- NZNOG - lists.nznog.org

Re: [nznog] Anyone awake at Ihug NOC/Security?
by Mark Foster 21 Jun '05

21 Jun '05

Glen Wilson wrote: *snip* > I enquired about your email today and was told that you had lodged a fault > regarding smtp relay attempts in which the offending ip was not an Ihug > ip and the issue was dropped. It was also brought to my attention > that in a follow up email from you to the abuse mailbox stated the > following,... > > "If I don't get some sort of acknowledgement of my reports soon I will > start dropping ihug IP ranges at the highest supernet I can see... " Unfortunately you're taking my frustration and desire-to-get-SOME-sort-of-response out of context, and its a shame you did this on NZNOG. I don't make a habit of misreporting complaints, and i'm wary of the fact that as an end user (at least in the capacity I was reporting this particular abuse case in) I don't exactly have any 'clout'. So I was simply reporting a fact - that my frustration level was such that i'd rather add all of ihug to my RBL than deal with the ongoing virus payload that was (apparently) being ignored. I have sent another response offlist but I felt the need to make it clear that I am not a cry-wolf type and am familiar with the concepts of dns lookup and whois. ;-) Good luck to those at ihug with the thankless task of clearing that backlog! Mark.

5 4

RE: [nznog] Anyone awake at Ihug NOC/Security?
by Blair Robson 21 Jun '05

21 Jun '05

It was just a suggestion, that email was a few days old and none of you guys had responded (obviously cos it was sorted) - I was just trying to help. >> All your comments are just rumour and speculation. Yeah, absolutely I don't _know_ anything and I said that. Again just a suggestion. _b -----Original Message----- From: Simon Allard [mailto:simona(a)staff.iinet.net.au] Sent: Wednesday, 22 June 2005 9:23 a.m. To: Blair Robson; nznog(a)list.waikato.ac.nz Subject: RE: [nznog] Anyone awake at Ihug NOC/Security? Blair. Please don't comment on ihug matters which you know nothing about. All your comments are just rumour and speculation. None of the senior type jobs have gone. Yes some have left for other jobs, but they have all been replaced with new staff. abuse(a)iinet.net.au has no visibility into the ihug NZ network, so they will be no help to you. abuse(a)ihug.co.nz is the correct email to use. For the record, Mark was contacted minutes after his email and his problem was sorted. Cheers Simon Allard IHUG Security Monkey > -----Original Message----- > From: Blair Robson [mailto:blair.robson(a)ihug.co.nz] > Sent: Wednesday, 22 June 2005 2:52 a.m. > To: jon.brewer(a)att.net; 'Mark Foster'; nznog(a)list.waikato.ac.nz > Subject: RE: [nznog] Anyone awake at Ihug NOC/Security? > > Seriously - try abuse(a)iinet.net.au , explain that you have tried > contacting > abuse(a)ihug.co.nz (I assume you have?) > I don't know weather that will work or not, but I do know that nearly all > the senior people at Ihug in NZ are gone..And I think you will find Simon > no > longer works for Ihug. > As far as I can gather everything is being run or in the process of being > run from Perth now. > > Blair > > -----Original Message----- > From: jon.brewer(a)att.net [mailto:jon.brewer(a)att.net] > Sent: Tuesday, 21 June 2005 3:25 p.m. > To: Blair Robson; 'Mark Foster'; nznog(a)list.waikato.ac.nz > Subject: RE: [nznog] Anyone awake at Ihug NOC/Security? > > We too need a reply from Ihug security, and have unanswered mail in to > noc(a)ihug.net - address from Simon Lyall's NOC Contact List. Is there a > better address? > > To air some dirty laundry, 203-173-155-220.bliink.ihug.co.nz has generated > 30 GB of http traffic in the past month for one of our customers - > repeatedly downloading one file. (2400 times at last count) Our customer > would rather like it to stop. > > JB > > -------------- Original message from "Blair Robson" > <blair.robson(a)ihug.co.nz>: -------------- > > > > abuse(a)iinet ? > > > > > > > > -----Original Message----- > > From: Mark Foster [mailto:blakjak(a)blakjak.net] > > Sent: Wednesday, 15 June 2005 5:05 p.m. > > To: nznog(a)list.waikato.ac.nz > > Subject: [nznog] Anyone awake at Ihug NOC/Security? > > > > Repeat emails over the last week or two to abuse@ and noc@ havn't had > any > > sort of response or acknowledgement - can someone from Ihug NOC or > > security please contact me offlist. > > > > Thanks > > Mark. > > > > _______________________________________________ > > NZNOG mailing list > > NZNOG(a)list.waikato.ac.nz > > http://list.waikato.ac.nz/mailman/listinfo/nznog > > > > _______________________________________________ > > NZNOG mailing list > > NZNOG(a)list.waikato.ac.nz > > http://list.waikato.ac.nz/mailman/listinfo/nznog > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Re: [nznog] Anyone awake at Ihug NOC/Security?
by Glen Wilson 21 Jun '05

21 Jun '05

Glen Wilson Network Operations Manager Ihug Ltd, Auckland, New Zealand www.ihug.co.nz On Wed, 22 Jun 2005, Glen Wilson wrote: > > Again I clarify that noc(a)ihug and abuse(a)ihug remain the appropriate > channels. The mailbox is currently backlogged by several weeks, for the > benefit of the list if there are any urgent issues please feel free to > raise them with me directly (off list) for adequate responce. > > Your points are valid, but as the abuse autoresponder states, not all > emails warrent a reply. > > I can assure you that the matter was looked into and recommendations > were made to the responsible parties to improve the process. > > Abuse emails are treated seriously, however genuine cases of abuse are > dealt with faster than complaints of portscans, relay attempts and > blackice alarm logs. > > I enquired about your email today and was told that you had lodged a fault > regarding smtp relay attempts in which the offending ip was not an Ihug > ip and the issue was dropped. It was also brought to my attention > that in a follow up email from you to the abuse mailbox stated the > following,... > > "If I don't get some sort of acknowledgement of my reports soon I will > start dropping ihug IP ranges at the highest supernet I can see... " > > I recognise that current response times to abuse emails is somewhat > lacking but may I presume to recommend a more professional approach in > future Mark. > > Further comments should be off list. > > Regards > > Glen Wilson > Network Operations Manager > Ihug Ltd, Auckland, New Zealand > www.ihug.co.nz > > On Wed, 22 Jun 2005, Mark Foster wrote: > > > Glen - > > I dare say that instead of 'habitual abuse emailer' you might call me > > 'someone who's not willing to simply ignore situations for which ISPs > > and end users should actually be responsible'. > > > > And in case you missed what I stated in my original email, I had tried > > both addresses. Repeatedly. Over WEEKS. > > > > Further I suggest that the 'I'm having the same problem too' format of > > responses to my post to NZNOG might imply that maybe you need to examine > > your own internal processes before you decide to get snarky on a public > > mailing list. > > > > If Ihug abuse team actually acknowledged complaints and committed to > > actioning them within a specific timeframe - as many ISPs do - I would > > not have felt the need to post to NZNOG - which was an act of desparation. > > > > I've been responsible for the abuse@ mailboxes for 3 different ISPs in > > the past and funnily enough, each of those ISPs took abuse reports > > seriously. Nomatter how much they might have wanted to killfile reports > > from particularly frequent reporters. :-) > > > > So I hope you have a great day, Glen. :-) > > > > Mark. > > > > PS: In case anyone hasn't registered it, Simon Lyall's NOC Contact List > > at http://www.usenet.net.nz/noc is pretty damn useful. Most of the time. > > :) [And isn't related to Simons past employment with Ihug.] > > > > Glen Wilson wrote: > > > > > noc(a)ihug.co.nz or abuse(a)ihug.co.nz. > > > > > > As a habitual abuse emailer, Mark Foster knows the appropriate channels. > > > > > > > > > Glen Wilson > > > Network Operations Manager > > > Ihug Ltd, Auckland, New Zealand > > > www.ihug.co.nz > > > > > > On Wed, 22 Jun 2005, Blair Robson wrote: > > > > > > > > >>Seriously - try abuse(a)iinet.net.au , explain that you have tried contacting > > >>abuse(a)ihug.co.nz (I assume you have?) > > >>I don't know weather that will work or not, but I do know that nearly all > > >>the senior people at Ihug in NZ are gone..And I think you will find Simon no > > >>longer works for Ihug. > > >>As far as I can gather everything is being run or in the process of being > > >>run from Perth now. > > >> > > >>Blair > > >> > > >>-----Original Message----- > > >>From: jon.brewer(a)att.net [mailto:jon.brewer(a)att.net] > > >>Sent: Tuesday, 21 June 2005 3:25 p.m. > > >>To: Blair Robson; 'Mark Foster'; nznog(a)list.waikato.ac.nz > > >>Subject: RE: [nznog] Anyone awake at Ihug NOC/Security? > > >> > > >>We too need a reply from Ihug security, and have unanswered mail in to > > >>noc(a)ihug.net - address from Simon Lyall's NOC Contact List. Is there a > > >>better address? > > >> > > >>To air some dirty laundry, 203-173-155-220.bliink.ihug.co.nz has generated > > >>30 GB of http traffic in the past month for one of our customers - > > >>repeatedly downloading one file. (2400 times at last count) Our customer > > >>would rather like it to stop. > > >

2 1

RE: [nznog] Anyone awake at Ihug NOC/Security?
by Blair Robson 21 Jun '05

21 Jun '05

Seriously - try abuse(a)iinet.net.au , explain that you have tried contacting abuse(a)ihug.co.nz (I assume you have?) I don't know weather that will work or not, but I do know that nearly all the senior people at Ihug in NZ are gone..And I think you will find Simon no longer works for Ihug. As far as I can gather everything is being run or in the process of being run from Perth now. Blair -----Original Message----- From: jon.brewer(a)att.net [mailto:jon.brewer(a)att.net] Sent: Tuesday, 21 June 2005 3:25 p.m. To: Blair Robson; 'Mark Foster'; nznog(a)list.waikato.ac.nz Subject: RE: [nznog] Anyone awake at Ihug NOC/Security? We too need a reply from Ihug security, and have unanswered mail in to noc(a)ihug.net - address from Simon Lyall's NOC Contact List. Is there a better address? To air some dirty laundry, 203-173-155-220.bliink.ihug.co.nz has generated 30 GB of http traffic in the past month for one of our customers - repeatedly downloading one file. (2400 times at last count) Our customer would rather like it to stop. JB -------------- Original message from "Blair Robson" <blair.robson(a)ihug.co.nz>: -------------- > abuse(a)iinet ? > > > > -----Original Message----- > From: Mark Foster [mailto:blakjak(a)blakjak.net] > Sent: Wednesday, 15 June 2005 5:05 p.m. > To: nznog(a)list.waikato.ac.nz > Subject: [nznog] Anyone awake at Ihug NOC/Security? > > Repeat emails over the last week or two to abuse@ and noc@ havn't had any > sort of response or acknowledgement - can someone from Ihug NOC or > security please contact me offlist. > > Thanks > Mark. > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog

7 6

RE: [nznog] Help with configuring router
by Lesley Walker 21 Jun '05

21 Jun '05

As you were. I found out what my problem was. Sorry for the distraction, I no longer need help. > I need some help with setting up a borrowed Network iQ 1000 series > router. (Also labelled securicor 3net if that helps) Lesley

1 0

PS: RE: [nznog] Help with configuring router
by Lesley Walker 21 Jun '05

21 Jun '05

> Replies off-list, please. Or phone me or Rob on this number: > Phone 64 4 384 4153 Thanks in anticipation. Lesley

1 0

Help with configuring router
by Lesley Walker 21 Jun '05

21 Jun '05

I need some help with setting up a borrowed Network iQ 1000 series router. (Also labelled securicor 3net if that helps) I have got as far as connecting to the serial port, watching it boot up and produce the login prompt, then it doesn't seem to respond to input, and hangs my Hyperterm (sorry!) session. I'm told the config has been set back to factory defaults, but the person who loaned it to me is in the middle of a crisis and can't help me set it up. If anyone could spare a few minutes to point me in the right direction I would be very grateful. I have all the config info I need, I just can't talk to it. (This is a temporary replacement for a very dodgy router that's providing our internet connection, and quite urgent) Replies off-list, please. Lesley Walker Datamine Limited - turning numbers into people 103 Ghuznee Street PO Box 11-452 Wellington, New Zealand Phone 64 4 384 4153 http://www.datamine.co.nz

1 0

Re: Paradise MX , was: [nznog] Anyone awake at Ihug NOC/Security?
by Ewen McNeill 21 Jun '05

21 Jun '05

In message <Pine.LNX.4.56.0506221253110.2350(a)green.darkmere.gen.nz>, Simon Lyall writes: >Does anyone know why pop3.paradise.net.nz doesn't seem to listen on port >25? [1] I wouldn't normally mind but it is listed as the primamry MX for >the domain. > >[1] - Since Monday at least, might be a lot longer. It's been like that for a year.[0] The response I got when I reported it said "We have permanently blocked SMTP requests to pop3.paradise.net.nz.". After some discussion, and me suggesting some more sensible approaches to route their mail,[1] they eventually said: "Despite how our mail system may look to the outside world it is functioning in a manner that we require at this particular stage of development." >From where I sit it still looks fairly clueless to firewall your primary MX off from the world. But I concluded then that I would be best served by excluding the instances of "failed connection to pop3.paradise.net.nz" from my log reports and forgetting about it. If you're able to get hold of someone clueful at Paradise and get them to fix it, I'll be grateful too.[2] Ewen [0] I know this because I found the auto-response to my ticket reporting the problem, and it's dated 21 June 2004. [1] Eg, modern mailers mail forwarding from their preferred MX to pop3.paradise.net.nz when appropriate, split DNs, etc. [2] The wellylug mailing list I host has several @paradise.net.nz addresses subscribed to it, so I get instances of this in my log pretty much daily.

1 0

IANA IPv4 allocations and bogon updates: 74/8, 75/8, 76/8, 189/8, 190/8
by Rob Thomas 21 Jun '05

21 Jun '05

-----BEGIN PGP SIGNED MESSAGE----- [ Apologies to those of you who receive this note in multiple forums. ] Hi, all. The numerous Team Cymru bogon projects have been updated as of 17 JUN 2005 to reflect the following IANA allocation made on 17 JUN 2005: 074/8 Jun 05 ARIN (whois.arin.net) 075/8 Jun 05 ARIN (whois.arin.net) 076/8 Jun 05 ARIN (whois.arin.net) 189/8 Jun 05 LACNIC (whois.lacnic.net) 190/8 Jun 05 LACNIC (whois.lacnic.net) IANA allocations change over time, so please check regularly to ensure you have the latest filters if you are not using the bogon BGP feed(s). We do announce updates to the bogon projects to sundry lists, such as the bogon-announce list. We can not stress this point strongly enough - these allocations change. If you do not adjust your filters, you will be unable to access perhaps large portions of the Internet. Worse yet, you may end up blocking access for people who transit through you. Please do not apply any filters or blocks to your network without carefully considering the ramifications of doing so. As a point of reference, the Team Cymru master Bogon Reference Page can be found here: <http://www.cymru.com/Bogons/> A quick summary of the documents and projects that have been updated include the following: HTTP The Bogon List - <http://www.cymru.com/Documents/bogon-list.html> The Text Bogon Lists - <http://www.cymru.com/Documents/bogon-bn-nonagg.txt> - <http://www.cymru.com/Documents/bogon-bn-agg.txt> Secure BIND Template - <http://www.cymru.com/Documents/secure-bind-template.html> Secure IOS Template (Cisco) - <http://www.cymru.com/Documents/secure-ios-template.html> Secure BGP Template (Cisco) - <http://www.cymru.com/Documents/secure-bgp-template.html> Secure JUNOS Template (Juniper) - <http://www.cymru.com/gillsr/documents/junos-template.htm> Secure JUNOS BGP Template (Juniper) - <http://www.cymru.com/gillsr/documents/junos-bgp-template.htm> Ingress Prefix Filter Templates, Loose and Strict (Cisco) - <ftp://ftp-eng.cisco.com/cons/isp/security/Ingress-Prefix-Filter- Templates/> Ingress Prefix Filter Template, Loose (Juniper) - <http://www.cymru.com/gillsr/documents/junos-isp-prefix-filter-loose.htm> Ingress Prefix Filter Template, Strict (Juniper) - <http://www.cymru.com/gillsr/documents/junos-isp-prefix-filter-strict.htm> BGP Bogon route-server for AUTOMATED updates of bogon filters - All bogon route-server peers have already received the appropriate BGP prefix updates. - <http://www.cymru.com/BGP/bogon-rs.html> RADb fltr-unallocated fltr-martian fltr-bogons - <http://www.cymru.com/Bogons/index.html#radb> RIPE NCC fltr-unallocated fltr-martian fltr-bogons - <http://www.cymru.com/Bogons/index.html#ripe> DNS Bogon (bogons.cymru.com) zone - <http://www.cymru.com/Bogons/index.html#dns> Monitoring Bogon prefix monitoring - <http://www.cymru.com/BGP/robbgp-bogon.html> Bogus ASN monitoring - <http://www.cymru.com/BGP/asnbogusrep.html> Please feel free to contact Team Cymru <team-cymru(a)cymru.com> with any comments, questions, or concerns. Thank you for your continued support. Rob, for Team Cymru. - -- Rob Thomas http://www.cymru.com Shaving with Occam's razor since 1999. -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.2 iQCVAwUBQrjLPlkX3QAo5sgJAQFHwAP/Z8KrLp9id6PD51KNEjAlveJCxRnvP4ev RofqRMex1SB5itogkB4O6JmrpSqIjqgM2GsnAUREZr5/r2ekdAZwejT85zHftl92 3ExvEec3P2PVDdfWF5v9TSVWfzwwbMW2HWwymzUYT7klWpjblcUUPdAWl+khD+FU /C8cCA2b8qk= =JvMq -----END PGP SIGNATURE-----

1 0

Thanks to TelstraClear for providing service during the major outage on Monday
by Adrian Smith 21 Jun '05

21 Jun '05

The National Library of New Zealand would like to thank TelstraClear New Zealand for providing a quick alternate National and International Internet service to us by setting up a BGP routing/Peering connection over our existing CityLink Network connections to bypass the major Telecom network outage on Monday. Our organisation was back up on the Internet several hours before the Telecom Network failure was restored. Due to the nature of Mondays Telecom Network failure we lost both our primary and backup Internet connections at 10:49am, leaving only our CityLink connection working, and peering with the CityLink WIX route servers, which still provided some 300 routes to us. After an hour of not being able to get any news on the cause and duration of the Telecom outage we approached one of TelstraClear's Internet BGP routing wizards and asked how can we route past this problem, he advised us to talk to their wholesale people. After explaining the situation to wholesale, authorisation was given to one of their Internet BGP routing wizard's to make it happen. Within a short time BGP Peering was set-up and implemented over the phone, and our full National and International Internet service was fully restored over CityLink to TelstraClear. We do not have any sort of contract with TelstraClear. The point here is that although TelstraClear stopped peering at WIX :( they are still connected to the CityLink Network :) and still connect to customers over it. We would not have had this option open to us if we were not already connected and using the CityLink Network and CityLink's Neutral Peering Exchange. http://www.citylink.co.nz/community/peering.html So Thanks to TelstraClear for providing a temporary Internet pipe with no notice; and Thanks also to the CityLink team /NGI/MORST Advanced Network for running some Internet BGP routing courses last week. The information was put into action on our router to bypass Monday's problem. http://www.ngi.org.nz/ http://www.morst.govt.nz/?CHANNEL=IT+INFRASTRUCTURE&PAGE=IT+Infrastructure The recently released Government Digital Strategy http://www.digitalstrategy.govt.nz/ encourages co-operation and collaboration in as many ways possible between all New Zealand people, and organisations both Government and private sector. When the many technical people on this NZNOG list receive this email, please take it to your leaders and explain the many benefits of Internet Peering at Neutral Internet Peering Exchanges to create a fully meshed, distributed Internet for New Zealand. Digital Strategy Launch http://www.r2.co.nz/20050516/ recording from Parliament. When the big one hits New Zealand and we have a full-scale major civil defence emergency it will be far too late for the very capable technical people in each of the organisations to implement Internet peering. They will not be able to use the phone networks due to outages and overloading, and the current New Zealand Internet will fail because peering was not put in place and working. It is in the interest of every single New Zealander that every New Zealand Telco, ISP and organisation connects their networks to the nearest Neutral Internet Peering Exchange and starts peering; and helps to create a real New Zealand Internet. The original Internet was designed for this very reason for the US Defence Department to prevent a total failure of communications during major infrastructure outages and emergencies. There would also be benefits for the Telco's and ISP's if this peering was already in place before the Telecom outage on Monday. It may have been a non-event, when both fibres were cut, the Telecom network could have re-routed traffic around the damage over TelstraClear's equally capable backbone network. Even if Telecom had to pay TelstraClear for the temporary transit traffic, it would have probably been a far less cost to pay both financially and politically. And the major disruptions caused to a lot of people waiting at airports, unable to use EFTPOS networks etc. may have been avoided, and Telecom customers would still have trust in them to provide Internetworking services. This would also work in reverse should such an event hit TelstraClear's network. So come on New Zealanders, please get the important message and do something about this situation today. Without realising it, you may save lives in the future because the NZ Internet does not break, just because a couple of fibre optic cables get cut by accident or equally by a natural disaster event. To all journalists on this list, please feel free to put this full message in as many papers, magazines and web sites as possible. With a further message to encourage every New Zealander who reads it, to email their ISP and request that their ISP set-up Internet Peering at a Neutral Internet Peering Exchange to create a robust New Zealand Internet. Come on Kiwi's, lets just do it. Adrian Smith, Network Specialist, National Library of New Zealand >>> Michael Newbery <Michael.Newbery(a)team.telstraclear.co.nz> 20/06/2005 17:26:36 >>> At 5:01 PM +1200 20/6/05, Andy Linton wrote: >So is this a good time to ask about the design of a network that concentrates >so much of its core service in Auckland? Is TelstraClear's network design any >better? I'd like to think so. :) For a start, it takes more than two fibre cuts in the North Island to disrupt us (that's new since you fled Andy :) Currently the core network is distributed and I prefer to follow that mantra whenever possible, though sometimes resources are naturally 'clumpy' (is that a word?) -- Michael Newbery IP Architect TelstraClear Limited Tel: +64-4-920 3102 Mobile: +64-29-920 3102 Fax: +64-4-920 3361 _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0