- NZNOG - lists.nznog.org

Asbestos in Remuera?
by Brian E Carpenter 01 Mar '18

01 Mar '18

Hi, Is anyone aware of access problems (asbestos issues) at the Remuera exchange? I'm being given the run-around by Chorus - just moved and no local loop for the last 10 days. (Yes, I know I should upgrade to fibre but that is stage 2.) This is a personal gripe but if the access problem is genuine it probably affects many subscribers. An off list reply would be fine. Regards Brian Carpenter

1 0

Removing the four stale TAL from the APNIC RPKI validation set.
by George Michaelson 26 Feb '18

26 Feb '18

Updating RPKI trust anchor configuration ------------------------------------------------------- APNIC has completed the process of transitioning from its previous Resource Public Key Infrastructure (RPKI) trust anchor arrangement to a new single trust anchor configuration. Each RIR will publish an 'all resources' global trust anchor, under which its own regional resources (IP addresses and ASNs) will be certified. APNICs trust anchor is one of the previous five, which has been retained as the sole trust anchor over all APNIC resource certificate products. If you are using relying-party software, such as the Dragon Research Labs RPKI Toolkit, RPSTIR or the RIPE NCC’s RPKI Validator, you are advised to update your software’s configuration to use only the current APNIC trust anchor, rather than the set of five APNIC trust anchors that were previously in use. The update is to remove four of the five: One has been retained as the current live Trust Anchor. Note: this update is not critical. However, if it is not done, the software will log or report warnings about being unable to retrieve the trust anchors that are no longer being used. All resources now validate under the single active trust anchor and no orphan products are valid under the other prior trust anchors. The current APNIC TAL is as follows: ------ rsync://rpki.apnic.net/repository/apnic-rpki-root-iana-origin.cer MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx9RWSL61YAAYumEiU8z8 qH2ETVIL01ilxZlzIL9JYSORMN5Cmtf8V2JblIealSqgOTGjvSjEsiV73s67zYQI 7C/iSOb96uf3/s86NqbxDiFQGN8qG7RNcdgVuUlAidl8WxvLNI8VhqbAB5uSg/Mr LeSOvXRja041VptAxIhcGzDMvlAJRwkrYK/Mo8P4E2rSQgwqCgae0ebY1CsJ3Cjf i67C1nw7oXqJJovvXJ4apGmEv8az23OLC6Ki54Ul/E6xk227BFttqFV3YMtKx42H cCcDVZZy01n7JjzvO8ccaXmHIgR7utnqhBRNNq5Xc5ZhbkrUsNtiJmrZzVlgU6Ou 0wIDAQAB ------ Configuring Relying Party Software ----------------------------------------------- RIPE NCC RPKI Validator: If you upgrade to RIPE validator rpki-validator-app-2.24 the correct Trust Anchor is configured. No further work is required. Dragon Research Labs Rcynic Validator: If you run rcynic, you need to remove all the TAL, TA or CER entries in rcynic.conf except ones which point to apnic-rpki-root-iana-origin.cer or the related TAL. If you use the trusted-certs/ directory, simply remove the four files which are named for the non-APNIC RIR as follows: cd /etc/trust-anchors # or wherever you place the TAL files rm apnic-rpki-root-ripe-origin.tal rm apnic-rpki-root-arin-origin.tal rm apnic-rpki-root-lacnic-origin.tal rm apnic-rpki-root-afrinic-origin.tal RPSTIR To modify an installed RPSTIR system, locate the /usr/local/etc/rpstir directory and remove all but the current live APNIC TAL. More information is in the attached PDF describing how to update the trust anchor configuration in these three popular relying-partner software systems. -George

1 0

Survey
by Richard Nelson 14 Feb '18

14 Feb '18

Thankyou to everybody who responded to the NZNOG survey, the results are in and are very useful to us. Geoff Huston was considered a top three speaker most often followed by Francesco Alberti of Eolo. Hamid Maani of Hawaiki and Kraig Winters representing the Red Cross were third equal with a large group just behind them. More importantly almost all the speakers were considered interesting by someone attending the conference so we are pleased with the programme reception. Respondents liked Queenstown but didn't like the venue. They wanted desks in the conference and aircon in the rooms. The most popular destination choices for next years conference were Napier, Wellington and New Plymouth. This fairly closely corresponds with the trustees' thinking so we will check them out for venues and accommodation with air conditioned rooms. It will, however, be difficult to top jet boating as a social activity. Just over 90% of people are open to us changing the conference dates. We will investigate this. There were almost no other conferences identified to avoid clashes with but public holidays are clearly sancrosanct. There was also a suggestion that we avoid school holdiays which we currently don't do. People are happy for us to make the conference a bit bigger to make sure people don't miss out. There were also a lot of individual comments and suggestions that we will try to take on board. Richard Nelson

4 4

Re: [nznog] Survey
by Ewen McNeill 11 Feb '18

11 Feb '18

On 9/02/18 13:11, Barry Murphy wrote: > May be quite beneficial to have NZNog the week after, so those that have travelled > from AU the week before can stick around for another week and attend NZNog Could definitely work out. I can think of at least a half dozen Australia-nbased Linux.Conf.au regulars, who would probably come to LCA2019 in Christchurch too, working in networks/network operations as their day job. There's probably more who would find it relevant if it was easy to get to after Linux.Conf.au (Christchurch/Wellington is an easy regular flight; not sure about Christchurch/New Plymouth or Christchurch/Napier -- those might be two flights). (The week before might work too, but some of the people I'm thinking of usually help with LCA conference setup, which obviously is the end of the week before the conference...) Ewen

4 3

Looking for DNS resolver addresses in NZ for research project
by Sebastian Castro 01 Feb '18

01 Feb '18

Hi everyone: In case you haven't seen a message from me before, I'm Sebastian Castro, Technical Research Manager for NZRS, part of the InternetNZ team. Our Research Team has been conducting some research work on passive DNS analysis in order to identify real DNS resolvers in the wild, as authoritative DNS servers like the .nz nameservers get a lot of rubbish traffic. In order to advance the work, we are looking for some ground truth about real DNS resolvers in NZ. We have a list of known resolvers from organizatons like Spark, Vodafone, some ISPs, but we are looking to extend and refresh that list. If you operate a network that has a resolver, would you be so kind to share with us the IP addresses (both v4 and v6 if available) the resolver uses to send traffic? Depending on your architecture, it could be the address your users setup in their configuration, or a different address based on location where there is a load balancing architecture. There is no restriction: we want big and small resolvers, ISPs, Wireless ISPS, educational organizations, big and small companies, everything helps. The list won't be made public, it will be used for our research purposes. Thanks in advance and enjoy your Waitangi weekend. -- Sebastian Castro Technical Research Manager NZRS Ltd. desk: +64 4 495 2337 mobile: +64 21 400535

1 0

TICSA – Security contacts
by TICSA 01 Feb '18

01 Feb '18

Hi folks, In keeping with Tarus’s comments, I too would like to thank you all for your time at the NZNOG. It was great to catch up with old friends and make some new ones. We can be reached at TICSA(a)NCSC.govt.nz for anything relating to the Network Security section (part 3) of the TICSA How to submit a notification is covered in the Guidelines document which can be found at https://www.ncsc[dot]govt.nz/ticsa Regards Steve Martin On behalf of The TICSA Team National Cyber Security Centre Government Communications Security Bureau This electronic message, together with any attachments, contains information that is provided in confidence and may be subject to legal privilege. Any classification markings must be adhered to. If you are not the intended recipient, you must not peruse, disclose, disseminate, copy or use the message in any way. If you have received this message in error, please notify us immediately by return email and then destroy the original message. The New Zealand Intelligence Community (NZIC) and the departments comprising the NZIC accepts no responsibility for changes to this e-mail, or to any attachments, after its transmission from NZIC. This communication may be accessed or retained for information assurance purposes. Thank you. ______________________________________________________________________________ This email has been filtered by SMX. For more information visit http://smxemail.com ______________________________________________________________________________

1 0

OpenNMS at NZNOG 2018
by Tarus BALOG 31 Jan '18

31 Jan '18

Gang: I just wanted to thank NZNOG for allowing me to come speak at your conference. I had a great time and I wrote about it here: https://www.adventuresinoss.com/2018/01/31/2018-new-zealand-network-operato… As loud, fat and ugly American I have a tendency to overstay my welcome, but if there is interest I'd love to come back next year. We are working on a project called OpenNMS Drift and the company sponsoring it just asked us to add OpenConfig and gRPC telemetry support. The work will be completed by NZNOG 2019, so that is a potential topic. Thanks again for having me. -T -- Tarus BALOG, Maintainer Main: +1 919 533 0160 The OpenNMS Group, Inc. Fax: +1 773 345 3645 Email: tarus(a)opennms.org URL: http://www.opennms.org PGP Key Fingerprint: AFA1 DDA2 24B0 4B61 8D76 9CC7 91F4 79A0 FBF2 DC21

1 0

Lost shirt
by Tim Price 25 Jan '18

25 Jan '18

Did anyone happen to find a spare medium size nznog shirt? I seem to have left mine somewhere by accident and I suspect there aren't any left. Not an emergency but I thought I would ask anyway. Sent from my iPhone

1 0

Conference network and Faucet Statistics
by Jamie Curtis 25 Jan '18

25 Jan '18

Hi all, Firstly I'd like to start by thanking the NZNOG community and in particular the Trustees and conference organisers for supporting REANNZ and the Faucet team to deploy a Faucet based network again for this years conference. As seen by many young development projects, it's often a challenge to find places to get good production operational experience. Running the network each year at NZNOG has provided some great experience for the team and we've learnt lots each year. Thanks for everyones patience as we've got things stabilised. So - some statistics from the network through to today: * 1799 GB total data forwarded by data-plane * 2,240,472,504 packets forwarded by data-plane * 274 dhcp leases issued * 169 unique mac addresses Some slightly less common statistics that we get thanks to the new monitoring inside Faucet: * 1,345,598 L2 learn events inside faucet * 1.50 GB flooded by data-plane * 79,785 openflow control messages sent by faucet * 27,035 openflow control messages received by faucet And, the contribution to the project thanks to running it at NZNOG: * Two versions of faucet released (1.6.17 & 1.6.18) for required features and bug fixes * 75 commits to git, 667 line additions and 238 line deletions * 284 lines of faucet configuration (YAML) built as examples for others * Three new engineers trained in running Faucet in production * One happy PhD student who now has more data for his research project! Thanks again to all for making NZNOG '18 such a great conference, looking forward to next year already! Jamie -- Jamie Curtis Head of Technology Research & Education Advanced Network New Zealand Ltd M +64 21 392 102 P +64 4 913 6363 E jamie.curtis(a)reannz.co.nz www.reannz.co.nz

1 0

Thanks - Port 43 - IntNZ group changes
by Jordan Carter 24 Jan '18

24 Jan '18

Hi all Thanks for the chance to talk at the Conference today. Just a quick couple of links and pointers. For more info about InternetNZ: https://internetnz.nz/ For more info about NZRS: https://nzrs.net.nz/ For more info about the Domain Name Commission: https://dnc.org.nz/ There's a bit of info about the changes to how we organise the InternetNZ group at this URL: https://internetnz.nz/blog/changing-internetnz-our-organisational-review Our commitment to quality in the services we provide is unchanged - .nz is important and we aim to maintain the level of service you're used to. All current products and services continue through the transition, as we merge IntNZ and NZRS. Brent Carey is the incoming Domain Name Commissioner - he outlined the consultation DNCL are running on access to WHOIS via port 43. The info on that is here: https://dnc.org.nz/port-43 Consultation closes 5 Feb - any info you can share on use cases, impact of any change to that service, etc, would be brilliant in informing any changes. Easy to do by email - policies(a)dnc.org.nz. My email is below. Brent is on dnc(a)dnc.org.nz. We're both here tonight and tomorrow and welcome any thoughts or feedback or questions while NZNOG carries on. Finally thanks to two of our team, Yvonne Shelton and Maryann Robertson, who have been working with the trustees to put this conference together. cheers Jordan -- *Jordan Carter* Group Chief Executive InternetNZ Office: +64 4 495 2118 <04-495%202118> | Mobile: +64 21 442 649 <021%20442%20649> | Skype: jordancarter Email: jordan(a)internetnz.net.nz *A better world through a better Internet *

1 0