- NZNOG - lists.nznog.org

ARP _request_ with Target Protocol Address = 255.255.255.255
by Ewen McNeill 02 Aug '15

02 Aug '15

On the off chance that someone else has seen this before and knows what causes it, does anyone know of any software that generates ARP _Requests_ with the Target Protocol Address (TPA) of 255.255.255.255 (all ones). Such that results in this sort of log message from picky switches: <188> Jul 29 10:47:13 [SWITCH] ARP[ipMapForwarding]: ipmap_arp_api.c(1147) 1021154 %% Received ARP Request on interface Vl1 with bad target IP address 255.255.255.255. Sender IP is [REALIP], sender MAC is [REALMAC]. As far as I can tell they happen _approximately_ every 5 minutes, but definitely not to the second. I'm told the Sender IP is a relatively old Windows host, but the Windows admins don't know of anything installed which would do that. Searching the Internet doesn't turn up much. I did find UNARP (https://tools.ietf.org/html/rfc1868) but that's supposed to be an unsolicited ARP _Reply_, and this is a Request; and besides this isn't the scenario UNARP was invented for anyway. The only other speculation I can find is maybe it's a gratuitous ARP that doesn't follow RFC5227 (https://tools.ietf.org/html/rfc5227; which says that Target Protocol Address should be set to the address you want to claim), but that also seems implausible (especially since the DHCP leases at this site are longer than 5/10 minutes). Any thoughts as to what might be generating it welcomed. Ewen PS: This is not the ARP being _broadcast_ to the all address 255.255.255.255; that happens all the time on requests. This is asking "who-has 255.255.255.255"!

2 3

gnodal switches
by Rob McDonald 28 Jul '15

28 Jul '15

Hi, Slightly OT maybe. Not an operational issue. But where else would you ask? Has anyone heard of what happened to gnodal? They sprang up, released some fairly impressive switches, went into receivership then were purchased by Cray computing... 18 months later you can buy their hardware on ebay... $5000 kiwi landed for a 72port 10gig SFP+ chassis? Has anyone made use of this kit? Cheers Rob

1 0

Call for Presentations - DNS-OARC Fall Workshop, Oct 2015 -- Deadline Extended
by Sebastian Castro 28 Jul '15

28 Jul '15

The next DNS-OARC Fall Workshop will take place in Montreal on Oct 3rd and 4th, the weekend before NANOG65. DNS-OARC is requesting proposals for presentations, with a preference for DNSSEC work. We are looking for the whole spectrum, from measurement work using passive and active techniques, to applications and potential new uses of DNSSEC. This workshop intends to build from previous strong DNS-OARC workshops, where operational content and research is welcome. Presentations from DNS operators are particularly welcome, as well as from DNS researchers. All DNS-related subjects are accepted, introduction to new tools, visualizations, data analysis, DNSSEC and novel uses of the DNS. If you are an DNS-OARC member, and have a sensitive topic you would like to present for members-only, we will accommodate those talks too. Time will be available for lighting talks to fit short presentations (5 to 10 minutes). Workshop Milestones 17 June 2015, Call for Presentations posted 17 June 2015, Open for submissions 14 August 2015, Deadline for submission (Deadline extended by two weeks) 20 August 2015, Final Program published 1 October 2015, Final deadline for slideset submission Details for abstract submission will be published here: https://indico.dns-oarc.net/event/24/call-for-abstracts/ The workshop will be organized on different tracks, depending on the topics and the timing of each presentation. If you are interested in a lightning talk, let us know at the time of submission. You can contact the Programme Committee: https://www.dns-oarc.net/oarc/programme via <submissions(a)dns-oarc.net> if you have questions or concerns. Sebastian Castro, for the DNS-OARC Programme Committee DNS-OARC is also seeking sponsorship for this workshop, please contact <sponsor(a)dns-oarc.net> if your organization is interested in becoming a sponsor. (Please note that DNS-OARC is run on a non-profit basis, and is not in a position to reimburse expenses or time for speakers at its meetings.) -- Sebastian Castro Technical Research Manager .nz Registry Services (New Zealand Domain Name Registry Limited) desk: +64 4 495 2337 mobile: +64 21 400535

1 0

Android "stagefright" bug, aka "The Android End Times"
by Mike Forbes 27 Jul '15

27 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Seems this is pretty hot right now. Basically every single android device - and it seems very difficult to imagine a scenario where all those devices could be patched. Suggestions for mitigating include disabling the "Auto download / Auto retrieve" portion of your MMS app and/or disabling the MMS APN in your mobile settings. Though, of course the vulnerability is in the media library so assume the malicious code could be sent via other means. In talking to @jduck (he's a Kiwicon regular!) he's openly commented that this exploit could be definitely wormable. Sources: http://arstechnica.com/security/2015/07/950-million-android-phones-can-be-h… http://blog.zimperium.com/experts-found-a-unicorn-in-the-heart-of-android/ -----BEGIN PGP SIGNATURE----- iQQcBAEBCgAGBQJVtrdXAAoJENoDRsDWj78uMxwf/0AmB3LCWaPN7JT+9dlyQfUR YGppVe9ehpLXg0hhZod9//IJ0GXXhO1TeYwXVgO3E5fPKjNCy1DBv4eCrp/HAnBS 13r04j+H7H4tFy+KjPUHj546+U0KxAk8K4R08NGsyhpnSL4vIrm4m8D2MsOzlU/n YuiVHqCsxyO3YQ+FZDh24tLGCnoy+HrhFa+ry/i1KNOPdRFZmtrHwET5BBKX9q0I n/Dfgo1z4Lbfs6D5QmH1A2AhHXQx8fUiW0mNdOfd/SW4Thmwj7xPJVo36PGimYPQ 8qznIlLJLX9BgFZ10uVmCJaQEH2M1ZD1cV8WhnAgznSISTx8oopo5A3Qgk/D3Ltg LXApd09pv8fQbjq15fUmDc1buAYB/On7lkpboWxFSo2UHV3ua5YK0rz9Yag4TaBU Ii3+6a2dwW933qUQlLn7JR0ibv+yKsHeK/zjnd0WC8iaDGb+I33hdf+fL9DU7re/ DF0k0ku7E8Uf7209A+yz+2kW0qrE9guldvn4M3mGC4ptG0QQvRPEiTynxARO9pjW iWTix+zDkD8qlyUw2aiK9yTaXhdYQRUHcoBmVrs+HCQABLgQmpdZ/8FBZGFE3F0F KHRmLaPuhTeeKprHti2JoVU98/5OYGNMzYrRs13jV1I399vJSVP6grUIPIpk7M8i zI8vqsXmBNAK2CYK++WHINccjkFfZf6hJ1V59Ajv1VjeSkmFfuEveO2+AIjOvrBr Bv3ZcflxTZsmqxHrOhrU/VclpT8qprc8GoFYMLSpLmQsLqGG5H9ih5vLhz8H7wXe lDuwjXZbtRmAh4BtfCGZoR20KJExNipgoZlFN0zD46Y91F/CFYvMGOlQlmi978i/ 1CrQ6MAU/7krFGPGUXnf4ChXfDzxH41E90Sb02xHsl6542Cf21z9yjdTqavGln2R z6nnDhIM+FfbGdh/IxdBBQT334Dlaby+HDnHfv9z8NzmA+g6l4rnZn7g04O0r5oq 68odwxL59mUyC1Uhp1NIxcTSxgD+Rj8ZWs98auQkYFOrUoW2QlsmIAvqbZIQY0sT /isSYpsP/pO74mBt62fjz/dcrDwiPypDdT0iZxmgfeD+Jjlo78KxoVCpLxxBtKUw ykxvD3yhqsY4nJf6KkyRMJ3CgkNTNifmdJ/LhJ+0pbO9+zh8gL0kWO/S5WLg2nt4 CtRfOeQ4WwPX7PEmmtSs38L1oA3YUcRBYq2eseg0915WFO6tXjx/9Ej/Fj3lZ0jZ vWzF/PcTxkohBZk2CrnWBXxhbAgGtSNPzHzxDFMcu2kkLrDR0dn7efd5TDbbzRTe Dur1XFAmcGMh8KuW2HxqkOMu/fPLmbgufjxNcy7PG2CWZy7Xn8TwnGAyNnrvcCI= =cyK6 -----END PGP SIGNATURE-----

1 0

Any 2talk NOC lurking?
by Pete Mundy 27 Jul '15

27 Jul '15

Hi 2talk Just on the off-chance any of your guys are lurking on this list? You seem to have dropped a route and all traffic bound to your NS is going nowhere as of shortly after 6am today. I've tried lookups and pings from connections on quite a range of ISPs and they all show the same thing. Some traceroute examples are included below just as a reference. It's not the first time the route to the network hosting your NS has dropped. Have you ever considered having a tertiary NS elsewhere, say maybe on AWS or something? Just a thought. Anyway just a heads up since I can't access your live portal to lodge a ticket ;) (and a warning for others on list in case they are affected by it too). Cheers, Pete [from a Spark link] Host Loss% Snt Last Avg Best Wrst StDev 1. dsl-router.lan 0.0% 3 1.5 1.4 1.3 1.5 0.1 2. 122-56.78-178.n4l.sparkdigital.co.nz 0.0% 3 59.1 24.6 7.2 59.1 29.9 3. 122-56-99-251.n4l.sparkdigital.co.nz 0.0% 3 15.0 30.4 15.0 60.8 26.3 4. 122-56-99-250.n4l.sparkdigital.co.nz 0.0% 3 15.5 17.6 15.5 21.6 3.5 5. 122-56-99-253.n4l.sparkdigital.co.nz 0.0% 3 15.8 15.4 14.9 15.8 0.5 6. ??? 7. ae8-10.akbr6.global-gateway.net.nz 0.0% 2 25.8 25.8 25.8 25.8 0.0 8. ??? [from a Snap link] fpl-rpi17 (0.0.0.0) Tue Jul 28 07:16:35 2015 Keys: Help Display mode Restart statistics Order of fields quit Packets Pings Host Loss% Snt Last Avg Best Wrst StDev 1. fritz.box 0.0% 6 1.0 1.0 1.0 1.1 0.1 2. 133.7.69.111.static.snap.net.nz 0.0% 6 2.8 5.1 2.8 13.5 4.2 3. ??? [from a Solarix link] vvm2.fiberphone.co.nz (0.0.0.0) Tue Jul 28 07:17:14 2015 Keys: Help Display mode Restart statistics Order of fields quit Packets Pings Host Loss% Snt Last Avg Best Wrst StDev 1. ge-1-1-1-340.core-0.ive.chc.unleash.net.nz 0.0% 6 1.0 1.0 0.6 2.1 0.6 2. ae1-22.core-0.sho.chc.unleash.net.nz 0.0% 6 1.1 1.5 0.8 3.3 0.9 3. ae0-3221.core-0.que.akl.unleash.net.nz 0.0% 6 17.1 17.3 16.8 18.3 0.5 4. 116.90.129.203 0.0% 5 17.8 17.2 16.7 17.8 0.4 5. ten-0-3-0-500.bdr01.akl05.akl.VOCUS.net.nz 0.0% 5 17.1 17.4 17.1 17.5 0.2 6. ???

3 2

National Broadband Map launched yesterday
by Sebastian Castro 23 Jul '15

23 Jul '15

Hello members of the NZNOG community: NZRS launched the National Broadband Map (https://broadbandmap.nz) yesterday with the participation of Hon. Amy Adams. We had an overwhelming response and our team had to clock some extra hours to scale up everything nicely to cope with the load. We are getting calls and messages noting the accuracy in certain border cases. We are working with our data suppliers to ensure the information we're presenting is as accurate as possible, and new data will be added in the next weeks to improve it. We are open to receiving your comments and feedback, and definitely planning a presentation about the process for the next NZNOG meeting. Kind Regards, -- Sebastian Castro Technical Research Manager NZRS Ltd. desk: +64 4 495 2337 mobile: +64 21 400535

2 1

CallPlus Routes / Akamai Coming via Vocus / AKL-IX??
by Liam Farr 22 Jul '15

22 Jul '15

Hey, Anyone else seeing this, routes to CallPlus are being advertised to AKL-IX by Vocus rather than by CallPlus direct. As an example this is breaking 'www.stuff.co.nz' for me. The path by Vocus seems really 'fucked' (like its aggressively shaped down to nothing) so HTTP takes forever to load. Liams-MacBook-Pro:~ liamfarr$ traceroute www.stuff.co.nz > traceroute: Warning: www.stuff.co.nz has multiple addresses; using > 119.224.143.41 > traceroute to a1784.g.akamai.net (119.224.143.41), 64 hops max, 52 byte > packets > 1 192.168.6.1 (192.168.6.1) 0.710 ms 0.394 ms 0.332 ms > 2 unallocated.maxumdata.net (103.247.154.2) 0.427 ms 0.434 ms 0.397 > ms > 3 vl0901.core2.qs220.maxumdata.net (103.247.154.141) 0.585 ms 0.651 > ms 0.586 ms > 4 vl0233.edge1.qs220.maxumdata.net (103.247.154.38) 0.645 ms 0.672 > ms 0.613 ms > 5 43.243.21.6 (43.243.21.6) 1.580 ms 1.459 ms 1.529 ms > 6 ten-0-1-0-2.cor01.akl05.akl.vocus.net.nz (114.31.202.122) 2.139 ms > 2.088 ms 2.294 ms > 7 bundle-10.bdr02.akl05.akl.vocus.net.nz (114.31.202.101) 2.560 ms > 2.764 ms 2.314 ms > 8 as4610.cust.bdr02.akl05.akl.vocus.net.nz (175.45.102.66) 24.271 ms > 24.166 ms 24.251 ms > 9 pts-n.cpcak4-r1.tranzpeer.net (101.98.5.20) 2.297 ms 2.175 ms > 2.254 ms > 10 p1.akamai.callplus.net.nz (119.224.143.1) 1.488 ms 1.633 ms 2.441 > ms > 11 p41.akamai.callplus.net.nz (119.224.143.41) 1.624 ms 2.116 ms > 2.334 ms liam(a)QS220-EDGE1:~$ show ip bgp 119.224.143.41 > BGP routing table entry for 119.224.142.0/23 > Paths: (4 available, best #3, table Default-IP-Routing-Table) > Advertised to non peer-group peers: > 103.247.154.37 103.247.154.42 103.247.154.186 192.203.154.150 > 2403:4d00:fff:ffff:ffff:ffff:20:2 > 45177 4610 9790 > 103.247.152.241 from 103.247.152.241 (14.1.32.4) > Origin IGP, localpref 50, valid, external > Community: 55785:502 > Extended Community: RT:45177:1117 > Last update: Thu Jul 9 06:37:46 2015 > 45177 4610 9790 > 103.247.152.213 from 103.247.152.213 (14.1.32.4) > Origin IGP, localpref 50, valid, external > Community: 55785:502 > Extended Community: RT:45177:1117 > Last update: Thu Jul 9 06:34:55 2015 > > > > > * 4826 4610 9790 43.243.21.6 from 43.243.21.1 (43.243.21.1) > Origin IGP, localpref 100, valid, external, best Community: 55785:202 > Last update: Wed Jun 24 04:15:20 2015* > 23655 9560 9790 > 111.69.34.225 from 111.69.34.225 (43.225.200.2) > Origin IGP, localpref 90, valid, external > Community: 55785:302 > Last update: Sat Mar 28 03:36:00 2015 As CallPlus peer on AKL-IX I would have expected to see them advertising their own routes, rather than just advertising these to Vocus who are then 'breaking them'. Perhaps someone from CallPlus could fix their advertisements, and someone from Vocus could either fix their 'bottleneck' or stop advertising the routes. -- Kind Regards Liam Farr Maxum Data +64-9-950-5302

8 8

Junos and RPKI validation
by Dave Mill 16 Jul '15

16 Jul '15

Hi all NZNOG, and especially Michael Fincham and Tim Hoffman, had done a big push both at our conferences and on this list to get people using RPKI route validation. We were a test customer using the NZRS service at http://validator.rpki.net.nz/rtr-sessions . Someone with an observant eye may have noticed that we silently stopped using this validator a few weeks ago. We hit a 'minor' issue where Junos would restart _all_ routing daemons and produce a core dump when running a session to a RPKI validator. It affects 12.3R9 12.3X48-D10 13.3R4 14.1R3 14.2R1 15.1R1 and happens on J-series, M-series, T-series, MX-series, EX Series, SRX Series. PR for those with a Juniper login - https://prsearch.juniper.net/InfoCenter/index?page=prcontent&id=PR1010216 Upgrade to a recent release of your choosing to fix. Just figured I'd share for anyone else who is doing RPKI validation on one of these releases. For now we've stopped doing RPKI validation until we can arrange an upgrade of the routers involved. Cheers Dave

2 1

dual sim (3g) routers
by Jodi Thomson 12 Jul '15

12 Jul '15

Hi Folks We're on the hunt for a dual-sim (3g) router. Have done some googling but not sure what may or may not work with our 3/4G networks. Primary objective is to have 2nd 3G link as failover to second network (eg spark -> vodafone), but aggregation would be helpful also if networks support it (eg vodafone-vodafone) Wondering if anyone on the list knows what is available in NZ? Off list replies welcome to prevent clutter Cheers Jodi PS Beer -- Jodi Thomson Systems & Networks Web Connect Ltd Unit 1, 501 Heretaunga Street West Hastings, 4122 Ph: (06) 281 2324 (ext 802) http://www.webconnect.nz

1 1

Whither NzWrt?
by Dave Taht 12 Jul '15

12 Jul '15

I am curious if the NZWrt idea ever got any traction? It certainly seemed saner for me for a set of ISPs to agree on one specific hardware type, get software that met their needs, make it stable as heck, and to maintain it themselves.... -- Dave Täht worldwide bufferbloat report: http://www.dslreports.com/speedtest/results/bufferbloat And: What will it take to vastly improve wifi for everyone? https://plus.google.com/u/0/explore/makewififast

3 2