- NZNOG - lists.nznog.org

TelstraClear/ICONZ Fault
by Chris Woodrow 22 Jun '05

22 Jun '05

Apparently TelstraClear made some 'changes' to the primary ICONZ WGTN-AUCK circuit around midnight last night. Since then we have about 55% packet loss, with ICONZ as at 12:05 saying that they have not been given an ETA by TelstraClear. 12 hours of substandard performance with no ETA seems a bit poor to me. If anyone has any updates on this please feel free to let me know. Regards Chris Woodrow BDT

1 0

Re: [nznog] Anyone awake at Ihug NOC/Security?
by Mark Foster 21 Jun '05

21 Jun '05

Glen Wilson wrote: *snip* > I enquired about your email today and was told that you had lodged a fault > regarding smtp relay attempts in which the offending ip was not an Ihug > ip and the issue was dropped. It was also brought to my attention > that in a follow up email from you to the abuse mailbox stated the > following,... > > "If I don't get some sort of acknowledgement of my reports soon I will > start dropping ihug IP ranges at the highest supernet I can see... " Unfortunately you're taking my frustration and desire-to-get-SOME-sort-of-response out of context, and its a shame you did this on NZNOG. I don't make a habit of misreporting complaints, and i'm wary of the fact that as an end user (at least in the capacity I was reporting this particular abuse case in) I don't exactly have any 'clout'. So I was simply reporting a fact - that my frustration level was such that i'd rather add all of ihug to my RBL than deal with the ongoing virus payload that was (apparently) being ignored. I have sent another response offlist but I felt the need to make it clear that I am not a cry-wolf type and am familiar with the concepts of dns lookup and whois. ;-) Good luck to those at ihug with the thankless task of clearing that backlog! Mark.

5 4

RE: [nznog] Anyone awake at Ihug NOC/Security?
by Blair Robson 21 Jun '05

21 Jun '05

It was just a suggestion, that email was a few days old and none of you guys had responded (obviously cos it was sorted) - I was just trying to help. >> All your comments are just rumour and speculation. Yeah, absolutely I don't _know_ anything and I said that. Again just a suggestion. _b -----Original Message----- From: Simon Allard [mailto:simona(a)staff.iinet.net.au] Sent: Wednesday, 22 June 2005 9:23 a.m. To: Blair Robson; nznog(a)list.waikato.ac.nz Subject: RE: [nznog] Anyone awake at Ihug NOC/Security? Blair. Please don't comment on ihug matters which you know nothing about. All your comments are just rumour and speculation. None of the senior type jobs have gone. Yes some have left for other jobs, but they have all been replaced with new staff. abuse(a)iinet.net.au has no visibility into the ihug NZ network, so they will be no help to you. abuse(a)ihug.co.nz is the correct email to use. For the record, Mark was contacted minutes after his email and his problem was sorted. Cheers Simon Allard IHUG Security Monkey > -----Original Message----- > From: Blair Robson [mailto:blair.robson(a)ihug.co.nz] > Sent: Wednesday, 22 June 2005 2:52 a.m. > To: jon.brewer(a)att.net; 'Mark Foster'; nznog(a)list.waikato.ac.nz > Subject: RE: [nznog] Anyone awake at Ihug NOC/Security? > > Seriously - try abuse(a)iinet.net.au , explain that you have tried > contacting > abuse(a)ihug.co.nz (I assume you have?) > I don't know weather that will work or not, but I do know that nearly all > the senior people at Ihug in NZ are gone..And I think you will find Simon > no > longer works for Ihug. > As far as I can gather everything is being run or in the process of being > run from Perth now. > > Blair > > -----Original Message----- > From: jon.brewer(a)att.net [mailto:jon.brewer(a)att.net] > Sent: Tuesday, 21 June 2005 3:25 p.m. > To: Blair Robson; 'Mark Foster'; nznog(a)list.waikato.ac.nz > Subject: RE: [nznog] Anyone awake at Ihug NOC/Security? > > We too need a reply from Ihug security, and have unanswered mail in to > noc(a)ihug.net - address from Simon Lyall's NOC Contact List. Is there a > better address? > > To air some dirty laundry, 203-173-155-220.bliink.ihug.co.nz has generated > 30 GB of http traffic in the past month for one of our customers - > repeatedly downloading one file. (2400 times at last count) Our customer > would rather like it to stop. > > JB > > -------------- Original message from "Blair Robson" > <blair.robson(a)ihug.co.nz>: -------------- > > > > abuse(a)iinet ? > > > > > > > > -----Original Message----- > > From: Mark Foster [mailto:blakjak(a)blakjak.net] > > Sent: Wednesday, 15 June 2005 5:05 p.m. > > To: nznog(a)list.waikato.ac.nz > > Subject: [nznog] Anyone awake at Ihug NOC/Security? > > > > Repeat emails over the last week or two to abuse@ and noc@ havn't had > any > > sort of response or acknowledgement - can someone from Ihug NOC or > > security please contact me offlist. > > > > Thanks > > Mark. > > > > _______________________________________________ > > NZNOG mailing list > > NZNOG(a)list.waikato.ac.nz > > http://list.waikato.ac.nz/mailman/listinfo/nznog > > > > _______________________________________________ > > NZNOG mailing list > > NZNOG(a)list.waikato.ac.nz > > http://list.waikato.ac.nz/mailman/listinfo/nznog > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Re: [nznog] Anyone awake at Ihug NOC/Security?
by Glen Wilson 21 Jun '05

21 Jun '05

Glen Wilson Network Operations Manager Ihug Ltd, Auckland, New Zealand www.ihug.co.nz On Wed, 22 Jun 2005, Glen Wilson wrote: > > Again I clarify that noc(a)ihug and abuse(a)ihug remain the appropriate > channels. The mailbox is currently backlogged by several weeks, for the > benefit of the list if there are any urgent issues please feel free to > raise them with me directly (off list) for adequate responce. > > Your points are valid, but as the abuse autoresponder states, not all > emails warrent a reply. > > I can assure you that the matter was looked into and recommendations > were made to the responsible parties to improve the process. > > Abuse emails are treated seriously, however genuine cases of abuse are > dealt with faster than complaints of portscans, relay attempts and > blackice alarm logs. > > I enquired about your email today and was told that you had lodged a fault > regarding smtp relay attempts in which the offending ip was not an Ihug > ip and the issue was dropped. It was also brought to my attention > that in a follow up email from you to the abuse mailbox stated the > following,... > > "If I don't get some sort of acknowledgement of my reports soon I will > start dropping ihug IP ranges at the highest supernet I can see... " > > I recognise that current response times to abuse emails is somewhat > lacking but may I presume to recommend a more professional approach in > future Mark. > > Further comments should be off list. > > Regards > > Glen Wilson > Network Operations Manager > Ihug Ltd, Auckland, New Zealand > www.ihug.co.nz > > On Wed, 22 Jun 2005, Mark Foster wrote: > > > Glen - > > I dare say that instead of 'habitual abuse emailer' you might call me > > 'someone who's not willing to simply ignore situations for which ISPs > > and end users should actually be responsible'. > > > > And in case you missed what I stated in my original email, I had tried > > both addresses. Repeatedly. Over WEEKS. > > > > Further I suggest that the 'I'm having the same problem too' format of > > responses to my post to NZNOG might imply that maybe you need to examine > > your own internal processes before you decide to get snarky on a public > > mailing list. > > > > If Ihug abuse team actually acknowledged complaints and committed to > > actioning them within a specific timeframe - as many ISPs do - I would > > not have felt the need to post to NZNOG - which was an act of desparation. > > > > I've been responsible for the abuse@ mailboxes for 3 different ISPs in > > the past and funnily enough, each of those ISPs took abuse reports > > seriously. Nomatter how much they might have wanted to killfile reports > > from particularly frequent reporters. :-) > > > > So I hope you have a great day, Glen. :-) > > > > Mark. > > > > PS: In case anyone hasn't registered it, Simon Lyall's NOC Contact List > > at http://www.usenet.net.nz/noc is pretty damn useful. Most of the time. > > :) [And isn't related to Simons past employment with Ihug.] > > > > Glen Wilson wrote: > > > > > noc(a)ihug.co.nz or abuse(a)ihug.co.nz. > > > > > > As a habitual abuse emailer, Mark Foster knows the appropriate channels. > > > > > > > > > Glen Wilson > > > Network Operations Manager > > > Ihug Ltd, Auckland, New Zealand > > > www.ihug.co.nz > > > > > > On Wed, 22 Jun 2005, Blair Robson wrote: > > > > > > > > >>Seriously - try abuse(a)iinet.net.au , explain that you have tried contacting > > >>abuse(a)ihug.co.nz (I assume you have?) > > >>I don't know weather that will work or not, but I do know that nearly all > > >>the senior people at Ihug in NZ are gone..And I think you will find Simon no > > >>longer works for Ihug. > > >>As far as I can gather everything is being run or in the process of being > > >>run from Perth now. > > >> > > >>Blair > > >> > > >>-----Original Message----- > > >>From: jon.brewer(a)att.net [mailto:jon.brewer(a)att.net] > > >>Sent: Tuesday, 21 June 2005 3:25 p.m. > > >>To: Blair Robson; 'Mark Foster'; nznog(a)list.waikato.ac.nz > > >>Subject: RE: [nznog] Anyone awake at Ihug NOC/Security? > > >> > > >>We too need a reply from Ihug security, and have unanswered mail in to > > >>noc(a)ihug.net - address from Simon Lyall's NOC Contact List. Is there a > > >>better address? > > >> > > >>To air some dirty laundry, 203-173-155-220.bliink.ihug.co.nz has generated > > >>30 GB of http traffic in the past month for one of our customers - > > >>repeatedly downloading one file. (2400 times at last count) Our customer > > >>would rather like it to stop. > > >

2 1

RE: [nznog] Anyone awake at Ihug NOC/Security?
by Blair Robson 21 Jun '05

21 Jun '05

Seriously - try abuse(a)iinet.net.au , explain that you have tried contacting abuse(a)ihug.co.nz (I assume you have?) I don't know weather that will work or not, but I do know that nearly all the senior people at Ihug in NZ are gone..And I think you will find Simon no longer works for Ihug. As far as I can gather everything is being run or in the process of being run from Perth now. Blair -----Original Message----- From: jon.brewer(a)att.net [mailto:jon.brewer(a)att.net] Sent: Tuesday, 21 June 2005 3:25 p.m. To: Blair Robson; 'Mark Foster'; nznog(a)list.waikato.ac.nz Subject: RE: [nznog] Anyone awake at Ihug NOC/Security? We too need a reply from Ihug security, and have unanswered mail in to noc(a)ihug.net - address from Simon Lyall's NOC Contact List. Is there a better address? To air some dirty laundry, 203-173-155-220.bliink.ihug.co.nz has generated 30 GB of http traffic in the past month for one of our customers - repeatedly downloading one file. (2400 times at last count) Our customer would rather like it to stop. JB -------------- Original message from "Blair Robson" <blair.robson(a)ihug.co.nz>: -------------- > abuse(a)iinet ? > > > > -----Original Message----- > From: Mark Foster [mailto:blakjak(a)blakjak.net] > Sent: Wednesday, 15 June 2005 5:05 p.m. > To: nznog(a)list.waikato.ac.nz > Subject: [nznog] Anyone awake at Ihug NOC/Security? > > Repeat emails over the last week or two to abuse@ and noc@ havn't had any > sort of response or acknowledgement - can someone from Ihug NOC or > security please contact me offlist. > > Thanks > Mark. > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog

7 6

RE: [nznog] Help with configuring router
by Lesley Walker 21 Jun '05

21 Jun '05

As you were. I found out what my problem was. Sorry for the distraction, I no longer need help. > I need some help with setting up a borrowed Network iQ 1000 series > router. (Also labelled securicor 3net if that helps) Lesley

1 0

PS: RE: [nznog] Help with configuring router
by Lesley Walker 21 Jun '05

21 Jun '05

> Replies off-list, please. Or phone me or Rob on this number: > Phone 64 4 384 4153 Thanks in anticipation. Lesley

1 0

Help with configuring router
by Lesley Walker 21 Jun '05

21 Jun '05

I need some help with setting up a borrowed Network iQ 1000 series router. (Also labelled securicor 3net if that helps) I have got as far as connecting to the serial port, watching it boot up and produce the login prompt, then it doesn't seem to respond to input, and hangs my Hyperterm (sorry!) session. I'm told the config has been set back to factory defaults, but the person who loaned it to me is in the middle of a crisis and can't help me set it up. If anyone could spare a few minutes to point me in the right direction I would be very grateful. I have all the config info I need, I just can't talk to it. (This is a temporary replacement for a very dodgy router that's providing our internet connection, and quite urgent) Replies off-list, please. Lesley Walker Datamine Limited - turning numbers into people 103 Ghuznee Street PO Box 11-452 Wellington, New Zealand Phone 64 4 384 4153 http://www.datamine.co.nz

1 0

Re: Paradise MX , was: [nznog] Anyone awake at Ihug NOC/Security?
by Ewen McNeill 21 Jun '05

21 Jun '05

In message <Pine.LNX.4.56.0506221253110.2350(a)green.darkmere.gen.nz>, Simon Lyall writes: >Does anyone know why pop3.paradise.net.nz doesn't seem to listen on port >25? [1] I wouldn't normally mind but it is listed as the primamry MX for >the domain. > >[1] - Since Monday at least, might be a lot longer. It's been like that for a year.[0] The response I got when I reported it said "We have permanently blocked SMTP requests to pop3.paradise.net.nz.". After some discussion, and me suggesting some more sensible approaches to route their mail,[1] they eventually said: "Despite how our mail system may look to the outside world it is functioning in a manner that we require at this particular stage of development." >From where I sit it still looks fairly clueless to firewall your primary MX off from the world. But I concluded then that I would be best served by excluding the instances of "failed connection to pop3.paradise.net.nz" from my log reports and forgetting about it. If you're able to get hold of someone clueful at Paradise and get them to fix it, I'll be grateful too.[2] Ewen [0] I know this because I found the auto-response to my ticket reporting the problem, and it's dated 21 June 2004. [1] Eg, modern mailers mail forwarding from their preferred MX to pop3.paradise.net.nz when appropriate, split DNs, etc. [2] The wellylug mailing list I host has several @paradise.net.nz addresses subscribed to it, so I get instances of this in my log pretty much daily.

1 0

IANA IPv4 allocations and bogon updates: 74/8, 75/8, 76/8, 189/8, 190/8
by Rob Thomas 21 Jun '05

21 Jun '05

-----BEGIN PGP SIGNED MESSAGE----- [ Apologies to those of you who receive this note in multiple forums. ] Hi, all. The numerous Team Cymru bogon projects have been updated as of 17 JUN 2005 to reflect the following IANA allocation made on 17 JUN 2005: 074/8 Jun 05 ARIN (whois.arin.net) 075/8 Jun 05 ARIN (whois.arin.net) 076/8 Jun 05 ARIN (whois.arin.net) 189/8 Jun 05 LACNIC (whois.lacnic.net) 190/8 Jun 05 LACNIC (whois.lacnic.net) IANA allocations change over time, so please check regularly to ensure you have the latest filters if you are not using the bogon BGP feed(s). We do announce updates to the bogon projects to sundry lists, such as the bogon-announce list. We can not stress this point strongly enough - these allocations change. If you do not adjust your filters, you will be unable to access perhaps large portions of the Internet. Worse yet, you may end up blocking access for people who transit through you. Please do not apply any filters or blocks to your network without carefully considering the ramifications of doing so. As a point of reference, the Team Cymru master Bogon Reference Page can be found here: <http://www.cymru.com/Bogons/> A quick summary of the documents and projects that have been updated include the following: HTTP The Bogon List - <http://www.cymru.com/Documents/bogon-list.html> The Text Bogon Lists - <http://www.cymru.com/Documents/bogon-bn-nonagg.txt> - <http://www.cymru.com/Documents/bogon-bn-agg.txt> Secure BIND Template - <http://www.cymru.com/Documents/secure-bind-template.html> Secure IOS Template (Cisco) - <http://www.cymru.com/Documents/secure-ios-template.html> Secure BGP Template (Cisco) - <http://www.cymru.com/Documents/secure-bgp-template.html> Secure JUNOS Template (Juniper) - <http://www.cymru.com/gillsr/documents/junos-template.htm> Secure JUNOS BGP Template (Juniper) - <http://www.cymru.com/gillsr/documents/junos-bgp-template.htm> Ingress Prefix Filter Templates, Loose and Strict (Cisco) - <ftp://ftp-eng.cisco.com/cons/isp/security/Ingress-Prefix-Filter- Templates/> Ingress Prefix Filter Template, Loose (Juniper) - <http://www.cymru.com/gillsr/documents/junos-isp-prefix-filter-loose.htm> Ingress Prefix Filter Template, Strict (Juniper) - <http://www.cymru.com/gillsr/documents/junos-isp-prefix-filter-strict.htm> BGP Bogon route-server for AUTOMATED updates of bogon filters - All bogon route-server peers have already received the appropriate BGP prefix updates. - <http://www.cymru.com/BGP/bogon-rs.html> RADb fltr-unallocated fltr-martian fltr-bogons - <http://www.cymru.com/Bogons/index.html#radb> RIPE NCC fltr-unallocated fltr-martian fltr-bogons - <http://www.cymru.com/Bogons/index.html#ripe> DNS Bogon (bogons.cymru.com) zone - <http://www.cymru.com/Bogons/index.html#dns> Monitoring Bogon prefix monitoring - <http://www.cymru.com/BGP/robbgp-bogon.html> Bogus ASN monitoring - <http://www.cymru.com/BGP/asnbogusrep.html> Please feel free to contact Team Cymru <team-cymru(a)cymru.com> with any comments, questions, or concerns. Thank you for your continued support. Rob, for Team Cymru. - -- Rob Thomas http://www.cymru.com Shaving with Occam's razor since 1999. -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.2 iQCVAwUBQrjLPlkX3QAo5sgJAQFHwAP/Z8KrLp9id6PD51KNEjAlveJCxRnvP4ev RofqRMex1SB5itogkB4O6JmrpSqIjqgM2GsnAUREZr5/r2ekdAZwejT85zHftl92 3ExvEec3P2PVDdfWF5v9TSVWfzwwbMW2HWwymzUYT7klWpjblcUUPdAWl+khD+FU /C8cCA2b8qk= =JvMq -----END PGP SIGNATURE-----

1 0