- NZNOG - lists.nznog.org

RE: [nznog] microsoft.com
by Nathan Mercer 16 Aug '03

16 Aug '03

Microsoft.com is run on IIS6 with Windows Server 2003 http://www.microsoft.com/backstage/inside.htm Akamai provide a content distribution network and dns to get download files closer to end users to improve the overall end user experience by speeding up file downloads. http://uptime.netcraft.com/up/graph?site=www.microsoft.com reports that MS is running IIS6 on Linux! How is that possible? http://uptime.netcraft.com/up/accuracy.html#impossible Why do you report impossible operating system/server combinations ? Webservers that operate behind a caching system, load balancer, reverse proxy server or a firewall may sometimes report the operating system of the intermediate machine. Hence reports of 'Microsoft/IIS on Linux' may indicate that either the web server is behind a Linux server that is acting as a reverse proxy, or has configured the Akamai caching system such that the first request to the site goes to one of Akamai's servers [which run Linux], or as in the case of www.walmart.com has been configured to send a misleading signature. -----Original Message----- From: Juha Saarinen [mailto:juha(a)saarinen.org] Sent: Saturday, 16 August 2003 9:12 a.m. To: Joe Abley Cc: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] microsoft.com Joe Abley wrote: > That power outage knocked out bits of the North Eastern US and most of > South-Western Ontario (including my house -- still no power here, just > laptops and cellphones). To the best of my knowledge most > Microsoft-branded services are served out of Redmond, and Hotmail is in > the Bay Area somewhere (used to be in an MFN/AboveNet facility in San > Jose, but I seem to remember they moved a while ago). > > Most large exchange facilities in New York seem to have survived on > battery and diesel power, and I don't believe the outage stretched as > far as Virginia (where it might have stood a fighting chance of > impacting some high concentrations of network operators). > > So probably not related to the power outage. It's also interesting to note that a good chunk of Microsoft's Web content is served from Linux boxes. "Akamaighost" apparently runs on Linux. Here's an example: http://uptime.netcraft.com/up/graph?site=a100.ms.a.microsoft.com Looks like Windows Update arrives to you via Linux as well. -- Juha _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

5 7

RE: [nznog] blaster worm
by Nathan Mercer 16 Aug '03

16 Aug '03

We're experiencing increased traffic levels, but its not DoSing us. You might be interested in reading some more about the Blaster worm here Recommendations to ISPs Regarding the Blaster Worm http://www.microsoft.com/serviceproviders/security/isp_blaster.asp There is a Word DOC there with some more info. You can read with the Word viewer downloadable here http://download.microsoft.com/download/word2000/wd97vwr/2000/WIN98/EN-US /wd97vwr32.exe Nathan -----Original Message----- From: Barry Murphy [mailto:barry(a)unix.co.nz] Sent: Saturday, 16 August 2003 9:45 a.m. To: Nathan Mercer Cc: NZ NOG Subject: Re: [nznog] blaster worm Nathan, Are you aware of microsoft being affected from the DDoS of this virus yet? Seeing as you people will probably hear first off.

6 5

spam farms
by Liz Q 16 Aug '03

16 Aug '03

Is there anything that can be done about these 'Spam Farms' ? ie Companies that take 30+ C classes have a domain for every c class and set up reverse and forward mx<num>@<domain> for each ip. They appear to be designed purely for spam and One company in particular ive been having issues with, appear to own a couple hundred C class. Is there any way they can be mass listed with spam servers? Liz Q

1 0

RE: [nznog] blaster worm
by Nathan Mercer 16 Aug '03

16 Aug '03

www.windowsupdate.com isn't used for anything. It used to redirect to windowsupdate.microsoft.com If customers need to download patches they should be going to Windows Update link in their start menus which goes to windowsupdate.microsoft.com or www.windows.com 30 mins to go... Regards Nathan Microsoft NZ -----Original Message----- From: Malcolm Lockyer [mailto:ipvariance(a)hotmail.com] Sent: Friday, 15 August 2003 11:23 p.m. To: lennon(a)orcon.net.nz; simon.lyall(a)ihug.co.nz Cc: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] blaster worm --snippity-- >Subject: Re: [nznog] blaster worm >Date: 15 Aug 2003 21:56:15 +1200 > >--snippity-- > >Make www.windowsupdate.com point to 127.0.0.1 so it doesn't do anything >or what? Except that it makes it a more effective DOS. Because then NOBODY can reach windowsupdate regardless - instead of just painfully slowly - or decently for whatever Akamai based reason. Time to hold onto whatever body part you guys value - here comes the storm. Although on a side note I hope the blaster infections are lower than I think they are - because all of you have been blocking netbios / 139tcp / etc. since this thing broke out. Right? Should be a more interesting 24 hours then eh? :-| m > >Thanks >Craig Whitmore >Orcon Internet >http://www.orcon.net.nz > --snippity-- _________________________________________________________________ Download MSN Messenger @ http://messenger.xtramsn.co.nz - talk to family and friends overseas! _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

6 6

blaster worm
by Simon Lyall 15 Aug '03

15 Aug '03

According to published docs on the worm it attacks "windowsupdate.com" which maps to ip's in 204.79.188.0/24 However checks to my cache logs show that nothing ever goes to plain old http://windowsupdate.com . Everything goes to download.windowsupdate.com , www.download.windowsupdate.com or something else. Even www.windowsupdate.com points elsewhere. In fact a glance though cache logs so nothing going anywhere near the 204.79.188.0/24 network. Even better the 204.79.188.0/24 is a /24 all by itself advertised as a /24. Does this mean: 1. It's safe to null route this network. 2. Microsoft will withdraw the advertisement for the network if the going gets tough. I notice that there is no route for the network on route-server.cw.net already. Thoughts? -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz Ihug Ltd, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz

11 11

RE: [nznog] blaster worm
by Nathan Mercer 15 Aug '03

15 Aug '03

If you are having problems with WU can I suggest you try this URL https://v4.windowsupdate.microsoft.com/en/default.asp Cheers Nathan -----Original Message----- From: Jithen Singh [mailto:jsingh(a)net4u.co.nz] Sent: Saturday, 16 August 2003 10:06 a.m. To: 'Simon Byrnand'; 'Barry Murphy' Cc: 'NZ NOG' Subject: RE: [nznog] blaster worm According to articles posted on the web, Microsoft installed Windows Update from scratch (fresh install), and since then, updates that needed downloading have failed to show. Some have suggested changing the language to EN-US and this will fix the problem, but I have yet to see proper solution as yet. Regards Jithen -----Original Message----- From: Simon Byrnand [mailto:simon(a)igrin.co.nz] Sent: Saturday, 16 August 2003 9:57 a.m. To: Barry Murphy Cc: NZ NOG Subject: Re: [nznog] blaster worm > Nathan, > > Are you aware of microsoft being affected from the DDoS of this virus yet? > Seeing as you people will probably hear first off. > > P.S. I dont want you to loose your job so you can mail me off list if > you > like:) > > Barry I don't know about direct effects of the worm, but both windows update and the microsoft sites in general seemed to be down for many hours yesterday afternoon.... maybe it was just a huge influx of people trying to get at the patches, or maybe some server upgrades went awry...(apparently MS were going to increase their web serving capacity...) Also I tried Windows Update from a Windows 2000 machine just now and although it appears to be working, all is not well because it reports "There are no updates available for your computer" when I know full well that it normally keeps insisting that I install the .NET stuff and Media player 9. (And a few other things under the windows section that I normally refuse to install) Perhaps MS have temporarily suspended downloading of "non critical" updates to reduce the server load from people who go to windows update primarily to get the security related updates.... Regards, Simon _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

RE: [nznog] blaster worm
by Nathan Mercer 15 Aug '03

15 Aug '03

You're correct. We never used windowsupdate.com for anything, none of our stuff points to it at all - it was only a redirect site. There was a redirect in place going from windowupdate.com to windowsupdate.microsoft.com up until about 9pm NZ time last night. Cheers Nathan -----Original Message----- From: Simon Byrnand [mailto:simon(a)igrin.co.nz] Sent: Saturday, 16 August 2003 9:33 a.m. To: Kerry Thompson Cc: NZ NOG Subject: RE: [nznog] blaster worm > windowsupdate.com has been pulled my MS. > See > > http://slashdot.org/article.pl?sid=03/08/15/1730200&mode=thread&tid=109& tid=126&tid=172&tid=187 > > I believe they've shifted to windowsupdate.microsoft.com I wouldn't say they've "shifted" to windowsupdate.microsoft.com. As far as I'm aware, thats always been the actual URL of windows update pretty much since day one. I've been using windowsupdate.microsoft.com as the URL for years now.... Maybe they had a redirection page at windowsupdate.com or just mirrored that URL as well. If the worm really targets windowsupdate.com and not windowsupdate.microsoft.com then the worm author isn't as smart as they'd like to think they are :) (big surprise there huh....) Regards, Simon _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

6 5

Nauru
by Jon Leeman 15 Aug '03

15 Aug '03

>What is Nauru? and do you connect via telstra clear; they the only ISP i >know that connect via reach. That's the fourth, private query from members of this list I've had..............look north from NZ and it's just below the equator..........Nauru is known as the 'smallest' sovereign nation (if you discount the Vatican) on the planet...........google for Nauru + "phosphate" (or "John Howard's Pacific Solution", "Money Laundering", etc.. Internet access is via a 64/64 Kbps link with an F3 IDR ES using IntelSat and Telstra Reach. I'm an Oz 'expat' resident (14+ years). Rgds., Jon Jon Leeman .nr ccTLD Technicial Contact ISP Technician CenpacNet Inc. Republic of Nauru e: jleeman(a)cenpac.net.nr w: www.cenpac.net.nr

1 0

APE route servers
by Andy Linton 14 Aug '03

14 Aug '03

Those of you who use our route servers should use the Looking Glass at http://www.wix.net.nz/cgi-bin/mrlg-ape.cgi to check that you are peering with both route servers. Some of you have a session with rs1 but not with rs2. It would make sense for you to add the second server for redundancy. The configuration details are identical apart from the IP address of the BGP peer. 192.203.154.2 instead of 192.203.154.1.

3 2

Re: [nznog] blaster worm
by Malcolm Lockyer 14 Aug '03

14 Aug '03

--snippity-- >Subject: Re: [nznog] blaster worm >Date: 15 Aug 2003 21:56:15 +1200 > >--snippity-- > >Make www.windowsupdate.com point to 127.0.0.1 so it doesn't do anything >or what? Except that it makes it a more effective DOS. Because then NOBODY can reach windowsupdate regardless - instead of just painfully slowly - or decently for whatever Akamai based reason. Time to hold onto whatever body part you guys value - here comes the storm. Although on a side note I hope the blaster infections are lower than I think they are - because all of you have been blocking netbios / 139tcp / etc. since this thing broke out. Right? Should be a more interesting 24 hours then eh? :-| m > >Thanks >Craig Whitmore >Orcon Internet >http://www.orcon.net.nz > --snippity-- _________________________________________________________________ Download MSN Messenger @ http://messenger.xtramsn.co.nz - talk to family and friends overseas!

2 1