- NZNOG - lists.nznog.org

Re: [nznog] Win10 downloads causing UFB congestion?
by Scott Weeks 11 Aug '15

11 Aug '15

--- scott(a)scottpettit.nz wrote: From: Scott Pettit <scott(a)scottpettit.nz> puff piece designed to spread FUD for Digital Island's own -------------------------------------- Funny, I worked for another Digital Island that existed in Hawaii from the mid-1990s to ~2002. We had PoPs all over the world including NZ. It was bought by C&W and these guys took up the name 2 years later according to their "about us" page. Until now I never heard of them... scott _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Traffic on Akl-IX
by Jesse Archer 09 Aug '15

09 Aug '15

Hey all, A quick heads up about our experience on Akl-IX (community IX based in Auckland, presence in 220 Queen and Vocus Albany). This past week we've seen our traffic coming in via the IX double, in part thanks to Microsoft peering and the Windows 10 updates that are hammering everyone's networks right now :) Also recent growth in peers - I see Compass are on-boarding and a couple of other operators I've spoken with are peering shortly. There are some large content providers on the IX, either directly connected or via "host member ISPs" - so if you've been considering peering and access to content might be a driver for on-boarding and you would like some more info, please speak to Joe Wooller of WAIA on peering(a)akl-ix.nz or you can drop me an email. If you're from: Voyager ICONZ Trade Me Sitehost HD Mediaworks ...I'd love to see you on the IX as we do a bit of traffic each day and the current inbound and outbound paths are not as optimal as they could be. *Jesse Archer* *General Manager*Full Flavour *p. *07 577 0099 *ddi*. 07 281 1391 *s*. Skype "myfullflavour" *e*. jesse(a)fullflavour.nz <jesse(a)fullflavourmedia.co.nz> *w*. fullflavour.nz <http://www.fullflavourmedia.co.nz/> *a. *Basestation, 148 Durham Street, Tauranga *a*. PO Box 16306, Bethlehem 3176, New Zealand

8 9

Some name server changes, SkyTV and Paymark
by paul tinson 09 Aug '15

09 Aug '15

Hi There, I wanted to notify the list that anyone operating recursive resolvers would be wise to flush the following zones from the cache: *.skytv.co.nz *.paymarkclick.co.nz Lastnight the name servers for these where switched to ns1, ns2 and ns3.spark.co.nz. The TTL on the NS record was 24hrs at the time of change so these could still be in cache as the old record. Regards Paul

2 2

Chorus CCIL availability
by Jonathon Exley 05 Aug '15

05 Aug '15

Hi NOGers, The Chorus Co-Innovation Lab (CCIL) is being upgraded to a new software release in preparation for a UFB production upgrade later this year. The Wellington and Auckland nodes will bounce several times today and tomorrow, as we exercise the upgrade and rollback procedures. [cid:image001.jpg(a)01CF4F55.0ABA26E0] Jonathon Exley Network Specialist Layer 2 T +64 4 896 4190 M +64 27 514 8048 E jonathon.exley(a)chorus.co.nz<mailto:jonathon.exley(a)chorus.co.nz> Level 8, State Insurance Tower, 1 Willis Street Wellington www.chorus.co.nz<http://www.chorus.co.nz/> Aon Hewitt Best Employer in Australasia 2012 & 2013 P Please consider the environment before printing this e-mail This communication, including any attachments, is confidential and may be legally privileged. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. No confidentiality or privilege is waived or lost by any mis-transmission or error. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002.

2 2

Chorus EUBA + IPV6
by Simon Allard 02 Aug '15

02 Aug '15

Since it seems to be ipv6 month here at NZNog I thought I would bring this up. Some of you have commented that Orcon is in trial mode for IPv6 and are probably wondering why we haven’t progressed. We have had IPV6 enabled for a while and have a good number of ipv6 customers online now. However we found an issue on the Chorus network which stopped us rolling it out further. (UFB ipv6 was another battle which requires beer!) What we found was some Chrous DSLAMS with certain card types would drop IPV6CP packets in one direction when doing the PPPoE->PPPoA conversation. It would seem that these cards don’t support Ipv6. Weirdly enough it would seem it is the newer card types used for Broadband IP. (citation needed). This in itself isn’t a major but we also found our NFV4 modem would reset its entire PPPoE stack if the IPV6CP conversation started but didn’t complete as expected, so customers would constantly be disconnected and cycle around. (The Genius modem works well with ipv6) The NFV4 issue aside (we are resolving with the Vendor). We approached the Chorus tech team and they helped identify the issue but that’s is where its hit a brick wall. The Chorus op team are not keen on fixing the issue nationwide as it involves new code versions, a massive amount of testing and a long rollout program. (I can understand where they are coming from). To summarise: IPV6 doesn’t work on Chorus EUBA on some line card types Only affect PPPoE->PPPoA translation PPPoE end to end is fine. Chorus say IPV6 not supported on EUBA Customer numbers effected are smallish. We will fix the NFV4 issue, but keen to rollout more IPV6 to all customers, not just the lucky ones on card types which work. Has any other ISP’s (the bigger ones especially) noticed this? As it will require some pressure to get some progress. Cheers, Simon Allard Orcon/Callplus [cid:image92256e.PNG(a)016ea4ce.48a80470] Simon Allard // Senior Network Architect D: 09 550 2790 M: 020 100 0790 F: www.callplus.co.nz<http://www.callplus.co.nz> | www.slingshot.co.nz<http://www.slingshot.co.nz> | www.flip.co.nz<http://www.flip.co.nz> | www.orcon.net.nz<http://www.orcon.net.nz> This message and any attachments contain privileged and confidential information. If you are not the intended recipient of this message, you are hereby notified that any use, dissemination, distribution or reproduction of this message is prohibited. If you have received this message in error please notify the sender immediately via email and then destroy this message and any attachments.

5 5

ARP _request_ with Target Protocol Address = 255.255.255.255
by Ewen McNeill 02 Aug '15

02 Aug '15

On the off chance that someone else has seen this before and knows what causes it, does anyone know of any software that generates ARP _Requests_ with the Target Protocol Address (TPA) of 255.255.255.255 (all ones). Such that results in this sort of log message from picky switches: <188> Jul 29 10:47:13 [SWITCH] ARP[ipMapForwarding]: ipmap_arp_api.c(1147) 1021154 %% Received ARP Request on interface Vl1 with bad target IP address 255.255.255.255. Sender IP is [REALIP], sender MAC is [REALMAC]. As far as I can tell they happen _approximately_ every 5 minutes, but definitely not to the second. I'm told the Sender IP is a relatively old Windows host, but the Windows admins don't know of anything installed which would do that. Searching the Internet doesn't turn up much. I did find UNARP (https://tools.ietf.org/html/rfc1868) but that's supposed to be an unsolicited ARP _Reply_, and this is a Request; and besides this isn't the scenario UNARP was invented for anyway. The only other speculation I can find is maybe it's a gratuitous ARP that doesn't follow RFC5227 (https://tools.ietf.org/html/rfc5227; which says that Target Protocol Address should be set to the address you want to claim), but that also seems implausible (especially since the DHCP leases at this site are longer than 5/10 minutes). Any thoughts as to what might be generating it welcomed. Ewen PS: This is not the ARP being _broadcast_ to the all address 255.255.255.255; that happens all the time on requests. This is asking "who-has 255.255.255.255"!

2 3

gnodal switches
by Rob McDonald 28 Jul '15

28 Jul '15

Hi, Slightly OT maybe. Not an operational issue. But where else would you ask? Has anyone heard of what happened to gnodal? They sprang up, released some fairly impressive switches, went into receivership then were purchased by Cray computing... 18 months later you can buy their hardware on ebay... $5000 kiwi landed for a 72port 10gig SFP+ chassis? Has anyone made use of this kit? Cheers Rob

1 0

Call for Presentations - DNS-OARC Fall Workshop, Oct 2015 -- Deadline Extended
by Sebastian Castro 28 Jul '15

28 Jul '15

The next DNS-OARC Fall Workshop will take place in Montreal on Oct 3rd and 4th, the weekend before NANOG65. DNS-OARC is requesting proposals for presentations, with a preference for DNSSEC work. We are looking for the whole spectrum, from measurement work using passive and active techniques, to applications and potential new uses of DNSSEC. This workshop intends to build from previous strong DNS-OARC workshops, where operational content and research is welcome. Presentations from DNS operators are particularly welcome, as well as from DNS researchers. All DNS-related subjects are accepted, introduction to new tools, visualizations, data analysis, DNSSEC and novel uses of the DNS. If you are an DNS-OARC member, and have a sensitive topic you would like to present for members-only, we will accommodate those talks too. Time will be available for lighting talks to fit short presentations (5 to 10 minutes). Workshop Milestones 17 June 2015, Call for Presentations posted 17 June 2015, Open for submissions 14 August 2015, Deadline for submission (Deadline extended by two weeks) 20 August 2015, Final Program published 1 October 2015, Final deadline for slideset submission Details for abstract submission will be published here: https://indico.dns-oarc.net/event/24/call-for-abstracts/ The workshop will be organized on different tracks, depending on the topics and the timing of each presentation. If you are interested in a lightning talk, let us know at the time of submission. You can contact the Programme Committee: https://www.dns-oarc.net/oarc/programme via <submissions(a)dns-oarc.net> if you have questions or concerns. Sebastian Castro, for the DNS-OARC Programme Committee DNS-OARC is also seeking sponsorship for this workshop, please contact <sponsor(a)dns-oarc.net> if your organization is interested in becoming a sponsor. (Please note that DNS-OARC is run on a non-profit basis, and is not in a position to reimburse expenses or time for speakers at its meetings.) -- Sebastian Castro Technical Research Manager .nz Registry Services (New Zealand Domain Name Registry Limited) desk: +64 4 495 2337 mobile: +64 21 400535

1 0

Android "stagefright" bug, aka "The Android End Times"
by Mike Forbes 27 Jul '15

27 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Seems this is pretty hot right now. Basically every single android device - and it seems very difficult to imagine a scenario where all those devices could be patched. Suggestions for mitigating include disabling the "Auto download / Auto retrieve" portion of your MMS app and/or disabling the MMS APN in your mobile settings. Though, of course the vulnerability is in the media library so assume the malicious code could be sent via other means. In talking to @jduck (he's a Kiwicon regular!) he's openly commented that this exploit could be definitely wormable. Sources: http://arstechnica.com/security/2015/07/950-million-android-phones-can-be-h… http://blog.zimperium.com/experts-found-a-unicorn-in-the-heart-of-android/ -----BEGIN PGP SIGNATURE----- iQQcBAEBCgAGBQJVtrdXAAoJENoDRsDWj78uMxwf/0AmB3LCWaPN7JT+9dlyQfUR YGppVe9ehpLXg0hhZod9//IJ0GXXhO1TeYwXVgO3E5fPKjNCy1DBv4eCrp/HAnBS 13r04j+H7H4tFy+KjPUHj546+U0KxAk8K4R08NGsyhpnSL4vIrm4m8D2MsOzlU/n YuiVHqCsxyO3YQ+FZDh24tLGCnoy+HrhFa+ry/i1KNOPdRFZmtrHwET5BBKX9q0I n/Dfgo1z4Lbfs6D5QmH1A2AhHXQx8fUiW0mNdOfd/SW4Thmwj7xPJVo36PGimYPQ 8qznIlLJLX9BgFZ10uVmCJaQEH2M1ZD1cV8WhnAgznSISTx8oopo5A3Qgk/D3Ltg LXApd09pv8fQbjq15fUmDc1buAYB/On7lkpboWxFSo2UHV3ua5YK0rz9Yag4TaBU Ii3+6a2dwW933qUQlLn7JR0ibv+yKsHeK/zjnd0WC8iaDGb+I33hdf+fL9DU7re/ DF0k0ku7E8Uf7209A+yz+2kW0qrE9guldvn4M3mGC4ptG0QQvRPEiTynxARO9pjW iWTix+zDkD8qlyUw2aiK9yTaXhdYQRUHcoBmVrs+HCQABLgQmpdZ/8FBZGFE3F0F KHRmLaPuhTeeKprHti2JoVU98/5OYGNMzYrRs13jV1I399vJSVP6grUIPIpk7M8i zI8vqsXmBNAK2CYK++WHINccjkFfZf6hJ1V59Ajv1VjeSkmFfuEveO2+AIjOvrBr Bv3ZcflxTZsmqxHrOhrU/VclpT8qprc8GoFYMLSpLmQsLqGG5H9ih5vLhz8H7wXe lDuwjXZbtRmAh4BtfCGZoR20KJExNipgoZlFN0zD46Y91F/CFYvMGOlQlmi978i/ 1CrQ6MAU/7krFGPGUXnf4ChXfDzxH41E90Sb02xHsl6542Cf21z9yjdTqavGln2R z6nnDhIM+FfbGdh/IxdBBQT334Dlaby+HDnHfv9z8NzmA+g6l4rnZn7g04O0r5oq 68odwxL59mUyC1Uhp1NIxcTSxgD+Rj8ZWs98auQkYFOrUoW2QlsmIAvqbZIQY0sT /isSYpsP/pO74mBt62fjz/dcrDwiPypDdT0iZxmgfeD+Jjlo78KxoVCpLxxBtKUw ykxvD3yhqsY4nJf6KkyRMJ3CgkNTNifmdJ/LhJ+0pbO9+zh8gL0kWO/S5WLg2nt4 CtRfOeQ4WwPX7PEmmtSs38L1oA3YUcRBYq2eseg0915WFO6tXjx/9Ej/Fj3lZ0jZ vWzF/PcTxkohBZk2CrnWBXxhbAgGtSNPzHzxDFMcu2kkLrDR0dn7efd5TDbbzRTe Dur1XFAmcGMh8KuW2HxqkOMu/fPLmbgufjxNcy7PG2CWZy7Xn8TwnGAyNnrvcCI= =cyK6 -----END PGP SIGNATURE-----

1 0

Any 2talk NOC lurking?
by Pete Mundy 27 Jul '15

27 Jul '15

Hi 2talk Just on the off-chance any of your guys are lurking on this list? You seem to have dropped a route and all traffic bound to your NS is going nowhere as of shortly after 6am today. I've tried lookups and pings from connections on quite a range of ISPs and they all show the same thing. Some traceroute examples are included below just as a reference. It's not the first time the route to the network hosting your NS has dropped. Have you ever considered having a tertiary NS elsewhere, say maybe on AWS or something? Just a thought. Anyway just a heads up since I can't access your live portal to lodge a ticket ;) (and a warning for others on list in case they are affected by it too). Cheers, Pete [from a Spark link] Host Loss% Snt Last Avg Best Wrst StDev 1. dsl-router.lan 0.0% 3 1.5 1.4 1.3 1.5 0.1 2. 122-56.78-178.n4l.sparkdigital.co.nz 0.0% 3 59.1 24.6 7.2 59.1 29.9 3. 122-56-99-251.n4l.sparkdigital.co.nz 0.0% 3 15.0 30.4 15.0 60.8 26.3 4. 122-56-99-250.n4l.sparkdigital.co.nz 0.0% 3 15.5 17.6 15.5 21.6 3.5 5. 122-56-99-253.n4l.sparkdigital.co.nz 0.0% 3 15.8 15.4 14.9 15.8 0.5 6. ??? 7. ae8-10.akbr6.global-gateway.net.nz 0.0% 2 25.8 25.8 25.8 25.8 0.0 8. ??? [from a Snap link] fpl-rpi17 (0.0.0.0) Tue Jul 28 07:16:35 2015 Keys: Help Display mode Restart statistics Order of fields quit Packets Pings Host Loss% Snt Last Avg Best Wrst StDev 1. fritz.box 0.0% 6 1.0 1.0 1.0 1.1 0.1 2. 133.7.69.111.static.snap.net.nz 0.0% 6 2.8 5.1 2.8 13.5 4.2 3. ??? [from a Solarix link] vvm2.fiberphone.co.nz (0.0.0.0) Tue Jul 28 07:17:14 2015 Keys: Help Display mode Restart statistics Order of fields quit Packets Pings Host Loss% Snt Last Avg Best Wrst StDev 1. ge-1-1-1-340.core-0.ive.chc.unleash.net.nz 0.0% 6 1.0 1.0 0.6 2.1 0.6 2. ae1-22.core-0.sho.chc.unleash.net.nz 0.0% 6 1.1 1.5 0.8 3.3 0.9 3. ae0-3221.core-0.que.akl.unleash.net.nz 0.0% 6 17.1 17.3 16.8 18.3 0.5 4. 116.90.129.203 0.0% 5 17.8 17.2 16.7 17.8 0.4 5. ten-0-3-0-500.bdr01.akl05.akl.VOCUS.net.nz 0.0% 5 17.1 17.4 17.1 17.5 0.2 6. ???

3 2