December 2011 - NZNOG - lists.nznog.org

list.waikato.ac.nz Has Moved
by Donald Neal 11 Dec '24

11 Dec '24

NZNOG-People, I have just finished migrating all of the mailing lists held at The University of Waikato from one server to another. I don't have any reason to believe that anything's gone wrong, but please bear with me for today if it turns out that something has. - Donald Neal -- Donald Neal | Q: How many Aucklanders does it take to change Systems Programmer/Analyst | a light bulb? The University of Waikato | A: Pass me that candle and I'll tell you. Hamilton, New Zealand | --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

RE: Sort of OT: are there any "Internet enabled" temperature sens ors/servers for Auckland?
by Greg Clare 18 Aug '21

18 Aug '21

May not be exactly what you are after? However DSE have an Internet weather station at the Albany HQ. http://www.dse.gen.nz/public/webdata/weather.htm Regards Greg > -----Original Message----- > From: Juha Saarinen [mailto:juha(a)saarinen.org] > Sent: Wednesday, 2 January 2002 2:47 pm > To: NZNOG > Subject: Sort of OT: are there any "Internet enabled" temperature > sensors/servers for Auckland? > > > Measuring the outside temperature, with geographic location given. > > -- > Juha > Take off every sig! > > - > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > where the body of your message reads: > unsubscribe nznog > - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Don't quite get this?
by Bruce Kingsbury 09 Feb '12

09 Feb '12

Re: Paul Brislen: http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=10748747 ] " The ISP doesn't. It's up to the rights holder to determine that you've downloaded that file called The Terminator and that it's a movie and that they have the rights to it and that you haven't got the rights to download it. if they can't demonstrate that to the ISP (which will then check its records to determine if that file was downloaded and if so at what time and by whom) then the ISP rejects the claim." I don't quite get this. I know the ISP will have records of who had what IP address and perhaps even fairly detailed logs of how much throughput over the day, but if they get told that whatever IP at 8:08:45 pm was observed downloading The Terminator, are any of the the ISP's able to refute that? Do they even log what kind of traffic I was doing at the time? Do they keep track of http vs. torrent vs. skype traffic? Sorry to ask here, but it seemed like the best place to get an informed answer. Also, beer...

36 66

.nz DNSKEY encoding
by Sebastian Castro 22 Jan '12

22 Jan '12

To the technical community: It was brought to our attention the particularity of the encoded representation of the .nz DNSKEY in a post to NZNOG (thanks to Andy Linton). Further investigation confirmed the encoding was unique among the DNSSEC-enabled TLDs. To provide a clear explanation, let's walk through the decoding of the root zone DNSKEY: . 107464 IN DNSKEY 257 3 8 ( AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQ bSEW0O8gcCjFFVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh /RStIoO8g0NfnfL2MTJRkxoXbfDaUeVPQuYEhg37NZWA JQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaDX6RS6CXp oY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3 LQpzW5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGO Yl7OyQdXfZ57relSQageu+ipAdTTJ25AsRTAoub8ONGc LmqrAmRLKBP1dfwhYB4N7knNnulqQxA+Uk1ihz0= ) ; key id = 19036 . 107464 IN DNSKEY 256 3 8 ( AwEAAdNW7YIhcTdqXrzgZjJJ35VjAFT1ArvnhAzXDm7A uGxSQqmGBRmjJvBv0xS4gahB9mj6ekF0dVKoeZgLmNAj o8hj2JI7K281YTo2R5k3mKSc4hOCP55hR22r5hIsPJoT 19pv/VdZQfyTzZ96frQ16qRa9+/GSjzjtFfQv16FwE7R ) ; key id = 55231 The DNSKEY rdata is represented in BASE64, which once decoded, will provide the public component of the key used to generate signatures. According to RFC3110, the encoding for the key follows the structure below: ------------------------------------------------------------------------------ RSA Public KEY Resource Records RSA public keys are stored in the DNS as KEY RRs using algorithm number 5 [RFC2535]. The structure of the algorithm specific portion of the RDATA part of such RRs is as shown below. Field Size ----- ---- exponent length 1 or 3 octets (see text) exponent as specified by length field modulus remaining space ------------------------------------------------------------------------------- For the root zone DNSKEY with the SEP bit on, the decoding looks like dig dnskey . +short | grep '^257' | awk '{print $4}' | base64 -d | xxd -l 12 -b 0000000: 00000011 00000001 00000000 00000001 10101000 00000000 ...... 0000006: 00100000 10101001 01010101 01100110 10111010 01000010 .Uf.B where * exponent_length is the first byte (00000011). This indicates the next three bytes are the exponent. * exponent (00000001 00000000 00000001), which in decimal is 65537, the 4th number of Fermat. * modulus is represented by the rest of the data. The DNSKEY for .nz looks like nz. 3600 IN DNSKEY 257 3 8 ( BAABAAGwfTiEoh71o6S55+Mdy1qqVRnpKY1VHznrv+wx rPfvRGB5VivFFPFN+33fsaTxJQTceOtOna7IKxTffj6p bBG4a9vtk2FqF551IwXomKWJnzRVKqYzuAx+Os/5gLIN BH7+qRWAkJwCdQXIaJGyGmshkO5Ci5Ex5Cm3EZCeVrie 0fLI03Ufjuhi6IJ7gLzjEWw84faLIxWHEj8w0UVcXfaI 2VL0oUC/R+9RaO7BJKv93ZqoZhTOSg9nH51qfubbK6FM svOWEyVcUNE6NESYEbuCiUByKfxanvzzYUUCzmm+JwV7 7Ebj3XZSBnWnA2ylLXQ4+HD84rnqb1SgGXu9HZYn ) ; key id = 2517 nz. 3600 IN DNSKEY 256 3 8 ( BAABAAGD+q3p2XDCb6SvAbACB/NPdljxhpBx2O9ZnvF2 OYb6kViMJ5dgxYDcFtvL5RW31Bc7UDvseoQPUK1wora3 BtUTylo1xd5PN/lV600mrNGRxfmw77Hen/MXH5GQrjaj O+rFP1xce1/jdyvCciJzrYRcPL9p4c/eGoJK3ZMubiu1 OQ== ) ; key id = 27212 which once decoded, looks like dig dnskey nz +short | grep '^257' | awk '{print $4}' | base64 -d | xxd -l 12 -b 0000000: 00000100 00000000 00000001 00000000 00000001 10110000 ...... 0000006: 01111101 00111000 10000100 10100010 00011110 11110101 }8.... In this case, * exponent_length is the first byte (00000100), representing a decimal value of 4 * exponent covers the next four bytes (00000000 00000001 00000000 00000001), which converted to decimal is 65537. * modulus is represented by the rest of the bytes. The encoding for the .nz DNSKEY is different. According to RFC3110, Section 2 -------------------------------------------------------------------- Leading zero octets are prohibited in the exponent and modulus. -------------------------------------------------------------------- So the encoding being used is RFC non-compliant. We tracked down the issue to the PKCS#11 library recommended by the HSM manufacturer. Despite the wrong encoding, everything is working as far as we are aware, including validation using BIND 9.7 and Unbound 1.4.9, reinforcing the spirit of Postel's Law. Duane Wessels from Verisign reported our DNSKEYs cause some BIND utilities to generate different results: $ dig nz dnskey | grep 257 > nz.key $ dnssec-dsfromkey nz.key nz. IN DS 54026 8 1 CC0EFEDAA4AA09CFB05E72E765A97BD5A9BFD1FE nz. IN DS 54026 8 2 48B0A194EE26C9D59BCC683CBC7A3495BB0AAA51ECC75533DBC76408 F0F70458 where the DS records submitted to the root zone are nz. 6446 IN DS 2517 8 2 ( 02240B41DFDDAECA2D6227D75A3575D5BA2FD07E2157 7F1C506D98BE491D6FF3 ) nz. 6446 IN DS 2517 8 1 ( CB5F686CB7A500B344E33DBC5CA8183A4E5579EC ) Other tools such as Net::DNS or ldns-key2ds produce the expected output. We are currently deciding the best course of action to correct the wrong encoding, we'll keep you informed. Kind Regards, -- Sebastian Castro DNS Specialist .nz Registry Services (New Zealand Domain Name Registry Limited) desk: +64 4 495 2337 mobile: +64 21 400535

2 2

UTC, leap seconds and computer time
by Jay Daley 24 Dec '11

24 Dec '11

A network time heads-up. There has been a debate raging for some years on whether or not to change Universal Coordinated Time (UTC) to be the same as International Atomic Time (TAI), which is due for a major vote at the ITU-R in January. Previous votes have seen it defeated but it keeps coming back. To explain the background: The rotation of the earth is not precisely the same length of time each year and currently a decison is made every six months whether or not to correct UTC to ensure that midday really is when the sun is at its highest point over the Greenwich meridian, by adding a leap second. 24 have been added over the last 40 years and UTC now differs from TAI by 34 seconds. The proposal, if agreed, will drop this correction and so over a long time the connection between time and the rotation of the earth will be lost. The implication for networks is potentially quite profound. NTP currently supports leap seconds as do GPS satellite time signals and DCF77 radio clocks but if this proposal is agreed that will be turned off. So if you provide time to a system that take a photograph at the same time every day then that will need two time signals, one for TAI and a new one for earth rotation time. Same problem for anything to do with sun rises/falls and tides (though obviously the precision may not be an issue for some years). If you want to read more then this article covers the arguments quite well, though biased like me against the idea: http://www.bloomberg.com/news/2011-12-22/un-vote-could-allow-mankind-to-con… I'm not sure if NZ has a position on this, but I am trying to find out. cheers Jay PS A reminder about our free NTP service, details at: www.ntp.net.nz PPS If you think this is off-topic for this list then please let me know! -- Jay Daley Chief Executive .nz Registry Services (New Zealand Domain Name Registry Limited) desk: +64 4 931 6977 mobile: +64 21 678840

8 12

NZNOG 2012 - Registrations now open
by Gerard Creamer 23 Dec '11

23 Dec '11

Hi there, Sorry for the delay. We were about to open registrations yesterday and there were a few more earthquakes. Being the risk adverse bunch that we are we have been to the venue to assess the situation, and the Trustees have decided that there is no reason at present not to proceed with the 2012 NZNOG conference in Christchurch. So we're all go! Buy the gift of NZNOG this Christmas... Or New Year... Register now at https://nznog.lilregie.com There is conference information at http://2012.nznog.org For the terminally lazy, or those who don't want to loose any of those precious leap seconds waiting for network latency, the speaker list so far is: Martin J. Levy (Hurricane Electric) - The state of the IPv6 global Internet Phil Regnauld (NSRC) - ValiDNS Geoff Huston (APNIC) - Digi who? (DNS security) Josh Bailey (Google) - Software Defined Networking, OpenFlow, and how to make an OpenFlow Router Bill Manning (free agent) - Moving the cost of Crypto Nick Wilcox (Netmania UK) - 360 Degrees of Customer Service Jonathan Brewer (free agent) - All your Waves are belong to us Greg Hankins (Brocade) - What's Going on with Ethernet? Nelson Da Silva (Fortinet) - Have you secured your IPv6? Philip Smith (APNIC) - Migration from OSPF to ISIS Andy Linton (VUW / Citylink) - State of the IX There are two excellent three day workshops (IPv6 BGP and DNS SEC) Monday to Wednesday as well as a bunch of pick-n-mix tutorials on the Wednesday. See you all there. Cheers, Gerard

3 2

UFB talk at 'NOG 2012
by Shane Hobson 22 Dec '11

22 Dec '11

Slightly off topic, but useful suggestions will be rewarded with beer. At NZNOG 2012 I'll be bringing you an update on the rollout of ultrafast broadband around the country. In previous years I've described the money go round that makes it work, speculated on the prices of services and hinted at some of the challenges that ISPs might face. This year, much more information is already published (services, pricing, technical service descriptions, ops manuals etc) So my question for the NZNOG community what would you like to know about UFB ? Stuff I could do : summary of the wholesale services & pricing technical detail about precisely how the services work random questions & answer session Shane Hobson Ultrafast Fibre Ltd 021 221 3999

1 0

QinQ box
by Anton Smith 21 Dec '11

21 Dec '11

Hi all, Given the handover options from Chorus for UFB ( http://www.chorus.co.nz/file/1591), does anybody have any recommendations about a cost effective GE based node that can do QinQ happily? Port density probably only needs to be 2-4 ports. Control/forwarding redundancy not required. And, preferably with the capability to set individual policers and/or queue rates on each sub-interface. I don't know if chorus give you the option to do the rate limiting for you or not - does anybody know? Cheers, Anton

6 6

NZNOG is coming to Christchurch
by Sam Sargeant 20 Dec '11

20 Dec '11

The New Zealand Network Operators Group (NZNOG) is holding their annual conference and training workshops in the Garden City of Christchurch at the end of January 2012. The conference will run across the 26th and 27th of January and as always will include leading speakers in the field of Internet operations from New Zealand and much farther afield. Training workshops and tutorials will precede the conference and run from the 23rd to the 25th of January. The annual conference, workshops and tutorials are a once a year chance for individuals and organisations involved in Internet operations to meet and share the latest in Internet operations, technology practices and receive high quality training. The event is unique in New Zealand and attracts technical, skilled individuals with a genuine interest in Internet operations and Internetworking technologies. The event will be held at the Copthorne Commodore near Christchurch Airport. Accommodation is available on site as well as in the immediate area. Registrations for the event will open early December. Speakers will be confirmed early December and a full programme issued mid December. The cost of attendance has been confirmed at $250, students receive a 20% discount. For further information: Subscribe to the NZNOG mailing list: http://www.nznog.org/?page_id=5 Visit the conference website: http://2012.nznog.org.nz Follow us on Twitter: @NZNOG Copy of this text can also be found at: http://2012.nznog.org/cms_display.php?sn=20&st=1

3 3

Merry Christmas
by Greg Soffe 19 Dec '11

19 Dec '11

Hi all, I know this is totally off topic. But I wish you all a very merry Christmas, and a very happy New Year. Here's to a 2012 with no network outages, and the best IP services provided by all. And to a slow couple of weeks for those who are 'on call' :) All the best. Greg Soffe Manager Telecom Internet Registry Telecom NZ ltd.

1 0