- NZNOG - lists.nznog.org

issue with xtra mail
by Daniel Christie 31 Aug '15

31 Aug '15

Hey all, Is there anyone here who is an admin of the xtra mail servers for custom domains? I simply want to know why an email being sent from an email server to xtras would get this showing up in SMTP logs of the sending server 210.54.141.1 [1224] 12:52:37 Client session <<< 553 Authentication is required to send mail as user(a)domain.com<mailto:user(a)domain.com> I'm trying to go through normal spark support channels but they are trying to ask me questions about the email … [View More]

10 10

UFB - DHCP Relay and Packet Fragmentation
by Brent Marquis 26 Aug '15

26 Aug '15

Hi All, This is a little bit late for getting the info into this community sorry, I was tied down with ensuring we had the fix out there. I thought it was important to ensure that anyone who is affected, but may not have seen the informer(s), knows that as of tomorrow you can commence migrations, remove workarounds and re-instate config, etc I've attached our informer for the Fragmented Packet issue, as it has all the info - but the main details are below. We are currently upgrading all of … [View More]

2 1

alibi routing
by Jodi Thomson 25 Aug '15

25 Aug '15

Came across this while reading soylent news - thought it interesting http://spectrum.ieee.org/tech-talk/telecom/internet/system-routes-internet-… https://alibi.cs.umd.edu/ Cheers JT -- Jodi Thomson Systems & Networks Web Connect Ltd 501 Heretaunga Street West Hastings, 4122 Ph: (06) 281 2324 (ext 802) http://www.webconnect.nz

1 0

UFB Upload Issues
by Dave Mill 20 Aug '15

20 Aug '15

Hi all If any RSPs currently have any reports of 100/20 UFB Right Performing customers having only 2M upload could you contact me offlist? If you do contact me I'm really interested in where your BNG is and where your customers are with the issue. If any end users are on 100/20 with only 2M upload also feel free to contact me. I'm more interested in your location and your ISP in this case. Cheers Dave (representing Inspire Net in this post)

17 34

mx.clear.net.nz help please
by Don Gould 20 Aug '15

20 Aug '15

Hi guys, Sorry to say but one of my customers got their computer compromised and it caused a spam dump via one of my servers which now seems to be blocked by clear.net.nz Can someone have a look for me and unblock mx.yournet.co.nz? I can provided more full transcript but I've removed customer details for the public list. Thanks D *From: *MAILER-DAEMON(a)mx.yournet.co.nz <mailto:MAILER-DAEMON(a)mx.yournet.co.nz> (Mail Delivery System) *Subject: **Undelivered Mail Returned to … [View More]

1 0

Twitter peering in Sydney
by Tim Hoffman 17 Aug '15

17 Aug '15

Greetings, AS13414 is now peering in Australia. We invite AU/NZ eyeball networks to peer with us on the Equinix, IX Australia, and Megaport IXs in Sydney. Please find our details at http://as13414.peeringdb.com, and contact peering(a)twitter.com if this is of interest to you. Cheers, Tim -- Tim Hoffman | Twitter, Inc. 1355 Market St. | San Francisco, CA | 94103

1 0

Apricot 16
by Jamie Baddeley 15 Aug '15

15 Aug '15

Hey folks, We said in Rotorua we'd be keen to subsidise Apricot attendance in 2016. And if memory serves correctly it was for any of the diehard Noggers that always turn up to our conference. We must have had a rush of blood to the head at the time because it turns out we could do that and probably burn out the NZNOG Trust fund at the same time. That's not wise. Now that we've thought about it, what we can do is make 5K NZD available to those who $deserve a subsidy. What we have not worked … [View More]

2 2

Win10 downloads causing UFB congestion?
by Juha Saarinen 13 Aug '15

13 Aug '15

Hello NZNOG, I was reading this: http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11495508 <http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11495508> just now, which says the Windows 10 upgrade is overwhelming capacity on the UFB (which bit of it?). It’s a single source however, and I was wondering if there are other data points for the traffic increase to look at? Not sure if this is operational as such, so please email me off-list if … [View More]

8 8

Re: [nznog] Win10 downloads causing UFB congestion?
by Regan Murphy 11 Aug '15

11 Aug '15

Chris Keall wrote up this in the NBR yesterday with a "yeah....nah". (paywalled) http://www.nbr.co.nz/opinion/digital-island-windows-10-upgrades-are-congest… -- Regan ________________________________ From: Juha Saarinen<mailto:juha(a)saarinen.org> Sent: ‎8/‎12/‎2015 9:17 AM To: nznog<mailto:NZNOG(a)list.waikato.ac.nz> Subject: [nznog] Win10 downloads causing UFB congestion? Hello NZNOG, I was reading this: http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=… [View More]

1 0

Re: [nznog] Win10 downloads causing UFB congestion?
by Scott Weeks 11 Aug '15

11 Aug '15

--- scott(a)scottpettit.nz wrote: From: Scott Pettit <scott(a)scottpettit.nz> puff piece designed to spread FUD for Digital Island's own -------------------------------------- Funny, I worked for another Digital Island that existed in Hawaii from the mid-1990s to ~2002. We had PoPs all over the world including NZ. It was bought by C&W and these guys took up the name 2 years later according to their "about us" page. Until now I never heard of them... scott … [View More]

1 0

Traffic on Akl-IX
by Jesse Archer 09 Aug '15

09 Aug '15

Hey all, A quick heads up about our experience on Akl-IX (community IX based in Auckland, presence in 220 Queen and Vocus Albany). This past week we've seen our traffic coming in via the IX double, in part thanks to Microsoft peering and the Windows 10 updates that are hammering everyone's networks right now :) Also recent growth in peers - I see Compass are on-boarding and a couple of other operators I've spoken with are peering shortly. There are some large content providers on the IX, … [View More]

8 9

Some name server changes, SkyTV and Paymark
by paul tinson 09 Aug '15

09 Aug '15

Hi There, I wanted to notify the list that anyone operating recursive resolvers would be wise to flush the following zones from the cache: *.skytv.co.nz *.paymarkclick.co.nz Lastnight the name servers for these where switched to ns1, ns2 and ns3.spark.co.nz. The TTL on the NS record was 24hrs at the time of change so these could still be in cache as the old record. Regards Paul

2 2

Chorus CCIL availability
by Jonathon Exley 05 Aug '15

05 Aug '15

Hi NOGers, The Chorus Co-Innovation Lab (CCIL) is being upgraded to a new software release in preparation for a UFB production upgrade later this year. The Wellington and Auckland nodes will bounce several times today and tomorrow, as we exercise the upgrade and rollback procedures. [cid:image001.jpg(a)01CF4F55.0ABA26E0] Jonathon Exley Network Specialist Layer 2 T +64 4 896 4190 M +64 27 514 8048 E jonathon.exley(a)chorus.co.nz<mailto:jonathon.exley(a)chorus.co.nz> Level … [View More]

2 2

Chorus EUBA + IPV6
by Simon Allard 02 Aug '15

02 Aug '15

Since it seems to be ipv6 month here at NZNog I thought I would bring this up. Some of you have commented that Orcon is in trial mode for IPv6 and are probably wondering why we haven’t progressed. We have had IPV6 enabled for a while and have a good number of ipv6 customers online now. However we found an issue on the Chorus network which stopped us rolling it out further. (UFB ipv6 was another battle which requires beer!) What we found was some Chrous DSLAMS with certain card types would … [View More]drop IPV6CP packets in one direction when doing the PPPoE->PPPoA conversation. It would seem that these cards don’t support Ipv6. Weirdly enough it would seem it is the newer card types used for Broadband IP. (citation needed). This in itself isn’t a major but we also found our NFV4 modem would reset its entire PPPoE stack if the IPV6CP conversation started but didn’t complete as expected, so customers would constantly be disconnected and cycle around. (The Genius modem works well with ipv6) The NFV4 issue aside (we are resolving with the Vendor). We approached the Chorus tech team and they helped identify the issue but that’s is where its hit a brick wall. The Chorus op team are not keen on fixing the issue nationwide as it involves new code versions, a massive amount of testing and a long rollout program. (I can understand where they are coming from). To summarise: IPV6 doesn’t work on Chorus EUBA on some line card types Only affect PPPoE->PPPoA translation PPPoE end to end is fine. Chorus say IPV6 not supported on EUBA Customer numbers effected are smallish. We will fix the NFV4 issue, but keen to rollout more IPV6 to all customers, not just the lucky ones on card types which work. Has any other ISP’s (the bigger ones especially) noticed this? As it will require some pressure to get some progress. Cheers, Simon Allard Orcon/Callplus [cid:image92256e.PNG(a)016ea4ce.48a80470] Simon Allard // Senior Network Architect D: 09 550 2790 M: 020 100 0790 F: www.callplus.co.nz<http://www.callplus.co.nz> | www.slingshot.co.nz<http://www.slingshot.co.nz> | www.flip.co.nz<http://www.flip.co.nz> | www.orcon.net.nz<http://www.orcon.net.nz> This message and any attachments contain privileged and confidential information. If you are not the intended recipient of this message, you are hereby notified that any use, dissemination, distribution or reproduction of this message is prohibited. If you have received this message in error please notify the sender immediately via email and then destroy this message and any attachments. [View Less]

5 5

ARP _request_ with Target Protocol Address = 255.255.255.255
by Ewen McNeill 02 Aug '15

02 Aug '15

On the off chance that someone else has seen this before and knows what causes it, does anyone know of any software that generates ARP _Requests_ with the Target Protocol Address (TPA) of 255.255.255.255 (all ones). Such that results in this sort of log message from picky switches: <188> Jul 29 10:47:13 [SWITCH] ARP[ipMapForwarding]: ipmap_arp_api.c(1147) 1021154 %% Received ARP Request on interface Vl1 with bad target IP address 255.255.255.255. Sender IP is [REALIP], sender MAC … [View More]

2 3

gnodal switches
by Rob McDonald 28 Jul '15

28 Jul '15

Hi, Slightly OT maybe. Not an operational issue. But where else would you ask? Has anyone heard of what happened to gnodal? They sprang up, released some fairly impressive switches, went into receivership then were purchased by Cray computing... 18 months later you can buy their hardware on ebay... $5000 kiwi landed for a 72port 10gig SFP+ chassis? Has anyone made use of this kit? Cheers Rob

1 0

Call for Presentations - DNS-OARC Fall Workshop, Oct 2015 -- Deadline Extended
by Sebastian Castro 28 Jul '15

28 Jul '15

The next DNS-OARC Fall Workshop will take place in Montreal on Oct 3rd and 4th, the weekend before NANOG65. DNS-OARC is requesting proposals for presentations, with a preference for DNSSEC work. We are looking for the whole spectrum, from measurement work using passive and active techniques, to applications and potential new uses of DNSSEC. This workshop intends to build from previous strong DNS-OARC workshops, where operational content and research is welcome. Presentations from DNS operators … [View More]

1 0

Android "stagefright" bug, aka "The Android End Times"
by Mike Forbes 27 Jul '15

27 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Seems this is pretty hot right now. Basically every single android device - and it seems very difficult to imagine a scenario where all those devices could be patched. Suggestions for mitigating include disabling the "Auto download / Auto retrieve" portion of your MMS app and/or disabling the MMS APN in your mobile settings. Though, of course the vulnerability is in the media library so assume the malicious code could be sent via other means. … [View More]

1 0

Any 2talk NOC lurking?
by Pete Mundy 27 Jul '15

27 Jul '15

Hi 2talk Just on the off-chance any of your guys are lurking on this list? You seem to have dropped a route and all traffic bound to your NS is going nowhere as of shortly after 6am today. I've tried lookups and pings from connections on quite a range of ISPs and they all show the same thing. Some traceroute examples are included below just as a reference. It's not the first time the route to the network hosting your NS has dropped. Have you ever considered having a tertiary NS elsewhere, … [View More]say maybe on AWS or something? Just a thought. Anyway just a heads up since I can't access your live portal to lodge a ticket ;) (and a warning for others on list in case they are affected by it too). Cheers, Pete [from a Spark link] Host Loss% Snt Last Avg Best Wrst StDev 1. dsl-router.lan 0.0% 3 1.5 1.4 1.3 1.5 0.1 2. 122-56.78-178.n4l.sparkdigital.co.nz 0.0% 3 59.1 24.6 7.2 59.1 29.9 3. 122-56-99-251.n4l.sparkdigital.co.nz 0.0% 3 15.0 30.4 15.0 60.8 26.3 4. 122-56-99-250.n4l.sparkdigital.co.nz 0.0% 3 15.5 17.6 15.5 21.6 3.5 5. 122-56-99-253.n4l.sparkdigital.co.nz 0.0% 3 15.8 15.4 14.9 15.8 0.5 6. ??? 7. ae8-10.akbr6.global-gateway.net.nz 0.0% 2 25.8 25.8 25.8 25.8 0.0 8. ??? [from a Snap link] fpl-rpi17 (0.0.0.0) Tue Jul 28 07:16:35 2015 Keys: Help Display mode Restart statistics Order of fields quit Packets Pings Host Loss% Snt Last Avg Best Wrst StDev 1. fritz.box 0.0% 6 1.0 1.0 1.0 1.1 0.1 2. 133.7.69.111.static.snap.net.nz 0.0% 6 2.8 5.1 2.8 13.5 4.2 3. ??? [from a Solarix link] vvm2.fiberphone.co.nz (0.0.0.0) Tue Jul 28 07:17:14 2015 Keys: Help Display mode Restart statistics Order of fields quit Packets Pings Host Loss% Snt Last Avg Best Wrst StDev 1. ge-1-1-1-340.core-0.ive.chc.unleash.net.nz 0.0% 6 1.0 1.0 0.6 2.1 0.6 2. ae1-22.core-0.sho.chc.unleash.net.nz 0.0% 6 1.1 1.5 0.8 3.3 0.9 3. ae0-3221.core-0.que.akl.unleash.net.nz 0.0% 6 17.1 17.3 16.8 18.3 0.5 4. 116.90.129.203 0.0% 5 17.8 17.2 16.7 17.8 0.4 5. ten-0-3-0-500.bdr01.akl05.akl.VOCUS.net.nz 0.0% 5 17.1 17.4 17.1 17.5 0.2 6. ??? [View Less]

3 2

National Broadband Map launched yesterday
by Sebastian Castro 23 Jul '15

23 Jul '15

Hello members of the NZNOG community: NZRS launched the National Broadband Map (https://broadbandmap.nz) yesterday with the participation of Hon. Amy Adams. We had an overwhelming response and our team had to clock some extra hours to scale up everything nicely to cope with the load. We are getting calls and messages noting the accuracy in certain border cases. We are working with our data suppliers to ensure the information we're presenting is as accurate as possible, and new data will be … [View More]

2 1

CallPlus Routes / Akamai Coming via Vocus / AKL-IX??
by Liam Farr 22 Jul '15

22 Jul '15

Hey, Anyone else seeing this, routes to CallPlus are being advertised to AKL-IX by Vocus rather than by CallPlus direct. As an example this is breaking 'www.stuff.co.nz' for me. The path by Vocus seems really 'fucked' (like its aggressively shaped down to nothing) so HTTP takes forever to load. Liams-MacBook-Pro:~ liamfarr$ traceroute www.stuff.co.nz > traceroute: Warning: www.stuff.co.nz has multiple addresses; using > 119.224.143.41 > traceroute to a1784.g.akamai.net (119.224.… [View More]143.41), 64 hops max, 52 byte > packets > 1 192.168.6.1 (192.168.6.1) 0.710 ms 0.394 ms 0.332 ms > 2 unallocated.maxumdata.net (103.247.154.2) 0.427 ms 0.434 ms 0.397 > ms > 3 vl0901.core2.qs220.maxumdata.net (103.247.154.141) 0.585 ms 0.651 > ms 0.586 ms > 4 vl0233.edge1.qs220.maxumdata.net (103.247.154.38) 0.645 ms 0.672 > ms 0.613 ms > 5 43.243.21.6 (43.243.21.6) 1.580 ms 1.459 ms 1.529 ms > 6 ten-0-1-0-2.cor01.akl05.akl.vocus.net.nz (114.31.202.122) 2.139 ms > 2.088 ms 2.294 ms > 7 bundle-10.bdr02.akl05.akl.vocus.net.nz (114.31.202.101) 2.560 ms > 2.764 ms 2.314 ms > 8 as4610.cust.bdr02.akl05.akl.vocus.net.nz (175.45.102.66) 24.271 ms > 24.166 ms 24.251 ms > 9 pts-n.cpcak4-r1.tranzpeer.net (101.98.5.20) 2.297 ms 2.175 ms > 2.254 ms > 10 p1.akamai.callplus.net.nz (119.224.143.1) 1.488 ms 1.633 ms 2.441 > ms > 11 p41.akamai.callplus.net.nz (119.224.143.41) 1.624 ms 2.116 ms > 2.334 ms liam(a)QS220-EDGE1:~$ show ip bgp 119.224.143.41 > BGP routing table entry for 119.224.142.0/23 > Paths: (4 available, best #3, table Default-IP-Routing-Table) > Advertised to non peer-group peers: > 103.247.154.37 103.247.154.42 103.247.154.186 192.203.154.150 > 2403:4d00:fff:ffff:ffff:ffff:20:2 > 45177 4610 9790 > 103.247.152.241 from 103.247.152.241 (14.1.32.4) > Origin IGP, localpref 50, valid, external > Community: 55785:502 > Extended Community: RT:45177:1117 > Last update: Thu Jul 9 06:37:46 2015 > 45177 4610 9790 > 103.247.152.213 from 103.247.152.213 (14.1.32.4) > Origin IGP, localpref 50, valid, external > Community: 55785:502 > Extended Community: RT:45177:1117 > Last update: Thu Jul 9 06:34:55 2015 > > > > > * 4826 4610 9790 43.243.21.6 from 43.243.21.1 (43.243.21.1) > Origin IGP, localpref 100, valid, external, best Community: 55785:202 > Last update: Wed Jun 24 04:15:20 2015* > 23655 9560 9790 > 111.69.34.225 from 111.69.34.225 (43.225.200.2) > Origin IGP, localpref 90, valid, external > Community: 55785:302 > Last update: Sat Mar 28 03:36:00 2015 As CallPlus peer on AKL-IX I would have expected to see them advertising their own routes, rather than just advertising these to Vocus who are then 'breaking them'. Perhaps someone from CallPlus could fix their advertisements, and someone from Vocus could either fix their 'bottleneck' or stop advertising the routes. -- Kind Regards Liam Farr Maxum Data +64-9-950-5302 [View Less]

8 8

Junos and RPKI validation
by Dave Mill 16 Jul '15

16 Jul '15

Hi all NZNOG, and especially Michael Fincham and Tim Hoffman, had done a big push both at our conferences and on this list to get people using RPKI route validation. We were a test customer using the NZRS service at http://validator.rpki.net.nz/rtr-sessions . Someone with an observant eye may have noticed that we silently stopped using this validator a few weeks ago. We hit a 'minor' issue where Junos would restart _all_ routing daemons and produce a core dump when running a session to a … [View More]

2 1

dual sim (3g) routers
by Jodi Thomson 12 Jul '15

12 Jul '15

Hi Folks We're on the hunt for a dual-sim (3g) router. Have done some googling but not sure what may or may not work with our 3/4G networks. Primary objective is to have 2nd 3G link as failover to second network (eg spark -> vodafone), but aggregation would be helpful also if networks support it (eg vodafone-vodafone) Wondering if anyone on the list knows what is available in NZ? Off list replies welcome to prevent clutter Cheers Jodi PS Beer -- Jodi Thomson Systems & … [View More]

1 1

Whither NzWrt?
by Dave Taht 12 Jul '15

12 Jul '15

I am curious if the NZWrt idea ever got any traction? It certainly seemed saner for me for a set of ISPs to agree on one specific hardware type, get software that met their needs, make it stable as heck, and to maintain it themselves.... -- Dave Täht worldwide bufferbloat report: http://www.dslreports.com/speedtest/results/bufferbloat And: What will it take to vastly improve wifi for everyone? https://plus.google.com/u/0/explore/makewififast

3 2

NZ TCF very bad SSL FYI
by Tony Wicks 08 Jul '15

08 Jul '15

HI guys, one of my users reported being unable access the IPMS platform this morning and it appears Firefox and Chrome are calling bul### on the really bad SSL on the TCF website and blocking access. IE still works but really shouldn't. Anyone on the TCF on this list, please sort your your technical people, this is just not good enough ! https://www.ssllabs.com/ssltest/analyze.html?d=ipms-prod.tcf.org.nz

1 1

4-wire SHDSL routers in NZ
by Dmitry Konchanin 06 Jul '15

06 Jul '15

Hi all We are suddenly in need of a couple 4-wire SHDSL EFM routers. There is basically no retail market for shdsl devices, ones we found are only 2-wires or have to be ordered with a lead time of couple of weeks (except pricy Cisco 888E option). If somebody has an access to stocked supply of such devices, could you please contact me off the list. -- Kind regards, Dmitry Konchanin

3 2

Intac program
by Dean Pemberton 02 Jul '15

02 Jul '15

Hi all, The Programme for this year's InTAC is now up: http://2015.nethui.nz/programme/day-0-intac This year there is a focus on "The Netflix Effect; Organic Growth or Step Change?" What does the changing face of user demand look like? What happens when people who previously only used their home connections for email and web, start using it for multiple 4-5Mbps streams? What happens when everyone on their street does that? Take a drive down any New Zealand street and look at all the Sky … [View More]

2 1

Fwd: [PAG] Fwd: InternetNZ deeply disappointed with Global Mode withdrawal
by Joel Wirāmu Pauling 23 Jun '15

23 Jun '15

FYI; ---------- Forwarded message ---------- From: Jordan Carter <jordan(a)internetnz.net.nz> Date: 23 June 2015 at 16:48 Subject: [PAG] Fwd: InternetNZ deeply disappointed with Global Mode withdrawal To: Policy Advisory Group <pag(a)mailman.internetnz.net.nz> ---------- Forwarded message ---------- From: *Aimee Whitcroft* <news(a)meltwaterpress.com> Date: Tuesday, 23 June 2015 Subject: InternetNZ deeply disappointed with Global Mode withdrawal To: jordan(a)internetnz.… [View More]net.nz A better world through a better Internet InternetNZ deeply disappointed with Global Mode withdrawal InternetNZ is deeply disappointed at announcements today that the Global Mode service is being withdrawn from New Zealand. "Global Mode was a great example of Internet-based innovation that challenged traditional content distribution models. It was by no means clear that the service was illegal, and we were keen to see the matter go before the courts to provide users and the industry with clarity." said InternetNZ Chief Executive Jordan Carter. The removal of this service means that New Zealanders have fewer options to pay for content. Restricting consumer access to paid content services on the basis of geographic content monopolies seems the wrong answer to resolving copyright concerns. "Withdrawing the service and settling before court seems a worse outcome for all concerned. The media companies have said that they wanted to clarify their own legal rights over content - a settlement doesn't achieve this, and leaves us all none the wiser." "There remains a number of questions that will now go unanswered due to this withdrawal. Internet users and innovation have taken a back seat to entrenched old media interests." "This outcome makes it ever more important that we review New Zealand copyright law, to ensure that the interests of consumers and creators are appropriately balanced." said Carter. *ENDS* For more information, please contact Andrew Cushen, Acting Chief Executive: - 021 346 408 - andrew(a)internetnz.nz www.internetnz.net.nz *Disclaimer: *If you do not wish to receive further news/releases from Internet NZ, please click the following link: [Remove Me] <http://app.meltwaterpress.com/mpress/removeme.html?cId=3507196&sId=171920&c…>. Requests will take a maximum of 2 business days to process. Contact information: Aimee Whitcroft, Internet NZ, Grand Arcade Tower, 16 Willis Street, Wellington, 6011 -- Jordan Carter Chief Executive, InternetNZ +64-21-442-649 | jordan(a)internetnz.net.nz Sent on the run, apologies for brevity _______________________________________________ Pag mailing list Pag(a)mailman.internetnz.net.nz http://mailman.internetnz.net.nz/mailman/listinfo/pag [View Less]

1 0

Call for Presentations - DNS-OARC Fall Workshop, Oct 2015
by Sebastian Castro 17 Jun '15

17 Jun '15

The next DNS-OARC Fall Workshop will take place in Montreal on Oct 3rd and 4th, the weekend before NANOG65. DNS-OARC is requesting proposals for presentations, with a preference for DNSSEC work. We are looking for the whole spectrum, from measurement work using passive and active techniques, to applications and potential new uses of DNSSEC. This workshop intends to build from previous strong DNS-OARC workshops, where operational content and research is welcome. Presentations from DNS operators … [View More]

1 0

Onsite Cisco Switch Install - Tomorrow - lunchtime-ish (Auckland)
by Skeeve Stevens 16 Jun '15

16 Jun '15

Hi all, I need a Cisco switch installed in Auckland tomorrow. It is already onsite and will need to be wiped (if anything is on it) and the config provided loaded, then installed into a rack. If you can assist, please let me know off-list with availability (tomorrow obviously) and rates. As usual I get a dozen responses... I will accept the first appropriate one, but sorry if I don't reply to everyone. ...Skeeve *Skeeve Stevens - Founder & Chief Network Architect* eintellego Networks … [View More]

2 1

IANA AS Numbers registry update
by Selina Harrington 11 Jun '15

11 Jun '15

Hi, The IANA AS Numbers registry has been updated to reflect the allocation of the following block to RIPE NCC in June 2015: 202240-203263 Assigned by RIPE NCC 2015-06-11 203264-204287 Assigned by RIPE NCC 2015-06-11 You can find the IANA AS Numbers registry at: http://www.iana.org/assignments/as-numbers/as-numbers.xml The allocation was made in accordance with the Policy for Allocation of ASN Blocks to Regional Internet Registries: https://www.icann.org/resources/pages/global-policy-asn-… [View More]

1 0

Re: [nznog] racks for beer.
by Stuart Pigneguy 10 Jun '15

10 Jun '15

I also have two 19" server racks (with doors) no longer required and can be exchanged for beer. I believe they are 42U, available for pick up in Auckland on Monday 22nd. Otherwise they'll be scrapped! - please reply off list Cheers, Stuart NZNOG lurker since 2001

1 0

DEI bit on Fortigate D series
by Dan BAJARCA 09 Jun '15

09 Jun '15

Hi All, Just sharing a bit of knowledge around issues we've had with Fortigate firewalls on UFB Accelerate plans. Some of our customers reported slow download speeds (generally close to 2Mbps) when using Fortigate D series firewalls on UFB 200/100 (tested with 30, 60 and 90 models). The issue is caused by the units dropping inbound packets with the DEI bit set and showed up on 5.0 and 5.2 software. After some extensive troubleshooting with Fortinet they've eventually acknowledged the fault … [View More]

1 0

Assistence with Brocade CNA
by Tristram Cheer 09 Jun '15

09 Jun '15

Hi All, I've run out of options for an issue we've got with some brocade 1020's we're using in a pinch, Is there anyone who's familiar with the 1020's and vmware on the list who's able to drop me a message off-list? I'm hoping it's a simple thing and some beer for your efforts. Cheers Tristram Cheer Network Architect - Most problems are the result of previous solutions... [Visit our Website]<http://www.uber.co.nz/> 09 438 5472 Ext 803 | 022 412 1985 | PO Box 5083, Whangarei, 0140 t(a)… [View More]

1 0

Where can congestion occur on a UFB (GPON) network?
by Joel van Velden 03 Jun '15

03 Jun '15

Hi all, At Auckland Thursday Night Curry I asked what I thought was a simple enough question: "In this this new world of GPON fibre that is UFB, /where can congestion occur/?" Obviously at handovers, no question, but where else? From what I can figure, given a hypothetical GPON network using a 24-way optical split (seems to be number quoted in a NZ context) Standard GPON suggests 2.488 Gbps down, so split 24 ways is 103.7 Mbps (Not sure what packet sizes) So if all customers behind a … [View More]

1 0

RE Legal Text on TICSA - Visit to Wellington/ Seeking input
by Beau Murrah 27 May '15

27 May '15

Hello NZNOG list, Some months ago I emailed to the list about my plan to produce a legal manual/critical to guide to the TICSA legislation for network operators/the list. I got some feedback from people on this list and outside of it that there was interest in such analysis and some highlighted a number of particular issues to look into/affecting them. My original hope was to have it completely edited and ready to share to the list about this time - I know updated guidance was/is planned to … [View More]be released by the NCSC soon (or has already been released). Well, Im still going at it but it is proving difficult topic to write about and finish into a usable and credible form. My text is currently 6500+ words - and I think there are definitely some genuinely some useful or novel things for consideration but it is also all over the place. Initial feedback on the very rough draft was that it doesn’t seem clear exactly exactly who I am writing for - seeming like a mix of legal academic essay and direct practical consideration for network operators and also partly political content about the nature of bureaucracy in this area (the latter Ive decided to cut out as much as possible. I believe writing about this topic is difficult because I realised I don’t know much about what the worklife of a network operator of a truly large network is actually like at all. I have read/seen most all of the publicly available information - close reading of the legislation and related legislation, NCSC guidance, information from this list and so on. None of the technical people I know are network operators. It is hard to gauge what the level/type of interaction with the Agency is actually like broadly. I really don’t want to inadvertently publish any bullcrap technical claims and there is plenty of cyber-paranoid stuff out there already. So, I digress- I am visiting Wellington later this month (28th-31st May) and I would love to get insight from a network operator(s) over beer/coffee/water. I am actually less interested in what TICSA compliance has been like for you - and I don’t expect or want you to “leak” anything or disclose anything - but to hear more about the worklife of a network operator in general day to day that would come under examination in any potential legal proceeding under TICSA. To give a quick preview of my text, it focuses on the fundamental importance of good faith in the legislation to protecting you from any worst case scenario from alleged non-compliance. It considers what remaining in good faith could look like in a situation of alleged non-compliance and what variety of reasons or events could lead to non-compliance while good faith has been retained by the network operator. This depends on a lot on getting an understanding your workflow and obligations and what kind of people are you expected to report to and way that evidence accumulates in your day - much like in any employment situation or potential examination/dispute. There is very limited legal precedent to what Good Faith actually is from legislation and case law around the issue of employment and law and collective bargaining. How good faith might be interpreted involving network operators dealings with the Agency is a very open question and something all network operators ultimately have an interest in. I will say that the guidance provided to you by the NCSC guidance is not legal binding guidance and makes particular assumptions about the nature of good faith. It is very possible that this entire law will never effectively see a day in court if the narrative that this regulation is intrinsically a piece of national security and good faith flatly means following the Agency’s commands or striving to meet their interpretation of compliance. I do not think this is correct nor is anyway certain. I will add though, an actual Court case under this legislation’s confidentiality and evidential provisions will attempt to turn a civil court into a “Secret Court” like FISA this Country has never really seen and will intimidate the most experienced of lawyers, Judges and Court staff - there is a huge impetus to avoid this situation, and hopefully this can be put more in the network operators favour, rather than to scare them. I invite you to email me off-list if you want to meet, or to email on-list to propose a venue/time on-list for people to chat as a group. Happy Budget day, ___________ Beau Murrah Ph: +64 27 375 7897 Email: bmurrah(a)icloud.com <mailto:bmurrah(a)icloud.com> - PGP: https://keybase.io/airbridge <https://keybase.io/airbridge> Linkedin: https://www.linkedin.com/in/bmorganmurrah <https://www.linkedin.com/in/bmorganmurrah> Enrolled Barrister and Solicitor of the High Court of New Zealand (NB: not a lawyer <https://www.lawsociety.org.nz/for-lawyers/joining-the-legal-profession/admi…>) [View Less]

2 1

Re: [nznog] Need assistance troubleshooting a DNS issue
by Glen Eustace 27 May '15

27 May '15

To satisfy the curious and to provide some closure on this incident, I have included a statement from Ryan Joe. The incident began approx last Oct/Nov and was resolved last week. I would like to thank Peter Lambrechtsen for getting the right people at Spark to contact me and for their perseverance working through what turned out to be more than one non-trivial issue. The impact, unfortunately, was not wide spread and hence had gone largely un-noticed but had the potential to impact a lot … [View More]

1 0

Random number generators
by Nathan Ward 25 May '15

25 May '15

Hi all, As we all know, random numbers are an important part of cryptography, which is required for tools that are important to network operators like the widely deployed RPKI. Most systems today generate random numbers using a PRNG, rather than a dedicated hardware random number generator. A PRNG is only as good as its entropy source - if you have a small amount of entropy, an attacker can start to predict the output of your system’s PRNG, which is obviously bad. There are a number of … [View More]

8 14

Dark fibre in the outer wilderness of... Parnell
by Matthew Poole 24 May '15

24 May '15

Hi all I'm getting discouraging information on the availability of dark fibre around the bottom end of St George's Bay Rd in Parnell, near Xero and the Textile Centre. Seems that nobody has any, or at least nobody is mentioning any. If anyone knows of dark fibre capacity in that area could they please contact me off-list. Cheers -- Matthew Poole "The difference between theory and practice is that practice is easier in theory than theory is in practice"

3 3

Re: [nznog] Random number generators
by Nathan Ward 23 May '15

23 May '15

> On 24/05/2015, at 15:12, Dean Pemberton <dean(a)deanpemberton.com> wrote: > > > I can't imagine that if you were an ISP you wouldn't know exactly where any TrueNet probes were in your network. That is possibly true if you’ve paid TrueNet for probes. If your customers have opted to have one without your involvement (which I assume is possible, given ComCom give them money to do just that across NZ) then that’s unlikely. > The only question then is which of the … [View More]

1 0

Anyone else having GGIS speed problems?
by Nathan Ward 19 May '15

19 May '15

Hi all, Beware, operational content. A couple of hours ago I started noticing weird things getting to stuff overseas. Looks like GGIS have some sort of path flapping that doesn’t care about IP flows. I see RTT to sites in the US jump from ~125ms to ~160ms several times per second, which to me is indicative of going the short and long way around the SXC network, respectively. # hping3 -S -p 80 216.146.46.10 HPING 216.146.46.10 (eth0 216.146.46.10): S set, 40 headers + 0 data bytes len=46 ip=… [View More]216.146.46.10 ttl=55 DF id=33739 sport=80 flags=SA seq=0 win=65535 rtt=129.1 ms len=46 ip=216.146.46.10 ttl=55 DF id=47972 sport=80 flags=SA seq=1 win=65535 rtt=132.3 ms len=46 ip=216.146.46.10 ttl=53 DF id=48561 sport=80 flags=SA seq=2 win=65535 rtt=159.6 ms len=46 ip=216.146.46.10 ttl=55 DF id=35481 sport=80 flags=SA seq=3 win=65535 rtt=128.1 ms len=46 ip=216.146.46.10 ttl=54 DF id=49791 sport=80 flags=SA seq=4 win=65535 rtt=158.7 ms len=46 ip=216.146.46.10 ttl=55 DF id=36729 sport=80 flags=SA seq=5 win=65535 rtt=132.2 ms len=46 ip=216.146.46.10 ttl=53 DF id=50960 sport=80 flags=SA seq=6 win=65535 rtt=158.8 ms len=46 ip=216.146.46.10 ttl=55 DF id=37839 sport=80 flags=SA seq=7 win=65535 rtt=129.1 ms len=46 ip=216.146.46.10 ttl=55 DF id=38397 sport=80 flags=SA seq=8 win=65535 rtt=129.2 ms len=46 ip=216.146.46.10 ttl=54 DF id=39075 sport=80 flags=SA seq=9 win=65535 rtt=158.8 ms The above example is a bunch of SYN packets so are different L4 flows so it’d be *sort of* reasonable for them to go different ways. However, you see plenty of out of order TCP packets if you do a long running flow (like say trying to load a web page with large objects, such as speedtest.net) Out of order packets means TCP cries a bunch and goes slow. This is the effect I see. Note also the TTL differences and correlation to RTT. I do not see the TTL hopping around when looking at a single TCP stream, though I do see different TTLs on two concurrent streams, so I suspect that’s some other ECMP happening that isn’t a problem. Who knows where that might be, but I don’t believe it’s important. This particular host I have tested to is the speedtest.net main web server. I see the out of order packets when doing a regular speedtest.net test to the Sonic.net endpoint in California (I think San Jose?). Here is what mtr sees when tracing to the same host as above. It is unclear to me why hop 9 doesn’t see the same weird latency. It sees it sometimes, but not all the time. Perhaps there’s something about the way mtr sends packets that means the hashing is different over some sort of aggregate interface/ECMP thing. Maybe that’s where our TTL difference from above happens. I *always* see the frequent latency changes (jitter, I guess) on hop 8. 7.|-- ae1-10.tkbr12.global-gate 0.0% 10 3.3 3.5 2.2 5.3 0.7 8.|-- xe-0-0-7-3.sjbr3.global-g 0.0% 10 130.5 136.1 126.3 163.1 14.2 9.|-- ae0.pabr5.global-gateway. 0.0% 10 154.8 154.7 154.1 155.9 0.5 Here are some more samples that show the differences in later hops, but always hop 8 having jitter: 7.|-- 202.50.232.37 0.0% 10 3.5 3.2 1.5 4.1 0.7 8.|-- 122.56.127.22 0.0% 10 160.2 148.0 127.7 160.2 15.0 9.|-- 122.56.127.25 0.0% 10 158.2 148.6 132.2 166.9 14.3 10.|-- 203.96.120.74 10.0% 10 159.0 159.0 158.2 160.0 0.4 11.|-- 4.28.172.109 0.0% 10 167.6 171.3 166.3 207.7 12.8 7.|-- 202.50.232.37 0.0% 10 2.9 3.3 2.7 4.2 0.3 8.|-- 122.56.127.22 10.0% 10 159.3 147.1 126.6 168.7 17.1 9.|-- 122.56.127.25 10.0% 10 158.7 146.9 132.5 166.3 13.8 10.|-- 203.96.120.74 10.0% 10 159.7 158.8 158.0 159.7 0.0 11.|-- 4.28.172.109 20.0% 10 167.0 167.4 166.8 168.1 0.0 At least two providers have (or are in the process of) logging faults, so I figured it’s appropriate to bring it on to the list. Is anyone else seeing this behaviour? Do you have any feedback from GGIS yet? Have you had any customers complain about poor speeds/user experience? -- Nathan Ward [View Less]

1 0

Situations Vacant: Network Operations Team Leader
by Mark Foster 07 May '15

07 May '15

'evening folks. A quick 'sits vacant' advertisement; my Network Operations Team Leader is heading across the ditch for a new role shortly and I'm beginning the recruiting process to replace him. Looking for someone who speaks BGP and MPLS reasonably fluently and can help manage our network, managed security and datacentre operations, and also has some leadership potential (with two direct-reports to manage, in addition to the technical skills sought). If you're interested or know someone who … [View More]

1 0

Bitcoin/DDoS Ransoms
by Dean Pemberton 06 May '15

06 May '15

Hi all, Wearing my NZITF hat this time. We've put out a release this morning to get the message our about the latest round of "Pay us Bitcoin or your network gets DDoSed' You can see the release here: http://nzitf.org.nz/news.html But why I really wanted to address this audience was that one of our suggestions to organisations is... · Establish points of contact with your Internet Service Providers (ISP) in the event that you need them to perform traffic filtering. Defence against many … [View More]

3 3

Cisco Fellow Fred Baker - OpenStack on IPv6: Authorization vs Routing
by Nathan Ward 05 May '15

05 May '15

Hi, Apologies to those who are on InternetNZ members-discuss who’re seeing this for a second time. This looks like it would be fairly interesting for some people on the list. I’d be going myself if I’d known about it sooner! Thanks to Hamish MacEwan for posting it originally. -- Fri, May 8, 10:00 – 12:00 Cotton Club, Cotton 350 ECS Seminars Description Fred Baker will discuss concepts and a project in an architecture for OpenStack/IPv6, with a view to simplification and scaling in … [View More]

1 0

APNIC 40 Conference - Call for Papers
by Elly Tawhai 29 Apr '15

29 Apr '15

________________________________________________________________________ APNIC 40 Conference - Call for Papers ________________________________________________________________________ Hi NZNOG Community, The APNIC 40 Program Committee is now seeking presentations for the APNIC 40 Conference in Jakarta, Indonesia. We are looking for content that would suit the APOPS Plenary, technical conference sessions, lightning talks and Birds of Feather (BoF) sessions. Key Dates --------- The … [View More]

1 0

IANA AS Numbers registry update
by Selina Harrington 29 Apr '15

29 Apr '15

Hi, The IANA AS Numbers registry has been updated to reflect the allocation of the following block to ARIN in April 2015: 64198-64296 Assigned by ARIN 2015-04-29 394240-395164 Assigned by ARIN 2015-04-29 You can find the IANA AS Numbers registry at: http://www.iana.org/assignments/as-numbers/as-numbers.xml The allocation was made in accordance with the Policy for Allocation of ASN Blocks to Regional Internet Registries: https://www.icann.org/resources/pages/global-policy-asn-blocks-2010-… [View More]

1 0

Re: [nznog] Looking for data on how much Netflix/SVOD data NZ ISPs are seeing
by Richard Naylor 28 Apr '15

28 Apr '15

At 09:23 a.m. 29/04/2015, Barry Murphy wrote: >Obviously the cache fill that happens between >midnight and mid-day consumes some bandwidth, we >find the fill capacity (after the initial fill) >is about 1.2gbps for on average 2-4 hours per day. >We currently share our cache on Megaport IX >Auckland, in doing so we find weâre filling a >few other providers caches so they donât have >to fetch it from AU, so this may be helping some providers. Thanks Barry - Thats … [View More]REALLY useful. I'm involved in downstream activity in 2 areas. First - Uploading We have a current project moving some older videos from a server in NZ to Vimeo. Theres a weekly 20GB limit on uploads and an ugly web uploader (no restarts and a break means a complete re work). Using ADSL its pretty ugly. It takes 3.5 days to get 20-30GB up and ADSL 'breaks' make life a real pain. So I pay a local church to use their UFB. We find that uploading during the day conflicts with US based uploaders, so only get 10Mbps upload. If I wait until 5pm, we get a pretty good 100Mbps and the 20GB is up in about an hour. The first time we did it a 2.5G file that took 12 hours ( and failed) on ADSL went up in 4 minutes. Looking at the graph, it seems we have a nice window between 5pm and 8 or 9pm to do our uploads. Thats great to know. The second issue - Live feeds. We're doing quite a bit of live TV feeding using the net now. We have RX points with both TVNZ and TV3 - and also Sky Sport UK. The local TV companies are OK - its local (bounces out of SYD) and only SD and they don't really trust this IP stuff. Sky UK is different. We send them HD at 4Mbps and after some small adjustments for latency, can do live crosses with 3 sec delay (4 sec total allowing for return audio for the talent earpiece). NZ to UK is pretty solid. The other night we tried UK to NZ. NZ RX was via ADSL. We found we could only get a 1Mbps feed going. (vs 4Mbps going the other way) We need to do more testing as there are feed aggregation points and they are different depending on direction, but we have been wondering if there was congestion along the way causing the issue. If so we need to avoid doing crosses during the 'flix' peak. We are also going to test where we do the feed aggregation to see if that helps. Currently NZ to UK has aggregation in London, while UK to NZ has aggregation in LAX. We think its the LAX to NZ leg that suffers. More testing required. Richard [View Less]

1 0

Looking for data on how much Netflix/SVOD data NZ ISPs are seeing
by Dean Pemberton 28 Apr '15

28 Apr '15

Hi Everyone. Following recent media articles making mention of "the Netflix effect" and broadband slowdowns at peak times, we've had a number of requests to see if we could pull together some facts from NZ ISPs detailing what they are actually seeing. So the question is... How much Netflix/SVOD traffic are you seeing, either as a direct measurement or percentage of total traffic. Does this percentage change at all during the day/week. I realise that this may be considered commercially … [View More]

2 1

Need assistance troubleshooting a DNS issue
by Glen Eustace 26 Apr '15

26 Apr '15

>From about October/November last year we have been getting the odd call from some of our customers to report that our servers are ‘not found’. So far, each report has been from an Xtra broadband user. When investigating these reports we have found that the servers were fine and DNS lookups from various sources (except Xtra) were as well. Last night the issue happened to a member of the family so I was able to jump onto their computer using Teamviewer and do some more thorough diagnostics. … [View More] My results were; Name servers in use: ns1.xtra.co.nz <http://ns1.xtra.co.nz/> and ns2.xtra.co.nz <http://ns2.xtra.co.nz/> Name servers pingable from PC: Yes Does smtp.godzone.net.nz <http://smtp.godzone.net.nz/> resolve: No, times out Do other resources in our DNS resolve: No, time out Do resources in other DNS servers resolve: Yes Are all 4 of our name servers pingable from PC: Yes, 2 in NZ and 2 offshore Use nslookup to query our name servers directly, does smtp.godzone.net.nz <http://smtp.godzone.net.nz/> resolve: Yes Use nslookup to query our name servers using 8.8.8.8, does smtp.godzone.net.nz <http://smtp.godzone.net.nz/> resolve: Yes To fix the issue on the PC, I manually set the name servers to 8.8.8.8 and 8.8.4.4, all our services were then resolvable and useable. So, whats going on ? How are our servers different ? Well, we are one of the few ISPs that are using DNSSec to sign zones. Is DNSSec broken ? Not according to dnsviz.net <http://dnsviz.net/> The problem is also intermittent, I have heard that the two Xtra servers are actually LB VIPs in front of a farm of name servers. With the intermittent nature of the issue I wonder whether one server in the farm might be broken/misconfigured, just a thought. I have tried, without success to contact appropriate people at Xtra to either comment or assist and have failed to get past the level one helpdesk people. Their only response being “Sorry we can’t help you”. I am not saying this is an issue with Xtra’s internal recursive DNS servers but so far I have been unable to replicate the issue and have had no reports from any of our other customers using alternative broadband suppliers. I have run out of ideas now on how to continue to investigate this and just changing to Google’s DNS servers might work but isn’t a great solution. If anyone has any suggestions I’d appreciate hearing from you. Glen. -- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Glen and Rosanne Eustace, GodZone Internet Services, a division of AGRE Enterprises Ltd., P.O. Box 8020, Palmerston North, New Zealand 4446 Ph: +64 6 357 8168 <tel:%2B64%206%20357%208168>, Fax: +64 6 357 8165 <tel:%2B64%206%20357%208165>, Mob: +64 27 542 4015 <tel:%2B64%2027%20542%204015> "Specialising in providing low-cost professional Internet Services since 1997" [View Less]

8 12

MyRepublic Hamilton Outage
by Laurence Bullivant 26 Apr '15

26 Apr '15

Morning, This is more of a curiosity post then anything else, but does anyone know what is going on with the MyRepublic outage in Hamilton? Its gone past 72hours now and the only thing that is being said is that its a fault with the UFF handover. I don't know about anyone else but the idea of upstream provided having a fault that could take down an entire region for more then three days makes me a little nervous. Time to go check those SLA's anyone? -- Laurence Bullivant laurence(a)… [View More]

1 1