- NZNOG - lists.nznog.org

ipv6 peering
by Chris Hellberg 30 Jul '02

30 Jul '02

Morning all, Thanks to Dean's great ipv6 presentation at Uniforum, everyone's got a ::/28 allocation from APNIC now, right? I'm interested in hearing from people who've got v6 allocations, either from tunnel brokers, or otherwise who'd like to peer at an NZ ipv6 peering point. APE and WIX are possibilities, however I have my doubts on the number of providers on WIX and APE who would be willing to add v6 addresses on their interfaces from citylink to any servers in their network; it'd be easier to put a 6to4 tunnel for testing purposes on a router in the middle of the network, especially if the router question already has a tunnel to a tunnelbroker overseas. One of the benefits of this is that any NZ<->NZ v6 traffic doesn't have to traverse international tunnels. The big driver of this will be the amount of local content available via v6. Admittedly there's not much around at the moment, however I do have mysql, apache, xfree86, cygwin, cpan and sunfreeware mirrors that are on the 6bone which could serve as good starters. I'm sure that there would be some webservers out there who are v6 aware which people would be willing to route ipv6 to. The more people we can get on the ix, the more content would become available. Sorta like the multicast chicken and egg thing. Could I get a showing of interest on who'd like to be on such an ix (just a box I have running zebra which a whole bunch of 6in4 tunnels), even if you've got a ::/64 tunnel allocation from a tunnel broker? There won't be any international v6 transit provided, just a BGP4+ feed of all the NZ prefixes of people peering. Cheers, Chris - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Banks to review ICMP filtering?
by Juha Saarinen 30 Jul '02

30 Jul '02

http://www.idg.co.nz/webhome.nsf/UNID/E8C8975FB28122B1CC256C0500167A15!open… -- Juha Saarinen - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Banking/Hospital Problems and MTU
by rob.edkins＠axon.co.nz 28 Jul '02

28 Jul '02

> > Probably the reason its not on by default, is because it is > not a "fix", > its just a workaround, to work around braindead firewalls > that block all ICMP. > Agreed, it's a hack...but it's not only firewalls that drop ICMP...I came across this a few years ago with a WAN router that was misbehaving between Token Ring and Ethernet segments. > As such there would probably be considerable sacrifice in > performance when > it has to operate - first of all there will have to be a few lost > retransmitions of large MTU packets before it realises > something is wrong, > and then (from Juha's post) it just drops the MTU to 536 for further > communication, which is definately sub optimal, depending on > what the real > maximum MTU of the path is... > Yes, although it will only kick in on these sites that have this problem. It's dynamic on a per connection basis. Overall performance on the majority of connections won't be affected, as the 'ol TCP stack will behave as intended. > If it was on by default, it would hide the real problem, and > nothing would > ever get done about it. > Fixing is always better than working around, but given that ICMP access policy at the far end of the pipe is not something that Joe User usually has a lot of control over, then something that will work is probably better than something that doesn't. (From a user perspective) Unless it has some other negative impact.... Rob -- The information contained in this e-mail message is intended only for the use of the person or entity to whom it is addressed and may contain information that is CONFIDENTIAL and may be exempt from disclosure under applicable laws. If you read this message and are not the addressee you are notified that use, dissemination, distribution, or reproduction of this message is prohibited. If you have received this message in error, please notify us immediately and delete the original message. You should scan this message and any attached files for viruses. Axon Computertime accepts no liability for any loss caused either directly or indirectly by a virus arising from the use of this message or any attached file. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

DNS monitoring update
by Rob Thomas 28 Jul '02

28 Jul '02

Hi, NZNOGers. [ Apologies to those of you who have already seen this on NANOG. ] I have added two additional data collection points to my DNS root name server monitoring. I have also scaled the graphs and added a text only version. You will find it all here: http://www.cymru.com/DNS Comments and feedback are always welcome! Thanks, Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty); - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Pictures from Uniforum 2002 Online
by Mark Foster 28 Jul '02

28 Jul '02

Thanks to Eaden and Robert from Opentec - http://opentec.co.nz/uniforum Cheers, Mark. (Please forgive the CrossPosting.) - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Banking/Hospital Problems and MTU
by Simon Byrnand 28 Jul '02

28 Jul '02

At 10:46 29/07/02 +1200, rob.edkins(a)axon.co.nz wrote: >http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q159211& >http://support.microsoft.com/default.aspx?scid=KB;EN-US;q314825& > >Are useful too. > >This fix has been around for at least 4-5 years to my knowledge. >I don't know why it isn't on by default by now, but I guess it wasn't all >that big an issue in the old dial-up world. Probably the reason its not on by default, is because it is not a "fix", its just a workaround, to work around braindead firewalls that block all ICMP. As such there would probably be considerable sacrifice in performance when it has to operate - first of all there will have to be a few lost retransmitions of large MTU packets before it realises something is wrong, and then (from Juha's post) it just drops the MTU to 536 for further communication, which is definately sub optimal, depending on what the real maximum MTU of the path is... If it was on by default, it would hide the real problem, and nothing would ever get done about it. (I can see it now - "our Bank site works fine for MS operating systems, its only those weirdo's that run Linux that have problems because they don't have PMTUBHDetect" :) For once MS got something right by not making it on by default... Regards, Simon - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: Banking/Hospital Problems and MTU
by rob.edkins＠axon.co.nz 28 Jul '02

28 Jul '02

http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q159211& http://support.microsoft.com/default.aspx?scid=KB;EN-US;q314825& Are useful too. This fix has been around for at least 4-5 years to my knowledge. I don't know why it isn't on by default by now, but I guess it wasn't all that big an issue in the old dial-up world. > > http://www.microsoft.com/windows2000/techinfo/reskit/en/cnet/c > nbc_imp_yvjd.htm > > has more details. > > -- The information contained in this e-mail message is intended only for the use of the person or entity to whom it is addressed and may contain information that is CONFIDENTIAL and may be exempt from disclosure under applicable laws. If you read this message and are not the addressee you are notified that use, dissemination, distribution, or reproduction of this message is prohibited. If you have received this message in error, please notify us immediately and delete the original message. You should scan this message and any attached files for viruses. Axon Computertime accepts no liability for any loss caused either directly or indirectly by a virus arising from the use of this message or any attached file. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: Banking/Hospital Problems and MTU
by rob.edkins＠axon.co.nz 28 Jul '02

28 Jul '02

There's a somewhat simpler reg hack on Windoze. Set HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnablePMTUBHDetect to 1 This enables automatic 'Black Hole' router detection and triggers automatic MTU scaling. BTW, the 'Don't Fragment' Bit is on by default with Windows. Rob > > How incredibly serendipitous. I just ran into this problem > at work the > yesterday. The service techs. for our digital radiology > system came in > and applied the latest service update. All of a sudden users weren't > able to log in via their browser loaded Java client. Funny thing is, > these guys spent 2 days trying to figure out the problem before > resorting to asking "the network guy"... one of those pride things I > guess. > > Some quality time (15 minutes) with tcpdump (well, windump) showed the > DF bit being set and repeated acknowledgment requests during the > "hang". After a modest amount of investigation and a few phone calls > the following was found: > > 1. a remote firewall blocking all ICMP (the admin won't change it) > 2. a router somewhere in the path with a lower MTU requirement > 3. a software upgrade forcing the DF bit to be set (developer won't > change it) > > Lowering the MTU on the client end fixed the problem; > however, I need to > get the registry hack distributed across ~500 desktop and all > potentially have different interface descriptions in the > HKLM/system/current control set/service/ ...what a PITA. > > > -- The information contained in this e-mail message is intended only for the use of the person or entity to whom it is addressed and may contain information that is CONFIDENTIAL and may be exempt from disclosure under applicable laws. If you read this message and are not the addressee you are notified that use, dissemination, distribution, or reproduction of this message is prohibited. If you have received this message in error, please notify us immediately and delete the original message. You should scan this message and any attached files for viruses. Axon Computertime accepts no liability for any loss caused either directly or indirectly by a virus arising from the use of this message or any attached file. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Domainz falling prey to spambots?
by Simon Byrnand 28 Jul '02

28 Jul '02

Hi Everyone, I've just noticed a disturbing trend in the last few days. I've started receiving considerable spam to an address (which is actually just an alias) which we *only* use as the technical contact address when registering new domains with domainz. (I won't say what it is in this forum, least I make life easy for any spambots that havn't found it yet :) Email is *never* sent from this address, it is *not* on any of our web pages or used in way except to be listed as technical contact. (In case anyone just looked up our own domain, that is not the contact address in question, we've only been using it for registrations in the last couple of months) This poses the question - just how have the spambots got hold of it ? Maybe they got lucky, and guessed it, but I don't think so. That leaves the domainz website, and whois servers. For a spambot to be able to find contact details of a domain, it would have to know the domain existed in the first place, as to my knowledge domainz don't provide a "list" of domains they have in their registry for exactly this sort of reason. And yet only a few months ago there was the case of the disreputable Australian registry that somehow managed to get a list of a large number of .co.nz's and their contact details, presumably through some kind of automated queries. I'm curious if anyone else has received spam to an address they know for certain is only used as contact details on domains registered at domainz... Regards, Simon Byrnand iGRIN Internet - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Banking Problems and MTU
by Craig Whitmore 28 Jul '02

28 Jul '02

I was wondering what people think about this latest story.. http://www.idg.net.nz/webhome.nsf/UNID/4AA2988B4A1835C5CC256BFF0014A6A8!ope… (a more technical expanation from Cisco of the problem http://www.cisco.com/warp/public/105/56.html) I've noticed this problem for ages (for example the ASB's site) when viewing their pages via a GRE tunnel (or the inability to). Is blocking _all_ ICMP types the wrong thing to do? (in paticular type 3 (unreacable), subtype 4(needs fragmentation) for PMTU Discovery) and basiclly breaking their website for people who have paths who get fragmented TCP/IP Packets) Thanks Craig Whitmore

11 15