- NZNOG - lists.nznog.org

Notification of NZRR Database changes
by NZRR Database Notifications 20 Feb '07

20 Feb '07

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS4770 descr: advertised to AS9439 by ICONZ - AS4770 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 210.48.0.0/17^17-29, 210.185.0.0/18^18-29, 210.54.160.0/19^19-29, 202.50.208.0/20^20-29, 202.53.176.0/20^20-29, 202.55.96.0/20^20-29, 202.174.160.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 210.56.32.0/20^20-29, 192.173.16.0/21^21-29, 202.12.248.0/21^21-29, 202.37.144.0/21^21-29, 202.37.224.0/21^21-29, 202.46.176.0/21^21-29, 202.50.200.0/21^21-29, 202.74.224.0/21^21-29, 202.78.240.0/21^21-29, 202.126.80.0/21^21-29, 203.190.208.0/21^21-29, 205.233.128.0/21^21-29, 202.36.36.0/22^22-29, 202.37.140.0/22^22-29, 202.37.200.0/22^22-29, 202.41.136.0/22^22-29, 202.50.52.0/22^22-29, 202.50.196.0/22^22-29, 202.59.4.0/22^22-29, 210.54.136.0/22^22-29, 210.55.24.0/22^22-29, 202.21.136.0/23^23-29, 202.36.44.0/23^23-29, 202.36.76.0/23^23-29, 202.37.86.0/23^23-29, 202.37.240.0/23^23-29, 202.37.252.0/23^23-29, 202.49.80.0/23^23-29, 202.50.246.0/23^23-29, 202.124.106.0/23^23-29, 205.233.136.0/23^23-29, 210.55.182.0/23^23-29, 192.88.85.0/24^24-29, 192.107.113.0/24^24-29, 192.133.31.0/24^24-29, 192.173.24.0/24^24-29, 198.32.66.0/24^24-29, 199.212.93.0/24^24-29, 202.6.84.0/24^24-29, 202.12.70.0/24^24-29, 202.14.100.0/24^24-29, 202.20.6.0/24^24-29, 202.20.97.0/24^24-29, 202.21.130.0/24^24-29, 202.27.208.0/24^24-29, 202.36.119.0/24^24-29, 202.36.155.0/24^24-29, 202.36.183.0/24^24-29, 202.36.226.0/24^24-29, 202.37.57.0/24^24-29, 202.37.76.0/24^24-29, 202.37.85.0/24^24-29, 202.37.136.0/24^24-29, 202.37.163.0/24^24-29, 202.37.197.0/24^24-29, 202.37.232.0/24^24-29, 202.41.140.0/24^24-29, 202.46.190.0/24^24-29, 202.49.62.0/24^24-29, 202.49.89.0/24^24-29, 202.49.159.0/24^24-29, 202.49.249.0/24^24-29, 202.50.87.0/24^24-29, 203.97.5.0/24^24-29, 205.233.243.0/24^24-29, 210.54.140.0/24^24-29, 210.54.211.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: deon(a)iconz.net mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20061019 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS4770 descr: advertised to AS9439 by ICONZ - AS4770 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 210.48.0.0/17^17-29, 210.185.0.0/18^18-29, 210.54.160.0/19^19-29, 202.50.208.0/20^20-29, 202.53.176.0/20^20-29, 202.55.96.0/20^20-29, 202.174.160.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 210.56.32.0/20^20-29, 192.173.16.0/21^21-29, 202.12.248.0/21^21-29, 202.37.144.0/21^21-29, 202.37.224.0/21^21-29, 202.46.176.0/21^21-29, 202.50.200.0/21^21-29, 202.74.224.0/21^21-29, 202.78.240.0/21^21-29, 202.126.80.0/21^21-29, 203.190.208.0/21^21-29, 205.233.128.0/21^21-29, 202.36.36.0/22^22-29, 202.37.140.0/22^22-29, 202.37.200.0/22^22-29, 202.41.136.0/22^22-29, 202.50.52.0/22^22-29, 202.50.196.0/22^22-29, 202.59.4.0/22^22-29, 210.54.136.0/22^22-29, 210.55.24.0/22^22-29, 202.21.136.0/23^23-29, 202.36.44.0/23^23-29, 202.36.76.0/23^23-29, 202.37.86.0/23^23-29, 202.37.240.0/23^23-29, 202.37.252.0/23^23-29, 202.49.80.0/23^23-29, 202.50.246.0/23^23-29, 202.124.106.0/23^23-29, 205.233.136.0/23^23-29, 210.55.182.0/23^23-29, 192.88.85.0/24^24-29, 192.107.113.0/24^24-29, 192.133.31.0/24^24-29, 192.173.24.0/24^24-29, 198.32.66.0/24^24-29, 199.212.93.0/24^24-29, 202.6.84.0/24^24-29, 202.12.70.0/24^24-29, 202.14.100.0/24^24-29, 202.20.6.0/24^24-29, 202.20.97.0/24^24-29, 202.21.130.0/24^24-29, 202.27.208.0/24^24-29, 202.36.119.0/24^24-29, 202.36.155.0/24^24-29, 202.36.183.0/24^24-29, 202.36.226.0/24^24-29, 202.37.76.0/24^24-29, 202.37.85.0/24^24-29, 202.37.136.0/24^24-29, 202.37.163.0/24^24-29, 202.37.197.0/24^24-29, 202.37.232.0/24^24-29, 202.41.140.0/24^24-29, 202.46.190.0/24^24-29, 202.49.62.0/24^24-29, 202.49.89.0/24^24-29, 202.49.159.0/24^24-29, 202.49.249.0/24^24-29, 202.50.87.0/24^24-29, 203.97.5.0/24^24-29, 205.233.243.0/24^24-29, 210.54.140.0/24^24-29, 210.54.211.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: deon(a)iconz.net mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070221 source: NZRR

1 0

Notification of NZRR Database changes
by NZRR Database Notifications 20 Feb '07

20 Feb '07

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- OBJECT BELOW CREATED: aut-num: AS38329 as-name: NZRR-AS38329 descr: Wellington City Council descr: WIX peering at '202.7.0.71' descr: see Citylink RT job #8509 admin-c: RPA1-NZRR tech-c: RPA1-NZRR import: from AS9439 accept ANY AND NOT fltr-bogons export: to AS9439 announce AS38329 notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: Robert.Flynn(a)wcc.govt.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070221 source: NZRR --- OBJECT BELOW CREATED: route-set: AS9439:RS-ROUTES:AS38329 descr: Route set advertised to AS9439 by Wellington City Council - AS38329 members: 192.88.190.0/24^24-29, 192.190.108.0/24^24-29, 203.97.237.120/29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: Robert.Flynn(a)wcc.govt.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070221 source: NZRR

1 0

Re: [nznog] ISP's Natting customer pools
by Martin Kealey 20 Feb '07

20 Feb '07

> Given the relative sizes of ISPs, it's probably also true to say "most DSL netizens use xtra". Them's fighting words... or they would be if I was in the marketing dept. Question: are there any (DSL?) CPE units for sale or in development that will do v6 to v4 translation, plus v6 pass-thru? -Martin -- Martin D Kealey, ihüg engineering

10 12

Re: [nznog] ISP's Natting customer pools
by Perry Lorier 20 Feb '07

20 Feb '07

(Reposted to the list *with* Simons permission): Simon Lyall wrote: >> If you looked at the "top ports" you'll see 135, 139, 445 make an >> appearance which are used by various windows worms, so obvious some >> users are infected with virii. However this isn't going to push peoples >> port counts up to the 1,000's like p2p will. > > Have you got numbers for each port as well as the combos? Something like: > > Port 25 - 70% > Port 80 - 75% > Port 443 - 56% > /--- Percentage of IP's that sent a packet on this port | /------ Port number v v 98.11 80/tcp 98.09 53/udp 95.64 443/tcp 73.63 110/tcp 60.43 25/tcp 41.83 123/udp 36.18 22/tcp <-- ! 33.89 7001/udp 33.62 1433/tcp 33.22 5900/tcp 32.81 6000/tcp 31.07 139/tcp 30.86 445/tcp 30.60 135/tcp 26.40 21/tcp 25.73 2967/tcp 25.42 8080/tcp 23.79 42/tcp 21.62 10000/tcp 20.84 9/udp <-- wtf? 19.62 6346/tcp 19.49 1863/tcp 17.31 1080/tcp 16.98 6346/udp 15.49 3389/tcp 15.14 10827/tcp 14.83 10929/tcp 13.94 26200/tcp 13.22 6348/udp 12.92 6348/tcp 12.48 15118/tcp 11.99 20000/tcp 11.41 12350/udp 11.32 8000/udp 11.21 6881/tcp 11.02 80/udp 10.84 5800/tcp 10.84 5000/tcp 10.62 7001/tcp

1 0

Re: [nznog] [Fwd: [pacnog] IPv4 exhaustion discussionsin Asia Pacific region]
by Jonathan Woolley 20 Feb '07

20 Feb '07

> Indeed one might speculate that the vast bulk of users in a very large > country using a complex language of their own might not miss the > english speaking world to any great extent. For those who found it a > problem (international traders) legitimate v4 addresses could be > allocated. I can see the headlines now: "[Vendor] charges [country] $[lots] to enable NAT on the great firewall. They decide to go with iptables instead" =)

26 91

[Fwd: Re: ISP's Natting customer pools]
by Gerard Creamer 20 Feb '07

20 Feb '07

Fascinating stuff - thanks for posting it. I find it most interesting that over 60% of DSL users systems know about and use more than 20 protocols. What is the sample size? Just approximate - 100s, 1000s, 10s of 000s ? I can understand if you didn't want to say, but it would help with rough deviation / error % Thanks, Gerard Perry Lorier wrote: > Well, I ran an analysis of DSL customers[1] over the space of 24 hours > [4] to see how many different protocols people were using. For each IP > I kept track of the number of unique "server ports"[2] were used.[3] >

2 1

Prime Minister heart attack trojan spam run
by matthew＠auscert.org.au 18 Feb '07

18 Feb '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 G'day all Have just released an alert on a(nother) trojan spam run at: AL-2007.0026 -- [Win] -- "Prime Minister heart attack" trojan http://www.auscert.org.au/7314 Basically there being emails currently in circulation with a variety of subject lines, including: "Current Australia's Prime Minister survived a hear attack" "The life of the Prime Minister is in grave danger" "Prime Minister survived a heard attack" with a link to malicious websites, including: h**p://www,austr-news,com/ h**p://www,theaunews,com/ h**p://www,theau-news,org/ Anyone seeing a lot of this? Perhaps targeting other heads of state? Might be worth keeping an eye out as we've seen similar to this before: AL-2006.0069 -- [Win] -- "John Howard tragedy" email attachment installs Torpig credential stealing trojan http://www.auscert.org.au/6645 with similar 'hooks' in that one appearing to be targeting Italy and the UK at least with messages of their government leaders' reported assassination. Feedback appreciated. Best regards, - -- Matthew McGlashan -- Coordination Centre Team Leader | Hotline: +61 7 3365 4417 Australian Computer Emergency Response Team | Direct: +61 7 3365 7924 (AusCERT) | Fax: +61 7 3365 7031 The University of Queensland | WWW: www.auscert.org.au Qld 4072 Australia | Email: auscert(a)auscert.org.au -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (FreeBSD) Comment: http://www.auscert.org.au/render.html?it=1967 Comment: http://www.auscert.org.au/render.html?it=1967 iQCVAwUBRdlMDyh9+71yA2DNAQKhGwQAmY99YaXxm48qj5LqxSSYYeMlTTSjWIvm F1S/Qop5km5/e2ZrDNJHbojfVNpLg9YrXGG8AxtY5nTcD852ojBuTf9tBmHUwqwF ljnyc4L6zxZ4iFzFWEZhypXBcnN6AZEYU8++vnnqePCK6KPfZsNJkhgodq2L53n9 GimZG4XHaso= =/dMS -----END PGP SIGNATURE-----

1 0

[Fwd: [pacnog] IPv4 exhaustion discussions in Asia Pacific region]
by Andy Linton 18 Feb '07

18 Feb '07

Given our discussions on IPv4 and IPv6 at the recent nznog meeting some of you may be interested in this. -------- Original Message -------- Subject: [pacnog] IPv4 exhaustion discussions in Asia Pacific region Date: Mon, 12 Feb 2007 10:44:32 +1000 (EST) From: Elly Tawhai <elly(a)apnic.net> To: pacnog(a)pacnog.org Hi You are probably aware by now that the exhaustion of IPv4 address space is likely to occur in the next few years. You might be interested to know that a proposal to deal with IPv4 exhaustion has been put forward for discussion in the APNIC region. The proposal suggests five main principles: (1) Global synchronization: All five RIRs will proceed at the same time for measures on IPv4 address exhaustion. (2) Some Blocks to be left: Keep a few /8 stocks instead of distributing all. (3) Keeping current practices until the last moment: Maintain the current policy until the last allocation. (4) Separate discussions on "recycle" issue: Recovery of unused address space should be discussed separately For more information on the proposal, see: http://www.apnic.net/docs/policy/proposals/prop-046-v001.html This proposal affects the whole Internet community. I encourage you to read the proposal and have your say on the APNIC Policy SIG mailing list, or at the upcoming APNIC 23 meeting in Bali, Indonesia, 26 February - 2 March 2007. If you can't attend the meeting in person, you can still have your say by participating remotely via live chat. APNIC Policy SIG mailing list information: http://www.apnic.net/community/lists APNIC 23: http://www.apnic.net/meetings/23/ Kind regards, Elly APNIC

13 13

[Fwd: [pacnog] IPv4 exhaustion discussionsin Asia Pacific region]
by Patrick Jordan-Smith 18 Feb '07

18 Feb '07

> Which is a problem if we are reliant on the telco's to move to IPv6. > Why would any sane [NZ] telco spend serious money changing to a > technology which further relegates them to a common bit pusher? > There is an argument here that IPv4 exhaustion provides a technical > rational for telcos to provide walled garden, proxy-style services. I fully support this style of thinking. Infact, if I was an ISP I would be seriously considering NATing my entire customer base - except for those who were willing to pay $x/mo for a real IP. At the end of the day, with a few exceptions, most protocols work quite well from behind a nat. And it gives me another revenue stream, which if I am an ISP would be quite useful considering I am probably losing money on the DSL I am currently providing. Cheers, Patrick -- patpatnz(a)gmail.com

6 6

APNIC fee structure - Online voting period extended
by Elly Tawhai 18 Feb '07

18 Feb '07

Dear Colleagues Voting on the APNIC fee schedule questions has now been extended by one week. The APNIC Executive Council decided to extend the online vote due to the low number of responses so far. This is an important issue for all APNIC members, so we encourage you to have your opinions counted. The new deadline for votes is 14:00 UTC, Friday 23 February, 2007. To vote, or get more information about the process, please go to: https://my.apnic.net/voting Please note that only registered voting contacts are able to cast votes. If you have any questions about using MyAPNIC, please contact helpdesk(a)apnic.net. Kind regards, Elly ________________________________________________________________________ Elly Tawhai email: elly(a)apnic.net Internet Resource Analyst, APNIC sip: elly(a)voip.apnic.net http://www.apnic.net/helpdesk phone: +61 7 3858 3188 fax: +61 7 3858 3199 ________________________________________________________________________ See you at APNIC 23! Bali, 26 February - 2 March, 2007 http://www.apnic.net/meetings

1 0