- NZNOG - lists.nznog.org

Filming a server room
by Ross Ozarka 11 Nov '14

11 Nov '14

Hello members of NZNOG, My name is Ross Ozarka. I'm a filmmaker who is making a documentary about wire. I'm collecting shots of wires put to different uses, and I'd love to show off the wiring of a server room. The shoot will take about ten minutes, and whoever lets me film their server room will receive an Associate Producer credit. Takers, please get in touch with me at ross.ozarka(a)gmail.com so we can set up a day that works best for you. Warm Regards, Ross Ozarka

1 0

UFB 1 gig plans for retail and impact they have
by Barry Murphy 08 Nov '14

08 Nov '14

Hey guys, I just wondered what people thought of the implications around 1gbps residential / business plans now becoming more and more common. I¹m seeing requests from wholesalers and retail asking about this gigatown thing and how they can get a 1Gbps service, especially unlimited. While I know 1gbps is not too common yet, the 200mbps plan is becoming more and more common and it won¹t be long before there is pressure to do 1gbps I know the unlimited part is easy to justify to the client around Œinternational & domestic¹ transit pricing, but some ask why can we not do user to user or peering traffic at 1gbps. I¹m not sure if it¹s still true, but I recall from the Chorus documentation that you could LAG a maximum of 8x10g circuits in a handover region and that was the max, so theoretically 80gbps handover. For the sake of ease and because 10Gbps holes are not cheap in high end routers like ALU 7750 SR-7¹s which we run, we will consider the average provider has a single 10g or maybe 2 per region right now. If you had say 10 or 20 users on the 1Gbps plan or even 100-200 users on the 200mbps plan and they had misconfigured routers (consider they could do 200mbps upload) opening them up to the likes of DNS amplifications etc. Now those users are maxing out the upload capacity of the handover, you have no ability to QoS the malicious users as the QoS would need to come before hitting the handover, I.e. On the CPE. Suddenly everyone on the handover is impacted from a handful of users that wanted the faster speed just because it was available and affordable. The only way to stop the attack affecting everyone would be to isolate and disconnect the end users causing the damage, be it IPOE or PPPoE, if the user was on a direct /30 IP then things are even harder to manage. The DNS amplifications that hurt Spark for a whole weekend, I can only assume was caused by such a large amount of affected devices filling up the handovers and also because it was targeted at their DNS. Imagine an attack of that magnitude, 10s of thousands of end users on 200 or even 100mbps circuits filling up a 10gig or even at this point a 80gbps handover LAG. When you talk about regional handovers up and down the country then the problem gets worse as you then obviously need to backhaul that capacity to Auckland before getting out to the internet, so this also has to be considered too. Any thoughts on the matter. Many thanks Kind regards, Barry Murphy / Chief Operating Officer +64 27 490 9712 / barry(a)vibecommunications.co.nz <http://www.vibecommunications.co.nz/> <https://www.facebook.com/VibeCom> <https://twitter.com/vibecomnz> <https://www.linkedin.com/company/1941512> Office: +64 9 222 0000 / Fax: 0800 842 326 Unit A7, 1 Beresford Square, Auckland, New Zealand Web: www.vibecommunications.co.nz <http://www.vibecommunications.co.nz/> / Peering: AS45177 <http://www.peeringdb.com/view.php?asn=45177> This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002.

19 36

Network Operators Around the World Demonstrate Their Commitment to a Secure and Resilient Internet
by Dean Pemberton 06 Nov '14

06 Nov '14

This Interesting release via ISOC kinda fits in with the recent conversation around how to protect the Internet from edge originating ause. Any comment from New Zealand Network Operators (thats all of you!) as to whether you see a benefit in this initiative? Anyone want to publically add their name to the list of operators who "have taken one or several of the expected actions defined by the MANRS framework." Interested in peoples thoughts on this. ---------- Mutually Agreed Norms for Routing Security (MANRS) recommendations provide a coordinated approach to improve global routing system [Washington, D.C., USA and Geneva, Switzerland] - 6 November 2014 - Leading network operators around the world today announced that they have implemented a package of recommended measures that help improve the security and resilience of the global Internet. Working together, network operators have developed a tightly defined set of concrete actions to improve the global Internet routing system. The recommendations, called Mutually Agreed Norms for Routing Security (MANRS), recognize the interdependent nature of the global routing system and integrate best current practices related to routing security and resilience. More network operators from across the globe are encouraged to sign onto the movement and participate by visiting the website at www.manrs.org <http://www.manrs.org> and completing the signup form. Organized by the Internet Society, and building on the demonstrated success of coordinated industry activities such as World IPv6 Day and World IPv6 Launch, MANRS represents a significant step forward towards building a more resilient and secure Internet infrastructure. "The security of the Internet as a network of networks often relies on specific collaborative action. This initiative increases the security of the Internet by improving resiliency and stability of the underlying routing infrastructure," commented Olaf Kolkman, the Internet Society's Chief Internet Technology Officer. "Participating network operators committed to the MANRS initiative are taking actions that address problems with incorrect routing information and spoofed traffic, demonstrating their collective responsibility to a healthy and secure Internet ecosystem. We encourage and look forward to other network operators around the world publicly taking these steps." Participating network operators have taken one or several of the expected actions defined by the MANRS framework. These include preventing propagation of incorrect routing information, preventing traffic with spoofed IP addresses, and facilitating global operational communication and coordination between network operators. Committed network operators are: ● CERNET ● Claranet ● Comcast ● KPN ● Level 3 ● NTT ● RUNNet ● SpaceNet ● SURFnet Several of the participating network operators commented on their actions and today's announcement: "Adherence to MANRS is an important commitment that operators make back to the Internet community. Together we aim to remove the havens from which miscreants maintain the freedom and anonymity to attack our network and our customers." - David Freedman, Claranet Group "Comcast is committed to helping drive improvements to the reliability of the Internet ecosystem. We are thrilled to be engaged with other infrastructure participants across the spectrum and around the globe in pursuit of these goals." - Jason Livingood, Vice President, Internet Services, Comcast "Good network routing practice is the fundamental requirement for trust between providers, and ultimately creates a safer and stronger Internet for customers. KPN is committed to providing secure and trustworthy communications, and by joining partners in MANRS, we continue to improve security and resiliency for all." - Jaya Baloo, Chief Information Security Officer, KPN "As one of the most connected Internet providers in the world, security of the Internet is top-of-mind at Level 3 Communications. We are dedicated to supporting and protecting the Internet ecosystem and work each day to safeguard customers' critical communications. The Internet is a shared responsibility, and only through these important collaborative efforts can we continue to ensure the protection of this collective infrastructure." - Dale Drew, Senior Vice President, Chief Security Officer at Level 3 Communications "SURFnet is a big supporter of these initiatives to make the Internet more secure. Committing to the actions as outlined in the MANRS document will make routing on the Internet safer. This impacts every day usage of the Internet and helps with a free, open, and more secure Internet for all users." - Erik Huizer, CTO, SURFnet For more information about MANRS and the Routing Resilience Manifesto visit: http://www.manrs.org <http://www.manrs.org>

3 2

AKL-IX Launching Soon
by Joe Wooller 06 Nov '14

06 Nov '14

Hey All, It looks like NZ is the place to be! I am proud to announce that we have launched a new Internet Exchange in Auckland NZ, AKL-IX! We have just put a place holder page up with some information at http://www.akl-ix.nz <http://www.akl-ix.nz/> IX Australia are the only independent Internet Exchange operator in Australasia, with 16 years experience running exchanges throughout the region. Unlike all other Internet Exchanges in the region, we are not for profit, and seek to serve our members, not our shareholders. We're already very far down the path of bringing some very interesting content providers and large NSPs online. We seek further participants who wish to take part during our start-up phase of operation. During the start-up phase no charges will apply to participants. We are in the process of connecting a number of peers currently. Peers will need to be present at 220 Queen St as this is our first live site. Interested parties can contact peering(a)akl-ix.nz to learn how to take part. For a list of participants will be available on the above website and on PeeringDB (http://bit.ly/1vRAvgZ <http://bit.ly/1vRAvgZ>) If you have any questions please feel free to contact me. Regards Joe

2 2

Who's looking at peering on the new Intellipath / Megaport IX service?
by Jesse Archer 06 Nov '14

06 Nov '14

I see www.Intellipath.co.nz just launched. Anyone else looking at coming on-board? http://www.reseller.co.nz/article/558524/megaport-partners-vibe-break-down-… We've ordered a port at MDR and will VxC to a couple of other networks we do a lot of traffic to. The Megaport IX service in Auckland looks like a credible alternative to Citylink's APE - depends on who comes on-board. I'd be happy if Callplus & Mediaworks on-boarded. *Jesse Archer* *General Manager*Full Flavour *p. *07 929 7111 *ddi*. 07 281 1391 *s*. Skype username "myfullflavour" *e*. jesse(a)fullflavour.co.nz <jesse(a)fullflavourmedia.co.nz> *w*. fullflavour.co.nz <http://t.signauxsept.com/e1t/c/5/f18dQhb0S7lC8dDMPbW2n0x6l2B9nMJW7t5XZs2zqj…> *a. *Tauranga Business Centre, 50 Devonport Road, Tauranga *a*. PO Box 16306, Bethlehem 3176, New Zealand

4 3

Chorus UBA price changes for 1st December 2014
by Barry Murphy 05 Nov '14

05 Nov '14

Hey guys, What are other telcos opinions on the proposed chorus price changes that are to take effect on 1st December 2014? Reduction of naked services and increased of clothed services on UBA, yet none of the pricing is 'confirmed' and nor is the POTS reduction pricing. How can the commerce commission or Telecommunications minister allow for something so big to happen so close to a brown out date and with such short notice. It's now the 6th of November and with the proposed changes happening in about 24 days surely it's against their T&C's to give such short notice. We have been provided with 'draft' but that is just not good enough to give to downstream customers and wholesalers, questions we ask go unanswered meaning we can't advise customers of pricing before its out of draft. We had a meeting booked in with Chorus 'Billing resource' to explain the changes, yet this has just been cancelled because things are not yet confirmed internally. My account manager just called me while I was typing this email and said "they still haven't confirmed things internally as they don't know how they are to implement things into their systems". He also advises we are the first customer in the queue to have a billing resource meting to discuss the changes. I then proceeded to ask about the pricing of ADSL install +-$270 vs VDSL install +-$170 and he is even unsure. Just wondering how well or badly other Telcos in the same position are taking this. Cheers Kind regards, Barry Murphy / Chief Operating Officer +64 27 490 9712 / barry(a)vibecommunications.co.nz<mailto:barry(a)vibecommunications.co.nz> [3sparks llc]<http://www.vibecommunications.co.nz/> [Vibe Communications] <https://www.facebook.com/VibeCom> [Vibe Communications] <https://twitter.com/vibecomnz> [Vibe Communications] <https://www.linkedin.com/company/1941512> Office: +64 9 222 0000 / Fax: 0800 842 326 Unit A7, 1 Beresford Square, Auckland, New Zealand Web: www.vibecommunications.co.nz<http://www.vibecommunications.co.nz/> / Peering: AS45177<http://www.peeringdb.com/view.php?asn=45177> This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002.

3 3

Re: [nznog] UFB 1 gig plans for retail and impact they have
by Mark Foster 04 Nov '14

04 Nov '14

Blocking outbound port 25 blocks the vast majority of non authenticated smtp. The remainder being authenticated (or channelled via the same service provider, who can trace you by your IP, dynamic or not), provides some accountability and makes spam much easier to trace... acknowledging that much spam comes from compromised machines on residential grade connectivity (on port 25). Blocking port 25 outbound (with an opt out option) makes sense if you can't quickly deal with offenders on your network (as often seems to be the case with big players). This doesnt the provide those players with an excuse to under-resource abuse@ (as the remaining spam is finding another way out) but this does seem to happen regardless... so its not even close to a silver bullet but it does helo more than hinder. Mark. Sent from a mobile device. -------- Original message -------- From: Steve Holdoway <steve(a)greengecko.co.nz> Date:05/11/2014 14:56 (GMT+12:00) To: Peter Lambrechtsen <Peter.Lambrechtsen(a)spark.co.nz> Cc: nznog <nznog(a)list.waikato.ac.nz> Subject: Re: [nznog] UFB 1 gig plans for retail and impact they have On Wed, 2014-11-05 at 14:14 +1300, Peter Lambrechtsen wrote: > Have to say that blocking inbound port 25 and 53 is highly recommended > for all RSPs. Plus blocking outbound port 25 to only SMTP servers you > run if you wanted a sense of if customers are using their connections > for mass spamming. With an opt out of course. Given that mail servers also listen on 587 ( thanks billg ) and 465, isn't blocking just 25/tcp just a bit pointless? Steve -- Steve Holdoway BSc(Hons) MIITP http://www.greengecko.co.nz Linkedin: http://www.linkedin.com/in/steveholdoway Skype: sholdowa _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

3 2

Re: [nznog] An 'end to end' Internet (was Re: UFB 1 gig plans for retail and impact they have)
by Scott Weeks 03 Nov '14

03 Nov '14

--- mcdonald.richards(a)gmail.com wrote: From: McDonald Richards <mcdonald.richards(a)gmail.com> I should point out that I mean it purely as an "any service to any service from any host to any host" type of scenario :) Maybe I should have phrased it as the days of unfiltered and unfettered provision of default residential services is coming to an end. ------------------------------------------ I hope not. That'd be the beginning of the slow death of the internet innovation we have seen over the past couple of decades. We will be the new dinosaur. Maybe the homenet WG in IETF will come up with something. <crossing fingers> scott > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog > > _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Re: [nznog] UFB 1 gig plans for retail and impact they have
by Scott Weeks 03 Nov '14

03 Nov '14

--- ben(a)meh.net.nz wrote: From: Ben <ben(a)meh.net.nz> My biggest concern ATM over DDOS, is when IPV6 starts becoming widely used - a lot of people use NAT as a firewall, and when they implement IPV6 don't protect their hosts properly. --------------------------------------------- Homenet in the IETF is attempting to address that among other things in the home networks: https://datatracker.ietf.org/wg/homenet/charter <quote> End-to-end communication is both an opportunity and a concern as it enables new applications but also exposes nodes in the internal networks to receipt of unwanted traffic from the Internet. Firewalls that restrict incoming connections may be used to prevent exposure, however, this reduces the efficacy of end-to-end connectivity that IPv6 has the potential to restore. Home networks need to provide the tools to handle these situations in a manner accessible to all users of home networks. Manual configuration is rarely, if at all, possible, as the necessary skills and in some cases even suitable management interfaces are missing. The purpose of this working group is to focus on this evolution, in particular as it addresses the introduction of IPv6, by developing an architecture addressing this full scope of requirements: o prefix configuration for routers o managing routing o name resolution o service discovery o network security </quote> scott _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

2 1

Re: [nznog] CloudFlare Peering Blog
by McDonald Richards 02 Nov '14

02 Nov '14

Mobile in Australia is an oligarchy. Since the collapse of ISPone there seems to be an active effort being put in by the 3 mobile carriers (Telstra, Optus, VHA) to protect their margins and make it as difficult as possible for MVNOs to start up. Prepaid plans should not be that expensive - I have had worse experiences in Germany. Your home Internet is a different story. The caps exist to support the limited resource. Unlimited has been tried and is always abused. The wholesale access charges within Australia require ISP's set limits or it's the same as everyone leaving their taps running and lights on. Cloudflare's experience with Australian bandwidth pricing will be related to the costs charged by the tier 1 carriers (Optus, Telstra and AAPT [note: AAPT may have started peering; I am a little out of the game there now]). They will be seeking direct access to eyeballs and being charged for the privilege, much the same as the issues Netflix is facing with eyeball carriers in the USA. On the cost front, the underlying delivery cost for some of these networks is higher, as they try to keep consistent pricing across all regions of Australia. People in small towns pay the same prices as people in the largest cities. The country is big and the population density is low. Contrast that to Europe, and carriers there have a much easier time making money. Despite all of this, negotiating peering (paid or otherwise) in Europe with their incumbent carriers is just as difficult and costly as in Australia :) - unless you are Cloudflare-size and have hit that critical mass of outbound content that makes you attractive to these incumbents. Macca On Mon, Nov 3, 2014 at 8:04 PM, Petri Ojala <petri.ojala(a)gmail.com> wrote: > > We spend our winter in Sydney. While not directly related to the carrier > bandwidth costs, my mobile charges will triple and broadband internet cost > will be seven fold. > > In addition to the increased costs the services will be slower and I’m > getting data caps, which I don’t have in Europe. The offerings are > crippled by mandatory landlines, 24-month contracts and various other > requirements and fees. While one can get Telstra Cable without a minimum > contract, it comes with a mandatory landline that has penalties if > terminated too early. I won’t even go into details about the customer > experience getting the broadband.. > > I think it tells a story if CloudFare pays the same amount for Australia > as they do for all of Europe. I was actually thinking about buying Telstra > stock simply because it’s de-facto monopoly in the country and not much > light at the other end of the tunnel. > > Petri > > On 3 November 2014 at 10:14:21, McDonald Richards ( > mcdonald.richards(a)gmail.com) wrote: > > Keep in mind that this refers to "Benchmark pricing" with $10 being the > benchmark for the USA. > > Do your own math and draw conclusions from that extrapolation :) > > Macca > > On Mon, Nov 3, 2014 at 7:47 AM, Dean Pemberton <nznog(a)deanpemberton.com> > wrote: > >> Interesting article from CloudFlare... >> >> >> http://blog.cloudflare.com/the-relative-cost-of-bandwidth-around-the-world/ >> >> While NZ isn't mentioned I'm picking we get lumped in with Australia >> for which they have this to say... >> >> "Australia >> >> Australia is the most expensive region in which we operate, but for an >> interesting reason. We peer with virtually every ISP in the region >> except one: Telstra. Telstra, which controls approximately 50% of the >> market, and was traditionally the monopoly telecom provider, charges >> some of the highest transit pricing in the world — 20x the benchmark >> ($200/Mbps). Given that we are able to peer approximately half of our >> traffic, the effective bandwidth benchmark price is $100/Mbps. >> >> To give you some sense of how out-of-whack Australia is, at CloudFlare >> we pay about as much every month for bandwidth to serve all of Europe >> as we do to for Australia. That’s in spite of the fact that >> approximately 33x the number of people live in Europe (750 million) >> versus Australia (22 million). >> >> If Australians wonder why Internet and many other services are more >> expensive in their country than anywhere else in the world they need >> only look to Telstra. What's interesting is that Telstra maintains >> their high pricing even if only delivering traffic inside the country. >> Given that Australia is one large land mass with relatively >> concentrated population centers, it's difficult to justify the pricing >> based on anything other than Telstra's market power. In regions like >> North America where there is increasing consolidation of networks, >> Australia's experience with Telstra provides a cautionary tale." >> _______________________________________________ >> NZNOG mailing list >> NZNOG(a)list.waikato.ac.nz >> http://list.waikato.ac.nz/mailman/listinfo/nznog >> > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog > >

2 2