- NZNOG - lists.nznog.org

Home Grown RPKI Validators
by Bill Walker 25 Mar '14

25 Mar '14

Hi All, Now I have solved my ROA issue, (Thanks Dean & Michael) I'd like to look at building an RPKI validator, does anyone have any experience with these? Thanks, Bill

1 0

12ish U cabinets in Wellington?
by Michael Fincham 23 Mar '14

23 Mar '14

Hi all, Anyone have a 12ish U cabinet in Wellington they'd like to be rid of? Will swap for beer or small amounts of money. Would prefer one with solid doors on front / back. I can come collect if it it'll fit in a taxi :) -- Michael

1 0

Re: [nznog] NZNOG Digest, Vol 135, Issue 16
by Jonathan Spence 23 Mar '14

23 Mar '14

Remember some ISPs could be at national peering locations e.g. iinet peer ate APE do they not? If its your intention to save on traffic costs the BGP route is probably OK but using a proper service is more desirable overall. Jonathan Spence Chief Executive Officer Fixed: +64 9 9510448 Mobile: +64211055634 ---------------------------------------- From: nznog-request(a)list.waikato.ac.nz Sent: Monday, March 24, 2014 12:00 PM To: nznog(a)list.waikato.ac.nz Subject: NZNOG Digest, Vol 135, Issue 16 Send NZNOG mailing list submissions to nznog(a)list.waikato.ac.nz To subscribe or unsubscribe via the World Wide Web, visit http://list.waikato.ac.nz/mailman/listinfo/nznog or, via email, send a message with subject or body 'help' to nznog-request(a)list.waikato.ac.nz You can reach the person managing the list at nznog-owner(a)list.waikato.ac.nz When replying, please edit your Subject line so it is more specific than "Re: Contents of NZNOG digest..." Today's Topics: 1. List of NZ IP addresses? (Clark Mills) 2. Re: List of NZ IP addresses? (Tony Wicks) 3. Re: List of NZ IP addresses? (Clark Mills) 4. Re: List of NZ IP addresses? (Peter Lambrechtsen) 5. Re: List of NZ IP addresses? (Bill Walker) 6. Re: List of NZ IP addresses? (Damian Kissick) 7. Re: List of NZ IP addresses? (Scott Howard) 8. Re: List of NZ IP addresses? (Rob McDonald) 9. Re: List of NZ IP addresses? (Gareth Davies) 10. Re: List of NZ IP addresses? (Lindsay Hill) 11. Re: List of NZ IP addresses? (Richard Naylor) ---------------------------------------------------------------------- Message: 1 Date: Mon, 24 Mar 2014 08:51:30 +1300 From: Clark Mills <c.mills(a)auckland.ac.nz> To: nznog(a)list.waikato.ac.nz Subject: [nznog] List of NZ IP addresses? Message-ID: <532F3B42.90609(a)auckland.ac.nz> Content-Type: text/plain; charset="utf-8"; Format="flowed" Hi all. I realise that it's a constantly changing list but does anyone have a list on NZ IPs? Why: We're trying to set up a website to be accessible in NZ only. Knowing what I know then firewalling is the tool (a man with a hammer...) but I need to routinely source a more recent list. Any suggestions or hints appreciated. Cheers... Clark

1 0

Re: [nznog] List of NZ IP addresses?
by Richard Naylor 23 Mar '14

23 Mar '14

At 09:50 a.m. 24/03/2014, you wrote: >2 votes for maxmind. (or bgp feed with communities or something from >your ISP) it depends if you are trying to firewall for cost reasons, >eg: I don't want to serve my HD content to international viewers >because it will bankrupt me. Or I don't want to serve my >international content to international viewers because it would >breach a license agreement with the rights holder. The tier-1 CDNs all offer more than enough filtering to do very decent geo-fencing. So its not hard to limit to "NZ-only" or "everywhere but not nz". Sometimes we use that as the second line of defence. Rights agreements often require 2 levels or more.

1 0

List of NZ IP addresses?
by Clark Mills 23 Mar '14

23 Mar '14

Hi all. I realise that it's a constantly changing list but does anyone have a list on NZ IPs? Why: We're trying to set up a website to be accessible in NZ only. Knowing what I know then firewalling is the tool (a man with a hammer...) but I need to routinely source a more recent list. Any suggestions or hints appreciated. Cheers... Clark

9 9

RPKI and ROA
by Bill Walker 19 Mar '14

19 Mar '14

Hi All, Hoping someone can help. I am in the middle of a project to build 4 PoP's in Chicago, London, Sydney and Mumbai. As part of this I have been given the role of creating all the necessary Route objects etc. Our address space is from ARIN, but our ASN's are from RIPE, APNIC & ARIN. I have created as-set, aut-num and route objects in RADb to enable us to manage them from a single point. However I would like to setup ROA records for these route objects. I have setup RPKI with ARIN and created our first ROA object. Onto my question, am I likely to have operational issues if the route objects are in RADb and the ROA with ARIN? TIA, Bill

4 7

CityLink APE route server maintenance
by CityLink Ltd 18 Mar '14

18 Mar '14

On Sunday 23rd March 2014 between 18:00 and 21:00 the CityLink APE route server rs2.ape.nzix.net will be taken offline for building maintenance. Please make sure you also have a session configured with rs1.ape.nzix.netto ensure there is no loss of service. And a reminder that all NZIX customers should be configured with both route servers at each exchange for maximum resiliency. Customers who experience any problems with the service after the maintenance work should contact the CityLink 24 hour support number: Free call: 0800 4 CITYLINK (0800 424 895) Select: Option 3 Advise you have a fault with your CityLink service and include the relevant service reference number.

1 0

Google DNS 8.8.8.8/32
by Neil Fenemor 17 Mar '14

17 Mar '14

It seems 8.8.8.8/32 was hijacked yesterday for 22 minutes yesterday, affecting networks in Brazil and Venezuela. https://twitter.com/bgpmon/status/445266642616868864/photo/1 So about that RPKI thing…having a quick look (via whois.bgpmon.net) it seems Google does not have an ROA for 8.8.8.0/24. Yet another reason friends should not let friends use Google’s recursive resolvers. Perhaps their RIR doesn’t make it as easy as APNIC does to create ROA objects. Cheers, -- Neil Fenemor | +64 21 978 078 | Facetime | Skype

4 4

News: US to give up control of Internet administration
by Skeeve Stevens 16 Mar '14

16 Mar '14

Hi all, A very important announcement by NTIA/DoC/ICANN regarding the control of the Internet. This is an article from todays Commsday that very well explains the current situation. ...Skeeve -- *Commsday* - 17th March 2014 - www.commsday.com *US to give up control of Internet administration* The United States government says it will cede the Department of Commerce's legal authority over global Internet governance, but on condition that it approves of the system which replaces it. Late Friday afternoon, the National Telecommunications and Information Administration, under the DoC, said it wanted Internet domain governance to be subject to "multi-stakeholder" oversight and would oppose transition to an inter-governmental administration such as the International Telecommunications Union. Currently the DoC delegates oversight functions to the Internet Corporation for Assigned Names and Numbers which in turn works with various private and sector bodies such as the Internet Engineering Task Force, the Internet Architecture Board, the Internet Society, the Regional Internet Registries, top level domain name operators and VeriSign to administrate the Internet. "The timing is right to start the transition process," said Assistant Secretary of Commerce for Communications and Information Lawrence E. Strickling. "We look forward to ICANN convening stakeholders across the global Internet community to craft an appropriate transition plan." NTIA has communicated to ICANN that the transition proposal must have broad community support and address the following four principles: - Support and enhance the multi-stakeholder model; - Maintain the security, stability, and resiliency of the Internet DNS; - Meet the needs and expectation of the global customers and partners of ICANN's domain administration services; and, - Maintain the openness of the Internet. "Consistent with the clear policy expressed in bipartisan resolutions of the U.S. Senate and House of Representatives (S.Con.Res.50 and H.Con.Res.127), which affirmed the United States support for the multi-stakeholder model of Internet governance, NTIA will not accept a proposal that replaces the NTIA role with a government-led or an inter-governmental organisation solution," it said. AUSTRALIA BACKS US: The decision won the instant backing of Australian communications minister Malcolm Turnbull, who said he had discussed the plans with Strickling last week. Australia has been a steadfast ally of the US's opposition to a role for the ITU in Internet administration. Turnbull said "the Australian Government is absolutely committed to supporting an open Internet which is administered by multi stakeholder organisations like ICANN and NOT by governments whether in the form of consortia or multilateral organisations like the ITU or the UN." "The Internet is the most remarkable invention of our times and while it had its origins in research contracts with the US Government its growth, its dynamism, its resilience have all been the result of collaborative efforts by the wide Internet community not government regulation or fiat." "While it is all too common to complain about the US Government role in the Internet the truth is that the world owes the United States an extraordinary debt not just for giving birth to the Internet, but above all for giving it the freedom to develop into the extraordinary global platform it has become today." "The (ICANN subsidiary) Internet Assigned Numbers Authority contract with the US Department of Commerce expires in September 2015 and today I assured the President of ICANN, Mr Fadi Chehade, that the Australian Government will provide all the support it can to ICANN's efforts to develop a structure of governance that will meet the US Department of Commerce's vitally important conditions of removing itself from the IANA arrangements at the heart of the Internet. DOMESTIC OPPOSITION TO CHANGE: However, the decision did not receive bipartisan support in the United States with Republican politicians and advisers defending the status quo and warning of the consequences of global control of Internet administration. Former House speaker Newt Gingrich said "Every American should worry about Obama giving up control of the internet to an undefined group. This is very, very dangerous. What is the global internet community that Obama wants to turn the internet over to? This risks foreign dictatorships defining the internet." A former State Department adviser under the Bush administration, Christian Whiton, said "US management of the internet has been exemplary and there is no reason to give this away -- especially in return for nothing. This is the Obama equivalent of Carter's decision to give away the Panama Canal -- only with possibly much worse consequences." GROWING PUSH AGAINST US: However, the US move has been interpreted by others as an early strike against what are likely to be persistent efforts to globalise the Internet's administration on terms which may prove unacceptable to the United States and its allies. Following unsuccessful attempts by China, Russia and the Arab bloc to have the ITU assume Internet governance functions in late 2012, there has been renewed pressure to change the status quo following the so-called Snowden revelations last year regarding pervasive US surveillance of foreign powers and individuals using Internet and telecom platforms. Brazil, one of the leading critics of the US, plans its own global Internet multi-stakeholder forum in late April in order to seize the initiative on how a post-US Internet might be shaped. Anti-US governmental members of the ITU are expected to revive their efforts in support of that organisation assuming Internet control when it convenes in South Korea for its plenipotentiary in November. The last ITU vote on these matters saw around 90 countries, led by China, Russia and the Arab world, support new regulations to "nationalise" the Internet and around 55, led by the US and its allies, support the status quo or a "multi-stakeholder" approach akin to the status quo, where specialist private and technical organisations such as ICANN perform management roles. Paul Rosenzweig, who served as a senior homeland security official under former President George W. Bush, opined "the move by the United States to start this transition now is either very canny or panicked. The optimist in me wants to think that the transition to ICANN management is an effort to forestall an even worse result from takeover of network administration by the ITU. It may be that allowing ICANN a controlling role will placate our European allies and prevent the ITU meeting in Busan, South Korea from becoming a debacle." "The pessimist, however, sees this as a reaction to the Snowden disclosures. All of a sudden American stewardship of the network is suspect. Some, hoping to defuse the anger, may have chosen to rush to give up that stewardship, without thinking through the consequences." Malcolm Turnbull also agreed that the US decision opened up a Pandora's box of challenges for those who think the existing system is generally successful. "There is a lot of work to do to support ICANN in transitioning to a new model and the Australian Government, committed as it is to a multi-stakeholder system of governance, will work with the Australian and global Internet community including other governments to ensure that the Internet remains free, stable and resilient and continues to be a powerful platform for freedom around the world," he said Grahame Lynch --- To get access to great articles like this, often before the mainstream media, please subscribe to Commsday - www.commsday.com ...Skeeve *Skeeve Stevens - *eintellego Networks Pty Ltd skeeve(a)eintellegonetworks.co.nz ; www.eintellegonetworks.co.nz Phone: +612 8014 7398; Cell +61 (0)414 753 383 ; skype://skeeve facebook.com/eintellegonetworks ; <http://twitter.com/networkceoau> linkedin.com/in/skeeve twitter.com/theispguy ; blog: www.theispguy.com The Experts Who The Experts Call Juniper - Cisco - Cloud - Consulting - IPv4 Brokering

1 0

Re: [nznog] Andy Linton in the news as holder of a key to the internet
by Dominic Driver 12 Mar '14

12 Mar '14

One key to secure them all... I for one am delighted to know that such an honourable man is one of the few entrusted with such responsibility. On 3 Mar 2014 22:42, Nigel Roberts <nigel(a)nobiscuit.com> wrote: > > As spotted over here in the fairfax papers: > > http://www.theage.com.au/it-pro/security-it/meet-andy-linton-one-of-the-few… > > I think I’d get sick of the key holder (master?) jokes, too. Thanks for your good work Andy. > > Nigel > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog

2 1