- NZNOG - lists.nznog.org

Re: Next generation of SPAM
by Adrian Smith 20 Aug '02

20 Aug '02

It appears to be using UDP on port 135, which according to www.iana.org/assignments/port-numbers is for epmap 135/tcp DCE endpoint resolution epmap 135/udp DCE endpoint resolution Adrian Smith >>>> "Juha Saarinen" <juha(a)saarinen.org> 21/08/2002 11:53:38 >>> >Gordon Smith wrote: >> Looks like a copy of an open source tool that was around some time >> ago. Also has bogus domain registration details, and the address on >> the site is in spammer paradise (Florida). >> >> I believe that the MS NET SEND command relies on NetBIOS over TCP, so >> having something like this at the borders should make it a non-issue: >> >> access-list 101 deny tcp any any eq 137 >> access-list 101 deny tcp any any eq 138 >> access-list 101 deny tcp any any eq 139 >You might have to add TCP and UDP 445 to that list, for Win2K/XP. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

peer (fwd)
by Matt Camp 18 Aug '02

18 Aug '02

Tim assures me he's fixed it this time..... As before, please apply this to any domestic peering session with either AS4768 or AS7714.

2 1

Noshade size
by nznog 18 Aug '02

18 Aug '02

------------------ Virus Warning Message ------------------ word is removed from here because it contains a virus. ------------------------------------------------------------- ------------------ Virus Warning Message ------------------ Found virus WORM_KLEZ.H in file word The uncleanable file is deleted. For more information regarding Xtra's anti-virus email filter please visit http://xtra.co.nz/anti-virus Please do not reply to this mailbox, as it is not managed. Any enquiries regarding anti-virus should be directed to anti-virus(a)xtra.co.nz -------------------------------------------------------------

1 0

"A secure, zoned Internet within five years"
by Juha Saarinen 15 Aug '02

15 Aug '02

http://www.theregister.co.uk/content/6/26695.html Interesting read. -- Juha Saarinen - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Peering
by Matt Camp 15 Aug '02

15 Aug '02

Beloved Peers, Update to the TelstraClear Domestic Peering Prefix-List Please remove: 202.0.32.0/20 le 24 202.0.50.0/24 Please add: 202.0.32.0/19 le 24 202.37.137.0/24 Full list attached.

4 8

FW: Another anti-spam tool
by Gordon Smith 14 Aug '02

14 Aug '02

Just a heads-up for everyone - just found a customer using a nasty little tool called spamstalker. Not only does it forge headers when the user bounces messages, it also attempts a sendmail HELO buffer overflow exploit. It's distributed out of the U.S. Needless to say, we'll be contacting the author... Cheers, Gordon Smith CCNA Network Operations Manager MoreNet Ltd - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: Fwd: Outage in Wellington
by Richard Naylor 14 Aug '02

14 Aug '02

At 04:41 p.m. 05/08/2002 +1200, Peter Mott wrote: >Are you saying that CityLink does not have UPS and autostart generator >on-site to run the whole works for at least 8 hours? I wondered when this would come up. CityLink has a different architecture and there is no "central office". Switching centers have ups and generators and smaller buildings just have UPS. But that doesn't guarantee anything. Y2k showed up a lot of "interesting effects" and I'm sure they haven't all been rectified. Having a geny in the building doesn't mean its tested and feeds everywhere you think it does. BTW - the building people mentioned this was their first outage in 7 years. In the case of this morning, we (and the other telcos in the room) run off the local power and took a short hit of around 15 minutes, despite a local outage measured in hours. We also elected to go to geny due to the switching issues the power boys were facing. We also supplied power to other tennants who had a need. If you have ever closed an 11kV switch on a fault in a metro ring main sub, you will understand why we made that decision. "did the earth move for you ?" is being polite. "Sudden suntans", stuck HT gloves, etc sometimes result. (aside: HT gloves come up to your elbow, when they are "stuck" it means they've melted to something, normally the switch handle or the wall on the other side of the room from where you were not so long ago.) Now whats really interesting is that after my earlier post, an ISP contacted me to see if the outage in Courtenay Place was the cause of two dropped pings in Thorndon. He mentioned that some of todays NZNOG discussion was already posted in a security list (?) being sent around, probably misquoted. My concern is that as a list we share fairly openly about incidents mixed with a degree of good humour and frequent light relief. If an unknowing party is quoting the list, then we need a closed list or reduce the chatter or even the info conveyed. Summary - this mornings outage wasn't a simple - NO POWER. It was complex, with enough other indicators to fool experienced (power) operators. They actually did a good job. rich richard.naylor(a)citylink.co.nz - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Re: Domainz falling prey to spambots?
by Saby Singh 13 Aug '02

13 Aug '02

1 0

RE: DNS problems
by Tim John 11 Aug '02

11 Aug '02

Chris, I appreciate your concern, but I should have mentioned - and state for the record - that this name server issue is solely with the machine hosting the DRS and nothing to do with the .nz DNS. I don't want anyone thinking that the 'real' name servers are effected by this. Tim -----Original Message----- From: Chris Wedgwood [mailto:cw(a)f00f.org] Sent: Thursday, 8 August 2002 4:02 p.m. To: Tim John Cc: 'nznog(a)list.waikato.ac.nz' Subject: Re: DNS problems On Thu, Aug 08, 2002 at 02:42:38PM +1200, Tim John wrote: The mail queue on the server is unable to resolve the names for the relevant name servers when sending the notification mail. Why is this? It's troubling Domainz of all people are having DNS issues. --cw DISCLAIMER: The content of this email is confidential and may contain legally privileged information intended only for the individual or entity named above. Access to this message by anyone else is unauthorised. If you are not the intended recipient, please be advised that the use, distribution and publication of the above information is prohibited. If you have received this email in error, please contact Domainz by returning the email and destroying the original. Thank you. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

latency
by Michael Newbery 11 Aug '02

11 Aug '02

It's Friday... I have been considering a suitable measure for IP latency. Inspired by the knowledge that at least one network protocol uses micro-fortnights as a unit (RFC 995), I respectfully offer the following modest proposal for consideration. We typically measure latency in msec, which is just so mundane and last millennium. Given that the speed of light is a constant, we can easily map between time and distance with the simple formula d=ct. Since our proposed new unit is purely nominal, we will use the speed of light in vacuo. In this post-modern world, why not use a tried and true, human centered measure. I like the cubit. It has stood the test of time, plus it has the word 'bit' in it. Now, typical values of latency produce a number of cubits that is rather large, so for most networks we will need to scale up the the mega-cubit (Mcubit). Those of us firmly wedded to powers of two may prefer the IEC standard nomenclature for powers of two prefixes of MiCubit (pronounced mebicubit). Which leads to the observation that the current distance from my workstation to Xtra is 3.47Mcubits, Cisco is 23Mcubits away, www.theregister.com is 34Mcubits away, and I am only 0.45 mebicubits from Paradise. Draw what comfort you may from this. -- Michael Newbery IP Architect TelstraClear Limited - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

9 16