- NZNOG - lists.nznog.org

Pictures from Uniforum 2002 Online
by Mark Foster 28 Jul '02

28 Jul '02

Thanks to Eaden and Robert from Opentec - http://opentec.co.nz/uniforum Cheers, Mark. (Please forgive the CrossPosting.) - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Banking/Hospital Problems and MTU
by Simon Byrnand 28 Jul '02

28 Jul '02

At 10:46 29/07/02 +1200, rob.edkins(a)axon.co.nz wrote: >http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q159211& >http://support.microsoft.com/default.aspx?scid=KB;EN-US;q314825& > >Are useful too. > >This fix has been around for at least 4-5 years to my knowledge. >I don't know why it isn't on by default by now, but I guess it wasn't all >that big an issue in the old dial-up world. Probably the reason its not on by default, is because it is not a "fix", its just a workaround, to work around braindead firewalls that block all ICMP. As such there would probably be considerable sacrifice in performance when it has to operate - first of all there will have to be a few lost retransmitions of large MTU packets before it realises something is wrong, and then (from Juha's post) it just drops the MTU to 536 for further communication, which is definately sub optimal, depending on what the real maximum MTU of the path is... If it was on by default, it would hide the real problem, and nothing would ever get done about it. (I can see it now - "our Bank site works fine for MS operating systems, its only those weirdo's that run Linux that have problems because they don't have PMTUBHDetect" :) For once MS got something right by not making it on by default... Regards, Simon - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: Banking/Hospital Problems and MTU
by rob.edkins＠axon.co.nz 28 Jul '02

28 Jul '02

http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q159211& http://support.microsoft.com/default.aspx?scid=KB;EN-US;q314825& Are useful too. This fix has been around for at least 4-5 years to my knowledge. I don't know why it isn't on by default by now, but I guess it wasn't all that big an issue in the old dial-up world. > > http://www.microsoft.com/windows2000/techinfo/reskit/en/cnet/c > nbc_imp_yvjd.htm > > has more details. > > -- The information contained in this e-mail message is intended only for the use of the person or entity to whom it is addressed and may contain information that is CONFIDENTIAL and may be exempt from disclosure under applicable laws. If you read this message and are not the addressee you are notified that use, dissemination, distribution, or reproduction of this message is prohibited. If you have received this message in error, please notify us immediately and delete the original message. You should scan this message and any attached files for viruses. Axon Computertime accepts no liability for any loss caused either directly or indirectly by a virus arising from the use of this message or any attached file. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: Banking/Hospital Problems and MTU
by rob.edkins＠axon.co.nz 28 Jul '02

28 Jul '02

There's a somewhat simpler reg hack on Windoze. Set HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnablePMTUBHDetect to 1 This enables automatic 'Black Hole' router detection and triggers automatic MTU scaling. BTW, the 'Don't Fragment' Bit is on by default with Windows. Rob > > How incredibly serendipitous. I just ran into this problem > at work the > yesterday. The service techs. for our digital radiology > system came in > and applied the latest service update. All of a sudden users weren't > able to log in via their browser loaded Java client. Funny thing is, > these guys spent 2 days trying to figure out the problem before > resorting to asking "the network guy"... one of those pride things I > guess. > > Some quality time (15 minutes) with tcpdump (well, windump) showed the > DF bit being set and repeated acknowledgment requests during the > "hang". After a modest amount of investigation and a few phone calls > the following was found: > > 1. a remote firewall blocking all ICMP (the admin won't change it) > 2. a router somewhere in the path with a lower MTU requirement > 3. a software upgrade forcing the DF bit to be set (developer won't > change it) > > Lowering the MTU on the client end fixed the problem; > however, I need to > get the registry hack distributed across ~500 desktop and all > potentially have different interface descriptions in the > HKLM/system/current control set/service/ ...what a PITA. > > > -- The information contained in this e-mail message is intended only for the use of the person or entity to whom it is addressed and may contain information that is CONFIDENTIAL and may be exempt from disclosure under applicable laws. If you read this message and are not the addressee you are notified that use, dissemination, distribution, or reproduction of this message is prohibited. If you have received this message in error, please notify us immediately and delete the original message. You should scan this message and any attached files for viruses. Axon Computertime accepts no liability for any loss caused either directly or indirectly by a virus arising from the use of this message or any attached file. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Domainz falling prey to spambots?
by Simon Byrnand 28 Jul '02

28 Jul '02

Hi Everyone, I've just noticed a disturbing trend in the last few days. I've started receiving considerable spam to an address (which is actually just an alias) which we *only* use as the technical contact address when registering new domains with domainz. (I won't say what it is in this forum, least I make life easy for any spambots that havn't found it yet :) Email is *never* sent from this address, it is *not* on any of our web pages or used in way except to be listed as technical contact. (In case anyone just looked up our own domain, that is not the contact address in question, we've only been using it for registrations in the last couple of months) This poses the question - just how have the spambots got hold of it ? Maybe they got lucky, and guessed it, but I don't think so. That leaves the domainz website, and whois servers. For a spambot to be able to find contact details of a domain, it would have to know the domain existed in the first place, as to my knowledge domainz don't provide a "list" of domains they have in their registry for exactly this sort of reason. And yet only a few months ago there was the case of the disreputable Australian registry that somehow managed to get a list of a large number of .co.nz's and their contact details, presumably through some kind of automated queries. I'm curious if anyone else has received spam to an address they know for certain is only used as contact details on domains registered at domainz... Regards, Simon Byrnand iGRIN Internet - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Banking Problems and MTU
by Craig Whitmore 28 Jul '02

28 Jul '02

I was wondering what people think about this latest story.. http://www.idg.net.nz/webhome.nsf/UNID/4AA2988B4A1835C5CC256BFF0014A6A8!ope… (a more technical expanation from Cisco of the problem http://www.cisco.com/warp/public/105/56.html) I've noticed this problem for ages (for example the ASB's site) when viewing their pages via a GRE tunnel (or the inability to). Is blocking _all_ ICMP types the wrong thing to do? (in paticular type 3 (unreacable), subtype 4(needs fragmentation) for PMTU Discovery) and basiclly breaking their website for people who have paths who get fragmented TCP/IP Packets) Thanks Craig Whitmore

11 15

Are you lame? :)
by Rob Thomas 26 Jul '02

26 Jul '02

Hello, NZNOGers. [ Apologies to those of you who have already seen this post on NANOG. ] I recently came across a web site belonging to Justin McNutt that lists all of the lame delegations his name servers have detected. This is a great way to share some clue and keep track of errant domains. I have received his kind permission to mimic his efforts using data collected from three of my name servers. I will update this page weekly, and you will find it here: http://www.cymru.com/DNS/lame.html Justin's page is available here: https://dnps-linux2.telecom.missouri.edu/~mcnuttj/lame.html The DNS root name server statistics are still available, and have moved here: http://www.cymru.com/DNS/dns.html My thanks to the authors of the lamers.sh script, which I modified to suit my purposes. Comments and feedback are always welcome! Thanks, Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty); - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

OT but desperate!
by PhoneNet 24 Jul '02

24 Jul '02

I'vspent several hours today tryingt o find info on how to get past an old Compaq deskpro's setup password so I can alter the system setup for a friend - any one know if it can be done? I've tried disconnecting the CMOS jumper but despite it losing the config the sytem password stuff still comes up and I figure its a ssociated with the compaq's diagnostics partition some how .... Can't find anyhting on the internet and I'm so frustrated I'm going home! - something fo rthe night owls to ponder? Ian PhoneNet - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

ICMP message types
by Rob Thomas 24 Jul '02

24 Jul '02

Hi, all. I am opposed to blocking all ICMP, for many good reasons. I do limit the ICMP types and codes I allow, however, and have put together a list that might help others as well: http://www.cymru.com/Documents/icmp-messages.html Feedback is welcome and encouraged. Be the first in your ASN to make it to the Credits section. :) I hope this helps! Simon, thanks for the suggestion to post this link to the list. Thanks, Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty); - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Banking Problems and MTU
by Donald Neal 24 Jul '02

24 Jul '02

>From: Juha Saarinen [mailto:juha(a)saarinen.org] >Sent: Thursday, 25 July 2002 08:55 >To: Joe Abley >Subject: Re: Banking Problems and MTU [...] >> The worst thing you'd expect in a path throughput constriction from 8M >> to 128k is surely the loss of a window's worth of data. You'd expect to >> TCP to wind back to slow start, and you'd expect the in-flight pipeline >> to drain very rapidly. Performance would certainly be hit, but I don't >> think I would expect consistently stalled connections. >Dunno if it's relevant, but Jetstart is rate-limited at the RAN, which can >be anywhere in NZ (my one is in Glenfield, some 25-30km away, but used to >be in Wellington). >To and from the DSLAM, Jetstart users have a full RADSL connection (which >incidentally is also rate-limited, to 4Mbps down). >Would this sort of rate-limiting affect the problem? You should simply see a return to TCP slow start. TCP congestion control is not very sophisticated, but it does sort of work. And it works end to end. The cause of any packet loss in the middle isn't known to it. - Donald Neal ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ------------------------------------------------------------------------------ - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0