- NZNOG - lists.nznog.org

Re: FW: Walker Wireless attacking other ISPs?
by Steve Phillips 04 May '02

04 May '02

Sorry, this was supposed to hit the list Friday, but due to posting restrictions it never made it through :-) -- As the owner of this IP block, we were made aware of the issue, we requested that we be given until the end of the working day to obtain a response from the customer involved. We personally appreciate Gordon's restraint in agreeing not to post details on this until such time as the deadline was met or the formal response was obtained. Sadly, we did not manage to get a formal response to Gordon about this issue. The customer in question was null routed at the time, the block was removed pending comment from the customer but if this causes an issue for anyone else in the Internet community then please let us know and the null will be re-instated. Thanks, -- Steve. Systems Admin, ICONZ At 16:15 3/05/2002, Juha Saarinen wrote: >On 3 May 2002, Dean Pemberton wrote: > > > > > I REALLY hope that you made Walker Wireless aware of this before you > > posted it to the whole list. > >That would've spoilt the ensuing flame war though, wouldn't it? > >-- >Juha Saarinen > >- >To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz >where the body of your message reads: >unsubscribe nznog -- Steve Systems Admin, ICONZ - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

FW: Walker Wireless attacking other ISPs?
by Gordon Smith 02 May '02

02 May '02

Hi all, Has anyone else been seeing mail1.walkerwireless.com attempting to break in to their border routers? Picked this up on a routine log audit. Although we actively block and log this sort of activity, others may not be aware of it. Of particular concern is the attempted use of the ILMI exploit, detailed at http://www.kb.cert.org/vuls/id/976280 which has no legitimate reason to be seen. Attacking machine is running Checkpoint FW-1 mail server! Cheers, Gordon Smith CCNA Network Operations Manager MoreNet Ltd. Fingerprint: 4093 91BC 0055 46B9 1B1A EDBA 45AD 2381 7B1D E4BE Log extract (multiple occurrances of this): 04/23/2002 15:38.24 <WARN:SNMP> last message repeated 2 times 04/23/2002 15:38.14 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "ILMI" 04/23/2002 15:38.14 <WARN:SNMP> last message repeated 2 times 04/23/2002 15:38.02 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "DHdW7tr5nP" 04/23/2002 15:38.02 <WARN:SNMP> last message repeated 2 times 04/23/2002 15:37.52 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "P8nD8l1n7" 04/23/2002 15:37.52 <WARN:SNMP> last message repeated 2 times 04/23/2002 15:37.44 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "wd1h2dt2d" 04/23/2002 15:37.44 <WARN:SNMP> last message repeated 2 times 04/23/2002 15:37.34 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "private" 04/23/2002 15:37.34 <WARN:SNMP> last message repeated 2 times 04/23/2002 15:37.24 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "public" 04/23/2002 11:37.42 <WARN:SNMP> last message repeated 2 times 04/23/2002 11:37.32 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "ILMI" 04/23/2002 11:37.32 <WARN:SNMP> last message repeated 2 times 04/23/2002 11:37.18 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "DHdW7tr5nP" 04/23/2002 11:37.18 <WARN:SNMP> last message repeated 2 times 04/23/2002 11:37.10 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "P8nD8l1n7" - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

RE: Walker Wireless attacking other ISPs?
by Richard Watson 02 May '02

02 May '02

We have noticed this and have taken action to stop these SNMP polls from reaching other ISPs. The polling of addresses blocks managed by other ISPs was purely accidental and should not happen again. Walker Wireless is more than willing to investigate incidents like this directly. If anyone has concerns about unusual activity orginating from anywhere in the Walker Wireless network please contact our Network Operations Centre on 0800-WWCARE or myself directly. Thank you, Richard Watson Network Infrastructure Engineer WALKER WIRELESS LIMITED Tel: +64 (9) 522 3674 Fax: +64 (9) 520 3447 Mob: +6427 286 6681 Email: rwatson(a)walkerwireless.com 0800 NO NETLAG Get high speed wireless internet and private network connectivity with Walker Wireless. Visit www.walkerwireless.com for information. The information in this electronic mail and its attachments is legally privileged and confidential. If the reader of this electronic mail and attachments is not the intended recipient, you are hereby notified that any use, dissemination or reproduction of this electronic mail its contents and attachments is prohibited. This email is personal and may not reflect Walker Wireless', Walker Corporation's subsidiaries or affiliated companies' position. -----Original Message----- From: Gordon Smith [mailto:gordons(a)morenet.net.nz] Sent: Friday, 3 May 2002 4:09 p.m. To: Nznog Subject: FW: Walker Wireless attacking other ISPs? Hi all, Has anyone else been seeing mail1.walkerwireless.com attempting to break in to their border routers? Picked this up on a routine log audit. Although we actively block and log this sort of activity, others may not be aware of it. Of particular concern is the attempted use of the ILMI exploit, detailed at http://www.kb.cert.org/vuls/id/976280 which has no legitimate reason to be seen. Attacking machine is running Checkpoint FW-1 mail server! Cheers, Gordon Smith CCNA Network Operations Manager MoreNet Ltd. Fingerprint: 4093 91BC 0055 46B9 1B1A EDBA 45AD 2381 7B1D E4BE Log extract (multiple occurrances of this): 04/23/2002 15:38.24 <WARN:SNMP> last message repeated 2 times 04/23/2002 15:38.14 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "ILMI" 04/23/2002 15:38.14 <WARN:SNMP> last message repeated 2 times 04/23/2002 15:38.02 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "DHdW7tr5nP" 04/23/2002 15:38.02 <WARN:SNMP> last message repeated 2 times 04/23/2002 15:37.52 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "P8nD8l1n7" 04/23/2002 15:37.52 <WARN:SNMP> last message repeated 2 times 04/23/2002 15:37.44 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "wd1h2dt2d" 04/23/2002 15:37.44 <WARN:SNMP> last message repeated 2 times 04/23/2002 15:37.34 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "private" 04/23/2002 15:37.34 <WARN:SNMP> last message repeated 2 times 04/23/2002 15:37.24 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "public" 04/23/2002 11:37.42 <WARN:SNMP> last message repeated 2 times 04/23/2002 11:37.32 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "ILMI" 04/23/2002 11:37.32 <WARN:SNMP> last message repeated 2 times 04/23/2002 11:37.18 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "DHdW7tr5nP" 04/23/2002 11:37.18 <WARN:SNMP> last message repeated 2 times 04/23/2002 11:37.10 <WARN:SNMP> SNMP request received from 210.54.139.178 with unknown community "P8nD8l1n7" - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

The New Zealand Network Operators' Group
by Donald Neal 30 Apr '02

30 Apr '02

The New Zealand Network Operators' Group The New Zealand Network Operators' Group (NZNOG) has no king, president or formal membership. At present it consists of the subscribers to this mailing list, which anyone is free to join. This posting, or one like it, is sent to all subscribers each month, except those who work for the Ministry for Economic Development. NZNOG 2002 Work is now under way towards a conference and social gathering to be held in Auckland on 11 and 12 July 2002. Abstracts are sought _this week_ from prospective speakers, with the aim that a draft programme will appear not later than 8 May. If you wish to add your name as a possible presenter, please email nznog2002(a)deanpemberton.com without delay. If you wish to act a sponsor and have not already discussed this either with me or the Convenor, please contact me at this email address. My thanks to 2Day Internet Ltd, Cisco and Juniper. Operators' Contact List See http://www.usenet.net.nz/noc/ for operational contact details for most New Zealand ISP's. These are intended for use by other network operators rather than by most customers. Auckland Peering Exchange See http://www.ape.net.nz/ for details of the Auckland Peering Exchange and those connected there. About This Mailing List This list has around 320 subscribers, a number which isn't changing much at present. You may only post to the list from an address subscribed to one of the lists described below. (There's nowadays more spam bounced than non-member postings.) The NZNOG mailing list is provided through a server at The University of Waikato, and is administered by an employee of Telecom NZ Ltd. Neither of these organisations, nor the administrator, is responsible for its content. NZNOG Mailing List Acceptable Use Policy The NZNOG mailing list exists to provide a forum for the exchange of technical information and the discussion of implementation issues that require cooperation among New Zealand network service providers. In order to continue to provide a useful forum for discussion of relevant technical issues, users of the list are asked to respect the following guidelines. 1. Discussion will focus on Internet operational and technical issues. 2. Discussion related to meetings of network service providers is appropriate. 3. Discussion unrelated to these topics is not appropriate. 4. Postings to multiple mailing lists are discouraged. 5. Postings that include foul language, character assassination, and lack of respect for other participants are unacceptable. 6. Blatant product or service marketing is unacceptable. 7. Postings of a political, philosophical or legal nature are discouraged. 8. Postings to the list should be in ASCII or MIME encoded as text/plain. Attachments should not be sent to the list. To present a document, a suitable URL may be referred to. For documents of general interest, the use of proprietary file formats is discouraged. 9. Breaches of list etiquette should be dealt with privately with the offending list user, and should not result in complaints being sent to the list. 10. A person repeatedly breaching list etiquette shall receive warnings from the list administrator. A further breach after the second such warning within thirty days shall result in the offender being unsubscribed from the list. Other action may also be taken to block postings to the list by the offender. Any such unsubscription is to be immediately announced to the list. Mailing List Archives A full archive is available at http://list.waikato.ac.nz/archives/nznog/ Any message sent to the list will be archived and made available on the web automatically. Changes are not made to the archive on request, though the administrator remains happy to assist the Office of the Privacy Commissioner should any complaint be laid with that office. Subscribing to the List To subscribe to the NZNOG list, send email to majordomo(a)list.waikato.ac.nz, where the body of the message reads subscribe nznog Digest Mailing List If you don't wish to receive postings as they are sent, you can instead subscribe to the nznog-digest mailiing list, on which all postings are sent out in a single "digest" every couple of days. Post-only Mailing List An address from which you wish to post, but which will not receive messages from the list, may be subscribed to nznog-postonly. You will presumably want to have another address subscribed to the main nznog list. Donald Neal NZNOG Mailing List Owner/Administrator/Muggins This email message is a public document. I don't speak for Telecom and they don't speak for me. ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ============================================================================== - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: dyndns
by Darrin Cooke 28 Apr '02

28 Apr '02

-----Original Message----- From: Juha Saarinen [mailto:juha(a)saarinen.org] Sent: Monday, 29 April 2002 1:49 p.m. >On Mon, 29 Apr 2002, Jean-Francois Pirus wrote: >> >> Is there any publicly (& free) accessible dyndns server in NZ? >> (Ignoring dyndns.co.nz) >> >> I'd like to use a local one, and was thinking of setting one up, but >> there no point in reinventing the wheel. > http://www.comtek.co.nz/dyndns/ > Not free though. No, not free, but cheap enough to warrant looking at and the support seems to make it definatly worthwhile. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

dyndns
by Jean-Francois Pirus 28 Apr '02

28 Apr '02

Is there any publicly (& free) accessible dyndns server in NZ? (Ignoring dyndns.co.nz) I'd like to use a local one, and was thinking of setting one up, but there no point in reinventing the wheel. jfp. ------------------------------------------------------------------------ Jean-Francois Pirus <jfp(a)clearfield.com> Clearfield Software Ltd Phone (+64-9) 358 2081 4th Floor 8-10 Whitaker Place Fax (+64-9) 358 2083 P O Box 2348 Auckland, New Zealand ------------------------------------------------------------------------ - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Re: What's the xtra contact for spam (aka: abuse@xtra)
by Mark Foster 28 Apr '02

28 Apr '02

No.. but I would like people to lose the sarcasm when its unnecessary :) At 12:24 29/04/02 +1200, Matt Camp wrote: >On Mon, 29 Apr 2002, Mark Foster wrote: > > > (I got my Ihug account when I was 16 and barely knew what TCP/IP was. I > got > > my first DoS-incurred BSOD 6 days after I upgraded my DX40 from Win > 3.11 to > > Win95B - Thats a steep learning curve for someone who is NOT a natural > > talent. You gotta learn somehow, dont you?) > >Would you like a prize? > >Maybe a gold star sticker? - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: What's the xtra contact for spam (aka: abuse@xtra)
by Mark Foster 28 Apr '02

28 Apr '02

Yup.. didnt help that Ihugs New Fandangled Transparent Proxies just 'suddenly' started ICMPing the crap out of me.. I seem to recall failing to get a straight answer out of Ihug Abuse untill id sent in at least 3 or 4 seperate (and loud) complaints. Ive run the abuse box for a couple of ISPs now Glen - so yes, ive learnt a bit since I stopped using Ihug for my internet access - but one thing I have learnt is not to ignore customers. A couple of decent, polite responses (which may or may not include things like "This is outside of our control, please do not report further abuse of this nature to us") work a lot well than a stoney silence, which used to originate from Ihug Abuse far too often. If you educate your customers theyre less likely to come back to you with the same issues. Ihug Abuse has improved somewhat over the last year or two, fortunately. :) Not bad, especially considering staff turnover. Mark. (I got my Ihug account when I was 16 and barely knew what TCP/IP was. I got my first DoS-incurred BSOD 6 days after I upgraded my DX40 from Win 3.11 to Win95B - Thats a steep learning curve for someone who is NOT a natural talent. You gotta learn somehow, dont you?) At 11:12 29/04/02 +1200, Glen Wilson wrote: >Most likely they closed it because of the amount of BlackIce logs people >thought were "hacking" attempts. > >I remember when I looked after an abuse mailbox and atleast 4 a week would >come from you Mark. > >Glen Wilson >Senior Engineer and Administrator >Network Operations Shift Supervisor >Ihug, Auckland, New Zealand > >On Mon, 29 Apr 2002, Mark Foster wrote: > > > Thatd be unusual - My comms with them has always been that they have to > > wait for the log files to get parsed, which means the most recent entry is > > at least half a day old... > > > > Since when is admins@ a standard for abuse complaints anyway? :P > > > > abuse(a)xtra.co.nz would be the most appropriate address to use. (Im glad > > they reactivated it, whos bright idea was it to close that box?) > > > > > > At 10:43 29/04/02 +1200, Simon Lyall wrote: > > >On Mon, 29 Apr 2002, Jean-Francois Pirus wrote: > > > > What's the current xtra contact for spam (aka: abuse(a)xtra) > > > > > > > > admins(a)team.xtra.co.nz just bounces. > > > > > >abuse(a)xtra.co.nz works okay. > > > > > >I just sent them a complaint regarding a customer of theirs spamming and > > >they replied back to be saying the customer had been delt with within > > >about 30 minutes. > > > > > > > > >-- > > >Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz > > >Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz > > >ihug, Auckland, NZ | Asst Doorman | Web: > http://www.darkmere.gen.nz > > > > > >- > > >To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > > >where the body of your message reads: > > >unsubscribe nznog > > > > - > > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > > where the body of your message reads: > > unsubscribe nznog > > - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

What's the xtra contact for spam (aka: abuse@xtra)
by Jean-Francois Pirus 28 Apr '02

28 Apr '02

What's the current xtra contact for spam (aka: abuse(a)xtra) admins(a)team.xtra.co.nz just bounces. Thanks. jfp. ------------------------------------------------------------------------ Jean-Francois Pirus <jfp(a)clearfield.com> Clearfield Software Ltd Phone (+64-9) 358 2081 4th Floor 8-10 Whitaker Place Fax (+64-9) 358 2083 P O Box 2348 Auckland, New Zealand ------------------------------------------------------------------------ - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 5

Re: What's the xtra contact for spam (aka: abuse@xtra)
by Mark Foster 28 Apr '02

28 Apr '02

Thatd be unusual - My comms with them has always been that they have to wait for the log files to get parsed, which means the most recent entry is at least half a day old... Since when is admins@ a standard for abuse complaints anyway? :P abuse(a)xtra.co.nz would be the most appropriate address to use. (Im glad they reactivated it, whos bright idea was it to close that box?) At 10:43 29/04/02 +1200, Simon Lyall wrote: >On Mon, 29 Apr 2002, Jean-Francois Pirus wrote: > > What's the current xtra contact for spam (aka: abuse(a)xtra) > > > > admins(a)team.xtra.co.nz just bounces. > >abuse(a)xtra.co.nz works okay. > >I just sent them a complaint regarding a customer of theirs spamming and >they replied back to be saying the customer had been delt with within >about 30 minutes. > > >-- >Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz >Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz >ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz > >- >To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz >where the body of your message reads: >unsubscribe nznog - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0