- NZNOG - lists.nznog.org

NZRR Route Registry Update
by NZRR Database Notifications 12 Feb '12

12 Feb '12

Dear Colleague, This is to notify you that one or more objects in which you are designated for notification have been modified in the NZRR routing registry database. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. Diagnostic output: ------------------------------------------------------------ --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS23655 descr: advertised to AS9439 by Snap Internet - AS23655 members: 118.148.0.0/15^15-29, 111.69.0.0/16^16-29, 130.195.0.0/16^16-29, 132.181.0.0/16^16-29, 138.75.0.0/16^16-29, 140.200.0.0/16^16-29, 153.111.0.0/16^16-29, 159.117.0.0/16^16-29, 163.7.0.0/16^16-29, 165.84.0.0/16^16-29, 123.255.0.0/18^18-29, 14.1.32.0/19^19-29, 180.189.192.0/19^19-29, 202.124.96.0/19^19-29, 111.65.224.0/20^20-29, 182.54.160.0/20^20-29, 202.49.16.0/20^20-29, 202.56.32.0/20^20-29, 203.86.192.0/20^20-29, 210.7.32.0/20^20-29, 27.110.120.0/21^21-29, 120.136.0.0/21^21-29, 202.49.64.0/21^21-29, 202.56.48.0/21^21-29, 202.137.240.0/21^21-29, 202.174.112.0/21^21-29, 210.5.48.0/21^21-29, 103.4.136.0/22^22-29, 103.4.152.0/22^22-29, 103.247.152.0/22^22-29, 110.92.16.0/22^22-29, 113.197.96.0/22^22-29, 202.49.72.0/22^22-29, 202.49.92.0/22^22-29, 202.50.104.0/22^22-29, 202.50.124.0/22^22-29, 202.164.28.0/22^22-29, 203.99.132.0/22^22-29, 103.22.234.0/23^23-29, 202.27.186.0/23^23-29, 202.36.178.0/23^23-29, 202.36.220.0/23^23-29, 202.37.96.0/23^23-29, 202.37.100.0/23^23-29, 202.37.106.0/23^23-29, 202.49.80.0/23^23-29, 202.49.120.0/23^23-29, 210.55.30.0/23^23-29, 210.55.206.0/23^23-29, 103.10.233.0/24^24-29, 143.96.13.0/24^24-29, 192.148.221.0/24^24-29, 192.156.225.0/24^24-29, 202.14.217.0/24^24-29, 202.36.141.0/24^24-29, 202.36.163.0/24^24-29, 202.36.170.0/24^24-29, 202.36.174.0/24^24-29, 202.37.114.0/24^24-29, 202.37.127.0/24^24-29, 202.37.179.0/24^24-29, 202.37.194.0/24^24-29, 202.37.220.0/24^24-29, 202.46.187.0/24^24-29, 202.49.59.0/24^24-29, 202.49.115.0/24^24-29, 202.49.125.0/24^24-29, 202.49.140.0/24^24-29, 202.49.187.0/24^24-29, 202.50.110.0/24^24-29, 202.50.117.0/24^24-29, 202.50.169.0/24^24-29, 202.50.176.0/24^24-29, 203.92.25.0/24^24-29, 203.96.112.0/24^24-29, 203.174.26.0/24^24-29, 203.191.7.0/24^24-29, 205.233.128.0/24^24-29, 210.55.4.0/24^24-29, 210.55.7.0/24^24-29, 210.55.110.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: support(a)biz.snap.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20120207 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS23655 descr: advertised to AS9439 by Snap Internet - AS23655 members: 118.148.0.0/15^15-29, 111.69.0.0/16^16-29, 130.123.0.0/16^16-29, 130.195.0.0/16^16-29, 132.181.0.0/16^16-29, 138.75.0.0/16^16-29, 140.200.0.0/16^16-29, 150.206.0.0/16^16-29, 153.111.0.0/16^16-29, 159.117.0.0/16^16-29, 163.7.0.0/16^16-29, 165.84.0.0/16^16-29, 123.255.0.0/18^18-29, 14.1.32.0/19^19-29, 180.189.192.0/19^19-29, 202.124.96.0/19^19-29, 111.65.224.0/20^20-29, 182.54.160.0/20^20-29, 202.49.16.0/20^20-29, 202.56.32.0/20^20-29, 203.86.192.0/20^20-29, 210.7.32.0/20^20-29, 27.110.120.0/21^21-29, 120.136.0.0/21^21-29, 202.49.64.0/21^21-29, 202.56.48.0/21^21-29, 202.137.240.0/21^21-29, 202.174.112.0/21^21-29, 210.5.48.0/21^21-29, 103.4.136.0/22^22-29, 103.4.152.0/22^22-29, 103.247.152.0/22^22-29, 110.92.16.0/22^22-29, 113.197.96.0/22^22-29, 202.49.72.0/22^22-29, 202.49.92.0/22^22-29, 202.50.104.0/22^22-29, 202.50.124.0/22^22-29, 202.164.28.0/22^22-29, 203.99.132.0/22^22-29, 103.22.234.0/23^23-29, 202.27.186.0/23^23-29, 202.36.178.0/23^23-29, 202.36.220.0/23^23-29, 202.37.96.0/23^23-29, 202.37.100.0/23^23-29, 202.37.106.0/23^23-29, 202.49.80.0/23^23-29, 202.49.120.0/23^23-29, 210.55.30.0/23^23-29, 210.55.206.0/23^23-29, 103.10.233.0/24^24-29, 143.96.13.0/24^24-29, 192.148.221.0/24^24-29, 192.156.225.0/24^24-29, 202.14.217.0/24^24-29, 202.36.141.0/24^24-29, 202.36.163.0/24^24-29, 202.36.170.0/24^24-29, 202.36.174.0/24^24-29, 202.37.114.0/24^24-29, 202.37.127.0/24^24-29, 202.37.179.0/24^24-29, 202.37.194.0/24^24-29, 202.37.220.0/24^24-29, 202.46.187.0/24^24-29, 202.49.59.0/24^24-29, 202.49.115.0/24^24-29, 202.49.125.0/24^24-29, 202.49.140.0/24^24-29, 202.49.187.0/24^24-29, 202.50.110.0/24^24-29, 202.50.117.0/24^24-29, 202.50.169.0/24^24-29, 202.50.176.0/24^24-29, 203.92.25.0/24^24-29, 203.96.112.0/24^24-29, 203.174.26.0/24^24-29, 203.191.7.0/24^24-29, 205.233.128.0/24^24-29, 210.55.4.0/24^24-29, 210.55.7.0/24^24-29, 210.55.110.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: support(a)biz.snap.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20120213 source: NZRR ------------------------------------------------------------

1 0

Local charity mailer issue
by Steve Holdoway 11 Feb '12

11 Feb '12

Could I lean on your good nature and ask for advice on how to fix this situation properly. This charity receives emails from another organization, and the mail log goes like this... Feb 12 18:09:49 mail sm-mta[18000]: q1C59mrc018000: ruleset=check_rcpt, arg1=<bill(a)example.com>, relay=122-56-8-123.cid.global-gateway.net.nz [122.56.8.123] (may be forged), reject=450 4.7.1 <bill(a)example.com>... Access denied. IP name possibly forged [122.56.8.123] If I investigate the IP address, it comes out in the telecom domain, but if I lookup 122-56-8-123.cid.global-gateway.net.nz, it comes back as NXDOMAIN. Who should I be directing this problem to? I don't really want to drop this validation, as it does stop a metric shedload of spam. Cheers, Steve -- Steve Holdoway BSc(Hons) MNZCS <steve(a)greengecko.co.nz> http://www.greengecko.co.nz MSN: steve(a)greengecko.co.nz Skype: sholdowa

2 1

*.tnz.mail.yahoo.com broken?
by Barry Murphy 09 Feb '12

09 Feb '12

Trying to mail xtra users, have heaps queued up but can't even establish a connection... Tried from NZ via vocus, tried via global gateway circuit, SNAP, Vodafone, also tried via a server hosted in AU and one in US. Anyone from Yahoo / Xtra have any news? linweb03:~# telnet mx1.tnz.mail.yahoo.com 25 Trying 124.108.96.211... telnet: Unable to connect to remote host: Connection refused linweb03:~# telnet mx2.tnz.mail.yahoo.com 25 Trying 124.108.96.211... telnet: Unable to connect to remote host: Connection refused cheers Barry

1 0

Don't quite get this?
by Bruce Kingsbury 09 Feb '12

09 Feb '12

Re: Paul Brislen: http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=10748747 ] " The ISP doesn't. It's up to the rights holder to determine that you've downloaded that file called The Terminator and that it's a movie and that they have the rights to it and that you haven't got the rights to download it. if they can't demonstrate that to the ISP (which will then check its records to determine if that file was downloaded and if so at what time and by whom) then the ISP rejects the claim." I don't quite get this. I know the ISP will have records of who had what IP address and perhaps even fairly detailed logs of how much throughput over the day, but if they get told that whatever IP at 8:08:45 pm was observed downloading The Terminator, are any of the the ISP's able to refute that? Do they even log what kind of traffic I was doing at the time? Do they keep track of http vs. torrent vs. skype traffic? Sorry to ask here, but it seemed like the best place to get an informed answer. Also, beer...

36 66

Fwd: IPv4 Asset Sale
by Gerard Creamer 08 Feb '12

08 Feb '12

Hi all, I have heard some discussion in the recentpast (year or two) about the potential for IPv4 number space being sold off as it becomes less freely available. The following appears to be a real offer, and I checked with David and he seems to be a real person and was OK for me to post this to the list, so here it is. I've not seen this before, but possibly that's because I'm less well travelled than others on the list. Is this becoming common place? And what's the 'street price' of an IP address at present? Discuss. Or call him :^) Gerard -------- Original Message -------- Subject: IPv4 Asset Sale Date: Wed, 8 Feb 2012 16:49:34 -0700 From: David Kuehl <kuehl(a)qllc.com> To: <info(a)nznog.org> Greetings, My name is David Kuehl and I work for a technology-focused investment bank that is currently engaged to sell a large block of legacy Class A IPv4 addresses. Given that the global pool of IPv4 addresses is rapidly depleting, I was wondering if any NZNOG members are currently in need of additional addresses and interested in participating in this sale process. If so, please feel free to pass along my contact information to any members that would be interested in receiving additional information regarding this opportunity. Thank you in advance for your assistance, *David Kuehl* Q Advisors LLC 303.996.3009 /office/ 303.501.3665 /mobile/ kuehl(a)qllc.com <mailto:kuehl(a)qllc.com> www.qllc.com <http://www.qllc.com/> Description: Please, only print if truly necessaryThink green...use less paper// // /This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden./

3 4

Re: [nznog] BotNet Researchers in NZ
by Tristram Cheer 08 Feb '12

08 Feb '12

Thanks for all the replies, Someone has contacted me -- Tristram Cheer Network Architect - Most problems are the result of previous solutions... Tel. 09 438 5472 Ext 803 | Mobile. 022 412 1985 | 53 Port Road, Whangarei tristram.cheer(a)ubergroup.co.nz <mailto:tristram.cheer(a)ubergroup.co.nz> |www.ubergroup.co.nz <http://www.ubergroup.co.nz> <http://ubergroup.co.nz/fb> <https://twitter.com/#!/ubergroupltd> From: nznog-bounces(a)list.waikato.ac.nz [mailto:nznog-bounces(a)list.waikato.ac.nz] On Behalf Of Tristram Cheer Sent: Thursday, 9 February 2012 2:09 p.m. To: nznog(a)list.waikato.ac.nz Subject: [nznog] BotNet Researchers in NZ Hi All, We have a quarantined client server that is part of a botnet, We've got the files it's using aswell as a HDD image. I thought I would post here and see if there are any security folk in NZ that would like to take a look at it, I've had a dig at the server and we have it's com's systems etc etc. Anyone who interested that's either an academic or security researcher that would like to take a look at it is welcome to e-mail me offlist. Cheers -- Tristram Cheer Network Architect - Most problems are the result of previous solutions... Tel. 09 438 5472 Ext 803 | Mobile. 022 412 1985 | 53 Port Road, Whangarei tristram.cheer(a)ubergroup.co.nz <mailto:tristram.cheer(a)ubergroup.co.nz> |www.ubergroup.co.nz <http://www.ubergroup.co.nz> <http://ubergroup.co.nz/fb> <https://twitter.com/#!/ubergroupltd>

1 0

BotNet Researchers in NZ
by Tristram Cheer 08 Feb '12

08 Feb '12

Hi All, We have a quarantined client server that is part of a botnet, We've got the files it's using aswell as a HDD image. I thought I would post here and see if there are any security folk in NZ that would like to take a look at it, I've had a dig at the server and we have it's com's systems etc etc. Anyone who interested that's either an academic or security researcher that would like to take a look at it is welcome to e-mail me offlist. Cheers -- Tristram Cheer Network Architect - Most problems are the result of previous solutions... Tel. 09 438 5472 Ext 803 | Mobile. 022 412 1985 | 53 Port Road, Whangarei tristram.cheer(a)ubergroup.co.nz <mailto:tristram.cheer(a)ubergroup.co.nz> |www.ubergroup.co.nz <http://www.ubergroup.co.nz> <http://ubergroup.co.nz/fb> <https://twitter.com/#!/ubergroupltd>

1 0

Correcting the .nz DNSKEY encoding, action plan
by Sebastian Castro 08 Feb '12

08 Feb '12

To the technical community: As previously reported on this mailing list (http://list.waikato.ac.nz/pipermail/nznog/2011-December/018622.html) the encoding of the .nz DNSKEY is not RFC compliant. Although the majority of validators accept the key, we have recently become aware of validation failures in products from one supplier. Therefore we have decided to correct this issue now and then continue with DNSSEC deployment for the second level zones. Our plan, in broad terms, contains five steps: 1. Remove DS records for .nz from the root zone 2. Deploy patched software to the production servers 3. Resign the .nz zone 4. Confirm encoding is correct, including consultation with the supplier 5. Submit new DS records for .nz for inclusion in the root zone. This is a low risk and straightforward procedure compared to the alternative of performing a non-standard key rollover. The rollover needed to accomplish the same result is unusual, has never been attempted before and may carry unforeseen risks. Our plan will be executed over the next two weeks and once it is completed we will announce the DNSSEC deployment schedule for the second level zones starting with geek.nz. Kind Regards, -- Sebastian Castro DNS Specialist .nz Registry Services (New Zealand Domain Name Registry Limited) desk: +64 4 495 2337 mobile: +64 21 400535

1 0

NZIX Route Announce subscriptions
by Sid Jones 08 Feb '12

08 Feb '12

Andy mentioned this in passing and now we're getting subscription requests... > We not only propose - we've created: > > http://lists.citylink.co.nz/mailman/listinfo/nzix-route-announce At this stage, we're limiting subscriptions to active NZIX participants. If you subscribe from an address we don't immediately recognize we'll probably reject the request and ask for further identifying details. -- cheers, Sid

1 0

NZRR Route Registry Update
by NZRR Database Notifications 08 Feb '12

08 Feb '12

Dear Colleague, This is to notify you that one or more objects in which you are designated for notification have been modified in the NZRR routing registry database. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. Diagnostic output: ------------------------------------------------------------ --- PREVIOUS OBJECT: route-set: AS9560:RS-ROUTES6:AS24130 descr: Route set advertised to AS9560 by PipeNetworks - AS24130 mp-members: 2407:9000:0:0:0:0:0:0/32^32-64 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: cdaniel(a)pipenetworks.com mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20120208 source: NZRR REPLACED BY: route-set: AS9560:RS-ROUTES6:AS24130 descr: Route set advertised to AS9560 by PIPE Networks Pty Ltd - AS24130 mp-members: 2403:3400:0:0:0:0:0:0/32^32-64, 2407:9000:0:0:0:0:0:0/32^32-64, 2406:C000:0:0:0:0:0:0/32^32-64, 2402:5C00:0:0:0:0:0:0/32^32-64, 2001:DF0:4F:0:0:0:0:0/48^48-64, 2404:4800:30:0:0:0:0:0/48^48-64, 2400:B800:0:0:0:0:0:0/32^32-64, 2406:E600:0:0:0:0:0:0/32^32-64, 2404:9C00:0:0:0:0:0:0/32^32-64, 2406:FA00:0:0:0:0:0:0/32^32-64, 2404:C600:0:0:0:0:0:0/32^32-64, 2407:A00:0:0:0:0:0:0/32^32-64, 2600:1415:2:0:0:0:0:0/48^48-64, 2404:8600:0:0:0:0:0:0/32^32-64, 2404:4800:30:0:0:0:0:0/48^48-64, 2401:1F00:0:0:0:0:0:0/32^32-64, 2403:A400:0:0:0:0:0:0/32^32-64, 2001:DF0:FE:0:0:0:0:0/48^48-64, 2401:B500:0:0:0:0:0:0/32^32-64, 2001:DF0:24A:0:0:0:0:0/48^48-64, 2402:8500:0:0:0:0:0:0/32^32-64, 2402:6900:0:0:0:0:0:0/32^32-64, 2405:4600:0:0:0:0:0:0/32^32-64 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: cameron.daniel(a)pipenetworks.com mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20120209 source: NZRR ------------------------------------------------------------

1 0