- NZNOG - lists.nznog.org

Andy Linton in the news as holder of a key to the internet
by Nigel Roberts 02 Mar '14

02 Mar '14

As spotted over here in the fairfax papers: http://www.theage.com.au/it-pro/security-it/meet-andy-linton-one-of-the-few… I think I’d get sick of the key holder (master?) jokes, too. Thanks for your good work Andy. Nigel

1 0

OT: Ethernet
by Richard Naylor 28 Feb '14

28 Feb '14

Been some celebrations recently over ethernet. Going from 10Mbps to 100Gbps over 40 years. http://www.eetimes.com/document.asp?doc_id=1263267&page_number=1 You might find it interesting reading. The call for participation in 400Gbps ethernet was made about a year ago. Interesting points (other than the historical stuff) + 10G NICs will surpass 1G in 2015. Interesting to see fall of 100Mbps. + Graph showing ATM fall off and rise of ethernet in Telco cores. Hilarious from my point of view. The first switch at CityLink was a dual ethernet/ATM one. We never had much of an ATM network because we couldn't afford the second switch ! A shareholder did loan us two, but they were multi-mode fiber and so wasn't much use. No customers wanted ATM due to the cost. None of the telcos took us seriously because we used ethernet. About 6 or 7 years later both Telecom and Clear developed ethernet products. Occasionally we showed people our pole mounted ethernet switches, running PoE, but no one really understood it. James Watts in PNN did and ran some of it. Cheaper fiber replaced it. We also had pole mounted Linux routers that we used for WiF point to point links. Another story.

1 0

IANA AS Numbers registry update
by Selina Harrington 28 Feb '14

28 Feb '14

The IANA AS Numbers registry has been updated to reflect the allocation of 2 blocks to the RIPE NCC in 2014-02-28: 200192-201215 201216-202239 You can find the IANA AS Numbers registry at: http://www.iana.org/assignments/as-numbers/as-numbers.xml Regards, Selina Harrington ******************************************* Internet Assigned Numbers Authority (IANA) Internet Corporation for Assigned Names & Numbers 12025 Waterfront Drive, Suite 300 Los Angeles, CA 90094 Phone: +1 310 301 5800 Fax: +1-310-823-8649 *******************************************

1 0

What's the BCP/RFC that says that routers within an ISP network should not have RFC1918 link IPs?
by Matt Grant 27 Feb '14

27 Feb '14

Hi! Know I am some small fry on the list, but your help would be appreciated. This would be useful in talking to my ISP about some PMTU issues that I am having re a VPN going over PPPoE, with MTU 1480. Thanks! Matt Grant

11 11

[OT] {Humour} NCSC.govt.nz traceroute
by Alexander Neilson 26 Feb '14

26 Feb '14

The trusted guardian of NZ Information Assets. So where do they host this important guardian of our assets, of course they would host it here in Wellington wouldn’t they, maybe a backup in Auckland Serenity:~ alexander$ traceroute ncsc.govt.nz traceroute to ncsc.govt.nz (199.83.134.194), 64 hops max, 52 byte packets 1 172.31.2.1 (172.31.2.1) 0.548 ms 0.215 ms 0.191 ms 2 192.168.1.1 (192.168.1.1) 0.324 ms 0.296 ms 0.275 ms 3 113.197.96.18 (113.197.96.18) 4.058 ms 3.873 ms 4.489 ms 4 103.9.216.18 (103.9.216.18) 10.866 ms 10.734 ms 27.593 ms 5 103.9.216.19 (103.9.216.19) 10.699 ms 10.737 ms 10.956 ms 6 203.167.218.185 (203.167.218.185) 13.539 ms 11.339 ms 10.953 ms 7 ge-0-2-0-914.xcore1.acld.telstraclear.net (203.98.42.17) 11.106 ms 11.315 ms 10.950 ms 8 unknown.telstraglobal.net (134.159.174.37) 14.115 ms unknown.telstraglobal.net (134.159.174.41) 13.334 ms unknown.telstraglobal.net (134.159.174.37) 14.271 ms 9 i-0-0-4-1.tlot-core01.bx.telstraglobal.net (202.84.142.106) 136.672 ms i-0-0-4-0.tlot-core01.bx.telstraglobal.net (202.84.142.118) 138.917 ms i-0-6-4-1.tlot-core01.bx.telstraglobal.net (202.84.142.114) 138.757 ms 10 i-0-4-0-0.eqla01.bi.telstraglobal.net (202.84.251.174) 136.206 ms i-0-4-0-7.eqla01.bi.telstraglobal.net (202.40.149.254) 137.496 ms i-0-4-0-0.eqla01.bi.telstraglobal.net (202.84.251.174) 137.301 ms 11 nlayer-peer.eqla01.pr.telstraglobal.net (134.159.61.42) 143.708 ms 136.787 ms 140.136 ms 12 ae0-110g.cr1.lax1.us.nlayer.net (69.31.127.137) 138.668 ms ae0-110g.cr1.lax1.us.nlayer.net (69.31.127.141) 137.965 ms ae0-110g.cr1.lax1.us.nlayer.net (69.31.127.137) 136.064 ms 13 xe-5-3-0.cr1.iah1.us.nlayer.net (69.22.142.121) 167.796 ms 167.996 ms 168.156 ms 14 xe-3-1-1.cr1.dfw1.us.nlayer.net (69.22.142.3) 171.539 ms 194.181 ms 193.122 ms 15 xe-0-2-1.cr1.ord1.us.nlayer.net (69.22.142.4) 190.842 ms 190.634 ms 190.443 ms 16 ae0-60g.cr2.ord1.us.nlayer.net (69.31.111.154) 191.285 ms 190.151 ms 189.922 ms 17 ae2-20g.ar1.ord6.us.nlayer.net (69.31.110.254) 192.570 ms 195.793 ms 195.315 ms 18 * * * 19 * * * 20 * * * 21 * * * mmmmm. that looks like a long trip to Wellington or Auckland Whois that IP: Serenity:~ alexander$ whois 199.83.134.194 # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html # # # Query terms are ambiguous. The query is assumed to be: # "n 199.83.134.194" # # Use "?" to get help. # # # The following results may also be obtained via: # http://whois.arin.net/rest/nets;q=199.83.134.194?showDetails=true&showARIN=… # NetRange: 199.83.128.0 - 199.83.135.255 CIDR: 199.83.128.0/21 OriginAS: AS19551 NetName: INCAPSULA NetHandle: NET-199-83-128-0-1 Parent: NET-199-0-0-0-0 NetType: Direct Assignment RegDate: 2011-01-14 Updated: 2012-02-24 Ref: http://whois.arin.net/rest/net/NET-199-83-128-0-1 OrgName: Incapsula Inc OrgId: INCAP-5 Address: 3500 SOUTH DUPONT HIGHWAY City: Dover StateProv: DE PostalCode: 19901 Country: US RegDate: 2010-09-15 Updated: 2014-02-25 Ref: http://whois.arin.net/rest/org/INCAP-5 OrgAbuseHandle: INCAP1-ARIN OrgAbuseName: Incapsula AbuseDesk OrgAbusePhone: +1-866-250-7659 OrgAbuseEmail: abuse(a)incapsula.com OrgAbuseRef: http://whois.arin.net/rest/poc/INCAP1-ARIN OrgTechHandle: INCAP2-ARIN OrgTechName: Incapsula Operations OrgTechPhone: +1-866-250-7659 OrgTechEmail: ip(a)incapsula.com OrgTechRef: http://whois.arin.net/rest/poc/INCAP2-ARIN OrgNOCHandle: INCAP2-ARIN OrgNOCName: Incapsula Operations OrgNOCPhone: +1-866-250-7659 OrgNOCEmail: ip(a)incapsula.com OrgNOCRef: http://whois.arin.net/rest/poc/INCAP2-ARIN # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html # Serenity:~ alexander$ hmmmm, Delaware, now thats a funny place for it. It doesn’t seem to be any CDN or anything, I wonder if they are just going best price for their hosting, or does this path lead through the 5 Eyes network? Maybe our network lords and masters will be telling us to embed our network systems in foreign countries as part of our new approvals. Regards Alexander Alexander Neilson Neilson Productions Limited alexander(a)neilson.net.nz 021 329 681 022 456 2326

5 10

Open NTP servers in New Zealand.
by Dean Pemberton 26 Feb '14

26 Feb '14

Hi All, One of the sessions this morning was from Geoff Huston on the recent NTP server DDoS attacks. The presentation is here https://conference.apnic.net/data/37/2014-02-25-ntpddos_1392941955.pdf In short if you appear on the http://openntpproject.org/ list then you should be looking to clean this up before you contribute to global DDoS attacks the size of which we have not seen in the past. I've run the WIX and APE peering ASNs against the page and here are the number of open NTP servers. You can do this yourself by substituting your AS (instead of 9483) into the following URL http://openntpproject.org/searchby-asn.cgi?search_asn=9483 If you want it as a csv then use http://openntpproject.org/searchby-asn.cgi?search_asn=9483&csv=1 Here is the WIX & APE list. Bear in mind that this only covers the NTP servers which are in the AS that peers on the exchange. Not the customers of that AS. You should use the page above to check all your customer ASNs as well and work with them to patch any servers. WIX Open NTP servers 4823 total 709 AS4770 618 AS2687 603 AS9503 368 AS23838 304 AS23655 272 AS17746 256 AS18119 205 AS24183 187 AS45280 187 AS24466 158 AS18400 122 AS10022 118 AS18015 117 AS55454 91 AS9872 73 AS132040 63 AS24324 58 AS38477 53 AS18353 51 AS45177 39 AS17412 27 AS17435 25 AS42 23 AS9433 19 AS17705 17 AS24347 12 AS23905 10 AS8674 8 AS9834 4 AS24074 4 AS24005 4 AS17649 4 AS17484 3 AS38329 3 AS132003 3 AS12076 2 AS24006 1 AS7696 1 AS18021 1 AS17792 APE Open NTP servers 11877 total 2472 AS4739 1773 AS9889 1236 AS9738 709 AS4770 618 AS2687 603 AS9503 460 AS4826 368 AS23838 304 AS23655 285 AS45459 272 AS17746 256 AS18119 229 AS38333 205 AS24183 187 AS45280 187 AS24466 185 AS24130 158 AS18400 125 AS9790 125 AS9245 122 AS10022 118 AS18015 97 AS56030 91 AS9872 73 AS132040 63 AS24324 58 AS38477 53 AS18353 51 AS45177 44 AS58666 39 AS17412 37 AS55561 27 AS17435 26 AS9303 25 AS42 23 AS9898 23 AS9433 19 AS55752 19 AS17705 17 AS9431 16 AS18199 10 AS24398 10 AS23710 8 AS9834 7 AS17492 6 AS55785 5 AS9559 5 AS55872 4 AS24074 4 AS24005 4 AS17649 3 AS45946 3 AS12076 2 AS9897 2 AS9896 2 AS37974 1 AS38451 1 AS132347 1 AS132304 1 AS10200

12 13

IPAM software
by Glen Eustace 25 Feb '14

25 Feb '14

A year or maybe two back, Andy presented a demo of some software that CityLink were using that if I recall did both the IPAM And inventory function. I think it was an open source system from a US university but I can't remember what it was called. If you can can you let me know. Thanks. Glen.

6 10

Work Practices of Cyber Security Professionals
by Muhammad Adnan 24 Feb '14

24 Feb '14

Dear Sir/Madam, I am a university researcher who is investigating the development of new, usable tools that will improve the work practices of cyber security professionals. As a first step to achieve this goal, I am undertaking a survey to gain an in-depth understanding of the day-to-day activities of cyber security professionals. The targeted participants for this survey are those who perform security related activities as a part of their job (e.g. security analysts, network administrators, systems administrators, etc.). I would be very grateful if you could spare some time and complete this short (approx. 10-15 minutes) survey for me. It can be accessed at the following link: http://edu.surveygizmo.com/s3/1536165/Work-Practices-of-Cyber-Security-Prof… If you have questions or concerns about this research, please contact me ( Muhammad.Adnan(a)gcu.ac.uk) or my Ph.D. supervisor Dr. Mike Just ( Mike.Just(a)gcu.ac.uk), both at the Interactive and Trustworthy Technologies research group (http://www.ittgroup.org/) Glasgow Caledonian University, UK. Kind regards, Adnan

1 0

NZNOG 2014 Videos
by Richard Naylor 19 Feb '14

19 Feb '14

http://www.r2.co.nz/20140130/ The videos from NZNOG 2014 should be available about now. The CDN/cache is filling at the moment. If a file plays poorly, it could still be loading, so be patient. HD files also require a decent CPU to play. All talks except the Lightning talks are in both SD and HD. There is about 28GB of video. The lightning talks are numbered sequentially. I can add names and topics if a kind person sends me those details. Thanks for waiting patiently, there was a lot to get through while we were doing other jobs. rich

2 1

Those RPKI stats
by Michael Fincham 18 Feb '14

18 Feb '14

Hi all, Firstly, thanks NZNOG folks for a great conference. In spite of getting sick and missing ~ 50% I'd still have to say I enjoyed myself :) It's been long enough now that we've probably all forgotten that I'd promised to pony up some more "interesting" RPKI stats at NZNOG, so just to keep you on your toes here they are. ---> First order of business: Did we really hijack the Internet? <--- Sadly no, we just broke BGPMON. It's a long story. ---> RPKI data for the IXes, "domestic transit" <--- I've published a fixed slide deck + some other potentially useful info on my personal website at: <http://hotplate.co.nz/archive/nznog/2014/rpki/> The website includes a link to a web based "relying party cache query tool" I've put together, for anyone interested in having a play with validating some "real world" route data. This tool is also available directly at <http://rpki-validator.lab.hotplate.co.nz/>. In short, the totals for the IXes look like this: APE: 64 invalid, 165 valid, 5474 unvalidated routes out of 3694 unique prefixes WIX: 48 invalid, 92 valid, 1875 unvalidated routes out of 1190 unique prefixes CHIX: 8 invalid, 48 valid, 769 unvalidated routes out of 728 unique prefixes A detailed breakdown of what's valid / invalid and "why" is available from the web page above, along with the raw data so these results can be replicated if desired. Does my data look dodgy or suspect? Is my methodology bogus? Probably! Please do let me know :) -- Michael Fincham

1 0