- NZNOG - lists.nznog.org

Open NTP servers in New Zealand.
by Dean Pemberton 26 Feb '14

26 Feb '14

Hi All, One of the sessions this morning was from Geoff Huston on the recent NTP server DDoS attacks. The presentation is here https://conference.apnic.net/data/37/2014-02-25-ntpddos_1392941955.pdf In short if you appear on the http://openntpproject.org/ list then you should be looking to clean this up before you contribute to global DDoS attacks the size of which we have not seen in the past. I've run the WIX and APE peering ASNs against the page and here are the number of open NTP servers. You can do this yourself by substituting your AS (instead of 9483) into the following URL http://openntpproject.org/searchby-asn.cgi?search_asn=9483 If you want it as a csv then use http://openntpproject.org/searchby-asn.cgi?search_asn=9483&csv=1 Here is the WIX & APE list. Bear in mind that this only covers the NTP servers which are in the AS that peers on the exchange. Not the customers of that AS. You should use the page above to check all your customer ASNs as well and work with them to patch any servers. WIX Open NTP servers 4823 total 709 AS4770 618 AS2687 603 AS9503 368 AS23838 304 AS23655 272 AS17746 256 AS18119 205 AS24183 187 AS45280 187 AS24466 158 AS18400 122 AS10022 118 AS18015 117 AS55454 91 AS9872 73 AS132040 63 AS24324 58 AS38477 53 AS18353 51 AS45177 39 AS17412 27 AS17435 25 AS42 23 AS9433 19 AS17705 17 AS24347 12 AS23905 10 AS8674 8 AS9834 4 AS24074 4 AS24005 4 AS17649 4 AS17484 3 AS38329 3 AS132003 3 AS12076 2 AS24006 1 AS7696 1 AS18021 1 AS17792 APE Open NTP servers 11877 total 2472 AS4739 1773 AS9889 1236 AS9738 709 AS4770 618 AS2687 603 AS9503 460 AS4826 368 AS23838 304 AS23655 285 AS45459 272 AS17746 256 AS18119 229 AS38333 205 AS24183 187 AS45280 187 AS24466 185 AS24130 158 AS18400 125 AS9790 125 AS9245 122 AS10022 118 AS18015 97 AS56030 91 AS9872 73 AS132040 63 AS24324 58 AS38477 53 AS18353 51 AS45177 44 AS58666 39 AS17412 37 AS55561 27 AS17435 26 AS9303 25 AS42 23 AS9898 23 AS9433 19 AS55752 19 AS17705 17 AS9431 16 AS18199 10 AS24398 10 AS23710 8 AS9834 7 AS17492 6 AS55785 5 AS9559 5 AS55872 4 AS24074 4 AS24005 4 AS17649 3 AS45946 3 AS12076 2 AS9897 2 AS9896 2 AS37974 1 AS38451 1 AS132347 1 AS132304 1 AS10200

12 13

IPAM software
by Glen Eustace 25 Feb '14

25 Feb '14

A year or maybe two back, Andy presented a demo of some software that CityLink were using that if I recall did both the IPAM And inventory function. I think it was an open source system from a US university but I can't remember what it was called. If you can can you let me know. Thanks. Glen.

6 10

Work Practices of Cyber Security Professionals
by Muhammad Adnan 24 Feb '14

24 Feb '14

Dear Sir/Madam, I am a university researcher who is investigating the development of new, usable tools that will improve the work practices of cyber security professionals. As a first step to achieve this goal, I am undertaking a survey to gain an in-depth understanding of the day-to-day activities of cyber security professionals. The targeted participants for this survey are those who perform security related activities as a part of their job (e.g. security analysts, network administrators, systems administrators, etc.). I would be very grateful if you could spare some time and complete this short (approx. 10-15 minutes) survey for me. It can be accessed at the following link: http://edu.surveygizmo.com/s3/1536165/Work-Practices-of-Cyber-Security-Prof… If you have questions or concerns about this research, please contact me ( Muhammad.Adnan(a)gcu.ac.uk) or my Ph.D. supervisor Dr. Mike Just ( Mike.Just(a)gcu.ac.uk), both at the Interactive and Trustworthy Technologies research group (http://www.ittgroup.org/), Glasgow Caledonian University, UK. Kind regards, Adnan

1 0

NZNOG 2014 Videos
by Richard Naylor 18 Feb '14

18 Feb '14

http://www.r2.co.nz/20140130/ The videos from NZNOG 2014 should be available about now. The CDN/cache is filling at the moment. If a file plays poorly, it could still be loading, so be patient. HD files also require a decent CPU to play. All talks except the Lightning talks are in both SD and HD. There is about 28GB of video. The lightning talks are numbered sequentially. I can add names and topics if a kind person sends me those details. Thanks for waiting patiently, there was a lot to get through while we were doing other jobs. rich

2 1

Those RPKI stats
by Michael Fincham 18 Feb '14

18 Feb '14

Hi all, Firstly, thanks NZNOG folks for a great conference. In spite of getting sick and missing ~ 50% I'd still have to say I enjoyed myself :) It's been long enough now that we've probably all forgotten that I'd promised to pony up some more "interesting" RPKI stats at NZNOG, so just to keep you on your toes here they are. ---> First order of business: Did we really hijack the Internet? <--- Sadly no, we just broke BGPMON. It's a long story. ---> RPKI data for the IXes, "domestic transit" <--- I've published a fixed slide deck + some other potentially useful info on my personal website at: <http://hotplate.co.nz/archive/nznog/2014/rpki/> The website includes a link to a web based "relying party cache query tool" I've put together, for anyone interested in having a play with validating some "real world" route data. This tool is also available directly at <http://rpki-validator.lab.hotplate.co.nz/>. In short, the totals for the IXes look like this: APE: 64 invalid, 165 valid, 5474 unvalidated routes out of 3694 unique prefixes WIX: 48 invalid, 92 valid, 1875 unvalidated routes out of 1190 unique prefixes CHIX: 8 invalid, 48 valid, 769 unvalidated routes out of 728 unique prefixes A detailed breakdown of what's valid / invalid and "why" is available from the web page above, along with the raw data so these results can be replicated if desired. Does my data look dodgy or suspect? Is my methodology bogus? Probably! Please do let me know :) -- Michael Fincham

1 0

Interesting Adwords Advert..
by Craig Whitmore 18 Feb '14

18 Feb '14

I just noticed this today.. http://finch.am/scratch/dnc_discontent.png (This is what the advert looks like) It was an adwords advert I presume targeted towards NZers. Which links to.. http://dnc.org.nz/2ld-policy-amendments?gclid=CIzyxuPd1rwCFcEnpQodmFUAOQ Does anyone know who is paying for these adverts . As far as I know the new 2LD domain policy won¹t result in people loosing their .co.nz domain names. (Is this ³false² advertising?) Thanks Craig

2 3

LICA Boundaries
by Liam Farr 18 Feb '14

18 Feb '14

Hi, Does anyone out there know of or have an accurate definition of all the NZ LICA boundaries they could point me to or provide off list? Or otherwise be able to point me at the correct person to ask, Chorus / NAD / MBIE perhaps? I am trying to produce some sort of useful graphical tool, (e.g. google maps overlay) to assist a customer, where they can punch in an address and get the correct LICA displayed for that address. (I also have a stockpile of spare liquor if that helps :D). -- Kind Regards Liam Farr liamfarr(a)me.com +64-22-610-7884

3 2

Re: [nznog] LICA Boundaries
by Peter Lambrechtsen 18 Feb '14

18 Feb '14

Or the mapping folks from Chrous... I have some maps but don't think I will be allowed to share them :/ Sent from my phone on the smartphonetwork. -------- Original message -------- From: Peter Gent <Peter.Gent(a)mbie.govt.nz> Date: 19/02/2014 8:19 AM (GMT+12:00) To: NZNOG(a)list.waikato.ac.nz Subject: Re: [nznog] LICA Boundaries Hi, Have you tried contacting the people behind www.nad.ord.nz<http://www.nad.ord.nz> to start with? Regards Peter -----Original Message----- From: nznog-bounces(a)list.waikato.ac.nz [mailto:nznog-bounces(a)list.waikato.ac.nz] On Behalf Of Liam Farr Sent: Tuesday, 18 February 2014 11:32 p.m. To: Nznog List Subject: [nznog] LICA Boundaries Hi, Does anyone out there know of or have an accurate definition of all the NZ LICA boundaries they could point me to or provide off list? Or otherwise be able to point me at the correct person to ask, Chorus / NAD / MBIE perhaps? I am trying to produce some sort of useful graphical tool, (e.g. google maps overlay) to assist a customer, where they can punch in an address and get the correct LICA displayed for that address. (I also have a stockpile of spare liquor if that helps :D). -- Kind Regards Liam Farr liamfarr(a)me.com +64-22-610-7884 _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog http://newzealand.govt.nz/ - connecting you to New Zealand central & local government services Any opinions expressed in this message are not necessarily those of the Ministry of Business, Innovation and Employment. This message and any files transmitted with it are confidential and solely for the use of the intended recipient. If you are not the intended recipient or the person responsible for delivery to the intended recipient, be advised that you have received this message in error and that any use is strictly prohibited. Please contact the sender and delete the message and any attachment from your computer. _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Apologies
by Ray Taylor 17 Feb '14

17 Feb '14

I must apologise to the group. I have been a long time subscriber but don't post. Mailing list technology is a bit before my time so I was not exactly sure how I was to keep replies within the same thread / branch on the list archive. I was assuming if I forward to the list, it would place it in the correct thread much like a support ticketing system based on subject. Of course I was forwarding a few emails one after the other with responses and didn't see the particular email was sent to me off list. I shall go and find a how-to wiki on this mailing list stuff next time I need to post. With regards to my issue, I have our IP block / ASN advertised on our behalf by our upstream provider as we don't peer using BGP. The NOC at vocus replied to me and said somewhere along the chain there is an issue and they were most helpful in passing a message to whoever is responsible. As predicted by those who responded to my query, they were very fast in their response. Jonathan Brewer has quite rightly reminded me this is one of the woes of tier 7 bandwidth..something I should look at changing. Anyhow, thanks for the help Ray Taylor Taylor Communications ray(a)ruralkiwi.com Ph 021-483-280 Network status 06-929-9082 Description: header_logo

2 1

Re: [nznog] Vocus Contact
by Ray Taylor 17 Feb '14

17 Feb '14

I think it was more a BGP issue with our upstream's upstream. So hoping it isn't a vocus issue and something closer to us. Ray Taylor Taylor Communications <mailto:ray(a)ruralkiwi.com> ray(a)ruralkiwi.com Ph 021-483-280 Network status 06-929-9082 Description: header_logo From: Liam Farr [mailto:liamfarr(a)me.com] Sent: Tuesday, 18 February 2014 8:29 p.m. To: Ray Taylor Subject: Re: [nznog] Vocus Contact Craig Spiers is the most cluefull console wielding guy at Vocus, if there is a real problem with their BGP routing there's a good chance it will eventually make its way to him. He's also not a dick :) Craig Spiers <craig.spiers(a)vocus.co.nz> -- Kind Regards Liam Farr liamfarr(a)me.com +64-22-610-7884 On 18/02/2014, at 5:02 pm, Ray Taylor <ray(a)ruralkiwi.com> wrote: Have we someone here within Vocus? I have an issue with our ip range not being routed correctly through vocus' network. Thanks. Ray Taylor Taylor Communications <mailto:ray(a)ruralkiwi.com> ray(a)ruralkiwi.com Ph 021-483-280 Network status 06-929-9082 <image001.png> _______________________________________________ NZNOG mailing list <mailto:NZNOG(a)list.waikato.ac.nz> NZNOG(a)list.waikato.ac.nz <http://list.waikato.ac.nz/mailman/listinfo/nznog> http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0