- NZNOG - lists.nznog.org

NZRR Route Registry Update
by NZRR Database Notifications 08 Aug '12

08 Aug '12

Dear Colleague, This is to notify you that one or more objects in which you are designated for notification have been modified in the NZRR routing registry database. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. Diagnostic output: ------------------------------------------------------------ --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS4770 descr: advertised to AS9439 by ICONZ Ltd - AS4770 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 166.65.0.0/16^16-29, 210.48.0.0/17^17-29, 210.185.0.0/18^18-29, 119.15.0.0/19^19-29, 180.189.192.0/19^19-29, 202.14.32.0/19^19-29, 202.50.192.0/19^19-29, 202.154.128.0/19^19-29, 210.54.160.0/19^19-29, 114.134.160.0/20^20-29, 202.46.160.0/20^20-29, 202.53.176.0/20^20-29, 202.55.96.0/20^20-29, 202.86.96.0/20^20-29, 202.160.48.0/20^20-29, 202.174.160.0/20^20-29, 202.191.32.0/20^20-29, 203.96.16.0/20^20-29, 203.96.48.0/20^20-29, 203.96.128.0/20^20-29, 210.48.160.0/20^20-29, 210.56.32.0/20^20-29, 114.134.176.0/21^21-29, 116.90.128.0/21^21-29, 117.18.80.0/21^21-29, 120.89.80.0/21^21-29, 120.138.16.0/21^21-29, 123.108.144.0/21^21-29, 192.173.16.0/21^21-29, 202.12.248.0/21^21-29, 202.37.144.0/21^21-29, 202.37.224.0/21^21-29, 202.46.176.0/21^21-29, 202.49.0.0/21^21-29, 202.49.152.0/21^21-29, 202.74.224.0/21^21-29, 202.78.240.0/21^21-29, 202.126.80.0/21^21-29, 202.160.112.0/21^21-29, 203.190.208.0/21^21-29, 205.233.128.0/21^21-29, 210.4.208.0/21^21-29, 103.5.72.0/22^22-29, 113.197.64.0/22^22-29, 114.31.212.0/22^22-29, 202.36.36.0/22^22-29, 202.37.48.0/22^22-29, 202.37.140.0/22^22-29, 202.37.200.0/22^22-29, 202.41.136.0/22^22-29, 202.50.52.0/22^22-29, 202.59.4.0/22^22-29, 202.89.4.0/22^22-29, 203.80.60.0/22^22-29, 210.54.136.0/22^22-29, 210.55.24.0/22^22-29, 202.6.116.0/23^23-29, 202.21.136.0/23^23-29, 202.36.44.0/23^23-29, 202.36.76.0/23^23-29, 202.36.204.0/23^23-29, 202.37.86.0/23^23-29, 202.37.240.0/23^23-29, 202.37.252.0/23^23-29, 202.49.80.0/23^23-29, 202.50.246.0/23^23-29, 202.174.6.0/23^23-29, 203.84.134.0/23^23-29, 205.233.136.0/23^23-29, 210.55.182.0/23^23-29, 103.4.121.0/24^24-29, 103.8.80.0/24^24-29, 124.248.128.0/24^24-29, 124.248.132.0/24^24-29, 124.248.136.0/24^24-29, 124.248.140.0/24^24-29, 182.236.127.0/24^24-29, 192.88.85.0/24^24-29, 192.100.53.0/24^24-29, 192.107.113.0/24^24-29, 192.122.171.0/24^24-29, 192.133.31.0/24^24-29, 192.173.24.0/24^24-29, 192.195.219.0/24^24-29, 198.32.66.0/24^24-29, 198.32.71.0/24^24-29, 199.212.93.0/24^24-29, 202.6.84.0/24^24-29, 202.8.13.0/24^24-29, 202.12.0.0/24^24-29, 202.12.70.0/24^24-29, 202.12.91.0/24^24-29, 202.14.100.0/24^24-29, 202.20.97.0/24^24-29, 202.21.130.0/24^24-29, 202.27.83.0/24^24-29, 202.27.208.0/24^24-29, 202.36.33.0/24^24-29, 202.36.75.0/24^24-29, 202.36.119.0/24^24-29, 202.36.154.0/24^24-29, 202.36.162.0/24^24-29, 202.36.183.0/24^24-29, 202.36.218.0/24^24-29, 202.36.226.0/24^24-29, 202.37.57.0/24^24-29, 202.37.76.0/24^24-29, 202.37.85.0/24^24-29, 202.37.93.0/24^24-29, 202.37.136.0/24^24-29, 202.37.163.0/24^24-29, 202.37.168.0/24^24-29, 202.37.197.0/24^24-29, 202.37.205.0/24^24-29, 202.37.232.0/24^24-29, 202.41.140.0/24^24-29, 202.46.118.0/24^24-29, 202.46.188.0/24^24-29, 202.46.190.0/24^24-29, 202.49.62.0/24^24-29, 202.49.89.0/24^24-29, 202.49.106.0/24^24-29, 202.49.144.0/24^24-29, 202.49.249.0/24^24-29, 202.50.87.0/24^24-29, 202.134.48.0/24^24-29, 203.97.5.0/24^24-29, 203.119.56.0/24^24-29, 203.171.223.0/24^24-29, 205.233.243.0/24^24-29, 210.54.140.0/24^24-29, 210.54.211.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: engineering(a)iconz.net mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20120426 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS4770 descr: advertised to AS9439 by ICONZ Ltd - AS4770 members: 210.48.0.0/17^17-29, 210.185.0.0/18^18-29, 210.54.160.0/19^19-29, 120.138.16.0/20^20-29, 210.56.32.0/20^20-29, 223.165.64.0/20^20-29, 202.12.248.0/21^21-29, 202.37.144.0/21^21-29, 202.37.224.0/21^21-29, 202.74.224.0/21^21-29, 202.78.240.0/21^21-29, 103.5.72.0/22^22-29, 202.36.36.0/22^22-29, 202.37.140.0/22^22-29, 202.37.200.0/22^22-29, 202.41.136.0/22^22-29, 203.80.60.0/22^22-29, 210.54.136.0/22^22-29, 210.55.24.0/22^22-29, 114.134.176.0/23^23-29, 202.36.76.0/23^23-29, 202.37.240.0/23^23-29, 205.233.136.0/23^23-29, 210.4.212.0/23^23-29, 103.8.80.0/24^24-29, 198.32.66.0/24^24-29, 202.6.84.0/24^24-29, 202.12.70.0/24^24-29, 202.14.100.0/24^24-29, 202.21.130.0/24^24-29, 202.27.140.0/24^24-29, 202.27.208.0/24^24-29, 202.36.45.0/24^24-29, 202.36.183.0/24^24-29, 202.37.57.0/24^24-29, 202.37.73.0/24^24-29, 202.37.76.0/24^24-29, 202.37.85.0/24^24-29, 202.37.163.0/24^24-29, 202.37.197.0/24^24-29, 202.46.181.0/24^24-29, 202.46.188.0/24^24-29, 202.46.190.0/24^24-29, 202.49.62.0/24^24-29, 202.50.87.0/24^24-29, 202.50.139.0/24^24-29, 202.134.48.0/24^24-29, 210.54.140.0/24^24-29, 210.54.211.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc(a)iconz.net mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20120809 source: NZRR ------------------------------------------------------------

1 0

Changes to rs1.chix.nzix.net - 10am Monday
by Tim Hoffman 06 Aug '12

06 Aug '12

Greetings, As part of our continued effort to develop the NZIX route servers, we are planning to replace rs1.chix.nzix.net on Monday at 10am. We will observe a change freeze on the rest of our route servers nationwide (including rs2.chix.nzix.net) during this time. The new server is dual stacked and will support IPv6 on 2001:7FA:3:5F44::1/64. All the active peers have sessions pre-configured on this, your ipv6 address will be 2001:7FA:3:5F44::X/64, where X is the last octet of your v4 address (not a hex translation like we did to generate the APE v6 addresses) - i.e. if you are 218.100.24.17 then your v6 address will be 2001:7FA:3:5F44::17/64. The v6 peering is running now on this address for all peers, so please configure this up. Later next week we will be replacing rs2.chix.nzix.net with a dual stacked server also, we'll advise the details/timing of this once the rs1 replacement is complete. Changes of note include; Implementing v6 on the route servers. Only accepting up to /24's for v4 and /48's for v6. The only filtering we will provide is to deny bogon routes and defaults from peers. Also we are still on track to roll these changes out on the WIX in the next couple of weeks. Progress :). Feel free to drop me an email if you have any queries/comments regarding this. Regards, Tim

1 0

DNSSEC: co.nz now signed and deployment schedule for the moderated SLD
by Donald Neal 06 Aug '12

06 Aug '12

This message is forwarded on behalf of Sebastian Castro: ----- To our community: NZRS has completed today the deployment of DNSSEC for co.nz, enabling full validation for their sub-domains. All non-moderated second level domains now are DNSSEC-signed. InternetNZ has sent out a media release about this event http://tinyurl.com/crglf4z We also have added to our deployment calendar (http://nzrs.net.nz/dns/dnssec) the dates for the moderated second level domains. In summary, by the end of August the zones cri.nz, health.nz and iwi.nz will be signed. During the first two weeks of September, govt.nz, mil.nz, and parliament.nz will be signed, thus completing the DNSSEC schedule. Any DS records present in the registry for domains under those zones will be included as soon as the trust chain is completed. If you are keen to sign your domains, or they are already signed and need to submit DS records, a list of .nz Registrars who are either DNSSEC Friendly, or offer DNSSEC services can be found at http://dnc.org.nz/registrars Kind Regards, -- Sebastian Castro DNS Specialist .nz Registry Services (New Zealand Domain Name Registry Limited) desk: +64 4 495 2337 mobile: +64 21 400535 Donald Neal Senior Network Engineer Direct: +64 9 929 2958 Mobile: 0278081023 Fax: +64 9 929 2959

1 0

Pacific Fibre to Cease Operations - cites not enough investment.
by Joel Wirāmu Pauling 01 Aug '12

01 Aug '12

So if you haven't seen this; my question is if they don't have enough money to go "all the way" to LA why not at least re-align and put some NZ to AU fibre in? http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=10823806 -JoelW @aenertia +64 21 171 8049

20 43

Network Engineer roles ?
by Ian Batterbee 01 Aug '12

01 Aug '12

Hi all, I'm a little hesitant to post this, because I can't recall what the result of the last discussion on 'is this list an appropriate place to ask about jobs going in the industry' was... So, if the feeling was that it was okay, and anyone has openings going for an experienced network engineer, please let me know off-list. And if not, please imagine some lovely green sunny grassy fields :/

2 1

DNSSEC: A good or bad thing?
by Mark Goldfinch 01 Aug '12

01 Aug '12

Greetings all, I recently came across a presentation by DJB taking an in-depth look at how DNSSEC operates: http://cr.yp.to/talks/2012.06.04/slides.pdf I haven't seen much in the way of discussion on his assertions, so NZNOG, your opinion please! Thanks, -- Mark Goldfinch | Systems Team Leader MODICA GROUP

9 15

Re: [nznog] Pacific Fibre to Cease Operations - cites not enough investment.
by Joel Wirāmu Pauling 31 Jul '12

31 Jul '12

On 1 August 2012 16:21, Matthew Moyle-Croft <mmc(a)1mmc.com> wrote: > Like: http://www.commsday.com/commsday/2011/exclusive-china-telecom-huawei-units-… ? > I think you mis-understand the whole purpose (perhaps Dean can put his slides up somewhere) . I don't think this is about international capacity per-se, but quicker, faster, better links to AU - there are more CDN's there, it's easier to negotiate contracts for an 'Oceanic' market segment with the big content pushers. To quote Dean "We want to appear as a State of Australia, not a Suburb of LA" Wasn't there just another 200G pipe to US announced there last week from AU? Am aware of AXIN, but IIRC wasn't the major backer of Pacific Fibre PAC-NET, I would have through there are different politics involved; but I don't pretend to have the foggiest. If there were three providers to AU I think we might stand a chance of having on-negotiated competition out of AU which we can pitch into to.

2 1

Changes to rs2.ape.net.nz - 10am Tomorrow
by Sid Jones 31 Jul '12

31 Jul '12

Hola. We're in the process of final testing prior to livening up [animating?] a new route server to take the place of rs2.ape.net.nz on new hardware. There will be a brief outage tomorrow as we swap the servers. Note: rs1.ape.net.nz will not be affected by this change. The new server is dual-stacked and will support IPv6 on 2001:7fa:4:c0cb::9a02/64 - all the current v6 peers are configured on this server, feel free to configure up a session to the new server. Any issues, please let us know.

1 2

DNSSEC key signing
by Andy Linton 31 Jul '12

31 Jul '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 26 July 2012 I was a witness at the tenth KSK ceremony for the root zone in El Segundo, CA, USA. The Ceremony Administrator was Joe Abley. The tenth production Key Signing Request (KSR) generated by VeriSign was processed by ICANN using the root zone KSK generated in KSK Ceremony 1, and the resulting Signed Key Response (SKR) has been accepted by VeriSign. This SKR contains signatures for Q4 2012, for use between 2012-10-01 and 2012-12-31. The representation of the KSK key in the DS RR format is as follows: . IN DS 19036 8 2 49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5 For more information about the publication of the trust anchor see: https://data.iana.org/root-anchors/draft-icann-dnssec-trust-anchor.html For more information on the signing of the root see: http://www.root-dnssec.org/ Andy Linton -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (Darwin) Comment: GPGTools - http://gpgtools.org iD8DBQFQEyjakNpmQ2ketuURAv4iAKC+tlIUjnAwLOCBEqerBcHTVdQO1gCeKcFi RA79VvxJIxETt412y5GPDtk= =msdB -----END PGP SIGNATURE-----

1 0

Re: [nznog] DNSSEC: A good or bad thing?
by Andy Linton 31 Jul '12

31 Jul '12

On Wed, Aug 1, 2012 at 8:52 AM, <bmanning(a)vacation.karoshi.com> wrote: > > *Curve is a channel oriented security measure, like SIG(0) ad TSIG. > DNSSEC is a data integrity tool. > > different animals. And if you want some homework on DNSSEC try: http://www.dnsseccourse.nl/

1 0