- NZNOG - lists.nznog.org

[OT] 3g on mikrotik
by Rob McDonald 21 Apr '14

21 Apr '14

Hey all, Sorry for the OT post... Does anyone have experience with USB 3g sticks on Mikrotik routerboards? I've had quite a long look around, and without resorting to trial and error I thought someone here might be able to share their winning numbers with me. Cheers Rob *Rob McDonald | *Director Level 2 Systems Ltd *M:* +64 21 902 929 *eFax:* +64 9 974 4734 *W:* http://www.L2.co.nz <http://www.l2.co.nz/>

3 3

Message concerning Certs
by Michael Sutton 19 Apr '14

19 Apr '14

NZNOG members: My apologies but all attempts to send the text content of this PDF this morning have been blackholed until I managed to send the contents to InternetNZ PAG as a PDF which made it through filters which been stopping this content. I have had no problem send other messages etc. Your comments would be appreciated as I see this as a major issue which may require all certificates to be regenerated and then only used on patched systems whose memory and priv keys cannot read copied by external parties. Sincerely Michael S Sutton Director - Awacs Communications (NZ) Limited Transit Room The Dominion Observatory 34 Salamanca Road Kelburn Wellington +64 21 305500 Twitter & Skype: Mikiwis http://www.awacs.co.nz https://www.google.co.nz/#q=michael+sutton+nokia+patent http://www.linkedin.com/profile/view?id=16587996&trk=tab_pro

9 13

Heartleech tool
by Juha Saarinen 15 Apr '14

15 Apr '14

https://github.com/robertdavidgraham/heartleech >From the read me: A typical "heartbleed" tool. What makes this different is: autopwn most (-a) that does all the steps needed to get private key post-handshake (encrypted) heartbeats instead of during handshake evades Snort IDS rules loops making repeated requests (-l <loopcount>) dumps binary data to file (-f <filename>) IPv4 or IPv6 (-v <IPver>) full 64k heartbleeds -- Juha Saarinen twitter: juhasaarinen

4 3

Fake domain renewal invoices
by Richard Hulse 14 Apr '14

14 Apr '14

I got one of these just now from Domain Renewal Group, so beware. It was sent to someone else in our organisation, who fortunately brought it to me instead of approving and paying it.

3 2

Heartbleed - clients at risk too
by Juha Saarinen 11 Apr '14

11 Apr '14

Morning. Just saw this: http://vrt-blog.snort.org/2014/04/heartbleed-continued-openssl-client.html Which I thought might be useful to know. -- Juha Saarinen twitter: juhasaarinen

3 2

Snapchat question
by Tony Wicks 10 Apr '14

10 Apr '14

Hi all, we have had some users say they intermittently can't use this application. After downloading this app (and deciding it should go into the why the hell was that ever invented pile) it seems a bit difficult to fault find any issues. Does anyone know how this thing communicates ? Is it normally intermitttant ? Thanks all

2 1

Heartbleed OpenSSL Vulnerability
by Dean Pemberton 10 Apr '14

10 Apr '14

Hi All, NZITF (in conjunction with InternetNZ) have been endeavouring to raise awareness about this issue. We have compiled some information on our website, which may be of use to you and/or your clients. Please feel free to share this link as widely as you see fit. http://www.nzitf.org.nz/news.html The NZITF is treating this as an ongoing security issue with significant implications. As a result we are intending to monitor this situation and update our advice as required. We have tree basic messages for website owners: 1. Establish if your site's servers are vulnerable. 2. Patch the vulnerable servers. 3. Revoke/reissue keys and certificates. If you are vulnerable it is imperative that you do steps 2 AND 3. Not one, but both. You should also be encouraged to discuss this very important issue with your regular security consultants. If you have feedback or information please feel free to contact me so we can include it in the advice on the website. Regards, Dean

17 19

Re: [nznog] [PAG] Message concerning Certs
by Ewen McNeill 08 Apr '14

08 Apr '14

On 2014-04-09 22:40 , Dean Pemberton wrote: > And from the same twitter thread saying it was unlikely... > [can extract private key on vulnerable FreeBSD if it is first request] "first request after restart" is a special case too ("possible, but unlikely"). The same thread/poster also says: "[...] Does not work on Debian. [...]" (also https://twitter.com/1njected/status/453781230593769472) which implies (as noted in that thread) something about the FreeBSD malloc patterns makes it more likely/possible than Debian's malloc. Those (who were) running a vulnerable OpenSSL on FreeBSD may wish to take that into account in their assessment :-) The main thing which is certain is that it's going to be a well studied/probed bug. Ewen

1 0

Re: [nznog] Message concerning Certs
by Michael Sutton 08 Apr '14

08 Apr '14

The exploit has been rumoured for some time. Does it matter who the primary actors are. They have all the private keys by now and g's/s-view/wifi/scan has the other half; so that deals with the white-hats. All historical data dumps can be retrospectively analysed at any time for eternity at ones leisure. As for the code which is in the wild I enclose a graph of 3 hours traffic from the http://filippo.io/Heartbleed/# site which is using something like 31 machines showing ~2000 sites being tested every minute, ~360,000 over 3hours and that is from a public site; an unknown% will be blackhats. This is catastrophic and you should believe it's not only our guys that have it but every other *worth their salt. InternetNZ almost became a CA in ~2004. We could have fixed this hole now for .nz with a working revocation system. Then INZ had a new team on board and it was .... The ironical blowback is that our "own" might be just as threatened by this. We just have to get on and deal with this as a priority tomorrow and for the next decade. I am a patriot by the way, Yours Michael amI#6 -----Original Message----- From: nznog-bounces(a)list.waikato.ac.nz [mailto:nznog-bounces(a)list.waikato.ac.nz] On Behalf Of Don Stokes Sent: Wednesday, 9 April 2014 8:37 p.m. To: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] Message concerning Certs Is there any indication out there as to how widely this bug has been exploited? I.e. if you've patched servers in the last 24 hours, how likely is it that your certificate keys have been leaked over the last months / year? Not looking for accurate numbers, just roughly where on the scale of, "this is possible but no reports of actual use" to "all the black hats have been doing this for years so you're screwed unless you re-issue and revoke your certs" the exploit lies. Also, last time I worried about this, certificate revocation was, uh, largely unimplemented. That was a while ago. How well does it work now? And with potentially large numbers of revoked certs? -- don _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Callplus postmaster contact
by Jean-Francois Pirus 08 Apr '14

08 Apr '14

Can a Callplus/Slingshot/Tranzpeer postmaster contact me. We're having issue with forward emails for our clients to Callplus addresses, the clients are complaining mail is being dropped. PS: I have tried contacting postmaster(a)callplus.net.nz and this is what I got after 4 days: > This message was created automatically by mail delivery software. > A message that you sent has not yet been delivered to one or more of its > recipients after more than 72 hours on the queue on mxdsrv1.tranzpeer.net. > > The message identifier is: 1WTNur-0005YH-G5 > The subject of the message is: Mail server issue: > The date of the message is: Fri, 28 Mar 2014 16:47:21 +1300 > > The address to which the message has not yet been delivered is: > > sysops(a)noc.tranzpeer.net > (generated from postmaster(a)callplus.net.nz) > Delay reason: SMTP error from remote mail server after RCPT TO:<sysops(a)noc.tranzpeer.net>: > host 192.168.69.1 [192.168.69.1]: 451 4.3.2 Please try again later Our logs are full of the following: Apr 8 12:41:40 tiny postfix/smtp[14531]: 4FE0DDFA92F: host mxi1.callplus.net.nz[202.180.66.203] refused to talk to me: 421 4.7.0 Not allowed. Apr 8 12:41:40 tiny postfix/smtp[14532]: B7E63DFA8DC: host mxi1.callplus.net.nz[202.180.66.203] refused to talk to me: 421 4.7.0 Not allowed. Apr 8 12:41:40 tiny postfix/smtp[14537]: 9B205DFA940: host mxi1.callplus.net.nz[202.180.66.203] refused to talk to me: 421 4.7.0 Not allowed. Apr 8 12:41:40 tiny postfix/smtp[14537]: 9B205DFA940: to=<BLAH(a)slingshot.co.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=1347, delays=1346/0.58/0.06/0, dsn=4.7.0, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] refused to talk to me: 421 4.7.0 Not allowed.) Apr 8 12:41:52 tiny postfix/smtp[14530]: 4B069DFA8E2: host mxi1.callplus.net.nz[202.180.66.203] said: 451 4.3.2 Please try again later (in reply to RCPT TO command) Apr 8 12:41:52 tiny postfix/smtp[14531]: 4FE0DDFA92F: to=<BLAH(a)callplus.net.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=1391, delays=1379/0.25/0.1/12, dsn=4.3.2, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] said: 451 4.3.2 Please try again later (in reply to RCPT TO command)) Apr 8 12:41:52 tiny postfix/smtp[14532]: B7E63DFA8DC: to=<BLAH(a)callplus.net.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=1866, delays=1853/0.29/0.1/12, dsn=4.3.2, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] said: 451 4.3.2 Please try again later (in reply to RCPT TO command)) Apr 8 12:42:04 tiny postfix/smtp[14530]: 4B069DFA8E2: to=<BLAH(a)callplus.net.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=1790, delays=1766/0.25/12/12, dsn=4.3.2, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] said: 451 4.3.2 Please try again later (in reply to RCPT TO command)) Apr 8 12:56:58 tiny postfix/smtp[17081]: E3622DFA91C: host mxi1.callplus.net.nz[202.180.66.203] refused to talk to me: 421 4.7.0 Not allowed. Apr 8 12:56:59 tiny postfix/smtp[17081]: E3622DFA91C: to=<BLAH(a)slingshot.co.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=0.07, delays=0.01/0/0.05/0, dsn=4.7.0, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] refused to talk to me: 421 4.7.0 Not allowed.) Apr 8 13:00:24 tiny postfix/smtp[17832]: 061A4DFA8F6: host mxi1.callplus.net.nz[202.180.66.203] said: 451 4.3.2 Please try again later (in reply to RCPT TO command) Apr 8 13:00:36 tiny postfix/smtp[17832]: 061A4DFA8F6: to=<BLAH(a)callplus.net.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=24, delays=0.02/0.01/12/12, dsn=4.3.2, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] said: 451 4.3.2 Please try again later (in reply to RCPT TO command)) Apr 8 13:01:22 tiny postfix/smtp[17829]: D7FB0DFA91F: host mxi1.callplus.net.nz[202.180.66.203] said: 451 4.3.2 Please try again later (in reply to RCPT TO command) Apr 8 13:01:34 tiny postfix/smtp[17829]: D7FB0DFA91F: to=<BLAH(a)slingshot.co.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=25, delays=0.64/0.04/12/12, dsn=4.3.2, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] said: 451 4.3.2 Please try again later (in reply to RCPT TO command)) Apr 8 13:02:06 tiny postfix/smtp[17851]: 4F55DDFA934: host mxi1.callplus.net.nz[202.180.66.203] said: 451 4.3.2 Please try again later (in reply to RCPT TO command) Apr 8 13:02:15 tiny postfix/smtp[17832]: 1ABBEDFA0E0: host mxi1.callplus.net.nz[202.180.66.203] said: 451 4.3.2 Please try again later (in reply to RCPT TO command) Apr 8 13:02:18 tiny postfix/smtp[17851]: 4F55DDFA934: to=<BLAH(a)slingshot.co.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=24, delays=0.02/0/12/12, dsn=4.3.2, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] said: 451 4.3.2 Please try again later (in reply to RCPT TO command)) Apr 8 13:02:27 tiny postfix/smtp[17832]: 1ABBEDFA0E0: to=<BLAH(a)callplus.net.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=24, delays=0.01/0.01/12/12, dsn=4.3.2, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] said: 451 4.3.2 Please try again later (in reply to RCPT TO command)) Apr 8 13:15:04 tiny postfix/smtp[20825]: 4D5B9DFA923: host mxi1.callplus.net.nz[202.180.66.203] said: 451 4.3.2 Please try again later (in reply to RCPT TO command) Apr 8 13:15:16 tiny postfix/smtp[20825]: 4D5B9DFA923: to=<BLAH(a)callplus.net.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=24, delays=0.07/0/12/12, dsn=4.3.2, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] said: 451 4.3.2 Please try again later (in reply to RCPT TO command)) Apr 8 13:16:39 tiny postfix/smtp[21318]: 377AFDFA8DC: host mxi1.callplus.net.nz[202.180.66.203] said: 451 4.3.2 Please try again later (in reply to RCPT TO command) Apr 8 13:16:51 tiny postfix/smtp[21318]: 377AFDFA8DC: to=<BLAH(a)callplus.net.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=24, delays=0.01/0/12/12, dsn=4.3.2, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] said: 451 4.3.2 Please try again later (in reply to RCPT TO command)) Apr 8 13:24:14 tiny postfix/smtp[21330]: 8FF10DFA8E2: host mxi1.callplus.net.nz[202.180.66.203] said: 451 4.3.2 Please try again later (in reply to RCPT TO command) Apr 8 13:31:51 tiny postfix/smtp[24414]: 1ABBEDFA0E0: host mxi1.callplus.net.nz[202.180.66.203] said: 451 4.3.2 Please try again later (in reply to RCPT TO command) etc... Thanks. -- Jean-Francois Pirus | Technical Manager francois(a)clearfield.com | Mob +64 21 640 779 | DDI +64 9 282 3401 Clearfield Software Ltd | Ph +64 9 358 2081 | www.clearfield.com

7 7

ICONZ-Webvisions (NZ) to cease operating externally-reachable NTP servers
by Mark Foster 07 Apr '14

07 Apr '14

Hiya folks - again... ! :-) ICONZ-Webvisions (the entity formerly known simply as ICONZ in NZ) are making changes to their NTP server arrangements on the evening morning of 10 April (so, overnight tomorrow night). The details of the changes being made can be viewed at: http://iconz-webvisions.com/en/support/outages/new-zealand In short, if you have been using 'ntp.iconz.net' or 'ntp.iconz.co.nz' by DNS name, you'll have already seen a change; this now is CNAME'd to s2.ntp.net.nz (which happens to sit in our DC)[1]. Anyone who has been using any of our (very long lived) NTP servers by IP address, these IP's will stop responding to NTP queries from outside of our network, in the wee hours of 10 April. Much like the DNS changes recently made, this is most likely to be noticed by people who've been using these IP's for historical or habitual reasons. Customers with concerns about this change are invited to contact our Customer Care team on 0800 843 638 or via support.nz(a)iconz-webvisions.com<mailto:support.nz(a)iconz-webvisions.com>. Non-customers, should probably change their NTP timesource to a publically available resource; I do very much value and recommend the services offered by NZRS, with details at www.ntp.net.nz<http://www.ntp.net.nz>. Regards Mark. [1] This was done in conjunction with NZRS and mainly as an 'interim' measure. Those DNS records may be removed completely at some stage in the future. Anyone using those hostnames should move to using services such as those offered by NZRS, and bypass our DNS entries completely, as soon as possible. -- Mark Foster Technical Services Manager - Australia & New Zealand [iconz-webvisions-logo-png] www.iconz-webvisions.com<http://www.iconz-webvisions.com/> ICONZ-Webvisions, ICONZ House, 60 Airedale Street, Auckland 1010, New Zealand

1 1

OpenSSL vulnerability
by Dean Pemberton 07 Apr '14

07 Apr '14

Here's one to keep an eye on. Seems to be getting a bit of attention. http://www.kb.cert.org/vuls/id/720951 http://heartbleed.com/ Work with your vendors to confirm if you're at risk.

1 0

tk[1-4].ihug.co.nz
by Joel van Velden 07 Apr '14

07 Apr '14

Hi List After Mark's announcement about removal of Iconz public ntp I thought I should check my ntpd configs. Can anyone from Vodafone give an update on tk[1-4].ihug.co.nz? After many mergers and acquisitions it occurs to me that perhaps these could be dusty machines under someone's desk that could disappear one day without announcement? Any official comment? Is there an official webpage about them? Regards, Joel van Velden

1 0

Software Defined Networking (SDN) Presentation
by Jay Best 07 Apr '14

07 Apr '14

Hey is anyone else going to this? I haven't seen many of you guys from NZNOG in ages, so would be good to catchup for old times sake! Cheers, J *Software Defined Networking (SDN) Presentation* Auckland Tourism, Events and Economic Development and Massey University invite you to an informative and engaging presentation by world leading New Zealand expert Mr. Josh Bailey from Google around SDN research in New Zealand and beyond. SDN has been generating a lot of press in the network industry and research worlds. While a community has arisen to energetically debate what SDN is? There are concrete research efforts and deployed systems exploring the implications of separating control and data planes. These include Google's B4 network (which connects Google data centers together) and uses OpenFlow and CityLink's efforts in New Zealand to produce an SDN controlled Internet exchange. This presentation will describe some recent research both here in NZ and in the US, including work at REANNZ and Victoria University on building and deploying an open source SDN controller and experiments including RPKI. Date: Monday, 14th April 2014 Time: 4.30pm - 6.30pm Venue: Room OR 4, Building 102 Massey Albany Campus Gate 4 Eastbourne Road, Old Albany Highway. Cost: Complimentary RSVP: Shona Alo (s.alo(a)massey.ac.nz) if you would like to attend

1 0

Bitstream 3a DHCP manipulation
by Dave Mill 07 Apr '14

07 Apr '14

Hi all I posted a few weeks ago about MAC limits on Bitstream 3a connections. This is related to that. This is a UFF Bitstream 3a connection. I've discovered that a customer's only complaint with a Bitstream 3a connection from us is that DHCP doesn't work over this. I've obtained some pcaps from both ends and I can see the following changes occurring to a DHCP Request: 1) The transaction ID is changed 2) Option 82 is added. More specifically, sub-option 1 Agent Circuit ID is present and has a valid length. sub-option 2 Agent Remote ID is present, has a length of 0 and no content which wireshark doesn't seem to like much. I've had a brief read of RFC3046 and I can't really tell if its valid to have a sub-option with a length of 0 or not. https://tools.ietf.org/html/rfc3046#page-8 I never see any DHCP ACKs coming back from the customer's DHCP server. I've had a read of some of UFF's Bitstream3a docs and can't see any mention of DHCP. I can see in one of our initial requests we had to fill out we can choose to have DHCP Relay Agent Functionality but this seems to be related to Bitstream2 only and also this defaults to be disabled. I don't know what DHCP server the customer is using right now but I hope to find this out soon. Questions for anyone with more experience in this than myself: -Can changing the DHCP Request transaction ID cause issues? -Has anyone come across DHCP servers not liking option 82 being set, or not liking sub-option 2 having a 0 length? -Has anyone successfully used DHCP across a Bitstream3a connection? How about a UFF Bitstream3a connection? -Am I missing anything obvious? Obviously I might end up talking to UFF over this but I just want to see what others on the list know before doing so. Again, I don't really want to debate the wisdom of plugging two LANs in over a Bitstream3a connection. Cheers Dave

9 12

Koru Club Wireless - Air NZ Contact
by Davey Goode 07 Apr '14

07 Apr '14

Hi All, Can someone from AirNZ who has knowledge of the wireless in the koru lounge please flick me a mail off list. cheers davey

1 0

IP Hijack out of Indosat Thailand
by Tony Wicks 03 Apr '14

03 Apr '14

Is anyone else seeing their IP ranges hijacked out of Thailand ? http://seclists.org/nanog/2014/Apr/49 http://seclists.org/nanog/2014/Apr/55 You received this email because you are subscribed to BGPmon.net. For more details about these updates please visit: https://portal.bgpmon.net/myalerts.php ==================================================================== Possible Prefix Hijack (Code: 10) ==================================================================== Your prefix: 103.9.40.0/22: Prefix Description: FLIP-AS-AP Update time: 2014-04-02 20:29 (UTC) Detected by #peers: 1 Detected prefix: 103.9.40.0/22 Announced by: AS4761 (INDOSAT-INP-AP INDOSAT Internet Network Provider,ID) Upstream AS: AS4651 (THAI-GATEWAY The Communications Authority of Thailand(CAT),TH) ASpath: 18356 38794 4651 4761 ==================================================================== Possible Prefix Hijack (Code: 10) ==================================================================== Your prefix: 103.224.128.0/22: Prefix Description: Flip Update time: 2014-04-02 19:42 (UTC) Detected by #peers: 1 Detected prefix: 103.224.128.0/22 Announced by: AS4761 (INDOSAT-INP-AP INDOSAT Internet Network Provider,ID) Upstream AS: AS4651 (THAI-GATEWAY The Communications Authority of Thailand(CAT),TH) ASpath: 18356 9931 4651 4761

8 8

OM4 MMF
by Jed Laundry 31 Mar '14

31 Mar '14

Hi folks, Excuse my ignorance, I try to avoid orange/aqua cables... We recently had a rack of servers + SAN installed with 8Gb FC, and long story short, the vendor will only supply & install 5m OM4 cables. *grumble grumble FCoE grumble 2m patch grumble* AFAICT, OM4 is to OM3 what G.657A2 is to G.652 - completely interchangeable, especially for such a short run, just don't expect to wrap it around a pencil. And so I can swap out these stupidly long cables with properly measured OM3. Is this sensible? Thanks, Jed. Sent from a small screen.

3 3

slides for nznog 2014
by Joel van Velden 27 Mar '14

27 Mar '14

Hi list I seem to have lost the URL (someone's owncloud?) for where nznog '14 slides were posted to. Does anyone still have it? Regards, Joel van Velden

2 1

DNSSEC in .au
by Adam King 26 Mar '14

26 Mar '14

auDA has announced it will be introducing DNSSEC into the .au domain space in an experimental capacity. Deployment on production servers will commence during April and will be trialled for 4 months. The .au DS records will_not be added to the root zone during this period. Operators should_not create or implement trust anchors for .au in their production environments during this experimental phase. A mailing list has been created for all future announcements related to DNSSEC in .au, if you wish to subscribe to this mailing list please visit http://www.lists.auda.org.au/mailman/listinfo/dnssec-announce For further information about the implementation of DNSSEC in .au please see http://www.auda.org.au/industry-information/au-domains/dnssec/. Kind Regards, Adam King | CTO .au Domain Administration Ltd T: +61 3 8341 4111 | F: +61 3 8341 4112 E: adam.king(a)auda.org.au | W:www.auda.org.au Twitter: @auda | Blog: www.auda.org.au/blog/ auDA - Australia's Domain Name Administrator Important Notice This email may contain information which is confidential and/or subject to legal privilege, and is intended for the use of the named addressee only. If you are not the intended recipient, you must not use, disclose or copy any part of this email. If you have received this email by mistake, please notify the sender and delete this message immediately.

2 1

Home Grown RPKI Validators
by Bill Walker 25 Mar '14

25 Mar '14

Hi All, Now I have solved my ROA issue, (Thanks Dean & Michael) I'd like to look at building an RPKI validator, does anyone have any experience with these? Thanks, Bill

1 0

12ish U cabinets in Wellington?
by Michael Fincham 23 Mar '14

23 Mar '14

Hi all, Anyone have a 12ish U cabinet in Wellington they'd like to be rid of? Will swap for beer or small amounts of money. Would prefer one with solid doors on front / back. I can come collect if it it'll fit in a taxi :) -- Michael

1 0

Re: [nznog] NZNOG Digest, Vol 135, Issue 16
by Jonathan Spence 23 Mar '14

23 Mar '14

Remember some ISPs could be at national peering locations e.g. iinet peer ate APE do they not? If its your intention to save on traffic costs the BGP route is probably OK but using a proper service is more desirable overall. Jonathan Spence Chief Executive Officer Fixed: +64 9 9510448 Mobile: +64211055634 ---------------------------------------- From: nznog-request(a)list.waikato.ac.nz Sent: Monday, March 24, 2014 12:00 PM To: nznog(a)list.waikato.ac.nz Subject: NZNOG Digest, Vol 135, Issue 16 Send NZNOG mailing list submissions to nznog(a)list.waikato.ac.nz To subscribe or unsubscribe via the World Wide Web, visit http://list.waikato.ac.nz/mailman/listinfo/nznog or, via email, send a message with subject or body 'help' to nznog-request(a)list.waikato.ac.nz You can reach the person managing the list at nznog-owner(a)list.waikato.ac.nz When replying, please edit your Subject line so it is more specific than "Re: Contents of NZNOG digest..." Today's Topics: 1. List of NZ IP addresses? (Clark Mills) 2. Re: List of NZ IP addresses? (Tony Wicks) 3. Re: List of NZ IP addresses? (Clark Mills) 4. Re: List of NZ IP addresses? (Peter Lambrechtsen) 5. Re: List of NZ IP addresses? (Bill Walker) 6. Re: List of NZ IP addresses? (Damian Kissick) 7. Re: List of NZ IP addresses? (Scott Howard) 8. Re: List of NZ IP addresses? (Rob McDonald) 9. Re: List of NZ IP addresses? (Gareth Davies) 10. Re: List of NZ IP addresses? (Lindsay Hill) 11. Re: List of NZ IP addresses? (Richard Naylor) ---------------------------------------------------------------------- Message: 1 Date: Mon, 24 Mar 2014 08:51:30 +1300 From: Clark Mills <c.mills(a)auckland.ac.nz> To: nznog(a)list.waikato.ac.nz Subject: [nznog] List of NZ IP addresses? Message-ID: <532F3B42.90609(a)auckland.ac.nz> Content-Type: text/plain; charset="utf-8"; Format="flowed" Hi all. I realise that it's a constantly changing list but does anyone have a list on NZ IPs? Why: We're trying to set up a website to be accessible in NZ only. Knowing what I know then firewalling is the tool (a man with a hammer...) but I need to routinely source a more recent list. Any suggestions or hints appreciated. Cheers... Clark

1 0

Re: [nznog] List of NZ IP addresses?
by Richard Naylor 23 Mar '14

23 Mar '14

At 09:50 a.m. 24/03/2014, you wrote: >2 votes for maxmind. (or bgp feed with communities or something from >your ISP) it depends if you are trying to firewall for cost reasons, >eg: I don't want to serve my HD content to international viewers >because it will bankrupt me. Or I don't want to serve my >international content to international viewers because it would >breach a license agreement with the rights holder. The tier-1 CDNs all offer more than enough filtering to do very decent geo-fencing. So its not hard to limit to "NZ-only" or "everywhere but not nz". Sometimes we use that as the second line of defence. Rights agreements often require 2 levels or more.

1 0

List of NZ IP addresses?
by Clark Mills 23 Mar '14

23 Mar '14

Hi all. I realise that it's a constantly changing list but does anyone have a list on NZ IPs? Why: We're trying to set up a website to be accessible in NZ only. Knowing what I know then firewalling is the tool (a man with a hammer...) but I need to routinely source a more recent list. Any suggestions or hints appreciated. Cheers... Clark

9 9

RPKI and ROA
by Bill Walker 19 Mar '14

19 Mar '14

Hi All, Hoping someone can help. I am in the middle of a project to build 4 PoP's in Chicago, London, Sydney and Mumbai. As part of this I have been given the role of creating all the necessary Route objects etc. Our address space is from ARIN, but our ASN's are from RIPE, APNIC & ARIN. I have created as-set, aut-num and route objects in RADb to enable us to manage them from a single point. However I would like to setup ROA records for these route objects. I have setup RPKI with ARIN and created our first ROA object. Onto my question, am I likely to have operational issues if the route objects are in RADb and the ROA with ARIN? TIA, Bill

4 7

CityLink APE route server maintenance
by CityLink Ltd 18 Mar '14

18 Mar '14

On Sunday 23rd March 2014 between 18:00 and 21:00 the CityLink APE route server rs2.ape.nzix.net will be taken offline for building maintenance. Please make sure you also have a session configured with rs1.ape.nzix.netto ensure there is no loss of service. And a reminder that all NZIX customers should be configured with both route servers at each exchange for maximum resiliency. Customers who experience any problems with the service after the maintenance work should contact the CityLink 24 hour support number: Free call: 0800 4 CITYLINK (0800 424 895) Select: Option 3 Advise you have a fault with your CityLink service and include the relevant service reference number.

1 0

Google DNS 8.8.8.8/32
by Neil Fenemor 16 Mar '14

16 Mar '14

It seems 8.8.8.8/32 was hijacked yesterday for 22 minutes yesterday, affecting networks in Brazil and Venezuela. https://twitter.com/bgpmon/status/445266642616868864/photo/1 So about that RPKI thing…having a quick look (via whois.bgpmon.net) it seems Google does not have an ROA for 8.8.8.0/24. Yet another reason friends should not let friends use Google’s recursive resolvers. Perhaps their RIR doesn’t make it as easy as APNIC does to create ROA objects. Cheers, -- Neil Fenemor | +64 21 978 078 | Facetime | Skype

4 4

News: US to give up control of Internet administration
by Skeeve Stevens 15 Mar '14

15 Mar '14

Hi all, A very important announcement by NTIA/DoC/ICANN regarding the control of the Internet. This is an article from todays Commsday that very well explains the current situation. ...Skeeve -- *Commsday* - 17th March 2014 - www.commsday.com *US to give up control of Internet administration* The United States government says it will cede the Department of Commerce's legal authority over global Internet governance, but on condition that it approves of the system which replaces it. Late Friday afternoon, the National Telecommunications and Information Administration, under the DoC, said it wanted Internet domain governance to be subject to "multi-stakeholder" oversight and would oppose transition to an inter-governmental administration such as the International Telecommunications Union. Currently the DoC delegates oversight functions to the Internet Corporation for Assigned Names and Numbers which in turn works with various private and sector bodies such as the Internet Engineering Task Force, the Internet Architecture Board, the Internet Society, the Regional Internet Registries, top level domain name operators and VeriSign to administrate the Internet. "The timing is right to start the transition process," said Assistant Secretary of Commerce for Communications and Information Lawrence E. Strickling. "We look forward to ICANN convening stakeholders across the global Internet community to craft an appropriate transition plan." NTIA has communicated to ICANN that the transition proposal must have broad community support and address the following four principles: - Support and enhance the multi-stakeholder model; - Maintain the security, stability, and resiliency of the Internet DNS; - Meet the needs and expectation of the global customers and partners of ICANN's domain administration services; and, - Maintain the openness of the Internet. "Consistent with the clear policy expressed in bipartisan resolutions of the U.S. Senate and House of Representatives (S.Con.Res.50 and H.Con.Res.127), which affirmed the United States support for the multi-stakeholder model of Internet governance, NTIA will not accept a proposal that replaces the NTIA role with a government-led or an inter-governmental organisation solution," it said. AUSTRALIA BACKS US: The decision won the instant backing of Australian communications minister Malcolm Turnbull, who said he had discussed the plans with Strickling last week. Australia has been a steadfast ally of the US's opposition to a role for the ITU in Internet administration. Turnbull said "the Australian Government is absolutely committed to supporting an open Internet which is administered by multi stakeholder organisations like ICANN and NOT by governments whether in the form of consortia or multilateral organisations like the ITU or the UN." "The Internet is the most remarkable invention of our times and while it had its origins in research contracts with the US Government its growth, its dynamism, its resilience have all been the result of collaborative efforts by the wide Internet community not government regulation or fiat." "While it is all too common to complain about the US Government role in the Internet the truth is that the world owes the United States an extraordinary debt not just for giving birth to the Internet, but above all for giving it the freedom to develop into the extraordinary global platform it has become today." "The (ICANN subsidiary) Internet Assigned Numbers Authority contract with the US Department of Commerce expires in September 2015 and today I assured the President of ICANN, Mr Fadi Chehade, that the Australian Government will provide all the support it can to ICANN's efforts to develop a structure of governance that will meet the US Department of Commerce's vitally important conditions of removing itself from the IANA arrangements at the heart of the Internet. DOMESTIC OPPOSITION TO CHANGE: However, the decision did not receive bipartisan support in the United States with Republican politicians and advisers defending the status quo and warning of the consequences of global control of Internet administration. Former House speaker Newt Gingrich said "Every American should worry about Obama giving up control of the internet to an undefined group. This is very, very dangerous. What is the global internet community that Obama wants to turn the internet over to? This risks foreign dictatorships defining the internet." A former State Department adviser under the Bush administration, Christian Whiton, said "US management of the internet has been exemplary and there is no reason to give this away -- especially in return for nothing. This is the Obama equivalent of Carter's decision to give away the Panama Canal -- only with possibly much worse consequences." GROWING PUSH AGAINST US: However, the US move has been interpreted by others as an early strike against what are likely to be persistent efforts to globalise the Internet's administration on terms which may prove unacceptable to the United States and its allies. Following unsuccessful attempts by China, Russia and the Arab bloc to have the ITU assume Internet governance functions in late 2012, there has been renewed pressure to change the status quo following the so-called Snowden revelations last year regarding pervasive US surveillance of foreign powers and individuals using Internet and telecom platforms. Brazil, one of the leading critics of the US, plans its own global Internet multi-stakeholder forum in late April in order to seize the initiative on how a post-US Internet might be shaped. Anti-US governmental members of the ITU are expected to revive their efforts in support of that organisation assuming Internet control when it convenes in South Korea for its plenipotentiary in November. The last ITU vote on these matters saw around 90 countries, led by China, Russia and the Arab world, support new regulations to "nationalise" the Internet and around 55, led by the US and its allies, support the status quo or a "multi-stakeholder" approach akin to the status quo, where specialist private and technical organisations such as ICANN perform management roles. Paul Rosenzweig, who served as a senior homeland security official under former President George W. Bush, opined "the move by the United States to start this transition now is either very canny or panicked. The optimist in me wants to think that the transition to ICANN management is an effort to forestall an even worse result from takeover of network administration by the ITU. It may be that allowing ICANN a controlling role will placate our European allies and prevent the ITU meeting in Busan, South Korea from becoming a debacle." "The pessimist, however, sees this as a reaction to the Snowden disclosures. All of a sudden American stewardship of the network is suspect. Some, hoping to defuse the anger, may have chosen to rush to give up that stewardship, without thinking through the consequences." Malcolm Turnbull also agreed that the US decision opened up a Pandora's box of challenges for those who think the existing system is generally successful. "There is a lot of work to do to support ICANN in transitioning to a new model and the Australian Government, committed as it is to a multi-stakeholder system of governance, will work with the Australian and global Internet community including other governments to ensure that the Internet remains free, stable and resilient and continues to be a powerful platform for freedom around the world," he said Grahame Lynch --- To get access to great articles like this, often before the mainstream media, please subscribe to Commsday - www.commsday.com ...Skeeve *Skeeve Stevens - *eintellego Networks Pty Ltd skeeve(a)eintellegonetworks.co.nz ; www.eintellegonetworks.co.nz Phone: +612 8014 7398; Cell +61 (0)414 753 383 ; skype://skeeve facebook.com/eintellegonetworks ; <http://twitter.com/networkceoau> linkedin.com/in/skeeve twitter.com/theispguy ; blog: www.theispguy.com The Experts Who The Experts Call Juniper - Cisco - Cloud - Consulting - IPv4 Brokering

1 0

Re: [nznog] Andy Linton in the news as holder of a key to the internet
by Dominic Driver 12 Mar '14

12 Mar '14

One key to secure them all... I for one am delighted to know that such an honourable man is one of the few entrusted with such responsibility. On 3 Mar 2014 22:42, Nigel Roberts <nigel(a)nobiscuit.com> wrote: > > As spotted over here in the fairfax papers: > > http://www.theage.com.au/it-pro/security-it/meet-andy-linton-one-of-the-few… > > I think I’d get sick of the key holder (master?) jokes, too. Thanks for your good work Andy. > > Nigel > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog

2 1

Bitstream 3a MAC limits
by Dave Mill 12 Mar '14

12 Mar '14

Hi all I know the answer to my question here is likely hidden deep in a PDF somewhere but someone on this list may know the answer off hand. I see that Bitstream 3a has a 64 MAC limit. What doesn't seem clear to me is if this MAC limit is a customer ONT port MAC limit, or a MAC limit for the entire customer S-VID. I had always assumed it was a limit on MACs that can be sourced from the customer ONT port but am I wrong? Is it a MAC limit on the total number of MACs that can be learnt over the entire customer S-VID (src'ed from either the provider or customer end of the link)? I'm extracting the 64 MAC limit from this document here - http://www.crownfibre.govt.nz/wp-content/uploads/2013/01/Chorus-UFB-Service… Any feedback, especially this afternoon, would be very useful. Provider is UFF. I am not really wanting to debate why someone would want that number of MACs over a BS3 connection and why some layer 3 should probably be involved here.... Cheers Dave

4 4

TVNZ On Demand
by Barry Murphy 12 Mar '14

12 Mar '14

Hey guys, wondering if anyone from TVNZ On Demand is on this list and wouldn't mind contacting me offlist regarding problems streaming if a user has an IPv6 address. The helpdesk doesn't appear to know what ipv6 is so thought I'd try an alternative. Many thanks Barry

2 1

IPv6 redundancy
by Jonathan Spence 10 Mar '14

10 Mar '14

Hi all, I started a thread on the IPv6 group on LinkedIn in regards to this but.... What is the best way to provide redundant connectivity to SMBs with IPv6? Using v4 with NAT is easy with most routers but v6 is harder. Shim6 seems to be a good idea but looks to be a dead duck. People in that thread were advocating full AS and BGP but I don't think that is easy for most SMBs unless their IT support is top notch and trained (which lets face it, most don't even know how to screw in a lightbulb). It also may mess up global routing tables causing them to get much bigger. Any ideas? Jonathan Spence Chief Executive Officer Fixed: +64 9 9510448 Mobile: +64211055634

2 1

Web audio collection
by Richard Hulse 10 Mar '14

10 Mar '14

Radio NZ has an audio collection for the web's birthday: http://www.radionz.co.nz/collections/world-wide-web Featuring Vint Cerf, Tim Berners-Lee and Andy Linton. Add beer as required.

1 0

Turning on DNSSEC validation - you know you want to!
by Andy Linton 10 Mar '14

10 Mar '14

>From this posting: http://www.internetsociety.org/deploy360/blog/2014/01/circleid-dns-security… I like this quote: However, on the recursive resolver side, I am much more of a fan of having the DNS resolution occur as close to the end user as possible. This is particularly true when you enable DNSSEC validation.

1 0

Some discussion starters from APRICOT 37
by Michael Fincham 09 Mar '14

09 Mar '14

Hi all, I recently had the pleasure of attending APRICOT 37 (many thanks to the NZNOG and InternetNZ folks, and others, who made this possible!) and felt that there were some interesting topics discussed that may be worth bringing back to the NZNOG community. Here's an unsorted and terse list of some things I thought worthwhile: -> We need to stop looking at Alexa's "top 100" websites for IPv6 support and being disappointed - we need to be looking at a much smaller proportion of the "top sites" as this is where "all of the traffic" is actually going. Facebook, YouTube, Google, Wikipedia, Akamai and GGC cache nodes. It's a port 80 world and a few sites dominate :) -> Some big providers (T-Mobile, Telstra AU) talked about having rolled out IPv6 in various forms (single stack v6, dual stack with CGNAT on v4 and native v6) to their mobile subscriber base with approximately no support impact. A common theme: "We need to test IPv6 before deploying it!" "What testing did you do with IPv4?" "None" "Well do that with IPv6 too!" -> Paraphrasing: "Customers don't know what IPv4 is to begin with, so they sure don't know or care what IPv6 is." -> These operators reported seeing /40%/ of the traffic on any given subscriber where dual stack was available going straight out to the native v6 Internet! This is a huge win if you're looking at deploying CGNAT as it means approximately half as much state needs to be kept on your expensive CGNAT boxes, and half as much traffic is being molested on the way from the customer to the 'net :) It also means you should definitely be rolling out dual stack alongside your CGNAT :) -> 464XLAT (http://tools.ietf.org/html/rfc6877) looks like it's about to be a big deal in the mobile IPv6 space. In short, 464XLAT allows for phones to run single stack native IPv6 while applications on the phone can continue to access v4 literals etc if required. Makes use of a clever combination of existing technologies. Only Android 4.3+ supports this so far, but more phone support shouldn't be far away. To me this looks like it would be a killer feature to have on fixed line CPEs, though I am unclear how it would interact with the type of NAT these CPEs typically perform (though this ought not be too far away from a tethering scenario on a phone). -> Geoff Huston's closing presentation on the state of BGP in 2013 contained some interesting measurements and insights about how worried we should be able router performance and so on. The video (https://www.youtube.com/watch?feature=player_detailpage&v=e4N9ELoM76M#t=1798) and slides (https://conference.apnic.net/data/37/2014-02-27-bgp2013_1392943641.pdf) are worth a look if you have ~ 20 minutes. Since the NZNOG list has been more alive of late, I'd welcome discussion on any of these points as certainly there is plenty here that is relevant to NZ :) -- Michael Fincham System Administrator, Unleash Office: 0800 750 250

2 2

ICONZ-Webvisions (NZ) to close Open DNS Resolvers
by Mark Foster 05 Mar '14

05 Mar '14

Hi folks ICONZ-Webvisions (the entity formerly known simply as ICONZ in NZ) will be blocking external access to our recursive DNS servers to non-customer subnets on the evening of 6 March 2014. In the knowledge that there may well be former customers or third-parties who have hard-coded the IP's of our DNS servers into their configs (or their customer configs) I'm giving notice now; the following IP's will cease to provide DNS resolution to clients outside of our network space, at that time: 210.48.65.1 210.48.65.2 210.48.66.1 210.48.66.2 Customers with concerns about this change are invited to contact our Customer Care team on 0800 843 638 or via support.nz(a)iconz-webvisions.com<mailto:support.nz(a)iconz-webvisions.com>. Regards Mark. -- Mark Foster Technical Services Manager - Australia & New Zealand [iconz-webvisions-logo-png] www.iconz-webvisions.com<https://webmail.iconz.net/owa/redir.aspx?C=ToykmhkSsEaPr3XJN6nrf-rRV-b9iM8I…> ICONZ-Webvisions, ICONZ House, 60 Airedale Street, Auckland 1010, New Zealand

2 2

NZNOG 2014 videos
by Richard Naylor 05 Mar '14

05 Mar '14

Folks I just noticed an upgrade to the video player software had taken away the SD/HD control, or at least it wasn't explicitly obvious. There is a newer version that is slightly better, but I've rolled back a release so that SD/HD is obvious. Comments/feedback appreciated. They can be off list to save clutter. Also is HD worth it ? Richard

1 0

RFC 7149 -- SDN
by Sebastian Castro 05 Mar '14

05 Mar '14

Hi: Given SDN has been a buzzword within NZNOG, I would recommend RFC 7149 as reading for those interested: http://www.rfc-editor.org/rfc/rfc7149.txt SDN: A perspective from within a Service Provider Environment Cheers -- Sebastian Castro Technical Research Manager .nz Registry Services (New Zealand Domain Name Registry Limited) desk: +64 4 495 2337 mobile: +64 21 400535

1 0

NZNOG conference dates for the next hundred years
by Dean Pemberton 03 Mar '14

03 Mar '14

Hi All >From time to time we run into people who claim that we keep moving the NZNOG conference dates around. Normally this is because NZNOG happens to conflict with another conference that they might want to go to. The official policy is.. "The last full usable week in January" I'm just about the give the NZNOG update at the APRICOT meeting in Kuala Lumpur. So I thought I'd solve the problem once and for all. Here are the conference dates for the next hundred years along with a script to check which a particular year. I might have a couple of these wrong and we do reserve the right to change them if required, but they are a good place to start. #!/usr/bin/perl -w use strict ; use DateTime ; use feature qw( say ) ; my $year = $ARGV[ 0 ]; my $dt = DateTime->last_day_of_month( year => $year , month => 1 ) ; while ( $dt->day_of_week != 5 ) { $dt->subtract( days => 1 ) ; } my $nznogenddate = $dt->dmy; $dt->subtract (days => 5) ; my $nznogstartdate = $dt->dmy; print ("In $year NZNOG will be held from $nznogstartdate to $nznogenddate\n") ; $ for i in `seq 2015 1 2115`; do ./dates.pl $i ; done In 2015 NZNOG will be held from 25-01-2015 to 30-01-2015 In 2016 NZNOG will be held in conjunction with APRICOT 2016, Auckland In 2017 NZNOG will be held from 22-01-2017 to 27-01-2017 In 2018 NZNOG will be held from 21-01-2018 to 26-01-2018 In 2019 NZNOG will be held from 20-01-2019 to 25-01-2019 In 2020 NZNOG will be held from 26-01-2020 to 31-01-2020 In 2021 NZNOG will be held from 24-01-2021 to 29-01-2021 In 2022 NZNOG will be held from 23-01-2022 to 28-01-2022 In 2023 NZNOG will be held from 22-01-2023 to 27-01-2023 In 2024 NZNOG will be held from 21-01-2024 to 26-01-2024 In 2025 NZNOG will be held from 26-01-2025 to 31-01-2025 In 2026 NZNOG will be held from 25-01-2026 to 30-01-2026 In 2027 NZNOG will be held from 24-01-2027 to 29-01-2027 In 2028 NZNOG will be held from 23-01-2028 to 28-01-2028 In 2029 NZNOG will be held from 21-01-2029 to 26-01-2029 In 2030 NZNOG will be held from 20-01-2030 to 25-01-2030 In 2031 NZNOG will be held from 26-01-2031 to 31-01-2031 In 2032 NZNOG will be held from 25-01-2032 to 30-01-2032 In 2033 NZNOG will be held from 23-01-2033 to 28-01-2033 In 2034 NZNOG will be held from 22-01-2034 to 27-01-2034 In 2035 NZNOG will be held from 21-01-2035 to 26-01-2035 In 2036 NZNOG will be held from 20-01-2036 to 25-01-2036 In 2037 NZNOG will be held from 25-01-2037 to 30-01-2037 In 2038 NZNOG will be held from 24-01-2038 to 29-01-2038 In 2039 NZNOG will be held from 23-01-2039 to 28-01-2039 In 2040 NZNOG will be held from 22-01-2040 to 27-01-2040 In 2041 NZNOG will be held from 20-01-2041 to 25-01-2041 In 2042 NZNOG will be held from 26-01-2042 to 31-01-2042 In 2043 NZNOG will be held from 25-01-2043 to 30-01-2043 In 2044 NZNOG will be held from 24-01-2044 to 29-01-2044 In 2045 NZNOG will be held from 22-01-2045 to 27-01-2045 In 2046 NZNOG will be held from 21-01-2046 to 26-01-2046 In 2047 NZNOG will be held from 20-01-2047 to 25-01-2047 In 2048 NZNOG will be held from 26-01-2048 to 31-01-2048 In 2049 NZNOG will be held from 24-01-2049 to 29-01-2049 In 2050 NZNOG will be held from 23-01-2050 to 28-01-2050 In 2051 NZNOG will be held from 22-01-2051 to 27-01-2051 In 2052 NZNOG will be held from 21-01-2052 to 26-01-2052 In 2053 NZNOG will be held from 26-01-2053 to 31-01-2053 In 2054 NZNOG will be held from 25-01-2054 to 30-01-2054 In 2055 NZNOG will be held from 24-01-2055 to 29-01-2055 In 2056 NZNOG will be held from 23-01-2056 to 28-01-2056 In 2057 NZNOG will be held from 21-01-2057 to 26-01-2057 In 2058 NZNOG will be held from 20-01-2058 to 25-01-2058 In 2059 NZNOG will be held from 26-01-2059 to 31-01-2059 In 2060 NZNOG will be held from 25-01-2060 to 30-01-2060 In 2061 NZNOG will be held from 23-01-2061 to 28-01-2061 In 2062 NZNOG will be held from 22-01-2062 to 27-01-2062 In 2063 NZNOG will be held from 21-01-2063 to 26-01-2063 In 2064 NZNOG will be held from 20-01-2064 to 25-01-2064 In 2065 NZNOG will be held from 25-01-2065 to 30-01-2065 In 2066 NZNOG will be held from 24-01-2066 to 29-01-2066 In 2067 NZNOG will be held from 23-01-2067 to 28-01-2067 In 2068 NZNOG will be held from 22-01-2068 to 27-01-2068 In 2069 NZNOG will be held from 20-01-2069 to 25-01-2069 In 2070 NZNOG will be held from 26-01-2070 to 31-01-2070 In 2071 NZNOG will be held from 25-01-2071 to 30-01-2071 In 2072 NZNOG will be held from 24-01-2072 to 29-01-2072 In 2073 NZNOG will be held from 22-01-2073 to 27-01-2073 In 2074 NZNOG will be held from 21-01-2074 to 26-01-2074 In 2075 NZNOG will be held from 20-01-2075 to 25-01-2075 In 2076 NZNOG will be held from 26-01-2076 to 31-01-2076 In 2077 NZNOG will be held from 24-01-2077 to 29-01-2077 In 2078 NZNOG will be held from 23-01-2078 to 28-01-2078 In 2079 NZNOG will be held from 22-01-2079 to 27-01-2079 In 2080 NZNOG will be held from 21-01-2080 to 26-01-2080 In 2081 NZNOG will be held from 26-01-2081 to 31-01-2081 In 2082 NZNOG will be held from 25-01-2082 to 30-01-2082 In 2083 NZNOG will be held from 24-01-2083 to 29-01-2083 In 2084 NZNOG will be held from 23-01-2084 to 28-01-2084 In 2085 NZNOG will be held from 21-01-2085 to 26-01-2085 In 2086 NZNOG will be held from 20-01-2086 to 25-01-2086 In 2087 NZNOG will be held from 26-01-2087 to 31-01-2087 In 2088 NZNOG will be held from 25-01-2088 to 30-01-2088 In 2089 NZNOG will be held from 23-01-2089 to 28-01-2089 In 2090 NZNOG will be held from 22-01-2090 to 27-01-2090 In 2091 NZNOG will be held from 21-01-2091 to 26-01-2091 In 2092 NZNOG will be held from 20-01-2092 to 25-01-2092 In 2093 NZNOG will be held from 25-01-2093 to 30-01-2093 In 2094 NZNOG will be held from 24-01-2094 to 29-01-2094 In 2095 NZNOG will be held from 23-01-2095 to 28-01-2095 In 2096 NZNOG will be held from 22-01-2096 to 27-01-2096 In 2097 NZNOG will be held from 20-01-2097 to 25-01-2097 In 2098 NZNOG will be held from 26-01-2098 to 31-01-2098 In 2099 NZNOG will be held from 25-01-2099 to 30-01-2099 In 2100 NZNOG will be held from 24-01-2100 to 29-01-2100 In 2101 NZNOG will be held from 23-01-2101 to 28-01-2101 In 2102 NZNOG will be held from 22-01-2102 to 27-01-2102 In 2103 NZNOG will be held from 21-01-2103 to 26-01-2103 In 2104 NZNOG will be held from 20-01-2104 to 25-01-2104 In 2105 NZNOG will be held from 25-01-2105 to 30-01-2105 In 2106 NZNOG will be held from 24-01-2106 to 29-01-2106 In 2107 NZNOG will be held from 23-01-2107 to 28-01-2107 In 2108 NZNOG will be held from 22-01-2108 to 27-01-2108 In 2109 NZNOG will be held from 20-01-2109 to 25-01-2109 In 2110 NZNOG will be held from 26-01-2110 to 31-01-2110 In 2111 NZNOG will be held from 25-01-2111 to 30-01-2111 In 2112 NZNOG will be held from 24-01-2112 to 29-01-2112 In 2113 NZNOG will be held from 22-01-2113 to 27-01-2113 In 2114 NZNOG will be held from 21-01-2114 to 26-01-2114 In 2115 NZNOG will be held from 20-01-2115 to 25-01-2115

9 8

Re: [nznog] OT: Ethernet
by Scott Weeks 03 Mar '14

03 Mar '14

--- richard.naylor(a)R2.co.nz wrote: From: Richard Naylor <richard.naylor(a)R2.co.nz> Been some celebrations recently over ethernet. Going from 10Mbps to 100Gbps over 40 years. ------------------------------------------ Late reply, but to inspire those who have (have had) managers that just don't understand what you're doing... :-) http://b2b.cbsimg.net/blogs/19740305-xerox-ethernet-memo1.jpg scott _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Andy Linton in the news as holder of a key to the internet
by Nigel Roberts 02 Mar '14

02 Mar '14

As spotted over here in the fairfax papers: http://www.theage.com.au/it-pro/security-it/meet-andy-linton-one-of-the-few… I think I’d get sick of the key holder (master?) jokes, too. Thanks for your good work Andy. Nigel

1 0

OT: Ethernet
by Richard Naylor 28 Feb '14

28 Feb '14

Been some celebrations recently over ethernet. Going from 10Mbps to 100Gbps over 40 years. http://www.eetimes.com/document.asp?doc_id=1263267&page_number=1 You might find it interesting reading. The call for participation in 400Gbps ethernet was made about a year ago. Interesting points (other than the historical stuff) + 10G NICs will surpass 1G in 2015. Interesting to see fall of 100Mbps. + Graph showing ATM fall off and rise of ethernet in Telco cores. Hilarious from my point of view. The first switch at CityLink was a dual ethernet/ATM one. We never had much of an ATM network because we couldn't afford the second switch ! A shareholder did loan us two, but they were multi-mode fiber and so wasn't much use. No customers wanted ATM due to the cost. None of the telcos took us seriously because we used ethernet. About 6 or 7 years later both Telecom and Clear developed ethernet products. Occasionally we showed people our pole mounted ethernet switches, running PoE, but no one really understood it. James Watts in PNN did and ran some of it. Cheaper fiber replaced it. We also had pole mounted Linux routers that we used for WiF point to point links. Another story.

1 0

IANA AS Numbers registry update
by Selina Harrington 28 Feb '14

28 Feb '14

The IANA AS Numbers registry has been updated to reflect the allocation of 2 blocks to the RIPE NCC in 2014-02-28: 200192-201215 201216-202239 You can find the IANA AS Numbers registry at: http://www.iana.org/assignments/as-numbers/as-numbers.xml Regards, Selina Harrington ******************************************* Internet Assigned Numbers Authority (IANA) Internet Corporation for Assigned Names & Numbers 12025 Waterfront Drive, Suite 300 Los Angeles, CA 90094 Phone: +1 310 301 5800 Fax: +1-310-823-8649 *******************************************

1 0

What's the BCP/RFC that says that routers within an ISP network should not have RFC1918 link IPs?
by Matt Grant 27 Feb '14

27 Feb '14

Hi! Know I am some small fry on the list, but your help would be appreciated. This would be useful in talking to my ISP about some PMTU issues that I am having re a VPN going over PPPoE, with MTU 1480. Thanks! Matt Grant

11 11

[OT] {Humour} NCSC.govt.nz traceroute
by Alexander Neilson 26 Feb '14

26 Feb '14

The trusted guardian of NZ Information Assets. So where do they host this important guardian of our assets, of course they would host it here in Wellington wouldn’t they, maybe a backup in Auckland Serenity:~ alexander$ traceroute ncsc.govt.nz traceroute to ncsc.govt.nz (199.83.134.194), 64 hops max, 52 byte packets 1 172.31.2.1 (172.31.2.1) 0.548 ms 0.215 ms 0.191 ms 2 192.168.1.1 (192.168.1.1) 0.324 ms 0.296 ms 0.275 ms 3 113.197.96.18 (113.197.96.18) 4.058 ms 3.873 ms 4.489 ms 4 103.9.216.18 (103.9.216.18) 10.866 ms 10.734 ms 27.593 ms 5 103.9.216.19 (103.9.216.19) 10.699 ms 10.737 ms 10.956 ms 6 203.167.218.185 (203.167.218.185) 13.539 ms 11.339 ms 10.953 ms 7 ge-0-2-0-914.xcore1.acld.telstraclear.net (203.98.42.17) 11.106 ms 11.315 ms 10.950 ms 8 unknown.telstraglobal.net (134.159.174.37) 14.115 ms unknown.telstraglobal.net (134.159.174.41) 13.334 ms unknown.telstraglobal.net (134.159.174.37) 14.271 ms 9 i-0-0-4-1.tlot-core01.bx.telstraglobal.net (202.84.142.106) 136.672 ms i-0-0-4-0.tlot-core01.bx.telstraglobal.net (202.84.142.118) 138.917 ms i-0-6-4-1.tlot-core01.bx.telstraglobal.net (202.84.142.114) 138.757 ms 10 i-0-4-0-0.eqla01.bi.telstraglobal.net (202.84.251.174) 136.206 ms i-0-4-0-7.eqla01.bi.telstraglobal.net (202.40.149.254) 137.496 ms i-0-4-0-0.eqla01.bi.telstraglobal.net (202.84.251.174) 137.301 ms 11 nlayer-peer.eqla01.pr.telstraglobal.net (134.159.61.42) 143.708 ms 136.787 ms 140.136 ms 12 ae0-110g.cr1.lax1.us.nlayer.net (69.31.127.137) 138.668 ms ae0-110g.cr1.lax1.us.nlayer.net (69.31.127.141) 137.965 ms ae0-110g.cr1.lax1.us.nlayer.net (69.31.127.137) 136.064 ms 13 xe-5-3-0.cr1.iah1.us.nlayer.net (69.22.142.121) 167.796 ms 167.996 ms 168.156 ms 14 xe-3-1-1.cr1.dfw1.us.nlayer.net (69.22.142.3) 171.539 ms 194.181 ms 193.122 ms 15 xe-0-2-1.cr1.ord1.us.nlayer.net (69.22.142.4) 190.842 ms 190.634 ms 190.443 ms 16 ae0-60g.cr2.ord1.us.nlayer.net (69.31.111.154) 191.285 ms 190.151 ms 189.922 ms 17 ae2-20g.ar1.ord6.us.nlayer.net (69.31.110.254) 192.570 ms 195.793 ms 195.315 ms 18 * * * 19 * * * 20 * * * 21 * * * mmmmm. that looks like a long trip to Wellington or Auckland Whois that IP: Serenity:~ alexander$ whois 199.83.134.194 # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html # # # Query terms are ambiguous. The query is assumed to be: # "n 199.83.134.194" # # Use "?" to get help. # # # The following results may also be obtained via: # http://whois.arin.net/rest/nets;q=199.83.134.194?showDetails=true&showARIN=… # NetRange: 199.83.128.0 - 199.83.135.255 CIDR: 199.83.128.0/21 OriginAS: AS19551 NetName: INCAPSULA NetHandle: NET-199-83-128-0-1 Parent: NET-199-0-0-0-0 NetType: Direct Assignment RegDate: 2011-01-14 Updated: 2012-02-24 Ref: http://whois.arin.net/rest/net/NET-199-83-128-0-1 OrgName: Incapsula Inc OrgId: INCAP-5 Address: 3500 SOUTH DUPONT HIGHWAY City: Dover StateProv: DE PostalCode: 19901 Country: US RegDate: 2010-09-15 Updated: 2014-02-25 Ref: http://whois.arin.net/rest/org/INCAP-5 OrgAbuseHandle: INCAP1-ARIN OrgAbuseName: Incapsula AbuseDesk OrgAbusePhone: +1-866-250-7659 OrgAbuseEmail: abuse(a)incapsula.com OrgAbuseRef: http://whois.arin.net/rest/poc/INCAP1-ARIN OrgTechHandle: INCAP2-ARIN OrgTechName: Incapsula Operations OrgTechPhone: +1-866-250-7659 OrgTechEmail: ip(a)incapsula.com OrgTechRef: http://whois.arin.net/rest/poc/INCAP2-ARIN OrgNOCHandle: INCAP2-ARIN OrgNOCName: Incapsula Operations OrgNOCPhone: +1-866-250-7659 OrgNOCEmail: ip(a)incapsula.com OrgNOCRef: http://whois.arin.net/rest/poc/INCAP2-ARIN # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html # Serenity:~ alexander$ hmmmm, Delaware, now thats a funny place for it. It doesn’t seem to be any CDN or anything, I wonder if they are just going best price for their hosting, or does this path lead through the 5 Eyes network? Maybe our network lords and masters will be telling us to embed our network systems in foreign countries as part of our new approvals. Regards Alexander Alexander Neilson Neilson Productions Limited alexander(a)neilson.net.nz 021 329 681 022 456 2326

5 10

Open NTP servers in New Zealand.
by Dean Pemberton 26 Feb '14

26 Feb '14

Hi All, One of the sessions this morning was from Geoff Huston on the recent NTP server DDoS attacks. The presentation is here https://conference.apnic.net/data/37/2014-02-25-ntpddos_1392941955.pdf In short if you appear on the http://openntpproject.org/ list then you should be looking to clean this up before you contribute to global DDoS attacks the size of which we have not seen in the past. I've run the WIX and APE peering ASNs against the page and here are the number of open NTP servers. You can do this yourself by substituting your AS (instead of 9483) into the following URL http://openntpproject.org/searchby-asn.cgi?search_asn=9483 If you want it as a csv then use http://openntpproject.org/searchby-asn.cgi?search_asn=9483&csv=1 Here is the WIX & APE list. Bear in mind that this only covers the NTP servers which are in the AS that peers on the exchange. Not the customers of that AS. You should use the page above to check all your customer ASNs as well and work with them to patch any servers. WIX Open NTP servers 4823 total 709 AS4770 618 AS2687 603 AS9503 368 AS23838 304 AS23655 272 AS17746 256 AS18119 205 AS24183 187 AS45280 187 AS24466 158 AS18400 122 AS10022 118 AS18015 117 AS55454 91 AS9872 73 AS132040 63 AS24324 58 AS38477 53 AS18353 51 AS45177 39 AS17412 27 AS17435 25 AS42 23 AS9433 19 AS17705 17 AS24347 12 AS23905 10 AS8674 8 AS9834 4 AS24074 4 AS24005 4 AS17649 4 AS17484 3 AS38329 3 AS132003 3 AS12076 2 AS24006 1 AS7696 1 AS18021 1 AS17792 APE Open NTP servers 11877 total 2472 AS4739 1773 AS9889 1236 AS9738 709 AS4770 618 AS2687 603 AS9503 460 AS4826 368 AS23838 304 AS23655 285 AS45459 272 AS17746 256 AS18119 229 AS38333 205 AS24183 187 AS45280 187 AS24466 185 AS24130 158 AS18400 125 AS9790 125 AS9245 122 AS10022 118 AS18015 97 AS56030 91 AS9872 73 AS132040 63 AS24324 58 AS38477 53 AS18353 51 AS45177 44 AS58666 39 AS17412 37 AS55561 27 AS17435 26 AS9303 25 AS42 23 AS9898 23 AS9433 19 AS55752 19 AS17705 17 AS9431 16 AS18199 10 AS24398 10 AS23710 8 AS9834 7 AS17492 6 AS55785 5 AS9559 5 AS55872 4 AS24074 4 AS24005 4 AS17649 3 AS45946 3 AS12076 2 AS9897 2 AS9896 2 AS37974 1 AS38451 1 AS132347 1 AS132304 1 AS10200

12 13

IPAM software
by Glen Eustace 25 Feb '14

25 Feb '14

A year or maybe two back, Andy presented a demo of some software that CityLink were using that if I recall did both the IPAM And inventory function. I think it was an open source system from a US university but I can't remember what it was called. If you can can you let me know. Thanks. Glen.

6 10

Work Practices of Cyber Security Professionals
by Muhammad Adnan 24 Feb '14

24 Feb '14

Dear Sir/Madam, I am a university researcher who is investigating the development of new, usable tools that will improve the work practices of cyber security professionals. As a first step to achieve this goal, I am undertaking a survey to gain an in-depth understanding of the day-to-day activities of cyber security professionals. The targeted participants for this survey are those who perform security related activities as a part of their job (e.g. security analysts, network administrators, systems administrators, etc.). I would be very grateful if you could spare some time and complete this short (approx. 10-15 minutes) survey for me. It can be accessed at the following link: http://edu.surveygizmo.com/s3/1536165/Work-Practices-of-Cyber-Security-Prof… If you have questions or concerns about this research, please contact me ( Muhammad.Adnan(a)gcu.ac.uk) or my Ph.D. supervisor Dr. Mike Just ( Mike.Just(a)gcu.ac.uk), both at the Interactive and Trustworthy Technologies research group (http://www.ittgroup.org/) Glasgow Caledonian University, UK. Kind regards, Adnan

1 0

NZNOG 2014 Videos
by Richard Naylor 18 Feb '14

18 Feb '14

http://www.r2.co.nz/20140130/ The videos from NZNOG 2014 should be available about now. The CDN/cache is filling at the moment. If a file plays poorly, it could still be loading, so be patient. HD files also require a decent CPU to play. All talks except the Lightning talks are in both SD and HD. There is about 28GB of video. The lightning talks are numbered sequentially. I can add names and topics if a kind person sends me those details. Thanks for waiting patiently, there was a lot to get through while we were doing other jobs. rich

2 1

Those RPKI stats
by Michael Fincham 18 Feb '14

18 Feb '14

Hi all, Firstly, thanks NZNOG folks for a great conference. In spite of getting sick and missing ~ 50% I'd still have to say I enjoyed myself :) It's been long enough now that we've probably all forgotten that I'd promised to pony up some more "interesting" RPKI stats at NZNOG, so just to keep you on your toes here they are. ---> First order of business: Did we really hijack the Internet? <--- Sadly no, we just broke BGPMON. It's a long story. ---> RPKI data for the IXes, "domestic transit" <--- I've published a fixed slide deck + some other potentially useful info on my personal website at: <http://hotplate.co.nz/archive/nznog/2014/rpki/> The website includes a link to a web based "relying party cache query tool" I've put together, for anyone interested in having a play with validating some "real world" route data. This tool is also available directly at <http://rpki-validator.lab.hotplate.co.nz/>. In short, the totals for the IXes look like this: APE: 64 invalid, 165 valid, 5474 unvalidated routes out of 3694 unique prefixes WIX: 48 invalid, 92 valid, 1875 unvalidated routes out of 1190 unique prefixes CHIX: 8 invalid, 48 valid, 769 unvalidated routes out of 728 unique prefixes A detailed breakdown of what's valid / invalid and "why" is available from the web page above, along with the raw data so these results can be replicated if desired. Does my data look dodgy or suspect? Is my methodology bogus? Probably! Please do let me know :) -- Michael Fincham

1 0

Interesting Adwords Advert..
by Craig Whitmore 18 Feb '14

18 Feb '14

I just noticed this today.. http://finch.am/scratch/dnc_discontent.png (This is what the advert looks like) It was an adwords advert I presume targeted towards NZers. Which links to.. http://dnc.org.nz/2ld-policy-amendments?gclid=CIzyxuPd1rwCFcEnpQodmFUAOQ Does anyone know who is paying for these adverts . As far as I know the new 2LD domain policy won¹t result in people loosing their .co.nz domain names. (Is this ³false² advertising?) Thanks Craig

2 3

LICA Boundaries
by Liam Farr 18 Feb '14

18 Feb '14

Hi, Does anyone out there know of or have an accurate definition of all the NZ LICA boundaries they could point me to or provide off list? Or otherwise be able to point me at the correct person to ask, Chorus / NAD / MBIE perhaps? I am trying to produce some sort of useful graphical tool, (e.g. google maps overlay) to assist a customer, where they can punch in an address and get the correct LICA displayed for that address. (I also have a stockpile of spare liquor if that helps :D). -- Kind Regards Liam Farr liamfarr(a)me.com +64-22-610-7884

3 2

Re: [nznog] LICA Boundaries
by Peter Lambrechtsen 18 Feb '14

18 Feb '14

Or the mapping folks from Chrous... I have some maps but don't think I will be allowed to share them :/ Sent from my phone on the smartphonetwork. -------- Original message -------- From: Peter Gent <Peter.Gent(a)mbie.govt.nz> Date: 19/02/2014 8:19 AM (GMT+12:00) To: NZNOG(a)list.waikato.ac.nz Subject: Re: [nznog] LICA Boundaries Hi, Have you tried contacting the people behind www.nad.ord.nz<http://www.nad.ord.nz> to start with? Regards Peter -----Original Message----- From: nznog-bounces(a)list.waikato.ac.nz [mailto:nznog-bounces(a)list.waikato.ac.nz] On Behalf Of Liam Farr Sent: Tuesday, 18 February 2014 11:32 p.m. To: Nznog List Subject: [nznog] LICA Boundaries Hi, Does anyone out there know of or have an accurate definition of all the NZ LICA boundaries they could point me to or provide off list? Or otherwise be able to point me at the correct person to ask, Chorus / NAD / MBIE perhaps? I am trying to produce some sort of useful graphical tool, (e.g. google maps overlay) to assist a customer, where they can punch in an address and get the correct LICA displayed for that address. (I also have a stockpile of spare liquor if that helps :D). -- Kind Regards Liam Farr liamfarr(a)me.com +64-22-610-7884 _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog http://newzealand.govt.nz/ - connecting you to New Zealand central & local government services Any opinions expressed in this message are not necessarily those of the Ministry of Business, Innovation and Employment. This message and any files transmitted with it are confidential and solely for the use of the intended recipient. If you are not the intended recipient or the person responsible for delivery to the intended recipient, be advised that you have received this message in error and that any use is strictly prohibited. Please contact the sender and delete the message and any attachment from your computer. _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Apologies
by Ray Taylor 17 Feb '14

17 Feb '14

I must apologise to the group. I have been a long time subscriber but don't post. Mailing list technology is a bit before my time so I was not exactly sure how I was to keep replies within the same thread / branch on the list archive. I was assuming if I forward to the list, it would place it in the correct thread much like a support ticketing system based on subject. Of course I was forwarding a few emails one after the other with responses and didn't see the particular email was sent to me off list. I shall go and find a how-to wiki on this mailing list stuff next time I need to post. With regards to my issue, I have our IP block / ASN advertised on our behalf by our upstream provider as we don't peer using BGP. The NOC at vocus replied to me and said somewhere along the chain there is an issue and they were most helpful in passing a message to whoever is responsible. As predicted by those who responded to my query, they were very fast in their response. Jonathan Brewer has quite rightly reminded me this is one of the woes of tier 7 bandwidth..something I should look at changing. Anyhow, thanks for the help Ray Taylor Taylor Communications ray(a)ruralkiwi.com Ph 021-483-280 Network status 06-929-9082 Description: header_logo

2 1

Re: [nznog] Vocus Contact
by Ray Taylor 17 Feb '14

17 Feb '14

I think it was more a BGP issue with our upstream's upstream. So hoping it isn't a vocus issue and something closer to us. Ray Taylor Taylor Communications <mailto:ray(a)ruralkiwi.com> ray(a)ruralkiwi.com Ph 021-483-280 Network status 06-929-9082 Description: header_logo From: Liam Farr [mailto:liamfarr(a)me.com] Sent: Tuesday, 18 February 2014 8:29 p.m. To: Ray Taylor Subject: Re: [nznog] Vocus Contact Craig Spiers is the most cluefull console wielding guy at Vocus, if there is a real problem with their BGP routing there's a good chance it will eventually make its way to him. He's also not a dick :) Craig Spiers <craig.spiers(a)vocus.co.nz> -- Kind Regards Liam Farr liamfarr(a)me.com +64-22-610-7884 On 18/02/2014, at 5:02 pm, Ray Taylor <ray(a)ruralkiwi.com> wrote: Have we someone here within Vocus? I have an issue with our ip range not being routed correctly through vocus' network. Thanks. Ray Taylor Taylor Communications <mailto:ray(a)ruralkiwi.com> ray(a)ruralkiwi.com Ph 021-483-280 Network status 06-929-9082 <image001.png> _______________________________________________ NZNOG mailing list <mailto:NZNOG(a)list.waikato.ac.nz> NZNOG(a)list.waikato.ac.nz <http://list.waikato.ac.nz/mailman/listinfo/nznog> http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Vocus Contact
by Ray Taylor 17 Feb '14

17 Feb '14

Have we someone here within Vocus? I have an issue with our ip range not being routed correctly through vocus' network. Thanks. Ray Taylor Taylor Communications ray(a)ruralkiwi.com Ph 021-483-280 Network status 06-929-9082 Description: header_logo

5 6

Change of Trustee and Thank you
by Jamie Baddeley 17 Feb '14

17 Feb '14

HI Folks, Little bit of housekeeping on behalf of the NZNOG Trustees for those of you who missed the conference in Nelson this year. Shame you missed it, it was a beauty. As mentioned at the end of the Conference, Richard Nelson from the WAND group at Waikato University is the latest victim/trustee to join the fray. Thanks to Richard for saying yes. Also, this means that a self described "grey-haired, cantankerous old bastard living in Canada" is now able to spend more time doing what ever it is that he does when he's not being grey and cantankerous. I am of course talking about Joe Abley. He's no longer a trustee. For those of us who've been around a bit, and believe me Joe has, you'll know that he's contributed a great deal to the NZ Internet (and more!) over the years, even if most of it was last century. Well maybe not that long ago. So, with that, thanks Joe, and thanks Richard. cheers jamie

1 0

NTP reflection used for world's largest DDoS
by Juha Saarinen 16 Feb '14

16 Feb '14

http://www.itnews.com.au/News/372033,worlds-largest-ddos-strikes-us-europe.… Amplification factor: 58.5. -- Juha Saarinen twitter: juhasaarinen

21 32

Cisco Memory Issues
by Alexander Neilson 14 Feb '14

14 Feb '14

I saw alerts about this on AUSNOG but hadn’t seen anything on NZNOG yet so I posting it to make sure people know. http://www.itnews.com.au/News/372345,cisco-stung-by-switch-memory-glitch.as… http://www.cisco.com/web/about/doing_business/memory.html Regards Alexander

1 0

APRICOT 2014 - Remote Participation Registration
by Elly Tawhai 12 Feb '14

12 Feb '14

Hi NZNOG Community, I hope you are all looking forward to APRICOT 2014 which will start next week. The Workshops are from Tuesday, 18 to Saturday, 22 February 2014 and the Conference is from Monday, 24 to Friday, 28 February 2014. If you are unable to attend in person, you can still join the conference remotely. Some of the conference sessions will be broadcasted live. Please refer to the program for more information. http://2014.apricot.net/program Please note: Registration is now *mandatory* to watch the live webcast and participate remotely. Registration is free and you can register now to receive your login details https://apnic.ungerboeck.com/prod/emc00/register.aspx?OrgCode=10&EvtID=5824… I hope to see you all in person or online at APRICOT 2014. Regards APNIC Secretariat

1 0

Re: [nznog] Validating resolvers for DNS and DNSSEC
by Pete Mundy 12 Feb '14

12 Feb '14

Straight after the conference, I enabled validation on a resolver that handles in excess of 2 million queries/day. So far I have no negative impact to report either :) I support Andy & Dean's comments. Just turn it on already! Pete Mundy Wearer of Many Hats On 11/02/2014, at 12:20 PM, Dean Pemberton <nznog(a)deanpemberton.com> wrote: > Dave Mill (Inspire) stood up at NZNOG and clearly said that for them > that never happened. > > Just turn it on. > > On Tue, Feb 11, 2014 at 11:51 AM, Nathan Ward <nznog(a)daork.net> wrote: >> [SNIP] >> I've been talking about this with one of my customers recently, and there's >> a concern by some that turning on validation will trip false positives - >> which for an ISP is a bad thing to do - all the customer sees is that you >> 'don't work' while the other ISP does. >> >> Is there public data available re. this? Does it likely vary much for NZ? >> [SNIP] >> Nathan Ward

3 2

Technical Advisor, Harmful Digital Communications Bill
by Susan Chalmers 12 Feb '14

12 Feb '14

Hello NZNOG, I am developing InternetNZ's submission to the Justice and Electoral Committee on the Harmful Digital Communications Bill. I'd like to ask this list for some feedback on one issue in the Bill, in particular. Clause 15 of the Bill reads: Technical advisers - (1)A District Court or the High Court, as the case may be, may appoint a technical adviser to assist it in considering and determining an application for an order under section 17 or any appeal under section 72 of the District Courts Act 1947. (2)The duties of a technical adviser are-- - (a)to sit with the court; and - (b)subject to subsection (3), to act in all respects as an extra member of the court. (3)The court must appoint a technical adviser if the court is considering an application for an order under section 17(2)(a) or (b) or (3)(a). (4)The Judge may give any weight to the technical adviser's advice that the Judge thinks fit, and the Judge alone must determine the application or appeal. (5)The Minister must maintain a panel of persons who may be appointed under this section as technical advisers, and only persons named on the panel may be appointed under this section as technical advisers. (6)The chief executive must pay technical advisers the remuneration and allowances determined from time to time by the Minister. - For reference, the remedies referred to in cl 15(3) are: takedown of content/disabling access thereto; identification of an anonymous author; and, somewhat strangely, making an order against parties not before the court. *What I am after in the first instance relates to the advice of the technical advisor. * *If the advisor were to issue a report of some sort to the judge, explaining the impact - economic, administrative, technical - of a takedown order on the intermediary, what do you think that advice should cover? * How can this advice, if it were published, serve as evidence for policymakers in the future, helping them avoid making remedies (takedown orders, etc) that are a burden to intermediaries or have a negative technical impact? FWIW, I think that 17(2)(c) and (d) orders - publishing corrections and providing rights of reply - should also be considered in technical advice. There are of course, many different flavours of intermediaries. The OECD has categorised intermediaries in the following way: 1. ISPs (carriers) 2. hosting providers 3. search engines 4. e-commerce intermediaries 5. Internet payment systems, and 6. participative web platforms http://www.keepeek.com/Digital-Asset-Management/oecd/science-and-technology… For the purposes of the Bill, we can consider intermediaries in two broad categories - content hosts and IPAPs (functionally - the IPAP language is not in the Bill, but I believe that IPAPs (meaning carriers in their IP-matching function) could be read into the current definition of "online content host" in the interpretation section). Thanks to those interested for your time and consideration, and please pose questions if you have them. I'd be grateful for your feedback by COB Friday. Sincerely, Susan -- --- Susan Chalmers Senior Policy Advisor susan(a)internetnz.net.nz

1 0

References/Recommendations for IP & VoIP in USA
by Christoph Berthoud 12 Feb '14

12 Feb '14

Morning all, We have an office in the US (Los Angeles) and I'm having issues with our current internet provider and are looking to change. Does anyone from NZNOG have any references/recommendations they could give me for a supplier in LA that can provide decent IP & SIP trunk services? Replies off-list much appreciated :) -- Thanks Christoph

1 0

Cisco Routers 3/4G connections.
by Laurence Bullivant 11 Feb '14

11 Feb '14

Afternoon, This is a reach out for anyone else using Cisco881g / Cisco887vag routers with 3G backup. We have just started getting the new routers into stock that use the new cellular modems. Our normal connection scripts don't work any more and we have been unable to find the required connection details for either vodafone or telecom connections. I am hoping in exchange for BEER, someone out there has worked it out. (We have a pending case with TAC but I hope this will be faster). Currently we are using: ----------------------------------------------------- *chat-script gsm "" "ATDT*99#" TIMEOUT 30 CONNECT!controller Cellular 0!interface Cellular0 ip address negotiated ip nat outside ip virtual-reassembly in ip virtual-reassembly out encapsulation slip dialer in-band dialer string gsm dialer-group 1 async mode interactive!interface Vlan1 ip address 10.0.0.1 255.255.255.0 ip nat inside ip virtual-reassembly!ip nat inside source list 1 interface Cellular0 overloadip route 0.0.0.0 0.0.0.0 Cellular0!access-list 1 permit anydialer-list 1 protocol ip permit!line 3 exec-timeout 0 0 script dialer gsm modem InOut no exec transport preferred none transport output none* ----------------------------------------------------- The issue is that the dial script always times out. Hopefully this is all recognizable to someone who has gone though the same pain as we are. Thanks in advance. -Laurence laurence(a)bullivant.co.nz

3 3

Call for NZ Provider
by Daniel Watson 10 Feb '14

10 Feb '14

Gday Noggers, I am currently seeking any NZ providers whom would meet the following requirements, Being able to rent dedicated servers at reasonable market pricing, Being able to provide us with a /24 IPv4 Being able to set up a Vyatta VM to act as our router via a direct BGP session to said provider If you can meet these requirements, I am eger to meet you :D Please respond off-list if you can meet this requirement Regards, Daniel Watson Network Administrator / Network Operations Manager E Daniel(a)GloVine.com.au W www.GloVine.com.au "No trees were harmed in the making of this email, however a large number of electrons were terribly inconvenienced."

1 0

Validating resolvers for DNS and DNSSEC
by Andy Linton 10 Feb '14

10 Feb '14

At the recent NZNOG meeting in Nelson, Geoff Huston from APNIC gave a talk on DNSSEC and had some interesting statistics about the use of validating resolvers for DNS and DNSSEC. For DNSSEC to work there are two parts of the equation that need to happen: 1) People need to sign their zones 2) People need to ask the question "is this zone signed" etc. I want to talk about 2) Geoff noted that a number of countries that we might not expect to be high on the list of those validating the responses using the DNSSEC technology were way ahead of the rest of the world. I haven't got the exact numbers here - I expect his presentation will appear shortly and there's likely to be a video of it at some stage at http://www.r2.co.nz/20140130/ - but from memory the global average is about 7% usage of validating resolvers. New Zealand is a dismal <2% and I'd like to challenge you all to do something about that. And we're way behind the Australians.... Geoff pointed out that the high rate elsewhere is due to a large degree to the number of people using Google's Public DNS servers and while that looks attractive and an easy way to improve those numbers I'd ask you not to go down that path. You need to do this yourself (or at least as close as possible to the end user). If you use someone else's resolver then your traffic can be intercepted en route to the validating resolver => man in the middle attack => game over. And of course, handing this data over to a centralised collection agent makes the work of anyone who wants to snoop on you much, much easier. It's not about Google's servers - this applies equally to public servers run by anyone. DNSSEC validation is not real validation unless it's performed end to end or at least as close as possible to that. A number of NZ ISPs provide this service to their customers with their in house resolvers and those of you who don't should really be looking at when you will do this. Those people who have signed their zones are making assertions about how they want their DNS data to be interpreted. They're saying that unless you validate their DNS data they really don't want you to connect to them. You should be taking notice of this. But then maybe you just ignore broken certs on websites etc. So what should you do? End user ======= Check here - http://dnssec.vs.uni-due.de/ Or use - https://www.dnssec-validator.cz/ Ask your ISP/admins to fix this. ISPs/Enterprise ============ If you're running a resolver for customers do the work to get it validating, please.... Plenty of info out there on how to do this for Bind and Unbound and I'm no Windows expert but this looks straightforward: Windows: http://info.menandmice.com/blog/bid/88297/Windows-2012-Server-Enabling-DNSS…

11 17

NZNOG 2014 Videos
by Richard Naylor 10 Feb '14

10 Feb '14

Before I get spammed to death about the videos.... We got back to base on Wednesday night, late. We got the tapes on friday and have been processing over the week end. Its pretty well all edited. One node ran out of disk last night and so is repeating today. Uploading is a slow process as the addition of HD footage added at least 200% more data. Thats why I asked if HD was of interest. (Its distribution grade HD rather than the higher bit-rate contribution HD) As we do the upload, we're also doing an idiot check on files, web pages etc, so there may be some reruns. But I expect that we should have it all available by the end of this week. We have another job starting tomorrow, which also consumes our evenings, so theres a bit of a time squeeze going on. I'll update the list when the files are available. rich

1 0

Re: [nznog] Validating resolvers for DNS and DNSSEC
by Richard Naylor 10 Feb '14

10 Feb '14

At 11:35 a.m. 11/02/2014, Andy Linton wrote: >At the recent NZNOG meeting in Nelson, Geoff Huston from APNIC gave >a talk on DNSSEC and had some interesting statistics about the use >of validating resolvers for DNS and DNSSEC. <snip> >and there's likely to be a video of it at some stage at ><http://www.r2.co.nz/20140130/>http://www.r2.co.nz/20140130/ - but >from memory the global average is about 7% usage of validating resolvers. The video is available at http://www.r2.co.nz/20140130/geoff-h.htm The others are rendering and uploading. The recording is large and currently filling the CDN cache, so if it doesn't play well - wait - its a large file. As an option there is an HD version. Its a large file also (>1GB) so takes even longer to load and requires a decent CPU to play back. Dual-core or better. Feedback on the value of HD footage would be interesting. Its slowing down the render and upload process, so if its not of much value, we can speed things up. The other videos should be available in a day or so. Richard

1 0

Reviews of Conference bridges that work well over multiple varied speeds
by Alexander Neilson 09 Feb '14

09 Feb '14

Little bit off topic so Beer However we have been asked to deliver a Video Teleconference Bridge in our system for customers whose speeds and connectivity vary (ADSL1, ADSL2, VDSL, Radio, Fibre, UFB) and so I am looking for anyones experiences with conference bridge hardware that can take connections from customers who may be using any of these connections into our network and that is smart enough to remux the video / audio streams out to cater to the connection speeds available. If anyone has any history with such a device I would love to hear about it off list. Preferring devices that will have a master bridge inside our core with good monitoring and management and easy to use remote units that are also reliable (remote customers make for hard trips to work on) however any relevant information would be appreciated. (I am arguing for on topic ish due to the handling of different grade customer connections across the network) Regards Alexander Alexander Neilson Neilson Productions Limited alexander(a)neilson.net.nz 021 329 681 022 456 2326

3 2

IPv6 address allocation questions
by Qinwen Hu 06 Feb '14

06 Feb '14

Hi All, My name is Qinwen(Steven) Hu from the University of Auckland. I am working on my PhD thesis in which I am trying to observe potential new security issues in IPv6 networks. I have two questions I would like to ask network operators: 1) Recently, we did a survey to investigate how network administrators are actually allocating IPv6 Interface IDs around the world. Our results show that 82% of domains use sequential small integer values in the interface ID field for their IPv6 addresses. - What IPv6 address allocation mechanisms do you (or will you) use in your IPv6 network/services? could you please give us your reasons for using these mechanisms? 2) What new security issues, i.e. issues that don't exist in IPv4, do you think are likely to arise? Any replies would be very helpful, please send them to me off-list.Many thanks for your kind consideration. Have a nice day. Regards, Steven 胡勤文／Qinwen Hu Ph.D. Candidate, Computer Science, University of Auckland 奥克兰大学计算机科学博士研究生

1 0

FW: Trusted Community Representation for Root KSK
by Leo Vegoda 06 Feb '14

06 Feb '14

Hi, People on this list might also want to submit responses. Regards, Leo From: dns-operations-bounces(a)mail.dns-oarc.net [mailto:dns-operations-bounces(a)mail.dns-oarc.net] On Behalf Of Kim Davies Sent: Thursday, February 06, 2014 12:38 PM To: DNS Operations Subject: [dns-operations] Trusted Community Representation for Root KSK Hi folks, ICANN is currently performing a consultation on how to evolve the participation of Trusted Community Representatives in the management of the root key signing key. I think this consultation is of particular interest to this group as ultimately these TCRs are there to instill trust in the DNS operations community that the KSK is being managed in a proper fashion. I'd encourage you to provide feedback to this consultation - available at http://www.icann.org/en/news/public-comment/tcr-dnssec-key-signing-21jan 14-en.htm - by 11th February. It is important we have a model of TCR participation that is satisfactory to the community. For convenience, here are the terms of reference replicated: Background Since July 2010, the DNS Root Zone has been secured using DNSSEC[1]. The model of using DNSSEC in the DNS Root Zone revolves around a "key signing key" (KSK) that is managed by ICANN in two secure facilities. Four times a year, a ceremony is conducted at these facilities to perform operations involving the KSK. As a key part of this process, a minimum of three from a pool of 21 trusted community representatives (TCRs) attend each ceremony to enable access to the secure materials, to witness the procedure, and to attest that the ceremony was conducted properly[2]. Each ceremony is attended by ICANN staff, the TCRs, representatives of the Root Zone Maintainer (Verisign), representatives of an independent audit firm retained by ICANN to monitor the process, and often additional external witnesses. Ceremonies are recorded by three audit cameras and webcast online. A typical ceremony lasts approximately four hours, and involves a process of temporarily removing the key signing key from a safe and performing key-signing operations in a secure manner following a formal script. The script is designed to perform each operation in a transparent manner to ensure the key signing key is only used for its proper purpose, and there is no ability for its contents to be disclosed for other purposes. Materials from each ceremony - such as the scripts, video recordings, and system output - are posted online[3]. De-briefings and discussions are conducted post-ceremony, where participants discuss how to improve future ceremonies. This feedback helps inform the evolution of the KSK ceremony to be both efficient and effective, while ensuring maximum trust in how ceremonies are performed. The TCRs were selected[4] from the global community based on a number of criteria[5]. These selection criteria relate to the volunteers ability to travel to ceremonies, conscientiously oversee the process, ensure transparency in its operation, and ultimately contribute to the broader community's trust that the private component of the key signing key has not been compromised. The TCRs are privately funded volunteers who are not reimbursed or compensated by ICANN for their participation nor their expenses. The original TCR proposal was silent on the length of service of individual TCRs. Of the 21 TCRs, seven are credentialed as "crypto officers" (COs) for each of the two facilities, and the remaining seven act as "recovery key shareholders" who only participate in ceremonies in the event the requisite number of COs are unable to participate or there is a need to rebuild the KSK following an unforeseen event. Of the seven COs for each facility, ICANN aims to have four attend each ceremony, with an absolute minimum of three required to successfully perform a ceremony. Each facility hosts two ceremonies per year, approximately once every six months. In practice, a TCR will attend at minimum one ceremony per year, and some will attend two in order to ensure sufficient attendance. Of the initial pool of 21 TCRs, one has resigned and been replaced from the pool of recovery key shareholders. No TCR has been removed owing to the other three criteria for replacement in the TCR selection document, relating to lack of integrity or trustworthiness; assumption of a conflicting role within a root management organization; or being unable to serve in their position. Based on feedback from the current TCRs and our experience from the first 14 ceremonies, we are reviewing what changes, if any, should be made to the current model of TCR participation. Comments Comments are welcome on any aspect of the consultation, and specifically on the following questions: 1. Is the current TCR model effectively performing its function of ensuring trust in the KSK management process? 2. Is the current size of the TCR pool appropriate to ensure sufficient participation in the ceremonies, while not overburdening the availability of specific volunteers? 3. Should there be a minimum level of participation required of a TCR in order to be considered to be successfully discharging their duties? 4. There is no standard provision to refresh the list of TCRs except when they are replaced due to inability to effectively perform their function. Should there be a process to renew the pool of TCRs, such as using term limits or another rotation mechanism? 5. The current model does not compensate TCRs for their services in order to ensure their independence from ICANN. a. Should the model of TCRs paying the costs of their participation be retained? b. Would some form of compensation to offset the expenses incurred by the TCRs detract from their independence in performing the role? c. If you support compensating TCRs for their expenses, are there requirements or limitations on whom the funding organization should be? Please send your comments to comments-tcr-dnssec-key-signing-21jan14(a)icann.org <mailto:comments-tcr-dnssec-key-signing-21jan14(a)icann.org> References [1] http://www.root-dnssec.org [2] https://www.iana.org/dnssec/icann-dps.txt [3] http://data.iana.org/ksk-ceremony/ [4] http://www.root-dnssec.org/tcr/selection-2010/ [5] http://www.root-dnssec.org/wp-content/uploads/2010/04/ICANN-TCR-Proposal -20100408.pdf kim

1 0

Re: [nznog] NZNOG Digest, Vol 134, Issue 2
by Jonathan Spence 04 Feb '14

04 Feb '14

Hi Trent, You may want to try geekzone.co.nz as there are a few good Telecom contacts on there. Thanks, Jonathan ---------------------------------------- From: nznog-request(a)list.waikato.ac.nz Sent: Wednesday, February 5, 2014 12:01 PM To: nznog(a)list.waikato.ac.nz Subject: NZNOG Digest, Vol 134, Issue 2 Send NZNOG mailing list submissions to nznog(a)list.waikato.ac.nz To subscribe or unsubscribe via the World Wide Web, visit http://list.waikato.ac.nz/mailman/listinfo/nznog or, via email, send a message with subject or body 'help' to nznog-request(a)list.waikato.ac.nz You can reach the person managing the list at nznog-owner(a)list.waikato.ac.nz When replying, please edit your Subject line so it is more specific than "Re: Contents of NZNOG digest..." Today's Topics: 1. Telecom NZ Contact (Trent Farrell) ---------------------------------------------------------------------- Message: 1 Date: Tue, 4 Feb 2014 12:19:25 +0000 From: Trent Farrell <tfarrell(a)riotgames.com> To: "nznog(a)list.waikato.ac.nz" <nznog(a)list.waikato.ac.nz> Subject: [nznog] Telecom NZ Contact Message-ID: <80289F43-A47C-4290-ABFC-5728C91EB5BA(a)riotgames.com> Content-Type: text/plain; charset="us-ascii" Hi all, Looking for someone from Telecom NZ to reach out off list, your customers are having issues with parts of our service. Cheers. - Trent ------------------------------ _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog End of NZNOG Digest, Vol 134, Issue 2 *************************************

1 0

Telecom NZ Contact
by Trent Farrell 03 Feb '14

03 Feb '14

Hi all, Looking for someone from Telecom NZ to reach out off list, your customers are having issues with parts of our service. Cheers. - Trent

1 0

Fwd: BCP 38
by Andy Linton 31 Jan '14

31 Jan '14

At NZNOG, Jamie Baddeley mention the spoofer tool at http://spoofer.cmand.org/ I ran it on the net I run at VUW and here are the traces from a couple of runs. I ran it once, realised I was being slack and turned on the 'rfp-check' feature on the edge Juniper and then ran the test again. A nice tool to demonstrate why we should do BCP 38.

1 0

Re: [nznog] Do you stream video?
by Richard Naylor 29 Jan '14

29 Jan '14

At 05:15 p.m. 15/01/2014, Dean Pemberton wrote: >Due to unforeseen circumstances our usual video streaming company of >choice (R2) is unable to stream NZNOG live this year. We're in AKL on another job. The plan is to send a camera operator to Nelson with a small portable encoder. The encoder planned is still in USA and won't be back in time. It died just after New Years day. I think we can free up one from the AKL job on wednesday, but need it back on the Saturday or Sunday after NZNOG, and are not confident couriers can do it. We also have very limited transport and time in AKL as we are parked up on a job. But if anyone can collect the unit from us on the Wednesday and take it to Nelson, then bring it back to AKL on the Saturday (we may have wheels on Saturday) that would solve the issue. I can probably meet someone at the airport and provide a ride home on the Saturday. The encoder is in a small plastic case about 200mmx150x100. Richard 021 897 089

9 10

Lightning talks
by Richard Nelson 29 Jan '14

29 Jan '14

If anyone has a lightning talk and can’t find me at the conference. Just email me off list. Richard.

1 0

One Day down.... Four to go
by Dean Pemberton 26 Jan '14

26 Jan '14

Hello from NZNOG 2014 in sunny Nelson! The venue is awesome and we're off to a great start. The BGP Routing and Network Security workshops are underway and the participants have been giving outstanding feedback. We've got less than 10 more registration slots left for the main conference before we're all sold out. If you're leaving it until the last minute... I'd suggest that you don't . See you all here. Dean

1 0

Re: [nznog] NZNOG Digest, Vol 133, Issue 14
by Jonathan Spence 26 Jan '14

26 Jan '14

They have been doing this for ages (maybe 6 months at least). We had to disable IPv6 on our mail server as we were struggling to get rDNS delegation from Orcon. Got too busy to follow up on it but will do so when I get a minute. Jonathan Spence Chief Executive Officer Fixed: +64 9 9510448 Mobile: +64211055634 ---------------------------------------- From: nznog-request(a)list.waikato.ac.nz Sent: Sunday, January 26, 2014 12:01 PM To: nznog(a)list.waikato.ac.nz Subject: NZNOG Digest, Vol 133, Issue 14 Send NZNOG mailing list submissions to nznog(a)list.waikato.ac.nz To subscribe or unsubscribe via the World Wide Web, visit http://list.waikato.ac.nz/mailman/listinfo/nznog or, via email, send a message with subject or body 'help' to nznog-request(a)list.waikato.ac.nz You can reach the person managing the list at nznog-owner(a)list.waikato.ac.nz When replying, please edit your Subject line so it is more specific than "Re: Contents of NZNOG digest..." Today's Topics: 1. heads up.. gmail now checking ipv6 rdns (Blair Harrison) 2. Re: heads up.. gmail now checking ipv6 rdns (Scott Howard) 3. Re: heads up.. gmail now checking ipv6 rdns (Michael Fincham) 4. Re: heads up.. gmail now checking ipv6 rdns (Phil Regnauld) ---------------------------------------------------------------------- Message: 1 Date: Sat, 25 Jan 2014 13:43:28 +1300 From: Blair Harrison <nznog(a)jedi.school.nz> To: NZNOG <nznog(a)list.waikato.ac.nz> Subject: [nznog] heads up.. gmail now checking ipv6 rdns Message-ID: <CAHn0gTveE=Nh-jp9Lfdw67UDAy=4Y-rgi-4h7t8zr1R_4p73zg(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" Hi Folks, Just got caught out with this on my personal box today. It looks as if Gmail is now checking RDNS on any inbound ipv6 smtp connections and rejecting with 500 error if it doesn't match. example fail - SMTP error from remote mail server after end of data: host gmail-smtp-in.l.google.com [2a00:1450:4008:c01::1a]: 550-5.7.1 [2402:6000:1000:x::x] Our system has detected that this message does 550-5.7.1 not meet IPv6 sending guidelines regarding PTR records and 550-5.7.1 authentication. Please review 550-5.7.1 https://support.google.com/mail/?p=ipv6_authentication_errorfor more 550 5.7.1 information. oq6si4802967bkb.182 - gsmtp So if you have ipv6 enabled on your mail servers and haven't yet set some RDNS for them.. now is the time. Cheers, Blair

1 0

heads up.. gmail now checking ipv6 rdns
by Blair Harrison 25 Jan '14

25 Jan '14

Hi Folks, Just got caught out with this on my personal box today. It looks as if Gmail is now checking RDNS on any inbound ipv6 smtp connections and rejecting with 500 error if it doesn't match. example fail - SMTP error from remote mail server after end of data: host gmail-smtp-in.l.google.com [2a00:1450:4008:c01::1a]: 550-5.7.1 [2402:6000:1000:x::x] Our system has detected that this message does 550-5.7.1 not meet IPv6 sending guidelines regarding PTR records and 550-5.7.1 authentication. Please review 550-5.7.1 https://support.google.com/mail/?p=ipv6_authentication_errorfor more 550 5.7.1 information. oq6si4802967bkb.182 - gsmtp So if you have ipv6 enabled on your mail servers and haven't yet set some RDNS for them.. now is the time. Cheers, Blair

4 3

Fibre circulators?
by Sam Russell 23 Jan '14

23 Jan '14

Hi guys, Does anyone recommend a supplier for fibre circulators, preferably with LC connectors? I'd be keen to hear anyone's experiences/horror stories with them if you're willing to volunteer them. Cheers Sam

6 7

Great Firewall of China misconfig; traffic re-routed
by Juha Saarinen 22 Jan '14

22 Jan '14

Somewhat operational, with amusement potential and besides, it’s too early for beer (surely???): http://www.itnews.com.au/News/370324,great-firewall-mishap-reroutes-chinese… Has anyone seen a more detailed explanation as to what happened? — Juha

1 0

Acceptable levels of packet loss
by Matthew Poole 21 Jan '14

21 Jan '14

Been running SmokePing for a little while now, building up a statistical sample, and wondering what's an acceptable level of loss to be seeing through the provider's core, both to targets foreign and domestic and also from the premises to the first hop in the provider's network. Obviously I'm seeing a non-zero level (averages are in the zero-point-something range, but some of the maximums are above 0), so want to know what people consider to be the point where I go from "unreasonable customer" to "customer with a justified concern"? -- Matthew Poole "The difference between theory and practice is that practice is easier in theory than theory is in practice"

8 10

IPv4 Brokering and Availability Announcements
by Skeeve Stevens 19 Jan '14

19 Jan '14

Hi all, I will keep this brief. After many comments to us where people have had to deal with US companies to acquire IPv4, eintellego Networks has decided formalise a service offering IP Brokering. After facilitating and consulting for over a dozen transactions in different countries (including NZ) under the APNIC region - including NZ, we thought it would be good to have a service available locally by someone you know. For more information: http://eintellegonetworks.com/site/ipbrokering/ So, rather than trolling lists when ranges become available or we have a client looking to sell a block, I've setup an announcement list so that I can let interested parties know when a range is available. If you wish to join this list and receive these announcements, please visit: http://eintellegonetworks.com/site/v4announce/ to sign-up. FYI, eintellego Networks has just launched in NZ as a locally registered foreign company to mainly do other business including hardware/consulting and network operations. Also, eintellego Networks is the only APNIC registered<http://www.apnic.net/services/become-a-member/manage-your-membership/transf…>IPv4 broker that is based in the APNIC region (all the other are presently American). Any questions, feel free to let me know off-list. ...Skeeve *Skeeve Stevens - *eintellego Networks Pty Ltd skeeve(a)eintellegonetworks.co.nz ; www.eintellegonetworks.co.nz Phone: +612 8014 7398; Cell +61 (0)414 753 383 ; skype://skeeve facebook.com/eintellegonetworks ; <http://twitter.com/networkceoau> linkedin.com/in/skeeve twitter.com/theispguy ; blog: www.theispguy.com The Experts Who The Experts Call Juniper - Cisco - Cloud - Consulting - IPv4 Brokering

2 3

Do you stream video?
by Dean Pemberton 14 Jan '14

14 Jan '14

Hi Everyone, Due to unforeseen circumstances our usual video streaming company of choice (R2) is unable to stream NZNOG live this year. They are able to record the session and have it available for streaming later on, It's just the live streaming they can't provide. Is there anyone in the community who does this sort of thing and wants to step forward and have a go? Just email krystal(a)internetnz.net.nz and let her know. The provisio is that it has to be drama free and this isn't an opportunity to 'try things out'. If you haven't done this sort of thing/scale before, then you might be best to give it a miss. If no one comes forward, then record-for-later-streaming it is.

1 0

NZNOG 2014 Social Events
by Dean Pemberton 13 Jan '14

13 Jan '14

Hi Everyone. Another conference update. THURSDAY NIGHT CONFERENCE DINNER Conference Dinner on the Thursday night will be a buffet style dinner has been organised for the Thursday night dinner, 6:30pm at the Mercure Monaco Marquette. Buses will leave from The Rutherford hotel at 6pm and return on the hour from 9 to 11pm. There is even a pub across the road called The Honest Lawyer for those who feel the need to move on. http://www.monacoresort.co.nz/ WEDNESDAY NIGHT I've also been asked what the plan is for the Wednesday evening. As it happens, nothing. In the mists of time, Wednesday night was always informally organised. Often involving food from the sub-continent. Everyone split the bill and basically it was Thursday Night Curry on a Wednesday night! Like Christmas in July! In more recent years, a specific spondsor kindly funded drinks and nibbles on the Wednesday at many a well respected establishment. With this in mind we placed the position of "Networking Drinks" on the sponsorship document in case someone wanted to take up the opportunity. So far this year none of our sponsors have indicated that they would like to take up this offer, so we will return to the default informal arrangement of the past. That being said there are options. If you are a potential sponsor who would like to fund an event on the Wednesday night, our events person Krystal (krystal(a)internetnz.net.nz) would be more than happy to talk through the opportunities with you. I'm also told there are some nice Indian places in Nelson http://www.menus.co.nz/restaurants/indian/nelson/ Failing that there are places that sell beer. http://maps.google.com/maps/ms?ie=UTF8&hl=en&msa=0&msid=1017353080318029218… Basically at the moment it will be up to people to arrange their own food/fun on Wednesday, but being the well adjusted social people I know you all are, I'm sure this won't be a problem. If we do get a benevolent sponsor come forward to save the Wednes-Day we'll be sure to let you know ASAP. Regards, Dean

1 0

Full Programme for NZNOG 2014
by Dean Pemberton 12 Jan '14

12 Jan '14

Hi Everyone, We've just shuffled together all the great talks we've got planned for the conference. The programme as it currently stands is here: http://www.nznog.org/home/nznog-2014-conference-programme You can download an ICS from the link of the bottom of that page. Don't forget to register. The SDN/OpenFlow Tutorial is now full (Although there is a waitlist, email krystal(a)internetnz.net.nz) but there are plenty of other cool things to attend. Don't forget to register! See you all there. Dean

1 0

Plea for help - Ethernet cables.
by Dean Pemberton 10 Jan '14

10 Jan '14

So it turns out that the SDN OpenFlow tutorial has turned into a bit if a thing. While it was going to use mainly VMs and simulators, Citylink has supplied 20 mikrotik routerboards for the class to actually configure into an openflow controlled data plane. On ya guys, much appreciated, great NZNOG and SDN supporters as always. What I'm after now however is the around 60 Ethernet cables to hook it all together. If anyone could help me out so that I don't need to buy them that would be awesome. Yes you get then back afterwards. Thanks heaps. It should be an awesome tut. Dean

1 0

Situations Vacant: Senior Network Engineer
by Mark Foster 09 Jan '14

09 Jan '14

Greetings, ICONZ-Webvisions currently have a vacancy for a Senior Network Engineer, to be based at the iWV offices in Auckland. We're looking for an experienced Cisco engineer with experience working on ASR, 2800/2900/3700/6500/7200 series devices, with exposure to the ISP world preferred. Other acronyms you'd be familiar with at a senior level would include MPLS, VRF, BGP, OSPF, QoS, VoIP. CCNP or equivalent experience is the listed minimum qualification. If you are interested, or know anyone who might be, please have them drop me a note ASAP - we're already interviewing likely candidates and will need to make an offer fairly soon. Off-list questions, or expressions of interest, are welcomed in the meantime. Thanks, Mark.

1 0

Want a free NZNOG 2014 conference ticket?
by Dean Pemberton 06 Jan '14

06 Jan '14

Krystal is looking for one or 2 more volunteers to help with registration and pack up. Duties will be - manning the registration desk on Thursday Morning (8am - 9.30am) and helping pack up gear to be shipped back in INZ on Friday after conference ends (4.00 - 6.00). If you put your hand up then we're happy to comp you a ticket, they may miss a couple of talks - but you should still manage to attend the bulk of the conference. If you're interested then please email krystal(a)internetnz.net.nz and let her know. If there is a huge influx of interest then some advanced algorithm will be used to determine those accepted. =)

2 1

Call for Presentations - DNS-OARC Spring Workshop, May 2014
by Sebastian Castro 05 Jan '14

05 Jan '14

Call for Presentations - DNS-OARC Spring Workshop, May 2014 Next OARC Spring Workshop will take place in Warsaw, Poland on May 10th and 11th, the weekend before RIPE68. OARC is requesting proposals for presentations, with a preference for DNS privacy and confidentiality work and ideas, and DNS over alternative (non UDP) transports. This workshop continues OARC's tradition of having meetings include a strong operational component. Presentations from DNS operators are particularly welcome. We'll also gladly accept talks from DNS researchers, as well as any other DNS-related subjects such as tools, visualizations and data analysis. If you are an OARC member, and have a sensitive topic you would like to present for members-only, we will accommodate those talks too. Adopting practice from other conferences, a section of lightning talks will be added for short presentations. Workshop Milestones * 20 December 2013, Call for Presentations posted * 6 January 2014, Open for submissions * 1 March 2014, Deadline for submission * 28 March 2014, Final Program published * May 9 2014, Final deadline for slideset submission Details for abstract submission are be published here: https://indico.dns-oarc.net/event/workshop-2014-05 If you consider submitting a presentation, please let the Programme Committee know in advance to help us organize the presentations tracks. You can contact the Programme Committee: https://www.dns-oarc.net/oarc/programme via submissions(a)dns-oarc.net if you have questions or concerns. Sebastian Castro, for the OARC Programme Committee (Please note that OARC is run on a non-profit basis, and is not in a position to reimburse expenses or time for speakers at its meetings.)

1 0

CARDIGAN implements RPKI - Cleanliness of prefixes onWIX
by Dean Pemberton 05 Jan '14

05 Jan '14

Hi All, CARDIGAN has just finished implementing RPKI Origin Validation on its WIX peering connection. What this effectively does is finds out if ASs are permitted to announce the IP addresses that they are advertising to the exchange. CARDIGAN then makes a decision on wether to allow invalid announcements to be turned into OpenFlow rules. So I thought you'd all be interested in the state of the prefixes on the exchange. The following table has removed all the routes for which no RPKI information was found. This leaves two conditions: Lines which start with a "V" have a valid RPKI ROA. That means that the AS originating the prefix has been explicitly authorised by the IP resource owner to do so. Likes which start with an "I" have an RPKI ROA which is different to the route seen. This means that the AS originating the prefix has been explicitly disallowed from doing so by the IP resource owner. These are explicit authorisations as the IP Resource owner has had to go to an RPKI trust anchor (normally the RIRs) and request certification of the ASs allowed to originate the prefix (or subnet of the prefix). For most of us (who are APNIC members) this is as simple as logging into the MyAPNIC portal and creating an ROA. APNIC handles everything else for you. Anything that turns up as an "I" on this list, I'm going to be looking at pretty carefully before I prefer into the CARDIGAN network. Anyone with more questions about RPKI, how it works, what it means, how to get it going. Feel free to post/email me. Network Next Hop Metric LocPrf Weight Path V* 58.28.0.0/16 202.7.1.22 30 0 9439 17435 i V*> 202.7.1.22 30 0 9439 17435 i V* 103.10.233.0/24 202.7.0.190 30 0 9439 132003 i V*> 202.7.0.190 30 0 9439 132003 i V* 103.23.16.0/22 202.7.0.222 30 0 9439 132040 i V*> 202.7.0.221 30 0 9439 132040 i I* 103.23.16.0/24 202.7.0.222 10 0 9439 132040 i I*> 202.7.0.221 10 0 9439 132040 i I* 103.23.17.0/24 202.7.0.222 10 0 9439 132040 i I*> 202.7.0.221 10 0 9439 132040 i I* 103.23.18.0/23 202.7.0.222 10 0 9439 132040 i I*> 202.7.0.221 10 0 9439 132040 i V* 113.197.96.0/22 202.7.0.211 30 0 9439 45831 45831 i V*> 202.7.0.211 30 0 9439 45831 45831 i I* 113.197.96.0/28 202.7.0.211 10 0 9439 45831 i I*> 202.7.0.211 10 0 9439 45831 i I* 113.197.96.32/27 202.7.0.211 10 0 9439 45831 i I*> 202.7.0.211 10 0 9439 45831 i I* 113.197.96.96/28 202.7.0.211 10 0 9439 45831 i I*> 202.7.0.211 10 0 9439 45831 i I* 113.197.96.112/28 202.7.0.211 10 0 9439 45831 i I*> 202.7.0.211 10 0 9439 45831 i I* 113.197.96.168/29 202.7.0.211 10 0 9439 45831 i I*> 202.7.0.211 10 0 9439 45831 i I* 113.197.98.32/29 202.7.0.211 10 0 9439 45831 i I*> 202.7.0.211 10 0 9439 45831 i I* 113.197.98.64/27 202.7.0.211 10 0 9439 45831 i I*> 202.7.0.211 10 0 9439 45831 i I* 116.90.130.16/29 202.7.0.176 10 0 9439 38477 i I*> 202.7.0.176 10 0 9439 38477 i I* 116.90.130.96/29 202.7.0.176 10 0 9439 38477 i I*> 202.7.0.176 10 0 9439 38477 i I* 116.90.135.0/24 202.7.0.176 10 0 9439 38477 45641 i I*> 202.7.0.176 10 0 9439 38477 45641 i V* 116.90.139.0/24 202.7.0.176 30 0 9439 38477 i V*> 202.7.0.176 30 0 9439 38477 i I* 116.90.139.0/29 202.7.0.176 10 0 9439 38477 i I*> 202.7.0.176 10 0 9439 38477 i I* 116.90.139.8/29 202.7.0.176 10 0 9439 38477 i I*> 202.7.0.176 10 0 9439 38477 i I* 116.90.139.16/29 202.7.0.176 10 0 9439 38477 i I*> 202.7.0.176 10 0 9439 38477 i I* 116.90.139.24/29 202.7.0.176 10 0 9439 38477 i I*> 202.7.0.176 10 0 9439 38477 i I* 116.90.139.64/27 202.7.0.176 10 0 9439 38477 i I*> 202.7.0.176 10 0 9439 38477 i I* 116.90.139.144/29 202.7.0.176 10 0 9439 38477 i I*> 202.7.0.176 10 0 9439 38477 i V* 118.90.0.0/16 202.7.1.22 30 0 9439 17435 i V*> 202.7.1.22 30 0 9439 17435 i 202.7.0.76 20 0 9439 24006 i V* 182.154.0.0 202.7.1.22 30 0 9439 17435 i V*> 202.7.1.22 30 0 9439 17435 i 202.7.0.168 20 0 9439 i I* 198.48.0.0/23 202.7.0.222 10 0 9439 132040 i I*> 202.7.0.221 10 0 9439 132040 i I* 198.48.2.0 202.7.0.222 10 0 9439 132040 132001 i I*> 202.7.0.221 10 0 9439 132040 132001 i I* 198.48.3.0 202.7.0.222 10 0 9439 132040 i I*> 202.7.0.221 10 0 9439 132040 i I* 202.7.4.0 202.7.0.222 10 0 9439 132040 23755 i I*> 202.7.0.221 10 0 9439 132040 23755 i I* 202.7.5.0 202.7.0.222 10 0 9439 132040 23755 i I*> 202.7.0.221 10 0 9439 132040 23755 i I* 202.7.6.0 202.7.0.222 10 0 9439 132040 23755 i I*> 202.7.0.221 10 0 9439 132040 23755 i I* 202.7.7.0 202.7.0.222 10 0 9439 132040 23755 i I*> 202.7.0.221 10 0 9439 132040 23755 i V* 203.119.88.0/23 202.7.1.253 30 0 9439 42 187 i V*> 202.7.1.253 30 0 9439 42 187 i 202.7.1.252 20 0 9439 i 202.7.0.147 20 0 9439 24183 45563 i 202.7.0.147 20 0 9439 24183 ? 202.7.0.128 20 0 9439 i 202.7.0.107 20 0 9439 i

2 3

2821 ipv4 table size
by Bill Walker 30 Dec '13

30 Dec '13

Hate to post this but my google foo is failing me anyone know the ipv4 max table size on a 2821? Would be running eBGP with two peers. Sent from my iPhone

2 2

Fraud Calls
by Davey Goode 27 Dec '13

27 Dec '13

Hi All, I hope everyone is having a good break ! If anyone out there has had any of their customers PBX's hacked recently (in the last 2 - 3 weeks) and have experienced a large call flow to say Somalia or some other dodgy destination id be keen to hear from you, I'm after the destination numbers they are dialling. replies off list would be great. cheers davey

3 2

How often does NZRS root reload?
by Skeeve Stevens 18 Dec '13

18 Dec '13

Hey all, Just registered a co.nz domain and it is registered and visible in whois. But ;; AUTHORITY SECTION: co.nz. 3285 IN SOA loopback.dns.net.nz. soa.nzrs.net.nz. 2013121964 900 300 604800 3600 How often does this server refresh its data? ...Skeeve *Skeeve Stevens - *eintellego Networks Pty Ltd skeeve(a)eintellegonetworks.com ; www.eintellegonetworks.com Phone: 1300 239 038; Cell +61 (0)414 753 383 ; skype://skeeve facebook.com/eintellegonetworks ; <http://twitter.com/networkceoau> linkedin.com/in/skeeve twitter.com/theispguy ; blog: www.theispguy.com The Experts Who The Experts Call Juniper - Cisco - Cloud

3 4

NZNOG 2014 Update
by Dean Pemberton 16 Dec '13

16 Dec '13

Hi Everyone. Registrations have been open for the conference for a while now and I'm pleased to say that they are at an unprecedented level for this time of year. Given that we've only just released the program, thats an outstanding achievement. With some great help from InternetNZ the conference is shaping up to be as awesome as usual. First up I'd like to thank the sponsors who have signed on thus far: Go Wireless - Gold Network Hardware Resale - Gold Vocus - Gold CityLink - Gold GKC - Silver Brocade - Silver Arbor Networks - Silver APNIC - Silver Extreme Networks - Silver Kordia - Bandwidth Sponsor We have more slots open for sponsorship as well as the much coveted Platinum sponsor position. If you would like to ensure that your organisation gets high visability at the event then contact sponsorship(a)nznog.org for a sponsorship pack. We know that the program is an important part of convincing your organisations that you need to attend. This year we've got a wide range of speakers lined up along with some great Workshops and tutorials. Program: International Keynotes: Tom Paseka (CloudFlare) - NZ Perspectives from a global CDN Roland Dobbins (Arbor Networks) - TBA Conference Presentations: Geoff Huston (APNIC) - Measuring DNSSEC Jamie Baddeley (Citylink) - NZIX2/Citylink SDN Sam Russell (REANNZ) - Building a better Skype with WebRTC, SIP, and ENUM Barry Brailey (DNC) .nz DNSSEC programme Jean-Sébastien Fontana (Extreme Networks) - Introduction to TRILL Gerard Creamer (Netspace) - Experiences with dual A records vs anycasting Beatty Lane-Davis (Cyan) - SDN & NFV Michael Fincham (Unleash) - RPKI Peter Gent (MBIE) - 5GHz Wireless Links Jan Jorz (ISOC) - BCOP Project Quintin Russ (SiteHost) - IPv6 deployment in the cloud InternetNZ Update APNIC update WAND update Lightning Talks Workshops: Network Infrastructure Security BGP Routing Tutorials: OpenDNSSEC Installation and Configuration (1/2 day) SDN/OpenFlow Installation (1/2 day) Mikrotik Routing (full day) APNIC Internet Resource Management (1/2 day) We'd suggest you register now. At least this side of Xmas. Flights, Accommodation etc will likely be easier and cheaper the sooner you do it. Better than doing it in a panic in mid January. For more information on how to register, head off to http://www.nznog.org/register See you all there. Dean

1 0

Keeping it local
by Martin Kealey 15 Dec '13

15 Dec '13

I have a question which I'm hoping the NZNOG community can help me with. Within NZ, what is the maximum number of hops from APE to any consumer's interface device? (smarty-phone, ADSL modem, whatever)? Or more pragmatically, let's say the 99th percentile, as in, fewer than 1% of customers are more than X hops away from APE. If this information is already available, I'd appreciate a pointer, otherwise... If you are an ISP could you give me an indicative number of hops from APE to your customers' CPE. If you can include a prefix length reflecting the number of affected customers that would help too. (Ideally the maximum across all your customers, but if you have a few oddball customers with longer paths, just the 99% will do.) If you're an ISP customer and would like to tell me your hop-count to APE (counting from your CPE, not from your computer) and your ISP's name, that would also be appreciated. Replies off-list and I will summarize back to the list. Here's the background: I'm investigating ways of limiting traffic so that it does not leave New Zealand, that can be configured on an application-by-application basis. Obviously if one has an upstream to "global" and a separate upstream to APE or WIX, then it's simple to filter traffic at those egresses. However for the average end-user, it's difficult to get multiple VLANs to their provider, let alone multiple physical links. In an ideal world, one would simply set some QoS bits and your upstream would understand them and do the filtering based on *their* egress, but in practice I haven't heard of any suppliers offering such a service. So I'm looking at DIY options ... In particular, I'm looking at setting the TTL on outgoing packets. We know how many hops it is from "our" hosts to APE, and I guestimate no more than 2 hops from a consumers border device (modem, whatever) to their client devices; So far it looks like setting the TTL so that it's down to 5 at APE will mean most of NZ is reachable, and most of the rest of the world isn't, assuming the international provider is as many hops from me as APE. But I'd really like to get a firmer idea of "how much of NZ will be unreachable given an egress hop limit of X?" (The idea is to find X where the list of exception prefixes is small enough to manage manually, while still blocking the majority of foreign traffic.) What I'd like to find out from the NZNOG community is the distribution of customers at various hop-counts from APE. -Martin

3 3

ISC/F-Root has returned to APE...
by Peter Losher 11 Dec '13

11 Dec '13

FYI - the Auckland node of F.ROOT-SERVERS.NET has been offline for the past couple of years due to HW failure, access issues @SkyTower, changes with our hosts (contacts and access to said data center). I am happy to report that the node is finally back online and advertising F's prefixes to the APE fabric as I type... So come and send your DNS root server queries locally instead of sending them off-shore. We are AS23710 @APE, so if you don't peer with us already, pop us a note at peering(a)isc.org. Yes, Telecom NZ, I am looking at you. Yes, you... (a guy can dream, even if it is hopeless) ;) There are many folks to thank as ISC could not do it alone including: - NZRS (Jay, Sebastian and Dave) for sponsoring the new server gear. - APNIC for sponsoring the new routers. (sorry to see the old Juniper kit go though) - Sebastian and Mike Jager for dealing with my numerous remote hands requests from the other side of the world. - The Kiwi Internet Mafia (Joe Abley, AJ, Jonny) for their support and access to their contacts to keep things moving. - Vodafone NZ and FX Networks for (now redundant) transit over IPv4 and IPv6. - Our peers at APE that have put up with us for being down so long... :) O.k., commercial over; back to serving packets again. Best Wishes - Peter -- [ plosher(a)isc.org | Senior Operations Architect | ISC | PGP E8048D08 ]

5 5

Web Servers: Dual-homing or DNAT/Port Forwarding?
by Christoph Berthoud 10 Dec '13

10 Dec '13

Hi All, I'm curious to know which of the following methods is more widely used/accepted today for publishing web servers to the Internet. 1) Dual-home the server - place one NIC on the internet and a second NIC on an internal network for administration, or 2) DNAT/Port Forward my external IP to my internal IP 3) Both - Dual home the server onto two private subnets (external/internal) and DNAT/Port Forward the public IP to the external subnet IP In either case: a) I will be hiding behind a dedicated firewall appliance and not relying on the OS firewalls b) the internal network will still be in its own subnet firewalled away from the rest of the network c) Only HTTP/HTTPS will be permitted from the internet, no RDP, SSH etc d) I will be deploying IPv6 to this machine in the next 12 months which makes option 1 more attractive I personally like option 1 but I'm looking to see if theres any facepalm reasons I shouldn't do it this way. Happy holidays! -- Thanks Christoph

9 10

JANOG 33 Program Published
by Daniel Griggs 09 Dec '13

09 Dec '13

Dear Colleagues, We have published the program for JANOG 33 and welcome you to join us in Beppu City, Japan, from 23rd-24th Jan 2014. Most sessions are in Japanese only but there are a few sessions in English. You are also welcome to connect with us through facebook and twitter for updates in English. The JANOG SNS accounts are open to everyone, including those who are not able to attend the meeting. See you in Beppu. Cheers, Shinichi Yamamoto, Chin Sze Yih, Izumi Okutani JANOG Internationalization team for JANOG 33 ----- JANOG 33 Program : ------------------------ The Program is available in English at: http://www.janog.gr.jp/en/index.php?JANOG33%20Programs%2FJANOG33%20Program%… Translations of the program titles and abstracts were supported by volunteers on the best efforts basis. Note: During the meeting, there will be no official interpretations in English, except for the sessions marked as (English session). Registration : ------------------------ You can register online at: https://regist.e-side.co.jp/product_info.php?products_id=427&language=en 　Deadline: 10th Jan 2014 JST 15:00 SNS Accounts : ------------------------ Facebook : https://www.facebook.com/janogmeetingi18n Twitter : https://twitter.com/janog_i18n -- Daniel Griggs e + j: daniel(a)pch.net c: +64 (21) 845158

1 0