- NZNOG - lists.nznog.org

openvz vm's
by Tony Wicks 24 Oct '14

24 Oct '14

I've noticed openvz VM's on several different international hosing providers have all dropped out at once (currently down), anyone else seeing this ? cheers

3 3

Vodafone VSI / Spark SecureME
by Tom Henderson 22 Oct '14

22 Oct '14

Hi All I'm interested in some feedback (off list) from anyone using either Vodafone VSI or Spark's SecureME offerings. We're currently looking into both of these for a group of hospitality outlets. Cheers Tom Henderson IT Manager | Pack & Company | 027 461 4403 | 09 929 2750 | tom(a)pack.co.nz -- ---------------------------------------------------------------------------If you are not the intended recipient of this email, you must not disclose, copy, or distribute any information contained in or attached to it, or take any action/inaction based on it. Please contact us immediately, and delete this email from your system. Any views or opinions presented in this email are solely those of the author and not of Pack & Company (NZ) Limited (the "Company"), however any intellectual property contained in or attached to this email is the property of the Company. Thank you.

1 0

Unwanted Traffic Removal Service (UTRS)
by Dean Pemberton 15 Oct '14

15 Oct '14

The latest useful community service from Team Cymru ---------- Forwarded message ---------- From: John Kristoff <jtk(a)cymru.com> [ Apologies if you have seen this elsewhere already - jtk ] Friends and colleagues, Last week I briefly discussed a new project we've recently launched and for which invited participation from the NANOG 62 attendees. This is a not so subtle wider request for consideration. UTRS is essentially a community RTBH that people have suggested to us would be a good service to provide, so we're giving it a go. The lightning talk page has the slide deck I presented: <https://www.nanog.org/meetings/abstract?id=2436> I've also put some additional technical detail here: <http://www.cymru.com/jtk/misc/utrs.html> There was a brief discussion, mostly criticism and that is fine, that took place on the NANOG list you may wish to review. If you have an assigned ASN and this sounds like something you or your network would like to take advantage of, drop me a line, I'd sure like to hear about it. If you think this is a terrible idea and want to express all that is wrong with it, tell me that too, I can take it. Even if you're unsure if you would ultimately deploy it in production, but are interested in testing it, do contact me. We won't expend energy on this project and will drop it if we there isn't sufficient interest from the community, but enough trial users would be encouraging. Kindly, John

1 0

Facebook NOC
by Stan Rivett 14 Oct '14

14 Oct '14

Hi guys Has anyone had any luck communicating with Facebook network operations in the past? They appear to be filtering our shiny new /22 and it is making clients somewhat grumpy. Cheers Stan Rivett ------------------ Netspeed Data Ltd PO Box 5691 Dunedin P: +64 3 481 7245 C: +64 21 323 841 ------------------

1 0

Is there anyone on the list using mikrotik hardware to receive UFB Handovers from Chorus?
by Alexander Neilson 10 Oct '14

10 Oct '14

Hey Everyone We have just stood up our first Chorus UFB Handovers in Auckland and Wellington and while the Mikrotik’s are showing the interfaces as running Chorus are telling me their end is “operationally down”. I have tried changing all the settings I have on my end and they are still reporting the same result. I have tried alternative optics, checked light levels with a meter, and even had a Chorus tech out to take a look. Chorus originally pointed to the SFP+ being the issue, now they are saying the config is wrong on my device and that they aren’t “seeing layer two”. I have asked them for any errors on the port or similar and they haven’t reported any to me. I am a little stumped here and would appreciate the advice of anyone doing either 1G or 10G HO Links for UFB with Chorus who could provide any input or any idea of issues they have seen with the configs that would help me diagnose this issue and resolve it. Thank you for your time. Regards Alexander Alexander Neilson Neilson Productions Limited alexander(a)neilson.net.nz 021 329 681 022 456 2326

5 7

Re: [nznog] UFB Upload Issues
by Peter Ensor 09 Oct '14

09 Oct '14

The change in the CFI to DEI occurred between the 802.1q 2005 and the 2011 versions. In 802.1q 2005 section 9.6 Octet 1 bit 5 was defined for use as CFI (Canonical Format Indicator) whereas in the 2011 version of the standard (also shown in section 9.6), this bit has been redefined as the DEI (Discard Eligible Indicator) bit. The diagram is for a single .Q tag but I assume it also applies to additional tags. Cheers, Peter. > From: Nathan Ward [mailto:nznog(a)daork.net] > Sent: Thursday, 9 October 2014 1:26 p.m. > To: Brent Marquis; Dave Mill; Don Stokes > Cc: nznog(a)list.waikato.ac.nz > Subject: Re: [nznog] UFB Upload Issues > > > On 9 October 2014 at 1:09:42 pm, Brent Marquis > (brent.marquis(a)chorus.co.nz(mailto:brent.marquis(a)chorus.co > .nz))<mailto:brent.marquis(a)chorus.co.nz(mailto:brent.marqu > is(a)chorus.co.nz))> wrote: > > > Sorry for the quick reply to myself! > > > > It actually seems like Don might not be 100% correct. > > > > I don?t have IEEE access to get the .1q standard? But > Wikipedia suggests it has been updated in 2005 for CFI to > be DEI: > > > http://en.wikipedia.org/wiki/IEEE_802.1ad > > > > Drop eligible indicator (DEI): a 1-bit field. (formerly > CFI[note > 1](http://en.wikipedia.org/wiki/IEEE_802.1Q#cite_note-2)[2 > ](http://en.wikipedia.org/wiki/IEEE_802.1Q#cite_note-3)) > May be used separately or in conjunction with PCP to > indicate frames eligible to be dropped in the presence of > congestion.[3](http://en.wikipedia.org/wiki/IEEE_802.1Q#ci > te_note-4) > > > With the note suggesting ? ?IEEE 802.1Q-2005 clause 9.6? > > > > If it?s on Wikipedia, it must be true?. Right? J > > The quote above is from the 802.1q page. If you read the > page you link to, the 802.1ad page, you get: > > In IEEE 802.1ad the CFI is replaced by a Drop Eligibility > Indicator (DEI), increasing the functionality of the PCP > field. > > Key bit is ?802.1ad?, not 802.1q. Using 0x88a8 vs > 0x8100/0x9100 is signalling that you?re using 802.1ad vs. > stacked 802.1q, so should set this bit appropriate to the > tag type. I?m with Don on this one - the frame type bits > signal how to interpret the following bits, you can?t just > swap them around. > > People should really just use 0x88a8 - those who aren?t, > can I ask why not? Is it because you?re trying to tunnel > it over a switch that doesn?t support 802.1ad or > something? I?m not saying it?s wrong, I?m interested in > understanding the situations in which you might do this. > > -- > Nathan Ward > This communication, including any attachments, is > confidential and may be legally privileged. If you are not > the intended recipient, you should not read it - please > contact me immediately, destroy it, and do not copy or use > any part of this communication or disclose anything about > it. Thank you. No confidentiality or privilege is waived > or lost by any mis-transmission or error. Please note that > this communication does not designate an information > system for the purposes of the Electronic Transactions Act > 2002. > >

3 2

Taking down `rpki-validator.lab.hotplate.co.nz' for a bit
by Michael Fincham 08 Oct '14

08 Oct '14

Hi all, I've noticed a few NZNOGish looking addresses hitting this service periodically, even though an automated upgrade to the rpki-ca package broke the database updates some months ago :) Thanks for checking it out, folks who did, and I hope you found it useful! Just a quick note to let everyone know I'm taking the validator app down for a bit until I have time to fix it and find it a new home (I'm currently paying for a whole VM for it to live on which seems a little unnecessary given it's partially broken). In the mean time, BGPmon has a (much more comprehensive) service you can query via WHOIS: <http://www.bgpmon.net/securing-bgp-routing-with-rpki-and-roas/> -- Michael

2 1

Re: [nznog] UFB Upload Issues (Ewen McNeill)
by Peter Ensor 08 Oct '14

08 Oct '14

Just for clarification, a 802.1ad (TPID = 88a8) does not need to have both a SVLAN and CVLAN. It is allowed to only be a single VLAN tag. This will occur when a an untagged packet ingresses a BS3/3a/4 type service at the UNI (Upstream frame). This frame will be wrapped with a SVLAN but because it did not contain any original CVLAN tag, there will not be any CVLAN tag in the packet that egresses the UFB Handover connection. My reading is that on a 802.1ad interface. the TPID = 88a8 indicates that it is a SVLAN whereas a TPID = 8100 would indicate that it is CVLAN or QinQ. Since both TPID's now use the DEI bit (since the 2011 standard) I'm not sure how else the two frames would be different. Cheers, Peter. Hi Brent, On 9/10/14 16:03, Brent Marquis wrote: > It just gets slightly more confusing. [...] > Which would mean your interpretation is that CFI on 802.1q only applies > if there is also an 88a8 802.1ad tag preceding it. Based on looking at the 802.1Q-2005 specification and 802.1ad-2005 specification that Nathan linked to, it seems to me that the intent of both 802.1Q-2005 and 802.1ad-2005 was that ethertype=0x8100 would mean "interpret the header as a 802.1Q VLAN Tag/802.1ad CVLAN Tag", both of which have the same bit pattern, and semantics -- including a CFI bit rather than a DEI bit. This is section 9.6 in both specifications (which makes sense since 802.1ad was based on 802.1Q). By contrast, in 802.1ad there is a SVLAN tag, with a separate ethertype (0x88a8), which is the same except that it has a DEI bit in the same bit position that 802.1Q/802.1ad has the CFI bit. This is section 9.7 in the 802.1ad specification. It seems to me that the intent was: if ethertype=0x8100 then bit is interpreted as CFI, else if ethertype=0x88a8 then bit is interpreted as DEI. Which gives an unambiguous interpretation, without needing any context (much easier for an ASCI implementation). So I'm pleased IEEE seem to have thought of this problem in advance and tried to avoid ambiguity. However, setting DEI on an 802.1ad frame with ethertype 0x88a8, then changing the ethertype of the outer tag to 0x8100 ("for compatibility" :-) ) seems to either (a) require force-clearing that bit to avoid confusion, or (b) lead to a potential for misinterpretation that causes traffic to be discarded. > IMO, our interface is .1ad and we dont believe being nice and tweaking > the ethertype at RSP request changes that :) but let me see what I can > find out from our Vendor. FWIW, it appears to me that sending two 0x8100 tags stacked is not 802.1ad, but some "pre-standard" double tagging. Even if the frames started out 802.1ad compliant. 802.1ad seems to require a SVLAN tag (0x88a8) around a CVLAN tag (0x8100). Although it appears the difference mostly only matters for the interpretation of this one bit (DEI or CFI). If Chorus is going to offer 0x8100-double-tagging (ie, two 0x8100 tags stacked, pre-802.1ad Q-in-Q) it seems like it'd maximise compatibility if you were able to clear bit 5 (CFI on 0x8100/DEI on 0x88a8) of the tag in that specific case (ie, two stacked 0x8100 tags). Ewen PS: For reference, Nathan's links: http://www.stephan-robert.ch/attachments/File/TIN08/802-1Q-2005.pdf https://github.com/yhaz/homeenv/blob/master/specs/802.1ad-2005.pdf beware the 802.1ad one is a revision 4 draft (they went to revision 6 before the release AFAICT: http://www.ieee802.org/1/pages/802.1ad.html) if you want to argue with vendors it might pay to get the official standard from IEEE directly.

2 1

APRICOT 2015 Programme Committee - call for volunteers
by Dean Pemberton 08 Oct '14

08 Oct '14

Hi everyone, The APRICOT 2015 Programme Committee is responsible for the solicitation and selection of suitable presentation and tutorial content for the APRICOT 2015 conference (http://2015.apricot.net/) The APIA Board selects a new Programme Committee each year and is now seeking nominations from the community. As part of APIA's partnership with APNIC, the PC will be responsible for building the technical & operational content for both APRICOT in Fukuoka, Japan in February/March 2015 and the APNIC 40 Conference in September 2015. Eligible PC candidates are those who have attended APRICOT & APNIC conferences in the recent past, have broad technical knowledge of Internet operations, and have reasonable familiarity with the format of APRICOT & APNIC conferences. Having constructive opinions and ideas about how the programme content might be improved is of high value too. PC members are expected to work actively to solicit content for the two events and review submissions for technical merit. The PC meets by conference call, weekly in frequency during the three months prior to each event. If you are interested in joining the PC and meet the above eligibility criteria, please send a brief note to "apia-sec at apia.org". The note should include affiliation (if any) and contact details (including e-mail address), and a brief description of why you would make a good addition to the PC. PC members receive complimentary registration for the event they helped assemble the programme for. The APIA Board will accept nominations received by the end of Friday 24 October, 2014, and will announce the new PC shortly thereafter. Many thanks! Mark Tinka, Raphael Ho & Dean Pemberton (APRICOT 2015 PC Chairs)

1 0

Re: [nznog] UFB Upload Issues
by Brent Marquis 08 Oct '14

08 Oct '14

Hi Craig, Yes, I spotted that this morning, hence we need some document updates - my understanding (it's not my document) is that specific wording hung around from an old version of the document and it was intended to point out that we will not utilise DEI/colour marking from RSPs into our network. Thanks, Brent BrentMarquis Layer 2 Network Specialist T +6448964169 M +64272290923 E Brent.Marquis(a)chorus.co.nz -----Original Message----- From: Craig Whitmore [mailto:lennon(a)orcon.net.nz] Sent: Thursday, 9 October 2014 10:44 a.m. To: Brent Marquis; nznog(a)list.waikato.ac.nz Subject: RE: [nznog] UFB Upload Issues Maybe I'm a little confused but reading the TUG it says DEI is not used /aware? Page 48 of the Chorus NGA TUG it states... Canonical Format Indicator (CFI) or Discard Eligible Indicator (DEI) is set to 0. DEI applies to the 802.1ad outer tag and is not used, i.e. NGA is not colour-aware. ???? -----Original Message----- From: nznog-bounces(a)list.waikato.ac.nz [mailto:nznog-bounces(a)list.waikato.ac.nz] On Behalf Of Brent Marquis Sent: Thursday, 9 October 2014 9:44 a.m. To: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] UFB Upload Issues Thanks for pushing all that info back into the list. I know of 1 RSP which has Juniper equipment that seems to be discarding CFI/DEI=1. I guess some switches need a bit of config to recognise CFI as DEI or to re-write it entirely (luckily there haven't been any hardware issues yet) This communication, including any attachments, is confidential and may be legally privileged. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. No confidentiality or privilege is waived or lost by any mis-transmission or error. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002.

1 0

Call for Papers NZNOG 2015
by Richard Nelson 05 Oct '14

05 Oct '14

It turns out that June is much too early to issue the CFP for NZNOG next January. So here it is again. We are negotiating with some interesting international speakers but we rely on submissions from the local community to make the programme interesting. Remember there is a prize of a trip to Japan. Richard. -------- The NZNOG organising committee invites papers for its 13th annual conference, to be hosted at the Distinction Hotel, Rotorua, New Zealand from 26 - 30th January 2015. There will the three day Workshops 26 – 28 January, a day of tutorials on 28 January with the main conference on 29 – 30 January. The best local conference paper as judged by the trustees in association with the programme committee will win a trip to APRICOT 2015, to be held jointly with APAN 39 in Fukuoka, Japan, from February 24th to March 6th 2015. Umm that’s right, an all[1] expenses paid trip to JAPAN!!!! It's a real thing. Two people have won this in previous years and to be honest they seemed pretty happy with the prize. Conference objective: The NZNOG conference, workshops and tutorials are a once-a-year opportunity for individuals and organisations involved in Internet operations to meet and share the latest in Internet operations, technologies practices and receive high quality training. The event is unique in New Zealand and attracts technical, skilled individuals with a genuine interest in Internet operations and Internetworking technologies. Submit a paper: Presenters are invited to submit abstracts of their paper for consideration by Monday 20th October. Abstracts should be no more than one page long and provide a summary of your networking-related subject matter. Please note that full slide decks will be required by late November. To submit your paper please e-mail: talks(a)nznog.org When considering a presentation, remember that the NZNOG audience is mainly comprised of technical network operators and engineers with a wide range of experience levels from beginners to multi-year experience. There is a strong orientation to offer core skills and basic knowledge in SIGs and to address issues relevant to the day-to-day operations of ISPs and network operators in the conference sessions. Note: The inclusion of a title, bio, topic, abstract, and slides with proposals is not compulsory but will help us determine the quality of your proposal and increase the likelihood it will be accepted. The organising committee will evaluate proposals based on fit with the conference’s objective and its ability to stimulate lively discussions around the current state of New Zealand networking. The best local paper will be judged by a selection of the trustees and the programme committee. It will be expected the best paper is submitted by the winner for presentation at APRICOT. More details on paper submission can be found at http://www.nznog.org/call-for-papers For more information about the conference visit www.nznog.org or contact: talks(a)nznog.org [1] where 'all' means Return Flights, Accommodation and Conference Fees. You still need to pay for things like food and entertainment. Most of what you need to eat/drink is covered in the conference though. We're also open to cases of special needs should you win. --------

1 0

Shell Shock - Bash vulnerability - CVE-2014-6271
by Dean Pemberton 28 Sep '14

28 Sep '14

Hi all, This isn't normally a security vuln release list but this one looks pretty bad A newly discovered vulnerability (CVE-2014-6271) in the Bash command-line interpreter poses a critical security risk to Unix and Linux systems. It allows remote code execution. NZITF is responding to this remote execution exploit, with a News page that we will be keeping up to date - http://www.nzitf.org.nz/news.html . We are also reaching out to technical and security community points of contact to raise awareness to the issue and ensure necessary action is taken (hence this email to you). Please note, no patch is yet available for Mac OSX. However, many other patches are available. So Patch, Patch, Patch. Regards, Dea

21 35

2degrees
by Matthew Harrison - PrimoWireless Ltd 24 Sep '14

24 Sep '14

Can someone from 2degrees please contact me off list. Regards, Matthew Harrison The Top Dog Please excuse the shortness of my email as it was sent from my phone.

2 1

Whole of Domain Web Harvest 2014 - Robots.txt
by Jay Gattuso 23 Sep '14

23 Sep '14

Hi Noggers, We are looking at undertaking another Whole of Domain (WOD) web harvest during this financial year. (I will be in touch with you with the specifics once we have some of the timings formalised with the crawl contractor, the Internet Archive. I wanted to ask for your views on adherence to robots.txt. We have three options that are hypothetically available to us, each with various merits. 1) Strictly adhere - will miss some artefacts required to replay a site correctly 2) Adhere but follow embeds - (allows us to get linked images, css, some json etc) 3) Ignore - most fulsome crawl. On the last WOD (in 2013) we used option (2), and I wanted to test if this was still the right option to choose. We aim to capture the most complete snapshot of the NZ web possible so it is available to future generations. This Robots issues directly affects the completeness of the crawl we can undertake. If we choose the wrong option, there is a risk of a, reduced crawl coverage, and frustrated web content operators. I'm really keen to make sure we are able to capture the most complete WOD we can, and seek your opinions on the above, on or off list. Many thanks, Jay Jay Gattuso | Digital Preservation Analyst | Preservation, Research and Consultancy National Library of New Zealand | Te Puna Mātauranga o Aotearoa PO Box 1467 Wellington 6140 New Zealand | +64 (0)4 474 3064 jay.gattuso(a)dia.govt.nz<mailto:jay.gattuso(a)natlib.govt.nz>

6 5

Did DNS replies for outlook.office365.com increase in size on Friday?
by Michael Fincham 23 Sep '14

23 Sep '14

Hi all, Out of curiosity - did anyone else see the DNS replies for outlook.office365.com scoot over 512 bytes on Friday? An ANY query from here currently returns a 740 byte answer. Trying to determine if Microsoft changed something on their end or my customer's router unexpectedly lost the ability to deal with large DNS replies 8^) -- Michael

3 4

2U swap for DR
by Rob McDonald 22 Sep '14

22 Sep '14

Hello all, I'm canvassing (soliciting??) for people interested to swap a few U and a few Mbps for a DR / monitoring server. People who just want to sell me rack space and data in a one way arrangement need not apply, I can research that myself. We are based in Auckland, but realise that all the sites we have available to put our monitoring and DR server are also in Auckland, with very similar network paths. To keep it on topic, to the winning referral goes the beer! Cheers Rob *Rob McDonald | *Director Level 2 Systems Ltd *M:* +64 21 902 929 *eFax:* +64 9 974 4734 *W:* http://www.L2.co.nz <http://www.l2.co.nz/>

1 0

Spark Lightbox question
by Tony Wicks 20 Sep '14

20 Sep '14

Hi guys, does anyone know the traffic path (or source IP's) for the Spark Lightbox service ? Interested to know if they are handing the traffic over APE or not. I really hope someone has not done something very stupid and put the streaming servers in Sydney and expect all the ISP's to pay to haul the traffic in internationally. [root(a)dalek ~]# traceroute lightbox.co.nz traceroute to lightbox.co.nz (54.252.86.48), 30 hops max, 60 byte packets 1 103-9-40-81.flip.co.nz (103.9.40.81) 1.355 ms 1.415 ms 1.408 ms 2 v503-ae1.icore1-e.flip.co.nz (103.9.41.35) 0.278 ms 0.280 ms 0.277 ms 3 v503-ae1.icore1-w.flip.co.nz (103.9.41.34) 0.290 ms 0.290 ms 0.284 ms 4 ten-1-0-0-250.bdr01.akl05.akl.VOCUS.net.nz (175.45.102.9) 0.254 ms 0.250 ms 0.245 ms 5 ten-0-2-0-3.cor01.alb01.akl.VOCUS.net.nz (114.31.202.88) 24.333 ms 24.328 ms 24.316 ms 6 ten-0-0-0-2.cor03.syd03.nsw.VOCUS.net.au (114.31.199.116) 23.842 ms 23.783 ms ten-0-3-0-2.cor03.syd03.nsw.VOCUS.net.au (114.31.202.85) 24.037 ms 7 ten-1-1-0.bdr03.syd03.nsw.VOCUS.net.au (175.45.72.116) 23.760 ms ten-2-1-0.bdr03.syd03.nsw.VOCUS.net.au (114.31.192.43) 23.733 ms 23.730 ms 8 16509.syd.equinix.com (202.167.228.131) 23.716 ms 23.986 ms 23.991 ms 9 54.240.192.77 (54.240.192.77) 24.736 ms 25.515 ms 24.739 ms 10 54.240.192.107 (54.240.192.107) 24.727 ms 24.841 ms 24.755 ms 11 ec2-54-252-0-1.ap-southeast-2.compute.amazonaws.com (54.252.0.1) 25.549 ms ec2-54-252-0-5.ap-southeast-2.compute.amazonaws.com (54.252.0.5) 25.781 ms ec2-54-252-0-1.ap-southeast-2.compute.amazonaws.com (54.252.0.1) 26.035 ms 12 * * * 13 * * * cheers

4 3

Call for NZ Provider
by Daniel Watson 20 Sep '14

20 Sep '14

Gday Noggers, I am currently seeking any NZ providers whom would meet the following requirements, Being able to rent dedicated servers at reasonable market pricing, Being able to provide us a BGP session on IPv4 & IPv6 to advertise our own IP's Being able to set up a VyOS VM to act as our router via a direct BGP session to said provider If you can meet these requirements, I am eger to meet you :D Please respond off-list if you can meet this requirement Regards, Daniel Watson Network Administrator / Network Operations Manager E Daniel(a)GloVine.com.au<mailto:Daniel(a)GloVine.com.au> W www.GloVine.com.au<http://www.GloVine.com.au> "No trees were harmed in the making of this email, however a large number of electrons were terribly inconvenienced."

1 0

[OT] APC Suppliers / Reps
by Alexander Neilson 18 Sep '14

18 Sep '14

Hey Noggers. Beer for the OT Taking a look at the APC Website and their Distributors I can only see acquire listed for NZ. I have no experience with them as a supplier, can others provide me with experiences offline? Also is there anyone else in NZ who supplies APC gear / is an APC Rep / Expert who would be able to help with planning some purchases? I have a couple of small DC’s to fit out (starting small but planning to improve management features on it as well). Any contact details would be much appreciated. Regards Alexander Alexander Neilson Neilson Productions Limited alexander(a)neilson.net.nz 021 329 681 022 456 2326

2 1

Kiwicon 8 CFP https://kiwicon.org/cfp2014.txt
by Mike Forbes 18 Sep '14

18 Sep '14

HI NOG Like you, we in the Kiwicon crue care about security. Also like you, we grew up in the 80s. Remember the 80s? they were good. Relatedly, we present our CFP (and training) https://kiwicon.org/cfp2014.txt We look forward to a few submissions from the New Zealand Network Operators' Group as you're all very intelligent and awesome. Beers, -- // Mike

1 0

Cisco ASR/LNS+VRF+Local Pool issue
by Skeeve Stevens 16 Sep '14

16 Sep '14

Hi all, I am having trouble with getting a PPPoE session to use a local ip pool via an AVPair. I am sending the following avpairs to the session from Radius (we're using Smile): lcp:allow-subinterface=yes ip:vrf-id=TESTVRF ip:addr-pool=TESTPOOL ip:ip-unnumbered=Loopback212 On the router: ip local pool TESTPOOL 100.64.8.1 100.64.15.254 The attributes are being received in the debug, and the session is ending up in the correct VRF, but there is no IP address being assigned on the local LNS. Router#show users ... Interface User Mode Idle Peer Address Vi2.1 testuser(a)test.com PPPoE - Router#show vrf ... Name Default RD Protocols Interfaces TESTVRF 65000:305 ipv4 Lo305 Vi2.1 ... Any help to figure out what is going on would be very much appreciated. Cisco IOS Software, ASR1000 Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 15.4(1)S, RELEASE SOFTWARE (fc2) ...Skeeve *Skeeve Stevens - *eintellego Networks Pty Ltd skeeve(a)eintellegonetworks.co.nz ; www.eintellegonetworks.co.nz Phone: +612 8014 7398; Cell +61 (0)414 753 383 ; skype://skeeve facebook.com/eintellegonetworks ; <http://twitter.com/networkceoau> linkedin.com/in/skeeve twitter.com/theispguy ; blog: www.theispguy.com The Experts Who The Experts Call Juniper - Cisco - Cloud - Consulting - IPv4 Brokering

2 2

A good read: The network nightmare that ate my week.
by Dean Pemberton 09 Sep '14

09 Sep '14

http://blog.bimajority.org/2014/09/05/the-network-nightmare-that-ate-my-wee…

3 2

GLIF2014 and SDNcon (REANNZ is hosting a few meetings)
by T. Charles Yun 07 Sep '14

07 Sep '14

All, full disclosure: I signed up for the mailing list to send this. A bit spammy, but on topic. Upside: if you go to the meetings, there will be beer. For you. GLIF 2014 29 Sep - 1 Oct 2014 Queenstown, NZ REANNZ <http://www.reannz.co.nz/>, the host of GLIF 2014 < http://glif-2014-conference.lilregie.com/>, invite you to come to lovely Queenstown, New Zealand to participate in a great set of talks < http://www.glif.is/meetings/2014/>, demonstrations and a wonderful dinner at the top of the mountain looking down on Lake Wakatipu. The meeting draws attendees from around the world who will be discussing SDN (software defined networking), lightpath exchanges, performance and virtualisation. A set of demanding demonstrations will also be using the temporary, high-speed network connection that is being brought to the hotel just for the meeting. You will see lightpath exchange technology, software defined networking, high-resolution (4k/8k) telemedicine and some new hardware. And if you can adjust to the altitude, an adventurous bunch will be taking an early morning run along the lake on Tuesday morning. We look forward to seeing you at GLIF, register now: < http://glif-2014-conference.lilregie.com/> If you happen to be in Wellington the following week, you might also be interested in participating in SDNcon <http://www.sdncon.net/>. This is a technical meeting designed for engineers. It will be hands-on-keyboard with an expected level of expertise in networking. Take a look at the website to see if it is for you. - Charles (because everyone else here was too scared to post this on their own) -- T. Charles Yun REANNZ email tcyun(a)reannz.co.nz mobi +64 21 526 758 post Level 1, 22 The Terrace, Wellington 6011, NZ

1 0

Help with Ripe Atlas Measurments
by Alexander Neilson 07 Sep '14

07 Sep '14

Hey Team Beer for the off topics. Can someone with experience with doing Measurements on Ripe Atlas please contact me off list? I am trying to do some research with their information however while the tests I am doing get results when I do them from my linux machines around the place I am getting empty result sets when testing through the Atlas. I have some requests into Ripe Atlas team as well as having read the documentation about the firmware and the structure of the response however I have still been able to get no valid responses. Regards Alexander Alexander Neilson Neilson Productions Limited alexander(a)neilson.net.nz 021 329 681 022 456 2326

1 0

Spark outage
by Juha Saarinen 06 Sep '14

06 Sep '14

Saw that TIFKAT suggests that customers manually change their DNS settings to sort out website access issues: http://helpbusiness.spark.co.nz/app/answers/detail/a_id/3701/related/1 What actually happened? Seen suggestions that it was a DNS amplification DDoS that might have been related to Spark customers clicking on phishing messages that had them download some form of malware that compromised their computers. Spark said: http://www.spark.co.nz/help/servicealert/mobileservicealert/ “The root cause is likely to be a handful of customers on our network whose computers are affected by malware, generating high levels of traffic destined for overseas sites.” Looks like it’s an ongoing issue too, as per the Spark service alerts. Has anyone seen any more detail on the incident? If this isn’t super operational, please email me off-list. Thanks -- Juha Saarinen twitter: juhasaarinen

5 4

Geekzone.co.nz dns/email issue
by Jean-Francois Pirus 05 Sep '14

05 Sep '14

If anybody from Geekzone is around, your mail server's forward DNS is not set up correctly. The A record for mail.geekzone.co.nz is missing. Sep 6 09:59:57 zeus postfix/smtpd[26470]: warning: 202.175.128.168: hostname mail.geekzone.co.nz verification failed: Name or service not known dig -x 202.175.128.168 168.128.175.202.in-addr.arpa. 3220 IN PTR mail.geekzone.co.nz. dig mail.geekzone.co.nz #nothing PS: I could not contact Geekzone directly as I can't register, (see above) -- Jean-Francois Pirus | Technical Manager francois(a)clearfield.com | Mob +64 21 640 779 | DDI +64 9 282 3401 Clearfield Software Ltd | Ph +64 9 358 2081 | www.clearfield.com

2 1

IANA AS Numbers registry update
by Selina Harrington 05 Sep '14

05 Sep '14

Hi, The IANA AS Numbers registry has been updated to reflect the allocation of the following blocks to LACNIC in September 2014: 64099-64197 Assigned by LACNIC 2014-09-05 263680-264604 Assigned by LACNIC 2014-09-05 264605-265628 Assigned by LACNIC 2014-09-05 You can find the IANA AS Numbers registry at: http://www.iana.org/assignments/as-numbers/as-numbers.xml The allocation was made in accordance with the Policy for Allocation of ASN Blocks to Regional Internet Registries: https://www.icann.org/resources/pages/global-policy-asn-blocks-2010-09-21-en Regards, Selina Harrington ******************************************* Internet Assigned Numbers Authority (IANA) Internet Corporation for Assigned Names & Numbers 12025 Waterfront Drive, Suite 300 Los Angeles, CA 90094 Phone: +1 310 301 5800 Fax: +1-310-823-8649 *******************************************

1 0

IANA IPv4 Recovered Address Space registry updated
by Selina Harrington 02 Sep '14

02 Sep '14

Hi, ICANN has updated the IANA IPv4 Recovered Address Space registry according to the Global Policy for Post Exhaustion IPv4 Allocation Mechanisms by the IANA. The policy states that in each IPv4 allocation period, each RIR will receive a single IPv4 allocation unit from ICANN. An IPv4 allocation period is defined as a 6-month period following 1 March or 1 September in each year. The address space selection software can be downloaded from: https://github.com/icann/ The list of allocations can be found at: https://www.iana.org/assignments/ipv4-recovered-address-space/ipv4-recovere… Regards, Selina Harrington ******************************************* Internet Assigned Numbers Authority (IANA) Internet Corporation for Assigned Names & Numbers 12025 Waterfront Drive, Suite 300 Los Angeles, CA 90094 Phone: +1 310 301 5800 Fax: +1-310-823-8649 *******************************************

2 1

IANA AS Numbers registry update
by Selina Harrington 02 Sep '14

02 Sep '14

Hi, The IANA AS Numbers registry has been updated to reflect the allocation of the following blocks to APNIC in September 2014: 64000-64098 Assigned by APNIC 2014-09-02 133632-134556 Assigned by APNIC 2014-09-02 134557-135580 Assigned by APNIC 2014-09-02 You can find the IANA AS Numbers registry at: http://www.iana.org/assignments/as-numbers/as-numbers.xml The allocation was made in accordance with the Policy for Allocation of ASN Blocks to Regional Internet Registries: https://www.icann.org/resources/pages/global-policy-asn-blocks-2010-09-21-en Regards, Selina Harrington ******************************************* Internet Assigned Numbers Authority (IANA) Internet Corporation for Assigned Names & Numbers 12025 Waterfront Drive, Suite 300 Los Angeles, CA 90094 Phone: +1 310 301 5800 Fax: +1-310-823-8649 *******************************************

1 0

DNSSEC single point of failure?
by Jean-Francois Pirus 26 Aug '14

26 Aug '14

Unless I'm missing something, looks like my internal dns stopped working because there were issues with the link to the US. All because dnssec is enabled in bind. Namely queries from a resolver server would timeout looking up MYHOST.MYDOMAIN.com.dlv.isc.org before it got to querying my authoritative server. Is there any way to work around that? Seems like a single point of failure, where resolvers will fail if there are any issues with com.dlv.isc.org. Thanks. -- Jean-Francois Pirus | Technical Manager francois(a)clearfield.com | Mob +64 21 640 779 | DDI +64 9 282 3401 Clearfield Software Ltd | Ph +64 9 358 2081 | www.clearfield.com

8 12

More NZ SDN news - CARDIGAN gains scale.
by Dean Pemberton 24 Aug '14

24 Aug '14

The CARDIGAN SDX system continues to gain scale in a production environment. The team is proud to announce that they have redesigned the system to provide OF1.3 multitable support which supports hardware with soft reconfigurable TCAM. CARDIGAN now provides a flexible controller framework which scales as quickly as vendors are increasing their TCAM support. With the current hardware (Pica8 3290 and Noviflow 1132) the system is able to support up to 130,000 flows today. The system optimises which flows are sent to the devices which means that many more routes that this number can be supported. Being able to support hardware from multiple vendors on the same framework allows engineers to deploy the right hardware, in the right location for them. In the early days of the deployment, there was concern expressed about the ability of this SDN system to scale. This framework now addresses those concerns head on. As can be seen below, the system is currently handling over 14,000 routes. We're going to make some changes so that we can test out the full capacity over the next few days. noviswitch# show stats table tableid 2 --------Table id: 2 Active count : 14716 Max_entries : 131071 Lookup count : 0 Match count : 0 The patches to the RouteFlow system which enable these features have been passed back to the RouteFlow development team so that they can be accessed by the entire community. Upwards and onwards.

2 1

Route limits
by Dave Mill 13 Aug '14

13 Aug '14

Hi all Just as a bit of a heads-up in case anyone else is hitting this issue (and not aware). We tend to be learning a total of about 511k or so unique IPv4 routes nowadays from external peers. Combine this with various internal routes and the actual number of IPv4 routes on a couple of our border routers is a few short of 512k. If any of these routers have a RIB or FIB limit of 512k IPv4 routes then expect some strange issues. Like random routes not showing up in your routing table.. *cough* brocade xmr default cam partition *cough* Have a nice day! Cheers Dave

6 8

IT/Network Service/Support in Shanghai
by Christoph Berthoud 11 Aug '14

11 Aug '14

Hi All, I am desperately looking for an IT consultant or company based in Shanghai who can offer Level 2/3 IT sales & support for my Shanghai office (10 staff) and speaks English as a first language. Trying to give technical instructions to someone with English as a second language is causing more harm than good and none of my staff there are technical enough for some of the steps I require of them. Any recommendations from our wonderful community much appreciated. Please reply off-list. -- Thanks Christoph

1 0

Apropos that dial-up discussion
by Juha Saarinen 06 Aug '14

06 Aug '14

<AOL>http://qz.com/245585/aol-still-has-2-3-million-dialup-subscribers-and-theyr…</AOL> -- Juha Saarinen twitter: juhasaarinen

1 0

Chorus ADSL to VDSL card swaps causing PPP issues
by Barry Murphy 06 Aug '14

06 Aug '14

Hey Guys, Chorus have been swapping cards in DSLAMs from NALT (ADSL Capable) to NVLT (VDSL Capable) throughout their network. >From looking at the Chorus Planned Network Notifications for a cabinet in BSY (Browns Bay) I can see over the last 2 months they have been swapping cards with about 65 customers at a time. Since this work began and customers swapped to the new cards we've noticed that some broadcom chipsets are having issues connecting with ADSL, it establishes PPP only around 10-20% of the time with 20 retries. Sometimes the router can connect within 5 mins and other times can take up to 60 minutes to reconnect. We've had Alcatel investigate and from our BNG/BRAS the correct PPPoE (chorus do the PPPoA conversion when used) packets are being sent to the CPE down the handovers however the CPE doesn't receive the ConfAck in the negotiation. Further investigation showed that the CPE was showing DSL sync but a downstream attenuation of 0, Chorus ESPM tool showed the same result, hence why the DSLAM may not be passing all the comms to the CPE. Cisco routers have no issues, however routers we have seen this issue with are DLINK: DSL-2750B, TP-LINK: W8950ND, NETGEAR: DGN1000, While I have not seen this issue on any of my direct customers, I have seeing about 30-40 cases on a ISP we manage their network for. Chorus have a case open for us though this has been ongoing for a few weeks now so just want to know if there are any other operators perhaps seeing similar cases? Many thanks -- Barry Murphy

2 1

Colo in the Tauranga West Chorus/UFF CO
by Jesse Archer 05 Aug '14

05 Aug '14

Evening, We're working on an upgrade project in Tauranga and may need to colocate some switches in the Chorus CO on Cameron RD. If you work for a operator that has rack space in this CO and know you can sublet space out to other operators, I'd appreciate if you could forward me a contact for one of your commercial guys so I can take it further. Only after 3-4U so thought I'd ask the community before looking at going down the road of getting an entire footprint (and having 90% of the space go to waste!). *Jesse Archer* *General Manager*Full Flavour *p. *07 929 7111 *ddi*. 07 281 1391 *s*. Skype username "myfullflavour" *e*. jesse(a)fullflavour.co.nz <jesse(a)fullflavourmedia.co.nz> *w*. fullflavour.co.nz <http://www.fullflavourmedia.co.nz/> *a. *Tauranga Business Centre, 50 Devonport Road, Tauranga *a*. PO Box 16306, Bethlehem 3176, New Zealand

1 0

Telecom Dial-up IPNet service
by Dave Mill 04 Aug '14

04 Aug '14

Hi Vaguely operational. Telecom have announced their Dial IP service will be retired on Dec 1 this year. Are any ISPs on this list intending on still offering dial-up after this date? Maybe using their own modem banks or via the TelstraVodahugClearDice equivalent service? Feel free to reply on or off list. Cheers Dave (vaguely representing Inspire Net)

8 7

Whitcoulls Network Contact
by Clayton Hubbard 03 Aug '14

03 Aug '14

Hi All, Is anyone on the list from Whitcoulls Networks that could contact me off-list. Thanks, *Clayton Hubbard* Senior Engineer, The Network for Learning Ltd W: http://www.n4l.co.nz A: Suite 306, Geyser Building, 100 Parnell Road, Parnell, Auckland 1052 P: PO Box 37118, Parnell, Auckland 1151 <http://www.n4l.co.nz> <https://twitter.com/@N4LNZ/> <https://www.facebook.com/NetworkForLearning> <https://plus.google.com/104649004276520409744/about> <http://www.linkedin.com/company/the-network-for-learning-ltd-n4l->

1 0

ntp2.ntp.net.nz failure
by Josh Simpson 01 Aug '14

01 Aug '14

Hi all, As some of you may have noticed ntp2.ntp.net.nz and its aliases p2.ntp.net.nz and s2.ntp.net.nz stopped responding late on 08-07-2014. This is related to a hardware fault with the NTP appliance, we are currently investigating both repair and replacement options. As a temporary measure the DNS records for ntp2.ntp.net.nz, p2.ntp.net.nz and s2.ntp.net.nz have been pointed to ntp3.ntp.net.nz. Information about these appliances and the services they provide can be found at https://ntp.net.nz. If you need any further information, please contact us at support(a)nzrs.net.nz Josh -- Josh Simpson Systems Administrator .nz Registry Services M: +64 21 783 399 P: +64 4 555 0124 GPG: 6516 B4EA 413B CAED 57B5 0956 124C 8AC3 A362 8080 www.nzrs.net.nz

5 7

Dynamic network topology mapping - L2 and L3
by Hamish 31 Jul '14

31 Jul '14

Hello there, Does anyone out there have a recommendation for a good network topology mapping application ? I want to see a live layer 2 and 3 topology diagrams - routing and vlans etc. juniper space used to have such a plugin but they killed it :( the only other mention of an app capable of such a thing that I have heard of is solar winds . Network Topology Mapper Any advice or experience with such an app would be much appreciated. cheers Hamish

8 8

Anyone got information about Lightbox Streaming
by Alexander Neilson 30 Jul '14

30 Jul '14

Hi All Just wondering if people knew where Spark was going to be serving up Lightbox from? Is it akamai? or another CDN system? I just looked at their base domain which seems to hit a redirect hosted in Amazon AWS and then to a register form hosted in Exact Target. Just wanting to see where the traffic will be coming from to be ready should it turn out to be popular (It does seem to be some first run stuff but still not convinced it will be amazingly popular - we will see) I didn’t find the information from my simple google search however this could be just a bad search. Regards Alexander Alexander Neilson Neilson Productions Limited alexander(a)neilson.net.nz 021 329 681 022 456 2326

1 0

More Xtra (Yahoo) email changes
by Martin Kealey 28 Jul '14

28 Jul '14

Last week it was Xtra blocking outbound mail at reception. This week any message having a Xtra or Yahoo address in the From header is being rejected upon receipt from our listserver, despite the listserver using its own address in the envelope & in the Sender header. When I follow the URL in the quoted SMTP responses, it turns out that Yahoo think I should change my listserver so that the senders address does not appear in the From header. Which sucks, because we already put the listserver's own address in the Sender header (which most mail clients will then render as "From knitting circle on behalf of Jane Smith"), and as far as I know, we're following the RFCs to the letter. So have I missed something in the RFCs that permits Yahoo to do this? They're essentially saying "we don't permit our subscribers to subscribe to mailing lists unless the mailing list is deliberately broken". -Martin

4 3

Spark/Telecom DNS issue
by Daniel Siva 28 Jul '14

28 Jul '14

FYI - looks like there is an issue with telecom authoritative DNS. Short version: it's currently broken. Long version: there is a whois/NS loop $ whois telecom.co.nz. ... domain_datelastmodified: 2014-07-28T13:54:33+12:00 ... ns_name_01: ns1.spark.co.nz ns_name_02: ns2.spark.co.nz ns_name_03: ns3.spark.co.nz $ whois spark.co.nz ... domain_datelastmodified: 2014-06-10T10:08:28+12:00 ... ns_name_01: ish4.telecom.co.nz ns_name_02: ish5.telecom.co.nz No glue records, so no way to resolve the NS IP's FYI: ish4.telecom.co.nz. A 146.171.13.195 ish5.telecom.co.nz. A 146.171.13.194 ns1.spark.co.nz. A 146.171.13.195 ns2.spark.co.nz. A 146.171.247.25 ns3.spark.co.nz. A 146.171.13.194 -- Daniel

5 5

Experience with Open Wireless Networks?
by B. Morgan Murrah 27 Jul '14

27 Jul '14

Hello- I wanted to enquire for anyone who may have experience or had issues with people running Open Wireless Networks and/or have any particular view to the Open Wireless movement (https://openwireless.org/)? Alongside this question I am interested in gauging how much IP Addresses are used as a token of identity for legal purposes in practice. This for the purposes of research at the Law Faculty of Otago. My apologies if this is somewhat outside of the purview of this mailing list. Any insight gratefully accepted. Regards -- B. Morgan Murrah [image: http://]about.me/bmmurrah https://keybase.io/airbridge <https://keybase.io/airbridge/key.asc>

3 2

Re: [nznog] NZNOG Digest, Vol 139, Issue 19
by Frank March 24 Jul '14

24 Jul '14

On 25/07/2014 12:00 p.m., nznog-request(a)list.waikato.ac.nz wrote: > Send NZNOG mailing list submissions to > nznog(a)list.waikato.ac.nz > > To subscribe or unsubscribe via the World Wide Web, visit > http://list.waikato.ac.nz/mailman/listinfo/nznog > or, via email, send a message with subject or body 'help' to > nznog-request(a)list.waikato.ac.nz > > You can reach the person managing the list at > nznog-owner(a)list.waikato.ac.nz > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of NZNOG digest..." > > > Today's Topics: > > 1. Xtra's email changes (Glen Eustace) > 2. Re: Xtra's email changes (Glen Eustace) > 3. Re: Xtra's email changes (Nathan Ward) > 4. Re: Xtra's email changes (Nathan Ward) > 5. Re: Xtra's email changes (Brian Gibbons) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 24 Jul 2014 20:19:42 +1200 > From: Glen Eustace <geustace(a)godzone.net.nz> > To: nznog <nznog(a)list.waikato.ac.nz> > Subject: [nznog] Xtra's email changes > Message-ID: <1406189982.13837.6.camel(a)agree-6.godzone.net.nz> > Content-Type: text/plain; charset="utf-8" > > Hi, > > Can somebody confirm or deny please. > > I just had another query where a customer uses Xtra broadband, and is > hence an xtra customer but are hosting their email with us. If they use > their someone(a)xtra.co.nz email address to authenticate against > send.xtra.co.nz, can they continue to use their own domain when sending > email ? > > This seems, in my opinion, to be something that should be allowed but I > can't test it as I am not an Xtra customer nor have access to an Xtra > broadband connection. > > Glen > -- ----- Frank March at home +64 (0)21 494 165

1 0

Re: [nznog] Xtra's email changes
by Glen Eustace 24 Jul '14

24 Jul '14

On Thu, 2014-07-24 at 20:30 +1200, Alexander Neilson wrote: > Probable that nobody can give you a final answer on it until the > policy actually takes effect as it would work fine now. > > > However you could contact xtra and ask. Probably good advice, so I gave it a go. The first person I spoke to didn't know so I was passed on to another. The response I received was. The 'send.xtra.co.nz' server will reject any address that has not been registered even if an xtra.co.nz address has been used for authentication. To register such addresses, ring the Telecom Broadband Help Desk on 0800225598. I then raised the question of whether the MFD photocopiers had been catered for as many don't provide a particularly feature-full smtp client. The answer was "I don't know, please try it and see, if it doesn't work please contact us and we will try to get it working for you". These were better responses than I had expected but still leave me trying to explain to our customers what they need to do. Sigh...

3 2

Re: [nznog] Xtra's email changes
by Nathan Ward 23 Jul '14

23 Jul '14

(Replying to the list, because you did the same for Alexander Neilson) On 24/07/2014, at 9:53 pm, Glen Eustace <geustace(a)godzone.net.nz> wrote: > On Thu, 2014-07-24 at 21:46 +1200, Nathan Ward wrote: >> I’m confused, are there questions you have that are not answered by this page? >> http://www.telecom.co.nz/help/internet/smtpupdate.html > > OK, I plead ignorance. I didn't get the original letter sent to the customer and I didn't know about this page. And yes you are right it pretty much gives all the answers. I learned about this page from this post: http://list.waikato.ac.nz/pipermail/nznog/2014-July/020987.html I have learned that it is wise not to ignore email from Richard Naylor, especially when it is a reply to a post you’ve made to the list. > In relation to the MFDs from what I have heard, the ones that are broken are not that old <face-sad.png> Like I say, don’t put them anywhere near the Internet, or replace them with something with software written since the 1990s. I’m sure the NE2000 network card upgrade was expensive at the time, but really, I’m sure it’s done it’s dash. Anyway, I recommend that the rest of this conversation happen on Geekzone, there’s a thread on it here: http://www.geekzone.co.nz/forums.asp?forumid=39&topicid=150006 -- Nathan Ward

1 0

Xtra's email changes
by Glen Eustace 23 Jul '14

23 Jul '14

Hi, Can somebody confirm or deny please. I just had another query where a customer uses Xtra broadband, and is hence an xtra customer but are hosting their email with us. If they use their someone(a)xtra.co.nz email address to authenticate against send.xtra.co.nz, can they continue to use their own domain when sending email ? This seems, in my opinion, to be something that should be allowed but I can't test it as I am not an Xtra customer nor have access to an Xtra broadband connection. Glen -- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Glen and Rosanne Eustace, GodZone Internet Services, a division of AGRE Enterprises Ltd., P.O. Box 8020, Palmerston North, New Zealand 4446 Ph: +64 6 357 8168, Fax: +64 6 357 8165, Mob: +64 27 542 4015 "A Ministry specialising in providing low-cost professional Internet Services to NZ Christian Churches, Ministries and Organisations"

1 0

CallPlus Old Open Recursive Resolver - closing
by Nick Clifford 22 Jul '14

22 Jul '14

Hi all, This by now is a pretty standard, we too are closing down public access to the last of our open recursive resolvers. CallPlus Group (Slingshot/Flip/2Talk/Callplus/Orcon) customers will continue to have access to them, but external access will be denied. IP Addresses: 202.180.64.2 202.180.64.3 202.180.64.4 202.180.64.9 Close Date: 31st July 2014 All of the above IP addresses will stop answering to recursive queries for non CallPlus/Slingshot/2Talk/Flip/Orcon customers Thursday Morning 31/July/2014. If for some strange reason this would cause you concern, please contact myself on this email address. (Malware authors are welcome to contact with their GPS coordinates and bunker thickness - we can arrange something). Cheers, Nick Nick Clifford NOC Support Manager Direct: +64 9 919 6162 Mobile: +64 21 960 411 Fax: +64 9 919 6163

1 1

DROA suspended by ICANN
by Juha Saarinen 21 Jul '14

21 Jul '14

Not before time. ICANN notice and story here: http://www.internetnews.me/2014/07/19/domain-registry-america-suspended-ica… -- Juha Saarinen twitter: juhasaarinen

1 0

Windows - Level 2 Help needed in Albany
by Skeeve Stevens 20 Jul '14

20 Jul '14

Hey all, I need someone for some onsite work in Albany on Thursday from about 4pm NZ time. Also, the SAME resources should be able to return back there on Friday morning for any user related issues. It is basically moving desktops from domain to another... about 11 desktops, making sure printing works, etc. One guy should be enough, but I'd like an option for two if required. Someone please get back to me ASAP so I can lock this in. Respond by email with skills/costs/etc. Someone with recommendations from someone I know and trust in the community would help :) ...Skeeve *Skeeve Stevens - *eintellego Networks Pty Ltd skeeve(a)eintellegonetworks.co.nz ; www.eintellegonetworks.co.nz Phone: +612 8014 7398; Cell +61 (0)414 753 383 ; skype://skeeve facebook.com/eintellegonetworks ; <http://twitter.com/networkceoau> linkedin.com/in/skeeve twitter.com/theispguy ; blog: www.theispguy.com The Experts Who The Experts Call Juniper - Cisco - Cloud - Consulting - IPv4 Brokering

2 2

Call for Presentations - DNS-OARC Fall Workshop, October 2014
by Sebastian Castro 20 Jul '14

20 Jul '14

Call for Presentations - DNS-OARC Fall Workshop, October 2014 Next OARC Fall Workshop will take place in Los Angeles, California, USA on October 11th to the 13th, the weekend before ICANN51. On Monday October 13th there will be a joint session with ICANN Tech Day. OARC is requesting proposals for presentations, with a preference for DNS data analysis tools and techniques. This workshop continues OARC's tradition of having meetings include a strong operational component. Presentations from DNS operators are particularly welcome. We'll also gladly accept talks from DNS researchers, as well as any other DNS-related subjects such as tools, visualizations, DNSSEC and novel uses of the DNS. If you are an OARC member, and have a sensitive topic you would like to present for members-only, we will accommodate those talks too. Adopting practice from other conferences, a section of lighting talks will be available for short presentations. Workshop Milestones * 20 July 2014, Call for Presentations posted * 21 July 2014, Open for submissions * 15 August 2014, Deadline for submission * 29 August 2014, Final Program published Details for abstract submission will be published here: https://indico.dns-oarc.net/event/workshop-2014-10 The workshop will be organized on different tracks, depending on the topics. On Sunday October 12th we will have the more in depth technical presentations, and on Monday October 13th presentations that can benefit from a larger and broader audience. If you consider submitting a presentation, please let the Programme Committee know for which track in advance to help us organize the presentations tracks. You can contact the Programme Committee: https://www.dns-oarc.net/oarc/programme via (submissions(a)dns-oarc.net) if you have questions or concerns. Sebastian Castro, for the OARC Programme Committee (Please note that OARC is run on a non-profit basis, and is not in a position to reimburse expenses or time for speakers at its meetings.)

1 0

BGP Session flapping with Vodafone Blue (Telstra Clear)
by Alexander Neilson 16 Jul '14

16 Jul '14

Has anyone else been seeing their Vodafone Blue (Telstra Clear) BGP sessions expiring hold timers / flapping this evening? We were experiencing the sessions timing out and dropping then coming back from about 6:50pm NZ till about 9:15pm NZ and looking at BGPlay I can’t see any withdrawals from when the sessions dropped so outbound traffic seemed to re route however inbound was at least partially black holed. I tried to ring the faults team and got no answer, I have sent in a fault via email nearly an hour ago and no response yet so was looking to try and isolate who / where people experienced this and try nut out what is happening. Regards Alexander Alexander Neilson Neilson Productions Limited alexander(a)neilson.net.nz 021 329 681 022 456 2326

3 3

Change to Telecom's email service
by Glen Eustace 14 Jul '14

14 Jul '14

We have had enquiries from several of our customers in the last couple of days regarding an email they have received from Telecom. It relates to a change in Telecom's email service that I find interesting. These customers use Telecom as their ISP, and have a mailbox on Telecom's Yahoo/Xtra service but they use their own domain when sending messages, we are their MX host and we redirect their mail to their xtra.co.nz address. Apparently from the end of September Telecom are going to prevent their customers from using their SMTP servers unless the From address on outbound email is an Xtra one (or I presume a domain that they manage). Up until now, we have always instructed customers to use the SMTP servers belonging to their ISP (i.e. the ISP providing their Internet service), that advice now goes out the window and we are going to have to work with Telecom's customers to help them setup authenticated SMTP to our servers. I am not impressed that Telecom are effectively going to break their email service (for their own customers) and are relying on others (e.g. us) to fix their customers email for them, when in my opinion, the customers email isn't currently broken. Glen.

9 9

Re: [nznog] Change to Telecom's email service
by Peter Lambrechtsen 14 Jul '14

14 Jul '14

Anyone can opt out of port 25 blocking. It's nothing to do with static ip or not. Sent from my phone on the smartphonetwork. -------- Original message -------- From: David Mitchell <David.Mitchell(a)lanworx.co.nz> Date: 15/07/2014 9:09 PM (GMT+12:00) To: Dave Green <dave.green(a)snowline.co.nz>,nznog(a)list.waikato.ac.nz Subject: Re: [nznog] Change to Telecom's email service That is correct, send requires authentication. A bit of a pain for Xerox copiers that don't support authentication correctly. Also, Telecom block outbound port 25, unless you opt out, and can only opt out on a connection with a static IP. -----Original Message----- From: nznog-bounces(a)list.waikato.ac.nz [mailto:nznog-bounces(a)list.waikato.ac.nz] On Behalf Of Dave Green Sent: Tuesday, 15 July 2014 6:32 p.m. To: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] Change to Telecom's email service > On 15/07/2014, at 17:43, Glen Eustace <geustace(a)godzone.net.nz> wrote: > > Here is the relevant parts of the email. NB: The customer uses their > xtra mailbox and POPs from it. But they have their From: set to the > address below. > > > OPTION 1: Keep using admin(a)customers-domain.co.nz. > [...] Doesn't send.xtra.co.nz require authentication while smtp.xtra.co.nz doesn't (but the connection must come from an Xtra subscriber)? Or something like that. If you get your free Xtra email addy and use that to auth to send.xtra.co.nz I wouldn't have thought it would matter what the From email address is. Sent from my iPad _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Does anyone sell upload favorable international transit in NZ?
by mcfbbqroast . 13 Jul '14

13 Jul '14

>From what I understand, most bandwidth purchased from the Southern Cross access cables is purchased in symmetrical quantities. ie 1gbps in both ways. Given that a lot of this is sold to residential ISPs with download favorable profiles, do any of them resell transit at a lower cost with a high up to down ratio (ie 1 gigabit up, 10 down or something similar)?

3 3

Re: [nznog] Upload favourable int'l transit in NZ
by Revel N 12 Jul '14

12 Jul '14

We have recently started offering more creative int'l transit options including time-of-day based bandwidth. You're welcome to contact me off-list if you want to discuss further. Revel Nambiar Network Architect ICONZ-Webvisions 0212428154 > On 13/07/2014, at 12:00 pm, nznog-request(a)list.waikato.ac.nz wrote: > > Send NZNOG mailing list submissions to > nznog(a)list.waikato.ac.nz > > To subscribe or unsubscribe via the World Wide Web, visit > http://list.waikato.ac.nz/mailman/listinfo/nznog > or, via email, send a message with subject or body 'help' to > nznog-request(a)list.waikato.ac.nz > > You can reach the person managing the list at > nznog-owner(a)list.waikato.ac.nz > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of NZNOG digest..." > > > Today's Topics: > > 1. Does anyone sell upload favorable international transit in > NZ? (mcfbbqroast .) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 13 Jul 2014 10:29:58 +1200 > From: "mcfbbqroast ." <bbqroast(a)gmail.com> > To: nznog(a)list.waikato.ac.nz > Subject: [nznog] Does anyone sell upload favorable international > transit in NZ? > Message-ID: > <CAKJkDEsBXMtQU9Tvwd1hF1S9JJGFKPZHmzujM6qHbGcAf8J1sA(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > >> From what I understand, most bandwidth purchased from the Southern Cross > access cables is purchased in symmetrical quantities. ie 1gbps in both ways. > > Given that a lot of this is sold to residential ISPs with download > favorable profiles, do any of them resell transit at a lower cost with a > high up to down ratio (ie 1 gigabit up, 10 down or something similar)? >

1 0

Linux.conf.au 2015 - Call for proposals closes soon
by Simon Lyall 09 Jul '14

09 Jul '14

A reminder that the Call for Proposals for Linux.conf.au 2015 in Auckland closes in a couple of days. If you want to submit a proposal for a talk, tutorial or a Miniconf you need to do it right away. Some advice on getting your talk accepted is here: http://www.linux.conf.au/cfp/gettingyourproposal === linux.conf.au Call For Proposals === The call for proposals for linux.conf.au 2015 is now open! The conference is a meeting place for the free and open source software communities. It will be held in Auckland at the University of Auckland Business School from Monday 12 to Friday 16 January, 2015, and provides a unique opportunity for open source developers, students, users and hackers to come together, share new ideas and collaborate. === Important Dates === * Call for Proposals opens 9 June 2014 * Call for Proposals closes 13 July 2014 * Email acceptances start September 2014 * Early bird registrations open 23 September 2014 * Conference dates: Monday 12 January to Friday 16 January, 2015 === Information on Proposals === The linux.conf.au 2015 papers committee is looking for a broad range of proposals, and will consider submissions on anything from programming and software, to desktop, mobile, gaming, userspace, community, government, space, and education. There is only one rule: *Your proposal must be related to open source* This year, the papers committee is going to be focused on open source in education as well as our usual focus on deep technical content. The conference is to a large extent what the speakers make it: if we receive heaps of excellent submissions on a topic, then it's sure to be represented at the conference. Here's a few ideas to get you started: * Clouds, data centers and scalability. * Community challenges; legal threats; education and outreach. * Documentation for open source projects. * HTML5; multimedia codecs. * Kernel developments; new architectures. * Open hardware; embedded systems; wearable computing. * Security; privacy; anonymity. * Networking; Software defined networking; bufferbloat; network function virtualization. * Software development; programming languages. * Sysadmin and automation. linux.conf.au is known for presentations and tutorials that are strongly technical in nature, but proposals for presentations on other aspects of free software and open culture, such as educational and cultural applications of open source, are welcome. === Code of Conduct === linux.conf.au welcomes first-time and seasoned speakers from all free and open communities: people of all ages, genders, nationalities, ethnicities, backgrounds, religions, abilities, and walks of life. We respect and encourage diversity at our conference. By agreeing to present at or attend the conference, you are agreeing to abide by the terms and conditions (http://lca2015.linux.org.au/cor/terms_and_conditions) We also expect all speakers and delegates to have read and understood our Code of Conduct (http://lca2015.linux.org.au/cor/code_of_conduct) === Format === There are three different ways that you can present your content: * Presentations * Tutorials * Mini conferences _Presentations_ Presentations are 45 minute slots that are generally presented in lecture format. These form the bulk of the available conference slots. _Tutorials_ Tutorials are 100 minutes long, and are generally presented in a classroom format. They should be interactive or hands-on in nature. Tutorials are expected to have a specific learning outcome for attendees. _Mini conferences_ Miniconfs are one or two day long sessions on a specific topic. A separate CFP form will be used to propose and select miniconfs, and is available at http://lca2015.linux.org.au/miniconf-cfp === Speaker Information === In recognition of the value that speakers bring to our conference, once a proposal is accepted a speaker is entitled to: * Free registration, which holds all of the benefits of a Professional Delegate Ticket * Exclusive tickets to the Speakers' Dinner for the speaker and their immediate family * One free family ticket to the Partners' Programme If your proposal includes more than one speaker, these additional speakers are not entitled to free registration or to any extra benefits. linux.conf.au does not and will not pay speakers to present at the conference. linux.conf.au is able to provide limited financial assistance for some speakers, for instance, where the cost of flights or accommodation might prohibit a speaker from attending. Please note, however, that there is a limited budget for travel assistance and that asking for assistance could affect your chances of acceptance. === Recording and Licensing === To increase the number of people that can view your presentation, linux.conf.au might record your talk and make it publicly available after the event. When submitting your proposal you will be asked to release materials relating to your presentation under a Creative Commons ShareAlike License. Additionally, if you are discussing software in your presentation, you must ensure the software has an appropriate open licence. All presentation material should be suitable for people aged 12 and above. All presentations are subject to Linux Australiaâ€™s code of conduct, including that they must not contain: sexual or violent imagery exclusionary language language which is not appropriate for an all-ages audience For more information, see: http://lca2015.linux.org.au/cfp === About Linux Australia === Linux Australia is the peak body for open source communities around Australia, and as such represents approximately 3500 Free and Open Source users and developers. Linux Australia supports the organisation of this international Free Software conference in a different Australasian city each year. For more information about Linux Australia see: http://www.linux.org.au/ === Papers Enquiries === For enquiries related to this CFP, or to presentations at linux.conf.au generally, contact the linux.conf.au 2015 Papers Committee by email: papers-chair at linux.org.au -- Simon Lyall | Volunteer | Linux.conf.au 2015 conference | http://www.linux.conf.au

1 0

Juniper MX with inline-jflow and full tables
by Ewen McNeill 09 Jul '14

09 Jul '14

Is anyone running a Juniper MX-80 type platform (MX5/10/40/80) and using inline-jflow (which runs in the TFEB) on the same router as full IPv4 BGP tables? Either with the current JTAC recommended release (12.3R6.6) or some other software release. I have a client that has been trying this, and found that moving to 12.3R6.6 and being _very_ careful about what goes into the TFEB[0] has made it _better_ than it was with previous software releases. But still not exactly rock solid, run forever. If anyone has experiences they'd be willing to share, either positive or negative, I'd be interested. Either on list or off list. (I'm happy to summarise back to the list if anything useful gets turned up.) Ewen +64-21-916-965 [0] To avoid running out of memory -- inline-jflow seems inclined to use about 1/3rd of the TFEB memory when it is turned on, and of course full v4 tables require a bunch of TFEB memory too.

2 1

Sky Television Point of Contact
by Alexander Neilson 08 Jul '14

08 Jul '14

Can anyone from sky tv please make contact off list with me to discuss delivery of services etc? We have tried making contact through the front door and seem to be hitting black holes where nothing gets a response. Thank You Beer! Regards Alexander Alexander Neilson Neilson Productions Limited alexander(a)neilson.net.nz 021 329 681 022 456 2326

1 0

Fwd: [apnic-talk] [Apnic-announce] Just over one week to be heard - APNIC Survey 2014
by Dean Pemberton 02 Jul '14

02 Jul '14

It's important for people to let APNIC know what they can improve. I encourage people to take some time to fill in the survey, member or not. If you don't know anything about APNIC, then fill in the survey and say that! =) Dean ---------- Forwarded message ---------- From: Secretariat <Secretariat(a)apnic.net> Date: Thu, Jul 3, 2014 at 5:21 PM Subject: [apnic-talk] [Apnic-announce] Just over one week to be heard - APNIC Survey 2014 To: apnic-announce(a)lists.apnic.net ________________________________________________________________________ Just over one week to be heard - APNIC Survey 2014 ________________________________________________________________________ Help guide the future direction of APNIC by completing the APNIC Survey 2014 before it closes next Friday, 11 July. https://survey.apnic.net Complete the Survey and you go into the draw to win a Samsung Galaxy TabPRO 10.1 (16GB, 4G) or an Apple iPad Mini (Retina 16GB, 4G). And, if you share the following text on Twitter or Facebook, you go into the exclusive social media draw to win an additional prize. "I’ve just completed the 2014 #apnicsurvey – visit survey.apnic.net to provide your thoughts. You could win a prize!" Will you be lucky like our two winners, Md Moinul Hossain from Bangladesh and Nitin Janardan Dalvi from India, and win a new tablet? Take the APNIC Survey 2014 now! https://survey.apnic.net ----------------------------- APNIC runs the Survey every two years to help ensure we are meeting the needs and wishes of our Members and those using APNIC services. The Singapore Internet Research Center (SIRC) is conducting the Survey and will provide an analysis of the data and a survey report to the APNIC community. The survey is anonymous, and no identifying information will be made available to APNIC. APNIC is grateful for feedback provided by Survey participants. ---------------------------- ________________________________________________________________________ APNIC Secretariat secretariat(a)apnic.net Asia Pacific Network Information Centre (APNIC) Tel: +61 7 3858 3100 PO Box 3646 South Brisbane, QLD 4101 Australia 6 Cordelia Street, South Brisbane, QLD http://www.apnic.net ________________________________________________________________________ _______________________________________________ Apnic-announce mailing list Apnic-announce(a)lists.apnic.net http://mailman.apnic.net/mailman/listinfo/apnic-announce _______________________________________________ apnic-talk mailing list apnic-talk(a)lists.apnic.net http://mailman.apnic.net/mailman/listinfo/apnic-talk

1 0

Re: [nznog] POSTing problems.
by Pete Mundy 02 Jul '14

02 Jul '14

(copied back to NZNOG as it is semi-operational and others may be able to chip in) Sorry Criggie, not certain as I don't know enough about CGN to say. I had just assumed CGNs would would handle non-80/443 TCP traffic! Otherwise you can't get your lulz catz emails without webmail?! If you're ring-fenced behind http then yeah that's somewhat restrictive. For what I'm using them for (quick remote tool for 1 person), I just use SSH outbound over a high TCP port into a (free :) EC2 instance that I reactivate when needed. The TCP session is kept alive with a minimal trickle of data until I'm ready to log in over it (Pi just keeps trying periodically if server is down because EC2 instance is paused). So if they (cell carrier) only pass TCP/80 & 443 (and then probably transparently proxied & sanity-checked for HTTP compliance etc too?!), then no, I think maybe my wee boxes probably wouldn't work behind that. I do trigger a periodic 'call home with stats' poll over https as well, and that would probably get through, but the tunnel itself needs that high TCP port to operate. I did set them up for IPv6 tunnels concurrent to the v4 ones though, and that can can actually sometimes be quite useful as sometimes one can get in via v6 when one's v4 is down! I don't suppose there is any chance your cell provider does IPv6? If not then I guess tunnelling over DNS or maybe over HTTP or HTTPS might be the only option to get through that; and if they're mucking with the POSTs then maybe even that couldn't get through! Pete On 2/07/2014, at 5:42 PM, Criggie <criggie(a)criggie.org.nz> wrote: > Pete Mundy wrote, On 02/07/14 15:59: >> I find the Raspberry Pi a most excellent tool for this purpose. I config them up to call home & hold a tunnel open through the users inevitable NAT. I post one out to the end user, get them to plug it in where the fault is occurring, and then I log into it though the tunnel and do all the testing and captures remotely. Coupled with capturing tcpdumps on the server's interface itself , this gives full visibility of both ends of the connection (and hence the ability to determine if the packets are coming through uninhibited). >> > Does this work through carrier grade NAT? I have to come up with a > solution for remote access to a cellular site in Brisbane River (its on > a pontoon and has no possibility of anything but cellular) > > Problem is they get a 100.60.x.x IP address, and it can't use anything > but http/https. > > So I wonder if openvpn /tcp on port 443 will work. Have you tried this? > > -- > Criggie > > http://criggie.org.nz/

2 2

Thoughts about IP Transit
by Skeeve Stevens 02 Jul '14

02 Jul '14

Hey all, There was a discussion recently on Ausnog about Transit, so I was inspired to make a video about some of my thoughts on the subject. I've done this video as my ISP Guy thing, and I thought I would share it as you might find it useful or interesting. It isn't meant to stir up people, but I am sure it may, especially those selling transit in a certain way. This video is more about educating people about the value of transit in certain kinds of ways. It is about 14 mins long, but I'd like to know what you thought if you have time to watch it. http://theispguy.com/thoughts-about-transit/ or https://www.youtube.com/watch?v=Wpq_jOMEmdM The pricing I mention in the video is mostly relevant to Australia and I realise pricing is somewhat different in NZ. That brings up a question... what is the pricing of transit in NZ and what ways are people selling it? Are terms 6, 12, 18, 24 months? What is the average price you are seeing? Does pricing drop much at scale? Who are the key providers of quality transit? Is there a demand for 1:1 in NZ? or is a little contention ok? Just a few questions so I can understand the NZ market a bit more and in future perhaps include that in my commentary. ...Skeeve *Skeeve Stevens - *eintellego Networks Pty Ltd skeeve(a)eintellegonetworks.co.nz ; www.eintellegonetworks.co.nz Phone: +612 8014 7398; Cell +61 (0)414 753 383 ; skype://skeeve facebook.com/eintellegonetworks ; <http://twitter.com/networkceoau> linkedin.com/in/skeeve twitter.com/theispguy ; blog: www.theispguy.com The Experts Who The Experts Call Juniper - Cisco - Cloud - Consulting - IPv4 Brokering

5 6

Re: [nznog] Vocus buys FX Networks
by Darren Moss 01 Jul '14

01 Jul '14

I think he has great values and the fact that he was prepared to goto jail for a cause which cost someone their life is a little more deserving than being called a dick. -------- Original message -------- From: Skeeve Stevens <skeeve(a)eintellegonetworks.co.nz> Date: 02/07/2014 12:59 PM (GMT+10:00) To: Darren Moss <Darren.Moss(a)webhostnz.co.nz> Cc: Shain Singh <shain.singh(a)gmail.com>,Jamie Baddeley <jamie.baddeley(a)vpc.co.nz>,NZNOG Mailing-List <nznog(a)list.waikato.ac.nz>,Dean Pemberton <dean(a)deanpemberton.com> Subject: Re: [nznog] Vocus buys FX Networks We sent Derryn to prison for being a dick. ...Skeeve Skeeve Stevens - eintellego Networks Pty Ltd skeeve(a)eintellegonetworks.co.nz ; www.eintellegonetworks.co.nz Phone: +612 8014 7398; Cell +61 (0)414 753 383 ; skype://skeeve facebook.com/eintellegonetworks ; linkedin.com/in/skeeve twitter.com/theispguy ; blog: www.theispguy.com The Experts Who The Experts Call Juniper - Cisco - Cloud - Consulting - IPv4 Brokering On Wed, Jul 2, 2014 at 12:45 PM, Darren Moss <Darren.Moss(a)webhostnz.co.nz> wrote: Hey don't knock Derryn, he is a good man. He still does a spot with Duncan Garner on Live. DM. ----- Original Message ----- From: Shain Singh To: Jamie Baddeley Cc: NZNOG Mailing-List ; Dean Pemberton Sent: Wednesday, July 02, 2014 2:41 PM Subject: Re: [nznog] Vocus buys FX Networks only if you promise to keep Derryn Hinch. On 2 Jul 2014, at 10:19 am, Jamie Baddeley <jamie.baddeley(a)vpc.co.nz> wrote: You can have Russell Crowe. jamie On 2 July 2014 14:16, Skeeve Stevens <skeeve(a)eintellegonetworks.co.nz> wrote: 2011? Kinda like you guys still talking about Crowded House, Pavlova, Lamingtons, Phar Lap, Russell Crowe & Wheetbix :) Next you will be trying to claim Lorde as a kiwi :) ...Skeeve Skeeve Stevens - eintellego Networks Pty Ltd skeeve(a)eintellegonetworks.co.nz ; www.eintellegonetworks.co.nz Phone: +612 8014 7398; Cell +61 (0)414 753 383 ; skype://skeeve facebook.com/eintellegonetworks ; linkedin.com/in/skeeve twitter.com/theispguy ; blog: www.theispguy.com The Experts Who The Experts Call Juniper - Cisco - Cloud - Consulting - IPv4 Brokering On Wed, Jul 2, 2014 at 12:01 PM, Dean Pemberton <nznog(a)deanpemberton.com> wrote: ... yes, better than the Australians http://www.stuff.co.nz/sport/basketball/4944153/Breakers-secure-first-ANBL-… On Wed, Jul 2, 2014 at 1:57 PM, Skeeve Stevens <skeeve(a)eintellegonetworks.co.nz> wrote: Maybe an NZ team is next! Do they play basketball in NZ? :) ...Skeeve Skeeve Stevens - eintellego Networks Pty Ltd skeeve(a)eintellegonetworks.co.nz ; www.eintellegonetworks.co.nz Phone: +612 8014 7398; Cell +61 (0)414 753 383 ; skype://skeeve facebook.com/eintellegonetworks ; linkedin.com/in/skeeve twitter.com/theispguy ; blog: www.theispguy.com The Experts Who The Experts Call Juniper - Cisco - Cloud - Consulting - IPv4 Brokering On Wed, Jul 2, 2014 at 11:41 AM, Matt Richards <matt(a)shakesbeare.com> wrote: Maybe that's why he bought a basketball team. Matt. On 2/07/2014 1:30 p.m., Skeeve Stevens wrote: James isn't tall enough to be an overlord :) ...Skeeve Skeeve Stevens - eintellego Networks Pty Ltd skeeve(a)eintellegonetworks.co.nz ; www.eintellegonetworks.co.nz Phone: +612 8014 7398; Cell +61 (0)414 753 383 ; skype://skeeve facebook.com/eintellegonetworks ; linkedin.com/in/skeeve twitter.com/theispguy ; blog: www.theispguy.com The Experts Who The Experts Call Juniper - Cisco - Cloud - Consulting - IPv4 Brokering On Wed, Jul 2, 2014 at 11:15 AM, Jo - Mesh|net <jo(a)mesh.net.nz> wrote: Hopefully they'll give me a local contact to ply with beer / stand-over to connect better to Cisco at HKIX without whatever packet filters they current apply. I, for one welcome our Vocus overlords. > PING 66.114.168.199 (66.114.168.199): 56 data bytes 36 bytes from webex-rge.hkix.net (202.40.161.251): Communication prohibited by filter Jo Booth - Mesh|net Connecting Communities Jo(a)Mesh.net.nz | mob +64 21 526684 | wk +64 4 9141213 On 2 July 2014 13:00, Skeeve Stevens <skeeve(a)eintellegonetworks.co.nz> wrote: So, Vocus is on the road to becoming a very big player in the NZ market... and with their Australian assets and Trans-Tasman capacity, this makes their likely future product offerings potentially interesting. http://www.businessspectator.com.au/news/2014/7/2/technology/vocus-strength… Any thoughts in the NZ market on the implications/benefits/negatives of this acquisition? ...Skeeve Skeeve Stevens - eintellego Networks Pty Ltd skeeve(a)eintellegonetworks.co.nz ; www.eintellegonetworks.co.nz Phone: +612 8014 7398; Cell +61 (0)414 753 383 ; skype://skeeve facebook.com/eintellegonetworks ; linkedin.com/in/skeeve twitter.com/theispguy ; blog: www.theispguy.com The Experts Who The Experts Hey all,Call Juniper - Cisco - Cloud - Consulting - IPv4 Brokering _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog -- Shain Singh p: +61 422 921 951 e: shain.singh(a)gmail.com -- Math problems? Call 1-800-(10x)(13i)^2]-[sin(xy)/2.362x] _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

3 2

Vocus buys FX Networks
by Skeeve Stevens 01 Jul '14

01 Jul '14

So, Vocus is on the road to becoming a very big player in the NZ market... and with their Australian assets and Trans-Tasman capacity, this makes their likely future product offerings potentially interesting. http://www.businessspectator.com.au/news/2014/7/2/technology/vocus-strength… Any thoughts in the NZ market on the implications/benefits/negatives of this acquisition? ...Skeeve *Skeeve Stevens - *eintellego Networks Pty Ltd skeeve(a)eintellegonetworks.co.nz ; www.eintellegonetworks.co.nz Phone: +612 8014 7398; Cell +61 (0)414 753 383 ; skype://skeeve facebook.com/eintellegonetworks ; <http://twitter.com/networkceoau> linkedin.com/in/skeeve twitter.com/theispguy ; blog: www.theispguy.com The Experts Who The Experts Hey all,Call Juniper - Cisco - Cloud - Consulting - IPv4 Brokering

11 15

POSTing problems.
by Steve Holdoway 01 Jul '14

01 Jul '14

Sorry, small fry here looking for guidance. I have a couple of websites running on separate VPSes at Optus in Sydney, and they are showing exactly the same symptoms: they seem to be working fine if routing from NZ via Voda or TC / Vocus, but if using Telecom, they can't POST anything at all - can view webstes no bother, but logging in, filling in forms, forget it. Any ideas? I set up both sites so may have done something weird ( I'm on voda! ) and not noticed. Quote from forum user - pretty succinct: "At work - no problems - we use a Telstra/Voda link to Oz then out to the world through corporate IT there. Works like a dream. Response times are <1ms. On mobile 3/4G via Vodafone it works okay, no performance or login issues that I can tell. At home, my old man's place, and the in-laws place, all Telecom (and Wi-Fi onto my iDevices) it is okay to browse without being logged in but as soon as you log in it either 1.) logs you straight out of whatever page your on when you navigate to another page, or 2.) it runs like arse and won't let you post, then logs you out. Basically unusable." Is this a known problem with a simple fix, or have I stuffed up??? Cheers, Steve -- Steve Holdoway BSc(Hons) MIITP http://www.greengecko.co.nz Linkedin: http://www.linkedin.com/in/steveholdoway Skype: sholdowa

6 7

Someone isn't nice
by Skeeve Stevens 01 Jul '14

01 Jul '14

So, I wonder who this is? ---- Mailing list removal confirmation notice for mailing list NZNOG We have received a request from 75.80.59.51 for the removal of your email address, "skeeve(a)eintellegonetworks.co.nz" from the nznog(a)list.waikato.ac.nz mailing list. To confirm that you want to be removed from this mailing list, simply reply to this message, keeping the Subject: header intact. Or visit this web page: ---- ...Skeeve *Skeeve Stevens - *eintellego Networks Pty Ltd skeeve(a)eintellegonetworks.co.nz ; www.eintellegonetworks.co.nz Phone: +612 8014 7398; Cell +61 (0)414 753 383 ; skype://skeeve facebook.com/eintellegonetworks ; <http://twitter.com/networkceoau> linkedin.com/in/skeeve twitter.com/theispguy ; blog: www.theispguy.com The Experts Who The Experts Call Juniper - Cisco - Cloud - Consulting - IPv4 Brokering

1 0

GRE BGP Peering
by Daniel Watson 30 Jun '14

30 Jun '14

Gday Noggers, I am interested to see whom would be interested in setting up a GRE tunnel to our Melbourne network and running BGP peering between each other? Please reply off-list if you are interested so we don't inconvenience the rest of the list. Regards, Daniel Watson Network Administrator / Network Operations Manager E Daniel(a)GloVine.com.au W www.GloVine.com.au

2 1

Question on Extreme VMAN
by Jodi Thomson 29 Jun '14

29 Jun '14

Hi All Currently we have a Cisco ME3400 handing the qinq for our fibre connection. However it only has 2xGig ports so have to uplink to a separate switch in the core to keep everything at a gig. Before purchasing new kit we have a couple of Extreme X450e switches. Their qinq implementation VMAN is supposedly compatible, providing Ethertype is set correctly. However documentation is a little light on details regarding configuration so I am wondering if anyone here has any experience with it. Current Cisco config below - can it be duplicated using VMAN? Off list replies are fine interface GigabitEthernet0/1 description Connects to Core port-type nni switchport mode trunk switchport vlan mapping 12,101,1200-1202 dot1q-tunnel 503 switchport vlan mapping 600-649 dot1q-tunnel 501 switchport vlan mapping 650-700 dot1q-tunnel 502 switchport vlan mapping default drop ! interface GigabitEthernet0/2 description Connects to Fibre port-type nni switchport mode trunk media-type sfp Thanks in advance, beer Cheers Jodi

1 1

Visualisation of the IXP's
by Jamie Baddeley 27 Jun '14

27 Jun '14

Hi folks, Thanks to the awesome work of Blair Harrison we now have a visualisation of the NZIX. A very interesting thing to see and it's nice to see the ANZAC aspect of it. See here: http://nzix.net/peers.html We'll be working on refining the process which extracts the information and readies it for this sort of presentation so that it will be updated nightly. We'll let you know when that's done. Thanks Blair! Feedback welcome of course. Cheers jamie

5 6

Vodafone New Zealand - access to recursive resolvers
by David Robb 27 Jun '14

27 Jun '14

To all members, Vodafone New Zealand will start blocking external access to the recursive DNS servers of the former TelstraClear network to non-customers as of July 3rd 2014. Some of our former customers or other users with Vodafone modems may have the IP addresses of our DNS servers set up on their devices. With that in mind, we'd like to notify you that from midnight 01 July 2014 we will stop providing DNS resolution for external non-Vodafone users, resulting in such customers being unable to browse the internet. The affected DNS servers are at the following IP addresses: 203.97.33.14 203.97.37.14 203.97.78.43 203.97.78.44 Vodafone customers who need help with this change can contact the Vodafone Technical Contact Centre on 0800 438 448. Regards David Robb Transport Design Engineer, Vodafone New Zealand

2 2

reprogram Brocade SFP+ optic to work in a Juniper QFX?
by Simon Blake 26 Jun '14

26 Jun '14

Hi folks Does anybody in NZ have a mechanism to repurpose a bunch of Brocade SFP+ optics into something a QFX will tolerate? Need a moderately quick turnaround (this week), hence the local constraint. Cheers Simon

1 1

Transit Questions (IPv6, MTU, EDNS)
by Alexander Neilson 25 Jun '14

25 Jun '14

Hi All I am looking to see what others experiences are with transit providers. Mainly I am wondering about IPv6 Support and MTU Sizes >From talking to my upstream providers it appears that 1500MTU is the limit I have access to, and one of my two upstreams doesn’t provide IPv6 for transit. This leads my to a few logical questions: * How many transit providers provide MTU above 1500 Bytes? * How many transit providers do not provide IPv6 transit? * How do others handle EDNS? I was doing some looking around our systems a while back and I found a default setting in the Bind9 version we were running that set EDNS to 4096 Bytes. Now all of our transit is limited it seems to 1500 Bytes, so I set the config to limit the announced support down into the usable range by us and saw a reduction in the need for DNS retries. Do other people just have better handling of fragmentation? Do you find any issues having EDNS announcing support for sizes above your transit? do you just have transit that supports MTU over 1500 Bytes? And a big issue in my opinion is the lack of IPv6 support from transit providers. I am not sure about other providers but it will be one deciding factor when purchasing transit going forward. Happy to receive information off list if people don’t want to name on here. Regards Alexander Alexander Neilson Neilson Productions Limited alexander(a)neilson.net.nz 021 329 681 022 456 2326

5 6

Linux.conf.au 2015 in Auckland - Call for Proposals
by Simon Lyall 24 Jun '14

24 Jun '14

=== linux.conf.au Call For Proposals === The call for proposals for linux.conf.au 2015 is now open! The conference is a meeting place for the free and open source software communities. It will be held in Auckland at the University of Auckland Business School from Monday 12 to Friday 16 January, 2015, and provides a unique opportunity for open source developers, students, users and hackers to come together, share new ideas and collaborate. === Important Dates === * Call for Proposals opens 9 June 2014 * Call for Proposals closes 13 July 2014 * Email acceptances start September 2014 * Early bird registrations open 23 September 2014 * Conference dates: Monday 12 January to Friday 16 January, 2015 === Information on Proposals === The linux.conf.au 2015 papers committee is looking for a broad range of proposals, and will consider submissions on anything from programming and software, to desktop, mobile, gaming, userspace, community, government, space, and education. There is only one rule: *Your proposal must be related to open source* This year, the papers committee is going to be focused on open source in education as well as our usual focus on deep technical content. The conference is to a large extent what the speakers make it: if we receive heaps of excellent submissions on a topic, then itâ€™s sure to be represented at the conference. Hereâ€™s a few ideas to get you started: * Clouds, data centers and scalability. * Community challenges; legal threats; education and outreach. * Documentation for open source projects. * HTML5; multimedia codecs. * Kernel developments; new architectures. * Open hardware; embedded systems; wearable computing. * Security; privacy; anonymity. * Networking; Software defined networking; bufferbloat; network function virtualization. * Software development; programming languages. * Sysadmin and automation. linux.conf.au is known for presentations and tutorials that are strongly technical in nature, but proposals for presentations on other aspects of free software and open culture, such as educational and cultural applications of open source, are welcome. === Code of Conduct === linux.conf.au welcomes first-time and seasoned speakers from all free and open communities: people of all ages, genders, nationalities, ethnicities, backgrounds, religions, abilities, and walks of life. We respect and encourage diversity at our conference. By agreeing to present at or attend the conference, you are agreeing to abide by the terms and conditions (http://lca2015.linux.org.au/cor/terms_and_conditions) We also expect all speakers and delegates to have read and understood our Code of Conduct (http://lca2015.linux.org.au/cor/code_of_conduct) === Format === There are three different ways that you can present your content: * Presentations * Tutorials * Mini conferences _Presentations_ Presentations are 45 minute slots that are generally presented in lecture format. These form the bulk of the available conference slots. _Tutorials_ Tutorials are 100 minutes long, and are generally presented in a classroom format. They should be interactive or hands-on in nature. Tutorials are expected to have a specific learning outcome for attendees. _Mini conferences_ Miniconfs are one or two day long sessions on a specific topic. A separate CFP form will be used to propose and select miniconfs, and is available at http://lca2015.linux.org.au/miniconf-cfp === Speaker Information === In recognition of the value that speakers bring to our conference, once a proposal is accepted a speaker is entitled to: * Free registration, which holds all of the benefits of a Professional Delegate Ticket * Exclusive tickets to the Speakers' Dinner for the speaker and their immediate family * One free family ticket to the Partners' Programme If your proposal includes more than one speaker, these additional speakers are not entitled to free registration or to any extra benefits. linux.conf.au does not and will not pay speakers to present at the conference. linux.conf.au is able to provide limited financial assistance for some speakers, for instance, where the cost of flights or accommodation might prohibit a speaker from attending. Please note, however, that there is a limited budget for travel assistance and that asking for assistance could affect your chances of acceptance. === Recording and Licensing === To increase the number of people that can view your presentation,linux.conf.au might record your talk and make it publicly available after the event. When submitting your proposal you will be asked to release materials relating to your presentation under a Creative Commons ShareAlike License. Additionally, if you are discussing software in your presentation, you must ensure the software has an appropriate open licence. All presentation material should be suitable for people aged 12 and above. All presentations are subject to Linux Australiaâ€™s code of conduct, including that they must not contain: sexual or violent imagery exclusionary language language which is not appropriate for an all-ages audience For more information, see: http://lca2015.linux.org.au/cfp === About Linux Australia === Linux Australia is the peak body for open source communities around Australia, and as such represents approximately 3500 Free and Open Source users and developers. Linux Australia supports the organisation of this international Free Software conference in a different Australasian city each year. For more information about Linux Australia see: http://www.linux.org.au/ === Papers Enquiries === For enquiries related to this CFP, or to presentations at linux.conf.au generally, contact the linux.conf.au 2015 Papers Committee by email: papers-chair at linux.org.au

1 0

Re: [nznog] Power event in Sky tower
by Martin Spencer 23 Jun '14

23 Jun '14

Hi Everyone. I am Martin Spencer, the owner of The Data Centre at 220 Queen Street. I have been following the thread on the Auckland Peering Exchange and thought it would be useful to bring you up to date with some recent changes in my data centre. We now have two generators and have just completed construction of our own sub-station to service the whole building instead of Vector's old one. We have never had a complete power outage, though in the early days we did experience an outage on one UPS. I then had all the UPSs modified to try and ensure it wouldn't happen again. I would like to confirm that we do not charge monthly cross-connect fees. The only charge is for setting up the connection and that is based on what it costs to run the cable. Since I do not and never will supply bandwidth I am carrier neutral and have always hoped that I could encourage people to peer in my facility. If a formal peering exchange were to be set up here I would not want to be involved in the administration. I would do all I could to support and encourage it but would continue with my current philosophy of concentrating on making the physical infrastructure (aircon, power, security) as robust and reliable as possible. If one or a group of you would like to meet with me to discuss how we can improve our facilities and make them more transparent and available to you, please contact me. Martin Spencer martin(a)datacentre.co.nz +64 (9) 304-0737

2 2

Trademe Contact
by Matthew Harrison - PrimoWireless Ltd 22 Jun '14

22 Jun '14

Can someone from Trademe make contact off list - I have some users being contacted by Trademe being asked why they are selling from overseas. Regards, Matthew Harrison The Top Dog p. 06 7566620 | e. <mailto:matthew(a)primowireless.co.nz> matthew(a)primowireless.co.nz

1 0

Rack Space & Service
by Pete gmail 22 Jun '14

22 Jun '14

I am looking for someone in AKL and WLG to provide racking, stacking and cabling services for data centres. We need a sub 4 hour response to service calls. Feel free to contact me off list. LightSpeed Pete *Peter Macaulay* Managing Director *The Number One IT Group* PO Box 25481 St Heliers <http://maps.google.com/maps?q=PO+Box+25481%2CSt+Heliers%2CAuckland%2C1740%2…> Auckland, 1740 New Zealand *Mobile:* 64 21 488 485 *Fax:* *Email:* peter(a)no1.co.nz <mailto:peter(a)no1.co.nz> *IM:* petermacaulay (Skype) *http://nz.linkedin.com/in/petermacaulay* See who we know in common <http://www.linkedin.com/e/wwk/2680292/?hs=false&tok=1C3cGjM9hG1kY1> Want a signature like this? <http://www.linkedin.com/e/sig/2680292/?hs=false&tok=1qpDY4lIRG1kY1>

1 0

Routing contact at GGI/Telecom
by McDonald Richards 18 Jun '14

18 Jun '14

Hello, This one is a last resort since normal channels are failing. Can somebody with routing clue at GGI/Telecom who understands how your domestic/international networks are strung together please contact me off-list via email. Macca Vocus

3 3

Re: [nznog] Visualisation of the IXP's
by "NOC＠NGWnoc"＠ngw.co.nz 18 Jun '14

18 Jun '14

Very well done, very impressed, congrats guys. Handy tool to keep book marked too :-) -- NOC @ Next Generation Wholesale - ngw.co.nz > > > - > > > -------- Original Message -------- > Subject: [nznog] Visualisation of the IXP's > Date: Thu, 19 Jun 2014 17:06:21 +1200 > From: Jamie Baddeley<jamie.baddeley(a)vpc.co.nz> > To: nznog<nznog(a)list.waikato.ac.nz> > > > > Hi folks, > > > Thanks to the awesome work of Blair Harrison we now have a visualisation > of the NZIX. A very interesting thing to see and it's nice to see the > ANZAC aspect of it. > > See here: > http://nzix.net/peers.html > > We'll be working on refining the process which extracts the information > and readies it for this sort of presentation so that it will be updated > nightly. We'll let you know when that's done. > > Thanks Blair! > > Feedback welcome of course. > > Cheers > > jamie > > > > > >

1 0

Power event in sky tower
by Alexander Neilson 16 Jun '14

16 Jun '14

Did anyone else notice a power event in sky tower in the last 15 Minutes? Regards Alexander Alexander Neilson Neilson Productions Limited alexander(a)neilson.net.nz 021 329 681 022 456 2326

19 28

Re: [nznog] old MAC 48-bit addresses that seem to be Local not Universal
by manning 16 Jun '14

16 Jun '14

On 16June2014Monday, at 21:35, manning bill <bmanning(a)isi.edu> wrote: > thats always been true…. (that MACs are not universal and can be overwritten) > > /bill > PO Box 12317 > Marina del Rey, CA 90295 > 310.322.8102 > > On 16June2014Monday, at 20:37, Jim Cheetham <jim(a)gonzul.net> wrote: > >> I've just been writing some guidance for our internal network that will help people to use manually-allocated MAC addresses rather than hardware ones. >> >> In order to indicate that these are Locally Administered MAC addresses properly, I need to set the "second-least-significant but of the most significant byte of the address", and to make them normal Unicast addresses the last bit should be a zero; therefore the last two bits will be "10" and unless my calculator has died converting things :-) in the standard hex representation the second character must be one of 2,6,A or E ... >> >> So to double-check, I grabbed the current OUI list from IEEE http://standards.ieee.org/develop/regauth/oui/oui.txt and found 18 entries that match this pattern & therefore look like Local addresses. >> >> $ egrep -i '^ +.[26AE]-' tmp/oui.txt >> 02-07-01 (hex) RACAL-DATACOM >> 02-1C-7C (hex) PERQ SYSTEMS CORPORATION >> 02-60-86 (hex) LOGIC REPLACEMENT TECH. LTD. >> 02-60-8C (hex) 3COM CORPORATION >> 02-70-01 (hex) RACAL-DATACOM >> 02-70-B0 (hex) M/A-COM INC. COMPANIES >> 02-70-B3 (hex) DATA RECALL LTD >> 02-9D-8E (hex) CARDIAC RECORDERS INC. >> 02-AA-3C (hex) OLIVETTI TELECOMM SPA (OLTECO) >> 02-BB-01 (hex) OCTOTHORPE CORP. >> 02-C0-8C (hex) 3COM CORPORATION >> 02-CF-1C (hex) COMMUNICATION MACHINERY CORP. >> 02-E6-D3 (hex) NIXDORF COMPUTER CORPORATION >> AA-00-00 (hex) DIGITAL EQUIPMENT CORPORATION >> AA-00-01 (hex) DIGITAL EQUIPMENT CORPORATION >> AA-00-02 (hex) DIGITAL EQUIPMENT CORPORATION >> AA-00-03 (hex) DIGITAL EQUIPMENT CORPORATION >> AA-00-04 (hex) DIGITAL EQUIPMENT CORPORATION >> >> (I also found a single 'multicast' value in there, but it doesn't seem to be a problem :- >> $ egrep -i '^ +.[13579BDF]-' tmp/oui.txt >> 11-00-AA (hex) PRIVATE) >> >> Some great old historical names on that list! Are these just relics of previous allocations, or are any of these in any meaningful way "live" in the real world? >> >> -jim >> _______________________________________________ >> NZNOG mailing list >> NZNOG(a)list.waikato.ac.nz >> http://list.waikato.ac.nz/mailman/listinfo/nznog >

1 0

old MAC 48-bit addresses that seem to be Local not Universal
by Jim Cheetham 16 Jun '14

16 Jun '14

I've just been writing some guidance for our internal network that will help people to use manually-allocated MAC addresses rather than hardware ones. In order to indicate that these are Locally Administered MAC addresses properly, I need to set the "second-least-significant but of the most significant byte of the address", and to make them normal Unicast addresses the last bit should be a zero; therefore the last two bits will be "10" and unless my calculator has died converting things :-) in the standard hex representation the second character must be one of 2,6,A or E ... So to double-check, I grabbed the current OUI list from IEEE http://standards.ieee.org/develop/regauth/oui/oui.txt and found 18 entries that match this pattern & therefore look like Local addresses. $ egrep -i '^ +.[26AE]-' tmp/oui.txt 02-07-01 (hex) RACAL-DATACOM 02-1C-7C (hex) PERQ SYSTEMS CORPORATION 02-60-86 (hex) LOGIC REPLACEMENT TECH. LTD. 02-60-8C (hex) 3COM CORPORATION 02-70-01 (hex) RACAL-DATACOM 02-70-B0 (hex) M/A-COM INC. COMPANIES 02-70-B3 (hex) DATA RECALL LTD 02-9D-8E (hex) CARDIAC RECORDERS INC. 02-AA-3C (hex) OLIVETTI TELECOMM SPA (OLTECO) 02-BB-01 (hex) OCTOTHORPE CORP. 02-C0-8C (hex) 3COM CORPORATION 02-CF-1C (hex) COMMUNICATION MACHINERY CORP. 02-E6-D3 (hex) NIXDORF COMPUTER CORPORATION AA-00-00 (hex) DIGITAL EQUIPMENT CORPORATION AA-00-01 (hex) DIGITAL EQUIPMENT CORPORATION AA-00-02 (hex) DIGITAL EQUIPMENT CORPORATION AA-00-03 (hex) DIGITAL EQUIPMENT CORPORATION AA-00-04 (hex) DIGITAL EQUIPMENT CORPORATION (I also found a single 'multicast' value in there, but it doesn't seem to be a problem :- $ egrep -i '^ +.[13579BDF]-' tmp/oui.txt 11-00-AA (hex) PRIVATE) Some great old historical names on that list! Are these just relics of previous allocations, or are any of these in any meaningful way "live" in the real world? -jim

1 0

Re: [nznog] Power event in sky tower
by Tim Hoffman 15 Jun '14

15 Jun '14

>From memory you have to be in the location in order to request it be added. Closest I have a node where I am now days is Sydney.... --Hoff Sent from my iPhone > On Jun 15, 2014, at 6:08 PM, Dean Pemberton <dean(a)deanpemberton.com> wrote: > > Sounds like your hand up to me Hoff :) > >> On Monday, June 16, 2014, Tim Hoffman <tim(a)hoffman.net.nz> wrote: >> If someone could make some effort to get all the facilities people peer at in Auckland registered in peeringdb, this would also help! >> >> Last I looked sky was the only one in there, and I added mayoral. But getting Kingston, 220Q, and the various DCs in there too would be of great use.... >> >> Sent from my iPhone >> >>> On Jun 15, 2014, at 5:56 PM, McDonald Richards <McDonald.Richards(a)vocus.com.au> wrote: >>> >>> Using PeeringDB like the rest of the Internet would be best. You could introduce a peering track/BOF into the NZNOG conference or get a lightning talk on how to use peeringdb? >>> >>> Macca >>> >>> >>> From: Dean Pemberton <dean(a)deanpemberton.com> >>> Date: Monday, 16 June 2014 10:54 AM >>> To: Jamie Baddeley <jamie.baddeley(a)vpc.co.nz> >>> Cc: McDonald Richards <McDonald.Richards(a)vocus.com.au>, nznog <nznog(a)list.waikato.ac.nz> >>> Subject: Re: [nznog] Power event in sky tower >>> >>> Good feedback Jamie. >>> >>> Not knowing where people are is a criticism I've heard a number of times now. >>> >>> Most recently from a large content delivery network operator who went to the Peering DB and struggled to find any info on NZ ASNs. >>> >>> I think we're past people keeping their pop locations a secret. >>> Would something like a meet-me location web page, or a primer on how to use the Peering DB for the same purpose be useful to people? >>> 'Peering socials' are held at other overseas meetings and they might be a good use for some nznog conference time. >>> >>> Essentially operators get up on stage. Present a slide on where they are located and what their peering policy is. This is then followed by beer to allow deals to be made. >>> >>> Seems to me that enough people saying 220 queen at one of these events might just get some traction. >>> >>> Could even get some colo operators along. >>> >>> On Monday, June 16, 2014, Jamie Baddeley <jamie.baddeley(a)vpc.co.nz> wrote: >>> Hi Guys, >>> >>> Citylink have been in the process of refreshing it's core infrastructure over the last few months. The big nodes for us in Auckland are Kingston and 220 Queen for many of the reasons that folks have already outlined. That's not to say Sky Tower is not important to us - it's just got different (ahem) qualities. So from Citylink's perspective 220 Queen is good. The sales guys tell me there's a bit of space at Kingston too. >>> >>> Having said that we're always focussed on making the APE a distributed exchange point so in reality it shouldn't really matter where you are (inside the footprint of course). I guess you'd just need to weigh up whether being able to shop around for colocation and all of it's associated costs and the benefits that brings vs the cost of APE connectivity. Simply put we think the cost of making the wrong choice for colocation will outweigh any APE stuff. >>> >>> Others have mentioned Mayoral Drive too. Falling out of the NZNOG conference this year was a message to get APE in there. We're working on that. Because we try to keep the cost of delivery low, we're having to be a little creative - essentially allowing us to set up crossconnects from an APE switch inside the site when we've been hosted by a 3rd party. Last time I spoke to someone at Chorus about this they said it wouldn't be until October until they could get into that. >>> >>> Others have also mentioned a cost difference that is largely there for historical reasons. Citylink are actually looking at normalising the pricing across the APE to make it fairer for everyone. That's inline with our aim to have a distributed IXP so that it really doesn't matter where you are. >>> >>> It'd be neat to see a list of locations around Auckland and who is where. That'll help us to make sure the APE is where you need it to be. >>> >>> Cheers > > > -- > Regards, > > Dean >

2 1

Re: [nznog] Power event in sky tower
by McDonald Richards 15 Jun '14

15 Jun '14

Using PeeringDB like the rest of the Internet would be best. You could introduce a peering track/BOF into the NZNOG conference or get a lightning talk on how to use peeringdb? Macca From: Dean Pemberton <dean(a)deanpemberton.com<mailto:dean(a)deanpemberton.com>> Date: Monday, 16 June 2014 10:54 AM To: Jamie Baddeley <jamie.baddeley(a)vpc.co.nz<mailto:jamie.baddeley(a)vpc.co.nz>> Cc: McDonald Richards <McDonald.Richards(a)vocus.com.au<mailto:McDonald.Richards(a)vocus.com.au>>, nznog <nznog(a)list.waikato.ac.nz<mailto:nznog(a)list.waikato.ac.nz>> Subject: Re: [nznog] Power event in sky tower Good feedback Jamie. Not knowing where people are is a criticism I've heard a number of times now. Most recently from a large content delivery network operator who went to the Peering DB and struggled to find any info on NZ ASNs. I think we're past people keeping their pop locations a secret. Would something like a meet-me location web page, or a primer on how to use the Peering DB for the same purpose be useful to people? 'Peering socials' are held at other overseas meetings and they might be a good use for some nznog conference time. Essentially operators get up on stage. Present a slide on where they are located and what their peering policy is. This is then followed by beer to allow deals to be made. Seems to me that enough people saying 220 queen at one of these events might just get some traction. Could even get some colo operators along. On Monday, June 16, 2014, Jamie Baddeley <jamie.baddeley(a)vpc.co.nz<mailto:jamie.baddeley(a)vpc.co.nz>> wrote: Hi Guys, Citylink have been in the process of refreshing it's core infrastructure over the last few months. The big nodes for us in Auckland are Kingston and 220 Queen for many of the reasons that folks have already outlined. That's not to say Sky Tower is not important to us - it's just got different (ahem) qualities. So from Citylink's perspective 220 Queen is good. The sales guys tell me there's a bit of space at Kingston too. Having said that we're always focussed on making the APE a distributed exchange point so in reality it shouldn't really matter where you are (inside the footprint of course). I guess you'd just need to weigh up whether being able to shop around for colocation and all of it's associated costs and the benefits that brings vs the cost of APE connectivity. Simply put we think the cost of making the wrong choice for colocation will outweigh any APE stuff. Others have mentioned Mayoral Drive too. Falling out of the NZNOG conference this year was a message to get APE in there. We're working on that. Because we try to keep the cost of delivery low, we're having to be a little creative - essentially allowing us to set up crossconnects from an APE switch inside the site when we've been hosted by a 3rd party. Last time I spoke to someone at Chorus about this they said it wouldn't be until October until they could get into that. Others have also mentioned a cost difference that is largely there for historical reasons. Citylink are actually looking at normalising the pricing across the APE to make it fairer for everyone. That's inline with our aim to have a distributed IXP so that it really doesn't matter where you are. It'd be neat to see a list of locations around Auckland and who is where. That'll help us to make sure the APE is where you need it to be. Cheers jamie On 16 June 2014 12:08, McDonald Richards <McDonald.Richards(a)vocus.com.au<javascript:_e(%7B%7D,'cvml','McDonald.Richards(a)vocus.com.au');>> wrote: I would think 220 Queen Street would be the logical one for that reason? The bar is set pretty high for entry into Mayoral Drive… Macca From: Tony Wicks <tony(a)wicks.co.nz> Date: Monday, 16 June 2014 10:05 AM To: 'Simon Allard' <Simon.Allard(a)team.orcon.net.nz> Cc: 'nznog' <nznog(a)list.waikato.ac.nz> Subject: Re: [nznog] Power event in sky tower If there is going to be a realistic alternative site it needs to cater to the smaller “community cabinet” customers and have a connect via whatever method suits you attitude. Mayoral drive is the polar opposite of this. From:nznog-bounces(a)list.waikato.ac.nz [mailto:nznog-bounces(a)list.waikato.ac.nz] On Behalf Of Simon Allard Sent: Monday, 16 June 2014 12:00 p.m. To: nznog Subject: Re: [nznog] Power event in sky tower Mayoral Drive Exchange seems to be the other place to be, but Citylink have no POP there, which is a shame. From:nznog-bounces(a)list.waikato.ac.nz [mailto:nznog-bounces(a)list.waikato.ac.nz] On Behalf Of Dean Pemberton Sent: Monday, 16 June 2014 11:46 a.m. To: Joel Cc: nznog Subject: Re: [nznog] Power event in sky tower Sounds like a good suggestion. Citylink? Care to comment? And yes, everyone is there today... but if you want things to change then you do need to start a process. Whats a better place in Auckland which we could start to work towards? On Mon, Jun 16, 2014 at 11:36 AM, Joel <joel(a)hd.net.nz> wrote: Someone from Citylink may like to confirm what I have said. ________________________________ _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz<javascript:_e(%7B%7D,'cvml','NZNOG(a)list.waikato.ac.nz');> http://list.waikato.ac.nz/mailman/listinfo/nznog -- Regards, Dean

2 1

APNIC Survey 2014 - Your Views Matter
by Elly Tawhai 12 Jun '14

12 Jun '14

________________________________________________________________________ APNIC Survey 2014 - Your Views Matter ________________________________________________________________________ Hi NZNOG Community, The APNIC Survey 2014 is now available and is open from 11 June - 11 July 2014. http://survey.apnic.net APNIC runs the Survey every two years to ensure we are meeting the needs and wishes of our Members and those who use APNIC services. Your views are extremely valuable to APNIC. The results of the Survey help guide the future direction of the organization. The Singapore Internet Research Center (SIRC) is conducting the Survey and they will provide an analysis of the data and a survey report to APNIC. The survey is anonymous, and no identifying information will be made available to APNIC. Special Early Bird competition ------------------------------ All participants who complete the APNIC Survey 2014 will have a chance to win a prize. An additional Early Bird prize will give those who complete the Survey by 17 June at 23:59 (UTC +10) another chance to win either a Samsung Galaxy TabPRO 10.1 (16GB, 4G) or an Apple iPad Mini (Retina 16GB, 4G). Take the APNIC Survey 2014 now! http://survey.apnic.net We thank you for your continued support of APNIC. Kind regards, Elly ------------------------------------------------------------------------ Elly Tawhai email: elly(a)apnic.net Senior Internet Resource Analyst/ sip: elly(a)voip.apnic.net Liaison Officer(Pacific), APNIC phone: +61 7 3858 3188 http://www.apnic.net fax: +61 7 3858 3199 ------------------------------------------------------------------------ Join us for APNIC 38 Brisbane. Visit - http://conference.apnic.net/38

1 0

Call for papers - NZNOG 2015
by Richard Nelson 11 Jun '14

11 Jun '14

Doing something interesting in the Internetworking space? Submit an NZNOG conference paper and you could win a trip to the next APRICOT meeting in Bangkok Thailand! -------- The NZNOG organising committee invites papers for its 13th annual conference, to be hosted at the Distinction Hotel, Rotorua, New Zealand from 26 - 30th January 2015. There will the three day Workshops 26 – 28 January, a day of tutorials on 28 January with the main conference on 29 – 30 January. The best local conference paper as judged by the trustees in association with the programme committee will win a trip to APRICOT 2015, to be held jointly with APAN 39 in Fukuoka, Japan, from February 24th to March 6th 2015. Umm that’s right, an all[1] expenses paid trip to JAPAN!!!! It's a real thing. Two people have won this in previous years and to be honest they seemed pretty happy with the prize. Conference objective: The NZNOG conference, workshops and tutorials are a once-a-year opportunity for individuals and organisations involved in Internet operations to meet and share the latest in Internet operations, technologies practices and receive high quality training. The event is unique in New Zealand and attracts technical, skilled individuals with a genuine interest in Internet operations and Internetworking technologies. Submit a paper: Presenters are invited to submit abstracts of their paper for consideration by Monday 20th October. Abstracts should be no more than one page long and provide a summary of your networking-related subject matter. Please note that full slide decks will be required by 17th November. To submit your paper please e-mail: talks(a)nznog.org When considering a presentation, remember that the NZNOG audience is mainly comprised of technical network operators and engineers with a wide range of experience levels from beginners to multi-year experience. There is a strong orientation to offer core skills and basic knowledge in SIGs and to address issues relevant to the day-to-day operations of ISPs and network operators in the conference sessions. Note: The inclusion of a title, bio, topic, abstract, and slides with proposals is not compulsory but will help us determine the quality of your proposal and increase the likelihood it will be accepted. The organising committee will evaluate proposals based on fit with the conference’s objective and its ability to stimulate lively discussions around the current state of New Zealand networking. The best local paper will be judged by a selection of the trustees and the programme committee. It will be expected the best paper is submitted by the winner for presentation at APRICOT. More details on paper submission can be found at http://www.nznog.org/call-for-papers For more information about the conference visit www.nznog.org or contact: talks(a)nznog.org [1] where 'all' means Return Flights, Accommodation and Conference Fees. You still need to pay for things like food and entertainment. Most of what you need to eat/drink is covered in the conference though. We're also open to cases of special needs should you win. --------

1 0

ALL GOLD SPONSOR SLOTS FILLED: Re: NZNOG2015 Sponsorship update: Platinum sponsor announcement and opportunity to be the last GOLD sponsor
by Dean Pemberton 11 Jun '14

11 Jun '14

Well that was quick... And the last GOLD sponsor for the 2015 conference is: "AS45177 - Vibe Communications" Thanks guys! Silver and Community spots are still available at the 2014 price. I've also had some queries about the Bandwidth Sponsor. We'll be doing that as part of a separate process which I'll announce soon. It's just too important to leave up to a first come first served thing. You would all kill me if we got the network wrong. Regards, Dean On Thu, Jun 12, 2014 at 11:20 AM, Dean Pemberton <nznog(a)deanpemberton.com> wrote: > Hi Everyone, > > I've got some more information regarding the conference. This one > concerns sponsorship, so if you're a company who generally sponsors > NZNOG tune in. If I interrupted you from BGP config, then as you > were. > > As part of feedback from sponsors in previous years, we've made some > changes to the way that the NZNOG conference sponsorship packages are > structured. > > 1) We've limited the numbers at the top end. Sponsors were concerned > that they were only 'one of many'. We've limited the number of slots > to: > > Platinum: 1 slot > Gold: 3 slots > Silver: 5 slots > Community: 6 shots > > We've also kept slots for things like "Networking Drinks" "Conference > Dinner" and "Bandwidth Sponsor" so people can tailor what they want > to support. > > Once the slots are filled however, thats it until the following year. > We will be running tier wait-lists on a first come, first served > basis. Which brings us to.... > > > 2) In the following year. Existing sponsors will be given first > right of refusal for their sponsorship spots. AusNOG works this way > and the feedback from sponsors was that it allowed them a greater > ability to plan ahead. There will be a cut off date within which the > existing sponsor can re-confirm. If they don't then the spot will be > offered to the next company on the wait-list for that tier. > > 3) We're also lifting the dollar amount for each of the sponsor tiers. > > Phew, Thats out the way. > > So under those new guidelines, the trustees approached the 2014 > conference sponsors and offered them first preference at the slots. > > I'm happy to say that we've filled our PLATINUM sponsor slot this year > with a long time supporter... > > ******* Go Wireless NZ Ltd. ******* > > Thanks to Dale and his team for continuing to be a great supporter of NZNOG. > > We've also filled all but one of our allocated GOLD sponsor slots with > > Vocus > Citylink. > > So there's only one more Gold slot left. We're also running an early > bird special. If you confirm NZNOG2015 sponsorship slots before the > 31st of July, we'll invoice you at the 2014 rate rather than the new > 2015 rate. For GOLD this is a 50% saving! > > So if you're an organisation who would like that GOLD spot, now is the > time to make that commitment. > > > You can download the sponsor document here (http://goo.gl/mdhu6p) and > email sponsorship(a)nznog.org to register your interest. > > See you all at the conference! > > Regards, > Dean

1 0

NZNOG2015 Sponsorship update: Platinum sponsor announcement and opportunity to be the last GOLD sponsor
by Dean Pemberton 11 Jun '14

11 Jun '14

Hi Everyone, I've got some more information regarding the conference. This one concerns sponsorship, so if you're a company who generally sponsors NZNOG tune in. If I interrupted you from BGP config, then as you were. As part of feedback from sponsors in previous years, we've made some changes to the way that the NZNOG conference sponsorship packages are structured. 1) We've limited the numbers at the top end. Sponsors were concerned that they were only 'one of many'. We've limited the number of slots to: Platinum: 1 slot Gold: 3 slots Silver: 5 slots Community: 6 shots We've also kept slots for things like "Networking Drinks" "Conference Dinner" and "Bandwidth Sponsor" so people can tailor what they want to support. Once the slots are filled however, thats it until the following year. We will be running tier wait-lists on a first come, first served basis. Which brings us to.... 2) In the following year. Existing sponsors will be given first right of refusal for their sponsorship spots. AusNOG works this way and the feedback from sponsors was that it allowed them a greater ability to plan ahead. There will be a cut off date within which the existing sponsor can re-confirm. If they don't then the spot will be offered to the next company on the wait-list for that tier. 3) We're also lifting the dollar amount for each of the sponsor tiers. Phew, Thats out the way. So under those new guidelines, the trustees approached the 2014 conference sponsors and offered them first preference at the slots. I'm happy to say that we've filled our PLATINUM sponsor slot this year with a long time supporter... ******* Go Wireless NZ Ltd. ******* Thanks to Dale and his team for continuing to be a great supporter of NZNOG. We've also filled all but one of our allocated GOLD sponsor slots with Vocus Citylink. So there's only one more Gold slot left. We're also running an early bird special. If you confirm NZNOG2015 sponsorship slots before the 31st of July, we'll invoice you at the 2014 rate rather than the new 2015 rate. For GOLD this is a 50% saving! So if you're an organisation who would like that GOLD spot, now is the time to make that commitment. You can download the sponsor document here (http://goo.gl/mdhu6p) and email sponsorship(a)nznog.org to register your interest. See you all at the conference! Regards, Dean

1 0

Alcatel-Lucent/Nuage 7850 - Nethui Opportunity to Play
by Joel Wirāmu Pauling 09 Jun '14

09 Jun '14

Hi all, I will be up at NetHui and have my hands on a somewhat desirable piece of SDN kit. Namely the ALU 7850. In a nutshell it's an SDN targeted switch 96Ports of 10G+/40G QSFP in a 1U rack, talks openflow, and also has a bunch of Controller stuff courtesy of Nuage.It is designed to act as the Datacentre to Carrier gateway, but it's just a fairly neat piece of hardware. I've had it on my desk for a while and would quite like some SDN boffins who have some use cases to have a poke around with it. Would be very interested in seeing some inter-op with some existing OpenFlow kit. Anyone interested in having a play at Nethui/Intac please let me know in advance. If I get no takers then I probably will avoid lugging it up to Auckland. Kind regards -Joel

4 3

Netflix/Verizon battle heats up
by Tony Wicks 09 Jun '14

09 Jun '14

http://arstechnica.com/tech-policy/2014/06/netflix-refuses-to-comply-with-ve rizons-cease-and-desist-demands/ This is really interesting in how it relates to the active de-peering of New Zealand's two largest ISP's 10+ years ago. We still have the situation where the gang of two demand paid peering and everyone just has to accept it as a fact. I am guessing that just as the gang of two have installed Akamai and Google caches they will install Netflix (and Hulu?) caches once these guys pry some content rights off Sky, but it is still quite incredible that the existing streaming providers (I assume) need to pay to deliver this content only to these two providers as they are big enough to strong arm them.

1 0

Tools for automatically summarising CIDR notation list?
by Neil Gardner 06 Jun '14

06 Jun '14

My Google-fu has failed me. It defies logic that there aren’t tools (application, Excel based or online) which will take a list of CIDR formatted prefixes and spit out an optimally summarised list also in CIDR notation. I however, can’t find them. Neither can my friends. I have seen an excel sheet which almost does it, but it requires significant manual interaction and I think it relies on zero point energy and/or wizards magic to work… and I don’t understand it well. Any pointers? And no, doing it in my head isn’t feasible J Cheers – Neil G

5 5

Exciting program confirmed for the 2014 InTAC Conference
by Dean Pemberton 05 Jun '14

05 Jun '14

Hi Everyone. This is a plug for the 2014 Internet Technical Architecture Conference. The program has just been finalised and we've got some exciting speakers. InTAC is on the first day of the NetHui conference on the 9th of July at SkyCity in Auckland. It is pitched at people in a technical architecture role and has a theme of looking at emerging technologies and how these can help shape the architecture of the New Zealand Internet. Registration for the event is free and can be done via the NetHui registration system (http://nethui.org.nz/) This year the conference has three themes with the following speakers: ***Future-Proof Networking*** "Software Defined Networking at RMIT" Paul Zanna - Senior Manager, Infrastructure Innovation and Design Information Technology Services (ITS) RMIT University, Melbourne Australia RMIT has recently developed and deployed a proof of concept network using SDN and OpenFlow technologies. Paul will present the high level details of this real-world pilot along with some of the business drivers which helped RMIT make such a decision. "Panel - Our Future Plans for making use of UFB" Some of the largest users of the UFB network give us an insight into the sorts of ways they are using it. The panel will then discuss how they would like to see the UFB network develop to ensure that it continues to meet the needs of New Zealanders into the next decade. Panelists: Dave Mill - Network Specialist - Inspire Net Simon Allard - Senior Network Architect - Orcon David Redmore - Head of Broadband and Internet - Telecom New Zealand Geoff D’Audney - Technology Leadership Team - Vodafone New Zealand Others TBC ***Security*** "Future Uses of DNSSEC" Geoff Huston - Chief Scientist - APNIC Geoff will take a look at both DNSSEC deployment as well as the benefits which the technology will enable. Technologies like DANE which would allow organisations to take control of generating their own SSL certificates and publishing them in DNS, without the need for Certification Authority" "RPKI - How to stop your network being hijacked" New Zealand Registry Services (NZRS) will present an overview of this emerging technology as well as some of the work they will be doing to promote its deployment locally "TICSA - What it means for network architects" With the Telecommunications (Interception Capability and Security) Act 2013 now a reality it is critically important that network architects are aware of their legislative obligations. Representatives from the National Cyber Security Centre will present their view of how the reporting requirements of the act effect network architecture decisions. ***Authentication*** "Architecting an Authenticated/Trusted Internet" Richard Foy - General Manager, Digital Transformation, Department of Internal Affairs Richard is responsible for leading the push for New Zealanders to be able to complete their transactions with government easily in a digital environment. His goal is to open the way to an average of 70 per cent of New Zealanders' most common transactions with government being completed in a digital environment by 2017. He will present his vision of an Authenticated, Trusted Internet "2FA, been there done that" Adam Fier - Architecture and Security Manager - Victoria University of Wellington Adam has worked for a number of organisations who have implemented 2 Factor Authentication both internally and externally. He will present some of his experiences with deploying 2FA systems along with his view on the importance of 2FA in today's network connected organisations" -- Dean Pemberton Technical Policy Advisor InternetNZ +64 21 920 363 (mob) dean(a)internetnz.net.nz To promote the Internet's benefits and uses, and protect its potential.

1 0

Wireless link suggestions for audio and remote control (IP)
by Darren Moss 03 Jun '14

03 Jun '14

Hi All, We have been looking at the Ubiquiti 5.8GHz outdoor wireless solutions for moving data between locations, of which we have 2. The first location is in Auckland CBD, on top of two buildings about 8klms apart, where both locations can see each other. The second location is in Tauranga, two building approx 15klms apart, again both locations can see each other (probably better than Auckland). Our goal is to move HD audio and remote control (TeamViewer/VNC type PC and server access) between the locations. The audio is moved via appliances which run over IP - nothing tricky, just needs about 2MBps bandwidth with low latency (we can buffer). Does anybody here have any recommendations on wireless kit / vendors, preferrably a solution that you have either used or seen in use. Many thanks Darren.

2 2

Mikrotik+certs+1970
by Sam Russell 03 Jun '14

03 Jun '14

Hi all, I'm playing with mikrotiks for VPNs, and one of the "features" is that the RB750's we have don't hold time when they reboot. I'm planning to build them with NTP access (so if they can get internet then they can get time), but I'm also tempted to generate certs backdated to 1970 instead. Is anyone else doing this? How do you get mikrotiks to validate certs if the clock keeps resetting on power off - is relying on NTP the answer? Cheers Sam

6 6

TICSA - Public Service Announcement
by Dean Pemberton 02 Jun '14

02 Jun '14

Hey all, So the TICSA came into effect today. Things to remember: The Act requires that network operators register their information with the Police Registrar. Details here: http://www.police.govt.nz/about-us/programmes-and-initiatives/telecommunica… The NCSC has also produced some guidance for Network Operators which is worth a read. http://ncsc.govt.nz/assets/TICSA/NCSC-Guidance-for-Network-Operators.pdf The GCSB have also published a list of exceptions for Operators with regard to what you're required to notify them of. http://ncsc.govt.nz/assets/TICSA/Notice-of-Exemptions.pdf As you were =)

10 17

Juniper EX-series switches & flash memory
by Sam Russell 02 Jun '14

02 Jun '14

Hi all, We've acquired a few EX-series switches recently and are a bit unimpressed at how they deal with power outages. Not wanting to trash talk here, just keen to see if anyone else is seeing this problem and ways they're dealing with this, off-list replies appreciated. Cheers Sam

4 3

Takapuna Cable Landing Station Mural
by Jonathan Brewer 28 May '14

28 May '14

Hey folks, My buddy Bron is looking for some information on the Takapuna cable landing station. In particular a mural associated with the site or building. Does anyone out there in the NOG community have any photos of said building or mural, or information that could help her out? If so, please contact bronwyn (at) holloway.co.nz with details. Thanks! Jon

3 3

power issues Sky tower
by Bruce Forster 28 May '14

28 May '14

Hi Noggers, Anyone in Skytower currently having any power issues? -- Regards, Bruce

1 1

Fwd: [Apnic-announce] Additional IPv4 space now available from APNIC
by Skeeve Stevens 28 May '14

28 May '14

FYI - announcement from APNIC. Please note... this will increase your membership costs. If you are a basic member with a single /22, your yearly membership feeds are AU$1994ex. Getting the extra /22 will increase it to AUD$2592ex per year (very much worth it considering the price of v4) If you have other ranges and want to see the impact on your membership fees, please visit: http://submit.apnic.net/cgi-bin/feecalc.pl If anyone else is looking for space bigger than a /22 or have some you want to offload, please contact us using the form: http://v4now.com/ip-brokering-enquiry/ ...Skeeve *Skeeve Stevens - *eintellego Networks Pty Ltd skeeve(a)eintellegonetworks.co.nz ; www.eintellegonetworks.co.nz Phone: +612 8014 7398; Cell +61 (0)414 753 383 ; skype://skeeve facebook.com/eintellegonetworks ; <http://twitter.com/networkceoau> linkedin.com/in/skeeve twitter.com/theispguy ; blog: www.theispguy.com The Experts Who The Experts Call Juniper - Cisco - Cloud - Consulting - IPv4 Brokering ---------- Forwarded message ---------- From: APNIC Secretariat <secretariat(a)apnic.net> Date: Wed, May 28, 2014 at 9:53 AM Subject: [Apnic-announce] Additional IPv4 space now available from APNIC To: apnic-announce(a)lists.apnic.net ________________________________________________________________________ Additional IPv4 space now available from APNIC ________________________________________________________________________ APNIC Members can now apply for more IPv4 address space. Members can now request a maximum of a /22 (or 1,024 addresses) from IPv4 address blocks returned to APNIC by IANA. This is in addition to the maximum of a /22 that Members can receive under 103/8 ("last /8"). This gives new or existing Members up to 2,048 of IPv4 addresses from these address blocks. This is a result of implementing prop-105: Distribution of returned IPv4 address blocks (Modification of prop-088). http://www.apnic.net/policy/proposals/prop-105 Members can now apply using the online form via MyAPNIC. Applications will still need to meet the current IPv4 policy criteria. http://www.apnic.net/policy/add-manage-policy While this additional IPv4 address space is available, APNIC reiterates the critical need to deploy IPv6 and encourages the community to work towards transitioning to this protocol. For more information about IPv4 address availability, please see: http://www.apnic.net/post-ipv4 ________________________________________________________________________ APNIC Secretariat secretariat(a)apnic.net Asia Pacific Network Information Centre (APNIC) Tel: +61 7 3858 3100 PO Box 3646 South Brisbane, QLD 4101 Australia Fax: +61 7 3858 3199 6 Cordelia Street, South Brisbane, QLD http://www.apnic.net ________________________________________________________________________ * Sent by email to save paper. Print only if necessary. _______________________________________________ Apnic-announce mailing list Apnic-announce(a)lists.apnic.net http://mailman.apnic.net/mailman/listinfo/apnic-announce

3 3

Fwd: [apnic-talk] [Apnic-announce] APNIC receives total of a /11 from IANA
by Dean Pemberton 22 May '14

22 May '14

---------- Forwarded message ---------- From: Secretariat <Secretariat(a)apnic.net> Date: Fri, May 23, 2014 at 11:21 AM Subject: [apnic-talk] [Apnic-announce] APNIC receives total of a /11 from IANA To: apnic-announce(a)lists.apnic.net ________________________________________________________________________ APNIC receives total of a /11 from IANA ________________________________________________________________________ Dear Colleagues The information in this announcement is to enable the Internet community to update network configurations, such as routing filters, where required. APNIC received the following recovered IPv4 address blocks (total of a /11) from IANA in May 2014. 43.224.0.0/13 43.236.0.0/14 43.240.0.0/14 43.245.0.0/16 43.246.0.0/15 43.248.0.0/14 43.252.0.0/16 43.254.0.0/15 45.64.0.0/16 45.65.0.0/20 150.107.0.0/16 150.129.0.0/16 150.242.0.0/16 163.47.4.0/22 163.47.8.0/21 163.47.16.0/23 163.47.18.0/24 163.47.20.0/23 163.47.32.0/21 163.47.40.0/22 163.47.44.0/23 163.47.47.0/24 163.47.48.0/20 163.47.64.0/18 163.47.128.0/17 163.53.0.0/16 APNIC will soon implement policy proposal prop-105, and will create a new IPv4 address pool, in addition to the 103/8 pool (final /8). APNIC Members will be eligible to receive up to a maximum of a /22 from this new pool, in addition to the /22 they can receive under the final /8 policy. For more information about prop-105, please see: https://www.apnic.net/policy/proposals/prop-105 If you have any questions, please contact helpdesk(a)apnic.net. Kind regards, ________________________________________________________________________ APNIC Secretariat secretariat(a)apnic.net Asia Pacific Network Information Centre (APNIC) Tel: +61 7 3858 3100 PO Box 3646 South Brisbane, QLD 4101 Australia Fax: +61 7 3858 3199 6 Cordelia Street, South Brisbane, QLD http://www.apnic.net ________________________________________________________________________ _______________________________________________ Apnic-announce mailing list Apnic-announce(a)lists.apnic.net http://mailman.apnic.net/mailman/listinfo/apnic-announce _______________________________________________ apnic-talk mailing list apnic-talk(a)lists.apnic.net http://mailman.apnic.net/mailman/listinfo/apnic-talk

1 0

APNIC allocated new space - all members eligible to receive an additional /22
by Skeeve Stevens 20 May '14

20 May '14

Hi everyone! This is indeed awesome news for small players out there who need address space. APNIC has been allocated a /11 from IANA (see the reasons below). This means that all current account holders will be eligible to receive an additional /22 under this allocation, in addition to the /22 you were already able to receive under the final /8 policy. This is a huge plus for small providers who need just a little bit on extra space. Just a note. This new allocation should not be seen as a handout for those who will request it and try to immediately sell it. It will follow the same /8 allocation where you will be required to hold on to it (and pay your membership at the new level) for at least a year. Those not prepared to pay the new membership level, shouldn't request it. These new ranges should be available for request sometime next week. Expect an announcement from APNIC. Good times! ...Skeeve =====START OF ANNOUNCEMENT===== ________________________________________________________________________ APNIC to receive additional IPv4 allocation from IANA as 'Recovered Space' to be distributed ________________________________________________________________________ LACNIC's announcement that its inventory of IPv4 addresses has reached less than a /9 (or 8,388,608 addresses) today triggered the activation of IANA's Recovered Pool of addresses. This means IANA will make a distribution to each RIR, including APNIC, every six months until the pool is exhausted. APNIC has received a /11 of IPv4 address space (2,097,152 addresses) from IANA under the Recovered Pool Policy. https://www.icann.org/resources/pages/allocation- ipv4-post-exhaustion-2012-05-08-en APNIC will implement procedures for distribution of space from this new allocation of addresses. APNIC Members will be eligible to receive up to a /22 from this pool, in addition to the /22 that they can receive under the last /8 rationing policy. This gives new or existing APNIC Members up to 2,048 IPv4 addresses from these address blocks, while the space is available. APNIC's Director General, Paul Wilson, said reaching this important milestone had two major implications for organizations in the Asia Pacific. ''Firstly, APNIC's receipt of the /11 from IANA will mean that organizations in our region can get a few more addresses, which they sorely need in many cases. Also, newcomers to the Internet will be able to receive these small allocations for some years to come, which is really critical for healthy Internet competition and growth into the future,'' Wilson said. ''The second, and more important message this milestone highlights, is that the journey towards exhaustion of IPv4 address space globally is continuing as expected, and the need for organizations to deploy IPv6 is increasingly urgent,'' he said. ''I again urge the Asia Pacific Internet community to turn its investments toward the transition to IPv6. If you depend on the Internet, then you will depend on IPv6 as a critical part of your business. Now is the time to be asking those who provide you with Internet services and expertise - whether they are ISPs, vendors, data centres, developers, staff, or consultants - how they will support IPv6 services for your in future.'' ''The good news is that costs can be minimized by planning ahead - for instance, by ensuring IPv6 capabilities are gained within the normal hardware and software upgrade cycles.'' APNIC will advise the community when applications for the new IPv4 addresses can be submitted. APNIC account holders who wish to apply for IPv4 addresses from the Recovered IPv4 Pool allocation will be able to do so via MyAPNIC using the standard application process. http://www.myapnic.net All policies for management of IP address space in the Asia Pacific region are determined by the Internet community through an open, consensus-based policy development process that is hosted by APNIC. The policy for allocation of Recovered IPv4 Pool addresses was approved during the 36th APNIC Conference, held in Xi'an, China, in August 2013. For more information on IPv4 and IPv6, visit the IPv6 Resources page. http://www.apnic.net/ipv6 =====END OF ANNOUNCEMENT===== ...Skeeve *Skeeve Stevens - *eintellego Networks Pty Ltd skeeve(a)eintellegonetworks.co.nz ; www.eintellegonetworks.co.nz Phone: +612 8014 7398; Cell +61 (0)414 753 383 ; skype://skeeve facebook.com/eintellegonetworks ; <http://twitter.com/networkceoau> linkedin.com/in/skeeve twitter.com/theispguy ; blog: www.theispguy.com The Experts Who The Experts Call Juniper - Cisco - Cloud - Consulting - IPv4 Brokering

1 0

Fwd: [apnic-talk] [Apnic-announce] APNIC to receive additional IPv4 allocation from IANA as 'Recovered Space' to be distributed
by Dean Pemberton 20 May '14

20 May '14

An ability to get some more IPv4 addresses for those who still need them. ---------- Forwarded message ---------- From: APNIC Secretariat <secretariat(a)apnic.net> Date: Wed, May 21, 2014 at 12:31 PM Subject: [apnic-talk] [Apnic-announce] APNIC to receive additional IPv4 allocation from IANA as 'Recovered Space' to be distributed To: apnic-announce(a)lists.apnic.net ________________________________________________________________________ APNIC to receive additional IPv4 allocation from IANA as 'Recovered Space' to be distributed ________________________________________________________________________ LACNIC's announcement that its inventory of IPv4 addresses has reached less than a /9 (or 8,388,608 addresses) today triggered the activation of IANA's Recovered Pool of addresses. This means IANA will make a distribution to each RIR, including APNIC, every six months until the pool is exhausted. APNIC has received a /11 of IPv4 address space (2,097,152 addresses) from IANA under the Recovered Pool Policy. https://www.icann.org/resources/pages/allocation-ipv4-post-exhaustion-2012-… APNIC will implement procedures for distribution of space from this new allocation of addresses. APNIC Members will be eligible to receive up to a /22 from this pool, in addition to the /22 that they can receive under the last /8 rationing policy. This gives new or existing APNIC Members up to 2,048 IPv4 addresses from these address blocks, while the space is available. APNIC's Director General, Paul Wilson, said reaching this important milestone had two major implications for organizations in the Asia Pacific. ''Firstly, APNIC's receipt of the /11 from IANA will mean that organizations in our region can get a few more addresses, which they sorely need in many cases. Also, newcomers to the Internet will be able to receive these small allocations for some years to come, which is really critical for healthy Internet competition and growth into the future,'' Wilson said. ''The second, and more important message this milestone highlights, is that the journey towards exhaustion of IPv4 address space globally is continuing as expected, and the need for organizations to deploy IPv6 is increasingly urgent,'' he said. ''I again urge the Asia Pacific Internet community to turn its investments toward the transition to IPv6. If you depend on the Internet, then you will depend on IPv6 as a critical part of your business. Now is the time to be asking those who provide you with Internet services and expertise - whether they are ISPs, vendors, data centres, developers, staff, or consultants - how they will support IPv6 services for your in future.'' ''The good news is that costs can be minimized by planning ahead - for instance, by ensuring IPv6 capabilities are gained within the normal hardware and software upgrade cycles.'' APNIC will advise the community when applications for the new IPv4 addresses can be submitted. APNIC account holders who wish to apply for IPv4 addresses from the Recovered IPv4 Pool allocation will be able to do so via MyAPNIC using the standard application process. http://www.myapnic.net All policies for management of IP address space in the Asia Pacific region are determined by the Internet community through an open, consensus-based policy development process that is hosted by APNIC. The policy for allocation of Recovered IPv4 Pool addresses was approved during the 36th APNIC Conference, held in Xi'an, China, in August 2013. For more information on IPv4 and IPv6, visit the IPv6 Resources page. http://www.apnic.net/ipv6 ________________________________________________________________________ APNIC Secretariat secretariat(a)apnic.net Asia Pacific Network Information Centre (APNIC) Tel: +61 7 3858 3100 PO Box 3646 South Brisbane, QLD 4101 Australia Fax: +61 7 3858 3199 6 Cordelia Street, South Brisbane, QLD http://www.apnic.net ________________________________________________________________________ * Sent by email to save paper. Print only if necessary. _______________________________________________ Apnic-announce mailing list Apnic-announce(a)lists.apnic.net http://mailman.apnic.net/mailman/listinfo/apnic-announce _______________________________________________ apnic-talk mailing list apnic-talk(a)lists.apnic.net http://mailman.apnic.net/mailman/listinfo/apnic-talk

1 0

IANA IPv4 Recovered Address Space registry updated
by Leo Vegoda 20 May '14

20 May '14

Hi, ICANN has updated the IANA IPv4 Recovered Address Space registry after LACNIC notified it that it has less than a total of a /9 in its inventory of IPv4 address space. This triggered the activation the Recovered IPv4 pool, which was created in the Global Policy for Post Exhaustion IPv4 Allocation Mechanisms by the IANA. The address space selection is made using software that tries to allocate blocks based on the RIR managing the DNS for that /8. The software, along with a worked example, is published at: https://github.com/icann/ The list of allocations can be found at: https://www.iana.org/assignments/ipv4-recovered-address-space/ipv4-recovered -address-space.xhtml#ipv4-recovered-address-space-2 Kind regards, Leo Vegoda

1 0

Real world experiences with Chorus ATA Voice service sought
by Alexander Neilson 19 May '14

19 May '14

Hi All I am looking for anyone who is using Chorus ATA Voice as part of their UFB offerings who would be willing to share experiences / advice / etc with me. I am trying to firm up exactly how we want to deploy things and the choices we will make and while the Chorus documents are fine some real world experiences / pitfalls / tips and tricks that could help shape how I do it or come back to the “lovely in theory, horrible in practice” that can be a common outcome. At the same time if anyone wants to share any similar information on the UFB Data plans / circuits then I would be most interested in anything people could share with me. Thank you all for your time. Regards Alexander Alexander Neilson Neilson Productions Limited alexander(a)neilson.net.nz 021 329 681 022 456 2326

1 0

NZNOG 2015 Programme Commitee
by Jamie Baddeley 12 May '14

12 May '14

Afternoon everyone, The NZNOG 2015 Programme Committee is responsible for the solicitation and selection of suitable presentation and tutorial content for the NZNOG 2015 conference (www.nznog.org) NZNOG 2015 will be held in Rotorua at the Distinction Hotel, which is conveniently located between the airport and the town centre. The dates for NZNOG 2015 are 29 - 30th January. The NZNOG Trustees selects a new Programme Committee each year and is now seeking nominations from the community. Eligible PC candidates are those who have attended NZNOG conferences in the recent past, have broad technical knowledge of Internet operations, and have reasonable familiarity with the format of NZNOG conferences. Having constructive opinions and ideas about how the programme content might be improved is of high value too. PC members are expected to work actively to solicit content for the event and review submissions for technical merit. The PC will meet by regular conference calls, during the months prior to the event. If you are interested in joining the PC send a brief note to "trustees at nznog.org". The note should include affiliation (if any) and contact details (including e-mail address), and a brief description of why you would make a good addition to the PC. PC members receive complimentary registration for the event. The NZNOG Trustees will accept nominations received by the end of Friday 30th June, 2014, and will announce the new PC shortly thereafter. Many thanks! NZNOG Trustees

1 0

A vs AAAA
by Mark Foster 11 May '14

11 May '14

Hello learned NZNOG-folks, Many of you have been working hands-on with IPv6 a lot more than I have, so i'll ask this here. In two cases, on two discrete systems, both Windows clients (one a Windows 7 workstation, the other a Windows 2008R2 server) a 'ping'[1] is run against a hostname. In both cases a ping against a v6 IP address is tried (and failed, as the host has no v6 connectivity - and in at least one case, v6 is actually disabled in the network interface settings). A simple 'nslookup' check without specifying the query type returns both IPv6 and IPv4 responses for the hostname. So why is the client trying to ping a v6 address when it has no v6 connectivity? (and for the record, an answer of 'make v6 work' doesn't solve my problem, as much as it might be a simple resolution.) Cheers Mark. [1] as you can probably guess, ping isn't actually the end-use of this connectivity, but it was the first troubleshooting measure used. This is impacting on application-layer connectivity, so 'use-v4-only' ping syntax also doesn't help me. :-)

4 5

TICSA "Guidance for Network Operators" released
by Michael Fincham 11 May '14

11 May '14

Hi all, Just a heads up to anyone who hasn't spotted it, it seems the "Guidance for Network Operators" document has been released by the NCSC. More info at: <http://ncsc.govt.nz/ticsa/> -- Michael

1 0

Average Usage Per Service
by Skeeve Stevens 11 May '14

11 May '14

Hey all, Just doing some math and capacity planning and I am wondering what others use for numbers for the average usage of a service per user? I am working with NBN-like speeds of 12mb, 25, 50 and 100. Back in the day I used to factor it in at around 30% when we were doing dialup and low-speed DSL... and on ADSL2 I normally factored it at around 15%. But I am wondering what people use for NBN-like speeds. I am thinking that a percentage is probably not a realistic measurement anymore as there is no particular reason a 25, 50 or 100mb user would do more or less on average... they just have the capacity to do more. Does anyone else have any thoughts they are willing to share, or even real observations across a significant number (thousands) of customers that they use for bandwidth (agvc and/or transit) planning? Feel free to off-list if you want to keep the information anonymous... I am happy to publish some findings and a spreadsheet for the use of others. Thanks all. ...Skeeve *Skeeve Stevens - *eintellego Networks Pty Ltd skeeve(a)eintellegonetworks.co.nz ; www.eintellegonetworks.co.nz Phone: +612 8014 7398; Cell +61 (0)414 753 383 ; skype://skeeve facebook.com/eintellegonetworks ; <http://twitter.com/networkceoau> linkedin.com/in/skeeve twitter.com/theispguy ; blog: www.theispguy.com The Experts Who The Experts Call Juniper - Cisco - Cloud - Consulting - IPv4 Brokering

2 2

Transit in Skytower
by Ben Cornish 11 May '14

11 May '14

Hey All, Looking for some Transit Capacity in Sky Tower for out of Band Management and possibly some Failover capacity. We are on Level 47 of Sky Tower and looking for the Cross connect.. Can anyone help me out ? Cheers.

1 0

Location and venue confirmed for NZNOG 2015
by Krystal Waine 08 May '14

08 May '14

Dear List, The location and venue are all locked in and I can officially announce that next years NZNOG conference will be held in Rotorua at the Distinction Hotel, which is conveniently located between the airport and the town centre. The dates for NZNOG 2015 are 29 - 30th January. Look forward to seeing a lot of you there! Cheers Krystal -- Krystal Waine Events Lead, InternetNZ DDI: 04 472 1601 Mobile:027 6555 450 *To promote the Internet's benefits and uses, and protect its potential.*

3 3

Best Practice - prefix advertisement
by Alexander Neilson 06 May '14

06 May '14

Hi All At $Dayjob I have been working around an aggregation bug in our routers and manually specifying prefix’s at the three levels we operate (/22, /23, /24) and using prefix filters to advertise /24’s to APE / WIX, /23’s to our domestic transit, and only the /22’s to international transit as a method of Traffic Management / Traffic Engineering to utilise cheapest links available. I have been exploring the looking glass services of a number of entities to see what propagates to them (that they enter into the forwarding database) and I am seeing some entities (who announce peering at APE for example) having the /22 and /23 routes in the LG outputs and following the /23 path in trace route. I am asking for two fold information. Can someone / everyone point me at their best guide to BGP “Best Practice” regarding advertising prefixes? and also can I get people’s specific advice about what they accept / do to announcements before entering them into their routers as accepted routes and what they would expect to see advertised to ensure my goals are reached. I made these changes to help reduce my contribution to the ballooning of the global routing table but I also don’t want to go to extremes on polluting the APE routing table by advertising the 12 /24’s plus the 6 /23’s and the 3 /22’s. Also can I get consensus information (or peoples opinions) about am I abusing / dis respecting APE with my announcements and how I should structure my announcements to be a respectable citizen here while providing the best hints to my preferred handling of traffic? (and feel free to let me know if I should just announce the /22’s and accept that some people choose to prioritise other paths) Thank you in advance for any input, feel free to reply off list. Regards Alexander Alexander Neilson Neilson Productions Limited alexander(a)neilson.net.nz 021 329 681 022 456 2326

4 3

APNIC 38 Call for Papers
by Dean Pemberton 05 May '14

05 May '14

___________________________________________________________________ APNIC 38 Conference - Call for Papers ___________________________________________________________________ The APNIC 38 Program Committee is now seeking presentations for the APNIC 38 Conference to be held in Brisbane, Australia, from 15 - 19 September 2014. We are looking for content that would suit the APOPS Plenary, technical conference sessions, and tutorials. Key dates --------- The timeline for submissions is: Call for Papers Opens Now First Round Paper Acceptance 1 August Final Deadline for Submissions 29 August Final Round Paper Acceptance 5 September Final Slides Received 12 September Submitting Proposals -------------------- Please submit your proposal for a presentation, technical session, or tutorial at: http://submission.apnic.net/user/login.php?event=14 Program material ---------------- The technical sessions at APNIC 38 will include presentations relevant to Internet operations and technologies. Possible areas of interest include: - IPv6 deployment and operations - IPv6 transition / IPv4 prolongation technologies - ISP and Carrier Services - IXPs and Peering - Network and Infrastructure security - Access and Transport Technologies - Content and Service Delivery - Software Defined Networking and Network Function Virtualization If you have any other ideas or proposals for panel or Birds of a Feather sessions, please feel free to submit your ideas via the submission system. If you have any questions, please email the Program Committee chairs at: pc-chairs(a)apricot.net For more information about APNIC 38, please visit: http://conference.apnic.net/38 On behalf of: APNIC 38 Program Committee Co-chairs: Dean Pemberton, Mark Tinka, and Raphael Ho

1 0

AusNOG 2014 Call for Presentations
by Mark Prior 05 May '14

05 May '14

Call for presentations for AusNOG 2014 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Swissotel Sydney 4 & 5 September 2014 Topics =-=-=- Internet operations can be a broad topic and the programme committee will be short-listing presentations in the following focus areas: * Improving the redundancy/resiliency/sustainability of your network * Making leaps in service or network availability * Taking the network operations BCP to the next level * Using 'offline' communications tools to keep the network working * How technology is changing network architectures * Evolution in network architectures and scaling issues * Analysis of relevant major operational events of the year This year we will be reintroducing a "Peering Forum". In this part of the programme we hope to include: * Peering related talks * Peering personals from various networks * IX updates Additional topics that are of interest to the network operator community are also welcome at AusNOG 2014. Naturally, presentations of a marketing nature are not welcome at this technical event. Notes to presenters =-=-=-=-=-=-=-=-=-= Preference will be given to presentations that result in actual operational outcomes. Session speakers should be prepared to present for 30 minutes. Keynote speakers will be expected to present for 45 minutes to 1 hour. Short presentations of strong operational content are also acceptable. Once the final slides are submitted, changes will only be permitted where the presentation requires the most up to date information or data. By submitting a presentation for consideration in the AusNOG 2014 programme, and if selected the presenter will allow AusNOG to: * Take photographs of the presentation and presenter * Record and rebroadcast video and audio of the presentation and presenter * Redistribute the presentation slides, audio, video, and photographs electronically, on the AusNOG website, or otherwise but leaving all intellectual property in the hands of presenter or rightful property holder[1]. Deadlines =-=-=-=-= 09 June: Submission of presentation title, presentation description (300 words), and presenter biography (200-400 words) 04 July: Presenters notified of their acceptance status as an AusNOG 2014 presentation. 27 August: Submission of final presentation slides as Portable Document Format (pdf), PowerPoint, or Keynote. Provision of a recent digital photograph (<500k) of the presenter. All submissions must be sent to organisers at ausnog.net. A separate call for lightning talks will be made closer to the AusNOG 2014 event. As in previous years you must be registered to attend AusNOG 2014 in order to be considered for a lightning talk. [1]: AusNOG accepts that some speakers are unable to allow us to archive their presentation due to company or corporate policy, and if the situation arises AusNOG will delete all copies in its possession after the presentation. Mark. For the AusNOG Board

1 0

clear.net.nz maintainers
by Al Twohill 04 May '14

04 May '14

Hi, Does anyone from Vodafone who looks after the Clear email servers lurk about here? I've had an issue going no-where with L1 support for the past 6 months.. Would greatly appreciate a contact off list. Cheers, Al

1 0

2 of 3 IPv6 DNS servers broken?
by Pete Mundy 27 Apr '14

27 Apr '14

Dear list Is anyone from Snap network ops watching who is involved in IPv6 or DNS? I'm not officially a Snap customer yet (1 week to go) so I guess trying to put this through the helpdesk might not be the best approach. Just wanted to give you guys a heads up really that only 1 of the 3 published NS appear to be responding to DNS queries via IPv6 (but they do all respond to ping6). See transcripts below. They were taken from a Snap UFB link. It all works fine via v4. I guess maybe others on the list with native v6 could test to confirm that this is also the case as seen from elsewhere? Eg perhaps from a non-Snap link? My v6 visibility is still a bit limited. Just a Raspberry Pi stuck behind a Fritzbox on Snap UFB for testing. Maybe something is 'on the fritz'?! Pete root(a)fpl-rpi16:~# ping6 -c 1 ns1.snap.net.nz PING ns1.snap.net.nz(2406:e000::100) 56 data bytes 64 bytes from 2406:e000::100: icmp_seq=1 ttl=251 time=10.0 ms --- ns1.snap.net.nz ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 10.048/10.048/10.048/0.000 ms root(a)fpl-rpi16:~# dig -6 SOA snap.net.nz @ns1.snap.net.nz ; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> -6 SOA snap.net.nz @ns1.snap.net.nz ;; global options: +cmd ;; connection timed out; no servers could be reached root(a)fpl-rpi16:~# ping6 -c 1 ns2.snap.net.nz 64 bytes from 2406:e000::200: icmp_seq=1 ttl=251 time=9.98 ms --- ns2.snap.net.nz. ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 9.985/9.985/9.985/0.000 ms root(a)fpl-rpi16:~# dig -6 SOA snap.net.nz @ns2.snap.net.nz ; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> -6 SOA snap.net.nz @ns2.snap.net.nz ;; global options: +cmd ;; connection timed out; no servers could be reached root(a)fpl-rpi16:/home/ladmin# ping6 -c 1 ns3.snap.net.nz PING ns3.snap.net.nz(2406:e000::300) 56 data bytes 64 bytes from 2406:e000::300: icmp_seq=1 ttl=251 time=11.4 ms --- ns3.snap.net.nz ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 11.433/11.433/11.433/0.000 ms root(a)fpl-rpi16:~# dig -6 SOA snap.net.nz @ns3.snap.net.nz ; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> -6 SOA snap.net.nz @ns3.snap.net.nz ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57245 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 6 ;; QUESTION SECTION: ;snap.net.nz. IN SOA ;; ANSWER SECTION: snap.net.nz. 86400 IN SOA ns1.snap.net.nz. soa.snap.net.nz. 2014040202 10800 3600 604800 86400 ;; AUTHORITY SECTION: snap.net.nz. 86400 IN NS ns2.snap.net.nz. snap.net.nz. 86400 IN NS ns1.snap.net.nz. snap.net.nz. 86400 IN NS ns3.snap.net.nz. ;; ADDITIONAL SECTION: ns1.snap.net.nz. 86400 IN A 202.37.101.1 ns1.snap.net.nz. 86400 IN AAAA 2406:e000::100 ns2.snap.net.nz. 86400 IN A 202.37.101.2 ns2.snap.net.nz. 300 IN AAAA 2406:e000::200 ns3.snap.net.nz. 86400 IN A 202.37.101.3 ns3.snap.net.nz. 300 IN AAAA 2406:e000::300 ;; Query time: 35 msec ;; SERVER: 2406:e000::300#53(2406:e000::300) ;; WHEN: Sun Apr 27 19:34:48 2014 ;; MSG SIZE rcvd: 255

2 1

SPF and mail forwarding, best practice?
by Richard Hector 25 Apr '14

25 Apr '14

Hi all, I'm in an organisation that uses a forwarding mailserver to give (some) members user(a)organisation email addresses, which get forwarded to their regular address. The trouble is, I have SPF on my domain, and one at least of the receiving MTAs checks it, and my mail gets rejected as a consequence. What's the best solution? Do I (and anybody else who might mail us) need to turn off SPF, or make it less strict? Does the forwarding server need to remail rather than forward? Do we need to persuade the receiving mail admins to whitelist our forwarder (there could be many others)? Should the organisation mailserver just operate an IMAP/POP/Webmail service rather than forwarding, so that this never arises (my favourite)? Any tips? Thanks, Richard

4 5

New RIPE NCC contribution to the IANA IPv4 Recovered Address Space registry
by Leo Vegoda 23 Apr '14

23 Apr '14

Hi, In April 2014, ICANN updated the IANA IPv4 Recovered Address Space registry to reflect the return of 14 /24 prefixes (5,376 IPv4 addresses) by the RIPE NCC. The updated registry can be found at: https://www.iana.org/assignments/ipv4-recovered-address-space Kind regards, Leo Vegoda ICANN IANA

3 4

InTAC 2014
by Dean Pemberton 23 Apr '14

23 Apr '14

Morning all. InTAC conference to be held again on the 9th of July in Auckland. The participants at last years conference gave plenty of feedback as to the directions that they wanted to see the Internet within New Zealand take. Feedback was that there needed to be more focus on the following areas: . Technical issues relating to the security of the infrastructure of the New Zealand Internet . Technical mechanisms to assist in the development of more appropriate Authentication, Identity and Trust systems relating to the use of the Internet . Technical ways to ensure the Future-proofing the infrastructure of the New Zealand Internet. What I'm suggesting for InTAC this year is the following structure... Welcome 45 Min - On DNSSEC 45 Min - On RPKI Morning Tea 45 Min - On Identity and trust online 45 Min - On Authentication (federated signon, 2fa, lockers) Lunch 45 Min - On SDN 45 Min - On UFB Afternoon Tea Open discussion Networking Drinks Does anyone have any feedback before I look to secure topic speakers and make it a real thing? -- Dean Pemberton Technical Policy Advisor InternetNZ +64 21 920 363 (mob) dean(a)internetnz.net.nz <javascript:;> To promote the Internet's benefits and uses, and protect its potential. -- -- Dean Pemberton Technical Policy Advisor InternetNZ +64 21 920 363 (mob) dean(a)internetnz.net.nz To promote the Internet's benefits and uses, and protect its potential.

2 2

Re: [nznog] CARDIGAN implements RPKI - Cleanliness of prefixes onWIX
by Andrew Niteesh 21 Apr '14

21 Apr '14

Hi, I have few clarifications, the table you shown have matric, local preference, path and next hop. 1. So how you are setting up these attributes in SDN? (Or) you have an application developed for BGP? (Or) you are running SDN on top of traditional networks? 2. What is Route flow - according to my understanding it's like getting connecting a set of open flow capable switches to single controller. Please correct me if am wrong. Thanks & Regards, Andrew Niteesh University of Houston

2 1

[OT] 3g on mikrotik
by Rob McDonald 21 Apr '14

21 Apr '14

Hey all, Sorry for the OT post... Does anyone have experience with USB 3g sticks on Mikrotik routerboards? I've had quite a long look around, and without resorting to trial and error I thought someone here might be able to share their winning numbers with me. Cheers Rob *Rob McDonald | *Director Level 2 Systems Ltd *M:* +64 21 902 929 *eFax:* +64 9 974 4734 *W:* http://www.L2.co.nz <http://www.l2.co.nz/>

3 3

Message concerning Certs
by Michael Sutton 19 Apr '14

19 Apr '14

NZNOG members: My apologies but all attempts to send the text content of this PDF this morning have been blackholed until I managed to send the contents to InternetNZ PAG as a PDF which made it through filters which been stopping this content. I have had no problem send other messages etc. Your comments would be appreciated as I see this as a major issue which may require all certificates to be regenerated and then only used on patched systems whose memory and priv keys cannot read copied by external parties. Sincerely Michael S Sutton Director - Awacs Communications (NZ) Limited Transit Room The Dominion Observatory 34 Salamanca Road Kelburn Wellington +64 21 305500 Twitter & Skype: Mikiwis http://www.awacs.co.nz https://www.google.co.nz/#q=michael+sutton+nokia+patent http://www.linkedin.com/profile/view?id=16587996&trk=tab_pro

9 13

Heartleech tool
by Juha Saarinen 15 Apr '14

15 Apr '14

https://github.com/robertdavidgraham/heartleech >From the read me: A typical "heartbleed" tool. What makes this different is: autopwn most (-a) that does all the steps needed to get private key post-handshake (encrypted) heartbeats instead of during handshake evades Snort IDS rules loops making repeated requests (-l <loopcount>) dumps binary data to file (-f <filename>) IPv4 or IPv6 (-v <IPver>) full 64k heartbleeds -- Juha Saarinen twitter: juhasaarinen

4 3

Fake domain renewal invoices
by Richard Hulse 14 Apr '14

14 Apr '14

I got one of these just now from Domain Renewal Group, so beware. It was sent to someone else in our organisation, who fortunately brought it to me instead of approving and paying it.

3 2

Heartbleed - clients at risk too
by Juha Saarinen 11 Apr '14

11 Apr '14

Morning. Just saw this: http://vrt-blog.snort.org/2014/04/heartbleed-continued-openssl-client.html Which I thought might be useful to know. -- Juha Saarinen twitter: juhasaarinen

3 2

Snapchat question
by Tony Wicks 10 Apr '14

10 Apr '14

Hi all, we have had some users say they intermittently can't use this application. After downloading this app (and deciding it should go into the why the hell was that ever invented pile) it seems a bit difficult to fault find any issues. Does anyone know how this thing communicates ? Is it normally intermitttant ? Thanks all

2 1

Heartbleed OpenSSL Vulnerability
by Dean Pemberton 10 Apr '14

10 Apr '14

Hi All, NZITF (in conjunction with InternetNZ) have been endeavouring to raise awareness about this issue. We have compiled some information on our website, which may be of use to you and/or your clients. Please feel free to share this link as widely as you see fit. http://www.nzitf.org.nz/news.html The NZITF is treating this as an ongoing security issue with significant implications. As a result we are intending to monitor this situation and update our advice as required. We have tree basic messages for website owners: 1. Establish if your site's servers are vulnerable. 2. Patch the vulnerable servers. 3. Revoke/reissue keys and certificates. If you are vulnerable it is imperative that you do steps 2 AND 3. Not one, but both. You should also be encouraged to discuss this very important issue with your regular security consultants. If you have feedback or information please feel free to contact me so we can include it in the advice on the website. Regards, Dean

17 19

Re: [nznog] [PAG] Message concerning Certs
by Ewen McNeill 08 Apr '14

08 Apr '14

On 2014-04-09 22:40 , Dean Pemberton wrote: > And from the same twitter thread saying it was unlikely... > [can extract private key on vulnerable FreeBSD if it is first request] "first request after restart" is a special case too ("possible, but unlikely"). The same thread/poster also says: "[...] Does not work on Debian. [...]" (also https://twitter.com/1njected/status/453781230593769472) which implies (as noted in that thread) something about the FreeBSD malloc patterns makes it more likely/possible than Debian's malloc. Those (who were) running a vulnerable OpenSSL on FreeBSD may wish to take that into account in their assessment :-) The main thing which is certain is that it's going to be a well studied/probed bug. Ewen

1 0

Re: [nznog] Message concerning Certs
by Michael Sutton 08 Apr '14

08 Apr '14

The exploit has been rumoured for some time. Does it matter who the primary actors are. They have all the private keys by now and g's/s-view/wifi/scan has the other half; so that deals with the white-hats. All historical data dumps can be retrospectively analysed at any time for eternity at ones leisure. As for the code which is in the wild I enclose a graph of 3 hours traffic from the http://filippo.io/Heartbleed/# site which is using something like 31 machines showing ~2000 sites being tested every minute, ~360,000 over 3hours and that is from a public site; an unknown% will be blackhats. This is catastrophic and you should believe it's not only our guys that have it but every other *worth their salt. InternetNZ almost became a CA in ~2004. We could have fixed this hole now for .nz with a working revocation system. Then INZ had a new team on board and it was .... The ironical blowback is that our "own" might be just as threatened by this. We just have to get on and deal with this as a priority tomorrow and for the next decade. I am a patriot by the way, Yours Michael amI#6 -----Original Message----- From: nznog-bounces(a)list.waikato.ac.nz [mailto:nznog-bounces(a)list.waikato.ac.nz] On Behalf Of Don Stokes Sent: Wednesday, 9 April 2014 8:37 p.m. To: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] Message concerning Certs Is there any indication out there as to how widely this bug has been exploited? I.e. if you've patched servers in the last 24 hours, how likely is it that your certificate keys have been leaked over the last months / year? Not looking for accurate numbers, just roughly where on the scale of, "this is possible but no reports of actual use" to "all the black hats have been doing this for years so you're screwed unless you re-issue and revoke your certs" the exploit lies. Also, last time I worried about this, certificate revocation was, uh, largely unimplemented. That was a while ago. How well does it work now? And with potentially large numbers of revoked certs? -- don _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Callplus postmaster contact
by Jean-Francois Pirus 08 Apr '14

08 Apr '14

Can a Callplus/Slingshot/Tranzpeer postmaster contact me. We're having issue with forward emails for our clients to Callplus addresses, the clients are complaining mail is being dropped. PS: I have tried contacting postmaster(a)callplus.net.nz and this is what I got after 4 days: > This message was created automatically by mail delivery software. > A message that you sent has not yet been delivered to one or more of its > recipients after more than 72 hours on the queue on mxdsrv1.tranzpeer.net. > > The message identifier is: 1WTNur-0005YH-G5 > The subject of the message is: Mail server issue: > The date of the message is: Fri, 28 Mar 2014 16:47:21 +1300 > > The address to which the message has not yet been delivered is: > > sysops(a)noc.tranzpeer.net > (generated from postmaster(a)callplus.net.nz) > Delay reason: SMTP error from remote mail server after RCPT TO:<sysops(a)noc.tranzpeer.net>: > host 192.168.69.1 [192.168.69.1]: 451 4.3.2 Please try again later Our logs are full of the following: Apr 8 12:41:40 tiny postfix/smtp[14531]: 4FE0DDFA92F: host mxi1.callplus.net.nz[202.180.66.203] refused to talk to me: 421 4.7.0 Not allowed. Apr 8 12:41:40 tiny postfix/smtp[14532]: B7E63DFA8DC: host mxi1.callplus.net.nz[202.180.66.203] refused to talk to me: 421 4.7.0 Not allowed. Apr 8 12:41:40 tiny postfix/smtp[14537]: 9B205DFA940: host mxi1.callplus.net.nz[202.180.66.203] refused to talk to me: 421 4.7.0 Not allowed. Apr 8 12:41:40 tiny postfix/smtp[14537]: 9B205DFA940: to=<BLAH(a)slingshot.co.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=1347, delays=1346/0.58/0.06/0, dsn=4.7.0, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] refused to talk to me: 421 4.7.0 Not allowed.) Apr 8 12:41:52 tiny postfix/smtp[14530]: 4B069DFA8E2: host mxi1.callplus.net.nz[202.180.66.203] said: 451 4.3.2 Please try again later (in reply to RCPT TO command) Apr 8 12:41:52 tiny postfix/smtp[14531]: 4FE0DDFA92F: to=<BLAH(a)callplus.net.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=1391, delays=1379/0.25/0.1/12, dsn=4.3.2, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] said: 451 4.3.2 Please try again later (in reply to RCPT TO command)) Apr 8 12:41:52 tiny postfix/smtp[14532]: B7E63DFA8DC: to=<BLAH(a)callplus.net.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=1866, delays=1853/0.29/0.1/12, dsn=4.3.2, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] said: 451 4.3.2 Please try again later (in reply to RCPT TO command)) Apr 8 12:42:04 tiny postfix/smtp[14530]: 4B069DFA8E2: to=<BLAH(a)callplus.net.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=1790, delays=1766/0.25/12/12, dsn=4.3.2, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] said: 451 4.3.2 Please try again later (in reply to RCPT TO command)) Apr 8 12:56:58 tiny postfix/smtp[17081]: E3622DFA91C: host mxi1.callplus.net.nz[202.180.66.203] refused to talk to me: 421 4.7.0 Not allowed. Apr 8 12:56:59 tiny postfix/smtp[17081]: E3622DFA91C: to=<BLAH(a)slingshot.co.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=0.07, delays=0.01/0/0.05/0, dsn=4.7.0, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] refused to talk to me: 421 4.7.0 Not allowed.) Apr 8 13:00:24 tiny postfix/smtp[17832]: 061A4DFA8F6: host mxi1.callplus.net.nz[202.180.66.203] said: 451 4.3.2 Please try again later (in reply to RCPT TO command) Apr 8 13:00:36 tiny postfix/smtp[17832]: 061A4DFA8F6: to=<BLAH(a)callplus.net.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=24, delays=0.02/0.01/12/12, dsn=4.3.2, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] said: 451 4.3.2 Please try again later (in reply to RCPT TO command)) Apr 8 13:01:22 tiny postfix/smtp[17829]: D7FB0DFA91F: host mxi1.callplus.net.nz[202.180.66.203] said: 451 4.3.2 Please try again later (in reply to RCPT TO command) Apr 8 13:01:34 tiny postfix/smtp[17829]: D7FB0DFA91F: to=<BLAH(a)slingshot.co.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=25, delays=0.64/0.04/12/12, dsn=4.3.2, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] said: 451 4.3.2 Please try again later (in reply to RCPT TO command)) Apr 8 13:02:06 tiny postfix/smtp[17851]: 4F55DDFA934: host mxi1.callplus.net.nz[202.180.66.203] said: 451 4.3.2 Please try again later (in reply to RCPT TO command) Apr 8 13:02:15 tiny postfix/smtp[17832]: 1ABBEDFA0E0: host mxi1.callplus.net.nz[202.180.66.203] said: 451 4.3.2 Please try again later (in reply to RCPT TO command) Apr 8 13:02:18 tiny postfix/smtp[17851]: 4F55DDFA934: to=<BLAH(a)slingshot.co.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=24, delays=0.02/0/12/12, dsn=4.3.2, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] said: 451 4.3.2 Please try again later (in reply to RCPT TO command)) Apr 8 13:02:27 tiny postfix/smtp[17832]: 1ABBEDFA0E0: to=<BLAH(a)callplus.net.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=24, delays=0.01/0.01/12/12, dsn=4.3.2, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] said: 451 4.3.2 Please try again later (in reply to RCPT TO command)) Apr 8 13:15:04 tiny postfix/smtp[20825]: 4D5B9DFA923: host mxi1.callplus.net.nz[202.180.66.203] said: 451 4.3.2 Please try again later (in reply to RCPT TO command) Apr 8 13:15:16 tiny postfix/smtp[20825]: 4D5B9DFA923: to=<BLAH(a)callplus.net.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=24, delays=0.07/0/12/12, dsn=4.3.2, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] said: 451 4.3.2 Please try again later (in reply to RCPT TO command)) Apr 8 13:16:39 tiny postfix/smtp[21318]: 377AFDFA8DC: host mxi1.callplus.net.nz[202.180.66.203] said: 451 4.3.2 Please try again later (in reply to RCPT TO command) Apr 8 13:16:51 tiny postfix/smtp[21318]: 377AFDFA8DC: to=<BLAH(a)callplus.net.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=24, delays=0.01/0/12/12, dsn=4.3.2, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] said: 451 4.3.2 Please try again later (in reply to RCPT TO command)) Apr 8 13:24:14 tiny postfix/smtp[21330]: 8FF10DFA8E2: host mxi1.callplus.net.nz[202.180.66.203] said: 451 4.3.2 Please try again later (in reply to RCPT TO command) Apr 8 13:31:51 tiny postfix/smtp[24414]: 1ABBEDFA0E0: host mxi1.callplus.net.nz[202.180.66.203] said: 451 4.3.2 Please try again later (in reply to RCPT TO command) etc... Thanks. -- Jean-Francois Pirus | Technical Manager francois(a)clearfield.com | Mob +64 21 640 779 | DDI +64 9 282 3401 Clearfield Software Ltd | Ph +64 9 358 2081 | www.clearfield.com

7 7

ICONZ-Webvisions (NZ) to cease operating externally-reachable NTP servers
by Mark Foster 07 Apr '14

07 Apr '14

Hiya folks - again... ! :-) ICONZ-Webvisions (the entity formerly known simply as ICONZ in NZ) are making changes to their NTP server arrangements on the evening morning of 10 April (so, overnight tomorrow night). The details of the changes being made can be viewed at: http://iconz-webvisions.com/en/support/outages/new-zealand In short, if you have been using 'ntp.iconz.net' or 'ntp.iconz.co.nz' by DNS name, you'll have already seen a change; this now is CNAME'd to s2.ntp.net.nz (which happens to sit in our DC)[1]. Anyone who has been using any of our (very long lived) NTP servers by IP address, these IP's will stop responding to NTP queries from outside of our network, in the wee hours of 10 April. Much like the DNS changes recently made, this is most likely to be noticed by people who've been using these IP's for historical or habitual reasons. Customers with concerns about this change are invited to contact our Customer Care team on 0800 843 638 or via support.nz(a)iconz-webvisions.com<mailto:support.nz(a)iconz-webvisions.com>. Non-customers, should probably change their NTP timesource to a publically available resource; I do very much value and recommend the services offered by NZRS, with details at www.ntp.net.nz<http://www.ntp.net.nz>. Regards Mark. [1] This was done in conjunction with NZRS and mainly as an 'interim' measure. Those DNS records may be removed completely at some stage in the future. Anyone using those hostnames should move to using services such as those offered by NZRS, and bypass our DNS entries completely, as soon as possible. -- Mark Foster Technical Services Manager - Australia & New Zealand [iconz-webvisions-logo-png] www.iconz-webvisions.com<http://www.iconz-webvisions.com/> ICONZ-Webvisions, ICONZ House, 60 Airedale Street, Auckland 1010, New Zealand

1 1

OpenSSL vulnerability
by Dean Pemberton 07 Apr '14

07 Apr '14

Here's one to keep an eye on. Seems to be getting a bit of attention. http://www.kb.cert.org/vuls/id/720951 http://heartbleed.com/ Work with your vendors to confirm if you're at risk.

1 0

tk[1-4].ihug.co.nz
by Joel van Velden 07 Apr '14

07 Apr '14

Hi List After Mark's announcement about removal of Iconz public ntp I thought I should check my ntpd configs. Can anyone from Vodafone give an update on tk[1-4].ihug.co.nz? After many mergers and acquisitions it occurs to me that perhaps these could be dusty machines under someone's desk that could disappear one day without announcement? Any official comment? Is there an official webpage about them? Regards, Joel van Velden

1 0

Software Defined Networking (SDN) Presentation
by Jay Best 07 Apr '14

07 Apr '14

Hey is anyone else going to this? I haven't seen many of you guys from NZNOG in ages, so would be good to catchup for old times sake! Cheers, J *Software Defined Networking (SDN) Presentation* Auckland Tourism, Events and Economic Development and Massey University invite you to an informative and engaging presentation by world leading New Zealand expert Mr. Josh Bailey from Google around SDN research in New Zealand and beyond. SDN has been generating a lot of press in the network industry and research worlds. While a community has arisen to energetically debate what SDN is? There are concrete research efforts and deployed systems exploring the implications of separating control and data planes. These include Google's B4 network (which connects Google data centers together) and uses OpenFlow and CityLink's efforts in New Zealand to produce an SDN controlled Internet exchange. This presentation will describe some recent research both here in NZ and in the US, including work at REANNZ and Victoria University on building and deploying an open source SDN controller and experiments including RPKI. Date: Monday, 14th April 2014 Time: 4.30pm - 6.30pm Venue: Room OR 4, Building 102 Massey Albany Campus Gate 4 Eastbourne Road, Old Albany Highway. Cost: Complimentary RSVP: Shona Alo (s.alo(a)massey.ac.nz) if you would like to attend

1 0

Bitstream 3a DHCP manipulation
by Dave Mill 07 Apr '14

07 Apr '14

Hi all I posted a few weeks ago about MAC limits on Bitstream 3a connections. This is related to that. This is a UFF Bitstream 3a connection. I've discovered that a customer's only complaint with a Bitstream 3a connection from us is that DHCP doesn't work over this. I've obtained some pcaps from both ends and I can see the following changes occurring to a DHCP Request: 1) The transaction ID is changed 2) Option 82 is added. More specifically, sub-option 1 Agent Circuit ID is present and has a valid length. sub-option 2 Agent Remote ID is present, has a length of 0 and no content which wireshark doesn't seem to like much. I've had a brief read of RFC3046 and I can't really tell if its valid to have a sub-option with a length of 0 or not. https://tools.ietf.org/html/rfc3046#page-8 I never see any DHCP ACKs coming back from the customer's DHCP server. I've had a read of some of UFF's Bitstream3a docs and can't see any mention of DHCP. I can see in one of our initial requests we had to fill out we can choose to have DHCP Relay Agent Functionality but this seems to be related to Bitstream2 only and also this defaults to be disabled. I don't know what DHCP server the customer is using right now but I hope to find this out soon. Questions for anyone with more experience in this than myself: -Can changing the DHCP Request transaction ID cause issues? -Has anyone come across DHCP servers not liking option 82 being set, or not liking sub-option 2 having a 0 length? -Has anyone successfully used DHCP across a Bitstream3a connection? How about a UFF Bitstream3a connection? -Am I missing anything obvious? Obviously I might end up talking to UFF over this but I just want to see what others on the list know before doing so. Again, I don't really want to debate the wisdom of plugging two LANs in over a Bitstream3a connection. Cheers Dave

9 12

Koru Club Wireless - Air NZ Contact
by Davey Goode 07 Apr '14

07 Apr '14

Hi All, Can someone from AirNZ who has knowledge of the wireless in the koru lounge please flick me a mail off list. cheers davey

1 0

IP Hijack out of Indosat Thailand
by Tony Wicks 03 Apr '14

03 Apr '14

Is anyone else seeing their IP ranges hijacked out of Thailand ? http://seclists.org/nanog/2014/Apr/49 http://seclists.org/nanog/2014/Apr/55 You received this email because you are subscribed to BGPmon.net. For more details about these updates please visit: https://portal.bgpmon.net/myalerts.php ==================================================================== Possible Prefix Hijack (Code: 10) ==================================================================== Your prefix: 103.9.40.0/22: Prefix Description: FLIP-AS-AP Update time: 2014-04-02 20:29 (UTC) Detected by #peers: 1 Detected prefix: 103.9.40.0/22 Announced by: AS4761 (INDOSAT-INP-AP INDOSAT Internet Network Provider,ID) Upstream AS: AS4651 (THAI-GATEWAY The Communications Authority of Thailand(CAT),TH) ASpath: 18356 38794 4651 4761 ==================================================================== Possible Prefix Hijack (Code: 10) ==================================================================== Your prefix: 103.224.128.0/22: Prefix Description: Flip Update time: 2014-04-02 19:42 (UTC) Detected by #peers: 1 Detected prefix: 103.224.128.0/22 Announced by: AS4761 (INDOSAT-INP-AP INDOSAT Internet Network Provider,ID) Upstream AS: AS4651 (THAI-GATEWAY The Communications Authority of Thailand(CAT),TH) ASpath: 18356 9931 4651 4761

8 8

OM4 MMF
by Jed Laundry 31 Mar '14

31 Mar '14

Hi folks, Excuse my ignorance, I try to avoid orange/aqua cables... We recently had a rack of servers + SAN installed with 8Gb FC, and long story short, the vendor will only supply & install 5m OM4 cables. *grumble grumble FCoE grumble 2m patch grumble* AFAICT, OM4 is to OM3 what G.657A2 is to G.652 - completely interchangeable, especially for such a short run, just don't expect to wrap it around a pencil. And so I can swap out these stupidly long cables with properly measured OM3. Is this sensible? Thanks, Jed. Sent from a small screen.

3 3

slides for nznog 2014
by Joel van Velden 27 Mar '14

27 Mar '14

Hi list I seem to have lost the URL (someone's owncloud?) for where nznog '14 slides were posted to. Does anyone still have it? Regards, Joel van Velden

2 1

DNSSEC in .au
by Adam King 26 Mar '14

26 Mar '14

auDA has announced it will be introducing DNSSEC into the .au domain space in an experimental capacity. Deployment on production servers will commence during April and will be trialled for 4 months. The .au DS records will_not be added to the root zone during this period. Operators should_not create or implement trust anchors for .au in their production environments during this experimental phase. A mailing list has been created for all future announcements related to DNSSEC in .au, if you wish to subscribe to this mailing list please visit http://www.lists.auda.org.au/mailman/listinfo/dnssec-announce For further information about the implementation of DNSSEC in .au please see http://www.auda.org.au/industry-information/au-domains/dnssec/. Kind Regards, Adam King | CTO .au Domain Administration Ltd T: +61 3 8341 4111 | F: +61 3 8341 4112 E: adam.king(a)auda.org.au | W:www.auda.org.au Twitter: @auda | Blog: www.auda.org.au/blog/ auDA - Australia's Domain Name Administrator Important Notice This email may contain information which is confidential and/or subject to legal privilege, and is intended for the use of the named addressee only. If you are not the intended recipient, you must not use, disclose or copy any part of this email. If you have received this email by mistake, please notify the sender and delete this message immediately.

2 1

Home Grown RPKI Validators
by Bill Walker 25 Mar '14

25 Mar '14

Hi All, Now I have solved my ROA issue, (Thanks Dean & Michael) I'd like to look at building an RPKI validator, does anyone have any experience with these? Thanks, Bill

1 0

12ish U cabinets in Wellington?
by Michael Fincham 23 Mar '14

23 Mar '14

Hi all, Anyone have a 12ish U cabinet in Wellington they'd like to be rid of? Will swap for beer or small amounts of money. Would prefer one with solid doors on front / back. I can come collect if it it'll fit in a taxi :) -- Michael

1 0

Re: [nznog] NZNOG Digest, Vol 135, Issue 16
by Jonathan Spence 23 Mar '14

23 Mar '14

Remember some ISPs could be at national peering locations e.g. iinet peer ate APE do they not? If its your intention to save on traffic costs the BGP route is probably OK but using a proper service is more desirable overall. Jonathan Spence Chief Executive Officer Fixed: +64 9 9510448 Mobile: +64211055634 ---------------------------------------- From: nznog-request(a)list.waikato.ac.nz Sent: Monday, March 24, 2014 12:00 PM To: nznog(a)list.waikato.ac.nz Subject: NZNOG Digest, Vol 135, Issue 16 Send NZNOG mailing list submissions to nznog(a)list.waikato.ac.nz To subscribe or unsubscribe via the World Wide Web, visit http://list.waikato.ac.nz/mailman/listinfo/nznog or, via email, send a message with subject or body 'help' to nznog-request(a)list.waikato.ac.nz You can reach the person managing the list at nznog-owner(a)list.waikato.ac.nz When replying, please edit your Subject line so it is more specific than "Re: Contents of NZNOG digest..." Today's Topics: 1. List of NZ IP addresses? (Clark Mills) 2. Re: List of NZ IP addresses? (Tony Wicks) 3. Re: List of NZ IP addresses? (Clark Mills) 4. Re: List of NZ IP addresses? (Peter Lambrechtsen) 5. Re: List of NZ IP addresses? (Bill Walker) 6. Re: List of NZ IP addresses? (Damian Kissick) 7. Re: List of NZ IP addresses? (Scott Howard) 8. Re: List of NZ IP addresses? (Rob McDonald) 9. Re: List of NZ IP addresses? (Gareth Davies) 10. Re: List of NZ IP addresses? (Lindsay Hill) 11. Re: List of NZ IP addresses? (Richard Naylor) ---------------------------------------------------------------------- Message: 1 Date: Mon, 24 Mar 2014 08:51:30 +1300 From: Clark Mills <c.mills(a)auckland.ac.nz> To: nznog(a)list.waikato.ac.nz Subject: [nznog] List of NZ IP addresses? Message-ID: <532F3B42.90609(a)auckland.ac.nz> Content-Type: text/plain; charset="utf-8"; Format="flowed" Hi all. I realise that it's a constantly changing list but does anyone have a list on NZ IPs? Why: We're trying to set up a website to be accessible in NZ only. Knowing what I know then firewalling is the tool (a man with a hammer...) but I need to routinely source a more recent list. Any suggestions or hints appreciated. Cheers... Clark

1 0

Re: [nznog] List of NZ IP addresses?
by Richard Naylor 23 Mar '14

23 Mar '14

At 09:50 a.m. 24/03/2014, you wrote: >2 votes for maxmind. (or bgp feed with communities or something from >your ISP) it depends if you are trying to firewall for cost reasons, >eg: I don't want to serve my HD content to international viewers >because it will bankrupt me. Or I don't want to serve my >international content to international viewers because it would >breach a license agreement with the rights holder. The tier-1 CDNs all offer more than enough filtering to do very decent geo-fencing. So its not hard to limit to "NZ-only" or "everywhere but not nz". Sometimes we use that as the second line of defence. Rights agreements often require 2 levels or more.

1 0

List of NZ IP addresses?
by Clark Mills 23 Mar '14

23 Mar '14

Hi all. I realise that it's a constantly changing list but does anyone have a list on NZ IPs? Why: We're trying to set up a website to be accessible in NZ only. Knowing what I know then firewalling is the tool (a man with a hammer...) but I need to routinely source a more recent list. Any suggestions or hints appreciated. Cheers... Clark

9 9

RPKI and ROA
by Bill Walker 19 Mar '14

19 Mar '14

Hi All, Hoping someone can help. I am in the middle of a project to build 4 PoP's in Chicago, London, Sydney and Mumbai. As part of this I have been given the role of creating all the necessary Route objects etc. Our address space is from ARIN, but our ASN's are from RIPE, APNIC & ARIN. I have created as-set, aut-num and route objects in RADb to enable us to manage them from a single point. However I would like to setup ROA records for these route objects. I have setup RPKI with ARIN and created our first ROA object. Onto my question, am I likely to have operational issues if the route objects are in RADb and the ROA with ARIN? TIA, Bill

4 7

CityLink APE route server maintenance
by CityLink Ltd 18 Mar '14

18 Mar '14

On Sunday 23rd March 2014 between 18:00 and 21:00 the CityLink APE route server rs2.ape.nzix.net will be taken offline for building maintenance. Please make sure you also have a session configured with rs1.ape.nzix.netto ensure there is no loss of service. And a reminder that all NZIX customers should be configured with both route servers at each exchange for maximum resiliency. Customers who experience any problems with the service after the maintenance work should contact the CityLink 24 hour support number: Free call: 0800 4 CITYLINK (0800 424 895) Select: Option 3 Advise you have a fault with your CityLink service and include the relevant service reference number.

1 0

Google DNS 8.8.8.8/32
by Neil Fenemor 17 Mar '14

17 Mar '14

It seems 8.8.8.8/32 was hijacked yesterday for 22 minutes yesterday, affecting networks in Brazil and Venezuela. https://twitter.com/bgpmon/status/445266642616868864/photo/1 So about that RPKI thing…having a quick look (via whois.bgpmon.net) it seems Google does not have an ROA for 8.8.8.0/24. Yet another reason friends should not let friends use Google’s recursive resolvers. Perhaps their RIR doesn’t make it as easy as APNIC does to create ROA objects. Cheers, -- Neil Fenemor | +64 21 978 078 | Facetime | Skype

4 4

News: US to give up control of Internet administration
by Skeeve Stevens 16 Mar '14

16 Mar '14

Hi all, A very important announcement by NTIA/DoC/ICANN regarding the control of the Internet. This is an article from todays Commsday that very well explains the current situation. ...Skeeve -- *Commsday* - 17th March 2014 - www.commsday.com *US to give up control of Internet administration* The United States government says it will cede the Department of Commerce's legal authority over global Internet governance, but on condition that it approves of the system which replaces it. Late Friday afternoon, the National Telecommunications and Information Administration, under the DoC, said it wanted Internet domain governance to be subject to "multi-stakeholder" oversight and would oppose transition to an inter-governmental administration such as the International Telecommunications Union. Currently the DoC delegates oversight functions to the Internet Corporation for Assigned Names and Numbers which in turn works with various private and sector bodies such as the Internet Engineering Task Force, the Internet Architecture Board, the Internet Society, the Regional Internet Registries, top level domain name operators and VeriSign to administrate the Internet. "The timing is right to start the transition process," said Assistant Secretary of Commerce for Communications and Information Lawrence E. Strickling. "We look forward to ICANN convening stakeholders across the global Internet community to craft an appropriate transition plan." NTIA has communicated to ICANN that the transition proposal must have broad community support and address the following four principles: - Support and enhance the multi-stakeholder model; - Maintain the security, stability, and resiliency of the Internet DNS; - Meet the needs and expectation of the global customers and partners of ICANN's domain administration services; and, - Maintain the openness of the Internet. "Consistent with the clear policy expressed in bipartisan resolutions of the U.S. Senate and House of Representatives (S.Con.Res.50 and H.Con.Res.127), which affirmed the United States support for the multi-stakeholder model of Internet governance, NTIA will not accept a proposal that replaces the NTIA role with a government-led or an inter-governmental organisation solution," it said. AUSTRALIA BACKS US: The decision won the instant backing of Australian communications minister Malcolm Turnbull, who said he had discussed the plans with Strickling last week. Australia has been a steadfast ally of the US's opposition to a role for the ITU in Internet administration. Turnbull said "the Australian Government is absolutely committed to supporting an open Internet which is administered by multi stakeholder organisations like ICANN and NOT by governments whether in the form of consortia or multilateral organisations like the ITU or the UN." "The Internet is the most remarkable invention of our times and while it had its origins in research contracts with the US Government its growth, its dynamism, its resilience have all been the result of collaborative efforts by the wide Internet community not government regulation or fiat." "While it is all too common to complain about the US Government role in the Internet the truth is that the world owes the United States an extraordinary debt not just for giving birth to the Internet, but above all for giving it the freedom to develop into the extraordinary global platform it has become today." "The (ICANN subsidiary) Internet Assigned Numbers Authority contract with the US Department of Commerce expires in September 2015 and today I assured the President of ICANN, Mr Fadi Chehade, that the Australian Government will provide all the support it can to ICANN's efforts to develop a structure of governance that will meet the US Department of Commerce's vitally important conditions of removing itself from the IANA arrangements at the heart of the Internet. DOMESTIC OPPOSITION TO CHANGE: However, the decision did not receive bipartisan support in the United States with Republican politicians and advisers defending the status quo and warning of the consequences of global control of Internet administration. Former House speaker Newt Gingrich said "Every American should worry about Obama giving up control of the internet to an undefined group. This is very, very dangerous. What is the global internet community that Obama wants to turn the internet over to? This risks foreign dictatorships defining the internet." A former State Department adviser under the Bush administration, Christian Whiton, said "US management of the internet has been exemplary and there is no reason to give this away -- especially in return for nothing. This is the Obama equivalent of Carter's decision to give away the Panama Canal -- only with possibly much worse consequences." GROWING PUSH AGAINST US: However, the US move has been interpreted by others as an early strike against what are likely to be persistent efforts to globalise the Internet's administration on terms which may prove unacceptable to the United States and its allies. Following unsuccessful attempts by China, Russia and the Arab bloc to have the ITU assume Internet governance functions in late 2012, there has been renewed pressure to change the status quo following the so-called Snowden revelations last year regarding pervasive US surveillance of foreign powers and individuals using Internet and telecom platforms. Brazil, one of the leading critics of the US, plans its own global Internet multi-stakeholder forum in late April in order to seize the initiative on how a post-US Internet might be shaped. Anti-US governmental members of the ITU are expected to revive their efforts in support of that organisation assuming Internet control when it convenes in South Korea for its plenipotentiary in November. The last ITU vote on these matters saw around 90 countries, led by China, Russia and the Arab world, support new regulations to "nationalise" the Internet and around 55, led by the US and its allies, support the status quo or a "multi-stakeholder" approach akin to the status quo, where specialist private and technical organisations such as ICANN perform management roles. Paul Rosenzweig, who served as a senior homeland security official under former President George W. Bush, opined "the move by the United States to start this transition now is either very canny or panicked. The optimist in me wants to think that the transition to ICANN management is an effort to forestall an even worse result from takeover of network administration by the ITU. It may be that allowing ICANN a controlling role will placate our European allies and prevent the ITU meeting in Busan, South Korea from becoming a debacle." "The pessimist, however, sees this as a reaction to the Snowden disclosures. All of a sudden American stewardship of the network is suspect. Some, hoping to defuse the anger, may have chosen to rush to give up that stewardship, without thinking through the consequences." Malcolm Turnbull also agreed that the US decision opened up a Pandora's box of challenges for those who think the existing system is generally successful. "There is a lot of work to do to support ICANN in transitioning to a new model and the Australian Government, committed as it is to a multi-stakeholder system of governance, will work with the Australian and global Internet community including other governments to ensure that the Internet remains free, stable and resilient and continues to be a powerful platform for freedom around the world," he said Grahame Lynch --- To get access to great articles like this, often before the mainstream media, please subscribe to Commsday - www.commsday.com ...Skeeve *Skeeve Stevens - *eintellego Networks Pty Ltd skeeve(a)eintellegonetworks.co.nz ; www.eintellegonetworks.co.nz Phone: +612 8014 7398; Cell +61 (0)414 753 383 ; skype://skeeve facebook.com/eintellegonetworks ; <http://twitter.com/networkceoau> linkedin.com/in/skeeve twitter.com/theispguy ; blog: www.theispguy.com The Experts Who The Experts Call Juniper - Cisco - Cloud - Consulting - IPv4 Brokering

1 0

Re: [nznog] Andy Linton in the news as holder of a key to the internet
by Dominic Driver 12 Mar '14

12 Mar '14

One key to secure them all... I for one am delighted to know that such an honourable man is one of the few entrusted with such responsibility. On 3 Mar 2014 22:42, Nigel Roberts <nigel(a)nobiscuit.com> wrote: > > As spotted over here in the fairfax papers: > > http://www.theage.com.au/it-pro/security-it/meet-andy-linton-one-of-the-few… > > I think I’d get sick of the key holder (master?) jokes, too. Thanks for your good work Andy. > > Nigel > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog

2 1

Bitstream 3a MAC limits
by Dave Mill 12 Mar '14

12 Mar '14

Hi all I know the answer to my question here is likely hidden deep in a PDF somewhere but someone on this list may know the answer off hand. I see that Bitstream 3a has a 64 MAC limit. What doesn't seem clear to me is if this MAC limit is a customer ONT port MAC limit, or a MAC limit for the entire customer S-VID. I had always assumed it was a limit on MACs that can be sourced from the customer ONT port but am I wrong? Is it a MAC limit on the total number of MACs that can be learnt over the entire customer S-VID (src'ed from either the provider or customer end of the link)? I'm extracting the 64 MAC limit from this document here - http://www.crownfibre.govt.nz/wp-content/uploads/2013/01/Chorus-UFB-Service… Any feedback, especially this afternoon, would be very useful. Provider is UFF. I am not really wanting to debate why someone would want that number of MACs over a BS3 connection and why some layer 3 should probably be involved here.... Cheers Dave

4 4

TVNZ On Demand
by Barry Murphy 12 Mar '14

12 Mar '14

Hey guys, wondering if anyone from TVNZ On Demand is on this list and wouldn't mind contacting me offlist regarding problems streaming if a user has an IPv6 address. The helpdesk doesn't appear to know what ipv6 is so thought I'd try an alternative. Many thanks Barry

2 1

IPv6 redundancy
by Jonathan Spence 11 Mar '14

11 Mar '14

Hi all, I started a thread on the IPv6 group on LinkedIn in regards to this but.... What is the best way to provide redundant connectivity to SMBs with IPv6? Using v4 with NAT is easy with most routers but v6 is harder. Shim6 seems to be a good idea but looks to be a dead duck. People in that thread were advocating full AS and BGP but I don't think that is easy for most SMBs unless their IT support is top notch and trained (which lets face it, most don't even know how to screw in a lightbulb). It also may mess up global routing tables causing them to get much bigger. Any ideas? Jonathan Spence Chief Executive Officer Fixed: +64 9 9510448 Mobile: +64211055634

2 1

Web audio collection
by Richard Hulse 10 Mar '14

10 Mar '14

Radio NZ has an audio collection for the web's birthday: http://www.radionz.co.nz/collections/world-wide-web Featuring Vint Cerf, Tim Berners-Lee and Andy Linton. Add beer as required.

1 0

Turning on DNSSEC validation - you know you want to!
by Andy Linton 10 Mar '14

10 Mar '14

>From this posting: http://www.internetsociety.org/deploy360/blog/2014/01/circleid-dns-security… I like this quote: However, on the recursive resolver side, I am much more of a fan of having the DNS resolution occur as close to the end user as possible. This is particularly true when you enable DNSSEC validation.

1 0

Some discussion starters from APRICOT 37
by Michael Fincham 09 Mar '14

09 Mar '14

Hi all, I recently had the pleasure of attending APRICOT 37 (many thanks to the NZNOG and InternetNZ folks, and others, who made this possible!) and felt that there were some interesting topics discussed that may be worth bringing back to the NZNOG community. Here's an unsorted and terse list of some things I thought worthwhile: -> We need to stop looking at Alexa's "top 100" websites for IPv6 support and being disappointed - we need to be looking at a much smaller proportion of the "top sites" as this is where "all of the traffic" is actually going. Facebook, YouTube, Google, Wikipedia, Akamai and GGC cache nodes. It's a port 80 world and a few sites dominate :) -> Some big providers (T-Mobile, Telstra AU) talked about having rolled out IPv6 in various forms (single stack v6, dual stack with CGNAT on v4 and native v6) to their mobile subscriber base with approximately no support impact. A common theme: "We need to test IPv6 before deploying it!" "What testing did you do with IPv4?" "None" "Well do that with IPv6 too!" -> Paraphrasing: "Customers don't know what IPv4 is to begin with, so they sure don't know or care what IPv6 is." -> These operators reported seeing /40%/ of the traffic on any given subscriber where dual stack was available going straight out to the native v6 Internet! This is a huge win if you're looking at deploying CGNAT as it means approximately half as much state needs to be kept on your expensive CGNAT boxes, and half as much traffic is being molested on the way from the customer to the 'net :) It also means you should definitely be rolling out dual stack alongside your CGNAT :) -> 464XLAT (http://tools.ietf.org/html/rfc6877) looks like it's about to be a big deal in the mobile IPv6 space. In short, 464XLAT allows for phones to run single stack native IPv6 while applications on the phone can continue to access v4 literals etc if required. Makes use of a clever combination of existing technologies. Only Android 4.3+ supports this so far, but more phone support shouldn't be far away. To me this looks like it would be a killer feature to have on fixed line CPEs, though I am unclear how it would interact with the type of NAT these CPEs typically perform (though this ought not be too far away from a tethering scenario on a phone). -> Geoff Huston's closing presentation on the state of BGP in 2013 contained some interesting measurements and insights about how worried we should be able router performance and so on. The video (https://www.youtube.com/watch?feature=player_detailpage&v=e4N9ELoM76M#t=1798) and slides (https://conference.apnic.net/data/37/2014-02-27-bgp2013_1392943641.pdf) are worth a look if you have ~ 20 minutes. Since the NZNOG list has been more alive of late, I'd welcome discussion on any of these points as certainly there is plenty here that is relevant to NZ :) -- Michael Fincham System Administrator, Unleash Office: 0800 750 250

2 2

ICONZ-Webvisions (NZ) to close Open DNS Resolvers
by Mark Foster 05 Mar '14

05 Mar '14

Hi folks ICONZ-Webvisions (the entity formerly known simply as ICONZ in NZ) will be blocking external access to our recursive DNS servers to non-customer subnets on the evening of 6 March 2014. In the knowledge that there may well be former customers or third-parties who have hard-coded the IP's of our DNS servers into their configs (or their customer configs) I'm giving notice now; the following IP's will cease to provide DNS resolution to clients outside of our network space, at that time: 210.48.65.1 210.48.65.2 210.48.66.1 210.48.66.2 Customers with concerns about this change are invited to contact our Customer Care team on 0800 843 638 or via support.nz(a)iconz-webvisions.com<mailto:support.nz(a)iconz-webvisions.com>. Regards Mark. -- Mark Foster Technical Services Manager - Australia & New Zealand [iconz-webvisions-logo-png] www.iconz-webvisions.com<https://webmail.iconz.net/owa/redir.aspx?C=ToykmhkSsEaPr3XJN6nrf-rRV-b9iM8I…> ICONZ-Webvisions, ICONZ House, 60 Airedale Street, Auckland 1010, New Zealand

2 2

NZNOG 2014 videos
by Richard Naylor 05 Mar '14

05 Mar '14

Folks I just noticed an upgrade to the video player software had taken away the SD/HD control, or at least it wasn't explicitly obvious. There is a newer version that is slightly better, but I've rolled back a release so that SD/HD is obvious. Comments/feedback appreciated. They can be off list to save clutter. Also is HD worth it ? Richard

1 0

RFC 7149 -- SDN
by Sebastian Castro 05 Mar '14

05 Mar '14

Hi: Given SDN has been a buzzword within NZNOG, I would recommend RFC 7149 as reading for those interested: http://www.rfc-editor.org/rfc/rfc7149.txt SDN: A perspective from within a Service Provider Environment Cheers -- Sebastian Castro Technical Research Manager .nz Registry Services (New Zealand Domain Name Registry Limited) desk: +64 4 495 2337 mobile: +64 21 400535

1 0

NZNOG conference dates for the next hundred years
by Dean Pemberton 03 Mar '14

03 Mar '14

Hi All >From time to time we run into people who claim that we keep moving the NZNOG conference dates around. Normally this is because NZNOG happens to conflict with another conference that they might want to go to. The official policy is.. "The last full usable week in January" I'm just about the give the NZNOG update at the APRICOT meeting in Kuala Lumpur. So I thought I'd solve the problem once and for all. Here are the conference dates for the next hundred years along with a script to check which a particular year. I might have a couple of these wrong and we do reserve the right to change them if required, but they are a good place to start. #!/usr/bin/perl -w use strict ; use DateTime ; use feature qw( say ) ; my $year = $ARGV[ 0 ]; my $dt = DateTime->last_day_of_month( year => $year , month => 1 ) ; while ( $dt->day_of_week != 5 ) { $dt->subtract( days => 1 ) ; } my $nznogenddate = $dt->dmy; $dt->subtract (days => 5) ; my $nznogstartdate = $dt->dmy; print ("In $year NZNOG will be held from $nznogstartdate to $nznogenddate\n") ; $ for i in `seq 2015 1 2115`; do ./dates.pl $i ; done In 2015 NZNOG will be held from 25-01-2015 to 30-01-2015 In 2016 NZNOG will be held in conjunction with APRICOT 2016, Auckland In 2017 NZNOG will be held from 22-01-2017 to 27-01-2017 In 2018 NZNOG will be held from 21-01-2018 to 26-01-2018 In 2019 NZNOG will be held from 20-01-2019 to 25-01-2019 In 2020 NZNOG will be held from 26-01-2020 to 31-01-2020 In 2021 NZNOG will be held from 24-01-2021 to 29-01-2021 In 2022 NZNOG will be held from 23-01-2022 to 28-01-2022 In 2023 NZNOG will be held from 22-01-2023 to 27-01-2023 In 2024 NZNOG will be held from 21-01-2024 to 26-01-2024 In 2025 NZNOG will be held from 26-01-2025 to 31-01-2025 In 2026 NZNOG will be held from 25-01-2026 to 30-01-2026 In 2027 NZNOG will be held from 24-01-2027 to 29-01-2027 In 2028 NZNOG will be held from 23-01-2028 to 28-01-2028 In 2029 NZNOG will be held from 21-01-2029 to 26-01-2029 In 2030 NZNOG will be held from 20-01-2030 to 25-01-2030 In 2031 NZNOG will be held from 26-01-2031 to 31-01-2031 In 2032 NZNOG will be held from 25-01-2032 to 30-01-2032 In 2033 NZNOG will be held from 23-01-2033 to 28-01-2033 In 2034 NZNOG will be held from 22-01-2034 to 27-01-2034 In 2035 NZNOG will be held from 21-01-2035 to 26-01-2035 In 2036 NZNOG will be held from 20-01-2036 to 25-01-2036 In 2037 NZNOG will be held from 25-01-2037 to 30-01-2037 In 2038 NZNOG will be held from 24-01-2038 to 29-01-2038 In 2039 NZNOG will be held from 23-01-2039 to 28-01-2039 In 2040 NZNOG will be held from 22-01-2040 to 27-01-2040 In 2041 NZNOG will be held from 20-01-2041 to 25-01-2041 In 2042 NZNOG will be held from 26-01-2042 to 31-01-2042 In 2043 NZNOG will be held from 25-01-2043 to 30-01-2043 In 2044 NZNOG will be held from 24-01-2044 to 29-01-2044 In 2045 NZNOG will be held from 22-01-2045 to 27-01-2045 In 2046 NZNOG will be held from 21-01-2046 to 26-01-2046 In 2047 NZNOG will be held from 20-01-2047 to 25-01-2047 In 2048 NZNOG will be held from 26-01-2048 to 31-01-2048 In 2049 NZNOG will be held from 24-01-2049 to 29-01-2049 In 2050 NZNOG will be held from 23-01-2050 to 28-01-2050 In 2051 NZNOG will be held from 22-01-2051 to 27-01-2051 In 2052 NZNOG will be held from 21-01-2052 to 26-01-2052 In 2053 NZNOG will be held from 26-01-2053 to 31-01-2053 In 2054 NZNOG will be held from 25-01-2054 to 30-01-2054 In 2055 NZNOG will be held from 24-01-2055 to 29-01-2055 In 2056 NZNOG will be held from 23-01-2056 to 28-01-2056 In 2057 NZNOG will be held from 21-01-2057 to 26-01-2057 In 2058 NZNOG will be held from 20-01-2058 to 25-01-2058 In 2059 NZNOG will be held from 26-01-2059 to 31-01-2059 In 2060 NZNOG will be held from 25-01-2060 to 30-01-2060 In 2061 NZNOG will be held from 23-01-2061 to 28-01-2061 In 2062 NZNOG will be held from 22-01-2062 to 27-01-2062 In 2063 NZNOG will be held from 21-01-2063 to 26-01-2063 In 2064 NZNOG will be held from 20-01-2064 to 25-01-2064 In 2065 NZNOG will be held from 25-01-2065 to 30-01-2065 In 2066 NZNOG will be held from 24-01-2066 to 29-01-2066 In 2067 NZNOG will be held from 23-01-2067 to 28-01-2067 In 2068 NZNOG will be held from 22-01-2068 to 27-01-2068 In 2069 NZNOG will be held from 20-01-2069 to 25-01-2069 In 2070 NZNOG will be held from 26-01-2070 to 31-01-2070 In 2071 NZNOG will be held from 25-01-2071 to 30-01-2071 In 2072 NZNOG will be held from 24-01-2072 to 29-01-2072 In 2073 NZNOG will be held from 22-01-2073 to 27-01-2073 In 2074 NZNOG will be held from 21-01-2074 to 26-01-2074 In 2075 NZNOG will be held from 20-01-2075 to 25-01-2075 In 2076 NZNOG will be held from 26-01-2076 to 31-01-2076 In 2077 NZNOG will be held from 24-01-2077 to 29-01-2077 In 2078 NZNOG will be held from 23-01-2078 to 28-01-2078 In 2079 NZNOG will be held from 22-01-2079 to 27-01-2079 In 2080 NZNOG will be held from 21-01-2080 to 26-01-2080 In 2081 NZNOG will be held from 26-01-2081 to 31-01-2081 In 2082 NZNOG will be held from 25-01-2082 to 30-01-2082 In 2083 NZNOG will be held from 24-01-2083 to 29-01-2083 In 2084 NZNOG will be held from 23-01-2084 to 28-01-2084 In 2085 NZNOG will be held from 21-01-2085 to 26-01-2085 In 2086 NZNOG will be held from 20-01-2086 to 25-01-2086 In 2087 NZNOG will be held from 26-01-2087 to 31-01-2087 In 2088 NZNOG will be held from 25-01-2088 to 30-01-2088 In 2089 NZNOG will be held from 23-01-2089 to 28-01-2089 In 2090 NZNOG will be held from 22-01-2090 to 27-01-2090 In 2091 NZNOG will be held from 21-01-2091 to 26-01-2091 In 2092 NZNOG will be held from 20-01-2092 to 25-01-2092 In 2093 NZNOG will be held from 25-01-2093 to 30-01-2093 In 2094 NZNOG will be held from 24-01-2094 to 29-01-2094 In 2095 NZNOG will be held from 23-01-2095 to 28-01-2095 In 2096 NZNOG will be held from 22-01-2096 to 27-01-2096 In 2097 NZNOG will be held from 20-01-2097 to 25-01-2097 In 2098 NZNOG will be held from 26-01-2098 to 31-01-2098 In 2099 NZNOG will be held from 25-01-2099 to 30-01-2099 In 2100 NZNOG will be held from 24-01-2100 to 29-01-2100 In 2101 NZNOG will be held from 23-01-2101 to 28-01-2101 In 2102 NZNOG will be held from 22-01-2102 to 27-01-2102 In 2103 NZNOG will be held from 21-01-2103 to 26-01-2103 In 2104 NZNOG will be held from 20-01-2104 to 25-01-2104 In 2105 NZNOG will be held from 25-01-2105 to 30-01-2105 In 2106 NZNOG will be held from 24-01-2106 to 29-01-2106 In 2107 NZNOG will be held from 23-01-2107 to 28-01-2107 In 2108 NZNOG will be held from 22-01-2108 to 27-01-2108 In 2109 NZNOG will be held from 20-01-2109 to 25-01-2109 In 2110 NZNOG will be held from 26-01-2110 to 31-01-2110 In 2111 NZNOG will be held from 25-01-2111 to 30-01-2111 In 2112 NZNOG will be held from 24-01-2112 to 29-01-2112 In 2113 NZNOG will be held from 22-01-2113 to 27-01-2113 In 2114 NZNOG will be held from 21-01-2114 to 26-01-2114 In 2115 NZNOG will be held from 20-01-2115 to 25-01-2115

9 8

Re: [nznog] OT: Ethernet
by Scott Weeks 03 Mar '14

03 Mar '14

--- richard.naylor(a)R2.co.nz wrote: From: Richard Naylor <richard.naylor(a)R2.co.nz> Been some celebrations recently over ethernet. Going from 10Mbps to 100Gbps over 40 years. ------------------------------------------ Late reply, but to inspire those who have (have had) managers that just don't understand what you're doing... :-) http://b2b.cbsimg.net/blogs/19740305-xerox-ethernet-memo1.jpg scott _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Andy Linton in the news as holder of a key to the internet
by Nigel Roberts 02 Mar '14

02 Mar '14

As spotted over here in the fairfax papers: http://www.theage.com.au/it-pro/security-it/meet-andy-linton-one-of-the-few… I think I’d get sick of the key holder (master?) jokes, too. Thanks for your good work Andy. Nigel

1 0

OT: Ethernet
by Richard Naylor 28 Feb '14

28 Feb '14

Been some celebrations recently over ethernet. Going from 10Mbps to 100Gbps over 40 years. http://www.eetimes.com/document.asp?doc_id=1263267&page_number=1 You might find it interesting reading. The call for participation in 400Gbps ethernet was made about a year ago. Interesting points (other than the historical stuff) + 10G NICs will surpass 1G in 2015. Interesting to see fall of 100Mbps. + Graph showing ATM fall off and rise of ethernet in Telco cores. Hilarious from my point of view. The first switch at CityLink was a dual ethernet/ATM one. We never had much of an ATM network because we couldn't afford the second switch ! A shareholder did loan us two, but they were multi-mode fiber and so wasn't much use. No customers wanted ATM due to the cost. None of the telcos took us seriously because we used ethernet. About 6 or 7 years later both Telecom and Clear developed ethernet products. Occasionally we showed people our pole mounted ethernet switches, running PoE, but no one really understood it. James Watts in PNN did and ran some of it. Cheaper fiber replaced it. We also had pole mounted Linux routers that we used for WiF point to point links. Another story.

1 0

IANA AS Numbers registry update
by Selina Harrington 28 Feb '14

28 Feb '14

The IANA AS Numbers registry has been updated to reflect the allocation of 2 blocks to the RIPE NCC in 2014-02-28: 200192-201215 201216-202239 You can find the IANA AS Numbers registry at: http://www.iana.org/assignments/as-numbers/as-numbers.xml Regards, Selina Harrington ******************************************* Internet Assigned Numbers Authority (IANA) Internet Corporation for Assigned Names & Numbers 12025 Waterfront Drive, Suite 300 Los Angeles, CA 90094 Phone: +1 310 301 5800 Fax: +1-310-823-8649 *******************************************

1 0

What's the BCP/RFC that says that routers within an ISP network should not have RFC1918 link IPs?
by Matt Grant 27 Feb '14

27 Feb '14

Hi! Know I am some small fry on the list, but your help would be appreciated. This would be useful in talking to my ISP about some PMTU issues that I am having re a VPN going over PPPoE, with MTU 1480. Thanks! Matt Grant

11 11

[OT] {Humour} NCSC.govt.nz traceroute
by Alexander Neilson 26 Feb '14

26 Feb '14

The trusted guardian of NZ Information Assets. So where do they host this important guardian of our assets, of course they would host it here in Wellington wouldn’t they, maybe a backup in Auckland Serenity:~ alexander$ traceroute ncsc.govt.nz traceroute to ncsc.govt.nz (199.83.134.194), 64 hops max, 52 byte packets 1 172.31.2.1 (172.31.2.1) 0.548 ms 0.215 ms 0.191 ms 2 192.168.1.1 (192.168.1.1) 0.324 ms 0.296 ms 0.275 ms 3 113.197.96.18 (113.197.96.18) 4.058 ms 3.873 ms 4.489 ms 4 103.9.216.18 (103.9.216.18) 10.866 ms 10.734 ms 27.593 ms 5 103.9.216.19 (103.9.216.19) 10.699 ms 10.737 ms 10.956 ms 6 203.167.218.185 (203.167.218.185) 13.539 ms 11.339 ms 10.953 ms 7 ge-0-2-0-914.xcore1.acld.telstraclear.net (203.98.42.17) 11.106 ms 11.315 ms 10.950 ms 8 unknown.telstraglobal.net (134.159.174.37) 14.115 ms unknown.telstraglobal.net (134.159.174.41) 13.334 ms unknown.telstraglobal.net (134.159.174.37) 14.271 ms 9 i-0-0-4-1.tlot-core01.bx.telstraglobal.net (202.84.142.106) 136.672 ms i-0-0-4-0.tlot-core01.bx.telstraglobal.net (202.84.142.118) 138.917 ms i-0-6-4-1.tlot-core01.bx.telstraglobal.net (202.84.142.114) 138.757 ms 10 i-0-4-0-0.eqla01.bi.telstraglobal.net (202.84.251.174) 136.206 ms i-0-4-0-7.eqla01.bi.telstraglobal.net (202.40.149.254) 137.496 ms i-0-4-0-0.eqla01.bi.telstraglobal.net (202.84.251.174) 137.301 ms 11 nlayer-peer.eqla01.pr.telstraglobal.net (134.159.61.42) 143.708 ms 136.787 ms 140.136 ms 12 ae0-110g.cr1.lax1.us.nlayer.net (69.31.127.137) 138.668 ms ae0-110g.cr1.lax1.us.nlayer.net (69.31.127.141) 137.965 ms ae0-110g.cr1.lax1.us.nlayer.net (69.31.127.137) 136.064 ms 13 xe-5-3-0.cr1.iah1.us.nlayer.net (69.22.142.121) 167.796 ms 167.996 ms 168.156 ms 14 xe-3-1-1.cr1.dfw1.us.nlayer.net (69.22.142.3) 171.539 ms 194.181 ms 193.122 ms 15 xe-0-2-1.cr1.ord1.us.nlayer.net (69.22.142.4) 190.842 ms 190.634 ms 190.443 ms 16 ae0-60g.cr2.ord1.us.nlayer.net (69.31.111.154) 191.285 ms 190.151 ms 189.922 ms 17 ae2-20g.ar1.ord6.us.nlayer.net (69.31.110.254) 192.570 ms 195.793 ms 195.315 ms 18 * * * 19 * * * 20 * * * 21 * * * mmmmm. that looks like a long trip to Wellington or Auckland Whois that IP: Serenity:~ alexander$ whois 199.83.134.194 # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html # # # Query terms are ambiguous. The query is assumed to be: # "n 199.83.134.194" # # Use "?" to get help. # # # The following results may also be obtained via: # http://whois.arin.net/rest/nets;q=199.83.134.194?showDetails=true&showARIN=… # NetRange: 199.83.128.0 - 199.83.135.255 CIDR: 199.83.128.0/21 OriginAS: AS19551 NetName: INCAPSULA NetHandle: NET-199-83-128-0-1 Parent: NET-199-0-0-0-0 NetType: Direct Assignment RegDate: 2011-01-14 Updated: 2012-02-24 Ref: http://whois.arin.net/rest/net/NET-199-83-128-0-1 OrgName: Incapsula Inc OrgId: INCAP-5 Address: 3500 SOUTH DUPONT HIGHWAY City: Dover StateProv: DE PostalCode: 19901 Country: US RegDate: 2010-09-15 Updated: 2014-02-25 Ref: http://whois.arin.net/rest/org/INCAP-5 OrgAbuseHandle: INCAP1-ARIN OrgAbuseName: Incapsula AbuseDesk OrgAbusePhone: +1-866-250-7659 OrgAbuseEmail: abuse(a)incapsula.com OrgAbuseRef: http://whois.arin.net/rest/poc/INCAP1-ARIN OrgTechHandle: INCAP2-ARIN OrgTechName: Incapsula Operations OrgTechPhone: +1-866-250-7659 OrgTechEmail: ip(a)incapsula.com OrgTechRef: http://whois.arin.net/rest/poc/INCAP2-ARIN OrgNOCHandle: INCAP2-ARIN OrgNOCName: Incapsula Operations OrgNOCPhone: +1-866-250-7659 OrgNOCEmail: ip(a)incapsula.com OrgNOCRef: http://whois.arin.net/rest/poc/INCAP2-ARIN # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html # Serenity:~ alexander$ hmmmm, Delaware, now thats a funny place for it. It doesn’t seem to be any CDN or anything, I wonder if they are just going best price for their hosting, or does this path lead through the 5 Eyes network? Maybe our network lords and masters will be telling us to embed our network systems in foreign countries as part of our new approvals. Regards Alexander Alexander Neilson Neilson Productions Limited alexander(a)neilson.net.nz 021 329 681 022 456 2326

5 10

Open NTP servers in New Zealand.
by Dean Pemberton 26 Feb '14

26 Feb '14

Hi All, One of the sessions this morning was from Geoff Huston on the recent NTP server DDoS attacks. The presentation is here https://conference.apnic.net/data/37/2014-02-25-ntpddos_1392941955.pdf In short if you appear on the http://openntpproject.org/ list then you should be looking to clean this up before you contribute to global DDoS attacks the size of which we have not seen in the past. I've run the WIX and APE peering ASNs against the page and here are the number of open NTP servers. You can do this yourself by substituting your AS (instead of 9483) into the following URL http://openntpproject.org/searchby-asn.cgi?search_asn=9483 If you want it as a csv then use http://openntpproject.org/searchby-asn.cgi?search_asn=9483&csv=1 Here is the WIX & APE list. Bear in mind that this only covers the NTP servers which are in the AS that peers on the exchange. Not the customers of that AS. You should use the page above to check all your customer ASNs as well and work with them to patch any servers. WIX Open NTP servers 4823 total 709 AS4770 618 AS2687 603 AS9503 368 AS23838 304 AS23655 272 AS17746 256 AS18119 205 AS24183 187 AS45280 187 AS24466 158 AS18400 122 AS10022 118 AS18015 117 AS55454 91 AS9872 73 AS132040 63 AS24324 58 AS38477 53 AS18353 51 AS45177 39 AS17412 27 AS17435 25 AS42 23 AS9433 19 AS17705 17 AS24347 12 AS23905 10 AS8674 8 AS9834 4 AS24074 4 AS24005 4 AS17649 4 AS17484 3 AS38329 3 AS132003 3 AS12076 2 AS24006 1 AS7696 1 AS18021 1 AS17792 APE Open NTP servers 11877 total 2472 AS4739 1773 AS9889 1236 AS9738 709 AS4770 618 AS2687 603 AS9503 460 AS4826 368 AS23838 304 AS23655 285 AS45459 272 AS17746 256 AS18119 229 AS38333 205 AS24183 187 AS45280 187 AS24466 185 AS24130 158 AS18400 125 AS9790 125 AS9245 122 AS10022 118 AS18015 97 AS56030 91 AS9872 73 AS132040 63 AS24324 58 AS38477 53 AS18353 51 AS45177 44 AS58666 39 AS17412 37 AS55561 27 AS17435 26 AS9303 25 AS42 23 AS9898 23 AS9433 19 AS55752 19 AS17705 17 AS9431 16 AS18199 10 AS24398 10 AS23710 8 AS9834 7 AS17492 6 AS55785 5 AS9559 5 AS55872 4 AS24074 4 AS24005 4 AS17649 3 AS45946 3 AS12076 2 AS9897 2 AS9896 2 AS37974 1 AS38451 1 AS132347 1 AS132304 1 AS10200

12 13

IPAM software
by Glen Eustace 25 Feb '14

25 Feb '14

A year or maybe two back, Andy presented a demo of some software that CityLink were using that if I recall did both the IPAM And inventory function. I think it was an open source system from a US university but I can't remember what it was called. If you can can you let me know. Thanks. Glen.

6 10

Work Practices of Cyber Security Professionals
by Muhammad Adnan 24 Feb '14

24 Feb '14

Dear Sir/Madam, I am a university researcher who is investigating the development of new, usable tools that will improve the work practices of cyber security professionals. As a first step to achieve this goal, I am undertaking a survey to gain an in-depth understanding of the day-to-day activities of cyber security professionals. The targeted participants for this survey are those who perform security related activities as a part of their job (e.g. security analysts, network administrators, systems administrators, etc.). I would be very grateful if you could spare some time and complete this short (approx. 10-15 minutes) survey for me. It can be accessed at the following link: http://edu.surveygizmo.com/s3/1536165/Work-Practices-of-Cyber-Security-Prof… If you have questions or concerns about this research, please contact me ( Muhammad.Adnan(a)gcu.ac.uk) or my Ph.D. supervisor Dr. Mike Just ( Mike.Just(a)gcu.ac.uk), both at the Interactive and Trustworthy Technologies research group (http://www.ittgroup.org/) Glasgow Caledonian University, UK. Kind regards, Adnan

1 0

NZNOG 2014 Videos
by Richard Naylor 19 Feb '14

19 Feb '14

http://www.r2.co.nz/20140130/ The videos from NZNOG 2014 should be available about now. The CDN/cache is filling at the moment. If a file plays poorly, it could still be loading, so be patient. HD files also require a decent CPU to play. All talks except the Lightning talks are in both SD and HD. There is about 28GB of video. The lightning talks are numbered sequentially. I can add names and topics if a kind person sends me those details. Thanks for waiting patiently, there was a lot to get through while we were doing other jobs. rich

2 1

Those RPKI stats
by Michael Fincham 18 Feb '14

18 Feb '14

Hi all, Firstly, thanks NZNOG folks for a great conference. In spite of getting sick and missing ~ 50% I'd still have to say I enjoyed myself :) It's been long enough now that we've probably all forgotten that I'd promised to pony up some more "interesting" RPKI stats at NZNOG, so just to keep you on your toes here they are. ---> First order of business: Did we really hijack the Internet? <--- Sadly no, we just broke BGPMON. It's a long story. ---> RPKI data for the IXes, "domestic transit" <--- I've published a fixed slide deck + some other potentially useful info on my personal website at: <http://hotplate.co.nz/archive/nznog/2014/rpki/> The website includes a link to a web based "relying party cache query tool" I've put together, for anyone interested in having a play with validating some "real world" route data. This tool is also available directly at <http://rpki-validator.lab.hotplate.co.nz/>. In short, the totals for the IXes look like this: APE: 64 invalid, 165 valid, 5474 unvalidated routes out of 3694 unique prefixes WIX: 48 invalid, 92 valid, 1875 unvalidated routes out of 1190 unique prefixes CHIX: 8 invalid, 48 valid, 769 unvalidated routes out of 728 unique prefixes A detailed breakdown of what's valid / invalid and "why" is available from the web page above, along with the raw data so these results can be replicated if desired. Does my data look dodgy or suspect? Is my methodology bogus? Probably! Please do let me know :) -- Michael Fincham

1 0

Interesting Adwords Advert..
by Craig Whitmore 18 Feb '14

18 Feb '14

I just noticed this today.. http://finch.am/scratch/dnc_discontent.png (This is what the advert looks like) It was an adwords advert I presume targeted towards NZers. Which links to.. http://dnc.org.nz/2ld-policy-amendments?gclid=CIzyxuPd1rwCFcEnpQodmFUAOQ Does anyone know who is paying for these adverts . As far as I know the new 2LD domain policy won¹t result in people loosing their .co.nz domain names. (Is this ³false² advertising?) Thanks Craig

2 3

LICA Boundaries
by Liam Farr 18 Feb '14

18 Feb '14

Hi, Does anyone out there know of or have an accurate definition of all the NZ LICA boundaries they could point me to or provide off list? Or otherwise be able to point me at the correct person to ask, Chorus / NAD / MBIE perhaps? I am trying to produce some sort of useful graphical tool, (e.g. google maps overlay) to assist a customer, where they can punch in an address and get the correct LICA displayed for that address. (I also have a stockpile of spare liquor if that helps :D). -- Kind Regards Liam Farr liamfarr(a)me.com +64-22-610-7884

3 2

Re: [nznog] LICA Boundaries
by Peter Lambrechtsen 18 Feb '14

18 Feb '14

Or the mapping folks from Chrous... I have some maps but don't think I will be allowed to share them :/ Sent from my phone on the smartphonetwork. -------- Original message -------- From: Peter Gent <Peter.Gent(a)mbie.govt.nz> Date: 19/02/2014 8:19 AM (GMT+12:00) To: NZNOG(a)list.waikato.ac.nz Subject: Re: [nznog] LICA Boundaries Hi, Have you tried contacting the people behind www.nad.ord.nz<http://www.nad.ord.nz> to start with? Regards Peter -----Original Message----- From: nznog-bounces(a)list.waikato.ac.nz [mailto:nznog-bounces(a)list.waikato.ac.nz] On Behalf Of Liam Farr Sent: Tuesday, 18 February 2014 11:32 p.m. To: Nznog List Subject: [nznog] LICA Boundaries Hi, Does anyone out there know of or have an accurate definition of all the NZ LICA boundaries they could point me to or provide off list? Or otherwise be able to point me at the correct person to ask, Chorus / NAD / MBIE perhaps? I am trying to produce some sort of useful graphical tool, (e.g. google maps overlay) to assist a customer, where they can punch in an address and get the correct LICA displayed for that address. (I also have a stockpile of spare liquor if that helps :D). -- Kind Regards Liam Farr liamfarr(a)me.com +64-22-610-7884 _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog http://newzealand.govt.nz/ - connecting you to New Zealand central & local government services Any opinions expressed in this message are not necessarily those of the Ministry of Business, Innovation and Employment. This message and any files transmitted with it are confidential and solely for the use of the intended recipient. If you are not the intended recipient or the person responsible for delivery to the intended recipient, be advised that you have received this message in error and that any use is strictly prohibited. Please contact the sender and delete the message and any attachment from your computer. _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Apologies
by Ray Taylor 17 Feb '14

17 Feb '14

I must apologise to the group. I have been a long time subscriber but don't post. Mailing list technology is a bit before my time so I was not exactly sure how I was to keep replies within the same thread / branch on the list archive. I was assuming if I forward to the list, it would place it in the correct thread much like a support ticketing system based on subject. Of course I was forwarding a few emails one after the other with responses and didn't see the particular email was sent to me off list. I shall go and find a how-to wiki on this mailing list stuff next time I need to post. With regards to my issue, I have our IP block / ASN advertised on our behalf by our upstream provider as we don't peer using BGP. The NOC at vocus replied to me and said somewhere along the chain there is an issue and they were most helpful in passing a message to whoever is responsible. As predicted by those who responded to my query, they were very fast in their response. Jonathan Brewer has quite rightly reminded me this is one of the woes of tier 7 bandwidth..something I should look at changing. Anyhow, thanks for the help Ray Taylor Taylor Communications ray(a)ruralkiwi.com Ph 021-483-280 Network status 06-929-9082 Description: header_logo

2 1

Re: [nznog] Vocus Contact
by Ray Taylor 17 Feb '14

17 Feb '14

I think it was more a BGP issue with our upstream's upstream. So hoping it isn't a vocus issue and something closer to us. Ray Taylor Taylor Communications <mailto:ray(a)ruralkiwi.com> ray(a)ruralkiwi.com Ph 021-483-280 Network status 06-929-9082 Description: header_logo From: Liam Farr [mailto:liamfarr(a)me.com] Sent: Tuesday, 18 February 2014 8:29 p.m. To: Ray Taylor Subject: Re: [nznog] Vocus Contact Craig Spiers is the most cluefull console wielding guy at Vocus, if there is a real problem with their BGP routing there's a good chance it will eventually make its way to him. He's also not a dick :) Craig Spiers <craig.spiers(a)vocus.co.nz> -- Kind Regards Liam Farr liamfarr(a)me.com +64-22-610-7884 On 18/02/2014, at 5:02 pm, Ray Taylor <ray(a)ruralkiwi.com> wrote: Have we someone here within Vocus? I have an issue with our ip range not being routed correctly through vocus' network. Thanks. Ray Taylor Taylor Communications <mailto:ray(a)ruralkiwi.com> ray(a)ruralkiwi.com Ph 021-483-280 Network status 06-929-9082 <image001.png> _______________________________________________ NZNOG mailing list <mailto:NZNOG(a)list.waikato.ac.nz> NZNOG(a)list.waikato.ac.nz <http://list.waikato.ac.nz/mailman/listinfo/nznog> http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Vocus Contact
by Ray Taylor 17 Feb '14

17 Feb '14

Have we someone here within Vocus? I have an issue with our ip range not being routed correctly through vocus' network. Thanks. Ray Taylor Taylor Communications ray(a)ruralkiwi.com Ph 021-483-280 Network status 06-929-9082 Description: header_logo

5 6

Change of Trustee and Thank you
by Jamie Baddeley 17 Feb '14

17 Feb '14

HI Folks, Little bit of housekeeping on behalf of the NZNOG Trustees for those of you who missed the conference in Nelson this year. Shame you missed it, it was a beauty. As mentioned at the end of the Conference, Richard Nelson from the WAND group at Waikato University is the latest victim/trustee to join the fray. Thanks to Richard for saying yes. Also, this means that a self described "grey-haired, cantankerous old bastard living in Canada" is now able to spend more time doing what ever it is that he does when he's not being grey and cantankerous. I am of course talking about Joe Abley. He's no longer a trustee. For those of us who've been around a bit, and believe me Joe has, you'll know that he's contributed a great deal to the NZ Internet (and more!) over the years, even if most of it was last century. Well maybe not that long ago. So, with that, thanks Joe, and thanks Richard. cheers jamie

1 0

NTP reflection used for world's largest DDoS
by Juha Saarinen 16 Feb '14

16 Feb '14

http://www.itnews.com.au/News/372033,worlds-largest-ddos-strikes-us-europe.… Amplification factor: 58.5. -- Juha Saarinen twitter: juhasaarinen

21 32

Cisco Memory Issues
by Alexander Neilson 14 Feb '14

14 Feb '14

I saw alerts about this on AUSNOG but hadn’t seen anything on NZNOG yet so I posting it to make sure people know. http://www.itnews.com.au/News/372345,cisco-stung-by-switch-memory-glitch.as… http://www.cisco.com/web/about/doing_business/memory.html Regards Alexander

1 0

APRICOT 2014 - Remote Participation Registration
by Elly Tawhai 12 Feb '14

12 Feb '14

Hi NZNOG Community, I hope you are all looking forward to APRICOT 2014 which will start next week. The Workshops are from Tuesday, 18 to Saturday, 22 February 2014 and the Conference is from Monday, 24 to Friday, 28 February 2014. If you are unable to attend in person, you can still join the conference remotely. Some of the conference sessions will be broadcasted live. Please refer to the program for more information. http://2014.apricot.net/program Please note: Registration is now *mandatory* to watch the live webcast and participate remotely. Registration is free and you can register now to receive your login details https://apnic.ungerboeck.com/prod/emc00/register.aspx?OrgCode=10&EvtID=5824… I hope to see you all in person or online at APRICOT 2014. Regards APNIC Secretariat

1 0

Re: [nznog] Validating resolvers for DNS and DNSSEC
by Pete Mundy 12 Feb '14

12 Feb '14

Straight after the conference, I enabled validation on a resolver that handles in excess of 2 million queries/day. So far I have no negative impact to report either :) I support Andy & Dean's comments. Just turn it on already! Pete Mundy Wearer of Many Hats On 11/02/2014, at 12:20 PM, Dean Pemberton <nznog(a)deanpemberton.com> wrote: > Dave Mill (Inspire) stood up at NZNOG and clearly said that for them > that never happened. > > Just turn it on. > > On Tue, Feb 11, 2014 at 11:51 AM, Nathan Ward <nznog(a)daork.net> wrote: >> [SNIP] >> I've been talking about this with one of my customers recently, and there's >> a concern by some that turning on validation will trip false positives - >> which for an ISP is a bad thing to do - all the customer sees is that you >> 'don't work' while the other ISP does. >> >> Is there public data available re. this? Does it likely vary much for NZ? >> [SNIP] >> Nathan Ward

3 2

Technical Advisor, Harmful Digital Communications Bill
by Susan Chalmers 12 Feb '14

12 Feb '14

Hello NZNOG, I am developing InternetNZ's submission to the Justice and Electoral Committee on the Harmful Digital Communications Bill. I'd like to ask this list for some feedback on one issue in the Bill, in particular. Clause 15 of the Bill reads: Technical advisers - (1)A District Court or the High Court, as the case may be, may appoint a technical adviser to assist it in considering and determining an application for an order under section 17 or any appeal under section 72 of the District Courts Act 1947. (2)The duties of a technical adviser are-- - (a)to sit with the court; and - (b)subject to subsection (3), to act in all respects as an extra member of the court. (3)The court must appoint a technical adviser if the court is considering an application for an order under section 17(2)(a) or (b) or (3)(a). (4)The Judge may give any weight to the technical adviser's advice that the Judge thinks fit, and the Judge alone must determine the application or appeal. (5)The Minister must maintain a panel of persons who may be appointed under this section as technical advisers, and only persons named on the panel may be appointed under this section as technical advisers. (6)The chief executive must pay technical advisers the remuneration and allowances determined from time to time by the Minister. - For reference, the remedies referred to in cl 15(3) are: takedown of content/disabling access thereto; identification of an anonymous author; and, somewhat strangely, making an order against parties not before the court. *What I am after in the first instance relates to the advice of the technical advisor. * *If the advisor were to issue a report of some sort to the judge, explaining the impact - economic, administrative, technical - of a takedown order on the intermediary, what do you think that advice should cover? * How can this advice, if it were published, serve as evidence for policymakers in the future, helping them avoid making remedies (takedown orders, etc) that are a burden to intermediaries or have a negative technical impact? FWIW, I think that 17(2)(c) and (d) orders - publishing corrections and providing rights of reply - should also be considered in technical advice. There are of course, many different flavours of intermediaries. The OECD has categorised intermediaries in the following way: 1. ISPs (carriers) 2. hosting providers 3. search engines 4. e-commerce intermediaries 5. Internet payment systems, and 6. participative web platforms http://www.keepeek.com/Digital-Asset-Management/oecd/science-and-technology… For the purposes of the Bill, we can consider intermediaries in two broad categories - content hosts and IPAPs (functionally - the IPAP language is not in the Bill, but I believe that IPAPs (meaning carriers in their IP-matching function) could be read into the current definition of "online content host" in the interpretation section). Thanks to those interested for your time and consideration, and please pose questions if you have them. I'd be grateful for your feedback by COB Friday. Sincerely, Susan -- --- Susan Chalmers Senior Policy Advisor susan(a)internetnz.net.nz

1 0

References/Recommendations for IP & VoIP in USA
by Christoph Berthoud 12 Feb '14

12 Feb '14

Morning all, We have an office in the US (Los Angeles) and I'm having issues with our current internet provider and are looking to change. Does anyone from NZNOG have any references/recommendations they could give me for a supplier in LA that can provide decent IP & SIP trunk services? Replies off-list much appreciated :) -- Thanks Christoph

1 0

Cisco Routers 3/4G connections.
by Laurence Bullivant 11 Feb '14

11 Feb '14

Afternoon, This is a reach out for anyone else using Cisco881g / Cisco887vag routers with 3G backup. We have just started getting the new routers into stock that use the new cellular modems. Our normal connection scripts don't work any more and we have been unable to find the required connection details for either vodafone or telecom connections. I am hoping in exchange for BEER, someone out there has worked it out. (We have a pending case with TAC but I hope this will be faster). Currently we are using: ----------------------------------------------------- *chat-script gsm "" "ATDT*99#" TIMEOUT 30 CONNECT!controller Cellular 0!interface Cellular0 ip address negotiated ip nat outside ip virtual-reassembly in ip virtual-reassembly out encapsulation slip dialer in-band dialer string gsm dialer-group 1 async mode interactive!interface Vlan1 ip address 10.0.0.1 255.255.255.0 ip nat inside ip virtual-reassembly!ip nat inside source list 1 interface Cellular0 overloadip route 0.0.0.0 0.0.0.0 Cellular0!access-list 1 permit anydialer-list 1 protocol ip permit!line 3 exec-timeout 0 0 script dialer gsm modem InOut no exec transport preferred none transport output none* ----------------------------------------------------- The issue is that the dial script always times out. Hopefully this is all recognizable to someone who has gone though the same pain as we are. Thanks in advance. -Laurence laurence(a)bullivant.co.nz

3 3

Call for NZ Provider
by Daniel Watson 10 Feb '14

10 Feb '14

Gday Noggers, I am currently seeking any NZ providers whom would meet the following requirements, Being able to rent dedicated servers at reasonable market pricing, Being able to provide us with a /24 IPv4 Being able to set up a Vyatta VM to act as our router via a direct BGP session to said provider If you can meet these requirements, I am eger to meet you :D Please respond off-list if you can meet this requirement Regards, Daniel Watson Network Administrator / Network Operations Manager E Daniel(a)GloVine.com.au W www.GloVine.com.au "No trees were harmed in the making of this email, however a large number of electrons were terribly inconvenienced."

1 0

Validating resolvers for DNS and DNSSEC
by Andy Linton 10 Feb '14

10 Feb '14

At the recent NZNOG meeting in Nelson, Geoff Huston from APNIC gave a talk on DNSSEC and had some interesting statistics about the use of validating resolvers for DNS and DNSSEC. For DNSSEC to work there are two parts of the equation that need to happen: 1) People need to sign their zones 2) People need to ask the question "is this zone signed" etc. I want to talk about 2) Geoff noted that a number of countries that we might not expect to be high on the list of those validating the responses using the DNSSEC technology were way ahead of the rest of the world. I haven't got the exact numbers here - I expect his presentation will appear shortly and there's likely to be a video of it at some stage at http://www.r2.co.nz/20140130/ - but from memory the global average is about 7% usage of validating resolvers. New Zealand is a dismal <2% and I'd like to challenge you all to do something about that. And we're way behind the Australians.... Geoff pointed out that the high rate elsewhere is due to a large degree to the number of people using Google's Public DNS servers and while that looks attractive and an easy way to improve those numbers I'd ask you not to go down that path. You need to do this yourself (or at least as close as possible to the end user). If you use someone else's resolver then your traffic can be intercepted en route to the validating resolver => man in the middle attack => game over. And of course, handing this data over to a centralised collection agent makes the work of anyone who wants to snoop on you much, much easier. It's not about Google's servers - this applies equally to public servers run by anyone. DNSSEC validation is not real validation unless it's performed end to end or at least as close as possible to that. A number of NZ ISPs provide this service to their customers with their in house resolvers and those of you who don't should really be looking at when you will do this. Those people who have signed their zones are making assertions about how they want their DNS data to be interpreted. They're saying that unless you validate their DNS data they really don't want you to connect to them. You should be taking notice of this. But then maybe you just ignore broken certs on websites etc. So what should you do? End user ======= Check here - http://dnssec.vs.uni-due.de/ Or use - https://www.dnssec-validator.cz/ Ask your ISP/admins to fix this. ISPs/Enterprise ============ If you're running a resolver for customers do the work to get it validating, please.... Plenty of info out there on how to do this for Bind and Unbound and I'm no Windows expert but this looks straightforward: Windows: http://info.menandmice.com/blog/bid/88297/Windows-2012-Server-Enabling-DNSS…

11 17

NZNOG 2014 Videos
by Richard Naylor 10 Feb '14

10 Feb '14

Before I get spammed to death about the videos.... We got back to base on Wednesday night, late. We got the tapes on friday and have been processing over the week end. Its pretty well all edited. One node ran out of disk last night and so is repeating today. Uploading is a slow process as the addition of HD footage added at least 200% more data. Thats why I asked if HD was of interest. (Its distribution grade HD rather than the higher bit-rate contribution HD) As we do the upload, we're also doing an idiot check on files, web pages etc, so there may be some reruns. But I expect that we should have it all available by the end of this week. We have another job starting tomorrow, which also consumes our evenings, so theres a bit of a time squeeze going on. I'll update the list when the files are available. rich

1 0

Re: [nznog] Validating resolvers for DNS and DNSSEC
by Richard Naylor 10 Feb '14

10 Feb '14

At 11:35 a.m. 11/02/2014, Andy Linton wrote: >At the recent NZNOG meeting in Nelson, Geoff Huston from APNIC gave >a talk on DNSSEC and had some interesting statistics about the use >of validating resolvers for DNS and DNSSEC. <snip> >and there's likely to be a video of it at some stage at ><http://www.r2.co.nz/20140130/>http://www.r2.co.nz/20140130/ - but >from memory the global average is about 7% usage of validating resolvers. The video is available at http://www.r2.co.nz/20140130/geoff-h.htm The others are rendering and uploading. The recording is large and currently filling the CDN cache, so if it doesn't play well - wait - its a large file. As an option there is an HD version. Its a large file also (>1GB) so takes even longer to load and requires a decent CPU to play back. Dual-core or better. Feedback on the value of HD footage would be interesting. Its slowing down the render and upload process, so if its not of much value, we can speed things up. The other videos should be available in a day or so. Richard

1 0

Reviews of Conference bridges that work well over multiple varied speeds
by Alexander Neilson 10 Feb '14

10 Feb '14

Little bit off topic so Beer However we have been asked to deliver a Video Teleconference Bridge in our system for customers whose speeds and connectivity vary (ADSL1, ADSL2, VDSL, Radio, Fibre, UFB) and so I am looking for anyones experiences with conference bridge hardware that can take connections from customers who may be using any of these connections into our network and that is smart enough to remux the video / audio streams out to cater to the connection speeds available. If anyone has any history with such a device I would love to hear about it off list. Preferring devices that will have a master bridge inside our core with good monitoring and management and easy to use remote units that are also reliable (remote customers make for hard trips to work on) however any relevant information would be appreciated. (I am arguing for on topic ish due to the handling of different grade customer connections across the network) Regards Alexander Alexander Neilson Neilson Productions Limited alexander(a)neilson.net.nz 021 329 681 022 456 2326

3 2

IPv6 address allocation questions
by Qinwen Hu 06 Feb '14

06 Feb '14

Hi All, My name is Qinwen(Steven) Hu from the University of Auckland. I am working on my PhD thesis in which I am trying to observe potential new security issues in IPv6 networks. I have two questions I would like to ask network operators: 1) Recently, we did a survey to investigate how network administrators are actually allocating IPv6 Interface IDs around the world. Our results show that 82% of domains use sequential small integer values in the interface ID field for their IPv6 addresses. - What IPv6 address allocation mechanisms do you (or will you) use in your IPv6 network/services? could you please give us your reasons for using these mechanisms? 2) What new security issues, i.e. issues that don't exist in IPv4, do you think are likely to arise? Any replies would be very helpful, please send them to me off-list.Many thanks for your kind consideration. Have a nice day. Regards, Steven 胡勤文／Qinwen Hu Ph.D. Candidate, Computer Science, University of Auckland 奥克兰大学计算机科学博士研究生

1 0

FW: Trusted Community Representation for Root KSK
by Leo Vegoda 06 Feb '14

06 Feb '14

Hi, People on this list might also want to submit responses. Regards, Leo From: dns-operations-bounces(a)mail.dns-oarc.net [mailto:dns-operations-bounces(a)mail.dns-oarc.net] On Behalf Of Kim Davies Sent: Thursday, February 06, 2014 12:38 PM To: DNS Operations Subject: [dns-operations] Trusted Community Representation for Root KSK Hi folks, ICANN is currently performing a consultation on how to evolve the participation of Trusted Community Representatives in the management of the root key signing key. I think this consultation is of particular interest to this group as ultimately these TCRs are there to instill trust in the DNS operations community that the KSK is being managed in a proper fashion. I'd encourage you to provide feedback to this consultation - available at http://www.icann.org/en/news/public-comment/tcr-dnssec-key-signing-21jan 14-en.htm - by 11th February. It is important we have a model of TCR participation that is satisfactory to the community. For convenience, here are the terms of reference replicated: Background Since July 2010, the DNS Root Zone has been secured using DNSSEC[1]. The model of using DNSSEC in the DNS Root Zone revolves around a "key signing key" (KSK) that is managed by ICANN in two secure facilities. Four times a year, a ceremony is conducted at these facilities to perform operations involving the KSK. As a key part of this process, a minimum of three from a pool of 21 trusted community representatives (TCRs) attend each ceremony to enable access to the secure materials, to witness the procedure, and to attest that the ceremony was conducted properly[2]. Each ceremony is attended by ICANN staff, the TCRs, representatives of the Root Zone Maintainer (Verisign), representatives of an independent audit firm retained by ICANN to monitor the process, and often additional external witnesses. Ceremonies are recorded by three audit cameras and webcast online. A typical ceremony lasts approximately four hours, and involves a process of temporarily removing the key signing key from a safe and performing key-signing operations in a secure manner following a formal script. The script is designed to perform each operation in a transparent manner to ensure the key signing key is only used for its proper purpose, and there is no ability for its contents to be disclosed for other purposes. Materials from each ceremony - such as the scripts, video recordings, and system output - are posted online[3]. De-briefings and discussions are conducted post-ceremony, where participants discuss how to improve future ceremonies. This feedback helps inform the evolution of the KSK ceremony to be both efficient and effective, while ensuring maximum trust in how ceremonies are performed. The TCRs were selected[4] from the global community based on a number of criteria[5]. These selection criteria relate to the volunteers ability to travel to ceremonies, conscientiously oversee the process, ensure transparency in its operation, and ultimately contribute to the broader community's trust that the private component of the key signing key has not been compromised. The TCRs are privately funded volunteers who are not reimbursed or compensated by ICANN for their participation nor their expenses. The original TCR proposal was silent on the length of service of individual TCRs. Of the 21 TCRs, seven are credentialed as "crypto officers" (COs) for each of the two facilities, and the remaining seven act as "recovery key shareholders" who only participate in ceremonies in the event the requisite number of COs are unable to participate or there is a need to rebuild the KSK following an unforeseen event. Of the seven COs for each facility, ICANN aims to have four attend each ceremony, with an absolute minimum of three required to successfully perform a ceremony. Each facility hosts two ceremonies per year, approximately once every six months. In practice, a TCR will attend at minimum one ceremony per year, and some will attend two in order to ensure sufficient attendance. Of the initial pool of 21 TCRs, one has resigned and been replaced from the pool of recovery key shareholders. No TCR has been removed owing to the other three criteria for replacement in the TCR selection document, relating to lack of integrity or trustworthiness; assumption of a conflicting role within a root management organization; or being unable to serve in their position. Based on feedback from the current TCRs and our experience from the first 14 ceremonies, we are reviewing what changes, if any, should be made to the current model of TCR participation. Comments Comments are welcome on any aspect of the consultation, and specifically on the following questions: 1. Is the current TCR model effectively performing its function of ensuring trust in the KSK management process? 2. Is the current size of the TCR pool appropriate to ensure sufficient participation in the ceremonies, while not overburdening the availability of specific volunteers? 3. Should there be a minimum level of participation required of a TCR in order to be considered to be successfully discharging their duties? 4. There is no standard provision to refresh the list of TCRs except when they are replaced due to inability to effectively perform their function. Should there be a process to renew the pool of TCRs, such as using term limits or another rotation mechanism? 5. The current model does not compensate TCRs for their services in order to ensure their independence from ICANN. a. Should the model of TCRs paying the costs of their participation be retained? b. Would some form of compensation to offset the expenses incurred by the TCRs detract from their independence in performing the role? c. If you support compensating TCRs for their expenses, are there requirements or limitations on whom the funding organization should be? Please send your comments to comments-tcr-dnssec-key-signing-21jan14(a)icann.org <mailto:comments-tcr-dnssec-key-signing-21jan14(a)icann.org> References [1] http://www.root-dnssec.org [2] https://www.iana.org/dnssec/icann-dps.txt [3] http://data.iana.org/ksk-ceremony/ [4] http://www.root-dnssec.org/tcr/selection-2010/ [5] http://www.root-dnssec.org/wp-content/uploads/2010/04/ICANN-TCR-Proposal -20100408.pdf kim

1 0

Re: [nznog] NZNOG Digest, Vol 134, Issue 2
by Jonathan Spence 04 Feb '14

04 Feb '14

Hi Trent, You may want to try geekzone.co.nz as there are a few good Telecom contacts on there. Thanks, Jonathan ---------------------------------------- From: nznog-request(a)list.waikato.ac.nz Sent: Wednesday, February 5, 2014 12:01 PM To: nznog(a)list.waikato.ac.nz Subject: NZNOG Digest, Vol 134, Issue 2 Send NZNOG mailing list submissions to nznog(a)list.waikato.ac.nz To subscribe or unsubscribe via the World Wide Web, visit http://list.waikato.ac.nz/mailman/listinfo/nznog or, via email, send a message with subject or body 'help' to nznog-request(a)list.waikato.ac.nz You can reach the person managing the list at nznog-owner(a)list.waikato.ac.nz When replying, please edit your Subject line so it is more specific than "Re: Contents of NZNOG digest..." Today's Topics: 1. Telecom NZ Contact (Trent Farrell) ---------------------------------------------------------------------- Message: 1 Date: Tue, 4 Feb 2014 12:19:25 +0000 From: Trent Farrell <tfarrell(a)riotgames.com> To: "nznog(a)list.waikato.ac.nz" <nznog(a)list.waikato.ac.nz> Subject: [nznog] Telecom NZ Contact Message-ID: <80289F43-A47C-4290-ABFC-5728C91EB5BA(a)riotgames.com> Content-Type: text/plain; charset="us-ascii" Hi all, Looking for someone from Telecom NZ to reach out off list, your customers are having issues with parts of our service. Cheers. - Trent ------------------------------ _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog End of NZNOG Digest, Vol 134, Issue 2 *************************************

1 0

Telecom NZ Contact
by Trent Farrell 03 Feb '14

03 Feb '14

Hi all, Looking for someone from Telecom NZ to reach out off list, your customers are having issues with parts of our service. Cheers. - Trent

1 0

Fwd: BCP 38
by Andy Linton 31 Jan '14

31 Jan '14

At NZNOG, Jamie Baddeley mention the spoofer tool at http://spoofer.cmand.org/ I ran it on the net I run at VUW and here are the traces from a couple of runs. I ran it once, realised I was being slack and turned on the 'rfp-check' feature on the edge Juniper and then ran the test again. A nice tool to demonstrate why we should do BCP 38.

1 0

Re: [nznog] Do you stream video?
by Richard Naylor 29 Jan '14

29 Jan '14

At 05:15 p.m. 15/01/2014, Dean Pemberton wrote: >Due to unforeseen circumstances our usual video streaming company of >choice (R2) is unable to stream NZNOG live this year. We're in AKL on another job. The plan is to send a camera operator to Nelson with a small portable encoder. The encoder planned is still in USA and won't be back in time. It died just after New Years day. I think we can free up one from the AKL job on wednesday, but need it back on the Saturday or Sunday after NZNOG, and are not confident couriers can do it. We also have very limited transport and time in AKL as we are parked up on a job. But if anyone can collect the unit from us on the Wednesday and take it to Nelson, then bring it back to AKL on the Saturday (we may have wheels on Saturday) that would solve the issue. I can probably meet someone at the airport and provide a ride home on the Saturday. The encoder is in a small plastic case about 200mmx150x100. Richard 021 897 089

9 10

Lightning talks
by Richard Nelson 29 Jan '14

29 Jan '14

If anyone has a lightning talk and can’t find me at the conference. Just email me off list. Richard.

1 0

One Day down.... Four to go
by Dean Pemberton 26 Jan '14

26 Jan '14

Hello from NZNOG 2014 in sunny Nelson! The venue is awesome and we're off to a great start. The BGP Routing and Network Security workshops are underway and the participants have been giving outstanding feedback. We've got less than 10 more registration slots left for the main conference before we're all sold out. If you're leaving it until the last minute... I'd suggest that you don't . See you all here. Dean

1 0

Re: [nznog] NZNOG Digest, Vol 133, Issue 14
by Jonathan Spence 26 Jan '14

26 Jan '14

They have been doing this for ages (maybe 6 months at least). We had to disable IPv6 on our mail server as we were struggling to get rDNS delegation from Orcon. Got too busy to follow up on it but will do so when I get a minute. Jonathan Spence Chief Executive Officer Fixed: +64 9 9510448 Mobile: +64211055634 ---------------------------------------- From: nznog-request(a)list.waikato.ac.nz Sent: Sunday, January 26, 2014 12:01 PM To: nznog(a)list.waikato.ac.nz Subject: NZNOG Digest, Vol 133, Issue 14 Send NZNOG mailing list submissions to nznog(a)list.waikato.ac.nz To subscribe or unsubscribe via the World Wide Web, visit http://list.waikato.ac.nz/mailman/listinfo/nznog or, via email, send a message with subject or body 'help' to nznog-request(a)list.waikato.ac.nz You can reach the person managing the list at nznog-owner(a)list.waikato.ac.nz When replying, please edit your Subject line so it is more specific than "Re: Contents of NZNOG digest..." Today's Topics: 1. heads up.. gmail now checking ipv6 rdns (Blair Harrison) 2. Re: heads up.. gmail now checking ipv6 rdns (Scott Howard) 3. Re: heads up.. gmail now checking ipv6 rdns (Michael Fincham) 4. Re: heads up.. gmail now checking ipv6 rdns (Phil Regnauld) ---------------------------------------------------------------------- Message: 1 Date: Sat, 25 Jan 2014 13:43:28 +1300 From: Blair Harrison <nznog(a)jedi.school.nz> To: NZNOG <nznog(a)list.waikato.ac.nz> Subject: [nznog] heads up.. gmail now checking ipv6 rdns Message-ID: <CAHn0gTveE=Nh-jp9Lfdw67UDAy=4Y-rgi-4h7t8zr1R_4p73zg(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" Hi Folks, Just got caught out with this on my personal box today. It looks as if Gmail is now checking RDNS on any inbound ipv6 smtp connections and rejecting with 500 error if it doesn't match. example fail - SMTP error from remote mail server after end of data: host gmail-smtp-in.l.google.com [2a00:1450:4008:c01::1a]: 550-5.7.1 [2402:6000:1000:x::x] Our system has detected that this message does 550-5.7.1 not meet IPv6 sending guidelines regarding PTR records and 550-5.7.1 authentication. Please review 550-5.7.1 https://support.google.com/mail/?p=ipv6_authentication_errorfor more 550 5.7.1 information. oq6si4802967bkb.182 - gsmtp So if you have ipv6 enabled on your mail servers and haven't yet set some RDNS for them.. now is the time. Cheers, Blair

1 0

heads up.. gmail now checking ipv6 rdns
by Blair Harrison 25 Jan '14

25 Jan '14

Hi Folks, Just got caught out with this on my personal box today. It looks as if Gmail is now checking RDNS on any inbound ipv6 smtp connections and rejecting with 500 error if it doesn't match. example fail - SMTP error from remote mail server after end of data: host gmail-smtp-in.l.google.com [2a00:1450:4008:c01::1a]: 550-5.7.1 [2402:6000:1000:x::x] Our system has detected that this message does 550-5.7.1 not meet IPv6 sending guidelines regarding PTR records and 550-5.7.1 authentication. Please review 550-5.7.1 https://support.google.com/mail/?p=ipv6_authentication_errorfor more 550 5.7.1 information. oq6si4802967bkb.182 - gsmtp So if you have ipv6 enabled on your mail servers and haven't yet set some RDNS for them.. now is the time. Cheers, Blair

4 3

Fibre circulators?
by Sam Russell 23 Jan '14

23 Jan '14

Hi guys, Does anyone recommend a supplier for fibre circulators, preferably with LC connectors? I'd be keen to hear anyone's experiences/horror stories with them if you're willing to volunteer them. Cheers Sam

6 7