- NZNOG - lists.nznog.org

New IXs in NZ - discussion
by Bevan Slattery 17 Nov '14

17 Nov '14

Hi Joe, [snip] IX Australia are the only independent Internet Exchange operator in Australasia, with 16 years experience running exchanges throughout the region. Unlike all other Internet Exchanges in the region, we are not for profit, and seek to serve our members, not our shareholders. We're already very far down the path of bringing some very interesting content providers and large NSPs online. [/snip] Interesting to see IX-Australia following Megaport lead again and it¹s great to see competition. However, a few points regarding your statement above: 1. It is a misrepresentation to say that WAIA/IX-Australia is the only independent provider of IX Services in Australasia 2. Its generally known that IX-Australia provides services to organisations that aren¹t members of WAIA/IX-Australia. which apart from a contravention of its constitution means the statement above isn¹t quite factually correct. Can you confirm WAIA only provide services to registered members under its constitution? I can think of a handful that aren¹t. 3. The constitution of WAIA only provides for WAIA/IX Australia to service Australia, so I¹m not sure whether the announcement is simply a reaction to Megaports announcement, not approved by members/amended in the constitution or part of a plan to expand (not foreshadowed at the recent AGM which would have been the time to amend the constitution?) 4. WAIA is Incorporated in WA which actually only really provides for the delivery of services in Western Australia (there is a pathway to delivering nationally through Incorporation under ASIC), but certainly is not able to provide services outside of Australia. Operation outside of Australia may lead to issues regarding WAIA¹s incorporated status. Despite some persistent rumours that IX-Australia is perhaps being taken advantage of by a particular commercial carrier to hinder Megaports success, I would like to think otherwise, but this reaction to step outside the legal operational jurisdiction makes me think there is merit to same. So ultimately, from a Network Operations perspective it would be helpful to understand whether WAIA as an Incorporated Association in Western Australia is legally able to operate outside of Australia in the first instance though (even if the Constitution allowed it which I don¹t think it does). Your clarification to the list would be helpful. Cheers [b] WAIA 2013 Constitution https://www.waia.asn.au/node/83

3 4

Megaport Auckland
by Denver Maddux 17 Nov '14

17 Nov '14

Hi NZNOGers, First off, I’m new to the NZNOG list, but far from new to NOGs in general. I’ve recently stepped into the CEO role at Megaport and expect to be more actively engaging the community regionally as we expand the business into New Zealand, but I’ve been a long-time active member of NANOG, GPF, EPF, and APF groups. I’ve been trying to catch-up on the NZNOG list via the archives over the past couple of weeks to get some context for the community and I’m really happy to see how active the list has been as of late. Second, I wanted to just drop a note that Megaport is now live in 220 Queen St. As many of you have seen, we are partnered with Vibe in NZ, but users can also sign up directly with Megaport now in The Data Centre. This is for the full index of Megaport services, including IX, as has been heavily discussed on this list recently. We will also be expanding into Datacom Orbit Dr in the next month or so. http://www.megaport.com Feel free to email me direct if you have questions, or flames. :) Denver Maddux CEO Megaport denver.maddux(a)megaport.com<mailto:denver.maddux(a)megaport.com>

2 1

Reminder of NZNOG list AUP
by Simon Lyall 12 Nov '14

12 Nov '14

Just a reminder to everyone that the list AUP includes: 6. Blatant product or service marketing is unacceptable. so please try not to overdo it. The full AUP is here: http://www.nznog.org/mailing-list Simon. NZNOG list co-moderator. -- Simon Lyall | Very Busy | Web: http://www.simonlyall.com/ "To stay awake all night adds a day to your life" - Stilgar

12 13

New IXs in NZ - discussion
by Tim Hoffman 12 Nov '14

12 Nov '14

All, We’ve had some interesting announcements of Megaport and IX Australia building internet exchanges into NZ over the last week or so. I’ve been a bit surprised at how little chatter there has been around this on the list. I thought I’d put some thoughts down (as someone who has worked for a bunch of networks in NZ and is now overseas working for big content) with hope of kicking off a discussion. At a 10,000 foot view, New Zealand has had a reasonably successful operation of IXs over the last 10-15 years. All of y’all except for the two big operators openly peer. This is awesome! However, as has been discussed in other posts recently; 1/ More and more of the internet is becoming about connectivity from CDNs to users. 2/ More and more CDNs are coming to New Zealand and Australia 3/ Trans-tasman capacity isn’t hugely expensive Addressing points (1) and (2), as content comes into New Zealand, we have to remember that on a global scale, New Zealand is absolutely tiny. It’s a hard business case to get a POP there as a content provider. Content providers that do come are likely just going to put in a single location - Auckland. So while WIX may make sense for ISPs in NZ peering with each other, for the bulk of the *interesting* content on the internet that you can get through peering, you’re going to have to get it in Auckland. Networks have outages, planned works, etc. So assuming that most of NZ’s interesting content is in Auckland (with a bit more over the Tasman, which isn’t too expensive to get to these days), it makes sense to have multiple (redundantly built and managed) ways of getting at this content. It’s interesting looking at the differences between the 3 IXs we’re about to have. Citylink, who have the critical mass of all the peers, are in the most locations, and are the most expensive. They’ve also got a product set around metro ethernet, dark fibre, and have a CDN running. And they’re doing some interesting things around a “SDN driven IX”. Megaport, who have placed huge focus on their “Virtual Cross Connect” product and being able to configure this on the fly, but also have run a pretty successful IX. IX Australia, who are very IX focused, and have gone to great pains to ensure that that’s their only product, making them the most “independent”. IX Australia also have public graphs of traffic levels through their IX (i.e. for NSW-iX http://monitor.nsw.ix.asn.au/cacti/graph_image.php?action=view&local_graph_… <http://monitor.nsw.ix.asn.au/cacti/graph_image.php?action=view&local_graph_…>) - which is commendable (it would be nice to see Megaport and Citylink follow suit on this one) I suspect you’re going to find that most of the content will try to get to all 3. It’s my hope that most of the bigger ISPs try to get to all three, then the smaller ones can go to a couple, get most NZ routes reliantly over peering, and then transit the rest if it has to happen. It would be disappointing if we didn’t see the top 5-6 IXs + all the content providers on all of them. Also it’ll be important to ensure that the result isn’t just that we have 3 split IX communities, all with different content/users on them without crossover, as this would cause a huge barrier to entry to smaller players if they have to connect to all 3. For the community, having this competition is going to be a win. It won’t kill APE, which has huge critical mass, and has done a great job in it’s long history, but will ensure that all 3 IXs keep each other honest. What will be interesting to see is who turns up at which IX and how they all grow together. What’s everyone else’s thoughts? It would be interesting particularly if there is anyone from Citylink, or any of the big ISPs, who could comment on their take on these developments in the market and where they will be peering? Cheers, Hoff

16 19

Non Commercial request for Hardware (learning kit)
by Alexander Neilson 11 Nov '14

11 Nov '14

Hey All Sorry if this is rude of me to ask and I apologise if so. Does anyone have old routers / switches / firewalls / spare parts or modules for same lying around that are still function (or slightly broken) that they are looking at flicking on or long term loaning? I am looking for any gear that would help me get greater exposure to other hardware / configurations and that can be used in my home lab. I currently have a single Cisco 2821 that was pulled from production, and a Cisco Catalyse 2900XL plus on long term loan I have two Juniper J2320’s. The 2821 has a very loud dying fan that I would like to replace (flatmates aren’t so understanding about my learning noises) and I would like to get some more experience with Cisco and other manufacturers. I do also have a copy of GNS3 that I will be trying to use more but I have always preferred to grab actual physical hardware and wire it up and play around with configs etc. I am wellington based so hardware locally would be a bonus but if its something exciting to learn I would probably try save up shipping. Also I don’t have massive space so while some hardware would be awesome to experience I will likely decline for space reasons. Thank you all in advance. Apologies for any noise on the list. Off list replies are probably best. Please note for future people seeing this in the archive, if you want to take a look / have a play any of the hardware I receive would be available for learning loan to others. Regards Alexander Alexander Neilson Neilson Productions Limited alexander(a)neilson.net.nz 021 329 681 022 456 2326

2 1

Load balance appliances
by Jodi Thomson 10 Nov '14

10 Nov '14

Hi All Just wondering what people are using these days for dedicated load balance appliances. Last ones I had anything to do with were the Alteon Ace Directors going back 7-8 yrs so am a little out of touch with whats in use today. Cheers Jodi -- Jodi Thomson Systems & Networks Big Noise Group Ltd 501 Heretaunga Street West, Hastings 4122 Cell (021) 903712 Ph: (06) 876 9661 Fax: (06) 876 9668 Skype: jodit1 Web : http://www.bignoisegroup.com

6 8

Filming a server room
by Ross Ozarka 10 Nov '14

10 Nov '14

Hello members of NZNOG, My name is Ross Ozarka. I'm a filmmaker who is making a documentary about wire. I'm collecting shots of wires put to different uses, and I'd love to show off the wiring of a server room. The shoot will take about ten minutes, and whoever lets me film their server room will receive an Associate Producer credit. Takers, please get in touch with me at ross.ozarka(a)gmail.com so we can set up a day that works best for you. Warm Regards, Ross Ozarka

1 0

UFB 1 gig plans for retail and impact they have
by Barry Murphy 08 Nov '14

08 Nov '14

Hey guys, I just wondered what people thought of the implications around 1gbps residential / business plans now becoming more and more common. I¹m seeing requests from wholesalers and retail asking about this gigatown thing and how they can get a 1Gbps service, especially unlimited. While I know 1gbps is not too common yet, the 200mbps plan is becoming more and more common and it won¹t be long before there is pressure to do 1gbps I know the unlimited part is easy to justify to the client around Œinternational & domestic¹ transit pricing, but some ask why can we not do user to user or peering traffic at 1gbps. I¹m not sure if it¹s still true, but I recall from the Chorus documentation that you could LAG a maximum of 8x10g circuits in a handover region and that was the max, so theoretically 80gbps handover. For the sake of ease and because 10Gbps holes are not cheap in high end routers like ALU 7750 SR-7¹s which we run, we will consider the average provider has a single 10g or maybe 2 per region right now. If you had say 10 or 20 users on the 1Gbps plan or even 100-200 users on the 200mbps plan and they had misconfigured routers (consider they could do 200mbps upload) opening them up to the likes of DNS amplifications etc. Now those users are maxing out the upload capacity of the handover, you have no ability to QoS the malicious users as the QoS would need to come before hitting the handover, I.e. On the CPE. Suddenly everyone on the handover is impacted from a handful of users that wanted the faster speed just because it was available and affordable. The only way to stop the attack affecting everyone would be to isolate and disconnect the end users causing the damage, be it IPOE or PPPoE, if the user was on a direct /30 IP then things are even harder to manage. The DNS amplifications that hurt Spark for a whole weekend, I can only assume was caused by such a large amount of affected devices filling up the handovers and also because it was targeted at their DNS. Imagine an attack of that magnitude, 10s of thousands of end users on 200 or even 100mbps circuits filling up a 10gig or even at this point a 80gbps handover LAG. When you talk about regional handovers up and down the country then the problem gets worse as you then obviously need to backhaul that capacity to Auckland before getting out to the internet, so this also has to be considered too. Any thoughts on the matter. Many thanks Kind regards, Barry Murphy / Chief Operating Officer +64 27 490 9712 / barry(a)vibecommunications.co.nz <http://www.vibecommunications.co.nz/> <https://www.facebook.com/VibeCom> <https://twitter.com/vibecomnz> <https://www.linkedin.com/company/1941512> Office: +64 9 222 0000 / Fax: 0800 842 326 Unit A7, 1 Beresford Square, Auckland, New Zealand Web: www.vibecommunications.co.nz <http://www.vibecommunications.co.nz/> / Peering: AS45177 <http://www.peeringdb.com/view.php?asn=45177> This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002.

19 36

Network Operators Around the World Demonstrate Their Commitment to a Secure and Resilient Internet
by Dean Pemberton 06 Nov '14

06 Nov '14

This Interesting release via ISOC kinda fits in with the recent conversation around how to protect the Internet from edge originating ause. Any comment from New Zealand Network Operators (thats all of you!) as to whether you see a benefit in this initiative? Anyone want to publically add their name to the list of operators who "have taken one or several of the expected actions defined by the MANRS framework." Interested in peoples thoughts on this. ---------- Mutually Agreed Norms for Routing Security (MANRS) recommendations provide a coordinated approach to improve global routing system [Washington, D.C., USA and Geneva, Switzerland] - 6 November 2014 - Leading network operators around the world today announced that they have implemented a package of recommended measures that help improve the security and resilience of the global Internet. Working together, network operators have developed a tightly defined set of concrete actions to improve the global Internet routing system. The recommendations, called Mutually Agreed Norms for Routing Security (MANRS), recognize the interdependent nature of the global routing system and integrate best current practices related to routing security and resilience. More network operators from across the globe are encouraged to sign onto the movement and participate by visiting the website at www.manrs.org <http://www.manrs.org> and completing the signup form. Organized by the Internet Society, and building on the demonstrated success of coordinated industry activities such as World IPv6 Day and World IPv6 Launch, MANRS represents a significant step forward towards building a more resilient and secure Internet infrastructure. "The security of the Internet as a network of networks often relies on specific collaborative action. This initiative increases the security of the Internet by improving resiliency and stability of the underlying routing infrastructure," commented Olaf Kolkman, the Internet Society's Chief Internet Technology Officer. "Participating network operators committed to the MANRS initiative are taking actions that address problems with incorrect routing information and spoofed traffic, demonstrating their collective responsibility to a healthy and secure Internet ecosystem. We encourage and look forward to other network operators around the world publicly taking these steps." Participating network operators have taken one or several of the expected actions defined by the MANRS framework. These include preventing propagation of incorrect routing information, preventing traffic with spoofed IP addresses, and facilitating global operational communication and coordination between network operators. Committed network operators are: ● CERNET ● Claranet ● Comcast ● KPN ● Level 3 ● NTT ● RUNNet ● SpaceNet ● SURFnet Several of the participating network operators commented on their actions and today's announcement: "Adherence to MANRS is an important commitment that operators make back to the Internet community. Together we aim to remove the havens from which miscreants maintain the freedom and anonymity to attack our network and our customers." - David Freedman, Claranet Group "Comcast is committed to helping drive improvements to the reliability of the Internet ecosystem. We are thrilled to be engaged with other infrastructure participants across the spectrum and around the globe in pursuit of these goals." - Jason Livingood, Vice President, Internet Services, Comcast "Good network routing practice is the fundamental requirement for trust between providers, and ultimately creates a safer and stronger Internet for customers. KPN is committed to providing secure and trustworthy communications, and by joining partners in MANRS, we continue to improve security and resiliency for all." - Jaya Baloo, Chief Information Security Officer, KPN "As one of the most connected Internet providers in the world, security of the Internet is top-of-mind at Level 3 Communications. We are dedicated to supporting and protecting the Internet ecosystem and work each day to safeguard customers' critical communications. The Internet is a shared responsibility, and only through these important collaborative efforts can we continue to ensure the protection of this collective infrastructure." - Dale Drew, Senior Vice President, Chief Security Officer at Level 3 Communications "SURFnet is a big supporter of these initiatives to make the Internet more secure. Committing to the actions as outlined in the MANRS document will make routing on the Internet safer. This impacts every day usage of the Internet and helps with a free, open, and more secure Internet for all users." - Erik Huizer, CTO, SURFnet For more information about MANRS and the Routing Resilience Manifesto visit: http://www.manrs.org <http://www.manrs.org>

3 2

AKL-IX Launching Soon
by Joe Wooller 06 Nov '14

06 Nov '14

Hey All, It looks like NZ is the place to be! I am proud to announce that we have launched a new Internet Exchange in Auckland NZ, AKL-IX! We have just put a place holder page up with some information at http://www.akl-ix.nz <http://www.akl-ix.nz/> IX Australia are the only independent Internet Exchange operator in Australasia, with 16 years experience running exchanges throughout the region. Unlike all other Internet Exchanges in the region, we are not for profit, and seek to serve our members, not our shareholders. We're already very far down the path of bringing some very interesting content providers and large NSPs online. We seek further participants who wish to take part during our start-up phase of operation. During the start-up phase no charges will apply to participants. We are in the process of connecting a number of peers currently. Peers will need to be present at 220 Queen St as this is our first live site. Interested parties can contact peering(a)akl-ix.nz to learn how to take part. For a list of participants will be available on the above website and on PeeringDB (http://bit.ly/1vRAvgZ <http://bit.ly/1vRAvgZ>) If you have any questions please feel free to contact me. Regards Joe

2 2