- NZNOG - lists.nznog.org

Mailwasher and its Forged Bounces
by Lennon - Orcon 18 Oct '04

18 Oct '04

I've been looking lately and a "large" number of double bounces to postermaster are caused by people who use "MailWashers" to Bounce Spam. I rmember the days when I could read every message to postmaster(a)isp.co.nz They are quite easy to spot as they all have the format of: mail.local: unknown name: username 550 username(a)domain.co.nz ... User unknown Coming from MAILER-DAEMON(a)domain.co.nz (usually the ISP's one) (and forging the email (which I presume is against all ISP's T&C) In mailwashers FAQ it says: ------- Do the spammers know I am bouncing email? No, spammers do not know you are bouncing messages. Bounced messages look just like a returned mail message you would receive if you sent an email to an incorrect address. --------- If I can tell if someone if using mailwasher.. why cannot the spammers? Even so I would think 99.9% of all emails bounced via this program don't get back to the spammers anyway (they don't use proper from addresses or use someone else's domain to send from (anyone in NZ using/looking at using SPF? to stop this type of thing) What I am trying to say (if not very well). What do people think of this feature of mailwasher. I've emailed the writer a few times for comments over the last few years and heard nothing from him. Have ISP's complained to uses using it? stopped people using it? or what? Thanks Craig Whitmore

12 19

Ihug Prefix list update
by Sainesh Singh 17 Oct '04

17 Oct '04

Please update domestic filters for Ihug. APE details: AS7657 192.203.154.36 192.203.154.37 Updated list can be found at: http://www.ihug.net/ihug-prefix-list and is included below. Cheers, Sainesh Singh Ihug Engineering ip prefix-list ihug-networks permit ip prefix-list ihug-networks description ihug peering prefix-list contact: noc(a)ihug.co.nz : Updated 2004-10-18 ip prefix-list ihug-networks permit 192.107.113.0/24 ip prefix-list ihug-networks permit 202.21.130.0/24 ip prefix-list ihug-networks permit 202.21.136.0/23 le 24 ip prefix-list ihug-networks permit 202.36.44.0/24 ip prefix-list ihug-networks permit 202.36.94.0/23 le 24 ip prefix-list ihug-networks permit 202.36.230.0/24 ip prefix-list ihug-networks permit 202.36.231.0/24 ip prefix-list ihug-networks permit 202.37.182.0/24 ip prefix-list ihug-networks permit 202.49.33.0/24 ip prefix-list ihug-networks permit 202.49.46.0/23 le 24 ip prefix-list ihug-networks permit 202.49.63.0/24 ip prefix-list ihug-networks permit 202.49.148.0/23 le 24 ip prefix-list ihug-networks permit 202.49.176.0/23 le 24 ip prefix-list ihug-networks permit 202.49.178.0/24 ip prefix-list ihug-networks permit 202.49.180.0/23 le 24 ip prefix-list ihug-networks permit 202.49.186.0/24 ip prefix-list ihug-networks permit 202.49.249.0/24 ip prefix-list ihug-networks permit 202.50.84.0/24 ip prefix-list ihug-networks permit 202.50.103.0/24 ip prefix-list ihug-networks permit 202.50.188.0/22 le 24 ip prefix-list ihug-networks permit 202.50.255.0/24 ip prefix-list ihug-networks permit 203.96.192.0/19 le 24 ip prefix-list ihug-networks permit 203.109.128.0/17 le 24 ip prefix-list ihug-networks permit 203.109.130.0/24 ip prefix-list ihug-networks permit 203.109.132.0/22 ip prefix-list ihug-networks permit 203.109.133.0/24 ip prefix-list ihug-networks permit 203.109.134.0/24 ip prefix-list ihug-networks permit 203.109.135.0/24 ip prefix-list ihug-networks permit 203.109.144.0/20 ip prefix-list ihug-networks permit 203.109.157.0/24 ip prefix-list ihug-networks permit 203.109.192.0/21 ip prefix-list ihug-networks permit 203.109.198.0/24 ip prefix-list ihug-networks permit 203.109.199.0/24 ip prefix-list ihug-networks permit 203.109.230.0/24 ip prefix-list ihug-networks permit 203.118.128.0/18 le 24 ip prefix-list ihug-networks permit 203.118.144.0/20 ip prefix-list ihug-networks permit 203.118.160.0/20 ip prefix-list ihug-networks permit 203.118.164.0/22 ip prefix-list ihug-networks permit 203.118.168.0/21 ip prefix-list ihug-networks permit 203.173.128.0/17 le 24 ip prefix-list ihug-networks permit 203.173.170.0/23 ip prefix-list ihug-networks permit 203.173.192.0/19 ip prefix-list ihug-networks permit 203.173.224.0/20 ip prefix-list ihug-networks permit 203.173.240.0/21 ip prefix-list ihug-networks permit 210.55.110.0/24 ip prefix-list ihug-networks permit 210.55.184.0/24 ip prefix-list ihug-networks permit 210.55.202.0/23 le 24 ip prefix-list ihug-networks permit 210.55.248.0/21 le 24

1 0

ACCC (Aus): Draft report on Internet Interconnection
by Simon Lyall 17 Oct '04

17 Oct '04

I havn't read it all yet but people may find it interesting. http://www.accc.gov.au/content/index.phtml/itemId/543536/ "The Australian Competition and Consumer Commission has issued a draft report seeking comment on whether internet interconnection arrangements should be subject to a two year period of monitoring..... " -- Simon J. Lyall. | Very Busy | Mail: simon(a)darkmere.gen.nz "To stay awake all night adds a day to your life" - Stilgar | eMT.

2 1

Updated monitoring pages from Team Cymru
by Rob Thomas 13 Oct '04

13 Oct '04

[ Apologies to those of you who receive this note in multiple forums. ] Hi, team. We are pleased to announce some updated monitoring, as well as some new monitoring, on our web site. This includes aesthetic fixes as well as increased visibility. Our DNS monitoring now has increased visibility as well as a new look and feel. Gone are the multiple pages for each zone, replaced with a single page that will have additional zones soon. You'll find it at the following URL. <http://www.cymru.com/DNS/dns.html> The times are DNS query response times, and the query responses are checked for correctness. Clicking on the query response time will bring you to a more detailed, graphical view of the query responses for the given pod and name server combination. We've updated our network monitoring to include several new components. This includes pod to pod ICMP, TCP, and UDP monitoring. It also includes traffic graphs for a select few Darknet pods, and our new Internet Garbage Meter. :) <http://www.cymru.com/Reach/index.html> For more on Darknets, from which our Darknet monitoring and Internet Garbage Meter are generated, please see our Darknet Project page at the following URL. <http://www.cymru.com/Darknet/> We hope you find this of use. Comments and suggestions are always welcome! Thanks! Rob, for Team Cymru. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

1 0

Re: [nznog] ICONZ
by Michael Hallager 12 Oct '04

12 Oct '04

Their helpdesk has told me it is a BGP4 fault and it is at Orcon's end, which it appears is news to Orcon. > Call the helpdesk? Call the noc? Paths look fine to me in a traceroute from > both providers. Michael Hallager (SNIP)

2 1

Re: Re: [nznog] linux.jetstreamgames.co.nz
by Jonny Martin 12 Oct '04

12 Oct '04

> "WIX peers only" mirror, much like ftp.nz.debian.org? I notice the "your ISP > is broken" message is still broken: > Looks like peering with the APE route servers wont > actually fix it. "...MAY be able to fix this problem for you... at the APE OR the WIX" - doesn't seem to me that it's broken. Seems quite reasonable as a generic sorry-no-peering-at-the-appropriate-place-and-we're-not-paying-for-the-traffic message. Cheers, Jonny.

18 23

RE: [nznog] Windows Update Server Selection
by Craig Humphrey 12 Oct '04

12 Oct '04

We've worked with Akamai and the best I can ascertain is that it directs you to the "best" location, where best isn't always the physically nearest server, since it may not have the content you're after. I think it uses similar ideas to what some of the distributed p2p clients do. Get enough requests from a "region" and you move the content (or a copy of the content) closer to that region. But that's just my understanding. > -----Original Message----- > From: Craig Whitmore [mailto:lennon(a)orcon.net.nz] > Sent: Wednesday, October 13, 2004 1:24 PM > To: jon.brewer(a)araneo.net.nz > Cc: nznog(a)list.waikato.ac.nz > Subject: RE: [nznog] Windows Update Server Selection > > It is based on Akamai (where download.microsoft.com is > pointing). But for > some reason.. they seem to move it around ALL the time. Anyone from > Microsoft/Akamai comment/can find out WHY its switching > around all the time > (with us it changes every 20-30 mins.. NZ..Australia.. US.. > Australia....) > Instead of just going to the Akamai Servers in NZ > > Thanks > Craig Whitmore > Orcon Internet

1 0

An idea for discussion
by Michael Hallager 12 Oct '04

12 Oct '04

Hello all. Ever so often on NZNOG somebody posts a wanted or for sale message. I have just thought - would there be any interest in a seperate "marketplace" mailing list, to buy, sell, trade equipment specifically related to ISP's and networks? MTCW - Comments please. // Michael Hallager Director || Head geek || Making IT work. URL: http://www.networkstuff.co.nz networkStuff, NZ's leading online supplier of high quality new and used networking equipment. Phone: (09) 839-1000 (DDI) 0800 638-788 (Freecall) Fax: (09) 837-8100 0800 329-788 (Freefax) Mobile: 029 638-7883 (SMS, MMS and PXT supported)

4 4

ICONZ
by Michael Hallager 11 Oct '04

11 Oct '04

Hello all. Is anyone aware of any funkiness between Iconz and Orcon, somewhere around APE? Non APE paths work. APE paths don't. // Michael Hallager Director || Head geek || Making IT work. URL: http://www.networkstuff.co.nz networkStuff, NZ's leading online supplier of high quality new and used networking equipment. Phone: (09) 839-1000 (DDI) 0800 638-788 (Freecall) Fax: (09) 837-8100 0800 329-788 (Freefax) Mobile: 029 638-7883 (SMS, MMS and PXT supported)

4 3

Re: [nznog] Networkstuff promotion
by Michael Hallager 11 Oct '04

11 Oct '04

Repeat: NO ONE who got emailed today was added to any mailing list !! (Without requesting it). It was ONLY AN INVITATION to a small group of targetted people, who's email addresses were in my address book. Please people, with p-pills, mortgage applications, pirated MS software yada yada, why the need to take out your frustrations on a local known specialised e-commerce business? Despite having my email address all over the place, I receive maybe once a month only an unsolicited professional email offering me something relevant and I find many of these useful or I simply delete. I have publically apologised several times and still I get emails suggesting that I should "apologise". Could it be that this is way out of proportion? I am still sorry and disapointed that some people have taken this in an unintended way. Michael Hallager > Rather remove everyone you manually added to the mailing list and let them > find your website on their own, if they want to be added they will opt in. > > Barry > > -----Original Message----- > From: Michael Hallager [mailto:michael(a)networkstuff.co.nz] > Sent: Sunday, 10 October 2004 9:05 p.m. > To: nznog(a)list.waikato.ac.nz > Subject: [nznog] Networkstuff promotion > > Hello all. > > I have just gone through and added a few names to the no-contact list > although > only about 50% of the people posting so far in this subject so far were > ever > > emailed in the first place. At last count, about 5 or 6. > > The actions of some in threatening mail blocks and in continuing this on > NZNOG > has made it rather hard for me to asertain who would like to be added. > I have already discussed it with others, some who would rather keep > the pot boiling... for no obvious reason.... I have tried to sort this out > with as many people as possible. > > So I repeat - contact me directly with your details and it will happen. > > I sincerely apologise again to all who were offended. > > // Michael Hallager > Director || Head geek || Making IT work. > > URL: http://www.networkstuff.co.nz > networkStuff, NZ's leading online supplier of high quality new and used > networking equipment. > > Phone: (09) 839-1000 (DDI) 0800 638-788 (Freecall) > Fax: (09) 837-8100 0800 329-788 (Freefax) > Mobile: 029 638-7883 (SMS, MMS and PXT supported) > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog -- // Michael Hallager Director || Head geek || Making IT work. URL: http://www.networkstuff.co.nz networkStuff, NZ's leading online supplier of high quality new and used networking equipment. Phone: (09) 839-1000 (DDI) 0800 638-788 (Freecall) Fax: (09) 837-8100 0800 329-788 (Freefax) Mobile: 029 638-7883 (SMS, MMS and PXT supported)

7 12