- NZNOG - lists.nznog.org

Fibre circulators?
by Sam Russell 23 Jan '14

23 Jan '14

Hi guys, Does anyone recommend a supplier for fibre circulators, preferably with LC connectors? I'd be keen to hear anyone's experiences/horror stories with them if you're willing to volunteer them. Cheers Sam

6 7

Great Firewall of China misconfig; traffic re-routed
by Juha Saarinen 22 Jan '14

22 Jan '14

Somewhat operational, with amusement potential and besides, it’s too early for beer (surely???): http://www.itnews.com.au/News/370324,great-firewall-mishap-reroutes-chinese… Has anyone seen a more detailed explanation as to what happened? — Juha

1 0

Acceptable levels of packet loss
by Matthew Poole 21 Jan '14

21 Jan '14

Been running SmokePing for a little while now, building up a statistical sample, and wondering what's an acceptable level of loss to be seeing through the provider's core, both to targets foreign and domestic and also from the premises to the first hop in the provider's network. Obviously I'm seeing a non-zero level (averages are in the zero-point-something range, but some of the maximums are above 0), so want to know what people consider to be the point where I go from "unreasonable customer" to "customer with a justified concern"? -- Matthew Poole "The difference between theory and practice is that practice is easier in theory than theory is in practice"

8 10

IPv4 Brokering and Availability Announcements
by Skeeve Stevens 19 Jan '14

19 Jan '14

Hi all, I will keep this brief. After many comments to us where people have had to deal with US companies to acquire IPv4, eintellego Networks has decided formalise a service offering IP Brokering. After facilitating and consulting for over a dozen transactions in different countries (including NZ) under the APNIC region - including NZ, we thought it would be good to have a service available locally by someone you know. For more information: http://eintellegonetworks.com/site/ipbrokering/ So, rather than trolling lists when ranges become available or we have a client looking to sell a block, I've setup an announcement list so that I can let interested parties know when a range is available. If you wish to join this list and receive these announcements, please visit: http://eintellegonetworks.com/site/v4announce/ to sign-up. FYI, eintellego Networks has just launched in NZ as a locally registered foreign company to mainly do other business including hardware/consulting and network operations. Also, eintellego Networks is the only APNIC registered<http://www.apnic.net/services/become-a-member/manage-your-membership/transf…>IPv4 broker that is based in the APNIC region (all the other are presently American). Any questions, feel free to let me know off-list. ...Skeeve *Skeeve Stevens - *eintellego Networks Pty Ltd skeeve(a)eintellegonetworks.co.nz ; www.eintellegonetworks.co.nz Phone: +612 8014 7398; Cell +61 (0)414 753 383 ; skype://skeeve facebook.com/eintellegonetworks ; <http://twitter.com/networkceoau> linkedin.com/in/skeeve twitter.com/theispguy ; blog: www.theispguy.com The Experts Who The Experts Call Juniper - Cisco - Cloud - Consulting - IPv4 Brokering

2 3

Do you stream video?
by Dean Pemberton 14 Jan '14

14 Jan '14

Hi Everyone, Due to unforeseen circumstances our usual video streaming company of choice (R2) is unable to stream NZNOG live this year. They are able to record the session and have it available for streaming later on, It's just the live streaming they can't provide. Is there anyone in the community who does this sort of thing and wants to step forward and have a go? Just email krystal(a)internetnz.net.nz and let her know. The provisio is that it has to be drama free and this isn't an opportunity to 'try things out'. If you haven't done this sort of thing/scale before, then you might be best to give it a miss. If no one comes forward, then record-for-later-streaming it is.

1 0

NZNOG 2014 Social Events
by Dean Pemberton 13 Jan '14

13 Jan '14

Hi Everyone. Another conference update. THURSDAY NIGHT CONFERENCE DINNER Conference Dinner on the Thursday night will be a buffet style dinner has been organised for the Thursday night dinner, 6:30pm at the Mercure Monaco Marquette. Buses will leave from The Rutherford hotel at 6pm and return on the hour from 9 to 11pm. There is even a pub across the road called The Honest Lawyer for those who feel the need to move on. http://www.monacoresort.co.nz/ WEDNESDAY NIGHT I've also been asked what the plan is for the Wednesday evening. As it happens, nothing. In the mists of time, Wednesday night was always informally organised. Often involving food from the sub-continent. Everyone split the bill and basically it was Thursday Night Curry on a Wednesday night! Like Christmas in July! In more recent years, a specific spondsor kindly funded drinks and nibbles on the Wednesday at many a well respected establishment. With this in mind we placed the position of "Networking Drinks" on the sponsorship document in case someone wanted to take up the opportunity. So far this year none of our sponsors have indicated that they would like to take up this offer, so we will return to the default informal arrangement of the past. That being said there are options. If you are a potential sponsor who would like to fund an event on the Wednesday night, our events person Krystal (krystal(a)internetnz.net.nz) would be more than happy to talk through the opportunities with you. I'm also told there are some nice Indian places in Nelson http://www.menus.co.nz/restaurants/indian/nelson/ Failing that there are places that sell beer. http://maps.google.com/maps/ms?ie=UTF8&hl=en&msa=0&msid=1017353080318029218… Basically at the moment it will be up to people to arrange their own food/fun on Wednesday, but being the well adjusted social people I know you all are, I'm sure this won't be a problem. If we do get a benevolent sponsor come forward to save the Wednes-Day we'll be sure to let you know ASAP. Regards, Dean

1 0

Full Programme for NZNOG 2014
by Dean Pemberton 12 Jan '14

12 Jan '14

Hi Everyone, We've just shuffled together all the great talks we've got planned for the conference. The programme as it currently stands is here: http://www.nznog.org/home/nznog-2014-conference-programme You can download an ICS from the link of the bottom of that page. Don't forget to register. The SDN/OpenFlow Tutorial is now full (Although there is a waitlist, email krystal(a)internetnz.net.nz) but there are plenty of other cool things to attend. Don't forget to register! See you all there. Dean

1 0

Plea for help - Ethernet cables.
by Dean Pemberton 10 Jan '14

10 Jan '14

So it turns out that the SDN OpenFlow tutorial has turned into a bit if a thing. While it was going to use mainly VMs and simulators, Citylink has supplied 20 mikrotik routerboards for the class to actually configure into an openflow controlled data plane. On ya guys, much appreciated, great NZNOG and SDN supporters as always. What I'm after now however is the around 60 Ethernet cables to hook it all together. If anyone could help me out so that I don't need to buy them that would be awesome. Yes you get then back afterwards. Thanks heaps. It should be an awesome tut. Dean

1 0

Situations Vacant: Senior Network Engineer
by Mark Foster 09 Jan '14

09 Jan '14

Greetings, ICONZ-Webvisions currently have a vacancy for a Senior Network Engineer, to be based at the iWV offices in Auckland. We're looking for an experienced Cisco engineer with experience working on ASR, 2800/2900/3700/6500/7200 series devices, with exposure to the ISP world preferred. Other acronyms you'd be familiar with at a senior level would include MPLS, VRF, BGP, OSPF, QoS, VoIP. CCNP or equivalent experience is the listed minimum qualification. If you are interested, or know anyone who might be, please have them drop me a note ASAP - we're already interviewing likely candidates and will need to make an offer fairly soon. Off-list questions, or expressions of interest, are welcomed in the meantime. Thanks, Mark.

1 0

Want a free NZNOG 2014 conference ticket?
by Dean Pemberton 06 Jan '14

06 Jan '14

Krystal is looking for one or 2 more volunteers to help with registration and pack up. Duties will be - manning the registration desk on Thursday Morning (8am - 9.30am) and helping pack up gear to be shipped back in INZ on Friday after conference ends (4.00 - 6.00). If you put your hand up then we're happy to comp you a ticket, they may miss a couple of talks - but you should still manage to attend the bulk of the conference. If you're interested then please email krystal(a)internetnz.net.nz and let her know. If there is a huge influx of interest then some advanced algorithm will be used to determine those accepted. =)

2 1

Call for Presentations - DNS-OARC Spring Workshop, May 2014
by Sebastian Castro 05 Jan '14

05 Jan '14

Call for Presentations - DNS-OARC Spring Workshop, May 2014 Next OARC Spring Workshop will take place in Warsaw, Poland on May 10th and 11th, the weekend before RIPE68. OARC is requesting proposals for presentations, with a preference for DNS privacy and confidentiality work and ideas, and DNS over alternative (non UDP) transports. This workshop continues OARC's tradition of having meetings include a strong operational component. Presentations from DNS operators are particularly welcome. We'll also gladly accept talks from DNS researchers, as well as any other DNS-related subjects such as tools, visualizations and data analysis. If you are an OARC member, and have a sensitive topic you would like to present for members-only, we will accommodate those talks too. Adopting practice from other conferences, a section of lightning talks will be added for short presentations. Workshop Milestones * 20 December 2013, Call for Presentations posted * 6 January 2014, Open for submissions * 1 March 2014, Deadline for submission * 28 March 2014, Final Program published * May 9 2014, Final deadline for slideset submission Details for abstract submission are be published here: https://indico.dns-oarc.net/event/workshop-2014-05 If you consider submitting a presentation, please let the Programme Committee know in advance to help us organize the presentations tracks. You can contact the Programme Committee: https://www.dns-oarc.net/oarc/programme via submissions(a)dns-oarc.net if you have questions or concerns. Sebastian Castro, for the OARC Programme Committee (Please note that OARC is run on a non-profit basis, and is not in a position to reimburse expenses or time for speakers at its meetings.)

1 0

CARDIGAN implements RPKI - Cleanliness of prefixes onWIX
by Dean Pemberton 05 Jan '14

05 Jan '14

Hi All, CARDIGAN has just finished implementing RPKI Origin Validation on its WIX peering connection. What this effectively does is finds out if ASs are permitted to announce the IP addresses that they are advertising to the exchange. CARDIGAN then makes a decision on wether to allow invalid announcements to be turned into OpenFlow rules. So I thought you'd all be interested in the state of the prefixes on the exchange. The following table has removed all the routes for which no RPKI information was found. This leaves two conditions: Lines which start with a "V" have a valid RPKI ROA. That means that the AS originating the prefix has been explicitly authorised by the IP resource owner to do so. Likes which start with an "I" have an RPKI ROA which is different to the route seen. This means that the AS originating the prefix has been explicitly disallowed from doing so by the IP resource owner. These are explicit authorisations as the IP Resource owner has had to go to an RPKI trust anchor (normally the RIRs) and request certification of the ASs allowed to originate the prefix (or subnet of the prefix). For most of us (who are APNIC members) this is as simple as logging into the MyAPNIC portal and creating an ROA. APNIC handles everything else for you. Anything that turns up as an "I" on this list, I'm going to be looking at pretty carefully before I prefer into the CARDIGAN network. Anyone with more questions about RPKI, how it works, what it means, how to get it going. Feel free to post/email me. Network Next Hop Metric LocPrf Weight Path V* 58.28.0.0/16 202.7.1.22 30 0 9439 17435 i V*> 202.7.1.22 30 0 9439 17435 i V* 103.10.233.0/24 202.7.0.190 30 0 9439 132003 i V*> 202.7.0.190 30 0 9439 132003 i V* 103.23.16.0/22 202.7.0.222 30 0 9439 132040 i V*> 202.7.0.221 30 0 9439 132040 i I* 103.23.16.0/24 202.7.0.222 10 0 9439 132040 i I*> 202.7.0.221 10 0 9439 132040 i I* 103.23.17.0/24 202.7.0.222 10 0 9439 132040 i I*> 202.7.0.221 10 0 9439 132040 i I* 103.23.18.0/23 202.7.0.222 10 0 9439 132040 i I*> 202.7.0.221 10 0 9439 132040 i V* 113.197.96.0/22 202.7.0.211 30 0 9439 45831 45831 i V*> 202.7.0.211 30 0 9439 45831 45831 i I* 113.197.96.0/28 202.7.0.211 10 0 9439 45831 i I*> 202.7.0.211 10 0 9439 45831 i I* 113.197.96.32/27 202.7.0.211 10 0 9439 45831 i I*> 202.7.0.211 10 0 9439 45831 i I* 113.197.96.96/28 202.7.0.211 10 0 9439 45831 i I*> 202.7.0.211 10 0 9439 45831 i I* 113.197.96.112/28 202.7.0.211 10 0 9439 45831 i I*> 202.7.0.211 10 0 9439 45831 i I* 113.197.96.168/29 202.7.0.211 10 0 9439 45831 i I*> 202.7.0.211 10 0 9439 45831 i I* 113.197.98.32/29 202.7.0.211 10 0 9439 45831 i I*> 202.7.0.211 10 0 9439 45831 i I* 113.197.98.64/27 202.7.0.211 10 0 9439 45831 i I*> 202.7.0.211 10 0 9439 45831 i I* 116.90.130.16/29 202.7.0.176 10 0 9439 38477 i I*> 202.7.0.176 10 0 9439 38477 i I* 116.90.130.96/29 202.7.0.176 10 0 9439 38477 i I*> 202.7.0.176 10 0 9439 38477 i I* 116.90.135.0/24 202.7.0.176 10 0 9439 38477 45641 i I*> 202.7.0.176 10 0 9439 38477 45641 i V* 116.90.139.0/24 202.7.0.176 30 0 9439 38477 i V*> 202.7.0.176 30 0 9439 38477 i I* 116.90.139.0/29 202.7.0.176 10 0 9439 38477 i I*> 202.7.0.176 10 0 9439 38477 i I* 116.90.139.8/29 202.7.0.176 10 0 9439 38477 i I*> 202.7.0.176 10 0 9439 38477 i I* 116.90.139.16/29 202.7.0.176 10 0 9439 38477 i I*> 202.7.0.176 10 0 9439 38477 i I* 116.90.139.24/29 202.7.0.176 10 0 9439 38477 i I*> 202.7.0.176 10 0 9439 38477 i I* 116.90.139.64/27 202.7.0.176 10 0 9439 38477 i I*> 202.7.0.176 10 0 9439 38477 i I* 116.90.139.144/29 202.7.0.176 10 0 9439 38477 i I*> 202.7.0.176 10 0 9439 38477 i V* 118.90.0.0/16 202.7.1.22 30 0 9439 17435 i V*> 202.7.1.22 30 0 9439 17435 i 202.7.0.76 20 0 9439 24006 i V* 182.154.0.0 202.7.1.22 30 0 9439 17435 i V*> 202.7.1.22 30 0 9439 17435 i 202.7.0.168 20 0 9439 i I* 198.48.0.0/23 202.7.0.222 10 0 9439 132040 i I*> 202.7.0.221 10 0 9439 132040 i I* 198.48.2.0 202.7.0.222 10 0 9439 132040 132001 i I*> 202.7.0.221 10 0 9439 132040 132001 i I* 198.48.3.0 202.7.0.222 10 0 9439 132040 i I*> 202.7.0.221 10 0 9439 132040 i I* 202.7.4.0 202.7.0.222 10 0 9439 132040 23755 i I*> 202.7.0.221 10 0 9439 132040 23755 i I* 202.7.5.0 202.7.0.222 10 0 9439 132040 23755 i I*> 202.7.0.221 10 0 9439 132040 23755 i I* 202.7.6.0 202.7.0.222 10 0 9439 132040 23755 i I*> 202.7.0.221 10 0 9439 132040 23755 i I* 202.7.7.0 202.7.0.222 10 0 9439 132040 23755 i I*> 202.7.0.221 10 0 9439 132040 23755 i V* 203.119.88.0/23 202.7.1.253 30 0 9439 42 187 i V*> 202.7.1.253 30 0 9439 42 187 i 202.7.1.252 20 0 9439 i 202.7.0.147 20 0 9439 24183 45563 i 202.7.0.147 20 0 9439 24183 ? 202.7.0.128 20 0 9439 i 202.7.0.107 20 0 9439 i

2 3

2821 ipv4 table size
by Bill Walker 30 Dec '13

30 Dec '13

Hate to post this but my google foo is failing me anyone know the ipv4 max table size on a 2821? Would be running eBGP with two peers. Sent from my iPhone

2 2

Fraud Calls
by Davey Goode 27 Dec '13

27 Dec '13

Hi All, I hope everyone is having a good break ! If anyone out there has had any of their customers PBX's hacked recently (in the last 2 - 3 weeks) and have experienced a large call flow to say Somalia or some other dodgy destination id be keen to hear from you, I'm after the destination numbers they are dialling. replies off list would be great. cheers davey

3 2

How often does NZRS root reload?
by Skeeve Stevens 18 Dec '13

18 Dec '13

Hey all, Just registered a co.nz domain and it is registered and visible in whois. But ;; AUTHORITY SECTION: co.nz. 3285 IN SOA loopback.dns.net.nz. soa.nzrs.net.nz. 2013121964 900 300 604800 3600 How often does this server refresh its data? ...Skeeve *Skeeve Stevens - *eintellego Networks Pty Ltd skeeve(a)eintellegonetworks.com ; www.eintellegonetworks.com Phone: 1300 239 038; Cell +61 (0)414 753 383 ; skype://skeeve facebook.com/eintellegonetworks ; <http://twitter.com/networkceoau> linkedin.com/in/skeeve twitter.com/theispguy ; blog: www.theispguy.com The Experts Who The Experts Call Juniper - Cisco - Cloud

3 4

NZNOG 2014 Update
by Dean Pemberton 16 Dec '13

16 Dec '13

Hi Everyone. Registrations have been open for the conference for a while now and I'm pleased to say that they are at an unprecedented level for this time of year. Given that we've only just released the program, thats an outstanding achievement. With some great help from InternetNZ the conference is shaping up to be as awesome as usual. First up I'd like to thank the sponsors who have signed on thus far: Go Wireless - Gold Network Hardware Resale - Gold Vocus - Gold CityLink - Gold GKC - Silver Brocade - Silver Arbor Networks - Silver APNIC - Silver Extreme Networks - Silver Kordia - Bandwidth Sponsor We have more slots open for sponsorship as well as the much coveted Platinum sponsor position. If you would like to ensure that your organisation gets high visability at the event then contact sponsorship(a)nznog.org for a sponsorship pack. We know that the program is an important part of convincing your organisations that you need to attend. This year we've got a wide range of speakers lined up along with some great Workshops and tutorials. Program: International Keynotes: Tom Paseka (CloudFlare) - NZ Perspectives from a global CDN Roland Dobbins (Arbor Networks) - TBA Conference Presentations: Geoff Huston (APNIC) - Measuring DNSSEC Jamie Baddeley (Citylink) - NZIX2/Citylink SDN Sam Russell (REANNZ) - Building a better Skype with WebRTC, SIP, and ENUM Barry Brailey (DNC) .nz DNSSEC programme Jean-Sébastien Fontana (Extreme Networks) - Introduction to TRILL Gerard Creamer (Netspace) - Experiences with dual A records vs anycasting Beatty Lane-Davis (Cyan) - SDN & NFV Michael Fincham (Unleash) - RPKI Peter Gent (MBIE) - 5GHz Wireless Links Jan Jorz (ISOC) - BCOP Project Quintin Russ (SiteHost) - IPv6 deployment in the cloud InternetNZ Update APNIC update WAND update Lightning Talks Workshops: Network Infrastructure Security BGP Routing Tutorials: OpenDNSSEC Installation and Configuration (1/2 day) SDN/OpenFlow Installation (1/2 day) Mikrotik Routing (full day) APNIC Internet Resource Management (1/2 day) We'd suggest you register now. At least this side of Xmas. Flights, Accommodation etc will likely be easier and cheaper the sooner you do it. Better than doing it in a panic in mid January. For more information on how to register, head off to http://www.nznog.org/register See you all there. Dean

1 0

Keeping it local
by Martin Kealey 15 Dec '13

15 Dec '13

I have a question which I'm hoping the NZNOG community can help me with. Within NZ, what is the maximum number of hops from APE to any consumer's interface device? (smarty-phone, ADSL modem, whatever)? Or more pragmatically, let's say the 99th percentile, as in, fewer than 1% of customers are more than X hops away from APE. If this information is already available, I'd appreciate a pointer, otherwise... If you are an ISP could you give me an indicative number of hops from APE to your customers' CPE. If you can include a prefix length reflecting the number of affected customers that would help too. (Ideally the maximum across all your customers, but if you have a few oddball customers with longer paths, just the 99% will do.) If you're an ISP customer and would like to tell me your hop-count to APE (counting from your CPE, not from your computer) and your ISP's name, that would also be appreciated. Replies off-list and I will summarize back to the list. Here's the background: I'm investigating ways of limiting traffic so that it does not leave New Zealand, that can be configured on an application-by-application basis. Obviously if one has an upstream to "global" and a separate upstream to APE or WIX, then it's simple to filter traffic at those egresses. However for the average end-user, it's difficult to get multiple VLANs to their provider, let alone multiple physical links. In an ideal world, one would simply set some QoS bits and your upstream would understand them and do the filtering based on *their* egress, but in practice I haven't heard of any suppliers offering such a service. So I'm looking at DIY options ... In particular, I'm looking at setting the TTL on outgoing packets. We know how many hops it is from "our" hosts to APE, and I guestimate no more than 2 hops from a consumers border device (modem, whatever) to their client devices; So far it looks like setting the TTL so that it's down to 5 at APE will mean most of NZ is reachable, and most of the rest of the world isn't, assuming the international provider is as many hops from me as APE. But I'd really like to get a firmer idea of "how much of NZ will be unreachable given an egress hop limit of X?" (The idea is to find X where the list of exception prefixes is small enough to manage manually, while still blocking the majority of foreign traffic.) What I'd like to find out from the NZNOG community is the distribution of customers at various hop-counts from APE. -Martin

3 3

ISC/F-Root has returned to APE...
by Peter Losher 11 Dec '13

11 Dec '13

FYI - the Auckland node of F.ROOT-SERVERS.NET has been offline for the past couple of years due to HW failure, access issues @SkyTower, changes with our hosts (contacts and access to said data center). I am happy to report that the node is finally back online and advertising F's prefixes to the APE fabric as I type... So come and send your DNS root server queries locally instead of sending them off-shore. We are AS23710 @APE, so if you don't peer with us already, pop us a note at peering(a)isc.org. Yes, Telecom NZ, I am looking at you. Yes, you... (a guy can dream, even if it is hopeless) ;) There are many folks to thank as ISC could not do it alone including: - NZRS (Jay, Sebastian and Dave) for sponsoring the new server gear. - APNIC for sponsoring the new routers. (sorry to see the old Juniper kit go though) - Sebastian and Mike Jager for dealing with my numerous remote hands requests from the other side of the world. - The Kiwi Internet Mafia (Joe Abley, AJ, Jonny) for their support and access to their contacts to keep things moving. - Vodafone NZ and FX Networks for (now redundant) transit over IPv4 and IPv6. - Our peers at APE that have put up with us for being down so long... :) O.k., commercial over; back to serving packets again. Best Wishes - Peter -- [ plosher(a)isc.org | Senior Operations Architect | ISC | PGP E8048D08 ]

5 5

Web Servers: Dual-homing or DNAT/Port Forwarding?
by Christoph Berthoud 10 Dec '13

10 Dec '13

Hi All, I'm curious to know which of the following methods is more widely used/accepted today for publishing web servers to the Internet. 1) Dual-home the server - place one NIC on the internet and a second NIC on an internal network for administration, or 2) DNAT/Port Forward my external IP to my internal IP 3) Both - Dual home the server onto two private subnets (external/internal) and DNAT/Port Forward the public IP to the external subnet IP In either case: a) I will be hiding behind a dedicated firewall appliance and not relying on the OS firewalls b) the internal network will still be in its own subnet firewalled away from the rest of the network c) Only HTTP/HTTPS will be permitted from the internet, no RDP, SSH etc d) I will be deploying IPv6 to this machine in the next 12 months which makes option 1 more attractive I personally like option 1 but I'm looking to see if theres any facepalm reasons I shouldn't do it this way. Happy holidays! -- Thanks Christoph

9 10

JANOG 33 Program Published
by Daniel Griggs 09 Dec '13

09 Dec '13

Dear Colleagues, We have published the program for JANOG 33 and welcome you to join us in Beppu City, Japan, from 23rd-24th Jan 2014. Most sessions are in Japanese only but there are a few sessions in English. You are also welcome to connect with us through facebook and twitter for updates in English. The JANOG SNS accounts are open to everyone, including those who are not able to attend the meeting. See you in Beppu. Cheers, Shinichi Yamamoto, Chin Sze Yih, Izumi Okutani JANOG Internationalization team for JANOG 33 ----- JANOG 33 Program : ------------------------ The Program is available in English at: http://www.janog.gr.jp/en/index.php?JANOG33%20Programs%2FJANOG33%20Program%… Translations of the program titles and abstracts were supported by volunteers on the best efforts basis. Note: During the meeting, there will be no official interpretations in English, except for the sessions marked as (English session). Registration : ------------------------ You can register online at: https://regist.e-side.co.jp/product_info.php?products_id=427&language=en 　Deadline: 10th Jan 2014 JST 15:00 SNS Accounts : ------------------------ Facebook : https://www.facebook.com/janogmeetingi18n Twitter : https://twitter.com/janog_i18n -- Daniel Griggs e + j: daniel(a)pch.net c: +64 (21) 845158

1 0

Re: [nznog] Help block out China please.
by Pete Mundy 08 Dec '13

08 Dec '13

A story along a similar line that reinforces this view: I put a phone on public IP space a few weeks back, then got sidetracked while configuring it. Before I had even returned to enter a new admin password and the correct SIP details (only 1/2hr later!), the phone had already been attempting to dial out on it's own. Turns out a robot had found it on it's public IP with port 80 open and started issuing it dial commands before I even had a chance to go about locking it down. It was unable to dial out as it hadn't had the correct SIP server or login details configured, but it just goes to show that the device really need to be locked down _before_ being put on any publicly accessible IP space, even if just for provisioning purposes! Pete On 8/12/2013, at 3:17 PM, "Dobbins, Roland" <rdobbins(a)arbor.net> wrote: > > On Dec 8, 2013, at 8:46 AM, Don Gould <don(a)bowenvale.co.nz> wrote: > >> Clearly you can't even put a quick and dirty box in place to just prove a concept without having to bolt it down. > > Correct - it simply isn't viable to expose an unpatched/unsecured box to the Internet at all, due to all the automated scanning/hacking activities taking place. > > +1 to the other folks who recommended more workable solutions - 'GeoIP' isn't exact at all, and not all bad nodes (of any nationality) are in China. > > Roland Dobbins

9 9

Re: [nznog] Help block out China please.
by Regan Murphy 07 Dec '13

07 Dec '13

Build the box behind a firewall and don't open incoming ports until its ready to go. Sent from my Windows Phone ________________________________ From: Don Gould<mailto:don(a)bowenvale.co.nz> Sent: ‎8/‎12/‎2013 9:54 p.m. To: nznog(a)list.waikato.ac.nz<mailto:nznog(a)list.waikato.ac.nz> Subject: Re: [nznog] Help block out China please. How do I download the current patch set for Windows 2012 R2 so I can apply it before putting the box on the network? This seems a bit chicken and egg. (And yes I agree this really is a Geekzone or Whirlpool type question now, but I'm a bit interested in what advice operators are keen for us to be dishing to folk.) Beer. D On 8/12/2013 4:36 p.m., Pete Mundy wrote: > locked down_before_ being put on any publicly accessible IP space > -- > Don Gould > 31 Acheson Ave > Mairehau > Christchurch, New Zealand > Ph: + 64 3 348 7235 > Mobile: + 64 21 114 0699 > Ph: +61 3 9111 1821 (Melb) > > I'M COLLECTING COFFEE CUPS FOR PROJECT COFFEE CUP. > > Deja vue (missing the French accent mark) - literally means already seen, that sense of haven't we been here before. _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Help block out China please.
by Don Gould 07 Dec '13

07 Dec '13

Hi, I've got a machine that's been hacked twice in the past week from IP ranges in China. I have it behind a Mikrotik router. There is no reason for anything outside of NZ and AU to be looking at this box so I'm keen to just block the rest of the world from it. I'm currently thinking an address list to just block out the world or an address list to include Au and Nz. Keen for ideas. D -- Don Gould 31 Acheson Ave Mairehau Christchurch, New Zealand Ph: + 64 3 348 7235 Mobile: + 64 21 114 0699 Ph: +61 3 9111 1821 (Melb) I'M COLLECTING COFFEE CUPS FOR PROJECT COFFEE CUP. Deja vue (missing the French accent mark) - literally means already seen, that sense of haven't we been here before.

5 7

SoapUI with WOMBL?
by Michael Fincham 04 Dec '13

04 Dec '13

Afternoon all, Has anyone managed to get Chorus's WOMBL B2B test environment working in SoapUI? One complimentary beer, redeemable at NZNOG 2014, for anyone who can share the settings in SoapUI required to make this work :) -- Michael Fincham

1 1

Domain registration scammers
by LRW Longhurst 04 Dec '13

04 Dec '13

Hi all, Sorry, and "beer" because this is more of an Aussie question, maybe someone can direct me to somewhere more appropriate. One of our execs received one of those "domain name available" letters in the form of an invoice, inviting him to register a name in .net.au that's similar to another name we own. This seems to have come via snail-mail but it invites payment at domainnamegroup.com.au. Do we do anything about such scammers? Suing them for wasting our time springs to mind, but I'm thinking more in terms of reporting to an authority. I know this practice has been around for a while but it's the first time I've encountered it directly. -- Lesley Longhurst (previously Walker) Linux Systems Administrator Opus International Consultants Ltd Email lesley.longhurst(a)opus.co.nz Tel +64 4 471 7002, Fax +64 4 473 3017 http://www.opus.co.nz Level 9 Majestic Centre, 100 Willis Street, PO Box 12 343 Wellington, New Zealand

6 5