- NZNOG - lists.nznog.org

KSK Roll coming 12th October
by Jay Daley 09 Oct '18

09 Oct '18

For those of you who don’t know, the KSK Roll is happening starting at 5am on 12th October (11th October 16:00 UTC). More details here https://www.icann.org/resources/pages/ksk-rollover The quick guide on how to check/prepare your DNS servers is https://www.icann.org/en/system/files/files/ksk-rollover-quick-guide-prepar… cheers Jay -- Jay Daley jay(a)daley.org.nz +64 21 678840 skype: jaydaley twitter: @jay_daley linkedin: www.linkedin.com/in/jaydaley

1 1

Spoofer Report for NZNOG for Sep 2018
by CAIDA Spoofer Project 08 Oct '18

08 Oct '18

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within nzl. Inferred improvements during Sep 2018: ASN Name Fixed-By 4764 wideband-as-au 2018-09-01 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Sep 2018: ASN Name First-Spoofed Last-Spoofed 131291 LANWORXLIMITED 2018-09-21 2018-09-23 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=nzl&no_block=1 Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

IPv6 / Cisco ASA / 2degrees UFB
by Bill Walker 06 Oct '18

06 Oct '18

Hi All, I’ve been quite happily running a Cisco router at home on Snap/2degrees, but with the upgrade to UFB its not coping with the throughput. I’ve managed to locate a suitably equipped ASA, however I cant get IPv6 going. The config I have on the ASA is very similar to that of the router: nterface GigabitEthernet0/7 description 2degrees nameif EXTERNAL security-level 0 no ip address ciscoasa# sh run int gi0/7.10 ! interface GigabitEthernet0/7.10 description 2degrees vlan 10 nameif 2degrees10 security-level 0 pppoe client vpdn group 2degrees ip address pppoe setroute ipv6 address autoconfig ipv6 address dhcp ipv6 enable ipv6 dhcp client pd 2degrees-v6 However, if I remember correctly the IPv6 dhcp assignment happens inside the PPPoE connection once its established. Can anyone confirm that or provide a working config? In case someone wants versions, the ASA is on 9.9.2 (asa992-smp-k8.bin) Thanks, Bill Sent from Mail for Windows 10

6 8

Re: [nznog] Comcom/Samknows broadband testing from a different perspective
by Brian Cole 01 Oct '18

01 Oct '18

Hi all, Longtime listener; first time caller. I signed up to SamKnows (partly out of curiosity and partly so I can have hard data about my connection that I pay for) at home. Over the last week my connection has gone from slightly adequate with the occasional drop out to a slow connection with regular drop outs. Netflix and YouTube are stuttering, video games drop connection, and websites hang at random times. I can't help but think that the email shared by Dylan sheds some light on why that maybe. This programme won't be terribly successful if everyone gets sick of having a terrible connection during peak hours and shuts the white box down. Pretty frustrating. Brian -- *Brian Cole* */** Research Projects Developer* *Research & Enterprise **/** Research Office **/** University of Waikato* *Private Bag 3105* */* *Hamilton 3240* */* *New Zealand**www.waikato.ac.nz* <http://www.waikato.ac.nz/> */* *mob + 64 21 049 9183**email brian.cole(a)waikato.ac.nz <brian.cole(a)waikato.ac.nz> *

10 13

Comcom/Samknows broadband testing from a different perspective
by Dylan Hall 26 Sep '18

26 Sep '18

Hi all, I'm wearing my REANNZ hat today. I thought I'd share what we're seeing hosting the M-Lab [1] nodes in NZ that the new Comcom/Samknows [2] broadband testing are using for some of their tests. For a start, it looks like the testing has been ramping up over the last week (see attached graph), in particular during the evening (6pm-midnight). I had assumed the testing would be evenly spread out throughout the day, but it looks like they're concentrating the testing during the busy evening period. If anyone is interested in following how that traffic grows we have publicly available graphs for the two M-Lab nodes: AKL: https://weathermap.reannz.co.nz/node.php?src=and01&int=xe_0_0_9 WLG: https://weathermap.reannz.co.nz/node.php?src=and02&int=xe_0_2_7 If you want to try out the M-Lab nodes themselves, type "speedtest" into a Google search box and there is a "Run Speed Test" option that uses M-Lab (at least in my copy of Chrome, your mileage may vary). The nodes each consist of 4 x Dell servers front ended by a Juniper QFX switch. They're connected at 10Gbps. The nodes are fully run by M-Lab, we're just providing some address space and capacity. If anyone is concerned about their connectivity to REANNZ, we're on all the major NZ exchanges (APE, WIX, CHIX, AKL-IX) where we peer with the route servers. I note Comcom have posted a FAQ [3] on their website with some more details. The nodes are also IPv6 connected with addresses allocated from 2404:138::/32. It's worth noting we've been hosting M-Lab nodes for around 5 years now, but no one from Comcom or Samknows has spoken to us about the testing so it's all come as a bit of a surprise to us. If you have any interesting information to share, we'd like to know more :) [1] https://www.measurementlab.net [2] https://comcom.govt.nz/regulated-industries/telecommunications/monitoring-t… [3] https://comcom.govt.nz/__data/assets/pdf_file/0032/98276/SamKnows-technical… Thanks, Dylan

1 0

Hello Hurricane Electric, doubling the size of our domestic table?
by Michael Fincham 18 Sep '18

18 Sep '18

Hi all, So my domestic tables now have some 76,000 prefixes in them, as of ~ 6:30 last night. I guess hello HE and welcome to AKL-IX? Domestic table for NZ was more like ~ 10,000 prefixes not that long ago! -- Michael

14 30

Juniper Lab
by Jesse Archer 16 Sep '18

16 Sep '18

Hi All, I've got some config that I'd like to lab but my own kit is tied up in a transition. Wondering if anyone has a spare MX5-MX80 they would be willing to fire up to allow me to perform some tests. Unfortunately, vMX doesn't quite work in this case. *Jesse Archer* *General Manager*Full Flavour *p. *07 577 0099 *ddi*. 07 281 1391 *s*. Skype "myfullflavour" *e*. jesse(a)fullflavour.nz <jesse(a)fullflavourmedia.co.nz> *w*. fullflavour.nz <http://www.fullflavourmedia.co.nz/> *a. *Basestation, 148 Durham Street, Tauranga *a*. PO Box 13403, Tauranga Central, Tauranga 3141, New Zealand

1 0

VPS with BGP
by Mehmet Akcin 08 Sep '18

08 Sep '18

Hello NZNOG Friends, long time. I am looking for a VPS hosting firm which support BGP advertisements for DNS anycast (for my experiement) 200GB Disk, 16 GB Memory , 4core cpu and small bandwidth running 18.04 Ubuntu Please contact me offlist if you are able offer this. thank you -- Mehmet +1-424-298-1903

1 0

Spoofer Report for NZNOG for Aug 2018
by CAIDA Spoofer Project 08 Sep '18

08 Sep '18

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within nzl. Inferred improvements during Aug 2018: none inferred Source Address Validation issues inferred during Aug 2018: ASN Name First-Spoofed Last-Spoofed 4764 wideband-as-au 2018-08-16 2018-08-17 131291 LANWORXLIMITED 2018-08-24 2018-08-24 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=nzl&no_block=1 Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

RFC 8145 Root Trust Anchor Reports
by Matthew Luckie 06 Sep '18

06 Sep '18

>From http://root-trust-anchor-reports.research.icann.org/ : The ICANN org is publishing the IP addresses that are sending RFC 8145 telemetry ostensibly indicating that a resolver at the reported address (or another resolver that is forwarding through the resolver at the address) is validating using only KSK-2010 as a trust anchor. Publishing these addresses allows ISPs and other organizations who know who operates resolvers at those addresses to contact the resolver operator and notify them of the need to update their DNSSEC trust anchors. Without further action, these resolvers will stop working after the root KSK is rolled on 11 October 2018. http://root-trust-anchor-reports.research.icann.org/rfc8145-addresses.txt The following ASes have their country recorded as NZ in whois, and are in the ICANN list. The following resolvers may or may not be operated by the ASN identified. 4771 Spark 122.56.234.219 122-56-234-219.mobile.spark.co.nz. 122.57.192.56 122-57-192-56-adsl.sparkbb.co.nz. 122.61.118.222 122-61-118-222-adsl.sparkbb.co.nz. 219.88.186.152 rns6.xtra.co.nz. 222.153.3.78 222-153-3-78-fibre.sparkbb.co.nz. 222.154.149.63 222-154-149-63-fibre.sparkbb.co.nz. 9500 Vodafone 203.96.208.52 akrdns2.akl.vf.net.nz. 203.96.208.61 akrdns3.akl.vf.net.nz. 203.96.208.62 akrdns4.akl.vf.net.nz. 203.96.208.91 cbrdns1.chc.vf.net.nz. 203.96.208.92 cbrdns2.chc.vf.net.nz. 210.246.17.115 210-246-17-115.dsl.dyn.ihug.co.nz. 2407:7000:ff00:5382:bd9d::1 2407:7000:ff00:5382:bd9d::2 49.224.251.45 45.251.224.49.dyn.cust.vf.net.nz. 23655 SNAP 111.69.178.254 254.178.69.111.dynamic.snap.net.nz. 111.69.195.153 153.195.69.111.dynamic.snap.net.nz. 24183 DTS 202.174.180.228 38793 2degrees 118.148.149.52 52-149-148-118.nzcomms.co.nz. 118.149.151.121 121-151-149-118.nzcomms.co.nz. 45177 Vibe 45.64.48.2 cdns-02.as45177.net. 45179 SiteHost 103.250.234.202 103-250-234-202.static.webslice.co.nz. 45267 Lightwire 114.134.0.194 114-134-0-194.lightwire.co.nz. 132347 MikiPro 2404:ab00:6:1::6 132692 GlobiCom 103.18.58.198 vpn2.torguardvpnaccess.com. 133607 Web Connect 103.51.101.28 135069 Feenix 103.208.143.164 103-208-143-164.feenix.co.nz. Further information is available at the ICANN site, and it might pay for other operators on NZNOG to double check the ICANN list. http://root-trust-anchor-reports.research.icann.org Matthew

1 0