- NZNOG - lists.nznog.org

Re: UPDATE: Xtra broken?
by Phill Groom 21 Aug '01

21 Aug '01

Sort of related to this thread; http://michael.toren.net/code/tcptraceroute/ Quite cool! Phill. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: XTRA network having problems?
by Ben Martel 21 Aug '01

21 Aug '01

Hey, > The original poster was questioning whether the site was up, > since it was > unreachable with ICMP. > By blocking all ICMP, such things as MTU path discovery are > also broken - > just like Hotmail. The original poster is aware of how blocking ICMP breaks things. In fact I am the indirect recipient of a 'display time on the wall alarm clock' for people who cant turn their heads at night (due to drunkeness generally), on the basis of fixing some American site that was broken because of it. I was actually trying to query (obviously not successfully - well Joe got it!) why the routing to one of the resolved addresses for www.nbnz.co.nz is being dropped by Xtra on their border router @ APE. Secondly why the hell the traffic should go through Australia to get their in the first place. TIA ~benm --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

XTRA network having problems?
by Ben Martel 21 Aug '01

21 Aug '01

Hey all, Anybody noticed if XTRA is having problems??? ~benm noc% traceroute www.nbnz.co.nz traceroute to www.nbnz.co.nz (210.55.168.70), 30 hops max, 40 byte packets 1 cs-red-vrrp.auckland.clix.net.nz (203.167.224.53) 0.681 ms 0.605 ms 0.620 ms 2 cs2-e4-4-acld.auckland.clix.net.nz (203.167.224.55) 1.295 ms 0.618 ms 0.616 ms 3 ba2-fe0-1-0-acld.auckland.clix.net.nz (203.97.9.177) 1.695 ms 1.342 ms 0.994 ms 4 xtra.ape.net.nz (192.203.154.60) 2.068 ms 3.037 ms 2.400 ms 5 202-37-237-229.dds.xtra.co.nz (202.37.237.229) 11.157 ms 14.180 ms 12.818 ms ^C noc% traceroute www.nbnz.co.nz traceroute to www.nbnz.co.nz (202.49.143.70), 30 hops max, 40 byte packets 1 cs-red-vrrp.auckland.clix.net.nz (203.167.224.53) 1.027 ms 0.643 ms 0.591 ms 2 core1-fe6-1-0-acld.auckland.clix.net.nz (203.97.2.241) 0.828 ms 0.832 ms 0.748 ms 3 b1-atm2-0-1-wcms.sydney.clix.net.nz (203.97.83.222) 24.861 ms 24.981 ms 24.879 ms 4 500.Serial0-1-1.GW2.SYD2.ALTER.NET (203.166.90.77) 25.304 ms 25.446 ms 25.532 ms 5 422.at-6-0-0.XR1.SYD2.Alter.Net (210.80.3.93) 25.821 ms 26.227 ms 26.369 ms 6 0.SO-5-0-0.XR1.SYD4.ALTER.NET (210.80.33.222) 26.798 ms 26.203 ms 26.783 ms 7 0.SO-0-0-1.XR2.SYD3.ALTER.NET (210.80.33.10) 26.120 ms 26.265 ms 26.196 ms 8 412.ATM8-0-0.GW1.SYD3.Alter.Net (210.80.3.158) 26.766 ms 27.052 ms 27.655 ms 9 500.ATM1-0.BORDER3.SYD.OZEMAIL.NET.AU (203.166.16.38) 29.680 ms 28.339 ms 27.345 ms 10 border1-fe0-0.syd.ozemail.net.au (203.108.190.150) 29.397 ms 27.699 ms 28.171 ms 11 203.108.1.237 (203.108.1.237) 125.545 ms 44.672 ms 47.893 ms 12 atm0-1-0-2.bdr1.hay.connect.com.au (210.8.219.234) 32.714 ms 41.311 ms 50.258 ms 13 f4-0-0-2.sybr1.netgate.net.nz (202.50.116.113) 59.829 ms 36.707 ms 35.536 ms 14 * * * 15 * * * 16 * * * 17 * * * 18 * * * 19 * * * 20 * * * 21 * * * 22 * * * 23 * * * 24 * * * 25 * * * 26 * * * 27 * * * 28 * * * 29 * * * 30 * * * noc% traceroute www.nbnz.co.nz traceroute to www.nbnz.co.nz (202.49.143.70), 30 hops max, 40 byte packets 1 cs-red-vrrp.auckland.clix.net.nz (203.167.224.53) 0.804 ms 0.591 ms 0.574 ms 2 core1-fe6-1-0-acld.auckland.clix.net.nz (203.97.2.241) 0.868 ms 1.181 ms 0.835 ms 3 b1-atm2-0-1-wcms.sydney.clix.net.nz (203.97.83.222) 26.398 ms 24.848 ms 25.311 ms 4 500.Serial0-1-1.GW2.SYD2.ALTER.NET (203.166.90.77) 25.351 ms 25.321 ms 25.193 ms 5 422.at-6-0-0.XR1.SYD2.Alter.Net (210.80.3.93) 26.074 ms 25.617 ms 25.889 ms 6 0.SO-5-0-0.XR1.SYD4.ALTER.NET (210.80.33.222) 26.125 ms 26.219 ms 26.750 ms 7 0.SO-0-0-1.XR2.SYD3.ALTER.NET (210.80.33.10) 26.163 ms 26.097 ms 26.047 ms 8 412.ATM8-0-0.GW1.SYD3.Alter.Net (210.80.3.158) 27.231 ms 27.047 ms 27.093 ms 9 500.ATM1-0.BORDER3.SYD.OZEMAIL.NET.AU (203.166.16.38) 27.965 ms 27.783 ms 28.140 ms 10 border1-fe0-0.syd.ozemail.net.au (203.108.190.150) 28.064 ms 28.494 ms 28.159 ms 11 203.108.1.237 (203.108.1.237) 38.559 ms 29.714 ms 35.737 ms 12 atm0-1-0-2.bdr1.hay.connect.com.au (210.8.219.234) 36.318 ms 34.299 ms 32.086 ms 13 f4-0-0-2.sybr1.netgate.net.nz (202.50.116.113) 32.040 ms 31.104 ms 30.982 ms 14 * * * 15 * *^C noc% traceroute www.nbnz.co.nz traceroute to www.nbnz.co.nz (210.55.168.70), 30 hops max, 40 byte packets 1 cs-red-vrrp.auckland.clix.net.nz (203.167.224.53) 0.663 ms 0.619 ms 0.612 ms 2 cs2-e4-4-acld.auckland.clix.net.nz (203.167.224.55) 0.698 ms 0.654 ms 1.278 ms 3 ba2-fe0-1-0-acld.auckland.clix.net.nz (203.97.9.177) 0.899 ms 1.329 ms 0.946 ms 4 xtra.ape.net.nz (192.203.154.60) 1.588 ms 3.299 ms 2.391 ms 5 203.96.111.218 (203.96.111.218) 11.624 ms 11.308 ms 11.742 ms 6 * 202-37-237-133.dds.xtra.co.nz (202.37.237.133) 87.635 ms 106.486 ms ^C noc% traceroute www.nbnz.co.nz traceroute to www.nbnz.co.nz (210.55.168.70), 30 hops max, 40 byte packets 1 cs-red-vrrp.auckland.clix.net.nz (203.167.224.53) 0.678 ms 0.607 ms 0.834 ms 2 cs2-e4-4-acld.auckland.clix.net.nz (203.167.224.55) 0.776 ms 0.646 ms 0.613 ms 3 ba2-fe0-1-0-acld.auckland.clix.net.nz (203.97.9.177) 0.855 ms 1.131 ms 0.718 ms 4 xtra.ape.net.nz (192.203.154.60) 3.019 ms 2.365 ms 1.725 ms 5 203.96.111.218 (203.96.111.218) 42.603 ms 41.431 ms 47.360 ms 6 203.96.111.217 (203.96.111.217) 60.746 ms 66.191 ms 78.594 ms 7 203.96.111.218 (203.96.111.218) 154.869 ms 159.711 ms * ^C noc% traceroute www.nbnz.co.nz traceroute to www.nbnz.co.nz (210.55.168.70), 30 hops max, 40 byte packets 1 cs-red-vrrp.auckland.clix.net.nz (203.167.224.53) 0.672 ms 0.634 ms 1.264 ms 2 cs2-e4-4-acld.auckland.clix.net.nz (203.167.224.55) 0.895 ms 0.643 ms 0.652 ms 3 ba2-fe0-1-0-acld.auckland.clix.net.nz (203.97.9.177) 1.304 ms 1.809 ms 1.085 ms 4 xtra.ape.net.nz (192.203.154.60) 2.856 ms 2.155 ms 1.760 ms 5 202-37-237-229.dds.xtra.co.nz (202.37.237.229) 70.480 ms 57.187 ms 36.798 ms 6 *^C noc% ~ben =~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~ Ben Martel Ph: +64 9 9124067 CLEAR Net Development Fax:+64 9 9125008 Mob:+64 21 541202 =~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~ --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

6 12

CLEAR Net Tempest
by Neil 16 Aug '01

16 Aug '01

Hi All, Has anyone else had any problems with Clear's 802.11 wireless internet service (http://www.clear.net.nz/services/tempest.html) as a source of interference? They have just done a rollout in Rotorua and totally stoped 3 separate wireless networks that had been running together nicely for the past year or two. Clear have told me that Rotorua is the only place that this has happened in and are being very slow to do anything about it so if this has happened to you could you let me know. Neil Fincham Integral LTD.

11 13

Cisco pages about code Red.
by Roger De Salis 16 Aug '01

16 Aug '01

Apologies if you have seen this multiple times. It is a little more complete than previous posted items. - R Cisco Technical Assistance Center News Flash - August 16, 2001 http://www.cisco.com/tac -------------------------------------------- "Code Red" Worm Update ____________________________________________ Dear Cisco Customer, For the most up-to-date information on the "Code Red" worm, visit the Cisco TAC Web Site "'Code Red' Technical Tips" page. Be sure to check this page for new and updated documents. The "'Code Red' Technical Tips" page can be reached at: http://www.cisco.com/tac/newsflash/codered_tt_08162001.html ISSUES REGARDING THE "CODE RED" WORM There are three main issues to deal with regarding the "Code Red" worm: 1. The worm infects and replicates through a vulnerability in the Microsoft Internet Information Server (IIS). This creates an infection exposure for Cisco products that embed or run on IIS. This exposure can be dealt with by applying Microsoft patches to the IIS servers. These patches are available at: http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security… 2. The earlier versions of the worm launched Denial of Service (DoS) attacks from the infected servers targeted at the White House Web Site. These DoS attacks can create high volumes of Internet-bound traffic. 3. The most recent variant of the worm creates high volumes of traffic on local networks, which may disrupt general network performance. The majority of the calls the Cisco TAC is receiving from customers are not due to Cisco products being infected by the worm; rather, many customers are experiencing the indirect impact that is caused by the messaging storms that occur because infected IIS servers are generating large amounts of network traffic while attempting to infect other IIS servers. This network traffic may cause networking equipment to become overloaded, which results in slow response, reloads, and other types of network equipment failures. Workarounds for the affected equipment, where applicable, are available at the "Cisco Security Advisory: 'Code Red' Worm" page, which can be found at: http://www.cisco.com/tac/newsflash/codered_secadvisory_08162001.html UNDERSTANDING THE "CODE RED" WORM A malicious self-replicating program known as the "Code Red" worm is targeted at systems running the Microsoft IIS. Several Cisco products are installed or provided on targeted systems. Additionally, the behavior of the worm can cause problems for other network devices. The following Cisco products are vulnerable to infection because they run affected versions of Microsoft IIS: * Cisco CallManager * Cisco Unity Server * Cisco uOne * Cisco ICS 7750 * Cisco Building Broadband Service Manager * Cisco IP/VC 3540 Application Server Other Cisco products may also be adversely affected by the "Code Red" worm. Please read "Cisco Security Advisory: 'Code Red' Worm" for further details. This advisory can be accessed at: http://www.cisco.com/tac/newsflash/codered_secadvisory_08162001.html All updates and workarounds are available under the "Featured Links" section of the Cisco TAC Web Home Page, which can be reached at: http://www.cisco.com/tac/newsflash/featured_links_08162001.html To access the documents directly, go to the "'Code Red' Technical Tips" page. This page can be reached at: http://www.cisco.com/tac/newsflash/codered_tt_08162001.html You can prevent the infection of servers and stop the spread of the worm by applying a Microsoft patch to vulnerable servers. This patch is available at: http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security… Once infected, a system may require additional repair due to the damage caused by the worm. This is also documented on the Microsoft Web Site at: http://www.microsoft.com/technet/treeview/default.asp?url=/technet/itsoluti… ADDITIONAL RESOURCES The Cisco TAC Web Site "'Code Red' Technical Tips" page includes new and updated documents with details about how the worm virus impacts Cisco networks, and what you can do to protect your network. These additional resources include: * "Cisco Security Advisory: 'Code Red' Worm - Customer Impact" * "The Network-Based Application Recognition and Access Control Lists for Blocking the 'Code Red' Worm at Network Ingress Points" * "Dealing with 'mallocfail' and High CPU Utilization Resulting From the 'Code Red' Worm" * "How to Filter 'Code Red' on Cisco Cache and Content Engines" CISCO PRODUCT SECURITY INCIDENT PROCEDURES Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, registering to receive security information from Cisco, and handling press inquiries regarding Cisco security notices is available at: http://www.cisco.com/tac/newsflash/prod_security_08162001.html Sincerely, Cisco TAC -- \_ Roger De Salis rdesalis(a)cisco.com </' Cisco Systems NZ Ltd +64 25 481 452 /) L8, ASB Tower, 2 Hunter St +64 4 496 9003 (/ Wellington, New Zealand roger(a)desalis.gen.nz ` By 2003, every home should have a Terabyte file server, a 10Mbps Internet Connection, a decent firewall and no M$ taxes. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Auckland Wireless Cards
by J S Russell 14 Aug '01

14 Aug '01

Short notice, but: Does anyone on this list in Auckland have any late-model hermes based PCMCIA wireless networking cards, which I would borrow for a few hours today, and come and pick up fairly immediately. CBD location preferred. JSR -- John S Russell | Operations Manager | "Evil, much like good, is it's own reward." Attica/Callplus NZ | --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

early daylight saving
by Joe Abley 14 Aug '01

14 Aug '01

If daylight saving is brought forward this year, I guess we'd need a new 2001-only rule in the unix timezone database. The copy I have in my OpenBSD source tree says updates should get sent to tz(a)elsie.nci.nih.gov. Is there some standard government protocol for notifying changes in daylight-saving time to other relevant agencies, like IATA? Just interested :) Joe http://www.nzherald.co.nz/storydisplay.cfm?storyID=207726&thesection=news&t… Daylight saving idea to beat cuts 15.08.2001 By VERNON SMALL deputy political reporter An early start to daylight saving is possible if the electricity crisis deepens. The radical idea, coming as energy savings fall below the required 10 per cent, could cut power use by extending daylight into the evening peak time. A spokesman for Energy Minister Pete Hodgson said the minister had an open mind on the suggestion, put forward by one industry player. The proposal would be explored over the next two weeks, but Mr Hodgson would not say whose idea it was because the person had requested anonymity. A rough estimate by electricity market company M-Co showed an overall power reduction of 3.5 per cent in the first week of daylight saving last year. For the past three years, the reduction in the first week averaged 2 per cent. More important, in the first week of daylight saving, peak evening consumption, between 5 pm and 8 pm, dropped 7.5 per cent last year and an average of 5.5 per cent over the past three years. Peak morning demand, between 7 am and 9 am, fell by smaller amounts. "If you can keep it lighter later, the lights come on later and you save power," said M-Co's general manager of communications, Jane Tronson. Decreasing demand in peak times could also reduce potential price spikes. Act energy spokesman Gerry Eckhoff called for clocks to be put forward as early as September 1 rather than the due date of October 7. That would save power because people would eat dinner earlier and might use the barbecue instead of the electric stove, the MP said. "I guess if they sit down to dinner and watch the news at 5 pm instead of 6 pm it is still a wee bit warmer." Even a small amount of saving on lighting could accumulate across the country. There could be bigger savings in the North, where twilight lasts less time than in the South. But Federated Farmers energy spokesman Tom Lambie firmly rejected the suggestion. "We are in the busiest time of year in full flight with calving. The last thing people want to do is get up in the dark. The first daylight hours are precious for getting on with the job." A study in California, which has suffered rolling blackouts, found that daylight saving saved only small amounts of power but caused significant reductions in peak use. However, Mr Eckhoff said California had a big demand for power for air-conditioning rather than heating. The icy blast sweeping NZ from the south has caused another hiccup in the power-saving effort. Snowfalls and a cold southerly change meant savings dropped to 6.5 per cent on Monday. In the past seven days, average savings have been 9.4 per cent. However, M-Co admitted yesterday that the power saving figure published for Saturday was incorrect. The actual saving was 7.3 per cent, not 1.8 per cent as it reported. Meanwhile, one power company is trying to boost the everyone-pull-together power-saving message by offering yet another cash incentive - this time with a twist. Contact Energy, one of the four big electricity generators, which also has about 22 per cent of the retail market, will give up to $400,000 to worthy causes in regions where power consumption is cut by 10 per cent over the next month. Contact chief executive Stephen Barrett said regions must save at least 4 per cent to get any money. Those that missed the 10 per cent target but still made savings would be rewarded on a sliding scale. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Firewalling on Cisco router?
by PhoneNet 14 Aug '01

14 Aug '01

Can anyone give some suggestions on the best way to firewall a system using a Cisco router.... a friend on another list I'm on has been charged with moving a system .... some of the misfortunes he has been faced with so far are (Don't Laugh): 1.They had no list of thier machine names, 2. No IP addresses, 3. moved token ring to ethernet. 4. They had hubs, but no patch cables.... They get the Cisco router today and are moving tomorrow. Initally they will just use a very restrictive set of Cisco filters and NAT. It has bee nsuggested he use either Checkpoint or Cisco Pix, both standalone machines. Any comments? Ian Cousins PhoneNet --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Max 6000 R2 Settings
by Craig Whitmore 13 Aug '01

13 Aug '01

If anyone is kind enough to be running a Max6000 with R2, could you please send me a copy of the Settings for the E1's so they will work with R2 :-) I set up the first 4000's at IHUG on PRI's years and years ago, about I don't know the "right" settings to R2's :-( Also. if anyone has a suggestion on most stable firmware for the 6000? 7.2? 8.1? 9.0? It would be great. Sig Mode=NEW ZEALAND Switch Type=CAS Framing Mode=G.703 etc etc etc Thanks Craig Whitmore Orcon Internet http://www.orcon.net.nz

4 5

Orcon Internet Updated Prefix List
by root 13 Aug '01

13 Aug '01

For those people who are Peering with Orcon Internet Please Note the Updated Prefix Lists. (210.54.56.0/21 is added from previous prefix-lists) ip prefix-list ORCON-networks description Orcon Internet <noc(a)orcon.net.nz> ip prefix-list ORCON-networks permit 202.14.20.0/22 le 24 ip prefix-list ORCON-networks permit 202.27.76.0/23 le 24 ip prefix-list ORCON-networks permit 202.27.140.0/22 le 24 ip prefix-list ORCON-networks permit 202.27.188.128/25 ip prefix-list ORCON-networks permit 210.27.250.0/24 ip prefix-list ORCON-networks permit 210.54.13.0/24 ip prefix-list ORCON-networks permit 210.54.142.0/23 le 24 ip prefix-list ORCON-networks permit 210.54.148.0/23 le 24 ip prefix-list ORCON-networks permit 210.55.8.0/24 ip prefix-list ORCON-networks permit 210.55.12.0/22 le 24 ip prefix-list ORCON-networks permit 210.55.18.0/24 ip prefix-list ORCON-networks permit 210.55.199.0/24 ip prefix-list ORCON-networks permit 210.54.56.0/21 Thanks Craig Whitmore Orcon Internet http://www.orcon.net.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1