- NZNOG - lists.nznog.org

Re: [nznog] ISP's Natting customer pools
by Perry Lorier 20 Feb '07

20 Feb '07

(Reposted to the list *with* Simons permission): Simon Lyall wrote: >> If you looked at the "top ports" you'll see 135, 139, 445 make an >> appearance which are used by various windows worms, so obvious some >> users are infected with virii. However this isn't going to push peoples >> port counts up to the 1,000's like p2p will. > > Have you got numbers for each port as well as the combos? Something like: > > Port 25 - 70% > Port 80 - 75% > Port 443 - 56% > /--- Percentage of IP's that sent a packet on this port | /------ Port number v v 98.11 80/tcp 98.09 53/udp 95.64 443/tcp 73.63 110/tcp 60.43 25/tcp 41.83 123/udp 36.18 22/tcp <-- ! 33.89 7001/udp 33.62 1433/tcp 33.22 5900/tcp 32.81 6000/tcp 31.07 139/tcp 30.86 445/tcp 30.60 135/tcp 26.40 21/tcp 25.73 2967/tcp 25.42 8080/tcp 23.79 42/tcp 21.62 10000/tcp 20.84 9/udp <-- wtf? 19.62 6346/tcp 19.49 1863/tcp 17.31 1080/tcp 16.98 6346/udp 15.49 3389/tcp 15.14 10827/tcp 14.83 10929/tcp 13.94 26200/tcp 13.22 6348/udp 12.92 6348/tcp 12.48 15118/tcp 11.99 20000/tcp 11.41 12350/udp 11.32 8000/udp 11.21 6881/tcp 11.02 80/udp 10.84 5800/tcp 10.84 5000/tcp 10.62 7001/tcp

1 0

Re: [nznog] [Fwd: [pacnog] IPv4 exhaustion discussionsin Asia Pacific region]
by Jonathan Woolley 20 Feb '07

20 Feb '07

> Indeed one might speculate that the vast bulk of users in a very large > country using a complex language of their own might not miss the > english speaking world to any great extent. For those who found it a > problem (international traders) legitimate v4 addresses could be > allocated. I can see the headlines now: "[Vendor] charges [country] $[lots] to enable NAT on the great firewall. They decide to go with iptables instead" =)

26 91

[Fwd: Re: ISP's Natting customer pools]
by Gerard Creamer 20 Feb '07

20 Feb '07

Fascinating stuff - thanks for posting it. I find it most interesting that over 60% of DSL users systems know about and use more than 20 protocols. What is the sample size? Just approximate - 100s, 1000s, 10s of 000s ? I can understand if you didn't want to say, but it would help with rough deviation / error % Thanks, Gerard Perry Lorier wrote: > Well, I ran an analysis of DSL customers[1] over the space of 24 hours > [4] to see how many different protocols people were using. For each IP > I kept track of the number of unique "server ports"[2] were used.[3] >

2 1

Prime Minister heart attack trojan spam run
by matthew＠auscert.org.au 18 Feb '07

18 Feb '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 G'day all Have just released an alert on a(nother) trojan spam run at: AL-2007.0026 -- [Win] -- "Prime Minister heart attack" trojan http://www.auscert.org.au/7314 Basically there being emails currently in circulation with a variety of subject lines, including: "Current Australia's Prime Minister survived a hear attack" "The life of the Prime Minister is in grave danger" "Prime Minister survived a heard attack" with a link to malicious websites, including: h**p://www,austr-news,com/ h**p://www,theaunews,com/ h**p://www,theau-news,org/ Anyone seeing a lot of this? Perhaps targeting other heads of state? Might be worth keeping an eye out as we've seen similar to this before: AL-2006.0069 -- [Win] -- "John Howard tragedy" email attachment installs Torpig credential stealing trojan http://www.auscert.org.au/6645 with similar 'hooks' in that one appearing to be targeting Italy and the UK at least with messages of their government leaders' reported assassination. Feedback appreciated. Best regards, - -- Matthew McGlashan -- Coordination Centre Team Leader | Hotline: +61 7 3365 4417 Australian Computer Emergency Response Team | Direct: +61 7 3365 7924 (AusCERT) | Fax: +61 7 3365 7031 The University of Queensland | WWW: www.auscert.org.au Qld 4072 Australia | Email: auscert(a)auscert.org.au -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (FreeBSD) Comment: http://www.auscert.org.au/render.html?it=1967 Comment: http://www.auscert.org.au/render.html?it=1967 iQCVAwUBRdlMDyh9+71yA2DNAQKhGwQAmY99YaXxm48qj5LqxSSYYeMlTTSjWIvm F1S/Qop5km5/e2ZrDNJHbojfVNpLg9YrXGG8AxtY5nTcD852ojBuTf9tBmHUwqwF ljnyc4L6zxZ4iFzFWEZhypXBcnN6AZEYU8++vnnqePCK6KPfZsNJkhgodq2L53n9 GimZG4XHaso= =/dMS -----END PGP SIGNATURE-----

1 0

[Fwd: [pacnog] IPv4 exhaustion discussions in Asia Pacific region]
by Andy Linton 18 Feb '07

18 Feb '07

Given our discussions on IPv4 and IPv6 at the recent nznog meeting some of you may be interested in this. -------- Original Message -------- Subject: [pacnog] IPv4 exhaustion discussions in Asia Pacific region Date: Mon, 12 Feb 2007 10:44:32 +1000 (EST) From: Elly Tawhai <elly(a)apnic.net> To: pacnog(a)pacnog.org Hi You are probably aware by now that the exhaustion of IPv4 address space is likely to occur in the next few years. You might be interested to know that a proposal to deal with IPv4 exhaustion has been put forward for discussion in the APNIC region. The proposal suggests five main principles: (1) Global synchronization: All five RIRs will proceed at the same time for measures on IPv4 address exhaustion. (2) Some Blocks to be left: Keep a few /8 stocks instead of distributing all. (3) Keeping current practices until the last moment: Maintain the current policy until the last allocation. (4) Separate discussions on "recycle" issue: Recovery of unused address space should be discussed separately For more information on the proposal, see: http://www.apnic.net/docs/policy/proposals/prop-046-v001.html This proposal affects the whole Internet community. I encourage you to read the proposal and have your say on the APNIC Policy SIG mailing list, or at the upcoming APNIC 23 meeting in Bali, Indonesia, 26 February - 2 March 2007. If you can't attend the meeting in person, you can still have your say by participating remotely via live chat. APNIC Policy SIG mailing list information: http://www.apnic.net/community/lists APNIC 23: http://www.apnic.net/meetings/23/ Kind regards, Elly APNIC

13 13

[Fwd: [pacnog] IPv4 exhaustion discussionsin Asia Pacific region]
by Patrick Jordan-Smith 18 Feb '07

18 Feb '07

> Which is a problem if we are reliant on the telco's to move to IPv6. > Why would any sane [NZ] telco spend serious money changing to a > technology which further relegates them to a common bit pusher? > There is an argument here that IPv4 exhaustion provides a technical > rational for telcos to provide walled garden, proxy-style services. I fully support this style of thinking. Infact, if I was an ISP I would be seriously considering NATing my entire customer base - except for those who were willing to pay $x/mo for a real IP. At the end of the day, with a few exceptions, most protocols work quite well from behind a nat. And it gives me another revenue stream, which if I am an ISP would be quite useful considering I am probably losing money on the DSL I am currently providing. Cheers, Patrick -- patpatnz(a)gmail.com

6 6

APNIC fee structure - Online voting period extended
by Elly Tawhai 18 Feb '07

18 Feb '07

Dear Colleagues Voting on the APNIC fee schedule questions has now been extended by one week. The APNIC Executive Council decided to extend the online vote due to the low number of responses so far. This is an important issue for all APNIC members, so we encourage you to have your opinions counted. The new deadline for votes is 14:00 UTC, Friday 23 February, 2007. To vote, or get more information about the process, please go to: https://my.apnic.net/voting Please note that only registered voting contacts are able to cast votes. If you have any questions about using MyAPNIC, please contact helpdesk(a)apnic.net. Kind regards, Elly ________________________________________________________________________ Elly Tawhai email: elly(a)apnic.net Internet Resource Analyst, APNIC sip: elly(a)voip.apnic.net http://www.apnic.net/helpdesk phone: +61 7 3858 3188 fax: +61 7 3858 3199 ________________________________________________________________________ See you at APNIC 23! Bali, 26 February - 2 March, 2007 http://www.apnic.net/meetings

1 0

Re: [nznog] [Fwd: [pacnog] IPv4 exhaustion discussionsin Asia Pacific region]
by Ewen McNeill 17 Feb '07

17 Feb '07

In message <2B310DEB-219F-4F70-9779-F27EDDEE60AA(a)ca.afilias.info>, Joe Abley writes: >On 16-Feb-2007, at 17:00, Nathan Ward wrote: >> End-to-end IP connectivity is so passe. > >But it's arguably what allowed the Internet to grow and flourish. If >the network controls the applications that users can deploy, then >[provider catchup or user disappointment or] >people will stop dreaming up new applications for users to run, and >will instead concentrate on packages they can sell to carriers and ISPs. Or, perhaps worse, all new applications will have an extra layer to "route around" this problem. The rise of application data over XML over HTTP (over SSL) over TCP over IP hints at what this world might be like. That's not exactly progress. The security folks aren't exactly keen on this either (even without the SSL, it's very hard to "pinhole" inspect what is going on in the midst of large XML payloads, and you don't get much of a service type indicator if it's all XML over HTTP). The "big win" of Skype, and Kazaa before it, is its ability to "route around" the NAT everywhere, firewall everywhere, world and overlay what is basically an end-to-end network again (at least bits of it created on demand). That's not exactly progress either. Some other possibilities have been suggested, such as smarter intermediate boxes (firewalls, NAT), with which one negotiates (as in a protocol to request) a path through to the end box. This is already starting to happen with, eg, STUN, but potentially could be formalised as part of connection setup, and done automatically rather than requiring per-application custom setup. One is left wondering if instead of inventing random ad-hoc "tunnel through intermediate boxes" protocols it may be that things converge on, eg, 6-over-4. At least, eg, application over TCP over IPv6 over IPv4 is still pretty transparent, and doesn't have _that_ much overheard (compared with, eg, XML over HTTP). And there's some eventual migration path which involves reducing layers (eventually when everything is 6-over-4 it makes sense to just get rid of the IPv4 bit). Ewen

1 0

Apropos addressing
by Juha Saarinen 17 Feb '07

17 Feb '07

Geoff Huston has something to say on that: http://www.circleid.com/posts/addressing_the_future_internet/ (Shamelessly nicked from Bill St Arnaud's CAnet news: http://www.canarie.ca/canet4/library/list.html) -- Juha Saarinen www.geekzone.co.nz/juha | Skype: juha_saarinen blogs.pcworld.co.nz/pcworld/techsploder www.computerworld.co.nz | MSN: juha_saarinen(a)msn.com Voice: +64 9 950 3023 Subtle recursive jokes in .sigs are not funny.

2 1

Notification of NZRR Database changes
by NZRR Database Notifications 13 Feb '07

13 Feb '07

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS38292 descr: Route set advertised to AS9439 by Zero One - AS38292 members: 210.48.94.0/24^24-29, 210.48.103.192/26^26-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: nick(a)01.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070212 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS38292 descr: advertised to AS9439 by ZeroOne (NZ) Limited - AS38292 members: 202.174.6.0/23^23-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc(a)zeroone.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070214 source: NZRR

1 0

NZNOG 2007: Sysadmin Miniconf: Slides available
by Ewen McNeill 11 Feb '07

11 Feb '07

For those that attended the Sysadmin Miniconf at NZNOG 2007 (or wished to but had conflicts), the slide sets from most of the talks at the miniconf are now online: http://nznog.miniconf.org/ Thank you to everyone who participated in the miniconf and helped make it a success, and especially to those who spoke at the miniconf. If anyone has anything else that they want linked to the Sysadmin Miniconf page please email it to <talks(a)nznog.miniconf.org>. Ewen

1 0

Notification of NZRR Database changes
by NZRR Database Notifications 11 Feb '07

11 Feb '07

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9560:RS-ROUTES:AS9503 descr: advertised to AS9560 by FX Networks - AS9503 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 202.53.176.0/20^20-29, 202.174.160.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 202.46.176.0/21^21-29, 202.78.240.0/21^21-29, 203.190.208.0/21^21-29, 202.37.48.0/22^22-29, 202.59.4.0/22^22-29, 202.124.106.0/23^23-29, 192.88.85.0/24^24-29, 192.133.31.0/24^24-29, 202.20.97.0/24^24-29, 202.27.208.0/24^24-29, 202.36.119.0/24^24-29, 202.36.183.0/24^24-29, 202.46.190.0/24^24-29, 202.50.247.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc-minor(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20061214 source: NZRR REPLACED BY: route-set: AS9560:RS-ROUTES:AS9503 descr: advertised to AS9560 by FX Networks - AS9503 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 202.53.176.0/20^20-29, 202.174.160.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 123.108.144.0/21^21-29, 202.46.176.0/21^21-29, 202.78.240.0/21^21-29, 203.190.208.0/21^21-29, 202.37.48.0/22^22-29, 202.59.4.0/22^22-29, 202.124.106.0/23^23-29, 192.88.85.0/24^24-29, 192.133.31.0/24^24-29, 202.20.97.0/24^24-29, 202.27.208.0/24^24-29, 202.36.119.0/24^24-29, 202.36.183.0/24^24-29, 202.46.190.0/24^24-29, 202.50.247.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc-minor(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070212 source: NZRR

1 0

Notification of NZRR Database changes
by NZRR Database Notifications 11 Feb '07

11 Feb '07

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS9503 descr: advertised to AS9439 by FX Networks - AS9503 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 202.53.176.0/20^20-29, 202.174.160.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 202.46.176.0/21^21-29, 202.78.240.0/21^21-29, 203.190.208.0/21^21-29, 202.37.48.0/22^22-29, 202.59.4.0/22^22-29, 202.124.106.0/23^23-29, 192.88.85.0/24^24-29, 192.133.31.0/24^24-29, 202.20.97.0/24^24-29, 202.27.208.0/24^24-29, 202.36.119.0/24^24-29, 202.36.183.0/24^24-29, 202.46.190.0/24^24-29, 202.50.247.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc-minor(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20061218 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS9503 descr: advertised to AS9439 by FX Networks - AS9503 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 202.53.176.0/20^20-29, 202.174.160.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 123.108.144.0/21^21-29, 202.46.176.0/21^21-29, 202.78.240.0/21^21-29, 203.190.208.0/21^21-29, 202.37.48.0/22^22-29, 202.59.4.0/22^22-29, 202.124.106.0/23^23-29, 192.88.85.0/24^24-29, 192.133.31.0/24^24-29, 202.20.97.0/24^24-29, 202.27.208.0/24^24-29, 202.36.119.0/24^24-29, 202.36.183.0/24^24-29, 202.46.190.0/24^24-29, 202.50.247.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc-minor(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070212 source: NZRR

1 0

Notification of NZRR Database changes
by NZRR Database Notifications 11 Feb '07

11 Feb '07

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- OBJECT BELOW CREATED: aut-num: AS38292 as-name: NZRR-AS38292 descr: Zero One descr: WIX peering at '202.7.1.17' descr: see Citylink RT job #245 admin-c: RPA1-NZRR tech-c: RPA1-NZRR import: from AS9439 accept ANY AND NOT fltr-bogons export: to AS9439 announce AS38292 notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: nick(a)01.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070212 source: NZRR --- OBJECT BELOW CREATED: route-set: AS9439:RS-ROUTES:AS38292 descr: Route set advertised to AS9439 by Zero One - AS38292 members: 210.48.94.0/24^24-29, 210.48.103.192/26^26-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: nick(a)01.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070212 source: NZRR

1 0

Off Topic - Woosh VoIP engineer please contact me off list..
by Chris Hodgetts 09 Feb '07

09 Feb '07

I had VoIP issues with Woosh awhile ago, and was advised by a tech there that they would start to support RFC2833 as opposed to INBAND DTMF on their VoIP system (when he spoke to me he advised in about 3 weeks, but this was well before Christmas) This is yet to happen, and I am still having issues calling a few IVR systems and would like to get it resolved if I can - or at least know of a date this might take place. Cheers, and apologies for taking this off topic, and because I don't drink I cant bring it back on topic..... but I am sure someone can drink enough for me. Cheers thanks again.

5 4

Notification of NZRR Database changes
by NZRR Database Notifications 07 Feb '07

07 Feb '07

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- OBJECT BELOW CREATED: aut-num: AS17663 as-name: NZRR-AS17663 descr: Housing New Zealand Corporation descr: WIX peering at '202.7.0.149' descr: see Citylink RT job #8222 admin-c: RPA1-NZRR tech-c: RPA1-NZRR import: from AS9439 accept ANY AND NOT fltr-bogons export: to AS9439 announce AS17663 notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: ns(a)hnzc.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070208 source: NZRR --- OBJECT BELOW CREATED: route-set: AS9439:RS-ROUTES:AS17663 descr: Route set advertised to AS9439 by Housing New Zealand Corporation - AS17663 members: 192.173.17.0/24^24-29, 202.37.197.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: ns(a)hnzc.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070208 source: NZRR

1 0

A new policy proposal "IPv4 countdown policy proposal" - APNIC 23
by Miwa Fujii 06 Feb '07

06 Feb '07

Hi All, Thanks for the NZNOG 2007 committee's efforts to make successful NZNOG 2007. Thanks also for NZNOG community pple's warm hospitality to us. I very much enjoyed technical presentations, the panel discussion and both formal/informal social events. As we discussed in the panel discussion "Where to spend the money, IPv6, or somewhere else?", there were quite a few dimensions to discuss this topic. As NZNOG is a technical community, naturally, the discussion was drawn into technical details of IPv6. However, we briefly discussed about the relationship between IPv4 address exhaustion and IPv6. There is a policy proposal for the upcoming APNIC 23 in Bali, titled "IPv4 countdown policy proposal" http://www.apnic.net/docs/policy/proposals/prop-046-v001.html I think having a wider community's input to this proposal would be good. If you have any comment, please feel free to post it to the APNIC sig-policy mailing list. You can subscribe the mailing list from: http://www.apnic.net/community/lists/index.html Looking forward to hearing your view. miwa

1 0

Thursday night curry in Hamilton?
by Ian McDonald 06 Feb '07

06 Feb '07

Jayne and I have thought about this and decided that it's really time Hamilton got their act together on this one. Various people/groups have talked about this but no-one has done this yet (that I'm aware of) and we'd like to see this kick off. Since many of you from Hamilton probably met each other at NZNOG (shame I couldn't make it) I thought it'd be a good time to mention it while you still remember each other. If you're interested please email me off list. Also can whoever looks after the domain/server (Jamie Baddeley?) contact me to see how we can put Hamilton on. NB I'm not going to make token reference to beer as think networking (in the social sense) is quite a relevant topic. And more than token amount of beer might get consumed anyway! Ian -- Web: http://wand.net.nz/~iam4 Blog: http://iansblog.jandi.co.nz WAND Network Research Group

1 1

NZNOG Photos (Group and others)
by Lin Nah 05 Feb '07

05 Feb '07

HI all Group photo for NZNOG 2007 http://coders.meta.net.nz/~perry/inet/nznog-07/index.php?photo=4 If you are in this photo and have NOT been named, please click on your mouse button when a ? appears on your face. We have tried to identify as many as possible. People are not indentified due to many reasons. Please don't take it personally. Btw if you want to look at the nznog photo of other years I've added a link in the group photo secion at wiki.nznog.org or NZNOG 2006 http://coders.meta.net.nz/~perry/inet/nznog-06/index.php?photo=3 NZNOG 2005 http://coders.meta.net.nz/~perry/inet/nznog-05/index.php?photo=1 nznog 2004 http://coders.meta.net.nz/~perry/inet/nznog-05/index.php?photo=2 If you took photos, please add a link to this page http://wiki.nznog.org/index.cgi/Pictures Also if you blogged about it, add a link to http://wiki.nznog.org/index.cgi/Blogs regards lin

1 0

elevated icmp last couple of days?
by Anton Smith 05 Feb '07

05 Feb '07

Hi all, Just wondering if anyone else has noticed elevated ICMP levels. I'm seeing a lot of what looks like ICMP from infected machines, both coming into our network and leaving it. Always with the same sequence number and going to and from many different machines: e.g. 13:41:45.682360 IP 196.211.95.177 > 202.65.160.195: icmp 72: echo request seq 20041 13:41:45.682395 IP 196.211.95.177 > 202.65.160.195: icmp 72: echo request seq 20041 13:41:45.684098 IP 196.211.95.177 > 202.65.160.195: icmp 72: echo request seq 20041 13:41:45.684185 IP 196.211.95.177 > 202.65.160.195: icmp 72: echo request seq 20041 and 13:45:23.759952 IP 203.110.28.211 > 24.149.23.167: icmp 41: echo request seq 39506 13:45:23.764000 IP 203.110.28.211 > 24.149.63.81: icmp 41: echo request seq 39762 13:45:23.764046 IP 203.110.28.211 > 24.149.20.160: icmp 41: echo request seq 40018 13:45:23.764426 IP 203.110.28.211 > 24.149.134.141: icmp 41: echo request seq 40274 13:45:23.766189 IP 203.110.28.211 > 24.149.81.135: icmp 41: echo request seq 40530 Seems to be the same sequence number for the same destination host. There are hundreds/thousands of these every second and seems to be ongoing. Just wondering if it is just us. Regards, Anton

1 1

Could the mail admin for blakjak.net contact me off list?
by Juha Saarinen 05 Feb '07

05 Feb '07

SMTP error from remote mail server after RCPT TO:<@nzoss.org.nz>: host mx.blakjak.net [202.50.176.75]: 554 Service unavailable; Client host [NZ IP address] blocked using rbl.blakjak.net; Mail from China and Korea is not welcome here due to high SPAM volumes. Visit rbl.blakjak.net for information. It seems the Blakjak RBL needs tweaking if the NZOSS is to accept email from certain parts of the NZ Intarweb. Thanks. -- Juha Saarinen www.geekzone.co.nz/juha | Skype: juha_saarinen blogs.pcworld.co.nz/pcworld/techsploder www.computerworld.co.nz | MSN: juha_saarinen(a)msn.com Voice: +64 9 950 3023 Subtle recursive jokes in .sigs are not funny.

2 2

Jersey found at NZNOG
by Simon Lyall 03 Feb '07

03 Feb '07

Found in Miro hall on Saturday morning. A black zip up Jersey, size "M" left in the common room. Contact me directly to arrange return. -- Simon J. Lyall | Very Busy | Web: http://www.darkmere.gen.nz/ "To stay awake all night adds a day to your life" - Stilgar | eMT.

1 0

NZNOG '07 Accommodation
by Jonny Martin 27 Jan '07

27 Jan '07

Hi All. We've ended up with a couple of spare rooms for NZNOG '07 accommodation (Tue - Fri nights). So if you'd been hoping to secure some accommodation but didn't get it sorted before the deadline, here is your chance! Send your details through to dave(a)staff.inspire.net.nz if you wish to take advantage of this. See you in Palmerston North, Jonny.

1 0

Incorrect / missing WHOIS details
by John ＠ netTRUST 26 Jan '07

26 Jan '07

Do any members present have any feelings about domain names that have misleading or ommited core/required contact details? I refer to cults.co.nz - a controversial religious themed website - though the issue at hand here is their whois, not their content. This may be a breach of rule 7.1 of the DNC's publication "Registering, Managing and Cancelling domain names" which reads- 7.1 When registering a new domain name the registrar will supply the following data: * Domain name. * Name server list. * Registrant contact details. * Administrative contact details. * Technical contact details. * Billing term. Also the registrar involved may be in breach of section 8.1 which reads- 8.1 Registrars will be required to maintain the details of the domain names for which they are the registrar. They will be able to amend/update the following fields: 􀂃 Name Server List. 􀂃 Registrant Name. 􀂃 Registrant Contact Details. 􀂃 Registrant Customer ID. 􀂃 Administrative Contact Details. 􀂃 Technical Contact Details. 􀂃 Billing Term. While the specifics as to whether this is a technical breach or not should be determined by the DNC and what I have stated above is only an opinion,. this is still a practice I feel should not be permitted to take hold in New Zealand. The publication mentioned is located at: http://www.dnc.org.nz/content//registering_managing_cancelling.pdf

3 2

NZNOG 2007 on 31 January - 2 February 2007
by Lin Nah 25 Jan '07

25 Jan '07

Hi Reminder: The nznog meet this year is at Massey University Campus, Palmerston North starting on 31 January to 2 February 2007. InspireNet is hosting this year. To those of you already going, check out wiki.nznog.org I know there's a whole lot more ppl who are attending but not found the wiki yet. Don't worry about reading the rest of this email. To those not attending: I urge you to consider coming to the conference. It isn't too late to register for it. I hope no one was put off by the "deadlines" mentioned in earlier posts. Registrations are still being accepted. If you don't know much about it check out www.nznog.org The programme will include: * AS-Path analysis: Testing claims of "tier-1" status and examining BGP routing anomalies by Gaurab Upadhaya, Packet Clearing House (PCH) * Connecting the dots: Graph theory, Telecom Policy, & Internet Evolution by Tom Vest, UC San Diego Supercomputer Center (CAIDA) * Open Source VoIP Platform in Carrier Environments by James Jones, Virtual Realm Software * Dealing with Joe-jobs (spam backscatter attacks) by Simon Howard, DMZGlobal Ltd * Network Control Planes: Subscriber authentication, authorization, and accounting, network policy deployment and enforcement, and a look at solutions to do that by Alastair Johnson, Alcatel-Lucent On the Wednesday we have * APNIC Internet Resource Management Essentials tutorial. * Microtik RouterOS Training * MPLS and fixed access networks for beginners * Sysadmin Day for sysadmins who work at ISPs. Sessions will be recorded. There are plans to stream the sessions as well BUT one never knows when Murphy's law will strike. Information will be available on the wiki regarding the streams etc when we have the information. The conference is more than just the sessions. It is the people you meet and the links made for future cooperation. Attached is a document that will hopefully help anyone attempting to apply for permission to attend NZNOG at this stage. Perhaps one method is to compare the cost of attending NZNOG with attending training courses. Hopefully it isn't too late for you. Have a good weekend! regards lin

1 0

VoIP and NZ ENUM services
by Nick Larsen 25 Jan '07

25 Jan '07

Hey people, Does anyone know the outcome of the ENUM trial in NZ (by InternetNZ), or is it still going? I've researched it a bit, but it seems the trial has ended (or maybe I just haven't searched hard enough ;)). Any info on ENUM in New Zealand or a pointer in the right direction would be great. Cheers, Nick Larsen

3 3

NZNOG07 Transport Pooling: Auckland CBD - Auckland Airport
by Ian Batterbee 24 Jan '07

24 Jan '07

For those going down on NZ5077 departing Auckland at 1835, how many, if any, are intending to leave from the Auckland CBD ?

9 8

[Fwd: [Apnic-announce] New APNIC IPv4 address ranges] (fwd)
by Elly Tawhai 24 Jan '07

24 Jan '07

Apologies for duplicate postings -------- Original Message -------- Subject: [Apnic-announce] New APNIC IPv4 address ranges Date: Thu, 18 Jan 2007 16:00:03 +1000 From: helpdesk(a)apnic.net Reply-To: apnic-talk(a)apnic.net To: apnic-announce(a)apnic.net Dear colleagues APNIC received the following IPv4 address blocks from IANA in Jan 2007 and will be making allocations from these ranges in the near future: 116/8 APNIC 117/8 APNIC 118/8 APNIC 119/8 APNIC 120/8 APNIC APNIC has made this announcement to enable the Internet community to update network configurations, such as routing filters, where required. Routability testing of new prefixes will commence on Friday January 19 2007. The daily report will be published at the usual URL: http://www.ris.ripe.net/debogon/debogon.html For more information on the resources administered by APNIC, please see: http://www.apnic.net/db/ranges.html For information on the minimum allocation sizes within address ranges administered by APNIC, please see: http://www.apnic.net/db/min-alloc.html Kind regards Guangliang ________________________________________________________________ Guangliang Pan email: helpdesk(a)apnic.net Resources Services Manager sip: helpdesk(a)voip.apnic.net APNIC phone: +61 7 3858 3188 http://www.apnic.net/ fax: +61 7 3858 3199 ________________________________________________________________ _______________________________________________ Apnic-announce mailing list Apnic-announce(a)lists.apnic.net http://mailman.apnic.net/mailman/listinfo/apnic-announce

1 0

AMS-IX claims to be world's largest public 'net exchange
by Matthew Poole 23 Jan '07

23 Jan '07

http://www.theregister.co.uk/2007/01/19/ams_ix_record/ "The Amsterdam Internet Exchange (AMS-IX) is claiming to be the world's largest public Internet exchange, after setting a new traffic record earlier this month of 233Gbit/s. It says it now shifts more than 1.5 Petabytes a day, on behalf of over 250 ISPs and carriers." How do our IX's compare? Obviously we won't be even close, a state of affairs not aided in any way by certain policies of certain telcos, but it'd be interesting to know how much traffic does actually traverse, in particular, APE and WIX. -- Matthew Poole "Don't use force. Get a bigger hammer."

5 4

NZNOG 07 Wiki and other info
by Lin Nah 20 Jan '07

20 Jan '07

HI Getting to NZNOG If you are flying down from Auckland AND with to get there by the start of tutorials on Wed, the only way is to fly in on Tues evening. The first flight for Auckland - PN will mean you'll be a little bit late. Alternatively you can fly to Wellington and catch a ride from someone to PN (read below). NZNOG wiki I have set up a few wiki pages for NZNOG 07 to help people coordinate their activities. There was no point setting up a wiki just for these few days. I just used the auckland TNC wiki. Anyway start from: http://auckland.thursdaynightcurry.com/index.cgi?NZNOG07_Wiki Basically I have set up sections like Transport and Dinners. Set up your own pages if you want more pages. I have no idea if anyone will find it useful. It was worth trying this once. Transport * This is for people who want rides from anywhere to PN. * There's a page for people who can perhaps save $$ by sharing taxi from the airport to Massey. * I have started up pages for Wellington - PN and Auckland to PN. List there if you have space in your car or are looking for a ride * I've included in the transport page for AUckland to PN the link to the Thrifty car rental that has a good relocation deal. Ie you only pay petrol for hiring car from PN to Auckland. Wednesday Dinner http://auckland.thursdaynightcurry.com/index.cgi?Wednesday_Dinner We are having a curry dinner on Wed evening. If you can make it, add your name to it. This isn't restricted to nznog conference attendees only. Anyone who can make it is welcome. Tuesday Evening It appears a few people are arriving on Tuesday evening. So a page to list who is going to be around etc. regards lin

2 3

WISP Technology - Trango?
by Jack Pivac 20 Jan '07

20 Jan '07

Hi all, Currently planning on setting up a community wireless project in South Taranaki. Range is looking to be up to 10km from the AP's. At the moment I'm looking at using Trango Radio Units [1] and was after thoughts/comments on this choice... Cheers, Jack [1] http://www.trangobroadband.com/

6 6

Re: [nznog] WISP Technology - Trango?
by Jack Pivac 19 Jan '07

19 Jan '07

Hi Jon, Thankyou for that advice, I will ensure to take it onboard. I'm interested to hear your thoughts on the pro's and con's of Trango vs Motorola Canopy? At the moment while price is always something to keep in mind, ease of administration is going to be top priority as I want to keep the running-round-fixing-it-after-install to a minimum. Kind Regards, Jack Jonathan Brewer wrote: > Hi Jack, > > There are two popular off the shelf systems currently sold in New Zealand. > Trango is one, Motorola Canopy is the other. Both are available in > .9/2.4/5.3/5.8GHz frequency bands, and both have unique advantages and > drawbacks. You could also go down the path of Mikrotik or StarOS, or other > of the myriad wireless ethernet based systems. You might find these less > expensive in terms of hardware, and you might find them more expensive in > terms of administration. > > Whatever you choose, please assume that you'll be sharing spectrum with > other users, and plan accordingly. > > Here is some unsolicited planning advice for the new WISP. (Attention! This > advice is not from any company I may work with/work for/own shares in/go > drinking with, etc., read on at your own risk, and may peace and harmony be > with you.) > > Both Trango Fox and Motorola Canopy subscriber units can be purchased with > small parabolic reflectors. This tightens the subscriber beam width from > 30-60 degrees (by default spraying unwanted radio everywhere) down to 9-10 > degrees. Please use these reflectors, and remember to turn the subscriber > unit radio power down accordingly. Your network will run better, and your > neighbors' networks will run better. > > With any system you choose, use external base station antennas. Buy a good > quality sector antenna (slotted waveguide made from drain pipe does not > qualify) and ensure you have it physically tilted down. If your most distant > customer is 10km away, please make sure you're not pointing your antenna > where someone 30km away is going to hear your noise. This will benefit you > too - your AP will be hearing your subscriber units and not SUs from the > next town over. > > Good luck. > > Cheers, > > Jon > > > >> -----Original Message----- >> From: Jack Pivac [mailto:email(a)delphinus.co.nz] >> Sent: Friday, 19 January 2007 3:12 p.m. >> To: nznog(a)list.waikato.ac.nz >> Subject: [nznog] WISP Technology - Trango? >> >> Hi all, >> >> Currently planning on setting up a community wireless project >> in South Taranaki. >> Range is looking to be up to 10km from the AP's. >> >> At the moment I'm looking at using Trango Radio Units [1] and >> was after thoughts/comments on this choice... >> >> >> Cheers, >> Jack >> >> [1] http://www.trangobroadband.com/ >> >> _______________________________________________ >> NZNOG mailing list >> NZNOG(a)list.waikato.ac.nz >> http://list.waikato.ac.nz/mailman/listinfo/nznog >> >> > > > >

1 0

Auckland/PN "road trip" bus cancelled
by Martin Kealey 19 Jan '07

19 Jan '07

Hi folks We haven't had enough people to warrant hiring a bus (needed about a dozen minimum). Unless another 5 people jump up immediately, the proposal won't proceed... We might still look at using a smaller vehicle, but it won't be as much fun. Sorry folks... I was really looking forward to doing this. -Martin PS: no, there won't be another chance next year because the people I was getting the bus from are retiring and selling their buses.

3 2

Shocking iptables performance
by Jasper Bryant-Greene 19 Jan '07

19 Jan '07

We currently have a pair of Linux iptables firewall boxes that are being replaced in a month's time with a pair of Cisco ASA firewalls. Recently during testing we noticed transfer rates through the Ciscos (attached to the same Cisco routers on the other side) is over 30x faster than through the iptables firewalls. I know that iptables isn't hugely fast, there's a reason you pay for Ciscos etc etc, but the resources I have read usually indicate that iptables slowness is related to massive rulesets. We have 2415 rules, which I don't consider to be *that* many... The boxes aren't heavily loaded (about 10% system, 90% idle), and have plenty of free memory. They aren't swapping. I've tested turning off logging, which had virtually no effect. Anybody encountered anything similar? Is it likely to simply be related to the number of rules? Cheers Jasper -- _________________________________________ http://www.digiweb.co.nz Webhosting, Dedicated Servers, E-commerce Phone: (64 3) 351 6713 Fax: (64 3) 351 6705 Free: 0800 DIGIWEB (0800 344-493) Email: jasper(a)digiweb.co.nz PLEASE NOTE: The information contained in this email message and any attached files may be confidential and subject to privilege. The views expressed may not necessarily be the official view of Digiweb New Zealand Limited. All technical advice and opinions are offered on a 'no-liability' basis. If you are not the intended recipient, you are notified that any use, disclosure or copying of this email is unauthorised. If you have received this email in error, please notify us immediately by reply email and delete the original. Thank you.

12 16

NZNOG 2007: DRAFT Network Systems Miniconf Programme
by Ewen McNeill 18 Jan '07

18 Jan '07

For those of you that are wondering which tutorial stream to go to, here is the _draft_ Network Systems Miniconf Programme (subject to change, but hopefully close to what it will be like on the day). Ewen -=- cut here -=- 08:00-09:00 - Registration 09:00-09:15 - Welcome 09:15-10:00 - Martin Kealey: From routers to Unix: shell tips for the network admin (45 minutes) 10:00-10:30 - Spare (BOF discussion on using Unix shell for automation?) 10:30-11:00 - Morning Tea 11:00-11:45 - Jonny Martin: Asterisk by Example... Doing useful VoIP things (45 minutes) 11:45-12:30 - Ewen McNeill: 42 hosts in 1U: Using virtual machines (45 minutes) 12:30-13:30 - Lunch 13:30-14:15 - Andrew McMillan: Using Debian packages for system administration (45 minutes) 14:15-15:00 - Matt Brown: Configuration Automation using CFengine (45 minutes) 15:00-15:30 - Server configuration management BOF 15:30-16:00 - Afternoon Tea 16:00-16:45 - Sam Sargeant: DNS registration services, and the .govt.nz 2LD (45 minutes) 16:45-17:15 - Martin Kealey: Mail debugging: how to talk to SMTP, POP & IMAP servers (30 minutes) 17:15-17:45 - Mail Server Best Practices BOF -=- cut here -=-

1 0

Re: [nznog] WISP Technology - Trango?
by Alex Hague 18 Jan '07

18 Jan '07

Hi Jack, You may also wish to check out http://meraki.net/ - this is a commercialization of the MIT Roofnet project. Will probably be a lot cheaper than Trango. Cheers, Alex -----Original Message----- From: Jack Pivac [mailto:email(a)delphinus.co.nz] Sent: Friday, 19 January 2007 3:12 p.m. To: nznog(a)list.waikato.ac.nz Subject: [nznog] WISP Technology - Trango? Hi all, Currently planning on setting up a community wireless project in South Taranaki. Range is looking to be up to 10km from the AP's. At the moment I'm looking at using Trango Radio Units [1] and was after thoughts/comments on this choice... Cheers, Jack [1] http://www.trangobroadband.com/

1 0

WISP Technology - Trango?
by Russell Tester 18 Jan '07

18 Jan '07

If you are setting up a community wireless project the very least you should consider is an open standard (such as 802.11) for the wireless. This will make it much easier for others to join / extend the project as well as provide neumorous other benefits! Russell Tester Serverworks Ltd Tel +64 3 9771750 Cell 021 478 611 -----Original Message----- From: Jack Pivac [mailto:email(a)delphinus.co.nz] Sent: Friday, 19 January 2007 3:12 p.m. To: nznog(a)list.waikato.ac.nz Subject: [nznog] WISP Technology - Trango? Hi all, Currently planning on setting up a community wireless project in South Taranaki. Range is looking to be up to 10km from the AP's. At the moment I'm looking at using Trango Radio Units [1] and was after thoughts/comments on this choice... Cheers, Jack [1] http://www.trangobroadband.com/ _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Re: [nznog] Shocking iptables performance
by Mark Seward 18 Jan '07

18 Jan '07

On 1/19/07, Jasper Bryant-Greene <jasper(a)digiweb.net.nz> wrote: > [root(a)firewall1 root]# mii-tool > eth0: negotiated 100baseTx-FD flow-control, link ok > eth1: negotiated 100baseTx-FD flow-control, link ok > > Looks ok to me. Fixing it with mii-tool -F 100baseTx-FD makes no > difference to transfer rates. What devices are connected to each interface on this firewall and what do they say about duplex and collisions / otherwise errored packets? 100Mb NICs and switches are notorious for misbehaving in ways that cripple throughput as you describe. Mark.

1 0

DNS problems yesterday?
by Patrick Mchale 18 Jan '07

18 Jan '07

Hey There, I was wondering if anyone noticed an odd external DNS problem happening yesterday, the National Library's main website was affected for several hours. We could resolve internally but nothing from outside would get resolved. Nothing was changed on our DNS servers. Vodafone seemed to be affected also. Default Server: planet.natlib.govt.nz Address: 192.122.171.130 > server 210.55.131.76 Default Server: jupiter.natlib.govt.nz Address: 210.55.131.76 > www Server: jupiter.natlib.govt.nz Address: 210.55.131.76 Name: slbweb.natlib.govt.nz Address: 210.55.131.96 Aliases: www.natlib.govt.nz > server defiant.netgate.net.nz Default Server: defiant.netgate.net.nz Address: 202.37.245.17 > www.natlib.govt.nz Server: defiant.netgate.net.nz Address: 202.37.245.17 Name: slbweb.natlib.govt.nz Address: 210.55.131.96 Aliases: www.natlib.govt.nz > server reliant.net.nz *** Can't find address for server reliant.net.nz: Non-existent host/domain > server reliant.netgate.net.nz Default Server: reliant.netgate.net.nz Address: 202.37.245.20 > www.natlib.govt.nz Server: reliant.netgate.net.nz Address: 202.37.245.20 Name: slbweb.natlib.govt.nz Address: 210.55.131.96 Aliases: www.natlib.govt.nz > server 203.96.152.4 Default Server: rachel.paradise.net.nz Address: 203.96.152.4 > www.natlib.govt.nz Server: rachel.paradise.net.nz Address: 203.96.152.4 *** rachel.paradise.net.nz can't find www.natlib.govt.nz: Non-existent host/domain > server 202.73.198.15 Default Server: isdn1ldv.vodafone.co.nz Address: 202.73.198.15 > www.natlib.govt.nz Server: isdn1ldv.vodafone.co.nz Address: 202.73.198.15 *** isdn1ldv.vodafone.co.nz can't find www.natlib.govt.nz: Non-existent host/domain Cheers Patrick McHale National Library of New Zealand.

8 11

Re: [nznog] DNS problems yesterday?
by Patrick Mchale 18 Jan '07

18 Jan '07

Thanks for the responses, We kinda thought there was a bit of fiddling going on but at to who and finding a definitive answer, this problem may be a total mystery forever. We are though inquiring into one particular DNS provider to check if anything went astray yesterday. The report was very interesting and a very useful website for finding out about a particular sites DNS issues and security. I need to read up more on the info it presented and sort out some changes. Cheers Patrick McHale >>> "Patrick Mchale" <Patrick.Mchale(a)natlib.govt.nz> 19/01/2007 9:26 a.m. >>> Hey There, I was wondering if anyone noticed an odd external DNS problem happening yesterday, the National Library's main website was affected for several hours. We could resolve internally but nothing from outside would get resolved. Nothing was changed on our DNS servers. Vodafone seemed to be affected also. Default Server: planet.natlib.govt.nz Address: 192.122.171.130 > server 210.55.131.76 Default Server: jupiter.natlib.govt.nz Address: 210.55.131.76 > www Server: jupiter.natlib.govt.nz Address: 210.55.131.76 Name: slbweb.natlib.govt.nz Address: 210.55.131.96 Aliases: www.natlib.govt.nz > server defiant.netgate.net.nz Default Server: defiant.netgate.net.nz Address: 202.37.245.17 > www.natlib.govt.nz Server: defiant.netgate.net.nz Address: 202.37.245.17 Name: slbweb.natlib.govt.nz Address: 210.55.131.96 Aliases: www.natlib.govt.nz > server reliant.net.nz *** Can't find address for server reliant.net.nz: Non-existent host/domain > server reliant.netgate.net.nz Default Server: reliant.netgate.net.nz Address: 202.37.245.20 > www.natlib.govt.nz Server: reliant.netgate.net.nz Address: 202.37.245.20 Name: slbweb.natlib.govt.nz Address: 210.55.131.96 Aliases: www.natlib.govt.nz > server 203.96.152.4 Default Server: rachel.paradise.net.nz Address: 203.96.152.4 > www.natlib.govt.nz Server: rachel.paradise.net.nz Address: 203.96.152.4 *** rachel.paradise.net.nz can't find www.natlib.govt.nz: Non-existent host/domain > server 202.73.198.15 Default Server: isdn1ldv.vodafone.co.nz Address: 202.73.198.15 > www.natlib.govt.nz Server: isdn1ldv.vodafone.co.nz Address: 202.73.198.15 *** isdn1ldv.vodafone.co.nz can't find www.natlib.govt.nz: Non-existent host/domain Cheers Patrick McHale National Library of New Zealand. _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Malware used to spam pump and dump scams
by matthew＠auscert.org.au 17 Jan '07

17 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Greetings all, As above - anyone aware of what particular bit of malware is being used to spam pump and dump scams? Also seeing similar usage for mule recruitment. Subjects may have the stock symbol CBFE for the stock P&D or "Managers opened - GAPFG Co" for the mule recruitment. Any feedback appreciated. Thanks for your time, - -- Matthew McGlashan -- Coordination Centre Team Leader | Hotline: +61 7 3365 4417 Australian Computer Emergency Response Team | Direct: +61 7 3365 7924 (AusCERT) | Fax: +61 7 3365 7031 The University of Queensland | WWW: www.auscert.org.au Qld 4072 Australia | Email: auscert(a)auscert.org.au -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (FreeBSD) Comment: http://www.auscert.org.au/render.html?it=1967 Comment: http://www.auscert.org.au/render.html?it=1967 iQCVAwUBRa7T0Ch9+71yA2DNAQLKHAP/U0x1SudRh4BRtg+mxxkry6YifNUPFD+J 6sYjwErVf1N4N+Y6WN5zmU9JuXO+HqrMf79JiZ9eff3fC/2xd7jK1wJWr1GzNO5w jw8jZmO0QAC/2UzrEQuC9q4eDbogk/mHCLzSpg2qyzY6+cdN6IFGcnmgnkL0ycUk eTRO+t+6PQE= =AijR -----END PGP SIGNATURE-----

1 0

IGMP testing - thanks
by Ian Batterbee 16 Jan '07

16 Jan '07

Thanks all for the suggestions. That C source code, (the setting of theIP_ADD_MEMBERSHIP socket option in particular), led me to this rather useful document: http://tldp.org/HOWTO/Multicast-HOWTO-7.html ...which describes how it is the kernel's task to send IGMP out for sockets set as above, and not the application's problem, which explains why there aren't many apps around that send IGMP. And using 'tcpdump -n igmp', on the client end, I can see that it's doing what it should be doing :) Thanks.

1 0

Re: [nznog] IGMP test tools
by chris＠chrishellberg.com 16 Jan '07

16 Jan '07

Hi Ian, What about using a media application like vlc (videolan) and joining a multicast group? I think you might be able to run it in command line mode, if you don't have an X server listening. This'll trigger your IGMP membership reports and respond to group queries. /Chris ----- Original Message ---- From: Ian Batterbee <ian.batterbee(a)aut.ac.nz> To: nznog(a)list.waikato.ac.nz Sent: Tuesday, January 16, 2007 10:45:30 PM Subject: [nznog] IGMP test tools Hi all, I'm looking for some linux test tools that I can run that will send IGMP join commands and that will respond to IGMP queries (to keep the group alive), that I can use to prove or disprove a sparse mode pim configuration. There's such a blatent lack of matches for anything like this on google that I wonder if I'm overlooking some basic utility that is already included with most distros or is built into the kernel, but I can't come up with anything on that front either. Using a Cisco router or switch as a multicast group member is a possibility, but I'd rather use linux hosts if I can do so. _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

2 1

IGMP test tools
by Ian Batterbee 16 Jan '07

16 Jan '07

Hi all, I'm looking for some linux test tools that I can run that will send IGMP join commands and that will respond to IGMP queries (to keep the group alive), that I can use to prove or disprove a sparse mode pim configuration. There's such a blatent lack of matches for anything like this on google that I wonder if I'm overlooking some basic utility that is already included with most distros or is built into the kernel, but I can't come up with anything on that front either. Using a Cisco router or switch as a multicast group member is a possibility, but I'd rather use linux hosts if I can do so.

3 2

Notification of NZRR Database changes
by NZRR Database Notifications 15 Jan '07

15 Jan '07

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS9733 descr: Route set advertised to AS9439 by Netspace Services Limited - AS9733 members: 203.118.134.64/26^26-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: operations(a)netspace.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20061219 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS9733 descr: advertised to AS9439 by Netspace Services Limited - AS9733 members: 210.4.208.0/21^21-29, 203.118.134.64/26^26-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: operations(a)netspace.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070116 source: NZRR

1 0

Hello all & a word on SPEWS DNS blackhole
by Michael Fincham 15 Jan '07

15 Jan '07

Hi everyone... Just wondering if anyone knows how prevalent checking against the (supposedly now defunct) SPEWS SPAM DNS blackhole list remains among NZ operators? Reason I ask is that our netblock seems to be inadvertently (and/or incorrectly) listed as an Aussie porn spam sender, and with the general unpleasantness involved in dealing with SPEWS combined with the apparent departure of their admins, I don't see any real resolution to this other than waiting for people to stop using SPEWS on their mail servers... Currently it looks like iServe's mail server is still using SPEWS as are the mail servers used by ISP amuri.net. These are the only two I have encountered so far since moving our mail server to its new home (202.6.116.105) -- --Michael Fincham Unleash Technology Solutions

3 2

Re: [nznog] Hello all & a word on SPEWS DNS blackhole
by Michael Fincham 15 Jan '07

15 Jan '07

> We do not use SPEWS though if you would kindly provide onlist a list > > of your > netblock addresses, myself and I'm sure others will check them against the > BL's we use and if neccessary whitelist accordingly. Hooray. Nothing like a post like that to restore my faith in humanity :^) We've got: 202.6.116.0/23 and for a short time longer, 210.55.104.0/26 - although that is technically assigned to Maxnet, not directly to us, and we are phasing out mailing from addresses in that range. Here's hoping I didn't break the threading with this post - I need to turn off digest mode :) -- --Michael Fincham Unleash Technology Solutions

2 1

Bus/Train to NZNOG
by Joel van Velden 15 Jan '07

15 Jan '07

Hi all The idea was floated at last weeks Curry in Auckland about hiring a bus to travel to NZNOG, as there would possibly be quite a number of people between Auckland and Palmerston North interested in a less stressful and cheaper means of getting there. I have no idea of what numbers would be required at this stage or what the cost would be. Obviously it would be cheaper than flying, but take longer to get there. The other alternative might be to group-book the train, which has tables, not sure about AC power, you can walk around, is apparently newly-refurbished, but probably takes a little longer than a bus, and possibly more expensive. Is anyone is interested? Contacting me off-list would be best. Regards, Joel van Velden

4 3

NZNOG Programme.
by Jonny Martin 14 Jan '07

14 Jan '07

Right, Neil and I have pretty much sorted the NZNOG programme. It's reasonably flexible, with a bit of room to slot things in if any important last minute talks pop up etc. It takes into account any preferences for days to talk on I have received. A couple of additions that have come up recently are for InternetNZ to have a talking slot to cover anti-spam legislation, copyright bills, and general telecommunications issues and how they impact ISPs. There is also a NZ internet history session slotted in. Richard Wood is writing a book on the subject for InternetNZ so will use this slot to gain some more content for this. Can someone give this a quick sanity check please? Dave will be throwing this on the website when he gets back in the office this afternoon. Cheers, Jonny.

3 2

[NZNOG 07 Conference] Registrations Close Today!
by Mark Foster 14 Jan '07

14 Jan '07

A gentle reminder that today is the last day for Conference registrations. If you havn't yet, but intended to, now is the time! I would imagine that ~3pm today is as late as anyone would want to dare leave it, as after that details of the registrations need to go out to our hosts, etc. (Registrations post today will continue to be accepted, but theres no guarantees around the availability of accomodation, for example.) Cheers Mark.

1 1