- NZNOG - lists.nznog.org

Re: [nznog] ISP's Natting customer pools
by Perry Lorier 20 Feb '07

20 Feb '07

(Reposted to the list *with* Simons permission): Simon Lyall wrote: >> If you looked at the "top ports" you'll see 135, 139, 445 make an >> appearance which are used by various windows worms, so obvious some >> users are infected with virii. However this isn't going to push peoples >> port counts up to the 1,000's like p2p will. > > Have you got numbers for each port as well as the combos? Something like: > > Port 25 - 70% > Port 80 - 75% > Port 443 - 56% > /--- Percentage of IP's that sent a packet on this port | /------ Port number v v 98.11 80/tcp 98.09 53/udp 95.64 443/tcp 73.63 110/tcp 60.43 25/tcp 41.83 123/udp 36.18 22/tcp <-- ! 33.89 7001/udp 33.62 1433/tcp 33.22 5900/tcp 32.81 6000/tcp 31.07 139/tcp 30.86 445/tcp 30.60 135/tcp 26.40 21/tcp 25.73 2967/tcp 25.42 8080/tcp 23.79 42/tcp 21.62 10000/tcp 20.84 9/udp <-- wtf? 19.62 6346/tcp 19.49 1863/tcp 17.31 1080/tcp 16.98 6346/udp 15.49 3389/tcp 15.14 10827/tcp 14.83 10929/tcp 13.94 26200/tcp 13.22 6348/udp 12.92 6348/tcp 12.48 15118/tcp 11.99 20000/tcp 11.41 12350/udp 11.32 8000/udp 11.21 6881/tcp 11.02 80/udp 10.84 5800/tcp 10.84 5000/tcp 10.62 7001/tcp

1 0

Re: [nznog] [Fwd: [pacnog] IPv4 exhaustion discussionsin Asia Pacific region]
by Jonathan Woolley 20 Feb '07

20 Feb '07

> Indeed one might speculate that the vast bulk of users in a very large > country using a complex language of their own might not miss the > english speaking world to any great extent. For those who found it a > problem (international traders) legitimate v4 addresses could be > allocated. I can see the headlines now: "[Vendor] charges [country] $[lots] to enable NAT on the great firewall. They decide to go with iptables instead" =)

26 91

[Fwd: Re: ISP's Natting customer pools]
by Gerard Creamer 20 Feb '07

20 Feb '07

Fascinating stuff - thanks for posting it. I find it most interesting that over 60% of DSL users systems know about and use more than 20 protocols. What is the sample size? Just approximate - 100s, 1000s, 10s of 000s ? I can understand if you didn't want to say, but it would help with rough deviation / error % Thanks, Gerard Perry Lorier wrote: > Well, I ran an analysis of DSL customers[1] over the space of 24 hours > [4] to see how many different protocols people were using. For each IP > I kept track of the number of unique "server ports"[2] were used.[3] >

2 1

Prime Minister heart attack trojan spam run
by matthew＠auscert.org.au 18 Feb '07

18 Feb '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 G'day all Have just released an alert on a(nother) trojan spam run at: AL-2007.0026 -- [Win] -- "Prime Minister heart attack" trojan http://www.auscert.org.au/7314 Basically there being emails currently in circulation with a variety of subject lines, including: "Current Australia's Prime Minister survived a hear attack" "The life of the Prime Minister is in grave danger" "Prime Minister survived a heard attack" with a link to malicious websites, including: h**p://www,austr-news,com/ h**p://www,theaunews,com/ h**p://www,theau-news,org/ Anyone seeing a lot of this? Perhaps targeting other heads of state? Might be worth keeping an eye out as we've seen similar to this before: AL-2006.0069 -- [Win] -- "John Howard tragedy" email attachment installs Torpig credential stealing trojan http://www.auscert.org.au/6645 with similar 'hooks' in that one appearing to be targeting Italy and the UK at least with messages of their government leaders' reported assassination. Feedback appreciated. Best regards, - -- Matthew McGlashan -- Coordination Centre Team Leader | Hotline: +61 7 3365 4417 Australian Computer Emergency Response Team | Direct: +61 7 3365 7924 (AusCERT) | Fax: +61 7 3365 7031 The University of Queensland | WWW: www.auscert.org.au Qld 4072 Australia | Email: auscert(a)auscert.org.au -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (FreeBSD) Comment: http://www.auscert.org.au/render.html?it=1967 Comment: http://www.auscert.org.au/render.html?it=1967 iQCVAwUBRdlMDyh9+71yA2DNAQKhGwQAmY99YaXxm48qj5LqxSSYYeMlTTSjWIvm F1S/Qop5km5/e2ZrDNJHbojfVNpLg9YrXGG8AxtY5nTcD852ojBuTf9tBmHUwqwF ljnyc4L6zxZ4iFzFWEZhypXBcnN6AZEYU8++vnnqePCK6KPfZsNJkhgodq2L53n9 GimZG4XHaso= =/dMS -----END PGP SIGNATURE-----

1 0

[Fwd: [pacnog] IPv4 exhaustion discussions in Asia Pacific region]
by Andy Linton 18 Feb '07

18 Feb '07

Given our discussions on IPv4 and IPv6 at the recent nznog meeting some of you may be interested in this. -------- Original Message -------- Subject: [pacnog] IPv4 exhaustion discussions in Asia Pacific region Date: Mon, 12 Feb 2007 10:44:32 +1000 (EST) From: Elly Tawhai <elly(a)apnic.net> To: pacnog(a)pacnog.org Hi You are probably aware by now that the exhaustion of IPv4 address space is likely to occur in the next few years. You might be interested to know that a proposal to deal with IPv4 exhaustion has been put forward for discussion in the APNIC region. The proposal suggests five main principles: (1) Global synchronization: All five RIRs will proceed at the same time for measures on IPv4 address exhaustion. (2) Some Blocks to be left: Keep a few /8 stocks instead of distributing all. (3) Keeping current practices until the last moment: Maintain the current policy until the last allocation. (4) Separate discussions on "recycle" issue: Recovery of unused address space should be discussed separately For more information on the proposal, see: http://www.apnic.net/docs/policy/proposals/prop-046-v001.html This proposal affects the whole Internet community. I encourage you to read the proposal and have your say on the APNIC Policy SIG mailing list, or at the upcoming APNIC 23 meeting in Bali, Indonesia, 26 February - 2 March 2007. If you can't attend the meeting in person, you can still have your say by participating remotely via live chat. APNIC Policy SIG mailing list information: http://www.apnic.net/community/lists APNIC 23: http://www.apnic.net/meetings/23/ Kind regards, Elly APNIC

13 13

[Fwd: [pacnog] IPv4 exhaustion discussionsin Asia Pacific region]
by Patrick Jordan-Smith 18 Feb '07

18 Feb '07

> Which is a problem if we are reliant on the telco's to move to IPv6. > Why would any sane [NZ] telco spend serious money changing to a > technology which further relegates them to a common bit pusher? > There is an argument here that IPv4 exhaustion provides a technical > rational for telcos to provide walled garden, proxy-style services. I fully support this style of thinking. Infact, if I was an ISP I would be seriously considering NATing my entire customer base - except for those who were willing to pay $x/mo for a real IP. At the end of the day, with a few exceptions, most protocols work quite well from behind a nat. And it gives me another revenue stream, which if I am an ISP would be quite useful considering I am probably losing money on the DSL I am currently providing. Cheers, Patrick -- patpatnz(a)gmail.com

6 6

APNIC fee structure - Online voting period extended
by Elly Tawhai 18 Feb '07

18 Feb '07

Dear Colleagues Voting on the APNIC fee schedule questions has now been extended by one week. The APNIC Executive Council decided to extend the online vote due to the low number of responses so far. This is an important issue for all APNIC members, so we encourage you to have your opinions counted. The new deadline for votes is 14:00 UTC, Friday 23 February, 2007. To vote, or get more information about the process, please go to: https://my.apnic.net/voting Please note that only registered voting contacts are able to cast votes. If you have any questions about using MyAPNIC, please contact helpdesk(a)apnic.net. Kind regards, Elly ________________________________________________________________________ Elly Tawhai email: elly(a)apnic.net Internet Resource Analyst, APNIC sip: elly(a)voip.apnic.net http://www.apnic.net/helpdesk phone: +61 7 3858 3188 fax: +61 7 3858 3199 ________________________________________________________________________ See you at APNIC 23! Bali, 26 February - 2 March, 2007 http://www.apnic.net/meetings

1 0

Re: [nznog] [Fwd: [pacnog] IPv4 exhaustion discussionsin Asia Pacific region]
by Ewen McNeill 16 Feb '07

16 Feb '07

In message <2B310DEB-219F-4F70-9779-F27EDDEE60AA(a)ca.afilias.info>, Joe Abley writes: >On 16-Feb-2007, at 17:00, Nathan Ward wrote: >> End-to-end IP connectivity is so passe. > >But it's arguably what allowed the Internet to grow and flourish. If >the network controls the applications that users can deploy, then >[provider catchup or user disappointment or] >people will stop dreaming up new applications for users to run, and >will instead concentrate on packages they can sell to carriers and ISPs. Or, perhaps worse, all new applications will have an extra layer to "route around" this problem. The rise of application data over XML over HTTP (over SSL) over TCP over IP hints at what this world might be like. That's not exactly progress. The security folks aren't exactly keen on this either (even without the SSL, it's very hard to "pinhole" inspect what is going on in the midst of large XML payloads, and you don't get much of a service type indicator if it's all XML over HTTP). The "big win" of Skype, and Kazaa before it, is its ability to "route around" the NAT everywhere, firewall everywhere, world and overlay what is basically an end-to-end network again (at least bits of it created on demand). That's not exactly progress either. Some other possibilities have been suggested, such as smarter intermediate boxes (firewalls, NAT), with which one negotiates (as in a protocol to request) a path through to the end box. This is already starting to happen with, eg, STUN, but potentially could be formalised as part of connection setup, and done automatically rather than requiring per-application custom setup. One is left wondering if instead of inventing random ad-hoc "tunnel through intermediate boxes" protocols it may be that things converge on, eg, 6-over-4. At least, eg, application over TCP over IPv6 over IPv4 is still pretty transparent, and doesn't have _that_ much overheard (compared with, eg, XML over HTTP). And there's some eventual migration path which involves reducing layers (eventually when everything is 6-over-4 it makes sense to just get rid of the IPv4 bit). Ewen

1 0

Apropos addressing
by Juha Saarinen 16 Feb '07

16 Feb '07

Geoff Huston has something to say on that: http://www.circleid.com/posts/addressing_the_future_internet/ (Shamelessly nicked from Bill St Arnaud's CAnet news: http://www.canarie.ca/canet4/library/list.html) -- Juha Saarinen www.geekzone.co.nz/juha | Skype: juha_saarinen blogs.pcworld.co.nz/pcworld/techsploder www.computerworld.co.nz | MSN: juha_saarinen(a)msn.com Voice: +64 9 950 3023 Subtle recursive jokes in .sigs are not funny.

2 1

Notification of NZRR Database changes
by NZRR Database Notifications 13 Feb '07

13 Feb '07

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS38292 descr: Route set advertised to AS9439 by Zero One - AS38292 members: 210.48.94.0/24^24-29, 210.48.103.192/26^26-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: nick(a)01.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070212 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS38292 descr: advertised to AS9439 by ZeroOne (NZ) Limited - AS38292 members: 202.174.6.0/23^23-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc(a)zeroone.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070214 source: NZRR

1 0