- NZNOG - lists.nznog.org

Anybody heard of these guys ?
by Simon Byrnand 03 Jul '02

03 Jul '02

Just to change the topic momentarily away from conference registrations etc to more technical matters.... :-) A while back I remember a bit of discussion about a "personal firewall" program that automatically sent out abuse(a)domain emails whenever it detected "intrusion attempts" that was really starting to get up the nose of system admins everywhere.... Yesterday I got a strong sense of Deja Vu when I received the following email to abuse@ (details xxx'ed to protect the innocent :) -------------------8<--------------------- Complaint ID: [securepipe.com #xxxxxx] The following is a complaint against an IP or domain which appeared in our logs, indicating possible network abuse. If you have received this report in error, please forward it to the appropriate party or let us know. A user, apparently from your network, probed port 139 (NETBIOS) on the IP appearing in the log except below. The port in question is commonly used for Windows networking, and thus the probe may represent a misconfigured client or an active attempt to gain unauthorized access to the target. All timestamps below are in UTC -0000 (Greenwich Mean Time) Jul 3 03:14:56 ca-gw kernel: Packet log: inpETH2 DENY eth2 PROTO=6 x.x.x.x:1026 x.x.x.x:139 L=48 S=0x00 I=64034 F=0x4000 T=103 SYN (#25) Jul 3 03:14:59 ca-gw kernel: Packet log: inpETH2 DENY eth2 PROTO=6 x.x.x.x:1026 x.x.x.x:139 L=48 S=0x00 I=547 F=0x4000 T=103 SYN (#25) Jul 3 03:15:05 ca-gw kernel: Packet log: inpETH2 DENY eth2 PROTO=6 x.x.x.x:1026 x.x.x.x:139 L=48 S=0x00 I=4643 F=0x4000 T=103 SYN (#25) Jul 3 03:15:17 ca-gw kernel: Packet log: inpETH2 DENY eth2 PROTO=6 x.x.x.x:1026 x.x.x.x:139 L=48 S=0x00 I=11811 F=0x4000 T=103 SYN (#25) We appreciate your assistance in resolving this matter. -- SecurePipe Incident Response Team Tel: +1 608 294 6940 Fax: +1 608 294 6950 (attn: IRT) incident.response(a)securepipe.com -------------------8<--------------------- Now I don't know about anyone else, but this email looks like an automatically generated report if I ever saw one...although this time comming from a linux firewall log. The question is should I be taking this seriously, or ignoring it. The fact that the "complaint" had an ID number suggested they may have a system like spamcop where you can quickly log in and address the issue on their website. Unless I'm blind, they don't have anything like that on their site, only lots of promotional material for their companys products/services. (Does that make this email effectively unsolicited advertising ? :) Then there is the question of severity - I'd be interested to know where most sysadmins draw the line between accidental and harmless connections and outright mallicious activity. IMHO a single connection attempt to port 139 doesn't fall into the category of mallicious, and could indeed be totally accidental. I can think of a number of actions in windows that will inadvertently cause it to try to make a netbios connection to a remote host - sometimes you have to go out of your way to STOP the stupid thing from doing that...(netbios hostname resolution anyone?) I'm definately not trying to downplay the importance of security, but I can see a lot of nuisance value if we get to the point where any connection to a non-desired port is automatically considered mallicious, and every man and his dog has their firewall automatically firing off emails every time somebody tries to connect to them on a port they weren't expecting connections on... Anyway, I'd be interested in hearing from anyone else who has dealt with "securepipe.com", or just peoples opinions on the matter of automated firewall abuse emailing in general... Regards, Simon Byrnand iGRIN Internet - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 4

Beer!!!!!!
by Dean Pemberton 03 Jul '02

03 Jul '02

In the spirit of Networking and Beer (Yep it's in the AUP), I'd just like to invite anyone who is in Wellington on Thursday along to Curry. A few of the networking people around town have been doing Thursday night curries for a few weeks now (ever since I flew in, maybe a bit before) and it's become a bit of a thing. If anyone wants to join us for Curry/Chat/Beer on Thursday, then get yourself to ThursdayNightCurry.com, check out the rules etc and we'll see you there. Dean - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

10 18

RE: Uniforum registration
by Tim John 03 Jul '02

03 Jul '02

I actually went ahead and enrolled my colleague yesterday anyway, but was happily surprised that for the three days, the total was only $628. Much appreciated ! C U there ... Tim -----Original Message----- From: martin(a)kurahaupo.gen.nz [mailto:martin(a)kurahaupo.gen.nz] Sent: Thursday, 4 July 2002 5:32 a.m. To: tim.john(a)domainz.net.nz Cc: nznog(a)list.waikato.ac.nz Subject: Re: Uniforum registration I've fixed the problem with the descriptive text (some days ago now, but I thought I'd better let people know). We've also had a re-think about the pricing, and have decided to continue a discounted rate for a while: Until midnight Monday the rate is $399 for two days and $157 for each addition day, including lunch but not dinner or accommodation. A few people booked at the "full" rates earlier this week; you're welcome to re-book at the reduced rate -- but use the same booking reference number or we'll wind up charging you for both! -Martin On Mon, 1 Jul 2002, Donald Neal wrote: > The rates now being advertised on the web site are not early bird > rates. Those ceased to be available once the first fifty registrations > were in. I believe work to be under way at present to fix the text on > the web site. Tim John" <tim.john(a)domainz.net.nz, on 07/01/02 11:20 wrote: > I'm trying to register a friend for the Uniforum next week and, > according to the website, there are still 'earlybird' places left, but > to register for three days cost's nearly $1,000. > > I registered a few weeks back and it came to a third of that. Was that > at a 'really, really, really earlybird discount' ? -- "War against Terror" is an oxymoron - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Uniforum registration
by Donald Neal 03 Jul '02

03 Jul '02

Tim, The rates now being advertised on the web site are not early bird rates. Those ceased to be available once the first fifty registrations were in. I believe work to be under way at present to fix the text on the web site. - Donald Neal -- Donald Neal Special Operations Network Delivery Telecom New Zealand Ltd >>> "Tim John" <tim.john(a)domainz.net.nz> 07/01/02 11:20 >>> I'm trying to register a friend for the Uniforum next week and, according to the website, there are still 'earlybird' places left, but to register for three days cost's nearly $1,000. I registered a few weeks back and it came to a third of that. Was that at a 'really, really, really earlybird discount' ? Tim - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ------------------------------------------------------------------------------ - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Re: Maxnet
by Juha Saarinen 02 Jul '02

02 Jul '02

On Wed, 3 Jul 2002, Geoff wrote: > Hi Juha, > > Abuse and postmaster(a)maxnet should work.. I see... they do work, at maxnet.co.nz, but not maxnet.net.nz. Oh well. :-) > however if you gimme the details I'll suss it out for you. Cheers, will do. -- Juha Saarinen - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Maxnet
by Juha Saarinen 02 Jul '02

02 Jul '02

Could someone from there contact me with an admin address that I could use? One of Maxnet's customers has come down with W32/Yaha.E. Furthermore, it'd be cool if Maxnet could add a couple of aliases, such as: hostmaster postmaster abuse -- Regards, Juha C program run. C program crash. C programmer quit. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

The New Zealand Network Operators' Group
by Donald Neal 01 Jul '02

01 Jul '02

The New Zealand Network Operators' Group The New Zealand Network Operators' Group (NZNOG) has no king, president or formal membership. At present it consists of the subscribers to this mailing list, which anyone is free to join. This posting, or one like it, is sent to all subscribers each month. NZNOG 2002 HURRY! HURRY! MAKE REGISTRATION FAST! Sorry, got a bit carried away there. A strong NZNOG programme makes up much of the content of the UniForum NZ conference to be held next week at the Auckland Airport Centre hotel. You can read the full programme and register at http://www.uniforum.org.nz/ . Yes, you could read the programme there and not register, but surely you wouldn't. Overseas speakers appear thanks to Cisco, Ericsson, Juniper and The University of Waikato. Operators' Contact List See http://www.usenet.net.nz/noc/ for operational contact details for most New Zealand ISP's. These are intended for use by other network operators rather than by most customers. Auckland Peering Exchange See http://www.ape.net.nz/ for details of the Auckland Peering Exchange and those connected there. About This Mailing List This list has around 340 subscribers, a number currently more or less static. You may only post to the list from an address subscribed to one of the lists described below. The NZNOG mailing list is provided through a server at The University of Waikato, and is administered by an employee of Telecom NZ Ltd. Neither of these organisations, nor the administrator, is responsible for its content. NZNOG Mailing List Acceptable Use Policy The NZNOG mailing list exists to provide a forum for the exchange of technical information and the discussion of implementation issues that require cooperation among New Zealand network service providers. In order to continue to provide a useful forum for discussion of relevant technical issues, users of the list are asked to respect the following guidelines. 1. Discussion will focus on Internet operational and technical issues. 2. Discussion related to meetings of network service providers is appropriate. 3. Discussion unrelated to these topics is not appropriate. 4. Postings to multiple mailing lists are discouraged. 5. Postings that include foul language, character assassination, and lack of respect for other participants are unacceptable. 6. Blatant product or service marketing is unacceptable. 7. Postings of a political, philosophical or legal nature are discouraged. 8. Postings to the list should be in ASCII or MIME encoded as text/plain. Attachments should not be sent to the list. To present a document, a suitable URL may be referred to. For documents of general interest, the use of proprietary file formats is discouraged. 9. Breaches of list etiquette should be dealt with privately with the offending list user, and should not result in complaints being sent to the list. 10. A person repeatedly breaching list etiquette shall receive warnings from the list administrator. A further breach after the second such warning within thirty days shall result in the offender being unsubscribed from the list. Other action may also be taken to block postings to the list by the offender. Any such unsubscription is to be immediately announced to the list. Mailing List Archives A full archive is available at http://list.waikato.ac.nz/archives/nznog/ Any message sent to the list will be archived and made available on the web automatically. Changes are not made to the archive on request, though the administrator remains happy to assist the Office of the Privacy Commissioner should any complaint be laid with that office. Subscribing to the List To subscribe to the NZNOG list, send email to majordomo(a)list.waikato.ac.nz, where the body of the message reads subscribe nznog Digest Mailing List If you don't wish to receive postings as they are sent, you can instead subscribe to the nznog-digest mailiing list, on which all postings are sent out in a single "digest" every couple of days. Post-only Mailing List An address from which you wish to post, but which will not receive messages from the list, may be subscribed to nznog-postonly. You will presumably want to have another address subscribed to the main nznog list. Donald Neal NZNOG Mailing List Owner/Administrator/Muggins ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ------------------------------------------------------------------------------ - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

OT: Wanted: Data Projectors for Uniforum
by Mark Foster 01 Jul '02

01 Jul '02

Hi folks, apologies for the offtopic nature of this post. We're in need of a couple of Datashow units for the Uniforum conference this year. The rates ive obtained for rental units so far arent particularly brilliant - ive managed to get one, we ideally would like to have three for the entire period Thursday-Sunday.. If anyone on this list is in a position to assist, im authorised to use a free conference registration as a bargaining chip :) Thats around $400 value for the four days worth. Note that two days are a weekend also. :) If anyone has a unit they could possibly loan us for the duration of the conference, please contact me directly either via email (offlist) or call me directly on 021 499 368. Auckland area preferred, and im happy make any other delivery arrangements. Thanks, Mark Foster Uniforum 2002 Conference Committee - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Uniforum registration
by Tim John 30 Jun '02

30 Jun '02

I'm trying to register a friend for the Uniforum next week and, according to the website, there are still 'earlybird' places left, but to register for three days cost's nearly $1,000. I registered a few weeks back and it came to a third of that. Was that at a 'really, really, really earlybird discount' ? Tim - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: CUG
by robbie_gernandt＠wilsonandhorton.co.nz 30 Jun '02

30 Jun '02

Yip, I'm in We would definitely qualify as a "multi-vendor" customer, but I would be keen to join in any case. regards Robbie Gernandt Network Consultant Wilson & Horton Ltd CCNA, NNCSS *************************************************************************** This may contain privileged and confidential information intended only for the use of the intended recipient. If you are not the intended recipient of this message, any use, dissemination, distribution or reproduction of this message is prohibited. Any views expressed in this message are those of the individual sender and may not necessarily reflect the views of Wilson & Horton Limited. For more information on Wilson & Horton please visit our web site at http://www.wilsonandhorton.co.nz ***************************************************************************

1 0