |Concentrator |2001-Feb-26 | | | +----------+-------------------+------------+---------------+--------------- + | | |12.0(15)S1 | | | | 12.0S |Core/ISP support: | | | | | |GSR, RSP, c7200 |2001-Feb-20 | | | +----------+-------------------+------------+---------------+--------------- + | | |12.0(15)SC1 | | | | 12.0SC |Cable/broadband | | | | | |ISP: ubr7200 |2001-Feb-26 | | | +----------+-------------------+------------+---------------+--------------- + | | |12.0(14)SL1 | | | | 12.0SL |10000 ESR: c10k | | | | | | |2001-Feb-26 | | | +----------+-------------------+------------+---------------+--------------- + | |General deployment |12.0(11)ST2 | | | | 12.0ST |release for all | | | | | |platforms |2001-Feb-26 | | | +----------+-------------------+------------+---------------+--------------- + | | |12.1(5c)E8 | | | | 12.0SX |Early Deployment | | | | | |(ED) |2001-Feb-26 | | | +----------+-------------------+------------+---------------+--------------- + | |Early | | | | | |Deployment(ED): | | |12.1(7) | | 12.0T |VPN, Distributed | | | | | |Director, various | | |2001-Feb-26 | | |platforms | | | | +----------+-------------------+------------+---------------+--------------- + | |cat8510c, cat8540c,| | | | | |ls1010, cat8510m, | |12.0(10)W5(18c)|12.0(14)W5(20) | | |cat8540m, c5atm, | | | | | |c5atm, c3620, | | | | | |c3640, c4500, | | | | | 12.0W5 |c5rsfc, c5rsm, | |Available |2001-Feb-28 | | |c7200, rsp, | | | | | |cat2948g, cat4232 | | | | | +-------------------+------------+---------------+---------------+ | | | |12.0(10)W5(18d)|12.0(14)W5(20) | | |c6msm | | | | | | | |Available |2001-Feb-28 | +----------+-------------------+------------+---------------+--------------- + | |General deployment | | |12.0(13)WT6(1) | | 12.0WT |release for all | | | | | |platforms | | |2001-Feb-20 | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | |12.1(7) | | 12.0XA |(ED): limited | | | | | |platforms | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | | | | |12.1(7) | | 12.0XB |Short-lived early | | | | | |deployment release | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | |12.1(7) | | 12.0XC |(ED): limited | | | | | |platforms | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | |12.1(7) | | 12.0XD |(ED): limited | | | | | |platforms | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment |12.1(5c)E8 | | | | 12.0XE |(ED): limited | | | | | |platforms |2001-Feb-26 | | | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | |12.1(7) | | 12.0XF |(ED): limited | | | | | |platforms | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | |12.1(7) | | 12.0XG |(ED): limited | | | | | |platforms | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment |12.0(4)XH5 | | | | 12.0XH |(ED): limited | | | | | |platforms |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | |12.1(7) | | 12.0XI |(ED): limited | | | | | |platforms | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | |12.1(7) | | 12.0XJ |(ED): limited | | | | | |platforms | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment |12.0(7)XK4 | | | | 12.0XK |(ED): limited | | | | | |platforms |Unscheduled | | | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment |12.0(4)XH5 | | | | 12.0XL |(ED): limited | | | | | |platforms |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | | | | |12.1(7) | | 12.0XM |Short-lived early | | | | | |deployment release | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | | | | 12.0XN |(ED): limited | | | | | |platforms | | | | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | |12.1WC | | 12.0XP |(ED): limited | | | | | |platforms | | |2001-Apr-12 | +----------+-------------------+------------+---------------+--------------- + | | | | |12.1(7) | | 12.0XQ |Short-lived early | | | | | |deployment release | | |2001-Feb-26 | +----------+-------------------+------------+---------------+--------------- + | | |12.1(5)T5 | | | | 12.0XR |Short-lived early | | | | | |deployment release |2001-Mar-05 | | | +----------+-------------------+------------+---------------+--------------- + | | |12.1(5c)E8 | | | | 12.0XS |Short-lived early | | | | | |deployment release |2001-Feb-26 | | | +----------+-------------------+------------+---------------+--------------- + | |Early Deployment | | |12.1WC | | 12.0XU |(ED): limited | | | | | |platforms | | |2001-Apr-12 | +----------+-------------------+------------+---------------+--------------- + | | |12.1(5)T5 | | | | 12.0XV |Short-lived early | | | | | |deployment release |2001-Mar-05 | | | +=========================================================================== + |12.1-based and Later Releases | Rebuild | Interim** | Maintenance | +=========================================================================== + | All 12.1 | | | | Releases |Various platforms |Not Vulnerable | +=========================================================================== + | Notes | +=========================================================================== + | * All dates are estimated and Subject to change. | | | |** Interim releases are subjected to less rigorous testing than regular | | maintenance releases, and may have serious bugs. | +=========================================================================== + Obtaining Fixed Software Cisco is offering free software upgrades to remedy this vulnerability for all affected customers. Customers with service contracts may upgrade to any software release. Customers without contracts may upgrade only within a single row of the table above, except that any available fixed software release will be provided to any customer who can use it and for whom the standard fixed software release is not yet available. Customers may install only the feature sets they have purchased. Note that not all fixed software may be available as of the release date of this notice. Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained via Cisco's Software Center at http://www.cisco.com/. Customers without contracts or warranty should get their upgrades by contacting the Cisco Technical Assistance Center (TAC) as shown below: * (800) 553-2447 (toll-free in North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com See http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including instructions and e-mail addresses for use in various languages. Give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Please do not contact either "psirt(a)cisco.com" or "security-alert(a)cisco.com" for software upgrades; faster results will be obtained by contacting the TAC directly. Workarounds Several workarounds are available based on customer needs, equipment, and software features. The usefulness and practicality of each workaround depends on the IOS release running on the device and many variables in the customer's environment. Customers are urged to consider each of the following alternatives carefully before deploying. These workarounds are only needed if it is not possible to upgrade to an unaffected release of IOS software. A. Default workaround for use with releases for which no other workarounds are effective: 1. Applying access lists to all the interfaces of the vulnerable device blocking SNMP from all hosts but those authorized to manage the devices. 2. Blocking SNMP access at the edge of the network to prevent undesirable SNMP traffic from entering the network containing the vulnerable device. Access lists should be deployed with careful consideration of the possible effects on network operation and performance. Also note that authentication based on an IP source address is weak, so the preceding method will not protect against certain types of attacks in which the IP source address has been spoofed. Further information can be found in the Cisco document "Improving Security on Cisco Routers", available at http://www.cisco.com/warp/public/707/21.html B. For affected releases based on IOS 11.1: 1. Remove the view so that the ILMI community cannot be reached: no snmp-server view *ilmi 2. This configuration will not survive a system reload. The command must be re-entered after every restart of the system. C. For affected releases of IOS 11.2 through 11.3(8) NOT REQUIRING ATM: In this affected range of releases, the ILMI community string can be modified or deleted. However, the changes will not persist through a reboot of the device. These instructions must be re-applied following every system reload of the affected device: 1. Expose the undocumented ILMI community string so it can be modified: snmp-server community ILMI RW The preceding command may cause an error that can be safely ignored. 2. Disable read-write capability for the same community: no snmp-server community ILMI RW If an error is displayed, then this workaround cannot be applied to the device. Use the default workarounds presented in the first item above. 3. Since this configuration will not survive a system reload, the command must be re-entered after every restart of the system. If the command in item 2 above did not generate an error and ATM is not needed on this device, then this workaround is complete. D. For affected releases of IOS 11.2 through 11.3(8) THAT REQUIRE ATM: This workaround will allow ILMI to continue to function for ATM while constraining who may reconfigure the device by way of the ILMI community string: 1. Create a simple ACL to deny access using the following command. If "66" is already in use, choose a different two-digit number: access-list 66 deny any 2. Apply it generally to the ILMI community to restrict its view: snmp community ILMI view *ilmi RW 66 An error will be reported if the *ilmi view doesn't exist. If that occurs, then use the following command to explicitly restrict the ILMI view: snmp community ILMI RW 66 If the preceding command produces persistent errors, then this workaround cannot be applied to this device. Use the default workarounds presented in the first item above. E. For affected releases of IOS 11.3(9) through 12.0(2)T NOT REQUIRING ATM: All versions of IOS in this range will accept this workaround, and the change will remain in place after a system reload. 1. Expose the undocumented ILMI community string so it can be modified: snmp-server community ILMI RW The preceding command may cause an error that can be safely ignored. 2. Disable read-write capability for the same community: no snmp-server community ILMI RW If an error is displayed, then this workaround cannot be applied to the device. Stop this procedure and use the default workarounds presented in the first item above. F. For affected releases of IOS 11.3(9) through 12.0(2)T THAT REQUIRE ATM: This workaround will allow ILMI to continue to function for ATM while constraining who may reconfigure the device by way of the ILMI community string: 1. Create a simple ACL to deny access using the following command. If "66" is already in use, choose a different two-digit number: access-list 66 deny any 2. Apply it generally to the ILMI community to restrict its view: snmp community ILMI view *ilmi RW 66 An error will be reported if the *ilmi view doesn't exist. If that occurs, then use the following command to explicitly restrict the ILMI view: snmp community ILMI RW 66 If the preceding command produces persistent errors, then this workaround cannot be applied to this device. Use the default workaround presented in the first item above. G. For affected releases of IOS 12.0(3)T and later: These releases of IOS include support for Simple Network Management Protocol version 3 (SNMPv3), which is required for this workaround. 1. Confirm the presence of SNMPv3 support by asking the console CLI (command-line interpreter) for assistance with options to complete the snmp-server command. Enter config mode, enter the command shown below, and note the expected response: snmp-server user test test ? remote Specify a remote SNMP entity to which the user belongs v1 user using the v1 security model v2c user using the v2c security model v3 user using the v3 security model If the preceding command did not produce the expected results, then SNMPv3 is not supported in the release and this workaround cannot be applied. Stop this procedure and consider applying the default workaround presented above in the first item. Otherwise, if the device responded as expected, continue with the following explanation and instructions. In these IOS releases (12.0(3)T and later), ILMI packets are processed by the SNMP engine in the same manner as ordinary IP SNMP packets. An access control list or a view applied to the ILMI community string will be processed whether the transport is ILMI or IP. However, the only types of access control lists that can be applied to a community string are via IP access-list statements, which when applied, block ALL non-IP packets, including ILMI packets. Modifying or deleting the *ilmi view will also affect the packets transported by ILMI, so workarounds that change the view are equally ineffective at permitting ILMI while denying SNMP. In this range of releases, it is not possible to apply a workaround that denies IP SNMP packets that does not also deny ILMI SNMP packets. H. For affected releases of IOS 12.0(3)T and later NOT REQUIRING ATM: 1. Expose the undocumented ILMI community string so it can be modified: snmp-server community ILMI RW The preceding command may cause an error that can be safely ignored. 2. Disable read-write capability for the same community: no snmp-server community ILMI RW If an error is displayed, then this workaround cannot be applied to the device. Stop this procedure and consider using the default workaround. I. For affected releases of IOS 12.0(3)T and later THAT REQUIRE ATM: NOTE: This section also applies to 12.0-based ATM switch software such as for the LS1010 and the 8500 series. The only effective workaround for systems in this category is the default workaround: 1. Applying access lists to all the interfaces of the vulnerable device blocking SNMP from all hosts but those authorized to manage the devices. 2. Blocking SNMP access at the edge of the network to prevent undesirable SNMP traffic from entering the network containing the vulnerable device. Access lists should be deployed with careful consideration of the possible effects on network operation and performance. Also note that authentication based on an IP source address is weak, so the preceding method will not protect against certain types of attacks in which the IP source address has been spoofed. In this range of releases it is not possible to block IP SNMP packets while permitting ILMI SNMP packets. The alternative workarounds presented previously will almost certainly cause a failure of ATM ILMI communications resulting in a loss of ATM connectivity, either immediately upon configuration, or unexpectedly at some later time. Either use the default workaround or upgrade to fixed software. Exploitation and Public Announcements This vulnerability is known to the engineering staff of several Cisco customers. Cisco considers it known to the public prior to the publication of this notice. Cisco is aware of one recent incident involving the unauthorized modification of a router that appears to have resulted from this vulnerability. However, it may have been the unintended side-effect of a test of the vulnerability. Cisco is not aware of any available tools specifically designed to make use of this vulnerability. However, various off-the-shelf network management programs could easily be used to test for this vulnerability and to exploit it. Certain widely-available programs known to the cracker community could be modified by any reasonably competent programmer to automate the abuse of this vulnerability. Cisco is not aware of any general public discussion of this vulnerability other than the exceptions previously noted. Status of This Notice: INTERIM This is an interim security advisory. Cisco anticipates issuing updated versions of this notice at irregular intervals as there are material changes in the facts, and will continue to update this notice as necessary. The reader is warned that this notice may contain inaccurate or incomplete information. Although Cisco cannot guarantee the accuracy of all statements in this notice, all of the facts have been checked to the best of our ability. Cisco anticipates issuing monthly updates of this notice until it reaches FINAL status. A standalone copy or paraphrase of the text of this security advisory that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution This notice will be posted at http://www.cisco.com/warp/public/707/ios-snmp-ilmi-vuln-pub.shtml . In addition to Worldwide Web posting, a text version of this notice will be clear-signed with the Cisco PSIRT PGP key and will be posted to the following e-mail and Usenet news recipients: * cust-security-announce(a)cisco.com * bugtraq(a)securityfocus.com * firewalls(a)lists.gnac.com * first-teams(a)first.org (including CERT/CC) * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * comp.dcom.sys.cisco * Various internal Cisco mailing lists Future updates of this notice, if any, will be placed on Cisco's Worldwide Web server, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the URL given above for any updates. Revision History Revision 1.0 2001-Feb-27 First interim public version Cisco Product Security Incident Procedures Instructions for reporting product security vulnerabilities in Cisco products, obtaining assistance with customer security incidents, and registering to receive security information from Cisco can be found at http://www.cisco.com/warp/public/707/sec_incident_response.shtml , including instructions for press inquiries regarding Cisco Security Advisories. _______________________________________________________________ Copyright 2001 by Cisco Systems, Inc. This notice may be redistributed freely after the release date given at the top of the text, provided that redistributed copies are complete and unmodified, and include all date and version information. _______________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.2 iQEVAwUBOpuPFWiN3BRdFxkbAQEmvAf+Ng5nJtzMpp2Dl/N+ZDp4/4Ul1nqMt89P IcNr/9AKa/jCMKNE8z20/tql78f0oniJ3YfR2GcoFfgfRCRKEVJ5QvzH3r+8BLA2 9YRsmxg/96aVwMP9gLoh4RiO4+qoTwSZkOBJ/DlZFzM7TG8SjKvgtjqcHWiLH9wx /YnxrVWg0jmnY9NvsRQSmS4KvKjFXZXaUBzlH8pOcrY9+vScS6ol+HwCiQOynQYn 2sG+KEapKP/ld2iDcHZPjbFfVsKm+iCtMzcroqpA+ND3ezBeNe2yjJXZG9oWUiVR zLYima8yuU5Mm18b3BoBkM2npf5QP/zRinis9A8d+mlnPemAWVoWug== =xM8n -----END PGP SIGNATURE----- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: [jamesr@rd.bbc.co.uk: Warning: Cisco RW community backdoor.]
by Andy Linton 26 Feb '01

26 Feb '01

At 14:44 27/02/2001 +1300, David Robb wrote: >On Tue, 27 Feb 2001, Chris Wedgwood wrote: > > > Unless you have IOS 11.1 where this doesn't work :) > > > > "no snmp-server" > >11.2 seems to require the same treatment. I tried the "patch" on IOS 11.2 and 11.3 boxes such as 2500s and 2924 switches. I had to leave out the "log'" option on the access list. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Cisco IOS ILMI/SNMP
by Roger De Salis 26 Feb '01

26 Feb '01

Gentlefolks, Cisco has become aware of an issue with ILMI (and there is is another advisory pending) across several versions of IOS. Please look at the PSAT pages on www.cisco.com, as info will be available very shortly with full details. Rgds Roger De Salis James A.T. Rice wrote > Its looks like parts of my earlier email are somewhat misleading, > the ILMI community appears to only allow RW access to the system > object and possibly some more objects. Its not a 'standard' open > RW community. hence the damage caused by this backdoor is limited. > There is still some write access however, so the fix mentioned > below is still highly recommended. > > And of course - it allows people to read what IOS/model cisco > you have, which could be used to find exploitable bugs in that > particular release. Oh I wonder what the chances of having a > router stolen due to discovery of system.sysLocation is! :-) > > Warm Regards > James -- \_ Roger De Salis Cisco Systems NZ Ltd </' +64 25 481 452 L8, ASB Tower, 2 Hunter St /) +64 4 496 9003 Wellington, New Zealand (/ roger(a)desalis.gen.nz rdesalis(a)cisco.com ` --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

[jamesr@rd.bbc.co.uk: Warning: Cisco RW community backdoor.]
by Joe Abley 26 Feb '01

26 Feb '01

----- Forwarded message from "James A. T. Rice" <jamesr(a)rd.bbc.co.uk> ----- Date: Tue, 27 Feb 2001 00:39:38 +0000 (GMT) From: "James A. T. Rice" <jamesr(a)rd.bbc.co.uk> X-Sender: <jamesr(a)inet15> To: <members(a)lonap.net>, <ops(a)linx.net> Subject: Warning: Cisco RW community backdoor. Precedence: bulk If your router responds to `snmpwalk router.isp.net.uk ILMI`, you probabally will want to do the following to disable it: conf t snmp-server community ILMI RO 99 access-list 99 deny any log (pick another spare access-list if 99 isn't available) If you dont, assuming your ios/hardware combination supports it, (most of the bigger routers do) anyone can do things like: `snmpset router.isp.net.uk ILMI system.sysName.0 s \ "ALL YOUR ROUTER ARE BELONG TO US."` Thats a harmless example. You can do almost anything with RW snmp. Warm Regards James -- James A. T. Rice | Email: jamesr(a)rd.bbc.co.uk Internet Operations Engineer | Phone: 01737 839 737 BBC Internet Services, Kingswood Warren, Tadworth, Surrey, UK. ----- End forwarded message ----- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

IOS & BGP
by James Tyson 26 Feb '01

26 Feb '01

Does anyone know what version of IOS the "bgp go faster you bitch" command appears in? It doesnt appear to be in 12.0(14)S. Sigh. Cheers. James Tyson --- Samizdat New Media Solutions --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

RE: ATM card in Cisco 4500
by Scott, Arron 26 Feb '01

26 Feb '01

Not speaking on behalf of any company in particular, I just wanted to say I know of a number of 4500's and 4700's running in production with the ATM card. Their throughput is limited by the CPU performance, but you can expect to get upwards of 40Mbps through it. If you want more than an OC3 I would suggest you look at something like a 7600 OSR, not speaking on behalf of any company in particular of course. Now we just need a Telco or three in NZ to support ATM at STM-4 rates. Arron Scott -----Original Message----- From: owner-nznog(a)list.waikato.ac.nz [mailto:owner-nznog(a)list.waikato.ac.nz]On Behalf Of Dennis Su Sent: Tuesday, 20 February 2001 7:04 p.m. To: nznog(a)list.waikato.ac.nz Subject: ATM card in Cisco 4500 Hi, We would like to purchase a ATM card for a Cisco 4500. Someone has mentioned to us that its ATM card is not very stable, although I doubt it. 4500 series router has been on the market for such a long time after all. I wonder if anyone can give us some previous experience. Good or bad and what type, all welcome. Thanks, Dennis ------------------------------------------------------------------------ ---- ----------------- Dennis Su, BSc MSc Network+ MCP CCNA CCDA CCNP CCDP Team Leader, Network Admin and Development IT Infrastructure, ITS, University of Waikato Hamilton, New Zealand phone:64 7 838 4183 email:d.su(a)waikato.ac.nz http://network-services.its.waikato.ac.nz/people/dennis.html --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

6 11

software required -- could be urgent
by Chris Wedgwood 24 Feb '01

24 Feb '01

... but probably it's not. Serious network software required. Only the network part isn't completely true :) I _need_ RollCage or RollCage II -- if I don't get this I'm sure something serious will happen; the entire Internet will stop routing or something. I am sure it will. I can feel it. I know the former was for sale at the warehouse for 20 bucks or so, but I can't find it now... the later, no idea. They are both old games by todays standards. Someone somewhere must have either both or one of these games. ... please ... :) --cw P.S. SPAM SPAM SPAM SPAM SPAM SPAM SPAM! --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: ATM card in Cisco 4500
by Scott, Arron 23 Feb '01

23 Feb '01

ATM is FAR WORSE than that, but it helps sell stuff in New Zealand ;-) Arron Scott Not speaking for any company in particular -----Original Message----- From: Joe Abley [mailto:jabley(a)automagic.org] Sent: Friday, 23 February 2001 3:49 a.m. To: Scott, Arron Cc: Dennis Su; nznog(a)list.waikato.ac.nz Subject: Re: ATM card in Cisco 4500 On Thu, Feb 22, 2001 at 02:17:09PM +1100, Scott, Arron wrote: > Now we just need a Telco or three in NZ to support ATM at STM-4 > rates. Is anybody really waiting for that? If you're shifting an STM-4s worth of data around, it's probably a stream of packets, and it's probably IP, and you probably want to use POS. You probably don't want the additional complexity, cost, operational overhead, cell tax and SAR latency that using ATM would involve. Also, ATM is the work of Satan, which should be mentioned, for the record. Joe --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

6 5

RE: ATM card in Cisco 4500
by Scott, Arron 22 Feb '01

22 Feb '01

Yeah yeah ... we're all telling the Service Providers that Broadband is critical, but that still doesn't change the fact that ATM aggregation, ADSL/FR access, legacy support, and the ability to run a fair bit of point-to-point bandwidth over an STM-4 ATM access is still quite attractive for a market like NZ. And being one who had to fight VERY hard to get POS inside a certain Telco here at all, I would love to see more widespread use of it. STM/4 ATM gives my customers what they want and need, not what I want to sell !!! Arron Scott -----Original Message----- From: dean(a)flatnet.gen.nz [mailto:dean(a)flatnet.gen.nz] Sent: Friday, 23 February 2001 4:45 p.m. To: Scott, Arron Cc: Joe Abley; nznog(a)list.waikato.ac.nz Subject: Re: ATM card in Cisco 4500 I'd rather sell something that had a future, and not cripple networking in NZ any more than it already is. No matter how much easier it made the sale. Customers listen to what vendors have to say. Vendors should be telling them the truth, not just what they think will make the sale. Long live POS =) Dean Not speaking for, or about, any company in particular On Fri, Feb 23, 2001 at 02:01:55PM +1100, Scott, Arron wrote: > ATM is FAR WORSE than that, but it helps sell stuff in New Zealand ;-) > > Arron Scott > Not speaking for any company in particular > > -----Original Message----- > From: Joe Abley [mailto:jabley(a)automagic.org] > Sent: Friday, 23 February 2001 3:49 a.m. > To: Scott, Arron > Cc: Dennis Su; nznog(a)list.waikato.ac.nz > Subject: Re: ATM card in Cisco 4500 > > > On Thu, Feb 22, 2001 at 02:17:09PM +1100, Scott, Arron wrote: > > Now we just need a Telco or three in NZ to support ATM at STM-4 > > rates. > > Is anybody really waiting for that? If you're shifting an STM-4s worth > of data around, it's probably a stream of packets, and it's probably IP, > and you probably want to use POS. You probably don't want the additional > complexity, cost, operational overhead, cell tax and SAR latency that > using ATM would involve. > > Also, ATM is the work of Satan, which should be mentioned, for the > record. > > > Joe > --------- > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > where the body of your message reads: > unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: ATM card in Cisco 4500
by dean＠flatnet.gen.nz 21 Feb '01

21 Feb '01

Having a look on the Cisco Web site it seems that the fastest interface is an oc3. http://www.cisco.com/univercd/cc/td/doc/pcat/4700m.htm It might be an old website though. If it were me I would POC this to death before I bought it. The 4500 is pretty old and MAY not be able to feed an oc12 and do everything that you want it to do. Dean (Who does not speak on behalf of any employer) On Thu, Feb 22, 2001 at 11:40:17AM +1300, Lindsay Druett wrote: > OC12 > > -----Original Message----- > From: dean(a)flatnet.gen.nz [mailto:dean(a)flatnet.gen.nz] > Sent: Thursday, 22 February 2001 11:39 > To: nznog(a)list.waikato.ac.nz > Subject: Re: ATM card in Cisco 4500 > > > > On Wed, Feb 21, 2001 at 04:04:21PM +1300, Dennis Su wrote: > > > We would like to purchase a ATM card for a Cisco 4500. Someone has > > > mentioned to us that its ATM card is not very stable, although I doubt > it. > > > 4500 series router has been on the market for such a long time after > all. I > > > wonder if anyone can give us some previous experience. Good or bad and > what > > > type, all welcome. > > What speed ATM are you talking here? > > > Dean > (Who does not speak on behalf of any employer) > --------- > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > where the body of your message reads: > unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 2

Re: ATM card in Cisco 4500
by dean＠flatnet.gen.nz 21 Feb '01

21 Feb '01

=) No Problems. I'd still POC it, But thats just me. Dean (Who does not speak on behalf of any employer) On Thu, Feb 22, 2001 at 12:06:03PM +1300, Lindsay Druett wrote: > I beg your pardon, it is an OC3 indeed (what was I thinking ?) > > -----Original Message----- > From: dean(a)flatnet.gen.nz [mailto:dean(a)flatnet.gen.nz] > Sent: Thursday, 22 February 2001 11:50 > To: Lindsay Druett; nznog(a)list.waikato.ac.nz > Subject: Re: ATM card in Cisco 4500 > > > > Having a look on the Cisco Web site it seems that the fastest interface is > an oc3. > http://www.cisco.com/univercd/cc/td/doc/pcat/4700m.htm > > It might be an old website though. > > If it were me I would POC this to death before I bought it. The 4500 is > pretty old and MAY not be able to feed an oc12 and do everything that you > want it to do. > > > Dean > (Who does not speak on behalf of any employer) > > On Thu, Feb 22, 2001 at 11:40:17AM +1300, Lindsay Druett wrote: > > OC12 > > > > -----Original Message----- > > From: dean(a)flatnet.gen.nz [mailto:dean(a)flatnet.gen.nz] > > Sent: Thursday, 22 February 2001 11:39 > > To: nznog(a)list.waikato.ac.nz > > Subject: Re: ATM card in Cisco 4500 > > > > > > > On Wed, Feb 21, 2001 at 04:04:21PM +1300, Dennis Su wrote: > > > > We would like to purchase a ATM card for a Cisco 4500. Someone has > > > > mentioned to us that its ATM card is not very stable, although I doubt > > it. > > > > 4500 series router has been on the market for such a long time after > > all. I > > > > wonder if anyone can give us some previous experience. Good or bad and > > what > > > > type, all welcome. > > > > What speed ATM are you talking here? > > > > > > Dean > > (Who does not speak on behalf of any employer) > > --------- > > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > > where the body of your message reads: > > unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

ATM card in Cisco 4500
by Dennis Su 21 Feb '01

21 Feb '01

Hi, We would like to purchase a ATM card for a Cisco 4500. Someone has mentioned to us that its ATM card is not very stable, although I doubt it. 4500 series router has been on the market for such a long time after all. I wonder if anyone can give us some previous experience. Good or bad and what type, all welcome. Thanks, Dennis ---------------------------------------------------------------------------- ----------------- Dennis Su, BSc MSc Network+ MCP CCNA CCDA CCNP CCDP Team Leader, Network Admin and Development IT Infrastructure, ITS, University of Waikato Hamilton, New Zealand phone:64 7 838 4183 email:d.su(a)waikato.ac.nz http://network-services.its.waikato.ac.nz/people/dennis.html --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

FYI: ihug DNS server ips.
by Simon Lyall 20 Feb '01

20 Feb '01

Just a note that ihug is in the process of changing it's main DNS ips (as used by customers). Previously almost all customers were using 203.29.160.4 and 203.29.160.2 but we have now switched to 203.109.252.42 and 203.109.252.43. It is likely that there are 10,000s of ihug and ex-ihug customers with the old ip's manually setup in their configurations. Since we are returning these networks to Telstra they will cease being advertised outside our network sometime next week. You may wish to warn your helpdesk to keep an eye open for this. -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | | Home: simon(a)darkmere.gen.nz ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

New 2LD Voting - Feedback request
by Sue Leader 19 Feb '01

19 Feb '01

Greetings There will be a meeting of the Council of the Society this Friday the 23rd. The Council will consider the following options in regard to voting rights for new 2LD applications. Your comments are encouraged: ================= Motion 1 Abstract The Request for Votes for the .bank.nz application requires a voting electorate. After review and consideration 3 options have been presented for discussion and voting. Option 1 The electorate for the RFV shall be members of good standing of ISOCNZ as of the day before the vote is called. Reason: Known community that is easy to reach and identify which has a greater propensity to understand the issues surrounding the vote. Option 2 The electorate for the RFV shall be name holders or name holder representatives of a name in the .nz name space. A person would be only be able to vote once no matter how many names they had that qualified. Reason: The addition of a new 2LD directly affects current name holders. By having a name in the .nz spaces means they are an existing stakeholder in the .nz name space. Option 3 The electorate for the RFV shall be any person that has an email address in the .nz name space, i.e. steven.heath(a)isocnz.org.nz but not steven.heath(a)seranova.com. A person would be only be able to vote once no matter how many email addresses they had that qualified. Reason: By having an address in the .nz name space means they have an affinity with .nz and provides the widest possible community. Also does not exclude anyone based on having membership or an existing name. Preferred Motion 1 wording: That the electorate for the RFV for the .bank.nz be any person that has an email address in the .nz name space. A person would be only be able to vote once no matter how many email addresses they had that qualified. ======= Cheers Sue Sue Leader - Executive Director ISOCNZ (Internet Society of New Zealand Inc) Exe.Dir(a)isocnz.org.nz Voice: +64-4-801-6256 http://www.isocnz.org.nz PLEASE NOTE CHANGE: P.O.Box 11-881, Wellington --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Deadline Extension - Green Paper
by Sue Leader 15 Feb '01

15 Feb '01

Greetings The Society has received requests for extension of the deadline for the SRS Implementation as the notification was not received by everyone on Feb 2 when I orginally sent it out. I resent the notice on the 8th, as even though the message went to the archives and some people had received it, clearly not everyone had. On that basis the Chair has agreed to an extension until Friday March 2 - 5:00pm. Please send all Submissions to me direct for collation. Cheers Sue Sue Leader - Executive Director ISOCNZ (Internet Society of New Zealand Inc) Exe.Dir(a)isocnz.org.nz Voice: +64-4-801-6256 http://www.isocnz.org.nz Postal: Level 1, (e)-Vision Centre, 282 Wakefield St, Wellington "Error: Press any key to continue or any other key to quit..." --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

ORBS blocking Domainz servers
by Don Stokes 15 Feb '01

15 Feb '01

Hello All, A heads-up for anyone using ORBS for spam filtering: ORBS has added the following manual entries to its database: 18.160.46.202.inputs.orbs.org IN TXT "Domainz.net.nz - Attacks on ORBS and ORBS hosters." 50.160.46.202.inputs.orbs.org IN TXT "Domainz.net.nz - Attacks on ORBS and ORBS hosters." 37.16.96.203.inputs.orbs.org IN TXT "Delivery point for Domainz.net.nz - Attacks on ORBS and ORBS hosters." These represent the hosts www.domainz.net.nz, office.domainz.net.nz and mail2.actrix.gen.nz respectively. The records were added on the 9th Feb 2001, according to the ORBS database web pages. The impact of this is that if a site is using ORBS for spam blocking, it will reject mail from the Domainz automated systems, including notifications of passwords, nameserver changes, reminders of accounts due and other automatically generated DRS notifications. It will also reject mail from the Actrix list server, which includes Domainz mailing lists, ISOCNZ mailing lists and presumably others. Normal customer service email should be unaffected, as these come from other Actrix hosts. Suffice to say, none of these addresses have been used to attack the ORBS service or systems, nor do the mail servers on these addresses relay spam or block ORBS queries. Email queries to ORBS by myself and Actrix staff have not elicited a reply. Unless ORBS decides to remove these records, anyone needing to to communicate (or having customers that may need to communicate) with Domainz should ensure that ORBS is not in use by their mail exchangers, or arrangements to bypass the blocks on the Domainz addresses are in place. -- don --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

15 23

zivo.co.nz (ex clearview.co.nz)
by PhoneNet 15 Feb '01

15 Feb '01

Following on from the ORBS discusion...... Anyone else having problems getting replies from zivo.co.nz (formerly clearview.co.nz) Our main email address was used to sign up to several porn sites from one of their IPs - The originating IP for the sign up process was recorded as: 202.78.157.14 which resolves to the address: >> router-cyber.cl.clearview.co.nz. Despite three emails regarding the matter I've had no response from them...... Ian Cousins --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Xtra / WIX
by Richard Naylor 14 Feb '01

14 Feb '01

At 03:35 PM 2/15/01 +1300, Ben Martel wrote: >Tony, > >It is the same for us (CLEAR) at the mo! Their router is there (ie. BGP is >active) but we are not exchanging any prefixes. > >I'm sure someone at Xtra is looking into it - right? Yep - I gave Peter a call about 2:40 and he had someone on the way to fix it. Sounded like internal switch failure/wedge. I understand dial-up users are down also - but then I don't use modems very often...... rich richard.naylor(a)citylink.co.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Xtra / WIX
by Ben Martel 14 Feb '01

14 Feb '01

Tony, It is the same for us (CLEAR) at the mo! Their router is there (ie. BGP is active) but we are not exchanging any prefixes. I'm sure someone at Xtra is looking into it - right? ~benm --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Xtra / WIX
by Tony Wicks 14 Feb '01

14 Feb '01

Hi all, my peering session with Xtra on WIX has disappeared, anyone know what has happened there ? --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0