- NZNOG - lists.nznog.org

New IANA IPv4 allocations and bogon updates: 83/8 and 84/8
by Rob Thomas 17 Nov '03

17 Nov '03

Hi, team. [ Apologies to those who have received this post in other fora. ] The numerous Team Cymru bogon projects have been updated to reflect the following IANA allocations on November 15, 2003: 83/8 Nov 03 RIPE NCC 84/8 Nov 03 RIPE NCC IANA allocations change over time, so please check regularly to ensure you have the latest filters if you are not using the bogon BGP feed(s). We do announce updates to the bogon projects to the FIRST community, as well as on lists such as NANOG, isp-routing, isp-security, isp-bgp, cisco-nsp, and bogon-announce. We can not stress this point strongly enough - these allocations change. If you do not adjust your filters, you will be unable to access perhaps large portions of the Internet. Worse yet, you may end up blocking access for people who transit through you. Please do not blindly apply any filters or blocks to your network without carefully considering the ramifications of doing so. As a point of reference, the master Bogon Reference Page can be found here: http://www.cymru.com/Bogons/index.html A quick summary of the documents and projects that have been updated include the following: HTTP The Bogon List The Text Bogon List, Unaggregated The Text Bogon List, Aggregated Secure BIND Template Secure IOS Template (Cisco) Secure BGP Template (Cisco) Secure JUNOS Template (Juniper) Secure JUNOS BGP Template (Juniper) Ingress Prefix Filter Templates, Loose and Strict (Cisco) Ingress Prefix Filter Template, Loose (Juniper) Ingress Prefix Filter Template, Strict (Juniper) BGP Bogon route-server * RADb fltr-unallocated fltr-martian fltr-bogons DNS Bogon (bogons.cymru.com) zone Monitoring Bogon prefix monitoring * All of the bogon peers have received the appropriate BGP prefix updates. Please feel free to contact Team Cymru with any comments, questions, or concerns. Thanks! Rob, for Team Cymru. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

1 0

Re: Weird spam
by Richard Cox 17 Nov '03

17 Nov '03

On 17 Nov 2003 11:25 UTC "Barry Murphy" <barry(a)unix.co.nz> wrote: | I received the same message 8 times to the same address with about | 2-3 per hour. My spamassasin picked them up but the strange thing was | they all came from different IP addresses and I couldn't traceroute | any of them... You've assumed the handoff between received lines was valid; it wasn't. The "earlier" received line in each case was totally bogus: there is now a variety of custom "spamware" that forges a Received: header and carefully matches the fake details to the reverse DNS of the proxy or trojan machine that the spammer is actually sending from. That makes it almost impossible to know that the line is is in fact forged, unless you spot some little detail that they get wrong ... like (as in some of the cases that you quoted), the fact that the fake sending IP in the forged header is in a block that's either unannounced or completely unroutable! | IP addresses they were sent from: 99.27.67.200 IANA Reserved 202.163.151.24 Assigned but not announced 89.87.209.213 IANA Reserved 112.188.234.68 IANA Reserved 45.38.78.200 Interop Show Network 244.128.164.67 Unroutable 168.80.80.67 UUNET Internet Africa 64.215.105.194 64.215.105.194 | the messages were stopped as they were listed in blacklists. Blocklist tests are normally done on the most recent Received: line, as unless that line is OK, previous lines cannot usually be trusted. | The thing I don't understand is that there was no consistency, all | the emails from different IP's, all different forged header fields, | all not tracerouteable and within 30 minutes of each other to an | address only listed on a new zealand website. I can traceroute to some of the IPs you listed so it may be that traceroute packets have been blocked at your gateway. There are currently very some good reasons why network administrators do that! Because of the level of filtering, spammers now try to send the same mail from different proxies/zombies to be sure of getting it through. Different IPs are in different blocklists, and spammers can't tell what blocklist your ISP - or that of any other victim - uses. They can't even tell whether mail gets through at all because many systems are now configured to drop the mail rather than reject it. I won't pass comment on that policy, but we all know it happens. Hence to get better delivery figures, spammers now have to send out multiple copies. Their systems randomise all the variable factors - fake mail client, fake origin, fake sender name, random subject line etc, and loads of random garbage text in the spam body to foil any checksum detection of bulk mailing. | Weird, sounds very much like the spam system explained on the list | not too long ago. While it may well use that system, multiple proxy/trojan sending boxes are now becoming a standard spammer-modus-operandi! Joe Abley <jabley(a)isc.org> replied: | It seems to be fairly commonplace these days for (a) spam to be | vectored through widely-distributed sets of open proxies or infected | windows drones and (b) for unallocated or normally unadvertised space | to be advertised transiently in order to provide temporary addresses | to bind SMTP clients to. (a) is normal, for sure, but (b) - although theoretically trivial to do - is not yet in common use. Bogus announcements would need to be visible every place the spammer wanted to send to, and would then be visible at the route-collectors which report into systems like RIPE's RIS server and that in turn would allow them to be identified from a lookup at http://www.ripe.net/ripencc/pub-services/np/ris/index.html -- Richard Cox \/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/ Contribute to the SpamCon Legal Fund!! http://www.spamcon.org/legalfund/

1 0

Weird spam
by Barry Murphy 16 Nov '03

16 Nov '03

Hey guys, Anyone else receive this subject on the 14th... "AMERICAN STOCK MARKET: TRHL Retains Sky Investor Relations...edita", where edita was changed with multiple names. Not strange that I received spam, however I received the same message 8 times to the same address with about 2-3 per hour. My spamassasin picked them up but the strange thing was they all came from different IP addresses and I couldn't traceroute any of them... All of them stop at 202.37.246.18 (Global-gateway) eg. traceroute 89.87.209.213 traceroute to 89.87.209.213 (89.87.209.213), 64 hops max, 44 byte packets 1 gateway (219.88.241.241) 1.679 ms 2.403 ms 1.358 ms 2 fe0-0.cr1.idc.orcon.net.nz (219.88.242.250) 0.863 ms 0.872 ms 0.852 ms 3 fe-1.qos2.idc.orcon.net.nz (219.88.242.226) 1.134 ms 1.004 ms 1.128 ms 4 219.88.242.233 (219.88.242.233) 1.774 ms 1.906 ms 1.567 ms 5 202.50.245.33 (202.50.245.33) 39.962 ms 93.651 ms 6.643 ms 6 ge-0-3-0-6.akbr3.global-gateway.net.nz (202.37.246.18) 6.165 ms !N^C Ip addresses they were sent from: 99.27.67.200 202.163.151.24 89.87.209.213 112.188.234.68 45.38.78.200 244.128.164.67 168.80.80.67 64.215.105.194 In all cases the messages were stopped as they were listed in blacklists. RCVD_IN_NJABL (0.9 points) RBL: Received via a relay in dnsbl.njabl.org [RBL check: found 45.38.78.200.dnsbl.njabl.org.,] [type: 127.0.0.9] RCVD_IN_UNCONFIRMED_DSBL (0.5 points) RBL: Received via a relay in unconfirmed.dsbl.org [RBL check: found 45.38.78.200.unconfirmed.dsbl.org.] RCVD_IN_BL_SPAMCOP_NET (3.0 points) RBL: Received via a relay in bl.spamcop.net [RBL check: found 45.38.78.200.bl.spamcop.net.] They were also stopped because of forged headers, some having forged froms, forged MUA Outlook, etc. The thing I don't understand is that there was no consistency, all the emails from different IP's, all different forged header fields, all not tracerouteable and within 30 minutes of eachother to an address only listed on a new zealand website. Weird, sounds very much like the spam system explained on the list not too long ago. Barry Murphy

2 1

Understanding my traceroute?
by Jon Dean 16 Nov '03

16 Nov '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Everybody, I'm trying to get a better understanding of how the DSL network is integrated together in New Zealand. I'm hoping someone can help explain to me why their is such big latency gaps in some of the connections. Below is the output from a traceroute between me on Ihug Jetstart DSL and an Xtra Jetstream connection with a Static IP. 1 192.168.1.2 (192.168.1.2) 0.299 ms 0.148 ms 0.142 ms 2 203-118-173-1.adsl.ihug.co.nz (203.118.173.1) 56.506 ms 57.695 ms 60.022 ms Is 203.118.173.1 an Ihug router or a Telecom router? 3 192.168.253.225 (192.168.253.225) 66.866 ms 58.911 ms 61.027 ms 4 192.168.254.42 (192.168.254.42) 70.011 ms 69.028 ms 59.954 ms 5 v-93-tig-nz-akl-core-1.ihug.net (203.109.156.145) 70.147 ms 69.346 ms 68.020 ms 6 203-109-156-98.ihug.net (203.109.156.98) 69.904 ms 67.363 ms 71.046 ms 7 a5-0-0-40.akcr5.global-gateway.net.nz (202.37.245.165) 210.854 ms 203.399 ms 185.586 ms This is my real question... why is this such a big lag between 6 & 7. 140ms seems to be very high? Is there some type of bandwidth gap between Ihug and Global Gateway? Everything below this point is irrelevant.... Cheers, Jon -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iD8DBQE/uGYITV0Xs0S7UB4RAg8zAJ4yB4wn5iqCWgzhQpljznjnyeTiSQCfaDAu INl9jjcMXNgPbWST7gHB5kE= =qECf -----END PGP SIGNATURE-----

2 2

BreezeNet PRO Serial Adapter...
by Dan Clark 16 Nov '03

16 Nov '03

Hi all, Does anyone happen to have one of those 3 pin serial adapters for a BreezeNet Unit? Or know the pinouts. Please contact offlist. Kind Regards, Dan Clark DunedinWireless Scarfies.Net Ltd

1 0

Apropos Spamcop, and 2day.com before that.
by Juha Saarinen 16 Nov '03

16 Nov '03

http://www.theregister.co.uk/content/6/33724.html -- Juha

3 2

Trademe contact?
by Simon Lyall 15 Nov '03

15 Nov '03

Has anyone got technical contact for trademe? I've tried their whois and 0900 numbers but their not operating today. -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz Ihug Ltd, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz

1 1

Revamp of WIX website
by Andy Linton 15 Nov '03

15 Nov '03

We've redone the WIX website http://www.wix.net.nz/ and it now has links to the Looking Glass tool as well as some explanations of how we do things. I'm working on a similar revamp of the APE website and will announce in due course. andy

5 12

Update to ihug prefixes
by Simon Lyall 14 Nov '03

14 Nov '03

We're updated our prefixes. Current list is attached or available at the following URL: http://www.ihug.net/ihug-prefix-list -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz Ihug Ltd, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz

1 0

Re: [nznog] IPv6 Peering on the WIX
by Simon Lyall 14 Nov '03

14 Nov '03

On Fri, 14 Nov 2003, Joe Abley wrote: > If you want to be able to reach the rest of the IPv6 internet, you will > need a transit provider of some kind. Since it sounds like nobody in > New Zealand is offering IPv6 transit, you'll need to look outside the > country and gain v6 transit via a tunnel plumbed over IPv4. Sprint appear to provide a ipv6, it's via tunnels but they provide direct ipv4 connectivity into NZ so you don't have multiple providers. http://www.sprintv6.net/ http://www.sprintv6.net/Sprintv6.html "Sprint has IPv6 speaking routers in New York City, Washington DC, Seattle, Ft. Worth, and San Jose in the US, and routers in Brussels, Belgium, and Stockholm, Sweden, in Europe. Customers who wish to connect to Sprint's IPv6 backbone may do so, by building a tunnel from their CPE (or any device inside their network) to the nearest Sprint IPv6 router. " -- Simon J. Lyall. | Very Busy | Mail: simon(a)darkmere.gen.nz "To stay awake all night adds a day to your life" - Stilgar | eMT.

1 0