- NZNOG - lists.nznog.org

APNIC 38 Call for Papers
by Dean Pemberton 05 May '14

05 May '14

___________________________________________________________________ APNIC 38 Conference - Call for Papers ___________________________________________________________________ The APNIC 38 Program Committee is now seeking presentations for the APNIC 38 Conference to be held in Brisbane, Australia, from 15 - 19 September 2014. We are looking for content that would suit the APOPS Plenary, technical conference sessions, and tutorials. Key dates --------- The timeline for submissions is: Call for Papers Opens Now First Round Paper Acceptance 1 August Final Deadline for Submissions 29 August Final Round Paper Acceptance 5 September Final Slides Received 12 September Submitting Proposals -------------------- Please submit your proposal for a presentation, technical session, or tutorial at: http://submission.apnic.net/user/login.php?event=14 Program material ---------------- The technical sessions at APNIC 38 will include presentations relevant to Internet operations and technologies. Possible areas of interest include: - IPv6 deployment and operations - IPv6 transition / IPv4 prolongation technologies - ISP and Carrier Services - IXPs and Peering - Network and Infrastructure security - Access and Transport Technologies - Content and Service Delivery - Software Defined Networking and Network Function Virtualization If you have any other ideas or proposals for panel or Birds of a Feather sessions, please feel free to submit your ideas via the submission system. If you have any questions, please email the Program Committee chairs at: pc-chairs(a)apricot.net For more information about APNIC 38, please visit: http://conference.apnic.net/38 On behalf of: APNIC 38 Program Committee Co-chairs: Dean Pemberton, Mark Tinka, and Raphael Ho

1 0

AusNOG 2014 Call for Presentations
by Mark Prior 05 May '14

05 May '14

Call for presentations for AusNOG 2014 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Swissotel Sydney 4 & 5 September 2014 Topics =-=-=- Internet operations can be a broad topic and the programme committee will be short-listing presentations in the following focus areas: * Improving the redundancy/resiliency/sustainability of your network * Making leaps in service or network availability * Taking the network operations BCP to the next level * Using 'offline' communications tools to keep the network working * How technology is changing network architectures * Evolution in network architectures and scaling issues * Analysis of relevant major operational events of the year This year we will be reintroducing a "Peering Forum". In this part of the programme we hope to include: * Peering related talks * Peering personals from various networks * IX updates Additional topics that are of interest to the network operator community are also welcome at AusNOG 2014. Naturally, presentations of a marketing nature are not welcome at this technical event. Notes to presenters =-=-=-=-=-=-=-=-=-= Preference will be given to presentations that result in actual operational outcomes. Session speakers should be prepared to present for 30 minutes. Keynote speakers will be expected to present for 45 minutes to 1 hour. Short presentations of strong operational content are also acceptable. Once the final slides are submitted, changes will only be permitted where the presentation requires the most up to date information or data. By submitting a presentation for consideration in the AusNOG 2014 programme, and if selected the presenter will allow AusNOG to: * Take photographs of the presentation and presenter * Record and rebroadcast video and audio of the presentation and presenter * Redistribute the presentation slides, audio, video, and photographs electronically, on the AusNOG website, or otherwise but leaving all intellectual property in the hands of presenter or rightful property holder[1]. Deadlines =-=-=-=-= 09 June: Submission of presentation title, presentation description (300 words), and presenter biography (200-400 words) 04 July: Presenters notified of their acceptance status as an AusNOG 2014 presentation. 27 August: Submission of final presentation slides as Portable Document Format (pdf), PowerPoint, or Keynote. Provision of a recent digital photograph (<500k) of the presenter. All submissions must be sent to organisers at ausnog.net. A separate call for lightning talks will be made closer to the AusNOG 2014 event. As in previous years you must be registered to attend AusNOG 2014 in order to be considered for a lightning talk. [1]: AusNOG accepts that some speakers are unable to allow us to archive their presentation due to company or corporate policy, and if the situation arises AusNOG will delete all copies in its possession after the presentation. Mark. For the AusNOG Board

1 0

clear.net.nz maintainers
by Al Twohill 04 May '14

04 May '14

Hi, Does anyone from Vodafone who looks after the Clear email servers lurk about here? I've had an issue going no-where with L1 support for the past 6 months.. Would greatly appreciate a contact off list. Cheers, Al

1 0

2 of 3 IPv6 DNS servers broken?
by Pete Mundy 27 Apr '14

27 Apr '14

Dear list Is anyone from Snap network ops watching who is involved in IPv6 or DNS? I'm not officially a Snap customer yet (1 week to go) so I guess trying to put this through the helpdesk might not be the best approach. Just wanted to give you guys a heads up really that only 1 of the 3 published NS appear to be responding to DNS queries via IPv6 (but they do all respond to ping6). See transcripts below. They were taken from a Snap UFB link. It all works fine via v4. I guess maybe others on the list with native v6 could test to confirm that this is also the case as seen from elsewhere? Eg perhaps from a non-Snap link? My v6 visibility is still a bit limited. Just a Raspberry Pi stuck behind a Fritzbox on Snap UFB for testing. Maybe something is 'on the fritz'?! Pete root(a)fpl-rpi16:~# ping6 -c 1 ns1.snap.net.nz PING ns1.snap.net.nz(2406:e000::100) 56 data bytes 64 bytes from 2406:e000::100: icmp_seq=1 ttl=251 time=10.0 ms --- ns1.snap.net.nz ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 10.048/10.048/10.048/0.000 ms root(a)fpl-rpi16:~# dig -6 SOA snap.net.nz @ns1.snap.net.nz ; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> -6 SOA snap.net.nz @ns1.snap.net.nz ;; global options: +cmd ;; connection timed out; no servers could be reached root(a)fpl-rpi16:~# ping6 -c 1 ns2.snap.net.nz 64 bytes from 2406:e000::200: icmp_seq=1 ttl=251 time=9.98 ms --- ns2.snap.net.nz. ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 9.985/9.985/9.985/0.000 ms root(a)fpl-rpi16:~# dig -6 SOA snap.net.nz @ns2.snap.net.nz ; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> -6 SOA snap.net.nz @ns2.snap.net.nz ;; global options: +cmd ;; connection timed out; no servers could be reached root(a)fpl-rpi16:/home/ladmin# ping6 -c 1 ns3.snap.net.nz PING ns3.snap.net.nz(2406:e000::300) 56 data bytes 64 bytes from 2406:e000::300: icmp_seq=1 ttl=251 time=11.4 ms --- ns3.snap.net.nz ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 11.433/11.433/11.433/0.000 ms root(a)fpl-rpi16:~# dig -6 SOA snap.net.nz @ns3.snap.net.nz ; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> -6 SOA snap.net.nz @ns3.snap.net.nz ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57245 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 6 ;; QUESTION SECTION: ;snap.net.nz. IN SOA ;; ANSWER SECTION: snap.net.nz. 86400 IN SOA ns1.snap.net.nz. soa.snap.net.nz. 2014040202 10800 3600 604800 86400 ;; AUTHORITY SECTION: snap.net.nz. 86400 IN NS ns2.snap.net.nz. snap.net.nz. 86400 IN NS ns1.snap.net.nz. snap.net.nz. 86400 IN NS ns3.snap.net.nz. ;; ADDITIONAL SECTION: ns1.snap.net.nz. 86400 IN A 202.37.101.1 ns1.snap.net.nz. 86400 IN AAAA 2406:e000::100 ns2.snap.net.nz. 86400 IN A 202.37.101.2 ns2.snap.net.nz. 300 IN AAAA 2406:e000::200 ns3.snap.net.nz. 86400 IN A 202.37.101.3 ns3.snap.net.nz. 300 IN AAAA 2406:e000::300 ;; Query time: 35 msec ;; SERVER: 2406:e000::300#53(2406:e000::300) ;; WHEN: Sun Apr 27 19:34:48 2014 ;; MSG SIZE rcvd: 255

2 1

SPF and mail forwarding, best practice?
by Richard Hector 25 Apr '14

25 Apr '14

Hi all, I'm in an organisation that uses a forwarding mailserver to give (some) members user(a)organisation email addresses, which get forwarded to their regular address. The trouble is, I have SPF on my domain, and one at least of the receiving MTAs checks it, and my mail gets rejected as a consequence. What's the best solution? Do I (and anybody else who might mail us) need to turn off SPF, or make it less strict? Does the forwarding server need to remail rather than forward? Do we need to persuade the receiving mail admins to whitelist our forwarder (there could be many others)? Should the organisation mailserver just operate an IMAP/POP/Webmail service rather than forwarding, so that this never arises (my favourite)? Any tips? Thanks, Richard

4 5

New RIPE NCC contribution to the IANA IPv4 Recovered Address Space registry
by Leo Vegoda 23 Apr '14

23 Apr '14

Hi, In April 2014, ICANN updated the IANA IPv4 Recovered Address Space registry to reflect the return of 14 /24 prefixes (5,376 IPv4 addresses) by the RIPE NCC. The updated registry can be found at: https://www.iana.org/assignments/ipv4-recovered-address-space Kind regards, Leo Vegoda ICANN IANA

3 4

InTAC 2014
by Dean Pemberton 22 Apr '14

22 Apr '14

Morning all. InTAC conference to be held again on the 9th of July in Auckland. The participants at last years conference gave plenty of feedback as to the directions that they wanted to see the Internet within New Zealand take. Feedback was that there needed to be more focus on the following areas: . Technical issues relating to the security of the infrastructure of the New Zealand Internet . Technical mechanisms to assist in the development of more appropriate Authentication, Identity and Trust systems relating to the use of the Internet . Technical ways to ensure the Future-proofing the infrastructure of the New Zealand Internet. What I'm suggesting for InTAC this year is the following structure... Welcome 45 Min - On DNSSEC 45 Min - On RPKI Morning Tea 45 Min - On Identity and trust online 45 Min - On Authentication (federated signon, 2fa, lockers) Lunch 45 Min - On SDN 45 Min - On UFB Afternoon Tea Open discussion Networking Drinks Does anyone have any feedback before I look to secure topic speakers and make it a real thing? -- Dean Pemberton Technical Policy Advisor InternetNZ +64 21 920 363 (mob) dean(a)internetnz.net.nz <javascript:;> To promote the Internet's benefits and uses, and protect its potential. -- -- Dean Pemberton Technical Policy Advisor InternetNZ +64 21 920 363 (mob) dean(a)internetnz.net.nz To promote the Internet's benefits and uses, and protect its potential.

2 2

Re: [nznog] CARDIGAN implements RPKI - Cleanliness of prefixes onWIX
by Andrew Niteesh 21 Apr '14

21 Apr '14

Hi, I have few clarifications, the table you shown have matric, local preference, path and next hop. 1. So how you are setting up these attributes in SDN? (Or) you have an application developed for BGP? (Or) you are running SDN on top of traditional networks? 2. What is Route flow - according to my understanding it's like getting connecting a set of open flow capable switches to single controller. Please correct me if am wrong. Thanks & Regards, Andrew Niteesh University of Houston

2 1

[OT] 3g on mikrotik
by Rob McDonald 21 Apr '14

21 Apr '14

Hey all, Sorry for the OT post... Does anyone have experience with USB 3g sticks on Mikrotik routerboards? I've had quite a long look around, and without resorting to trial and error I thought someone here might be able to share their winning numbers with me. Cheers Rob *Rob McDonald | *Director Level 2 Systems Ltd *M:* +64 21 902 929 *eFax:* +64 9 974 4734 *W:* http://www.L2.co.nz <http://www.l2.co.nz/>

3 3

Message concerning Certs
by Michael Sutton 19 Apr '14

19 Apr '14

NZNOG members: My apologies but all attempts to send the text content of this PDF this morning have been blackholed until I managed to send the contents to InternetNZ PAG as a PDF which made it through filters which been stopping this content. I have had no problem send other messages etc. Your comments would be appreciated as I see this as a major issue which may require all certificates to be regenerated and then only used on patched systems whose memory and priv keys cannot read copied by external parties. Sincerely Michael S Sutton Director - Awacs Communications (NZ) Limited Transit Room The Dominion Observatory 34 Salamanca Road Kelburn Wellington +64 21 305500 Twitter & Skype: Mikiwis http://www.awacs.co.nz https://www.google.co.nz/#q=michael+sutton+nokia+patent http://www.linkedin.com/profile/view?id=16587996&trk=tab_pro

9 13

Heartleech tool
by Juha Saarinen 15 Apr '14

15 Apr '14

https://github.com/robertdavidgraham/heartleech >From the read me: A typical "heartbleed" tool. What makes this different is: autopwn most (-a) that does all the steps needed to get private key post-handshake (encrypted) heartbeats instead of during handshake evades Snort IDS rules loops making repeated requests (-l <loopcount>) dumps binary data to file (-f <filename>) IPv4 or IPv6 (-v <IPver>) full 64k heartbleeds -- Juha Saarinen twitter: juhasaarinen

4 3

Fake domain renewal invoices
by Richard Hulse 14 Apr '14

14 Apr '14

I got one of these just now from Domain Renewal Group, so beware. It was sent to someone else in our organisation, who fortunately brought it to me instead of approving and paying it.

3 2

Heartbleed - clients at risk too
by Juha Saarinen 11 Apr '14

11 Apr '14

Morning. Just saw this: http://vrt-blog.snort.org/2014/04/heartbleed-continued-openssl-client.html Which I thought might be useful to know. -- Juha Saarinen twitter: juhasaarinen

3 2

Snapchat question
by Tony Wicks 10 Apr '14

10 Apr '14

Hi all, we have had some users say they intermittently can't use this application. After downloading this app (and deciding it should go into the why the hell was that ever invented pile) it seems a bit difficult to fault find any issues. Does anyone know how this thing communicates ? Is it normally intermitttant ? Thanks all

2 1

Heartbleed OpenSSL Vulnerability
by Dean Pemberton 10 Apr '14

10 Apr '14

Hi All, NZITF (in conjunction with InternetNZ) have been endeavouring to raise awareness about this issue. We have compiled some information on our website, which may be of use to you and/or your clients. Please feel free to share this link as widely as you see fit. http://www.nzitf.org.nz/news.html The NZITF is treating this as an ongoing security issue with significant implications. As a result we are intending to monitor this situation and update our advice as required. We have tree basic messages for website owners: 1. Establish if your site's servers are vulnerable. 2. Patch the vulnerable servers. 3. Revoke/reissue keys and certificates. If you are vulnerable it is imperative that you do steps 2 AND 3. Not one, but both. You should also be encouraged to discuss this very important issue with your regular security consultants. If you have feedback or information please feel free to contact me so we can include it in the advice on the website. Regards, Dean

17 19

Re: [nznog] [PAG] Message concerning Certs
by Ewen McNeill 08 Apr '14

08 Apr '14

On 2014-04-09 22:40 , Dean Pemberton wrote: > And from the same twitter thread saying it was unlikely... > [can extract private key on vulnerable FreeBSD if it is first request] "first request after restart" is a special case too ("possible, but unlikely"). The same thread/poster also says: "[...] Does not work on Debian. [...]" (also https://twitter.com/1njected/status/453781230593769472) which implies (as noted in that thread) something about the FreeBSD malloc patterns makes it more likely/possible than Debian's malloc. Those (who were) running a vulnerable OpenSSL on FreeBSD may wish to take that into account in their assessment :-) The main thing which is certain is that it's going to be a well studied/probed bug. Ewen

1 0

Re: [nznog] Message concerning Certs
by Michael Sutton 08 Apr '14

08 Apr '14

The exploit has been rumoured for some time. Does it matter who the primary actors are. They have all the private keys by now and g's/s-view/wifi/scan has the other half; so that deals with the white-hats. All historical data dumps can be retrospectively analysed at any time for eternity at ones leisure. As for the code which is in the wild I enclose a graph of 3 hours traffic from the http://filippo.io/Heartbleed/# site which is using something like 31 machines showing ~2000 sites being tested every minute, ~360,000 over 3hours and that is from a public site; an unknown% will be blackhats. This is catastrophic and you should believe it's not only our guys that have it but every other *worth their salt. InternetNZ almost became a CA in ~2004. We could have fixed this hole now for .nz with a working revocation system. Then INZ had a new team on board and it was .... The ironical blowback is that our "own" might be just as threatened by this. We just have to get on and deal with this as a priority tomorrow and for the next decade. I am a patriot by the way, Yours Michael amI#6 -----Original Message----- From: nznog-bounces(a)list.waikato.ac.nz [mailto:nznog-bounces(a)list.waikato.ac.nz] On Behalf Of Don Stokes Sent: Wednesday, 9 April 2014 8:37 p.m. To: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] Message concerning Certs Is there any indication out there as to how widely this bug has been exploited? I.e. if you've patched servers in the last 24 hours, how likely is it that your certificate keys have been leaked over the last months / year? Not looking for accurate numbers, just roughly where on the scale of, "this is possible but no reports of actual use" to "all the black hats have been doing this for years so you're screwed unless you re-issue and revoke your certs" the exploit lies. Also, last time I worried about this, certificate revocation was, uh, largely unimplemented. That was a while ago. How well does it work now? And with potentially large numbers of revoked certs? -- don _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Callplus postmaster contact
by Jean-Francois Pirus 08 Apr '14

08 Apr '14

Can a Callplus/Slingshot/Tranzpeer postmaster contact me. We're having issue with forward emails for our clients to Callplus addresses, the clients are complaining mail is being dropped. PS: I have tried contacting postmaster(a)callplus.net.nz and this is what I got after 4 days: > This message was created automatically by mail delivery software. > A message that you sent has not yet been delivered to one or more of its > recipients after more than 72 hours on the queue on mxdsrv1.tranzpeer.net. > > The message identifier is: 1WTNur-0005YH-G5 > The subject of the message is: Mail server issue: > The date of the message is: Fri, 28 Mar 2014 16:47:21 +1300 > > The address to which the message has not yet been delivered is: > > sysops(a)noc.tranzpeer.net > (generated from postmaster(a)callplus.net.nz) > Delay reason: SMTP error from remote mail server after RCPT TO:<sysops(a)noc.tranzpeer.net>: > host 192.168.69.1 [192.168.69.1]: 451 4.3.2 Please try again later Our logs are full of the following: Apr 8 12:41:40 tiny postfix/smtp[14531]: 4FE0DDFA92F: host mxi1.callplus.net.nz[202.180.66.203] refused to talk to me: 421 4.7.0 Not allowed. Apr 8 12:41:40 tiny postfix/smtp[14532]: B7E63DFA8DC: host mxi1.callplus.net.nz[202.180.66.203] refused to talk to me: 421 4.7.0 Not allowed. Apr 8 12:41:40 tiny postfix/smtp[14537]: 9B205DFA940: host mxi1.callplus.net.nz[202.180.66.203] refused to talk to me: 421 4.7.0 Not allowed. Apr 8 12:41:40 tiny postfix/smtp[14537]: 9B205DFA940: to=<BLAH(a)slingshot.co.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=1347, delays=1346/0.58/0.06/0, dsn=4.7.0, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] refused to talk to me: 421 4.7.0 Not allowed.) Apr 8 12:41:52 tiny postfix/smtp[14530]: 4B069DFA8E2: host mxi1.callplus.net.nz[202.180.66.203] said: 451 4.3.2 Please try again later (in reply to RCPT TO command) Apr 8 12:41:52 tiny postfix/smtp[14531]: 4FE0DDFA92F: to=<BLAH(a)callplus.net.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=1391, delays=1379/0.25/0.1/12, dsn=4.3.2, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] said: 451 4.3.2 Please try again later (in reply to RCPT TO command)) Apr 8 12:41:52 tiny postfix/smtp[14532]: B7E63DFA8DC: to=<BLAH(a)callplus.net.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=1866, delays=1853/0.29/0.1/12, dsn=4.3.2, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] said: 451 4.3.2 Please try again later (in reply to RCPT TO command)) Apr 8 12:42:04 tiny postfix/smtp[14530]: 4B069DFA8E2: to=<BLAH(a)callplus.net.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=1790, delays=1766/0.25/12/12, dsn=4.3.2, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] said: 451 4.3.2 Please try again later (in reply to RCPT TO command)) Apr 8 12:56:58 tiny postfix/smtp[17081]: E3622DFA91C: host mxi1.callplus.net.nz[202.180.66.203] refused to talk to me: 421 4.7.0 Not allowed. Apr 8 12:56:59 tiny postfix/smtp[17081]: E3622DFA91C: to=<BLAH(a)slingshot.co.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=0.07, delays=0.01/0/0.05/0, dsn=4.7.0, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] refused to talk to me: 421 4.7.0 Not allowed.) Apr 8 13:00:24 tiny postfix/smtp[17832]: 061A4DFA8F6: host mxi1.callplus.net.nz[202.180.66.203] said: 451 4.3.2 Please try again later (in reply to RCPT TO command) Apr 8 13:00:36 tiny postfix/smtp[17832]: 061A4DFA8F6: to=<BLAH(a)callplus.net.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=24, delays=0.02/0.01/12/12, dsn=4.3.2, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] said: 451 4.3.2 Please try again later (in reply to RCPT TO command)) Apr 8 13:01:22 tiny postfix/smtp[17829]: D7FB0DFA91F: host mxi1.callplus.net.nz[202.180.66.203] said: 451 4.3.2 Please try again later (in reply to RCPT TO command) Apr 8 13:01:34 tiny postfix/smtp[17829]: D7FB0DFA91F: to=<BLAH(a)slingshot.co.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=25, delays=0.64/0.04/12/12, dsn=4.3.2, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] said: 451 4.3.2 Please try again later (in reply to RCPT TO command)) Apr 8 13:02:06 tiny postfix/smtp[17851]: 4F55DDFA934: host mxi1.callplus.net.nz[202.180.66.203] said: 451 4.3.2 Please try again later (in reply to RCPT TO command) Apr 8 13:02:15 tiny postfix/smtp[17832]: 1ABBEDFA0E0: host mxi1.callplus.net.nz[202.180.66.203] said: 451 4.3.2 Please try again later (in reply to RCPT TO command) Apr 8 13:02:18 tiny postfix/smtp[17851]: 4F55DDFA934: to=<BLAH(a)slingshot.co.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=24, delays=0.02/0/12/12, dsn=4.3.2, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] said: 451 4.3.2 Please try again later (in reply to RCPT TO command)) Apr 8 13:02:27 tiny postfix/smtp[17832]: 1ABBEDFA0E0: to=<BLAH(a)callplus.net.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=24, delays=0.01/0.01/12/12, dsn=4.3.2, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] said: 451 4.3.2 Please try again later (in reply to RCPT TO command)) Apr 8 13:15:04 tiny postfix/smtp[20825]: 4D5B9DFA923: host mxi1.callplus.net.nz[202.180.66.203] said: 451 4.3.2 Please try again later (in reply to RCPT TO command) Apr 8 13:15:16 tiny postfix/smtp[20825]: 4D5B9DFA923: to=<BLAH(a)callplus.net.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=24, delays=0.07/0/12/12, dsn=4.3.2, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] said: 451 4.3.2 Please try again later (in reply to RCPT TO command)) Apr 8 13:16:39 tiny postfix/smtp[21318]: 377AFDFA8DC: host mxi1.callplus.net.nz[202.180.66.203] said: 451 4.3.2 Please try again later (in reply to RCPT TO command) Apr 8 13:16:51 tiny postfix/smtp[21318]: 377AFDFA8DC: to=<BLAH(a)callplus.net.nz>, relay=mxi2.callplus.net.nz[202.180.66.204]:25, delay=24, delays=0.01/0/12/12, dsn=4.3.2, status=deferred (host mxi2.callplus.net.nz[202.180.66.204] said: 451 4.3.2 Please try again later (in reply to RCPT TO command)) Apr 8 13:24:14 tiny postfix/smtp[21330]: 8FF10DFA8E2: host mxi1.callplus.net.nz[202.180.66.203] said: 451 4.3.2 Please try again later (in reply to RCPT TO command) Apr 8 13:31:51 tiny postfix/smtp[24414]: 1ABBEDFA0E0: host mxi1.callplus.net.nz[202.180.66.203] said: 451 4.3.2 Please try again later (in reply to RCPT TO command) etc... Thanks. -- Jean-Francois Pirus | Technical Manager francois(a)clearfield.com | Mob +64 21 640 779 | DDI +64 9 282 3401 Clearfield Software Ltd | Ph +64 9 358 2081 | www.clearfield.com

7 7

ICONZ-Webvisions (NZ) to cease operating externally-reachable NTP servers
by Mark Foster 07 Apr '14

07 Apr '14

Hiya folks - again... ! :-) ICONZ-Webvisions (the entity formerly known simply as ICONZ in NZ) are making changes to their NTP server arrangements on the evening morning of 10 April (so, overnight tomorrow night). The details of the changes being made can be viewed at: http://iconz-webvisions.com/en/support/outages/new-zealand In short, if you have been using 'ntp.iconz.net' or 'ntp.iconz.co.nz' by DNS name, you'll have already seen a change; this now is CNAME'd to s2.ntp.net.nz (which happens to sit in our DC)[1]. Anyone who has been using any of our (very long lived) NTP servers by IP address, these IP's will stop responding to NTP queries from outside of our network, in the wee hours of 10 April. Much like the DNS changes recently made, this is most likely to be noticed by people who've been using these IP's for historical or habitual reasons. Customers with concerns about this change are invited to contact our Customer Care team on 0800 843 638 or via support.nz(a)iconz-webvisions.com<mailto:support.nz(a)iconz-webvisions.com>. Non-customers, should probably change their NTP timesource to a publically available resource; I do very much value and recommend the services offered by NZRS, with details at www.ntp.net.nz<http://www.ntp.net.nz>. Regards Mark. [1] This was done in conjunction with NZRS and mainly as an 'interim' measure. Those DNS records may be removed completely at some stage in the future. Anyone using those hostnames should move to using services such as those offered by NZRS, and bypass our DNS entries completely, as soon as possible. -- Mark Foster Technical Services Manager - Australia & New Zealand [iconz-webvisions-logo-png] www.iconz-webvisions.com<http://www.iconz-webvisions.com/> ICONZ-Webvisions, ICONZ House, 60 Airedale Street, Auckland 1010, New Zealand

1 1

OpenSSL vulnerability
by Dean Pemberton 07 Apr '14

07 Apr '14

Here's one to keep an eye on. Seems to be getting a bit of attention. http://www.kb.cert.org/vuls/id/720951 http://heartbleed.com/ Work with your vendors to confirm if you're at risk.

1 0

tk[1-4].ihug.co.nz
by Joel van Velden 07 Apr '14

07 Apr '14

Hi List After Mark's announcement about removal of Iconz public ntp I thought I should check my ntpd configs. Can anyone from Vodafone give an update on tk[1-4].ihug.co.nz? After many mergers and acquisitions it occurs to me that perhaps these could be dusty machines under someone's desk that could disappear one day without announcement? Any official comment? Is there an official webpage about them? Regards, Joel van Velden

1 0

Software Defined Networking (SDN) Presentation
by Jay Best 07 Apr '14

07 Apr '14

Hey is anyone else going to this? I haven't seen many of you guys from NZNOG in ages, so would be good to catchup for old times sake! Cheers, J *Software Defined Networking (SDN) Presentation* Auckland Tourism, Events and Economic Development and Massey University invite you to an informative and engaging presentation by world leading New Zealand expert Mr. Josh Bailey from Google around SDN research in New Zealand and beyond. SDN has been generating a lot of press in the network industry and research worlds. While a community has arisen to energetically debate what SDN is? There are concrete research efforts and deployed systems exploring the implications of separating control and data planes. These include Google's B4 network (which connects Google data centers together) and uses OpenFlow and CityLink's efforts in New Zealand to produce an SDN controlled Internet exchange. This presentation will describe some recent research both here in NZ and in the US, including work at REANNZ and Victoria University on building and deploying an open source SDN controller and experiments including RPKI. Date: Monday, 14th April 2014 Time: 4.30pm - 6.30pm Venue: Room OR 4, Building 102 Massey Albany Campus Gate 4 Eastbourne Road, Old Albany Highway. Cost: Complimentary RSVP: Shona Alo (s.alo(a)massey.ac.nz) if you would like to attend

1 0

Bitstream 3a DHCP manipulation
by Dave Mill 07 Apr '14

07 Apr '14

Hi all I posted a few weeks ago about MAC limits on Bitstream 3a connections. This is related to that. This is a UFF Bitstream 3a connection. I've discovered that a customer's only complaint with a Bitstream 3a connection from us is that DHCP doesn't work over this. I've obtained some pcaps from both ends and I can see the following changes occurring to a DHCP Request: 1) The transaction ID is changed 2) Option 82 is added. More specifically, sub-option 1 Agent Circuit ID is present and has a valid length. sub-option 2 Agent Remote ID is present, has a length of 0 and no content which wireshark doesn't seem to like much. I've had a brief read of RFC3046 and I can't really tell if its valid to have a sub-option with a length of 0 or not. https://tools.ietf.org/html/rfc3046#page-8 I never see any DHCP ACKs coming back from the customer's DHCP server. I've had a read of some of UFF's Bitstream3a docs and can't see any mention of DHCP. I can see in one of our initial requests we had to fill out we can choose to have DHCP Relay Agent Functionality but this seems to be related to Bitstream2 only and also this defaults to be disabled. I don't know what DHCP server the customer is using right now but I hope to find this out soon. Questions for anyone with more experience in this than myself: -Can changing the DHCP Request transaction ID cause issues? -Has anyone come across DHCP servers not liking option 82 being set, or not liking sub-option 2 having a 0 length? -Has anyone successfully used DHCP across a Bitstream3a connection? How about a UFF Bitstream3a connection? -Am I missing anything obvious? Obviously I might end up talking to UFF over this but I just want to see what others on the list know before doing so. Again, I don't really want to debate the wisdom of plugging two LANs in over a Bitstream3a connection. Cheers Dave

9 12

Koru Club Wireless - Air NZ Contact
by Davey Goode 07 Apr '14

07 Apr '14

Hi All, Can someone from AirNZ who has knowledge of the wireless in the koru lounge please flick me a mail off list. cheers davey

1 0

IP Hijack out of Indosat Thailand
by Tony Wicks 03 Apr '14

03 Apr '14

Is anyone else seeing their IP ranges hijacked out of Thailand ? http://seclists.org/nanog/2014/Apr/49 http://seclists.org/nanog/2014/Apr/55 You received this email because you are subscribed to BGPmon.net. For more details about these updates please visit: https://portal.bgpmon.net/myalerts.php ==================================================================== Possible Prefix Hijack (Code: 10) ==================================================================== Your prefix: 103.9.40.0/22: Prefix Description: FLIP-AS-AP Update time: 2014-04-02 20:29 (UTC) Detected by #peers: 1 Detected prefix: 103.9.40.0/22 Announced by: AS4761 (INDOSAT-INP-AP INDOSAT Internet Network Provider,ID) Upstream AS: AS4651 (THAI-GATEWAY The Communications Authority of Thailand(CAT),TH) ASpath: 18356 38794 4651 4761 ==================================================================== Possible Prefix Hijack (Code: 10) ==================================================================== Your prefix: 103.224.128.0/22: Prefix Description: Flip Update time: 2014-04-02 19:42 (UTC) Detected by #peers: 1 Detected prefix: 103.224.128.0/22 Announced by: AS4761 (INDOSAT-INP-AP INDOSAT Internet Network Provider,ID) Upstream AS: AS4651 (THAI-GATEWAY The Communications Authority of Thailand(CAT),TH) ASpath: 18356 9931 4651 4761

8 8

OM4 MMF
by Jed Laundry 31 Mar '14

31 Mar '14

Hi folks, Excuse my ignorance, I try to avoid orange/aqua cables... We recently had a rack of servers + SAN installed with 8Gb FC, and long story short, the vendor will only supply & install 5m OM4 cables. *grumble grumble FCoE grumble 2m patch grumble* AFAICT, OM4 is to OM3 what G.657A2 is to G.652 - completely interchangeable, especially for such a short run, just don't expect to wrap it around a pencil. And so I can swap out these stupidly long cables with properly measured OM3. Is this sensible? Thanks, Jed. Sent from a small screen.

3 3

slides for nznog 2014
by Joel van Velden 27 Mar '14

27 Mar '14

Hi list I seem to have lost the URL (someone's owncloud?) for where nznog '14 slides were posted to. Does anyone still have it? Regards, Joel van Velden

2 1

DNSSEC in .au
by Adam King 26 Mar '14

26 Mar '14

auDA has announced it will be introducing DNSSEC into the .au domain space in an experimental capacity. Deployment on production servers will commence during April and will be trialled for 4 months. The .au DS records will_not be added to the root zone during this period. Operators should_not create or implement trust anchors for .au in their production environments during this experimental phase. A mailing list has been created for all future announcements related to DNSSEC in .au, if you wish to subscribe to this mailing list please visit http://www.lists.auda.org.au/mailman/listinfo/dnssec-announce For further information about the implementation of DNSSEC in .au please see http://www.auda.org.au/industry-information/au-domains/dnssec/. Kind Regards, Adam King | CTO .au Domain Administration Ltd T: +61 3 8341 4111 | F: +61 3 8341 4112 E: adam.king(a)auda.org.au | W:www.auda.org.au Twitter: @auda | Blog: www.auda.org.au/blog/ auDA - Australia's Domain Name Administrator Important Notice This email may contain information which is confidential and/or subject to legal privilege, and is intended for the use of the named addressee only. If you are not the intended recipient, you must not use, disclose or copy any part of this email. If you have received this email by mistake, please notify the sender and delete this message immediately.

2 1

Home Grown RPKI Validators
by Bill Walker 25 Mar '14

25 Mar '14

Hi All, Now I have solved my ROA issue, (Thanks Dean & Michael) I'd like to look at building an RPKI validator, does anyone have any experience with these? Thanks, Bill

1 0

12ish U cabinets in Wellington?
by Michael Fincham 23 Mar '14

23 Mar '14

Hi all, Anyone have a 12ish U cabinet in Wellington they'd like to be rid of? Will swap for beer or small amounts of money. Would prefer one with solid doors on front / back. I can come collect if it it'll fit in a taxi :) -- Michael

1 0

Re: [nznog] NZNOG Digest, Vol 135, Issue 16
by Jonathan Spence 23 Mar '14

23 Mar '14

Remember some ISPs could be at national peering locations e.g. iinet peer ate APE do they not? If its your intention to save on traffic costs the BGP route is probably OK but using a proper service is more desirable overall. Jonathan Spence Chief Executive Officer Fixed: +64 9 9510448 Mobile: +64211055634 ---------------------------------------- From: nznog-request(a)list.waikato.ac.nz Sent: Monday, March 24, 2014 12:00 PM To: nznog(a)list.waikato.ac.nz Subject: NZNOG Digest, Vol 135, Issue 16 Send NZNOG mailing list submissions to nznog(a)list.waikato.ac.nz To subscribe or unsubscribe via the World Wide Web, visit http://list.waikato.ac.nz/mailman/listinfo/nznog or, via email, send a message with subject or body 'help' to nznog-request(a)list.waikato.ac.nz You can reach the person managing the list at nznog-owner(a)list.waikato.ac.nz When replying, please edit your Subject line so it is more specific than "Re: Contents of NZNOG digest..." Today's Topics: 1. List of NZ IP addresses? (Clark Mills) 2. Re: List of NZ IP addresses? (Tony Wicks) 3. Re: List of NZ IP addresses? (Clark Mills) 4. Re: List of NZ IP addresses? (Peter Lambrechtsen) 5. Re: List of NZ IP addresses? (Bill Walker) 6. Re: List of NZ IP addresses? (Damian Kissick) 7. Re: List of NZ IP addresses? (Scott Howard) 8. Re: List of NZ IP addresses? (Rob McDonald) 9. Re: List of NZ IP addresses? (Gareth Davies) 10. Re: List of NZ IP addresses? (Lindsay Hill) 11. Re: List of NZ IP addresses? (Richard Naylor) ---------------------------------------------------------------------- Message: 1 Date: Mon, 24 Mar 2014 08:51:30 +1300 From: Clark Mills <c.mills(a)auckland.ac.nz> To: nznog(a)list.waikato.ac.nz Subject: [nznog] List of NZ IP addresses? Message-ID: <532F3B42.90609(a)auckland.ac.nz> Content-Type: text/plain; charset="utf-8"; Format="flowed" Hi all. I realise that it's a constantly changing list but does anyone have a list on NZ IPs? Why: We're trying to set up a website to be accessible in NZ only. Knowing what I know then firewalling is the tool (a man with a hammer...) but I need to routinely source a more recent list. Any suggestions or hints appreciated. Cheers... Clark

1 0

Re: [nznog] List of NZ IP addresses?
by Richard Naylor 23 Mar '14

23 Mar '14

At 09:50 a.m. 24/03/2014, you wrote: >2 votes for maxmind. (or bgp feed with communities or something from >your ISP) it depends if you are trying to firewall for cost reasons, >eg: I don't want to serve my HD content to international viewers >because it will bankrupt me. Or I don't want to serve my >international content to international viewers because it would >breach a license agreement with the rights holder. The tier-1 CDNs all offer more than enough filtering to do very decent geo-fencing. So its not hard to limit to "NZ-only" or "everywhere but not nz". Sometimes we use that as the second line of defence. Rights agreements often require 2 levels or more.

1 0

List of NZ IP addresses?
by Clark Mills 23 Mar '14

23 Mar '14

Hi all. I realise that it's a constantly changing list but does anyone have a list on NZ IPs? Why: We're trying to set up a website to be accessible in NZ only. Knowing what I know then firewalling is the tool (a man with a hammer...) but I need to routinely source a more recent list. Any suggestions or hints appreciated. Cheers... Clark

9 9

RPKI and ROA
by Bill Walker 19 Mar '14

19 Mar '14

Hi All, Hoping someone can help. I am in the middle of a project to build 4 PoP's in Chicago, London, Sydney and Mumbai. As part of this I have been given the role of creating all the necessary Route objects etc. Our address space is from ARIN, but our ASN's are from RIPE, APNIC & ARIN. I have created as-set, aut-num and route objects in RADb to enable us to manage them from a single point. However I would like to setup ROA records for these route objects. I have setup RPKI with ARIN and created our first ROA object. Onto my question, am I likely to have operational issues if the route objects are in RADb and the ROA with ARIN? TIA, Bill

4 7

CityLink APE route server maintenance
by CityLink Ltd 18 Mar '14

18 Mar '14

On Sunday 23rd March 2014 between 18:00 and 21:00 the CityLink APE route server rs2.ape.nzix.net will be taken offline for building maintenance. Please make sure you also have a session configured with rs1.ape.nzix.netto ensure there is no loss of service. And a reminder that all NZIX customers should be configured with both route servers at each exchange for maximum resiliency. Customers who experience any problems with the service after the maintenance work should contact the CityLink 24 hour support number: Free call: 0800 4 CITYLINK (0800 424 895) Select: Option 3 Advise you have a fault with your CityLink service and include the relevant service reference number.

1 0

Google DNS 8.8.8.8/32
by Neil Fenemor 16 Mar '14

16 Mar '14

It seems 8.8.8.8/32 was hijacked yesterday for 22 minutes yesterday, affecting networks in Brazil and Venezuela. https://twitter.com/bgpmon/status/445266642616868864/photo/1 So about that RPKI thing…having a quick look (via whois.bgpmon.net) it seems Google does not have an ROA for 8.8.8.0/24. Yet another reason friends should not let friends use Google’s recursive resolvers. Perhaps their RIR doesn’t make it as easy as APNIC does to create ROA objects. Cheers, -- Neil Fenemor | +64 21 978 078 | Facetime | Skype

4 4

News: US to give up control of Internet administration
by Skeeve Stevens 15 Mar '14

15 Mar '14

Hi all, A very important announcement by NTIA/DoC/ICANN regarding the control of the Internet. This is an article from todays Commsday that very well explains the current situation. ...Skeeve -- *Commsday* - 17th March 2014 - www.commsday.com *US to give up control of Internet administration* The United States government says it will cede the Department of Commerce's legal authority over global Internet governance, but on condition that it approves of the system which replaces it. Late Friday afternoon, the National Telecommunications and Information Administration, under the DoC, said it wanted Internet domain governance to be subject to "multi-stakeholder" oversight and would oppose transition to an inter-governmental administration such as the International Telecommunications Union. Currently the DoC delegates oversight functions to the Internet Corporation for Assigned Names and Numbers which in turn works with various private and sector bodies such as the Internet Engineering Task Force, the Internet Architecture Board, the Internet Society, the Regional Internet Registries, top level domain name operators and VeriSign to administrate the Internet. "The timing is right to start the transition process," said Assistant Secretary of Commerce for Communications and Information Lawrence E. Strickling. "We look forward to ICANN convening stakeholders across the global Internet community to craft an appropriate transition plan." NTIA has communicated to ICANN that the transition proposal must have broad community support and address the following four principles: - Support and enhance the multi-stakeholder model; - Maintain the security, stability, and resiliency of the Internet DNS; - Meet the needs and expectation of the global customers and partners of ICANN's domain administration services; and, - Maintain the openness of the Internet. "Consistent with the clear policy expressed in bipartisan resolutions of the U.S. Senate and House of Representatives (S.Con.Res.50 and H.Con.Res.127), which affirmed the United States support for the multi-stakeholder model of Internet governance, NTIA will not accept a proposal that replaces the NTIA role with a government-led or an inter-governmental organisation solution," it said. AUSTRALIA BACKS US: The decision won the instant backing of Australian communications minister Malcolm Turnbull, who said he had discussed the plans with Strickling last week. Australia has been a steadfast ally of the US's opposition to a role for the ITU in Internet administration. Turnbull said "the Australian Government is absolutely committed to supporting an open Internet which is administered by multi stakeholder organisations like ICANN and NOT by governments whether in the form of consortia or multilateral organisations like the ITU or the UN." "The Internet is the most remarkable invention of our times and while it had its origins in research contracts with the US Government its growth, its dynamism, its resilience have all been the result of collaborative efforts by the wide Internet community not government regulation or fiat." "While it is all too common to complain about the US Government role in the Internet the truth is that the world owes the United States an extraordinary debt not just for giving birth to the Internet, but above all for giving it the freedom to develop into the extraordinary global platform it has become today." "The (ICANN subsidiary) Internet Assigned Numbers Authority contract with the US Department of Commerce expires in September 2015 and today I assured the President of ICANN, Mr Fadi Chehade, that the Australian Government will provide all the support it can to ICANN's efforts to develop a structure of governance that will meet the US Department of Commerce's vitally important conditions of removing itself from the IANA arrangements at the heart of the Internet. DOMESTIC OPPOSITION TO CHANGE: However, the decision did not receive bipartisan support in the United States with Republican politicians and advisers defending the status quo and warning of the consequences of global control of Internet administration. Former House speaker Newt Gingrich said "Every American should worry about Obama giving up control of the internet to an undefined group. This is very, very dangerous. What is the global internet community that Obama wants to turn the internet over to? This risks foreign dictatorships defining the internet." A former State Department adviser under the Bush administration, Christian Whiton, said "US management of the internet has been exemplary and there is no reason to give this away -- especially in return for nothing. This is the Obama equivalent of Carter's decision to give away the Panama Canal -- only with possibly much worse consequences." GROWING PUSH AGAINST US: However, the US move has been interpreted by others as an early strike against what are likely to be persistent efforts to globalise the Internet's administration on terms which may prove unacceptable to the United States and its allies. Following unsuccessful attempts by China, Russia and the Arab bloc to have the ITU assume Internet governance functions in late 2012, there has been renewed pressure to change the status quo following the so-called Snowden revelations last year regarding pervasive US surveillance of foreign powers and individuals using Internet and telecom platforms. Brazil, one of the leading critics of the US, plans its own global Internet multi-stakeholder forum in late April in order to seize the initiative on how a post-US Internet might be shaped. Anti-US governmental members of the ITU are expected to revive their efforts in support of that organisation assuming Internet control when it convenes in South Korea for its plenipotentiary in November. The last ITU vote on these matters saw around 90 countries, led by China, Russia and the Arab world, support new regulations to "nationalise" the Internet and around 55, led by the US and its allies, support the status quo or a "multi-stakeholder" approach akin to the status quo, where specialist private and technical organisations such as ICANN perform management roles. Paul Rosenzweig, who served as a senior homeland security official under former President George W. Bush, opined "the move by the United States to start this transition now is either very canny or panicked. The optimist in me wants to think that the transition to ICANN management is an effort to forestall an even worse result from takeover of network administration by the ITU. It may be that allowing ICANN a controlling role will placate our European allies and prevent the ITU meeting in Busan, South Korea from becoming a debacle." "The pessimist, however, sees this as a reaction to the Snowden disclosures. All of a sudden American stewardship of the network is suspect. Some, hoping to defuse the anger, may have chosen to rush to give up that stewardship, without thinking through the consequences." Malcolm Turnbull also agreed that the US decision opened up a Pandora's box of challenges for those who think the existing system is generally successful. "There is a lot of work to do to support ICANN in transitioning to a new model and the Australian Government, committed as it is to a multi-stakeholder system of governance, will work with the Australian and global Internet community including other governments to ensure that the Internet remains free, stable and resilient and continues to be a powerful platform for freedom around the world," he said Grahame Lynch --- To get access to great articles like this, often before the mainstream media, please subscribe to Commsday - www.commsday.com ...Skeeve *Skeeve Stevens - *eintellego Networks Pty Ltd skeeve(a)eintellegonetworks.co.nz ; www.eintellegonetworks.co.nz Phone: +612 8014 7398; Cell +61 (0)414 753 383 ; skype://skeeve facebook.com/eintellegonetworks ; <http://twitter.com/networkceoau> linkedin.com/in/skeeve twitter.com/theispguy ; blog: www.theispguy.com The Experts Who The Experts Call Juniper - Cisco - Cloud - Consulting - IPv4 Brokering

1 0

Re: [nznog] Andy Linton in the news as holder of a key to the internet
by Dominic Driver 12 Mar '14

12 Mar '14

One key to secure them all... I for one am delighted to know that such an honourable man is one of the few entrusted with such responsibility. On 3 Mar 2014 22:42, Nigel Roberts <nigel(a)nobiscuit.com> wrote: > > As spotted over here in the fairfax papers: > > http://www.theage.com.au/it-pro/security-it/meet-andy-linton-one-of-the-few… > > I think I’d get sick of the key holder (master?) jokes, too. Thanks for your good work Andy. > > Nigel > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog

2 1

Bitstream 3a MAC limits
by Dave Mill 12 Mar '14

12 Mar '14

Hi all I know the answer to my question here is likely hidden deep in a PDF somewhere but someone on this list may know the answer off hand. I see that Bitstream 3a has a 64 MAC limit. What doesn't seem clear to me is if this MAC limit is a customer ONT port MAC limit, or a MAC limit for the entire customer S-VID. I had always assumed it was a limit on MACs that can be sourced from the customer ONT port but am I wrong? Is it a MAC limit on the total number of MACs that can be learnt over the entire customer S-VID (src'ed from either the provider or customer end of the link)? I'm extracting the 64 MAC limit from this document here - http://www.crownfibre.govt.nz/wp-content/uploads/2013/01/Chorus-UFB-Service… Any feedback, especially this afternoon, would be very useful. Provider is UFF. I am not really wanting to debate why someone would want that number of MACs over a BS3 connection and why some layer 3 should probably be involved here.... Cheers Dave

4 4

TVNZ On Demand
by Barry Murphy 12 Mar '14

12 Mar '14

Hey guys, wondering if anyone from TVNZ On Demand is on this list and wouldn't mind contacting me offlist regarding problems streaming if a user has an IPv6 address. The helpdesk doesn't appear to know what ipv6 is so thought I'd try an alternative. Many thanks Barry

2 1

IPv6 redundancy
by Jonathan Spence 10 Mar '14

10 Mar '14

Hi all, I started a thread on the IPv6 group on LinkedIn in regards to this but.... What is the best way to provide redundant connectivity to SMBs with IPv6? Using v4 with NAT is easy with most routers but v6 is harder. Shim6 seems to be a good idea but looks to be a dead duck. People in that thread were advocating full AS and BGP but I don't think that is easy for most SMBs unless their IT support is top notch and trained (which lets face it, most don't even know how to screw in a lightbulb). It also may mess up global routing tables causing them to get much bigger. Any ideas? Jonathan Spence Chief Executive Officer Fixed: +64 9 9510448 Mobile: +64211055634

2 1

Web audio collection
by Richard Hulse 10 Mar '14

10 Mar '14

Radio NZ has an audio collection for the web's birthday: http://www.radionz.co.nz/collections/world-wide-web Featuring Vint Cerf, Tim Berners-Lee and Andy Linton. Add beer as required.

1 0

Turning on DNSSEC validation - you know you want to!
by Andy Linton 10 Mar '14

10 Mar '14

>From this posting: http://www.internetsociety.org/deploy360/blog/2014/01/circleid-dns-security… I like this quote: However, on the recursive resolver side, I am much more of a fan of having the DNS resolution occur as close to the end user as possible. This is particularly true when you enable DNSSEC validation.

1 0

Some discussion starters from APRICOT 37
by Michael Fincham 09 Mar '14

09 Mar '14

Hi all, I recently had the pleasure of attending APRICOT 37 (many thanks to the NZNOG and InternetNZ folks, and others, who made this possible!) and felt that there were some interesting topics discussed that may be worth bringing back to the NZNOG community. Here's an unsorted and terse list of some things I thought worthwhile: -> We need to stop looking at Alexa's "top 100" websites for IPv6 support and being disappointed - we need to be looking at a much smaller proportion of the "top sites" as this is where "all of the traffic" is actually going. Facebook, YouTube, Google, Wikipedia, Akamai and GGC cache nodes. It's a port 80 world and a few sites dominate :) -> Some big providers (T-Mobile, Telstra AU) talked about having rolled out IPv6 in various forms (single stack v6, dual stack with CGNAT on v4 and native v6) to their mobile subscriber base with approximately no support impact. A common theme: "We need to test IPv6 before deploying it!" "What testing did you do with IPv4?" "None" "Well do that with IPv6 too!" -> Paraphrasing: "Customers don't know what IPv4 is to begin with, so they sure don't know or care what IPv6 is." -> These operators reported seeing /40%/ of the traffic on any given subscriber where dual stack was available going straight out to the native v6 Internet! This is a huge win if you're looking at deploying CGNAT as it means approximately half as much state needs to be kept on your expensive CGNAT boxes, and half as much traffic is being molested on the way from the customer to the 'net :) It also means you should definitely be rolling out dual stack alongside your CGNAT :) -> 464XLAT (http://tools.ietf.org/html/rfc6877) looks like it's about to be a big deal in the mobile IPv6 space. In short, 464XLAT allows for phones to run single stack native IPv6 while applications on the phone can continue to access v4 literals etc if required. Makes use of a clever combination of existing technologies. Only Android 4.3+ supports this so far, but more phone support shouldn't be far away. To me this looks like it would be a killer feature to have on fixed line CPEs, though I am unclear how it would interact with the type of NAT these CPEs typically perform (though this ought not be too far away from a tethering scenario on a phone). -> Geoff Huston's closing presentation on the state of BGP in 2013 contained some interesting measurements and insights about how worried we should be able router performance and so on. The video (https://www.youtube.com/watch?feature=player_detailpage&v=e4N9ELoM76M#t=1798) and slides (https://conference.apnic.net/data/37/2014-02-27-bgp2013_1392943641.pdf) are worth a look if you have ~ 20 minutes. Since the NZNOG list has been more alive of late, I'd welcome discussion on any of these points as certainly there is plenty here that is relevant to NZ :) -- Michael Fincham System Administrator, Unleash Office: 0800 750 250

2 2

ICONZ-Webvisions (NZ) to close Open DNS Resolvers
by Mark Foster 05 Mar '14

05 Mar '14

Hi folks ICONZ-Webvisions (the entity formerly known simply as ICONZ in NZ) will be blocking external access to our recursive DNS servers to non-customer subnets on the evening of 6 March 2014. In the knowledge that there may well be former customers or third-parties who have hard-coded the IP's of our DNS servers into their configs (or their customer configs) I'm giving notice now; the following IP's will cease to provide DNS resolution to clients outside of our network space, at that time: 210.48.65.1 210.48.65.2 210.48.66.1 210.48.66.2 Customers with concerns about this change are invited to contact our Customer Care team on 0800 843 638 or via support.nz(a)iconz-webvisions.com<mailto:support.nz(a)iconz-webvisions.com>. Regards Mark. -- Mark Foster Technical Services Manager - Australia & New Zealand [iconz-webvisions-logo-png] www.iconz-webvisions.com<https://webmail.iconz.net/owa/redir.aspx?C=ToykmhkSsEaPr3XJN6nrf-rRV-b9iM8I…> ICONZ-Webvisions, ICONZ House, 60 Airedale Street, Auckland 1010, New Zealand

2 2

NZNOG 2014 videos
by Richard Naylor 05 Mar '14

05 Mar '14

Folks I just noticed an upgrade to the video player software had taken away the SD/HD control, or at least it wasn't explicitly obvious. There is a newer version that is slightly better, but I've rolled back a release so that SD/HD is obvious. Comments/feedback appreciated. They can be off list to save clutter. Also is HD worth it ? Richard

1 0

RFC 7149 -- SDN
by Sebastian Castro 05 Mar '14

05 Mar '14

Hi: Given SDN has been a buzzword within NZNOG, I would recommend RFC 7149 as reading for those interested: http://www.rfc-editor.org/rfc/rfc7149.txt SDN: A perspective from within a Service Provider Environment Cheers -- Sebastian Castro Technical Research Manager .nz Registry Services (New Zealand Domain Name Registry Limited) desk: +64 4 495 2337 mobile: +64 21 400535

1 0

NZNOG conference dates for the next hundred years
by Dean Pemberton 03 Mar '14

03 Mar '14

Hi All >From time to time we run into people who claim that we keep moving the NZNOG conference dates around. Normally this is because NZNOG happens to conflict with another conference that they might want to go to. The official policy is.. "The last full usable week in January" I'm just about the give the NZNOG update at the APRICOT meeting in Kuala Lumpur. So I thought I'd solve the problem once and for all. Here are the conference dates for the next hundred years along with a script to check which a particular year. I might have a couple of these wrong and we do reserve the right to change them if required, but they are a good place to start. #!/usr/bin/perl -w use strict ; use DateTime ; use feature qw( say ) ; my $year = $ARGV[ 0 ]; my $dt = DateTime->last_day_of_month( year => $year , month => 1 ) ; while ( $dt->day_of_week != 5 ) { $dt->subtract( days => 1 ) ; } my $nznogenddate = $dt->dmy; $dt->subtract (days => 5) ; my $nznogstartdate = $dt->dmy; print ("In $year NZNOG will be held from $nznogstartdate to $nznogenddate\n") ; $ for i in `seq 2015 1 2115`; do ./dates.pl $i ; done In 2015 NZNOG will be held from 25-01-2015 to 30-01-2015 In 2016 NZNOG will be held in conjunction with APRICOT 2016, Auckland In 2017 NZNOG will be held from 22-01-2017 to 27-01-2017 In 2018 NZNOG will be held from 21-01-2018 to 26-01-2018 In 2019 NZNOG will be held from 20-01-2019 to 25-01-2019 In 2020 NZNOG will be held from 26-01-2020 to 31-01-2020 In 2021 NZNOG will be held from 24-01-2021 to 29-01-2021 In 2022 NZNOG will be held from 23-01-2022 to 28-01-2022 In 2023 NZNOG will be held from 22-01-2023 to 27-01-2023 In 2024 NZNOG will be held from 21-01-2024 to 26-01-2024 In 2025 NZNOG will be held from 26-01-2025 to 31-01-2025 In 2026 NZNOG will be held from 25-01-2026 to 30-01-2026 In 2027 NZNOG will be held from 24-01-2027 to 29-01-2027 In 2028 NZNOG will be held from 23-01-2028 to 28-01-2028 In 2029 NZNOG will be held from 21-01-2029 to 26-01-2029 In 2030 NZNOG will be held from 20-01-2030 to 25-01-2030 In 2031 NZNOG will be held from 26-01-2031 to 31-01-2031 In 2032 NZNOG will be held from 25-01-2032 to 30-01-2032 In 2033 NZNOG will be held from 23-01-2033 to 28-01-2033 In 2034 NZNOG will be held from 22-01-2034 to 27-01-2034 In 2035 NZNOG will be held from 21-01-2035 to 26-01-2035 In 2036 NZNOG will be held from 20-01-2036 to 25-01-2036 In 2037 NZNOG will be held from 25-01-2037 to 30-01-2037 In 2038 NZNOG will be held from 24-01-2038 to 29-01-2038 In 2039 NZNOG will be held from 23-01-2039 to 28-01-2039 In 2040 NZNOG will be held from 22-01-2040 to 27-01-2040 In 2041 NZNOG will be held from 20-01-2041 to 25-01-2041 In 2042 NZNOG will be held from 26-01-2042 to 31-01-2042 In 2043 NZNOG will be held from 25-01-2043 to 30-01-2043 In 2044 NZNOG will be held from 24-01-2044 to 29-01-2044 In 2045 NZNOG will be held from 22-01-2045 to 27-01-2045 In 2046 NZNOG will be held from 21-01-2046 to 26-01-2046 In 2047 NZNOG will be held from 20-01-2047 to 25-01-2047 In 2048 NZNOG will be held from 26-01-2048 to 31-01-2048 In 2049 NZNOG will be held from 24-01-2049 to 29-01-2049 In 2050 NZNOG will be held from 23-01-2050 to 28-01-2050 In 2051 NZNOG will be held from 22-01-2051 to 27-01-2051 In 2052 NZNOG will be held from 21-01-2052 to 26-01-2052 In 2053 NZNOG will be held from 26-01-2053 to 31-01-2053 In 2054 NZNOG will be held from 25-01-2054 to 30-01-2054 In 2055 NZNOG will be held from 24-01-2055 to 29-01-2055 In 2056 NZNOG will be held from 23-01-2056 to 28-01-2056 In 2057 NZNOG will be held from 21-01-2057 to 26-01-2057 In 2058 NZNOG will be held from 20-01-2058 to 25-01-2058 In 2059 NZNOG will be held from 26-01-2059 to 31-01-2059 In 2060 NZNOG will be held from 25-01-2060 to 30-01-2060 In 2061 NZNOG will be held from 23-01-2061 to 28-01-2061 In 2062 NZNOG will be held from 22-01-2062 to 27-01-2062 In 2063 NZNOG will be held from 21-01-2063 to 26-01-2063 In 2064 NZNOG will be held from 20-01-2064 to 25-01-2064 In 2065 NZNOG will be held from 25-01-2065 to 30-01-2065 In 2066 NZNOG will be held from 24-01-2066 to 29-01-2066 In 2067 NZNOG will be held from 23-01-2067 to 28-01-2067 In 2068 NZNOG will be held from 22-01-2068 to 27-01-2068 In 2069 NZNOG will be held from 20-01-2069 to 25-01-2069 In 2070 NZNOG will be held from 26-01-2070 to 31-01-2070 In 2071 NZNOG will be held from 25-01-2071 to 30-01-2071 In 2072 NZNOG will be held from 24-01-2072 to 29-01-2072 In 2073 NZNOG will be held from 22-01-2073 to 27-01-2073 In 2074 NZNOG will be held from 21-01-2074 to 26-01-2074 In 2075 NZNOG will be held from 20-01-2075 to 25-01-2075 In 2076 NZNOG will be held from 26-01-2076 to 31-01-2076 In 2077 NZNOG will be held from 24-01-2077 to 29-01-2077 In 2078 NZNOG will be held from 23-01-2078 to 28-01-2078 In 2079 NZNOG will be held from 22-01-2079 to 27-01-2079 In 2080 NZNOG will be held from 21-01-2080 to 26-01-2080 In 2081 NZNOG will be held from 26-01-2081 to 31-01-2081 In 2082 NZNOG will be held from 25-01-2082 to 30-01-2082 In 2083 NZNOG will be held from 24-01-2083 to 29-01-2083 In 2084 NZNOG will be held from 23-01-2084 to 28-01-2084 In 2085 NZNOG will be held from 21-01-2085 to 26-01-2085 In 2086 NZNOG will be held from 20-01-2086 to 25-01-2086 In 2087 NZNOG will be held from 26-01-2087 to 31-01-2087 In 2088 NZNOG will be held from 25-01-2088 to 30-01-2088 In 2089 NZNOG will be held from 23-01-2089 to 28-01-2089 In 2090 NZNOG will be held from 22-01-2090 to 27-01-2090 In 2091 NZNOG will be held from 21-01-2091 to 26-01-2091 In 2092 NZNOG will be held from 20-01-2092 to 25-01-2092 In 2093 NZNOG will be held from 25-01-2093 to 30-01-2093 In 2094 NZNOG will be held from 24-01-2094 to 29-01-2094 In 2095 NZNOG will be held from 23-01-2095 to 28-01-2095 In 2096 NZNOG will be held from 22-01-2096 to 27-01-2096 In 2097 NZNOG will be held from 20-01-2097 to 25-01-2097 In 2098 NZNOG will be held from 26-01-2098 to 31-01-2098 In 2099 NZNOG will be held from 25-01-2099 to 30-01-2099 In 2100 NZNOG will be held from 24-01-2100 to 29-01-2100 In 2101 NZNOG will be held from 23-01-2101 to 28-01-2101 In 2102 NZNOG will be held from 22-01-2102 to 27-01-2102 In 2103 NZNOG will be held from 21-01-2103 to 26-01-2103 In 2104 NZNOG will be held from 20-01-2104 to 25-01-2104 In 2105 NZNOG will be held from 25-01-2105 to 30-01-2105 In 2106 NZNOG will be held from 24-01-2106 to 29-01-2106 In 2107 NZNOG will be held from 23-01-2107 to 28-01-2107 In 2108 NZNOG will be held from 22-01-2108 to 27-01-2108 In 2109 NZNOG will be held from 20-01-2109 to 25-01-2109 In 2110 NZNOG will be held from 26-01-2110 to 31-01-2110 In 2111 NZNOG will be held from 25-01-2111 to 30-01-2111 In 2112 NZNOG will be held from 24-01-2112 to 29-01-2112 In 2113 NZNOG will be held from 22-01-2113 to 27-01-2113 In 2114 NZNOG will be held from 21-01-2114 to 26-01-2114 In 2115 NZNOG will be held from 20-01-2115 to 25-01-2115

9 8

Re: [nznog] OT: Ethernet
by Scott Weeks 03 Mar '14

03 Mar '14

--- richard.naylor(a)R2.co.nz wrote: From: Richard Naylor <richard.naylor(a)R2.co.nz> Been some celebrations recently over ethernet. Going from 10Mbps to 100Gbps over 40 years. ------------------------------------------ Late reply, but to inspire those who have (have had) managers that just don't understand what you're doing... :-) http://b2b.cbsimg.net/blogs/19740305-xerox-ethernet-memo1.jpg scott _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Andy Linton in the news as holder of a key to the internet
by Nigel Roberts 02 Mar '14

02 Mar '14

As spotted over here in the fairfax papers: http://www.theage.com.au/it-pro/security-it/meet-andy-linton-one-of-the-few… I think I’d get sick of the key holder (master?) jokes, too. Thanks for your good work Andy. Nigel

1 0