- NZNOG - lists.nznog.org

Re: Proposed Change to Acceptable Use Policy
by Donald Neal 07 Aug '01

07 Aug '01

NZNOG People, Voting is now under way on the following proposed addition to the list''s acceptable use policy. 10. A person repeatedly breaching list etiquette shall receive warnings from the list administrator. A further breach after the second such warning within thirty days shall result in the offender being unsubscribed from the list. Other action may also be taken to block postings to the list by the offender. Any such unsubscription is to be immediately announced to the list. Votes on this change to me (not the list!) by midday, Friday 10 August, please. I have so far received thirty votes, and have acknowledged all of them. If you have not received email saying your vote has been recorded, it is not likely that it has been recorded. Donald Neal List Administrator -- Donald Neal Mobility & Calling Platforms Network Delivery Telecom New Zealand Ltd --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

spammer
by Michael Coates 07 Aug '01

07 Aug '01

Hello Is there a list in NZ I can get a spammer put onto to block them from sending emails with viruses attached? Thanks

3 2

Code Red Stats
by Craig Whitmore 07 Aug '01

07 Aug '01

I've been running a running couter of hits on 1 machine take logs from 500 IP addresses's (2 C Classes). Its Hits/sec has gone up from yesterday from about 3.4->6.9 and growing fast :-( Total Seconds = 8878 Total Unique Machines Infected = 6380 Total Hits = 51169 Total Hits/Sec = 6.89 Also I have it emailing the owners of the Unique IP addresses (automaticlly) (with an ugly script) and telling that their machines are infected and so far have had many happy people repling thanking me. (But the Number of infected machines still increases :-( ) This is only from 2 C Class Addresses.. I can't imagine how many hits/sec NZ is getting in Total from Overseas.. There have only been a few infected machines from inside NZ (mostly from Xtra and WorldNet Dialups) Thanks Craig Whitmore Orcon Internet http://www.orcon.net.nz

1 0

TCP Header Definition help request "Window"
by Mike Sutton [ awacs ] 07 Aug '01

07 Aug '01

TCP Header Could an expert tell me "how" the "window" value is generated and "what" explicitly it means... Appreciate your help as my reference books don't help and I have not been able to locate a precise definition on the Net. Michael Sutton --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 7

root.exe
by Dylan Reeve 07 Aug '01

07 Aug '01

Any ISPs had a look through their proxy logs for "root.exe" or "cmd.exe" so far? I bet there will be a few... Going to go after people for 'hacking'? -- Dylan Reeve - dylan(a)wibble.net "Um, yeah." --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Code Red: NZ vs Canada
by Dan Langille 06 Aug '01

06 Aug '01

I can give you two lots of stats, one from a NZ server, the other from a Canada server: http://www.langille.org/stats-red-worm/ - in Wellington http://www.freebsddiary.org/stats-red-worm/ - in Ottawa Both are updated every 30 minutes, 15 minutes after and after the hour. -- Dan Langille pgpkey - finger dan(a)unixathome.org | http://unixathome.org/finger.php --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 5

Whazzup w/ Ihug?
by Juha Saarinen 06 Aug '01

06 Aug '01

http://www.internettrafficreport.com/cgi-bin/tr_chartpage.pl?203.98.56.1 70 -- Juha Saarinen --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 5

Re: Code Red Weirdness
by Mark Foster 06 Aug '01

06 Aug '01

[Tue Aug 7 13:56:39 2001] [error] [client 203.199.60.10] Invalid URI in request XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u 8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0 Ive had just one today, in the last half hour. None prior to that Did someone try to write a variant and screw up or maybe one of the infectees got weird? At 13:58 7/08/2001 +1200, you wrote: >[Tue Aug 7 13:57:14 2001] [error] [client 203.228.144.15] Invalid URI in >request >XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a >HTTP/1.0 > >Just started getting these. no default.ida?. > >Has the worm turned, again? > > >Tim J. Shackleton ------------------+ +- Business http://www.netlink.co.nz/ >Networks Admin/Programmer ----------+ +- Personal http://www.netnet.net.nz/ >Netlink LTD -- DDI +64 4 922 8476 --+ +------------- Pager 64 +26 253 4356 >+64 29 650 476 -- Cellular ---------+ +------------------------------------ >---- "Cold silence has a tendency to atrophy any sense of compassion" ----- > >--------- >To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz >where the body of your message reads: >unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 4

Code Red Stats
by Neil 06 Aug '01

06 Aug '01

Hi All, After about 30 second's of thinking about how to get rrdtool or mrgt to display what Code Red is up to on my server I decided to use webalizer instead. It defiantly gives you a better view on what is going on, have a look at http://203.97.86.130/codered/usage_200108.html . I have put the script in the cron.hourly directory so check back as often as you like. Neil Fincham Integral LTD.

6 8

Re: Code Red - Network Impact?
by Mark Davies 06 Aug '01

06 Aug '01

From: "Barry Raveendran Greene" <bgreene(a)cisco.com> Date: Mon, 6 Aug 2001 05:18:53 -0700 > Is anyone seeing router impact caused by all the bogus queries sent out by > Code Red? Just wondering if there could be some side effects. We had the cpu running at 100% on our border router till we tuned the access-lists to deal with traffic to port 80 early. cheers mark --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 2