- NZNOG - lists.nznog.org

Google DNS 8.8.8.8/32
by Neil Fenemor 16 Mar '14

16 Mar '14

It seems 8.8.8.8/32 was hijacked yesterday for 22 minutes yesterday, affecting networks in Brazil and Venezuela. https://twitter.com/bgpmon/status/445266642616868864/photo/1 So about that RPKI thing…having a quick look (via whois.bgpmon.net) it seems Google does not have an ROA for 8.8.8.0/24. Yet another reason friends should not let friends use Google’s recursive resolvers. Perhaps their RIR doesn’t make it as easy as APNIC does to create ROA objects. Cheers, -- Neil Fenemor | +64 21 978 078 | Facetime | Skype

4 4

News: US to give up control of Internet administration
by Skeeve Stevens 15 Mar '14

15 Mar '14

Hi all, A very important announcement by NTIA/DoC/ICANN regarding the control of the Internet. This is an article from todays Commsday that very well explains the current situation. ...Skeeve -- *Commsday* - 17th March 2014 - www.commsday.com *US to give up control of Internet administration* The United States government says it will cede the Department of Commerce's legal authority over global Internet governance, but on condition that it approves of the system which replaces it. Late Friday afternoon, the National Telecommunications and Information Administration, under the DoC, said it wanted Internet domain governance to be subject to "multi-stakeholder" oversight and would oppose transition to an inter-governmental administration such as the International Telecommunications Union. Currently the DoC delegates oversight functions to the Internet Corporation for Assigned Names and Numbers which in turn works with various private and sector bodies such as the Internet Engineering Task Force, the Internet Architecture Board, the Internet Society, the Regional Internet Registries, top level domain name operators and VeriSign to administrate the Internet. "The timing is right to start the transition process," said Assistant Secretary of Commerce for Communications and Information Lawrence E. Strickling. "We look forward to ICANN convening stakeholders across the global Internet community to craft an appropriate transition plan." NTIA has communicated to ICANN that the transition proposal must have broad community support and address the following four principles: - Support and enhance the multi-stakeholder model; - Maintain the security, stability, and resiliency of the Internet DNS; - Meet the needs and expectation of the global customers and partners of ICANN's domain administration services; and, - Maintain the openness of the Internet. "Consistent with the clear policy expressed in bipartisan resolutions of the U.S. Senate and House of Representatives (S.Con.Res.50 and H.Con.Res.127), which affirmed the United States support for the multi-stakeholder model of Internet governance, NTIA will not accept a proposal that replaces the NTIA role with a government-led or an inter-governmental organisation solution," it said. AUSTRALIA BACKS US: The decision won the instant backing of Australian communications minister Malcolm Turnbull, who said he had discussed the plans with Strickling last week. Australia has been a steadfast ally of the US's opposition to a role for the ITU in Internet administration. Turnbull said "the Australian Government is absolutely committed to supporting an open Internet which is administered by multi stakeholder organisations like ICANN and NOT by governments whether in the form of consortia or multilateral organisations like the ITU or the UN." "The Internet is the most remarkable invention of our times and while it had its origins in research contracts with the US Government its growth, its dynamism, its resilience have all been the result of collaborative efforts by the wide Internet community not government regulation or fiat." "While it is all too common to complain about the US Government role in the Internet the truth is that the world owes the United States an extraordinary debt not just for giving birth to the Internet, but above all for giving it the freedom to develop into the extraordinary global platform it has become today." "The (ICANN subsidiary) Internet Assigned Numbers Authority contract with the US Department of Commerce expires in September 2015 and today I assured the President of ICANN, Mr Fadi Chehade, that the Australian Government will provide all the support it can to ICANN's efforts to develop a structure of governance that will meet the US Department of Commerce's vitally important conditions of removing itself from the IANA arrangements at the heart of the Internet. DOMESTIC OPPOSITION TO CHANGE: However, the decision did not receive bipartisan support in the United States with Republican politicians and advisers defending the status quo and warning of the consequences of global control of Internet administration. Former House speaker Newt Gingrich said "Every American should worry about Obama giving up control of the internet to an undefined group. This is very, very dangerous. What is the global internet community that Obama wants to turn the internet over to? This risks foreign dictatorships defining the internet." A former State Department adviser under the Bush administration, Christian Whiton, said "US management of the internet has been exemplary and there is no reason to give this away -- especially in return for nothing. This is the Obama equivalent of Carter's decision to give away the Panama Canal -- only with possibly much worse consequences." GROWING PUSH AGAINST US: However, the US move has been interpreted by others as an early strike against what are likely to be persistent efforts to globalise the Internet's administration on terms which may prove unacceptable to the United States and its allies. Following unsuccessful attempts by China, Russia and the Arab bloc to have the ITU assume Internet governance functions in late 2012, there has been renewed pressure to change the status quo following the so-called Snowden revelations last year regarding pervasive US surveillance of foreign powers and individuals using Internet and telecom platforms. Brazil, one of the leading critics of the US, plans its own global Internet multi-stakeholder forum in late April in order to seize the initiative on how a post-US Internet might be shaped. Anti-US governmental members of the ITU are expected to revive their efforts in support of that organisation assuming Internet control when it convenes in South Korea for its plenipotentiary in November. The last ITU vote on these matters saw around 90 countries, led by China, Russia and the Arab world, support new regulations to "nationalise" the Internet and around 55, led by the US and its allies, support the status quo or a "multi-stakeholder" approach akin to the status quo, where specialist private and technical organisations such as ICANN perform management roles. Paul Rosenzweig, who served as a senior homeland security official under former President George W. Bush, opined "the move by the United States to start this transition now is either very canny or panicked. The optimist in me wants to think that the transition to ICANN management is an effort to forestall an even worse result from takeover of network administration by the ITU. It may be that allowing ICANN a controlling role will placate our European allies and prevent the ITU meeting in Busan, South Korea from becoming a debacle." "The pessimist, however, sees this as a reaction to the Snowden disclosures. All of a sudden American stewardship of the network is suspect. Some, hoping to defuse the anger, may have chosen to rush to give up that stewardship, without thinking through the consequences." Malcolm Turnbull also agreed that the US decision opened up a Pandora's box of challenges for those who think the existing system is generally successful. "There is a lot of work to do to support ICANN in transitioning to a new model and the Australian Government, committed as it is to a multi-stakeholder system of governance, will work with the Australian and global Internet community including other governments to ensure that the Internet remains free, stable and resilient and continues to be a powerful platform for freedom around the world," he said Grahame Lynch --- To get access to great articles like this, often before the mainstream media, please subscribe to Commsday - www.commsday.com ...Skeeve *Skeeve Stevens - *eintellego Networks Pty Ltd skeeve(a)eintellegonetworks.co.nz ; www.eintellegonetworks.co.nz Phone: +612 8014 7398; Cell +61 (0)414 753 383 ; skype://skeeve facebook.com/eintellegonetworks ; <http://twitter.com/networkceoau> linkedin.com/in/skeeve twitter.com/theispguy ; blog: www.theispguy.com The Experts Who The Experts Call Juniper - Cisco - Cloud - Consulting - IPv4 Brokering

1 0

Re: [nznog] Andy Linton in the news as holder of a key to the internet
by Dominic Driver 12 Mar '14

12 Mar '14

One key to secure them all... I for one am delighted to know that such an honourable man is one of the few entrusted with such responsibility. On 3 Mar 2014 22:42, Nigel Roberts <nigel(a)nobiscuit.com> wrote: > > As spotted over here in the fairfax papers: > > http://www.theage.com.au/it-pro/security-it/meet-andy-linton-one-of-the-few… > > I think I’d get sick of the key holder (master?) jokes, too. Thanks for your good work Andy. > > Nigel > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog

2 1

Bitstream 3a MAC limits
by Dave Mill 12 Mar '14

12 Mar '14

Hi all I know the answer to my question here is likely hidden deep in a PDF somewhere but someone on this list may know the answer off hand. I see that Bitstream 3a has a 64 MAC limit. What doesn't seem clear to me is if this MAC limit is a customer ONT port MAC limit, or a MAC limit for the entire customer S-VID. I had always assumed it was a limit on MACs that can be sourced from the customer ONT port but am I wrong? Is it a MAC limit on the total number of MACs that can be learnt over the entire customer S-VID (src'ed from either the provider or customer end of the link)? I'm extracting the 64 MAC limit from this document here - http://www.crownfibre.govt.nz/wp-content/uploads/2013/01/Chorus-UFB-Service… Any feedback, especially this afternoon, would be very useful. Provider is UFF. I am not really wanting to debate why someone would want that number of MACs over a BS3 connection and why some layer 3 should probably be involved here.... Cheers Dave

4 4

TVNZ On Demand
by Barry Murphy 12 Mar '14

12 Mar '14

Hey guys, wondering if anyone from TVNZ On Demand is on this list and wouldn't mind contacting me offlist regarding problems streaming if a user has an IPv6 address. The helpdesk doesn't appear to know what ipv6 is so thought I'd try an alternative. Many thanks Barry

2 1

IPv6 redundancy
by Jonathan Spence 10 Mar '14

10 Mar '14

Hi all, I started a thread on the IPv6 group on LinkedIn in regards to this but.... What is the best way to provide redundant connectivity to SMBs with IPv6? Using v4 with NAT is easy with most routers but v6 is harder. Shim6 seems to be a good idea but looks to be a dead duck. People in that thread were advocating full AS and BGP but I don't think that is easy for most SMBs unless their IT support is top notch and trained (which lets face it, most don't even know how to screw in a lightbulb). It also may mess up global routing tables causing them to get much bigger. Any ideas? Jonathan Spence Chief Executive Officer Fixed: +64 9 9510448 Mobile: +64211055634

2 1

Web audio collection
by Richard Hulse 10 Mar '14

10 Mar '14

Radio NZ has an audio collection for the web's birthday: http://www.radionz.co.nz/collections/world-wide-web Featuring Vint Cerf, Tim Berners-Lee and Andy Linton. Add beer as required.

1 0

Turning on DNSSEC validation - you know you want to!
by Andy Linton 10 Mar '14

10 Mar '14

>From this posting: http://www.internetsociety.org/deploy360/blog/2014/01/circleid-dns-security… I like this quote: However, on the recursive resolver side, I am much more of a fan of having the DNS resolution occur as close to the end user as possible. This is particularly true when you enable DNSSEC validation.

1 0

Some discussion starters from APRICOT 37
by Michael Fincham 09 Mar '14

09 Mar '14

Hi all, I recently had the pleasure of attending APRICOT 37 (many thanks to the NZNOG and InternetNZ folks, and others, who made this possible!) and felt that there were some interesting topics discussed that may be worth bringing back to the NZNOG community. Here's an unsorted and terse list of some things I thought worthwhile: -> We need to stop looking at Alexa's "top 100" websites for IPv6 support and being disappointed - we need to be looking at a much smaller proportion of the "top sites" as this is where "all of the traffic" is actually going. Facebook, YouTube, Google, Wikipedia, Akamai and GGC cache nodes. It's a port 80 world and a few sites dominate :) -> Some big providers (T-Mobile, Telstra AU) talked about having rolled out IPv6 in various forms (single stack v6, dual stack with CGNAT on v4 and native v6) to their mobile subscriber base with approximately no support impact. A common theme: "We need to test IPv6 before deploying it!" "What testing did you do with IPv4?" "None" "Well do that with IPv6 too!" -> Paraphrasing: "Customers don't know what IPv4 is to begin with, so they sure don't know or care what IPv6 is." -> These operators reported seeing /40%/ of the traffic on any given subscriber where dual stack was available going straight out to the native v6 Internet! This is a huge win if you're looking at deploying CGNAT as it means approximately half as much state needs to be kept on your expensive CGNAT boxes, and half as much traffic is being molested on the way from the customer to the 'net :) It also means you should definitely be rolling out dual stack alongside your CGNAT :) -> 464XLAT (http://tools.ietf.org/html/rfc6877) looks like it's about to be a big deal in the mobile IPv6 space. In short, 464XLAT allows for phones to run single stack native IPv6 while applications on the phone can continue to access v4 literals etc if required. Makes use of a clever combination of existing technologies. Only Android 4.3+ supports this so far, but more phone support shouldn't be far away. To me this looks like it would be a killer feature to have on fixed line CPEs, though I am unclear how it would interact with the type of NAT these CPEs typically perform (though this ought not be too far away from a tethering scenario on a phone). -> Geoff Huston's closing presentation on the state of BGP in 2013 contained some interesting measurements and insights about how worried we should be able router performance and so on. The video (https://www.youtube.com/watch?feature=player_detailpage&v=e4N9ELoM76M#t=1798) and slides (https://conference.apnic.net/data/37/2014-02-27-bgp2013_1392943641.pdf) are worth a look if you have ~ 20 minutes. Since the NZNOG list has been more alive of late, I'd welcome discussion on any of these points as certainly there is plenty here that is relevant to NZ :) -- Michael Fincham System Administrator, Unleash Office: 0800 750 250

2 2

ICONZ-Webvisions (NZ) to close Open DNS Resolvers
by Mark Foster 05 Mar '14

05 Mar '14

Hi folks ICONZ-Webvisions (the entity formerly known simply as ICONZ in NZ) will be blocking external access to our recursive DNS servers to non-customer subnets on the evening of 6 March 2014. In the knowledge that there may well be former customers or third-parties who have hard-coded the IP's of our DNS servers into their configs (or their customer configs) I'm giving notice now; the following IP's will cease to provide DNS resolution to clients outside of our network space, at that time: 210.48.65.1 210.48.65.2 210.48.66.1 210.48.66.2 Customers with concerns about this change are invited to contact our Customer Care team on 0800 843 638 or via support.nz(a)iconz-webvisions.com<mailto:support.nz(a)iconz-webvisions.com>. Regards Mark. -- Mark Foster Technical Services Manager - Australia & New Zealand [iconz-webvisions-logo-png] www.iconz-webvisions.com<https://webmail.iconz.net/owa/redir.aspx?C=ToykmhkSsEaPr3XJN6nrf-rRV-b9iM8I…> ICONZ-Webvisions, ICONZ House, 60 Airedale Street, Auckland 1010, New Zealand

2 2