- NZNOG - lists.nznog.org

Anyone else seeing massive amount of UDP/53 DNS queries since ~6pm last night ?
by Ian Batterbee 06 Nov '10

06 Nov '10

Looks like a new DDOS out there.. anyone else seeing it ?

4 6

NZRR Route Registry Update
by NZRR Database Notifications 04 Nov '10

04 Nov '10

Dear Colleague, This is to notify you that one or more objects in which you are designated for notification have been modified in the NZRR routing registry database. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. Diagnostic output: ------------------------------------------------------------ --- PREVIOUS OBJECT: route-set: AS9560:RS-ROUTES:AS55561 descr: Route set advertised to AS9560 by ABC IP Limited - AS55561 members: 27.111.12.0/22^22-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: steve(a)abc-ip.com mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20101026 source: NZRR REPLACED BY: route-set: AS9560:RS-ROUTES:AS55561 descr: advertised to AS9560 by 2Talk Ltd - AS55561 members: 27.111.12.0/22^22-29, 202.180.102.0/24^24-29, 202.180.76.160/27^27-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: iproute(a)2talk.com mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20101105 source: NZRR ------------------------------------------------------------

1 0

Re: [nznog] Anyone else seeing massive amount of UDP/53 DNS queries since ~6pm last night ?
by Richard Haakma 04 Nov '10

04 Nov '10

On Fri, 2010-11-05 at 09:04 +1300, Ian Batterbee wrote: > Looks like a new DDOS out there.. anyone else seeing it ? > I found a DNS nameserver being used to generate traffic recently. It was receiving DNS requests from ip addresses in the same /24 as itself, but the requests were coming from outside the network. Thinking the lookup requests were coming from local addresses, the nameserver was sending traffic to the authoritative nameservers for some domains. So I recommend that the router or firewall in front of any nameserver be set so that it does not accept source addresses belonging to thelocal network from outside of the network. It has been best practice to do so for a long time. Regards, RH.

3 3

NZRR Route Registry Update
by NZRR Database Notifications 04 Nov '10

04 Nov '10

Dear Colleague, This is to notify you that one or more objects in which you are designated for notification have been modified in the NZRR routing registry database. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. Diagnostic output: ------------------------------------------------------------ --- PREVIOUS OBJECT: route-set: AS9560:RS-ROUTES:AS2686 descr: advertised to AS9560 by AT&T - AS2686 members: 124.248.128.0/20^20-29, 202.27.216.0/22^22-29, 202.36.192.0/22^22-29, 202.169.192.0/22^22-29, 32.114.24.0/23^23-29, 122.248.172.0/23^23-29, 202.27.136.0/23^23-29, 202.36.68.0/23^23-29, 202.37.70.0/23^23-29, 202.169.198.0/23^23-29, 202.169.202.0/23^23-29, 202.169.206.0/23^23-29, 202.169.212.0/23^23-29, 202.175.142.0/23^23-29, 203.99.128.0/23^23-29, 203.163.70.0/23^23-29, 203.176.122.0/23^23-29, 32.234.80.0/24^24-29, 192.88.190.0/24^24-29, 192.203.216.0/24^24-29, 202.12.105.0/24^24-29, 202.14.252.0/24^24-29, 202.14.254.0/24^24-29, 202.20.92.0/24^24-29, 202.27.77.0/24^24-29, 202.27.83.0/24^24-29, 202.27.160.0/24^24-29, 202.27.222.0/24^24-29, 202.27.236.0/24^24-29, 202.27.247.0/24^24-29, 202.27.251.0/24^24-29, 202.36.12.0/24^24-29, 202.36.29.0/24^24-29, 202.36.43.0/24^24-29, 202.36.75.0/24^24-29, 202.36.80.0/24^24-29, 202.36.154.0/24^24-29, 202.36.198.0/24^24-29, 202.37.68.0/24^24-29, 202.37.167.0/24^24-29, 202.37.168.0/24^24-29, 202.37.187.0/24^24-29, 202.37.254.0/24^24-29, 202.49.189.0/24^24-29, 202.49.216.0/24^24-29, 202.50.240.0/24^24-29, 202.135.38.0/24^24-29, 202.135.49.0/24^24-29, 202.135.64.0/24^24-29, 202.135.85.0/24^24-29, 202.135.111.0/24^24-29, 202.135.112.0/24^24-29, 202.135.116.0/24^24-29, 202.135.142.0/24^24-29, 202.135.146.0/24^24-29, 202.135.190.0/24^24-29, 202.135.192.0/24^24-29, 202.135.231.0/24^24-29, 202.169.196.0/24^24-29, 202.169.201.0/24^24-29, 202.169.205.0/24^24-29, 202.169.223.0/24^24-29, 203.163.68.0/24^24-29, 203.163.94.0/24^24-29, 203.163.98.0/24^24-29, 203.196.101.0/24^24-29, 203.196.119.0/24^24-29, 203.196.121.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: dl-globalwork(a)att.com mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20101028 source: NZRR REPLACED BY: route-set: AS9560:RS-ROUTES:AS2686 descr: advertised to AS9560 by AT&T - AS2686 members: 124.248.128.0/20^20-29, 202.27.216.0/22^22-29, 202.36.192.0/22^22-29, 202.169.192.0/22^22-29, 32.114.24.0/23^23-29, 122.248.172.0/23^23-29, 202.14.252.0/23^23-29, 202.27.136.0/23^23-29, 202.36.68.0/23^23-29, 202.37.70.0/23^23-29, 202.169.198.0/23^23-29, 202.169.202.0/23^23-29, 202.169.206.0/23^23-29, 202.169.212.0/23^23-29, 202.175.142.0/23^23-29, 203.99.128.0/23^23-29, 203.163.70.0/23^23-29, 203.176.122.0/23^23-29, 32.234.80.0/24^24-29, 192.88.190.0/24^24-29, 192.203.216.0/24^24-29, 202.12.105.0/24^24-29, 202.14.254.0/24^24-29, 202.20.92.0/24^24-29, 202.27.77.0/24^24-29, 202.27.83.0/24^24-29, 202.27.160.0/24^24-29, 202.27.222.0/24^24-29, 202.27.236.0/24^24-29, 202.27.247.0/24^24-29, 202.27.251.0/24^24-29, 202.36.12.0/24^24-29, 202.36.29.0/24^24-29, 202.36.43.0/24^24-29, 202.36.75.0/24^24-29, 202.36.80.0/24^24-29, 202.36.154.0/24^24-29, 202.36.198.0/24^24-29, 202.37.68.0/24^24-29, 202.37.167.0/24^24-29, 202.37.168.0/24^24-29, 202.37.187.0/24^24-29, 202.37.254.0/24^24-29, 202.49.189.0/24^24-29, 202.49.216.0/24^24-29, 202.50.240.0/24^24-29, 202.135.38.0/24^24-29, 202.135.49.0/24^24-29, 202.135.64.0/24^24-29, 202.135.85.0/24^24-29, 202.135.111.0/24^24-29, 202.135.112.0/24^24-29, 202.135.116.0/24^24-29, 202.135.142.0/24^24-29, 202.135.146.0/24^24-29, 202.135.190.0/24^24-29, 202.135.192.0/24^24-29, 202.135.231.0/24^24-29, 202.169.196.0/24^24-29, 202.169.201.0/24^24-29, 202.169.205.0/24^24-29, 202.169.223.0/24^24-29, 203.163.68.0/24^24-29, 203.163.94.0/24^24-29, 203.163.98.0/24^24-29, 203.196.101.0/24^24-29, 203.196.119.0/24^24-29, 203.196.121.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: dl-globalwork(a)att.com mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20101105 source: NZRR ------------------------------------------------------------

1 0

NZRR Route Registry Update
by NZRR Database Notifications 04 Nov '10

04 Nov '10

Dear Colleague, This is to notify you that one or more objects in which you are designated for notification have been modified in the NZRR routing registry database. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. Diagnostic output: ------------------------------------------------------------ --- NEW OBJECT CREATION: route-set: AS9439:RS-ROUTES:AS2686 descr: advertised to AS9439 by AT&T - AS2686 members: 124.248.128.0/20^20-29, 202.27.216.0/22^22-29, 202.36.192.0/22^22-29, 202.169.192.0/22^22-29, 32.114.24.0/23^23-29, 122.248.172.0/23^23-29, 202.14.252.0/23^23-29, 202.27.136.0/23^23-29, 202.36.68.0/23^23-29, 202.37.70.0/23^23-29, 202.169.198.0/23^23-29, 202.169.202.0/23^23-29, 202.169.206.0/23^23-29, 202.169.212.0/23^23-29, 202.175.142.0/23^23-29, 203.99.128.0/23^23-29, 203.163.70.0/23^23-29, 203.176.122.0/23^23-29, 32.234.80.0/24^24-29, 192.88.190.0/24^24-29, 192.203.216.0/24^24-29, 202.12.105.0/24^24-29, 202.14.254.0/24^24-29, 202.20.92.0/24^24-29, 202.27.77.0/24^24-29, 202.27.83.0/24^24-29, 202.27.160.0/24^24-29, 202.27.222.0/24^24-29, 202.27.236.0/24^24-29, 202.27.247.0/24^24-29, 202.27.251.0/24^24-29, 202.36.12.0/24^24-29, 202.36.29.0/24^24-29, 202.36.43.0/24^24-29, 202.36.75.0/24^24-29, 202.36.80.0/24^24-29, 202.36.154.0/24^24-29, 202.36.198.0/24^24-29, 202.37.68.0/24^24-29, 202.37.167.0/24^24-29, 202.37.168.0/24^24-29, 202.37.187.0/24^24-29, 202.37.254.0/24^24-29, 202.49.189.0/24^24-29, 202.49.216.0/24^24-29, 202.50.240.0/24^24-29, 202.135.38.0/24^24-29, 202.135.49.0/24^24-29, 202.135.64.0/24^24-29, 202.135.85.0/24^24-29, 202.135.111.0/24^24-29, 202.135.112.0/24^24-29, 202.135.116.0/24^24-29, 202.135.142.0/24^24-29, 202.135.146.0/24^24-29, 202.135.190.0/24^24-29, 202.135.192.0/24^24-29, 202.135.231.0/24^24-29, 202.169.196.0/24^24-29, 202.169.201.0/24^24-29, 202.169.205.0/24^24-29, 202.169.223.0/24^24-29, 203.163.68.0/24^24-29, 203.163.94.0/24^24-29, 203.163.98.0/24^24-29, 203.196.101.0/24^24-29, 203.196.119.0/24^24-29, 203.196.121.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: dl-globalwork(a)att.com mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20101105 source: NZRR ------------------------------------------------------------

1 0

Fwd: [itar-announce] End of Life Notice for ITAR
by Andy Linton 04 Nov '10

04 Nov '10

-------- Original Message -------- Subject: [itar-announce] End of Life Notice for ITAR Date: Thu, 4 Nov 2010 12:18:55 -0700 From: Kim Davies <kim.davies(a)icann.org> To: itar-announce(a)icann.org <itar-announce(a)icann.org> Dear colleagues, The Interim Trust Anchor Repository is now being retired from service. Starting today, no new listings will be accepted by the service. Later this month, existing listings will be removed; with the entire service turned off early next year. *** If you are using the ITAR service, please discontinue using it as soon *** *** as possible. We recommend you transition to using the signed DNS root *** *** zone. *** Since the beginning of 2009, ICANN has operated a service known as the Interim Trust Anchor Repository (ITAR). This allowed top-level domain operators who use DNSSEC to publish their trust anchor in absence of a signed DNS root zone. On 15 July 2010, the DNS root zone was signed, and in the following months TLD operators have transitioned to using it. With the last remaining TLDs transitioning to the signed root zone, the ITAR is no longer required. The service was a successful bottom-up collaboration with the Internet community. ICANN was asked to operate the service to help DNSSEC adoption during its initial phases. During its lifetime, the ITAR supported over a hundred listing requests for dozens of top-level domains that were early adopters of DNSSEC. The operational experience ICANN gained in operating ITAR also helped inform the roll-out of the signed DNS root zone. The expected date for existing listings to be removed is 18 November 2010, with the service fully retired in January 2011. These dates are subject to adjustment based on operational requirements or community feedback. With kindest regards, Kim Davies Manager, Root Zone Services ICANN _______________________________________________ itar-announce mailing list itar-announce(a)icann.org https://mm.icann.org/mailman/listinfo/itar-announce

1 0

Member and Stakeholder Survey 2010 - We need your feedback!
by Elly Tawhai 03 Nov '10

03 Nov '10

Hi NZNOG Community, We have just launched APNIC 2011 Stakeholder Survey, an important feedback mechanism that will be used to guide APNIC secretariat's operational plan in 2011-2012. Please note that you do not have to be an APNIC member to complete this survey. Just select 'No' in the first question: Are you an APNIC Account holder? There is a prize draw for an iPad if survey is completed by 9 November. Kind regards, Elly APNIC _______________________________________________________________________ Member and Stakeholder Survey 2010 - We need your feedback! _______________________________________________________________________ On behalf of the APNIC Executive Council, the Asia Pacific Network Information Centre (APNIC) is commissioning a Member and Stakeholder survey, to assess the Secretariat's performance during 2010. The survey is conducted every two years. The results of this survey will form the basis of the APNIC operational plan for 2011-2012. APNIC is a not-for-profit organization responsible for distributing and registering Internet resources, such as IP addresses, throughout the Asia Pacific region. You may have encountered APNIC in the region through our: - Training and liaison activities with local ISPs and governments - Participation in regional forums for Internet Governance - Media coverage on issues relevant to the Internet community such as IPv4 exhaustion and IPv6 deployment An independent consultant, Professor Ang Peng Hwa, Director of the Singapore Internet Research Center, will conduct the survey and analyse the findings using a completely neutral process guaranteeing the highest quality result. The survey is designed so that you only need to complete the sections that are relevant to your experience with APNIC. Early Birds who complete the survey before 24:00 (UTC +10) on 9 November 2010, will be entered to win an Apple iPad! Participation in the Stakeholder Survey is completely anonymous. The survey is open from 2 November 2010 - 21 November 2010 until 24:00 (UTC +10). For more information on how you can participate, visit: http://www.apnic.net/survey _______________________________________________________________________ APNIC Secretariat secretariat(a)apnic.net Asia Pacific Network Information Centre (APNIC) Tel: +61 7 3858 3100 PO Box 2131 Milton, QLD 4064 Australia Fax: +61 7 3858 3199 Level 1, 33 Park Road, Milton, QLD http://www.apnic.net _______________________________________________________________________ * Sent by email to save paper. Print only if necessary.

1 0

Root Zone DNSSEC KSK Ceremony 3 Completed
by Joe Abley 02 Nov '10

02 Nov '10

KSK CEREMONY 3 The third KSK ceremony for the root zone took place in Culpeper, VA, USA on Monday 2010-11-01. The Ceremony Administrator was Mehmet Akcin. The ceremony was completed successfully. Video from Ceremony 3 was recorded for audit purposes. Video and associated audit materials will be published in 1 to 2 weeks, and will be available as usual by following the "KSK Ceremony Materials" link at <https://www.iana.org/dnssec/>. Ceremony 3 included processing of a Key Signing Request (KSR) generated by VeriSign, and the resulting Signed Key Response (SKR) contained signatures for Q1 2011, for use in the root zone between 2011-01-01 and 2011-02-28. CONTACT INFORMATION We'd like to hear from you. If you have feedback for us, please send it to rootsign(a)icann.org.

1 0

Filtering Previously Unallocated Addresses
by Elly Tawhai 01 Nov '10

01 Nov '10

Hi NZNOG Community, I realize that Andy Linton sent this to the list a couple of weeks ago. However please note that 36/8 and 42/8 have now been added as newly allocated address blocks managed, by APNIC. Kind regards, Elly APNIC _______________________________________________________________________ Filtering Previously Unallocated Addresses _______________________________________________________________________ APNIC recognizes that as the IANA pool of unallocated IPv4 addresses nears exhaustion, there may be increasing community concern about the quality of the new address blocks made available for distribution. It is important that you ensure your router Access Control Lists (ACLs) are updated so addresses are not mistakenly filtered through your routers. It may also be time to consider whether you should stop any form of BOGON filtering. This is especially important for newly allocated address blocks: * 1.0.0.0/8 * 14.0.0.0/8 * 27.0.0.0/8 * 36.0.0.0/8 * 42.0.0.0/8 * 49.0.0.0/8 * 101.0.0.0/8 * 223.0.0.0/8 Keep informed about IANA allocations at: http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xml For those with recently allocated address space here are several tips to check whether your IP Addresses are filtered: * Your own firewall might be blocking the new IP addresses by default, if you set up your servers to block bogon IP ranges. To avoid blocking potential new customers, consider whether you should stop any form of BOGON filtering. * Run a traceroute to see if the new IP is consistently blocked along the same network path. It is advisable also, to test forward and reverse paths. Use of technology like the Routing Information Service (RIS) is highly recommended to assist in identifying routing conditions for prefixes under test. http://www.ripe.net/projects/ris/index.html * Do a search on your IP address and contact those organizations that appear to be blocking you. You may be blocked due to activity of one of your customers. http://whatismyipaddress.com/blacklist-check * Use a looking glass service as part of the diagnostic tool, set to detect network filters. http://www.ris.ripe.net/cgi-bin/lg/index.cgi Ongoing testing --------------- As part of our service commitment to our Members and the wider community, APNIC is working hard to evaluate the usability of address space allocated to APNIC before it is distributed. For further information on Resource Quality Assurance and the testing results, visit: http://www.apnic.net/rqa For further assistance, contact: helpdesk(a)apnic.net ____________________________________________________________________ APNIC Secretariatsecretariat(a)apnic.net Asia Pacific Network Information Centre (APNIC) Tel: +61 7 3858 3100 PO Box 2131 Milton, QLD 4064 Australia Fax: +61 7 3858 3199 Level 1, 33 Park Road, Milton, QLDhttp://www.apnic.net _______________________________________________________________________ * Sent by email to save paper. Print only if necessary.

1 0

New Zealand Network Operators' Group
by Donald Neal 31 Oct '10

31 Oct '10

The New Zealand Network Operators' Group The NZNOG mailing list exists to facilitate discussion among operators of networks in New Zealand on matters relevant to network operators as described in the list's Acceptable Use Policy. That policy appears later in this posting. The NZNOG Trust is registered as a charitable entity under the Charities Act. The trust exists to provide the legal framework needed to do jobs like operating the bank account which holds the money which allows our annual conferences to happen. Other than the four trustees, the NZNOG does not have a formal membership. Conference NZNOG holds New Zealand's only annual technical networking conference. The next conference is scheduled for the week beginning 24 January 2011 in Wellington, to be hosted by Vodafone. The call for participation can be read at http://list.waikato.ac.nz/pipermail/nznog/2010-November/017047.html . Other Meetings See http://thursdaynightcurry.com/ if you live in or near Auckland or Wellington. Operators' Contact List See http://www.nznog.org/?page_id=6 for operational contact details for most New Zealand ISP's. These are intended for use by other network operators, not by most customers. Internet Exchanges See http://www.nzix.net/ for details of exchanges in operation. About This Mailing List This list has around 1100 addresses subscribed. You may only post to the list from a subscribed address. A number of people subscribe addresses which do not receive email purely to allow posting from them. You may choose to receive postings as they come in, or just to receive daily "digests". See the bottom of the page http://list.waikato.ac.nz/mailman/listinfo/nznog/ to change the form in which you receive postings. The NZNOG mailing list is provided through a server at The University of Waikato, and is administered by employees of APN Online, Citylink, and The University of Waikato. None of these organisations, nor any administrator, is responsible for its content. NZNOG Mailing List Acceptable Use Policy The NZNOG mailing list exists to provide a forum for the exchange of technical information and the discussion of implementation issues that require cooperation among New Zealand network service providers. In order to continue to provide a useful forum for discussion of relevant technical issues, users of the list are asked to respect the following guidelines. 1. Discussion will focus on Internet operational and technical issues. 2. Discussion related to meetings of network service providers is appropriate. 3. Discussion unrelated to these topics is not appropriate. 4. Postings to multiple mailing lists are discouraged. 5. Postings that include foul language, character assassination, and lack of respect for other participants are unacceptable. 6. Blatant product or service marketing is unacceptable. 7. Postings of a political, philosophical or legal nature are discouraged. 8. Postings to the list should be in ASCII or MIME encoded as text/plain. Attachments should not be sent to the list. To present a document, a suitable URL may be referred to. For documents of general interest, the use of proprietary file formats is discouraged. 9. Breaches of list etiquette should be dealt with privately with the offending list user, and should not result in complaints being sent to the list. 10. A person repeatedly breaching list etiquette shall receive warnings from the list administrator. A further breach after the second such warning within thirty days shall result in the offender being unsubscribed from the list. Other action may also be taken to block postings to the list by the offender. Any such unsubscription is to be immediately announced to the list. Mailing List Archives A full archive is available at http://list.waikato.ac.nz/pipermail/nznog/ . Any message sent to the list will be archived and made available on the web automatically. Changes are not made to the archive on request, though the administrators remain happy to assist the Office of the Privacy Commissioner should any complaint be laid with that office. One way to search the archive is to use google and prefix your search with site:list.waikato.ac.nz . Subscribing to the List See http://list.waikato.ac.nz/mailman/listinfo/nznog to subscribe. Donald Neal NZNOG Mailing List Owner/Administrator/Muggins -- Donald Neal | I don't approve of gambling. I'll just | spend my time in the bar. High Performance Computing | - NZNOG 2010 attendee The University of Waikato |

1 0