- NZNOG - lists.nznog.org

Telstraclear international proxy?
by Jethro Carr 13 Aug '09

13 Aug '09

hi all, I am seeing an unusual problem with accessing international sites which I believe is being caused by a proxy on international HTTP access for Telstraclear cable internet users. I was attempting to setup virtualhosts on a new webserver (US based) and added entries to /etc/hosts in order to test the sites before I updated the DNS records. However, any access attempt to the new server on port 80 would just return the current production site, which was running on a different server (also in the US). Confirmed with tcpdump that my packets were leaving my computer for the correct IP. There is no proxy in place on my network. I believe there is some kind of proxy/cache for international traffic from Telstraclear's cable network. The proxy is set up in such a way, it ignores the destination IP address being requested and instead takes the requested hostname, resolves it via DNS and fetches the page from the resolved server IP. DEMONSTRATION If I take an international IP and use it for my browser's proxy settings, I find that I can use that IP as a proxy to access any other international website (but not domestic). eg: 74.125.67.100 (google.com) 212.58.254.252 (bbc.com) Using either IP as a proxy will allow me to reach any other international site, but will not allow access to domestic sites (returns blank page). ASSISTANCE Has anyone seen this problem before or know of any caching being taken place by Telstraclear? Would also be good to know if it's specific to Telstraclear cable customers, or other Telstraclear customers as well. Any advice on how I might be able to query the proxy to identify it's owner would be appreciated. thanks, jethro -- Jethro Carr www.jethrocarr.com/index.php?cms=blog www.amberdms.com

11 16

What is more important? - ipv4 vs. routing table size
by Skeeve Stevens 13 Aug '09

13 Aug '09

Hey all, I'd like to stimulate some discussion regarding IPv4 conservation vs. The size of the routing table. I'd like to hear what people think is more important - and why - which it is more important - or a miz? IPv4 conservation - possibly allocating smaller default allocations - or making it easier (/24, /23) vs. The size or the routing table. If by a more conservative allocation above was done, and the world table jumped to 400, 500 thousands or more routes - what implications would this have on routers and so on. APNIC's minimum is a /22 (was a /19 in 2000) (4 * /24's) ARIN is a /20 to ISPs (16 * /24's) RIPE is a /21 (8 * /24's) LANIC is a /21 (I think) AFRINIC is a /22 (4 * /24's) There are smaller hosting companies out there (here in ANZ at least) that want to be on, hosting, multi-homed, but only need a /24 or /23, but they're given the minimum allocation on a /22 - whether they need it or not. Thoughts? -- Skeeve Stevens, CEO/Technical Director eintellego Pty Ltd - The Networking Specialists skeeve(a)eintellego.net / www.eintellego.net Phone: 1300 753 383, Fax: (+612) 8572 9954 Cell +61 (0)414 753 383 / skype://skeeve www.linkedin.com/in/skeeve ; facebook.com/eintellego -- NOC, NOC, who's there? Disclaimer: Limits of Liability and Disclaimer: This message is for the named person's use only. It may contain sensitive and private proprietary or legally privileged information. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. eintellego Pty Ltd and each legal entity in the Tefilah Pty Ltd group of companies reserve the right to monitor all e-mail communications through its networks. Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorised to state them to be the views of any such entity. Any reference to costs, fee quotations, contractual transactions and variations to contract terms is subject to separate confirmation in writing signed by an authorised representative of eintellego. Whilst all efforts are made to safeguard inbound and outbound e-mails, we cannot guarantee that attachments are virus-free or compatible with your systems and do not accept any liability in respect of viruses or computer problems experienced.

5 5

KIWICON ]|[ - 2009 - Call For Papers
by Kiwicon <3 12 Aug '09

12 Aug '09

A wise deadite captain once yelled "Cry Havoc and let loose the Dogs of War!". Quite frankly, we couldn't have said it better ourselves: ~~ ~~ || || @@@@@@@@@@@@@@@@@ @@@@@@@@@@@@@@@@@@@ @@@@@@@@@@@@@@@@@@@\___ @@@@@@@@@@@@@@@@@@ \ @@@@@@@@@@@@@@@@@ X___/ \/ KIWICON ]|[ 28TH & 29TH NOVEMBER 2009 With a current record of three arrests, seven conceptions and one committal Kiwicon is back for 2k9. The time has come to fake up an abstract and submit it to the Kiwicon Crue for judgement. In the coming months, we predict you will spend more time dreaming of kudos and UID 0 than actually working on your slides, since you'll be doing them the night before anyway. It's not New Zealand's only security conference, but it is the one where you're more likely to get a standing ovation for scanning an entire country than pointed questions regarding whether you were, perhaps, a little reckless in accessing systems without authorisation. _ _-(")- `%%%%% `KIWICON` // \\ The Crue holds a special place in their bowels for those who are aggravated that Kiwicon is held on a weekend so they don't get time off work. It is a gathering for those who are passionate about security. It has been hacked together by the .nz security scene for the .nz security community. Following in the tradition of previous cons, the atmosphere is extremely laid back; even the feds don't wear suits. Kiwicon is about sharing information. It's about intersections and cross-pollination and dissemination and other nouns disturbing reminiscent of a pre-AIDs key party. Sure, you could bring your RFID readers, your lockpicks or even your back track DVD but mostly you just need to bring yourself and the willingness to learn. For a little con down under we don't do too bad. Previously, Kiwicon has featured: the Crackstation, iKat (last seen at a airport near you), layer two telco shenanigans, a video montage of boardrooms across Japan, old school phreaking on new school kit, exposure of RIM's failure to hide their snooping capabilities, fun with the SCADA systems, making Microsoft look like turkeys, nuking various heap protections from space, and of course fucking up the certificate chain of your new passport. _ _-(")- `%%%%% // \\ `THE VENUE` The Crue is aware that location is everything, so once again we will be invading the Pipitea Campus which is surrounded by prestigious Wellington buildings such as Parliament house, the (partly renovated and badly secured) High Court, Ministry of Defence and various telecommunication hubs. All services are handy to the venue as well (train station, taxi rank, burger caravan, police cells / court etc). Caffeination will be provided by the lovely folks at Sweet Fanny-Anne's. _ _-(")- `%%%%% // \\ `THE PRICE` A recession-proof fifty bucks for the employed. Students and those otherwise supported by our precious taxpayer dollars (this does not include Members of Parliament) will pay $30. GST receipts will be available on request. The Crue will endeavour to leverage its synergies to architect a compelling ROI solution. _ _-(")- `%%%%% // \\ `THE TOPICS` Social networking/automated stalking, Cellular Networks (GSM,2degrees, openbts), State-sponsored surveillance, Malware (Viruses, Botnets), The Scam of EAL Certification, Industrial Espionage, Reverse Engineering, The Failwhale Rider, Virtualisation, Flash mobs, WebApps, 0hday The schedule will be made up as we go, so fifteen minutes or thirty minutes worth of material should be submitted as fifteen or thirty minutes worth of talk. We do place an upper limit of an hour (including questions), as anything longer than that can continue at the pub. _ _-(")- `%%%%% // \\ `SUBMISSIONS` These need to be in by the Witching Hour of the 31st October (NZST). Expats and wanna-be Kiwis will want to get their submissions in by 10th October, when we're going to be announcing the first round of Interesting Stuff. To submit a presentation to Kiwicon2k9, send an email to cfp(a)kiwicon.org with the following information: * Name or Handle: * Country of Residence: * Employer (if applicable): * Presentation Title: * Presentation Length: * Presentation Synopsis: * Brief Bio: If you do not provide a bio, one will be provided for you. _ _-(")- `%%%%% // \\ `BOTTOM LINE` The Crue want you to submit your talk to Kiwicon or the cute little header sheep gets it. _ -(")- `%%%%% // \\ `CONTACT` Email us: kiwicon(a)kiwicon.org Check the site: https://www.kiwicon.org/ Drop by silc: silc.kiwicon.org:2706/kiwicon Join the list: hackers-subscribe(a)kiwicon.org CFP online at https://kiwicon.org/cfp2k9.txt

1 0

Cable cuts in Asia
by Juha Saarinen 12 Aug '09

12 Aug '09

Reading in Commsday and Computerworld Singapore that APCN2, APCN, EAC and SMW3 near Taiwan have developed faults, possibly due to typhoon Morakot. Anyone in NZ noticing the effect of that? -- Juha

2 1

175/8 and 182/8 allocated to APNIC
by Leo Vegoda 11 Aug '09

11 Aug '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, The IANA IPv4 registry has been updated to reflect the allocation of two /8 IPv4 blocks to APNIC in August 2009: 175/8 and 182/8. You can find the IANA IPv4 registry at: http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xml http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xml http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.txt Please update your filters as appropriate. Regards, Leo Vegoda Number Resources Manager, IANA -----BEGIN PGP SIGNATURE----- Version: 9.10.0.500 wj8DBQFKguZyvBLymJnAzRwRAmDCAKCCnxLNmk32v+sm786x5RyVLnLBDACcCu5I zCs7FdAdkIZRnfNtuVyVB0s= =6huK -----END PGP SIGNATURE-----

1 0

Re: [nznog] Telecom International HTTP Caching
by Paul Tinson 11 Aug '09

11 Aug '09

As a general rule if the content is in a page that gets retrieved by the cache it will be cached and served from the cache to subsequent requests. This includes mp3 files if they are an embedded object. If the mp3 is a single file then I would not expect it to be cached in parts, so it should not be missing pieces. If it's a streaming mp3 that may be different and if you supply an example URL I can check this. If you don't want it cached or want to control the time we keep it in cache then you can use cache control directives and expiry meta tags in the page. At this point in time we have not enabled caching of streaming media. If you have a specific example URL please send it to me and I can double check though. If we have cached it I will look into why. I am happy to look into specific examples of issues, but if you have a wider service effecting issues please continue to use the helpdesk as this will result in calls being handled correctly and not left unattended on the list. Hope this answers your questions. Regards Paul -----Original Message----- From: Richard Hulse [mailto:Richard.Hulse(a)radionz.co.nz] Sent: Wednesday, 12 August 2009 9:00 a.m. To: nznog; Paul Tinson Subject: Re: [nznog] Telecom International HTTP Caching Hi Paul, I'll ask this on the list, as there are quite a few (other) audio and video content providers here... How will the cache handle MP3s that are served via HTTP? Is this content you want to cache? Should we be setting some sort of header to make it work better? Willl you also be caching on-demand Windows Media content? I ask because I have noticed that some of our visitors complain of Mp3 audio that is truncated or has bits missing out of the middle. It seems to clear itself after a few hours. cheers, Richard Hulse Webmaster Radio NZ

5 5

Re: [nznog] Telecom International HTTP Caching
by Richard Hulse 11 Aug '09

11 Aug '09

Hi Paul, I'll ask this on the list, as there are quite a few (other) audio and video content providers here... How will the cache handle MP3s that are served via HTTP? Is this content you want to cache? Should we be setting some sort of header to make it work better? Willl you also be caching on-demand Windows Media content? I ask because I have noticed that some of our visitors complain of Mp3 audio that is truncated or has bits missing out of the middle. It seems to clear itself after a few hours. cheers, Richard Hulse Webmaster Radio NZ

1 0

Telecom International HTTP Caching
by Paul Tinson 11 Aug '09

11 Aug '09

Good Morning, Telecom would like to advise that over the coming weeks we will be extending our international http caching service. This work should go unnoticed but if you or your customers do experience a loss of international browsing then please contact the Broadband Helpdesk on: adsl_helpdesk(a)xtra.co.nz Please make sure the subject has "HTTP Caching" included so that the Helpdesk can filter on these issues. If you would like to talk to the Helpdesk then please phone: 0800 22 55 98 Please state that you believe this to be an http caching issue when raising the case so that it will be routed to the correct resources. NB. Please note that the service is only in place for Telecom Broadband Customers and "International" in this case is based on the international routing tables, as such some domestic sites may appear to Telecom as international content. If you have any specific questions about the service then please feel free to post the questions on this mailing list and as time allows they will be answered. Regards Paul Tinson Senior Specialist Web App Services Shared & Other IS Operations E paul.tinson(a)telecom.co.nz <mailto:paul.tinson(a)telecom.co.nz> W www.telecom.co.nz <http://www.telecom.co.nz> Level 9, 31 Airedale Street Auckland ________________________________ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002."

3 4

Re: [nznog] Telstraclear international proxy?
by Anton Smith 10 Aug '09

10 Aug '09

> Message: 12 > Date: Tue, 11 Aug 2009 10:31:53 +1200 > From: Dean Pemberton <nznog(a)deanpemberton.com> > Subject: Re: [nznog] Telstraclear international proxy? > To: nznog(a)list.waikato.ac.nz > Message-ID: <4A809FD9.3040700(a)deanpemberton.com> > Content-Type: text/plain; charset=ISO-8859-1 > > On 11/08/09 12:31 AM, Anton Smith wrote: > > In the beginning when diagnosing the problem, an engineer might not > > even know that the problem lies with Telstra, and we have seen people > > posting http headers and so on in the past wondering what was going > > on. > > > > I don't believe that was the case in this instance. It was not a > general query about a general problem. It was a specific technical > issue with a specific ISP. In that case a trouble ticket should be > logged with the ISP first, then post to the list. I'd even accept if > these were both done at the same time. > > To not give the ISP involved a chance to address the issue through > normal customer support channels is not giving them a fair go. > Some ISPs are not very good at customer support, but if you don't log > the call, then how can you expect anything of them. > > I'll explain some more why this is so important; > In years gone by, NZNOG was seen by the major Telcos and some ISPs as a > bunch of troublemakers. I know this for a fact because I've worked for > them while they held this opinion. They viewed NZNOG as a group of > individuals constantly waiting to bash them at any opportunity. The > minute that someone found a bug, or a technical issue, they would post > it first to NZNOG and everyone would hang the associated ISP/Telco out > to dry. > > As such, no one from those organisations joined NZNOG, contributed to > NZNOG, attended the NZNOG conference, etc etc etc. > > Over time we have worked very hard to re-engage with the ISPs and > Telcos, making NZNOG a place where they can derive benefit from > contributing to. Just today we see Paul Tinson posting about Telecom's > cache changes. I doubt anyone would disagree that this is the sort of > involvement that we want. > > Do you think that TelstraClear are going to engage with NZNOG if just > the week previously an NZNOG member was posting publically about > technical issues on their network before giving them a chance to address > them? > > It's a bit like someone buying a shirt at a store, being unhappy with > it, and doing a spot on Campbell Live before going back to the shop and > asking for a refund. Now sure, Campbell Live has its place. It even > has a place for long running retail disputes, but it shouldn't be the > first port of call. And neither should NZNOG. > > We work hard with the Telcos to keep them engaged (the benefits of which > can be seen in Telecoms post this morning), please keep this in mind > when posting. Just make sure you've worked with them first. If you > have and they did a bad job, then by all means post and all bets are off =) > > > Dean > Hi Dean, Given the general difficulties in resolving problems with various ISP/Carriers it is sometimes a fact that the only place you can learn what you need to is here. I'm very heartened by the Telecom post about their caching, and being very specific about the path to follow if there are issues encountered. That is exactly what I believe is missing from Telstra. Perhaps our discussions here (that may be deemed off topic in which case I shall raise the virtues of beer later) are actually constructive in that they can help highlight to carriers how a proactive approach might be used. I do however completely agree with you that it is important to foster a greater sense of community that includes the carriers, ISPs and NZNOG. It is important that NZNOG is not just seen as a bashing list. However, I did not really see that the original post about the caching was negative, and far from "bashing".. so I hardly think that the relationship between NZNOG and Telstra would have been damaged. Maybe my own post had a disgruntled tone, for which I apologise - I shouldn't have done that. I do believe that proactive approaches from the bigger players towards the list (like the Telecom post) are brilliant, and I encourage others (Telstra) to do something similar. Regards, Anton

2 1

Re: [nznog] NZNOG Digest, Vol 80, Issue 9
by Anton Smith 10 Aug '09

10 Aug '09

Hi Dean, While I agree with the general notion that people should go to the ISP directly first, in the Telstra case with their transparent proxy I think it is okay posting here. Mainly because most people on this list know it is there, while most people on the ISPs desk probably don't. Telstra could make this a bit better for themselves by being more verbose about the proxies presence, rather than getting various levels of brokenness complaints. In the beginning when diagnosing the problem, an engineer might not even know that the problem lies with Telstra, and we have seen people posting http headers and so on in the past wondering what was going on. I just think that this kind of thing is a natural side effect of an ill publicised (and some would argue, annoying) network feature, and if Telstra are not proactive about letting people know they have it and the problems that may arise, then they deserve the occasional mail list post. Regards, Anton Disclaimer: I have run into their proxy before due to asymmetric routing + transparent proxy unhappiness (resulted in what looked like a black hole). On Mon, Aug 10, 2009 at 2:00 AM, <nznog-request(a)list.waikato.ac.nz> wrote: > From: Dean Pemberton <nznog(a)deanpemberton.com> > Subject: Re: [nznog] Telstraclear international proxy? > To: nznog <nznog(a)list.waikato.ac.nz> > Message-ID: <4A7F6257.9080104(a)deanpemberton.com> > Content-Type: text/plain; charset=ISO-8859-1 > > > I'd like to take this opportunity to remind people that the appropriate > way to handle situations like this is to log a support call with the > ISPs helpdesk before posting support questions to this list. > > If you believe that it is a problem which effects the NZ Operator > community as a whole and you have exhausted your options (including > escalations) with the ISP concerned then it is maybe appropriate to post. > > This is to eliminate the situation where an ISP finds its name/helpdesk > practices used in vain throughout a mailing list without being given a > chance to put the matter right in private first. > > > Thanks > Dean

5 4