- NZNOG - lists.nznog.org

Those RPKI stats
by Michael Fincham 18 Feb '14

18 Feb '14

Hi all, Firstly, thanks NZNOG folks for a great conference. In spite of getting sick and missing ~ 50% I'd still have to say I enjoyed myself :) It's been long enough now that we've probably all forgotten that I'd promised to pony up some more "interesting" RPKI stats at NZNOG, so just to keep you on your toes here they are. ---> First order of business: Did we really hijack the Internet? <--- Sadly no, we just broke BGPMON. It's a long story. ---> RPKI data for the IXes, "domestic transit" <--- I've published a fixed slide deck + some other potentially useful info on my personal website at: <http://hotplate.co.nz/archive/nznog/2014/rpki/> The website includes a link to a web based "relying party cache query tool" I've put together, for anyone interested in having a play with validating some "real world" route data. This tool is also available directly at <http://rpki-validator.lab.hotplate.co.nz/>. In short, the totals for the IXes look like this: APE: 64 invalid, 165 valid, 5474 unvalidated routes out of 3694 unique prefixes WIX: 48 invalid, 92 valid, 1875 unvalidated routes out of 1190 unique prefixes CHIX: 8 invalid, 48 valid, 769 unvalidated routes out of 728 unique prefixes A detailed breakdown of what's valid / invalid and "why" is available from the web page above, along with the raw data so these results can be replicated if desired. Does my data look dodgy or suspect? Is my methodology bogus? Probably! Please do let me know :) -- Michael Fincham

1 0

Interesting Adwords Advert..
by Craig Whitmore 18 Feb '14

18 Feb '14

I just noticed this today.. http://finch.am/scratch/dnc_discontent.png (This is what the advert looks like) It was an adwords advert I presume targeted towards NZers. Which links to.. http://dnc.org.nz/2ld-policy-amendments?gclid=CIzyxuPd1rwCFcEnpQodmFUAOQ Does anyone know who is paying for these adverts . As far as I know the new 2LD domain policy won¹t result in people loosing their .co.nz domain names. (Is this ³false² advertising?) Thanks Craig

2 3

LICA Boundaries
by Liam Farr 18 Feb '14

18 Feb '14

Hi, Does anyone out there know of or have an accurate definition of all the NZ LICA boundaries they could point me to or provide off list? Or otherwise be able to point me at the correct person to ask, Chorus / NAD / MBIE perhaps? I am trying to produce some sort of useful graphical tool, (e.g. google maps overlay) to assist a customer, where they can punch in an address and get the correct LICA displayed for that address. (I also have a stockpile of spare liquor if that helps :D). -- Kind Regards Liam Farr liamfarr(a)me.com +64-22-610-7884

3 2

Re: [nznog] LICA Boundaries
by Peter Lambrechtsen 18 Feb '14

18 Feb '14

Or the mapping folks from Chrous... I have some maps but don't think I will be allowed to share them :/ Sent from my phone on the smartphonetwork. -------- Original message -------- From: Peter Gent <Peter.Gent(a)mbie.govt.nz> Date: 19/02/2014 8:19 AM (GMT+12:00) To: NZNOG(a)list.waikato.ac.nz Subject: Re: [nznog] LICA Boundaries Hi, Have you tried contacting the people behind www.nad.ord.nz<http://www.nad.ord.nz> to start with? Regards Peter -----Original Message----- From: nznog-bounces(a)list.waikato.ac.nz [mailto:nznog-bounces(a)list.waikato.ac.nz] On Behalf Of Liam Farr Sent: Tuesday, 18 February 2014 11:32 p.m. To: Nznog List Subject: [nznog] LICA Boundaries Hi, Does anyone out there know of or have an accurate definition of all the NZ LICA boundaries they could point me to or provide off list? Or otherwise be able to point me at the correct person to ask, Chorus / NAD / MBIE perhaps? I am trying to produce some sort of useful graphical tool, (e.g. google maps overlay) to assist a customer, where they can punch in an address and get the correct LICA displayed for that address. (I also have a stockpile of spare liquor if that helps :D). -- Kind Regards Liam Farr liamfarr(a)me.com +64-22-610-7884 _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog http://newzealand.govt.nz/ - connecting you to New Zealand central & local government services Any opinions expressed in this message are not necessarily those of the Ministry of Business, Innovation and Employment. This message and any files transmitted with it are confidential and solely for the use of the intended recipient. If you are not the intended recipient or the person responsible for delivery to the intended recipient, be advised that you have received this message in error and that any use is strictly prohibited. Please contact the sender and delete the message and any attachment from your computer. _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Apologies
by Ray Taylor 17 Feb '14

17 Feb '14

I must apologise to the group. I have been a long time subscriber but don't post. Mailing list technology is a bit before my time so I was not exactly sure how I was to keep replies within the same thread / branch on the list archive. I was assuming if I forward to the list, it would place it in the correct thread much like a support ticketing system based on subject. Of course I was forwarding a few emails one after the other with responses and didn't see the particular email was sent to me off list. I shall go and find a how-to wiki on this mailing list stuff next time I need to post. With regards to my issue, I have our IP block / ASN advertised on our behalf by our upstream provider as we don't peer using BGP. The NOC at vocus replied to me and said somewhere along the chain there is an issue and they were most helpful in passing a message to whoever is responsible. As predicted by those who responded to my query, they were very fast in their response. Jonathan Brewer has quite rightly reminded me this is one of the woes of tier 7 bandwidth..something I should look at changing. Anyhow, thanks for the help Ray Taylor Taylor Communications ray(a)ruralkiwi.com Ph 021-483-280 Network status 06-929-9082 Description: header_logo

2 1

Re: [nznog] Vocus Contact
by Ray Taylor 17 Feb '14

17 Feb '14

I think it was more a BGP issue with our upstream's upstream. So hoping it isn't a vocus issue and something closer to us. Ray Taylor Taylor Communications <mailto:ray(a)ruralkiwi.com> ray(a)ruralkiwi.com Ph 021-483-280 Network status 06-929-9082 Description: header_logo From: Liam Farr [mailto:liamfarr(a)me.com] Sent: Tuesday, 18 February 2014 8:29 p.m. To: Ray Taylor Subject: Re: [nznog] Vocus Contact Craig Spiers is the most cluefull console wielding guy at Vocus, if there is a real problem with their BGP routing there's a good chance it will eventually make its way to him. He's also not a dick :) Craig Spiers <craig.spiers(a)vocus.co.nz> -- Kind Regards Liam Farr liamfarr(a)me.com +64-22-610-7884 On 18/02/2014, at 5:02 pm, Ray Taylor <ray(a)ruralkiwi.com> wrote: Have we someone here within Vocus? I have an issue with our ip range not being routed correctly through vocus' network. Thanks. Ray Taylor Taylor Communications <mailto:ray(a)ruralkiwi.com> ray(a)ruralkiwi.com Ph 021-483-280 Network status 06-929-9082 <image001.png> _______________________________________________ NZNOG mailing list <mailto:NZNOG(a)list.waikato.ac.nz> NZNOG(a)list.waikato.ac.nz <http://list.waikato.ac.nz/mailman/listinfo/nznog> http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Vocus Contact
by Ray Taylor 17 Feb '14

17 Feb '14

Have we someone here within Vocus? I have an issue with our ip range not being routed correctly through vocus' network. Thanks. Ray Taylor Taylor Communications ray(a)ruralkiwi.com Ph 021-483-280 Network status 06-929-9082 Description: header_logo

5 6

Change of Trustee and Thank you
by Jamie Baddeley 17 Feb '14

17 Feb '14

HI Folks, Little bit of housekeeping on behalf of the NZNOG Trustees for those of you who missed the conference in Nelson this year. Shame you missed it, it was a beauty. As mentioned at the end of the Conference, Richard Nelson from the WAND group at Waikato University is the latest victim/trustee to join the fray. Thanks to Richard for saying yes. Also, this means that a self described "grey-haired, cantankerous old bastard living in Canada" is now able to spend more time doing what ever it is that he does when he's not being grey and cantankerous. I am of course talking about Joe Abley. He's no longer a trustee. For those of us who've been around a bit, and believe me Joe has, you'll know that he's contributed a great deal to the NZ Internet (and more!) over the years, even if most of it was last century. Well maybe not that long ago. So, with that, thanks Joe, and thanks Richard. cheers jamie

1 0

NTP reflection used for world's largest DDoS
by Juha Saarinen 16 Feb '14

16 Feb '14

http://www.itnews.com.au/News/372033,worlds-largest-ddos-strikes-us-europe.… Amplification factor: 58.5. -- Juha Saarinen twitter: juhasaarinen

21 32

Cisco Memory Issues
by Alexander Neilson 14 Feb '14

14 Feb '14

I saw alerts about this on AUSNOG but hadn’t seen anything on NZNOG yet so I posting it to make sure people know. http://www.itnews.com.au/News/372345,cisco-stung-by-switch-memory-glitch.as… http://www.cisco.com/web/about/doing_business/memory.html Regards Alexander

1 0

APRICOT 2014 - Remote Participation Registration
by Elly Tawhai 12 Feb '14

12 Feb '14

Hi NZNOG Community, I hope you are all looking forward to APRICOT 2014 which will start next week. The Workshops are from Tuesday, 18 to Saturday, 22 February 2014 and the Conference is from Monday, 24 to Friday, 28 February 2014. If you are unable to attend in person, you can still join the conference remotely. Some of the conference sessions will be broadcasted live. Please refer to the program for more information. http://2014.apricot.net/program Please note: Registration is now *mandatory* to watch the live webcast and participate remotely. Registration is free and you can register now to receive your login details https://apnic.ungerboeck.com/prod/emc00/register.aspx?OrgCode=10&EvtID=5824… I hope to see you all in person or online at APRICOT 2014. Regards APNIC Secretariat

1 0

Re: [nznog] Validating resolvers for DNS and DNSSEC
by Pete Mundy 12 Feb '14

12 Feb '14

Straight after the conference, I enabled validation on a resolver that handles in excess of 2 million queries/day. So far I have no negative impact to report either :) I support Andy & Dean's comments. Just turn it on already! Pete Mundy Wearer of Many Hats On 11/02/2014, at 12:20 PM, Dean Pemberton <nznog(a)deanpemberton.com> wrote: > Dave Mill (Inspire) stood up at NZNOG and clearly said that for them > that never happened. > > Just turn it on. > > On Tue, Feb 11, 2014 at 11:51 AM, Nathan Ward <nznog(a)daork.net> wrote: >> [SNIP] >> I've been talking about this with one of my customers recently, and there's >> a concern by some that turning on validation will trip false positives - >> which for an ISP is a bad thing to do - all the customer sees is that you >> 'don't work' while the other ISP does. >> >> Is there public data available re. this? Does it likely vary much for NZ? >> [SNIP] >> Nathan Ward

3 2

Technical Advisor, Harmful Digital Communications Bill
by Susan Chalmers 12 Feb '14

12 Feb '14

Hello NZNOG, I am developing InternetNZ's submission to the Justice and Electoral Committee on the Harmful Digital Communications Bill. I'd like to ask this list for some feedback on one issue in the Bill, in particular. Clause 15 of the Bill reads: Technical advisers - (1)A District Court or the High Court, as the case may be, may appoint a technical adviser to assist it in considering and determining an application for an order under section 17 or any appeal under section 72 of the District Courts Act 1947. (2)The duties of a technical adviser are-- - (a)to sit with the court; and - (b)subject to subsection (3), to act in all respects as an extra member of the court. (3)The court must appoint a technical adviser if the court is considering an application for an order under section 17(2)(a) or (b) or (3)(a). (4)The Judge may give any weight to the technical adviser's advice that the Judge thinks fit, and the Judge alone must determine the application or appeal. (5)The Minister must maintain a panel of persons who may be appointed under this section as technical advisers, and only persons named on the panel may be appointed under this section as technical advisers. (6)The chief executive must pay technical advisers the remuneration and allowances determined from time to time by the Minister. - For reference, the remedies referred to in cl 15(3) are: takedown of content/disabling access thereto; identification of an anonymous author; and, somewhat strangely, making an order against parties not before the court. *What I am after in the first instance relates to the advice of the technical advisor. * *If the advisor were to issue a report of some sort to the judge, explaining the impact - economic, administrative, technical - of a takedown order on the intermediary, what do you think that advice should cover? * How can this advice, if it were published, serve as evidence for policymakers in the future, helping them avoid making remedies (takedown orders, etc) that are a burden to intermediaries or have a negative technical impact? FWIW, I think that 17(2)(c) and (d) orders - publishing corrections and providing rights of reply - should also be considered in technical advice. There are of course, many different flavours of intermediaries. The OECD has categorised intermediaries in the following way: 1. ISPs (carriers) 2. hosting providers 3. search engines 4. e-commerce intermediaries 5. Internet payment systems, and 6. participative web platforms http://www.keepeek.com/Digital-Asset-Management/oecd/science-and-technology… For the purposes of the Bill, we can consider intermediaries in two broad categories - content hosts and IPAPs (functionally - the IPAP language is not in the Bill, but I believe that IPAPs (meaning carriers in their IP-matching function) could be read into the current definition of "online content host" in the interpretation section). Thanks to those interested for your time and consideration, and please pose questions if you have them. I'd be grateful for your feedback by COB Friday. Sincerely, Susan -- --- Susan Chalmers Senior Policy Advisor susan(a)internetnz.net.nz

1 0

References/Recommendations for IP & VoIP in USA
by Christoph Berthoud 12 Feb '14

12 Feb '14

Morning all, We have an office in the US (Los Angeles) and I'm having issues with our current internet provider and are looking to change. Does anyone from NZNOG have any references/recommendations they could give me for a supplier in LA that can provide decent IP & SIP trunk services? Replies off-list much appreciated :) -- Thanks Christoph

1 0

Cisco Routers 3/4G connections.
by Laurence Bullivant 11 Feb '14

11 Feb '14

Afternoon, This is a reach out for anyone else using Cisco881g / Cisco887vag routers with 3G backup. We have just started getting the new routers into stock that use the new cellular modems. Our normal connection scripts don't work any more and we have been unable to find the required connection details for either vodafone or telecom connections. I am hoping in exchange for BEER, someone out there has worked it out. (We have a pending case with TAC but I hope this will be faster). Currently we are using: ----------------------------------------------------- *chat-script gsm "" "ATDT*99#" TIMEOUT 30 CONNECT!controller Cellular 0!interface Cellular0 ip address negotiated ip nat outside ip virtual-reassembly in ip virtual-reassembly out encapsulation slip dialer in-band dialer string gsm dialer-group 1 async mode interactive!interface Vlan1 ip address 10.0.0.1 255.255.255.0 ip nat inside ip virtual-reassembly!ip nat inside source list 1 interface Cellular0 overloadip route 0.0.0.0 0.0.0.0 Cellular0!access-list 1 permit anydialer-list 1 protocol ip permit!line 3 exec-timeout 0 0 script dialer gsm modem InOut no exec transport preferred none transport output none* ----------------------------------------------------- The issue is that the dial script always times out. Hopefully this is all recognizable to someone who has gone though the same pain as we are. Thanks in advance. -Laurence laurence(a)bullivant.co.nz

3 3

Call for NZ Provider
by Daniel Watson 10 Feb '14

10 Feb '14

Gday Noggers, I am currently seeking any NZ providers whom would meet the following requirements, Being able to rent dedicated servers at reasonable market pricing, Being able to provide us with a /24 IPv4 Being able to set up a Vyatta VM to act as our router via a direct BGP session to said provider If you can meet these requirements, I am eger to meet you :D Please respond off-list if you can meet this requirement Regards, Daniel Watson Network Administrator / Network Operations Manager E Daniel(a)GloVine.com.au W www.GloVine.com.au "No trees were harmed in the making of this email, however a large number of electrons were terribly inconvenienced."

1 0

Validating resolvers for DNS and DNSSEC
by Andy Linton 10 Feb '14

10 Feb '14

At the recent NZNOG meeting in Nelson, Geoff Huston from APNIC gave a talk on DNSSEC and had some interesting statistics about the use of validating resolvers for DNS and DNSSEC. For DNSSEC to work there are two parts of the equation that need to happen: 1) People need to sign their zones 2) People need to ask the question "is this zone signed" etc. I want to talk about 2) Geoff noted that a number of countries that we might not expect to be high on the list of those validating the responses using the DNSSEC technology were way ahead of the rest of the world. I haven't got the exact numbers here - I expect his presentation will appear shortly and there's likely to be a video of it at some stage at http://www.r2.co.nz/20140130/ - but from memory the global average is about 7% usage of validating resolvers. New Zealand is a dismal <2% and I'd like to challenge you all to do something about that. And we're way behind the Australians.... Geoff pointed out that the high rate elsewhere is due to a large degree to the number of people using Google's Public DNS servers and while that looks attractive and an easy way to improve those numbers I'd ask you not to go down that path. You need to do this yourself (or at least as close as possible to the end user). If you use someone else's resolver then your traffic can be intercepted en route to the validating resolver => man in the middle attack => game over. And of course, handing this data over to a centralised collection agent makes the work of anyone who wants to snoop on you much, much easier. It's not about Google's servers - this applies equally to public servers run by anyone. DNSSEC validation is not real validation unless it's performed end to end or at least as close as possible to that. A number of NZ ISPs provide this service to their customers with their in house resolvers and those of you who don't should really be looking at when you will do this. Those people who have signed their zones are making assertions about how they want their DNS data to be interpreted. They're saying that unless you validate their DNS data they really don't want you to connect to them. You should be taking notice of this. But then maybe you just ignore broken certs on websites etc. So what should you do? End user ======= Check here - http://dnssec.vs.uni-due.de/ Or use - https://www.dnssec-validator.cz/ Ask your ISP/admins to fix this. ISPs/Enterprise ============ If you're running a resolver for customers do the work to get it validating, please.... Plenty of info out there on how to do this for Bind and Unbound and I'm no Windows expert but this looks straightforward: Windows: http://info.menandmice.com/blog/bid/88297/Windows-2012-Server-Enabling-DNSS…

11 17

NZNOG 2014 Videos
by Richard Naylor 10 Feb '14

10 Feb '14

Before I get spammed to death about the videos.... We got back to base on Wednesday night, late. We got the tapes on friday and have been processing over the week end. Its pretty well all edited. One node ran out of disk last night and so is repeating today. Uploading is a slow process as the addition of HD footage added at least 200% more data. Thats why I asked if HD was of interest. (Its distribution grade HD rather than the higher bit-rate contribution HD) As we do the upload, we're also doing an idiot check on files, web pages etc, so there may be some reruns. But I expect that we should have it all available by the end of this week. We have another job starting tomorrow, which also consumes our evenings, so theres a bit of a time squeeze going on. I'll update the list when the files are available. rich

1 0

Re: [nznog] Validating resolvers for DNS and DNSSEC
by Richard Naylor 10 Feb '14

10 Feb '14

At 11:35 a.m. 11/02/2014, Andy Linton wrote: >At the recent NZNOG meeting in Nelson, Geoff Huston from APNIC gave >a talk on DNSSEC and had some interesting statistics about the use >of validating resolvers for DNS and DNSSEC. <snip> >and there's likely to be a video of it at some stage at ><http://www.r2.co.nz/20140130/>http://www.r2.co.nz/20140130/ - but >from memory the global average is about 7% usage of validating resolvers. The video is available at http://www.r2.co.nz/20140130/geoff-h.htm The others are rendering and uploading. The recording is large and currently filling the CDN cache, so if it doesn't play well - wait - its a large file. As an option there is an HD version. Its a large file also (>1GB) so takes even longer to load and requires a decent CPU to play back. Dual-core or better. Feedback on the value of HD footage would be interesting. Its slowing down the render and upload process, so if its not of much value, we can speed things up. The other videos should be available in a day or so. Richard

1 0

Reviews of Conference bridges that work well over multiple varied speeds
by Alexander Neilson 10 Feb '14

10 Feb '14

Little bit off topic so Beer However we have been asked to deliver a Video Teleconference Bridge in our system for customers whose speeds and connectivity vary (ADSL1, ADSL2, VDSL, Radio, Fibre, UFB) and so I am looking for anyones experiences with conference bridge hardware that can take connections from customers who may be using any of these connections into our network and that is smart enough to remux the video / audio streams out to cater to the connection speeds available. If anyone has any history with such a device I would love to hear about it off list. Preferring devices that will have a master bridge inside our core with good monitoring and management and easy to use remote units that are also reliable (remote customers make for hard trips to work on) however any relevant information would be appreciated. (I am arguing for on topic ish due to the handling of different grade customer connections across the network) Regards Alexander Alexander Neilson Neilson Productions Limited alexander(a)neilson.net.nz 021 329 681 022 456 2326

3 2

IPv6 address allocation questions
by Qinwen Hu 06 Feb '14

06 Feb '14

Hi All, My name is Qinwen(Steven) Hu from the University of Auckland. I am working on my PhD thesis in which I am trying to observe potential new security issues in IPv6 networks. I have two questions I would like to ask network operators: 1) Recently, we did a survey to investigate how network administrators are actually allocating IPv6 Interface IDs around the world. Our results show that 82% of domains use sequential small integer values in the interface ID field for their IPv6 addresses. - What IPv6 address allocation mechanisms do you (or will you) use in your IPv6 network/services? could you please give us your reasons for using these mechanisms? 2) What new security issues, i.e. issues that don't exist in IPv4, do you think are likely to arise? Any replies would be very helpful, please send them to me off-list.Many thanks for your kind consideration. Have a nice day. Regards, Steven 胡勤文／Qinwen Hu Ph.D. Candidate, Computer Science, University of Auckland 奥克兰大学计算机科学博士研究生

1 0

FW: Trusted Community Representation for Root KSK
by Leo Vegoda 06 Feb '14

06 Feb '14

Hi, People on this list might also want to submit responses. Regards, Leo From: dns-operations-bounces(a)mail.dns-oarc.net [mailto:dns-operations-bounces(a)mail.dns-oarc.net] On Behalf Of Kim Davies Sent: Thursday, February 06, 2014 12:38 PM To: DNS Operations Subject: [dns-operations] Trusted Community Representation for Root KSK Hi folks, ICANN is currently performing a consultation on how to evolve the participation of Trusted Community Representatives in the management of the root key signing key. I think this consultation is of particular interest to this group as ultimately these TCRs are there to instill trust in the DNS operations community that the KSK is being managed in a proper fashion. I'd encourage you to provide feedback to this consultation - available at http://www.icann.org/en/news/public-comment/tcr-dnssec-key-signing-21jan 14-en.htm - by 11th February. It is important we have a model of TCR participation that is satisfactory to the community. For convenience, here are the terms of reference replicated: Background Since July 2010, the DNS Root Zone has been secured using DNSSEC[1]. The model of using DNSSEC in the DNS Root Zone revolves around a "key signing key" (KSK) that is managed by ICANN in two secure facilities. Four times a year, a ceremony is conducted at these facilities to perform operations involving the KSK. As a key part of this process, a minimum of three from a pool of 21 trusted community representatives (TCRs) attend each ceremony to enable access to the secure materials, to witness the procedure, and to attest that the ceremony was conducted properly[2]. Each ceremony is attended by ICANN staff, the TCRs, representatives of the Root Zone Maintainer (Verisign), representatives of an independent audit firm retained by ICANN to monitor the process, and often additional external witnesses. Ceremonies are recorded by three audit cameras and webcast online. A typical ceremony lasts approximately four hours, and involves a process of temporarily removing the key signing key from a safe and performing key-signing operations in a secure manner following a formal script. The script is designed to perform each operation in a transparent manner to ensure the key signing key is only used for its proper purpose, and there is no ability for its contents to be disclosed for other purposes. Materials from each ceremony - such as the scripts, video recordings, and system output - are posted online[3]. De-briefings and discussions are conducted post-ceremony, where participants discuss how to improve future ceremonies. This feedback helps inform the evolution of the KSK ceremony to be both efficient and effective, while ensuring maximum trust in how ceremonies are performed. The TCRs were selected[4] from the global community based on a number of criteria[5]. These selection criteria relate to the volunteers ability to travel to ceremonies, conscientiously oversee the process, ensure transparency in its operation, and ultimately contribute to the broader community's trust that the private component of the key signing key has not been compromised. The TCRs are privately funded volunteers who are not reimbursed or compensated by ICANN for their participation nor their expenses. The original TCR proposal was silent on the length of service of individual TCRs. Of the 21 TCRs, seven are credentialed as "crypto officers" (COs) for each of the two facilities, and the remaining seven act as "recovery key shareholders" who only participate in ceremonies in the event the requisite number of COs are unable to participate or there is a need to rebuild the KSK following an unforeseen event. Of the seven COs for each facility, ICANN aims to have four attend each ceremony, with an absolute minimum of three required to successfully perform a ceremony. Each facility hosts two ceremonies per year, approximately once every six months. In practice, a TCR will attend at minimum one ceremony per year, and some will attend two in order to ensure sufficient attendance. Of the initial pool of 21 TCRs, one has resigned and been replaced from the pool of recovery key shareholders. No TCR has been removed owing to the other three criteria for replacement in the TCR selection document, relating to lack of integrity or trustworthiness; assumption of a conflicting role within a root management organization; or being unable to serve in their position. Based on feedback from the current TCRs and our experience from the first 14 ceremonies, we are reviewing what changes, if any, should be made to the current model of TCR participation. Comments Comments are welcome on any aspect of the consultation, and specifically on the following questions: 1. Is the current TCR model effectively performing its function of ensuring trust in the KSK management process? 2. Is the current size of the TCR pool appropriate to ensure sufficient participation in the ceremonies, while not overburdening the availability of specific volunteers? 3. Should there be a minimum level of participation required of a TCR in order to be considered to be successfully discharging their duties? 4. There is no standard provision to refresh the list of TCRs except when they are replaced due to inability to effectively perform their function. Should there be a process to renew the pool of TCRs, such as using term limits or another rotation mechanism? 5. The current model does not compensate TCRs for their services in order to ensure their independence from ICANN. a. Should the model of TCRs paying the costs of their participation be retained? b. Would some form of compensation to offset the expenses incurred by the TCRs detract from their independence in performing the role? c. If you support compensating TCRs for their expenses, are there requirements or limitations on whom the funding organization should be? Please send your comments to comments-tcr-dnssec-key-signing-21jan14(a)icann.org <mailto:comments-tcr-dnssec-key-signing-21jan14(a)icann.org> References [1] http://www.root-dnssec.org [2] https://www.iana.org/dnssec/icann-dps.txt [3] http://data.iana.org/ksk-ceremony/ [4] http://www.root-dnssec.org/tcr/selection-2010/ [5] http://www.root-dnssec.org/wp-content/uploads/2010/04/ICANN-TCR-Proposal -20100408.pdf kim

1 0

Re: [nznog] NZNOG Digest, Vol 134, Issue 2
by Jonathan Spence 04 Feb '14

04 Feb '14

Hi Trent, You may want to try geekzone.co.nz as there are a few good Telecom contacts on there. Thanks, Jonathan ---------------------------------------- From: nznog-request(a)list.waikato.ac.nz Sent: Wednesday, February 5, 2014 12:01 PM To: nznog(a)list.waikato.ac.nz Subject: NZNOG Digest, Vol 134, Issue 2 Send NZNOG mailing list submissions to nznog(a)list.waikato.ac.nz To subscribe or unsubscribe via the World Wide Web, visit http://list.waikato.ac.nz/mailman/listinfo/nznog or, via email, send a message with subject or body 'help' to nznog-request(a)list.waikato.ac.nz You can reach the person managing the list at nznog-owner(a)list.waikato.ac.nz When replying, please edit your Subject line so it is more specific than "Re: Contents of NZNOG digest..." Today's Topics: 1. Telecom NZ Contact (Trent Farrell) ---------------------------------------------------------------------- Message: 1 Date: Tue, 4 Feb 2014 12:19:25 +0000 From: Trent Farrell <tfarrell(a)riotgames.com> To: "nznog(a)list.waikato.ac.nz" <nznog(a)list.waikato.ac.nz> Subject: [nznog] Telecom NZ Contact Message-ID: <80289F43-A47C-4290-ABFC-5728C91EB5BA(a)riotgames.com> Content-Type: text/plain; charset="us-ascii" Hi all, Looking for someone from Telecom NZ to reach out off list, your customers are having issues with parts of our service. Cheers. - Trent ------------------------------ _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog End of NZNOG Digest, Vol 134, Issue 2 *************************************

1 0

Telecom NZ Contact
by Trent Farrell 03 Feb '14

03 Feb '14

Hi all, Looking for someone from Telecom NZ to reach out off list, your customers are having issues with parts of our service. Cheers. - Trent

1 0

Fwd: BCP 38
by Andy Linton 31 Jan '14

31 Jan '14

At NZNOG, Jamie Baddeley mention the spoofer tool at http://spoofer.cmand.org/ I ran it on the net I run at VUW and here are the traces from a couple of runs. I ran it once, realised I was being slack and turned on the 'rfp-check' feature on the edge Juniper and then ran the test again. A nice tool to demonstrate why we should do BCP 38.

1 0

Re: [nznog] Do you stream video?
by Richard Naylor 29 Jan '14

29 Jan '14

At 05:15 p.m. 15/01/2014, Dean Pemberton wrote: >Due to unforeseen circumstances our usual video streaming company of >choice (R2) is unable to stream NZNOG live this year. We're in AKL on another job. The plan is to send a camera operator to Nelson with a small portable encoder. The encoder planned is still in USA and won't be back in time. It died just after New Years day. I think we can free up one from the AKL job on wednesday, but need it back on the Saturday or Sunday after NZNOG, and are not confident couriers can do it. We also have very limited transport and time in AKL as we are parked up on a job. But if anyone can collect the unit from us on the Wednesday and take it to Nelson, then bring it back to AKL on the Saturday (we may have wheels on Saturday) that would solve the issue. I can probably meet someone at the airport and provide a ride home on the Saturday. The encoder is in a small plastic case about 200mmx150x100. Richard 021 897 089

9 10

Lightning talks
by Richard Nelson 29 Jan '14

29 Jan '14

If anyone has a lightning talk and can’t find me at the conference. Just email me off list. Richard.

1 0

One Day down.... Four to go
by Dean Pemberton 26 Jan '14

26 Jan '14

Hello from NZNOG 2014 in sunny Nelson! The venue is awesome and we're off to a great start. The BGP Routing and Network Security workshops are underway and the participants have been giving outstanding feedback. We've got less than 10 more registration slots left for the main conference before we're all sold out. If you're leaving it until the last minute... I'd suggest that you don't . See you all here. Dean

1 0

Re: [nznog] NZNOG Digest, Vol 133, Issue 14
by Jonathan Spence 26 Jan '14

26 Jan '14

They have been doing this for ages (maybe 6 months at least). We had to disable IPv6 on our mail server as we were struggling to get rDNS delegation from Orcon. Got too busy to follow up on it but will do so when I get a minute. Jonathan Spence Chief Executive Officer Fixed: +64 9 9510448 Mobile: +64211055634 ---------------------------------------- From: nznog-request(a)list.waikato.ac.nz Sent: Sunday, January 26, 2014 12:01 PM To: nznog(a)list.waikato.ac.nz Subject: NZNOG Digest, Vol 133, Issue 14 Send NZNOG mailing list submissions to nznog(a)list.waikato.ac.nz To subscribe or unsubscribe via the World Wide Web, visit http://list.waikato.ac.nz/mailman/listinfo/nznog or, via email, send a message with subject or body 'help' to nznog-request(a)list.waikato.ac.nz You can reach the person managing the list at nznog-owner(a)list.waikato.ac.nz When replying, please edit your Subject line so it is more specific than "Re: Contents of NZNOG digest..." Today's Topics: 1. heads up.. gmail now checking ipv6 rdns (Blair Harrison) 2. Re: heads up.. gmail now checking ipv6 rdns (Scott Howard) 3. Re: heads up.. gmail now checking ipv6 rdns (Michael Fincham) 4. Re: heads up.. gmail now checking ipv6 rdns (Phil Regnauld) ---------------------------------------------------------------------- Message: 1 Date: Sat, 25 Jan 2014 13:43:28 +1300 From: Blair Harrison <nznog(a)jedi.school.nz> To: NZNOG <nznog(a)list.waikato.ac.nz> Subject: [nznog] heads up.. gmail now checking ipv6 rdns Message-ID: <CAHn0gTveE=Nh-jp9Lfdw67UDAy=4Y-rgi-4h7t8zr1R_4p73zg(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" Hi Folks, Just got caught out with this on my personal box today. It looks as if Gmail is now checking RDNS on any inbound ipv6 smtp connections and rejecting with 500 error if it doesn't match. example fail - SMTP error from remote mail server after end of data: host gmail-smtp-in.l.google.com [2a00:1450:4008:c01::1a]: 550-5.7.1 [2402:6000:1000:x::x] Our system has detected that this message does 550-5.7.1 not meet IPv6 sending guidelines regarding PTR records and 550-5.7.1 authentication. Please review 550-5.7.1 https://support.google.com/mail/?p=ipv6_authentication_errorfor more 550 5.7.1 information. oq6si4802967bkb.182 - gsmtp So if you have ipv6 enabled on your mail servers and haven't yet set some RDNS for them.. now is the time. Cheers, Blair

1 0

heads up.. gmail now checking ipv6 rdns
by Blair Harrison 25 Jan '14

25 Jan '14

Hi Folks, Just got caught out with this on my personal box today. It looks as if Gmail is now checking RDNS on any inbound ipv6 smtp connections and rejecting with 500 error if it doesn't match. example fail - SMTP error from remote mail server after end of data: host gmail-smtp-in.l.google.com [2a00:1450:4008:c01::1a]: 550-5.7.1 [2402:6000:1000:x::x] Our system has detected that this message does 550-5.7.1 not meet IPv6 sending guidelines regarding PTR records and 550-5.7.1 authentication. Please review 550-5.7.1 https://support.google.com/mail/?p=ipv6_authentication_errorfor more 550 5.7.1 information. oq6si4802967bkb.182 - gsmtp So if you have ipv6 enabled on your mail servers and haven't yet set some RDNS for them.. now is the time. Cheers, Blair

4 3

Fibre circulators?
by Sam Russell 23 Jan '14

23 Jan '14

Hi guys, Does anyone recommend a supplier for fibre circulators, preferably with LC connectors? I'd be keen to hear anyone's experiences/horror stories with them if you're willing to volunteer them. Cheers Sam

6 7

Great Firewall of China misconfig; traffic re-routed
by Juha Saarinen 22 Jan '14

22 Jan '14

Somewhat operational, with amusement potential and besides, it’s too early for beer (surely???): http://www.itnews.com.au/News/370324,great-firewall-mishap-reroutes-chinese… Has anyone seen a more detailed explanation as to what happened? — Juha

1 0

Acceptable levels of packet loss
by Matthew Poole 21 Jan '14

21 Jan '14

Been running SmokePing for a little while now, building up a statistical sample, and wondering what's an acceptable level of loss to be seeing through the provider's core, both to targets foreign and domestic and also from the premises to the first hop in the provider's network. Obviously I'm seeing a non-zero level (averages are in the zero-point-something range, but some of the maximums are above 0), so want to know what people consider to be the point where I go from "unreasonable customer" to "customer with a justified concern"? -- Matthew Poole "The difference between theory and practice is that practice is easier in theory than theory is in practice"

8 10

IPv4 Brokering and Availability Announcements
by Skeeve Stevens 19 Jan '14

19 Jan '14

Hi all, I will keep this brief. After many comments to us where people have had to deal with US companies to acquire IPv4, eintellego Networks has decided formalise a service offering IP Brokering. After facilitating and consulting for over a dozen transactions in different countries (including NZ) under the APNIC region - including NZ, we thought it would be good to have a service available locally by someone you know. For more information: http://eintellegonetworks.com/site/ipbrokering/ So, rather than trolling lists when ranges become available or we have a client looking to sell a block, I've setup an announcement list so that I can let interested parties know when a range is available. If you wish to join this list and receive these announcements, please visit: http://eintellegonetworks.com/site/v4announce/ to sign-up. FYI, eintellego Networks has just launched in NZ as a locally registered foreign company to mainly do other business including hardware/consulting and network operations. Also, eintellego Networks is the only APNIC registered<http://www.apnic.net/services/become-a-member/manage-your-membership/transf…>IPv4 broker that is based in the APNIC region (all the other are presently American). Any questions, feel free to let me know off-list. ...Skeeve *Skeeve Stevens - *eintellego Networks Pty Ltd skeeve(a)eintellegonetworks.co.nz ; www.eintellegonetworks.co.nz Phone: +612 8014 7398; Cell +61 (0)414 753 383 ; skype://skeeve facebook.com/eintellegonetworks ; <http://twitter.com/networkceoau> linkedin.com/in/skeeve twitter.com/theispguy ; blog: www.theispguy.com The Experts Who The Experts Call Juniper - Cisco - Cloud - Consulting - IPv4 Brokering

2 3

Do you stream video?
by Dean Pemberton 14 Jan '14

14 Jan '14

Hi Everyone, Due to unforeseen circumstances our usual video streaming company of choice (R2) is unable to stream NZNOG live this year. They are able to record the session and have it available for streaming later on, It's just the live streaming they can't provide. Is there anyone in the community who does this sort of thing and wants to step forward and have a go? Just email krystal(a)internetnz.net.nz and let her know. The provisio is that it has to be drama free and this isn't an opportunity to 'try things out'. If you haven't done this sort of thing/scale before, then you might be best to give it a miss. If no one comes forward, then record-for-later-streaming it is.

1 0

NZNOG 2014 Social Events
by Dean Pemberton 13 Jan '14

13 Jan '14

Hi Everyone. Another conference update. THURSDAY NIGHT CONFERENCE DINNER Conference Dinner on the Thursday night will be a buffet style dinner has been organised for the Thursday night dinner, 6:30pm at the Mercure Monaco Marquette. Buses will leave from The Rutherford hotel at 6pm and return on the hour from 9 to 11pm. There is even a pub across the road called The Honest Lawyer for those who feel the need to move on. http://www.monacoresort.co.nz/ WEDNESDAY NIGHT I've also been asked what the plan is for the Wednesday evening. As it happens, nothing. In the mists of time, Wednesday night was always informally organised. Often involving food from the sub-continent. Everyone split the bill and basically it was Thursday Night Curry on a Wednesday night! Like Christmas in July! In more recent years, a specific spondsor kindly funded drinks and nibbles on the Wednesday at many a well respected establishment. With this in mind we placed the position of "Networking Drinks" on the sponsorship document in case someone wanted to take up the opportunity. So far this year none of our sponsors have indicated that they would like to take up this offer, so we will return to the default informal arrangement of the past. That being said there are options. If you are a potential sponsor who would like to fund an event on the Wednesday night, our events person Krystal (krystal(a)internetnz.net.nz) would be more than happy to talk through the opportunities with you. I'm also told there are some nice Indian places in Nelson http://www.menus.co.nz/restaurants/indian/nelson/ Failing that there are places that sell beer. http://maps.google.com/maps/ms?ie=UTF8&hl=en&msa=0&msid=1017353080318029218… Basically at the moment it will be up to people to arrange their own food/fun on Wednesday, but being the well adjusted social people I know you all are, I'm sure this won't be a problem. If we do get a benevolent sponsor come forward to save the Wednes-Day we'll be sure to let you know ASAP. Regards, Dean

1 0

Full Programme for NZNOG 2014
by Dean Pemberton 12 Jan '14

12 Jan '14

Hi Everyone, We've just shuffled together all the great talks we've got planned for the conference. The programme as it currently stands is here: http://www.nznog.org/home/nznog-2014-conference-programme You can download an ICS from the link of the bottom of that page. Don't forget to register. The SDN/OpenFlow Tutorial is now full (Although there is a waitlist, email krystal(a)internetnz.net.nz) but there are plenty of other cool things to attend. Don't forget to register! See you all there. Dean

1 0

Plea for help - Ethernet cables.
by Dean Pemberton 10 Jan '14

10 Jan '14

So it turns out that the SDN OpenFlow tutorial has turned into a bit if a thing. While it was going to use mainly VMs and simulators, Citylink has supplied 20 mikrotik routerboards for the class to actually configure into an openflow controlled data plane. On ya guys, much appreciated, great NZNOG and SDN supporters as always. What I'm after now however is the around 60 Ethernet cables to hook it all together. If anyone could help me out so that I don't need to buy them that would be awesome. Yes you get then back afterwards. Thanks heaps. It should be an awesome tut. Dean

1 0

Situations Vacant: Senior Network Engineer
by Mark Foster 09 Jan '14

09 Jan '14

Greetings, ICONZ-Webvisions currently have a vacancy for a Senior Network Engineer, to be based at the iWV offices in Auckland. We're looking for an experienced Cisco engineer with experience working on ASR, 2800/2900/3700/6500/7200 series devices, with exposure to the ISP world preferred. Other acronyms you'd be familiar with at a senior level would include MPLS, VRF, BGP, OSPF, QoS, VoIP. CCNP or equivalent experience is the listed minimum qualification. If you are interested, or know anyone who might be, please have them drop me a note ASAP - we're already interviewing likely candidates and will need to make an offer fairly soon. Off-list questions, or expressions of interest, are welcomed in the meantime. Thanks, Mark.

1 0

Want a free NZNOG 2014 conference ticket?
by Dean Pemberton 06 Jan '14

06 Jan '14

Krystal is looking for one or 2 more volunteers to help with registration and pack up. Duties will be - manning the registration desk on Thursday Morning (8am - 9.30am) and helping pack up gear to be shipped back in INZ on Friday after conference ends (4.00 - 6.00). If you put your hand up then we're happy to comp you a ticket, they may miss a couple of talks - but you should still manage to attend the bulk of the conference. If you're interested then please email krystal(a)internetnz.net.nz and let her know. If there is a huge influx of interest then some advanced algorithm will be used to determine those accepted. =)

2 1

Call for Presentations - DNS-OARC Spring Workshop, May 2014
by Sebastian Castro 05 Jan '14

05 Jan '14

Call for Presentations - DNS-OARC Spring Workshop, May 2014 Next OARC Spring Workshop will take place in Warsaw, Poland on May 10th and 11th, the weekend before RIPE68. OARC is requesting proposals for presentations, with a preference for DNS privacy and confidentiality work and ideas, and DNS over alternative (non UDP) transports. This workshop continues OARC's tradition of having meetings include a strong operational component. Presentations from DNS operators are particularly welcome. We'll also gladly accept talks from DNS researchers, as well as any other DNS-related subjects such as tools, visualizations and data analysis. If you are an OARC member, and have a sensitive topic you would like to present for members-only, we will accommodate those talks too. Adopting practice from other conferences, a section of lightning talks will be added for short presentations. Workshop Milestones * 20 December 2013, Call for Presentations posted * 6 January 2014, Open for submissions * 1 March 2014, Deadline for submission * 28 March 2014, Final Program published * May 9 2014, Final deadline for slideset submission Details for abstract submission are be published here: https://indico.dns-oarc.net/event/workshop-2014-05 If you consider submitting a presentation, please let the Programme Committee know in advance to help us organize the presentations tracks. You can contact the Programme Committee: https://www.dns-oarc.net/oarc/programme via submissions(a)dns-oarc.net if you have questions or concerns. Sebastian Castro, for the OARC Programme Committee (Please note that OARC is run on a non-profit basis, and is not in a position to reimburse expenses or time for speakers at its meetings.)

1 0

CARDIGAN implements RPKI - Cleanliness of prefixes onWIX
by Dean Pemberton 05 Jan '14

05 Jan '14

Hi All, CARDIGAN has just finished implementing RPKI Origin Validation on its WIX peering connection. What this effectively does is finds out if ASs are permitted to announce the IP addresses that they are advertising to the exchange. CARDIGAN then makes a decision on wether to allow invalid announcements to be turned into OpenFlow rules. So I thought you'd all be interested in the state of the prefixes on the exchange. The following table has removed all the routes for which no RPKI information was found. This leaves two conditions: Lines which start with a "V" have a valid RPKI ROA. That means that the AS originating the prefix has been explicitly authorised by the IP resource owner to do so. Likes which start with an "I" have an RPKI ROA which is different to the route seen. This means that the AS originating the prefix has been explicitly disallowed from doing so by the IP resource owner. These are explicit authorisations as the IP Resource owner has had to go to an RPKI trust anchor (normally the RIRs) and request certification of the ASs allowed to originate the prefix (or subnet of the prefix). For most of us (who are APNIC members) this is as simple as logging into the MyAPNIC portal and creating an ROA. APNIC handles everything else for you. Anything that turns up as an "I" on this list, I'm going to be looking at pretty carefully before I prefer into the CARDIGAN network. Anyone with more questions about RPKI, how it works, what it means, how to get it going. Feel free to post/email me. Network Next Hop Metric LocPrf Weight Path V* 58.28.0.0/16 202.7.1.22 30 0 9439 17435 i V*> 202.7.1.22 30 0 9439 17435 i V* 103.10.233.0/24 202.7.0.190 30 0 9439 132003 i V*> 202.7.0.190 30 0 9439 132003 i V* 103.23.16.0/22 202.7.0.222 30 0 9439 132040 i V*> 202.7.0.221 30 0 9439 132040 i I* 103.23.16.0/24 202.7.0.222 10 0 9439 132040 i I*> 202.7.0.221 10 0 9439 132040 i I* 103.23.17.0/24 202.7.0.222 10 0 9439 132040 i I*> 202.7.0.221 10 0 9439 132040 i I* 103.23.18.0/23 202.7.0.222 10 0 9439 132040 i I*> 202.7.0.221 10 0 9439 132040 i V* 113.197.96.0/22 202.7.0.211 30 0 9439 45831 45831 i V*> 202.7.0.211 30 0 9439 45831 45831 i I* 113.197.96.0/28 202.7.0.211 10 0 9439 45831 i I*> 202.7.0.211 10 0 9439 45831 i I* 113.197.96.32/27 202.7.0.211 10 0 9439 45831 i I*> 202.7.0.211 10 0 9439 45831 i I* 113.197.96.96/28 202.7.0.211 10 0 9439 45831 i I*> 202.7.0.211 10 0 9439 45831 i I* 113.197.96.112/28 202.7.0.211 10 0 9439 45831 i I*> 202.7.0.211 10 0 9439 45831 i I* 113.197.96.168/29 202.7.0.211 10 0 9439 45831 i I*> 202.7.0.211 10 0 9439 45831 i I* 113.197.98.32/29 202.7.0.211 10 0 9439 45831 i I*> 202.7.0.211 10 0 9439 45831 i I* 113.197.98.64/27 202.7.0.211 10 0 9439 45831 i I*> 202.7.0.211 10 0 9439 45831 i I* 116.90.130.16/29 202.7.0.176 10 0 9439 38477 i I*> 202.7.0.176 10 0 9439 38477 i I* 116.90.130.96/29 202.7.0.176 10 0 9439 38477 i I*> 202.7.0.176 10 0 9439 38477 i I* 116.90.135.0/24 202.7.0.176 10 0 9439 38477 45641 i I*> 202.7.0.176 10 0 9439 38477 45641 i V* 116.90.139.0/24 202.7.0.176 30 0 9439 38477 i V*> 202.7.0.176 30 0 9439 38477 i I* 116.90.139.0/29 202.7.0.176 10 0 9439 38477 i I*> 202.7.0.176 10 0 9439 38477 i I* 116.90.139.8/29 202.7.0.176 10 0 9439 38477 i I*> 202.7.0.176 10 0 9439 38477 i I* 116.90.139.16/29 202.7.0.176 10 0 9439 38477 i I*> 202.7.0.176 10 0 9439 38477 i I* 116.90.139.24/29 202.7.0.176 10 0 9439 38477 i I*> 202.7.0.176 10 0 9439 38477 i I* 116.90.139.64/27 202.7.0.176 10 0 9439 38477 i I*> 202.7.0.176 10 0 9439 38477 i I* 116.90.139.144/29 202.7.0.176 10 0 9439 38477 i I*> 202.7.0.176 10 0 9439 38477 i V* 118.90.0.0/16 202.7.1.22 30 0 9439 17435 i V*> 202.7.1.22 30 0 9439 17435 i 202.7.0.76 20 0 9439 24006 i V* 182.154.0.0 202.7.1.22 30 0 9439 17435 i V*> 202.7.1.22 30 0 9439 17435 i 202.7.0.168 20 0 9439 i I* 198.48.0.0/23 202.7.0.222 10 0 9439 132040 i I*> 202.7.0.221 10 0 9439 132040 i I* 198.48.2.0 202.7.0.222 10 0 9439 132040 132001 i I*> 202.7.0.221 10 0 9439 132040 132001 i I* 198.48.3.0 202.7.0.222 10 0 9439 132040 i I*> 202.7.0.221 10 0 9439 132040 i I* 202.7.4.0 202.7.0.222 10 0 9439 132040 23755 i I*> 202.7.0.221 10 0 9439 132040 23755 i I* 202.7.5.0 202.7.0.222 10 0 9439 132040 23755 i I*> 202.7.0.221 10 0 9439 132040 23755 i I* 202.7.6.0 202.7.0.222 10 0 9439 132040 23755 i I*> 202.7.0.221 10 0 9439 132040 23755 i I* 202.7.7.0 202.7.0.222 10 0 9439 132040 23755 i I*> 202.7.0.221 10 0 9439 132040 23755 i V* 203.119.88.0/23 202.7.1.253 30 0 9439 42 187 i V*> 202.7.1.253 30 0 9439 42 187 i 202.7.1.252 20 0 9439 i 202.7.0.147 20 0 9439 24183 45563 i 202.7.0.147 20 0 9439 24183 ? 202.7.0.128 20 0 9439 i 202.7.0.107 20 0 9439 i

2 3

2821 ipv4 table size
by Bill Walker 30 Dec '13

30 Dec '13

Hate to post this but my google foo is failing me anyone know the ipv4 max table size on a 2821? Would be running eBGP with two peers. Sent from my iPhone

2 2

Fraud Calls
by Davey Goode 27 Dec '13

27 Dec '13

Hi All, I hope everyone is having a good break ! If anyone out there has had any of their customers PBX's hacked recently (in the last 2 - 3 weeks) and have experienced a large call flow to say Somalia or some other dodgy destination id be keen to hear from you, I'm after the destination numbers they are dialling. replies off list would be great. cheers davey

3 2

How often does NZRS root reload?
by Skeeve Stevens 18 Dec '13

18 Dec '13

Hey all, Just registered a co.nz domain and it is registered and visible in whois. But ;; AUTHORITY SECTION: co.nz. 3285 IN SOA loopback.dns.net.nz. soa.nzrs.net.nz. 2013121964 900 300 604800 3600 How often does this server refresh its data? ...Skeeve *Skeeve Stevens - *eintellego Networks Pty Ltd skeeve(a)eintellegonetworks.com ; www.eintellegonetworks.com Phone: 1300 239 038; Cell +61 (0)414 753 383 ; skype://skeeve facebook.com/eintellegonetworks ; <http://twitter.com/networkceoau> linkedin.com/in/skeeve twitter.com/theispguy ; blog: www.theispguy.com The Experts Who The Experts Call Juniper - Cisco - Cloud

3 4

NZNOG 2014 Update
by Dean Pemberton 16 Dec '13

16 Dec '13

Hi Everyone. Registrations have been open for the conference for a while now and I'm pleased to say that they are at an unprecedented level for this time of year. Given that we've only just released the program, thats an outstanding achievement. With some great help from InternetNZ the conference is shaping up to be as awesome as usual. First up I'd like to thank the sponsors who have signed on thus far: Go Wireless - Gold Network Hardware Resale - Gold Vocus - Gold CityLink - Gold GKC - Silver Brocade - Silver Arbor Networks - Silver APNIC - Silver Extreme Networks - Silver Kordia - Bandwidth Sponsor We have more slots open for sponsorship as well as the much coveted Platinum sponsor position. If you would like to ensure that your organisation gets high visability at the event then contact sponsorship(a)nznog.org for a sponsorship pack. We know that the program is an important part of convincing your organisations that you need to attend. This year we've got a wide range of speakers lined up along with some great Workshops and tutorials. Program: International Keynotes: Tom Paseka (CloudFlare) - NZ Perspectives from a global CDN Roland Dobbins (Arbor Networks) - TBA Conference Presentations: Geoff Huston (APNIC) - Measuring DNSSEC Jamie Baddeley (Citylink) - NZIX2/Citylink SDN Sam Russell (REANNZ) - Building a better Skype with WebRTC, SIP, and ENUM Barry Brailey (DNC) .nz DNSSEC programme Jean-Sébastien Fontana (Extreme Networks) - Introduction to TRILL Gerard Creamer (Netspace) - Experiences with dual A records vs anycasting Beatty Lane-Davis (Cyan) - SDN & NFV Michael Fincham (Unleash) - RPKI Peter Gent (MBIE) - 5GHz Wireless Links Jan Jorz (ISOC) - BCOP Project Quintin Russ (SiteHost) - IPv6 deployment in the cloud InternetNZ Update APNIC update WAND update Lightning Talks Workshops: Network Infrastructure Security BGP Routing Tutorials: OpenDNSSEC Installation and Configuration (1/2 day) SDN/OpenFlow Installation (1/2 day) Mikrotik Routing (full day) APNIC Internet Resource Management (1/2 day) We'd suggest you register now. At least this side of Xmas. Flights, Accommodation etc will likely be easier and cheaper the sooner you do it. Better than doing it in a panic in mid January. For more information on how to register, head off to http://www.nznog.org/register See you all there. Dean

1 0

Keeping it local
by Martin Kealey 15 Dec '13

15 Dec '13

I have a question which I'm hoping the NZNOG community can help me with. Within NZ, what is the maximum number of hops from APE to any consumer's interface device? (smarty-phone, ADSL modem, whatever)? Or more pragmatically, let's say the 99th percentile, as in, fewer than 1% of customers are more than X hops away from APE. If this information is already available, I'd appreciate a pointer, otherwise... If you are an ISP could you give me an indicative number of hops from APE to your customers' CPE. If you can include a prefix length reflecting the number of affected customers that would help too. (Ideally the maximum across all your customers, but if you have a few oddball customers with longer paths, just the 99% will do.) If you're an ISP customer and would like to tell me your hop-count to APE (counting from your CPE, not from your computer) and your ISP's name, that would also be appreciated. Replies off-list and I will summarize back to the list. Here's the background: I'm investigating ways of limiting traffic so that it does not leave New Zealand, that can be configured on an application-by-application basis. Obviously if one has an upstream to "global" and a separate upstream to APE or WIX, then it's simple to filter traffic at those egresses. However for the average end-user, it's difficult to get multiple VLANs to their provider, let alone multiple physical links. In an ideal world, one would simply set some QoS bits and your upstream would understand them and do the filtering based on *their* egress, but in practice I haven't heard of any suppliers offering such a service. So I'm looking at DIY options ... In particular, I'm looking at setting the TTL on outgoing packets. We know how many hops it is from "our" hosts to APE, and I guestimate no more than 2 hops from a consumers border device (modem, whatever) to their client devices; So far it looks like setting the TTL so that it's down to 5 at APE will mean most of NZ is reachable, and most of the rest of the world isn't, assuming the international provider is as many hops from me as APE. But I'd really like to get a firmer idea of "how much of NZ will be unreachable given an egress hop limit of X?" (The idea is to find X where the list of exception prefixes is small enough to manage manually, while still blocking the majority of foreign traffic.) What I'd like to find out from the NZNOG community is the distribution of customers at various hop-counts from APE. -Martin

3 3

ISC/F-Root has returned to APE...
by Peter Losher 11 Dec '13

11 Dec '13

FYI - the Auckland node of F.ROOT-SERVERS.NET has been offline for the past couple of years due to HW failure, access issues @SkyTower, changes with our hosts (contacts and access to said data center). I am happy to report that the node is finally back online and advertising F's prefixes to the APE fabric as I type... So come and send your DNS root server queries locally instead of sending them off-shore. We are AS23710 @APE, so if you don't peer with us already, pop us a note at peering(a)isc.org. Yes, Telecom NZ, I am looking at you. Yes, you... (a guy can dream, even if it is hopeless) ;) There are many folks to thank as ISC could not do it alone including: - NZRS (Jay, Sebastian and Dave) for sponsoring the new server gear. - APNIC for sponsoring the new routers. (sorry to see the old Juniper kit go though) - Sebastian and Mike Jager for dealing with my numerous remote hands requests from the other side of the world. - The Kiwi Internet Mafia (Joe Abley, AJ, Jonny) for their support and access to their contacts to keep things moving. - Vodafone NZ and FX Networks for (now redundant) transit over IPv4 and IPv6. - Our peers at APE that have put up with us for being down so long... :) O.k., commercial over; back to serving packets again. Best Wishes - Peter -- [ plosher(a)isc.org | Senior Operations Architect | ISC | PGP E8048D08 ]

5 5

Web Servers: Dual-homing or DNAT/Port Forwarding?
by Christoph Berthoud 10 Dec '13

10 Dec '13

Hi All, I'm curious to know which of the following methods is more widely used/accepted today for publishing web servers to the Internet. 1) Dual-home the server - place one NIC on the internet and a second NIC on an internal network for administration, or 2) DNAT/Port Forward my external IP to my internal IP 3) Both - Dual home the server onto two private subnets (external/internal) and DNAT/Port Forward the public IP to the external subnet IP In either case: a) I will be hiding behind a dedicated firewall appliance and not relying on the OS firewalls b) the internal network will still be in its own subnet firewalled away from the rest of the network c) Only HTTP/HTTPS will be permitted from the internet, no RDP, SSH etc d) I will be deploying IPv6 to this machine in the next 12 months which makes option 1 more attractive I personally like option 1 but I'm looking to see if theres any facepalm reasons I shouldn't do it this way. Happy holidays! -- Thanks Christoph

9 10

JANOG 33 Program Published
by Daniel Griggs 09 Dec '13

09 Dec '13

Dear Colleagues, We have published the program for JANOG 33 and welcome you to join us in Beppu City, Japan, from 23rd-24th Jan 2014. Most sessions are in Japanese only but there are a few sessions in English. You are also welcome to connect with us through facebook and twitter for updates in English. The JANOG SNS accounts are open to everyone, including those who are not able to attend the meeting. See you in Beppu. Cheers, Shinichi Yamamoto, Chin Sze Yih, Izumi Okutani JANOG Internationalization team for JANOG 33 ----- JANOG 33 Program : ------------------------ The Program is available in English at: http://www.janog.gr.jp/en/index.php?JANOG33%20Programs%2FJANOG33%20Program%… Translations of the program titles and abstracts were supported by volunteers on the best efforts basis. Note: During the meeting, there will be no official interpretations in English, except for the sessions marked as (English session). Registration : ------------------------ You can register online at: https://regist.e-side.co.jp/product_info.php?products_id=427&language=en 　Deadline: 10th Jan 2014 JST 15:00 SNS Accounts : ------------------------ Facebook : https://www.facebook.com/janogmeetingi18n Twitter : https://twitter.com/janog_i18n -- Daniel Griggs e + j: daniel(a)pch.net c: +64 (21) 845158

1 0