- NZNOG - lists.nznog.org

Any spare Junipers?
by Nick Larsen 19 Jun '12

19 Jun '12

Hi all, Does anyone have any J2320's or SRX240h's for sale (in any condition, as just for a lab environment)? If so, please email nick(a)aptiv.co.nz Cheers, Nick Larsen

1 0

ARIN allows inter-RIR transfers.
by Dean Pemberton 18 Jun '12

18 Jun '12

Hi All, ARIN (the North American equivalent of APNIC) has just passed some new policy which has an impact for organisations in this region. There were three policies passed: ARIN-2011-1: ARIN Inter-RIR Transfers https://www.arin.net/policy/proposals/2011_1.html ARIN-2012-1: Clarifying requirements for IPv4 transfers https://www.arin.net/policy/proposals/2012_1.html ARIN-2012-3: ASN Transfers https://www.arin.net/policy/proposals/2012_3.html The impact for users in this regions is that APNIC members are now able to negotiate IPv4 Address Space transfers from organisations within the North American region. We have seen organisations in the ARIN region selling IP Address space in the past (Nortel selling 666k addresses to Microsoft for 7.5 million) , infact ARIN now has specific policy surrounding how to deal with a transfer in a bankruptcy scenario. The tricky part was that up until now they only allowed transfers to other members within the ARIN region. This meant that APNIC members were not able to get access to these resources and pull them into their APNIC account (and update the details around who currently holds them). This has now been changed so that as long as you can demonstrate to APNIC that you have a need for the addresses, and would have qualified for them under the old allocation scheme (ie when they still had addresses to give out), then you can transfer the numbers from the ARIN member into the APNIC region. This is generally considered a good thing. Having all users on an even footing is a step in the right direction. Anyone wanting some more clarification then feel free to post (if you think it's relevant to everyone) or mail me directly. Regards, Dean

5 5

InTAC invite
by Andy Linton 18 Jun '12

18 Jun '12

I forwarded something on this several days ago and I'm going to badger you once more about it. On Tuesday 10 July, InternetNZ is holding a one-day conference in Auckland to discuss issues related to the technical architecture and technical policy of ultra-fast broadband and fibre networks. See www.internetnz.net.nz/intac This is a chance for members of this group to meet with folks they often don't catch up with from the larger telcos and other industry players. We've got a couple of good speakers: Lev Gonick <http://www.case.edu/its/about/levgonick.html>, Chief Information Officer of Case Western Reserve University, Cleveland, USA Geoff Huston<http://www.apnic.net/publications/research-and-insights/geoff-huston>, Chief Scientist at APNIC and a chance to have some serious discussion about Technical Architecture Connectivity vs. Content UFB product specifications Technical Policy Keeping local traffic local - peering and interconnect Domestic and international IP transit

1 2

rs2.ape scheduled maintenence
by Tim Hoffman 17 Jun '12

17 Jun '12

Greetings, On Thursday 14 June Citylink will be taking rs2.ape (192.203.154.2) down for maintenance from 0800 till 0900. During this change window we will be observing a change freeze on the rest of the route servers nationwide. This is in preparation for upgrades which we are undertaking in the short to medium term. Cheers, Tim

1 1

ACL analyser
by Julian Maxwell 14 Jun '12

14 Jun '12

Hi All, I have a several-hundred-line extended ACL on a 6500, which is several years old and has had several admins over its time. As such, it is severaly (See what I did there?) ugly. I'm trying to find a tool that I can load this ACL into and it will tell me about redundant entries etc., as I have been given the envious task of moving the service it protects to a proper firewall. CiscoWorks ACL tool looks to be the business, but alas it's EOL and I can't find it anywhere. I don't want to pay hundreds/thousands for using something only once either. So what say you guys? Any suggestions on ACL managers? (Before you suggest, Gareth Evans ACL simulator won't work as you can't load ACL's into it). Cheers! Julian

3 2

RING Node in NZ
by Gaurab Raj Upadhaya 12 Jun '12

12 Jun '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello Noggers, I'd think some of you may be interested in a project run by some friends of mine: the NLNOG RING. Project came out of the NLNOG (the Dutch NOG) discussions. It's based around the goals of making network debugging easier. When trying to debug complex problems and plan future upgrades, a point of view from outside your network is absolutely essential. Seeing what others see is incredibly useful when dealing with a variety of network problems. Well known examples are ‘it works for even numbered ip address, but not for odd numbered ip address via this and this route’. So tired of asking people to do traceroutes and wait for results, NLNOG RING was formed. In essence the project is very simple: you make a (virtual) machine available to the RING, and you gain access on all other servers which are part of the RING. The project currently has 108 nodes, located on 100 participant networks in 25 countries. Was just looking and see that NZ is missing on that list, the home of the rings, so thought I'd send this out. The RING provides tools to trivially launch a ping from all these nodes and summarize the results to, other examples are distributed tracerouting and MTU testing. The RING also maintains a record of latencies between nodes using smokeping to help identify historic problems. I say, have a look at https://ring.nlnog.net/ for more information. A map of current node locations is available here: https://ring.nlnog.net/map And email ring-admins(a)ring.nlnog.net directly with any questions you have. I am sure the they will send some good beer for the next NOG to make this on topic. - - gaurab -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.16 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk/YkBwACgkQSo7fU26F3X2z9wCgo3bciqJuKD4TY48/TC9WEMH5 RPQAoO8o/lo4liNO1AjbVXAQpona6ETd =/AAz -----END PGP SIGNATURE-----

1 0

Reliability & performance of NZ carrier WAN/Internet services
by Josh Farrelly 12 Jun '12

12 Jun '12

Hi all One of our customers is looking at migrating away from their current WAN carrier and have nailed down their options to either FX Networks or Gen-i. This is a 3 office site (AKL/WGTN/CHCH) with relatively fat PIP pipes between all offices, and 20/30Mbps to the Internet from the AKL & WGTN locations using carrier managed BGP devices to allow for Internet failover. Obviously the overview of services according to the provider themselves are understandably at least somewhat bias, but I was wondering whether anybody from the NZNOG community has any objective views on each with regards to reliability and performance? For example FX seems to cost significantly less for relatively the same thing, however without personally having a lot of experience in provider topologies I can't justify being able to go back to the customer vouching for either provider either way. Any replies, either on or off-list are appreciated. Regards, Josh Farrelly

7 8

APE Peering
by Craig Spiers 12 Jun '12

12 Jun '12

Hi All, If anyone should wish to establish a direct peering session via APE with us (for either redundancy reasons, or because you don't use the route servers) please contact me directly off list. Kind regards, Craig Spiers | Network Engineer Maxnet Ltd

1 0

ZeuS- and SpyEye Tracker goes Spamhaus
by Dean Pemberton 12 Jun '12

12 Jun '12

http://www.abuse.ch/?p=3810 This might be of interest to people. Today The Spamhaus Project <http://www.spamhaus.org/>, a well known non-profit organisation fighting cybercrime in the internet, released a new list called “Spamhaus Botnet C&C List” (BGPCC <http://www.spamhaus.org/bgpf>) which is implemented at the router level using the Border Gateway Protocol (BGP). I’m proud to announce that the newly launched list also contains data provided by ZeuS Tracker <https://zeustracker.abuse.ch/> and SpyEye Tracker <https://spyeyetracker.abuse.ch/>.

1 0

Congratulations to Craig Whitmore
by Sebastian Castro 11 Jun '12

11 Jun '12

Because dnssec.geek.nz is the first .nz domain that can be DNSSEC validated According to the Open DNSSEC Validating Resolver (https://www.dns-oarc.net/oarc/services/odvr) dig a www.dnssec.geek.nz @149.20.64.20 +dnssec +multiline ; <<>> DiG 9.8.0 <<>> a www.dnssec.geek.nz @149.20.64.20 +dnssec +multiline ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24148 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 3, ADDITIONAL: 5 ^^^^ NOTE THIS ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 4096 ;; QUESTION SECTION: ;www.dnssec.geek.nz. IN A ;; ANSWER SECTION: www.dnssec.geek.nz. 86161 IN A 114.23.33.130 www.dnssec.geek.nz. 86161 IN RRSIG A 5 4 86400 20120705085021 ( 20120605083506 57516 dnssec.geek.nz. UCUGqNqTi020wY++lGqJWjZZrLYvPYyS7tEHLA1ASW3O AXEkBtojFfHxy0Zne0Z1INoChmlONAovXBWmCa6Y8RPO iAFsxoUcAt+njxwpXIrqWfSw4bKVex4DVtbIJiQcgUjf y4+CpkSEHKVZG0jQcquwnOCRqcf90OCPYW93Uqs= ) ;; AUTHORITY SECTION: dnssec.geek.nz. 86160 IN NS dns2.dnssec.geek.nz. dnssec.geek.nz. 86160 IN NS dns1.dnssec.geek.nz. dnssec.geek.nz. 86160 IN RRSIG NS 5 3 86400 20120705085021 ( 20120605083506 57516 dnssec.geek.nz. d+7MLB24EUROEmvsfDFRpy52qY1bNF6KJFBnhaszvyak 9tbsY1TpDY8dv6y2OUN4SoA9Ydfj3QD3IwEkGAOKIzvG OrorBNUDBb7nUyjXMi0te5X7AfRhSkQDNDL3zYb30WO/ 8KeCzydAGXQtmAiu2yxTV9RJFrnzbQ4OOe/i3QY= ) ;; ADDITIONAL SECTION: dns1.dnssec.geek.nz. 86160 IN A 114.23.33.130 dns2.dnssec.geek.nz. 86160 IN A 114.23.33.131 dns1.dnssec.geek.nz. 86160 IN RRSIG A 5 4 86400 20120705085021 ( 20120605083506 57516 dnssec.geek.nz. ODk/boWCMVYj6RWMkp2PqZoxvnCavFZyucZgvTxTIlYz R47IGWjlLeb1DHIQJzEDUPvKj6VhNiA+sbLwG/Oh4nHD WVb5xJt07gPlSPiihzWGlY2g90KN3PXqdujKgc/8FIhi GUSdE+umR+kBG2XlZpvyzc0L3C6niICPImMq3JY= ) dns2.dnssec.geek.nz. 86160 IN RRSIG A 5 4 86400 20120705085021 ( 20120605083506 57516 dnssec.geek.nz. Tl5vbS+GfMiWhft32InQHdUqWY0lHmzZdIzwyrVGJdoO yhRGrWej0RshhnypA0lO77cBRQuYoIzZt7/cUpGe1MyO FnYKQeQpt8bLak4HZ5W+Fkc5GQctD4Q2cGSJqvIJOuDd GqT1KuILudTDERmUwLCsA8n/q3W19mUnbYO4dqM= ) ;; Query time: 160 msec ;; SERVER: 149.20.64.20#53(149.20.64.20) ;; WHEN: Tue Jun 12 12:17:01 2012 ;; MSG SIZE rcvd: 829 Our internal validating nameservers report similar situation. BTW, the above is possible because geek.nz is fully DNSSEC enabled. Kind Regards, -- Sebastian Castro DNS Specialist .nz Registry Services (New Zealand Domain Name Registry Limited) desk: +64 4 495 2337 mobile: +64 21 400535

5 4