- NZNOG - lists.nznog.org

What's the BCP/RFC that says that routers within an ISP network should not have RFC1918 link IPs?
by Matt Grant 27 Feb '14

27 Feb '14

Hi! Know I am some small fry on the list, but your help would be appreciated. This would be useful in talking to my ISP about some PMTU issues that I am having re a VPN going over PPPoE, with MTU 1480. Thanks! Matt Grant

11 11

[OT] {Humour} NCSC.govt.nz traceroute
by Alexander Neilson 26 Feb '14

26 Feb '14

The trusted guardian of NZ Information Assets. So where do they host this important guardian of our assets, of course they would host it here in Wellington wouldn’t they, maybe a backup in Auckland Serenity:~ alexander$ traceroute ncsc.govt.nz traceroute to ncsc.govt.nz (199.83.134.194), 64 hops max, 52 byte packets 1 172.31.2.1 (172.31.2.1) 0.548 ms 0.215 ms 0.191 ms 2 192.168.1.1 (192.168.1.1) 0.324 ms 0.296 ms 0.275 ms 3 113.197.96.18 (113.197.96.18) 4.058 ms 3.873 ms 4.489 ms 4 103.9.216.18 (103.9.216.18) 10.866 ms 10.734 ms 27.593 ms 5 103.9.216.19 (103.9.216.19) 10.699 ms 10.737 ms 10.956 ms 6 203.167.218.185 (203.167.218.185) 13.539 ms 11.339 ms 10.953 ms 7 ge-0-2-0-914.xcore1.acld.telstraclear.net (203.98.42.17) 11.106 ms 11.315 ms 10.950 ms 8 unknown.telstraglobal.net (134.159.174.37) 14.115 ms unknown.telstraglobal.net (134.159.174.41) 13.334 ms unknown.telstraglobal.net (134.159.174.37) 14.271 ms 9 i-0-0-4-1.tlot-core01.bx.telstraglobal.net (202.84.142.106) 136.672 ms i-0-0-4-0.tlot-core01.bx.telstraglobal.net (202.84.142.118) 138.917 ms i-0-6-4-1.tlot-core01.bx.telstraglobal.net (202.84.142.114) 138.757 ms 10 i-0-4-0-0.eqla01.bi.telstraglobal.net (202.84.251.174) 136.206 ms i-0-4-0-7.eqla01.bi.telstraglobal.net (202.40.149.254) 137.496 ms i-0-4-0-0.eqla01.bi.telstraglobal.net (202.84.251.174) 137.301 ms 11 nlayer-peer.eqla01.pr.telstraglobal.net (134.159.61.42) 143.708 ms 136.787 ms 140.136 ms 12 ae0-110g.cr1.lax1.us.nlayer.net (69.31.127.137) 138.668 ms ae0-110g.cr1.lax1.us.nlayer.net (69.31.127.141) 137.965 ms ae0-110g.cr1.lax1.us.nlayer.net (69.31.127.137) 136.064 ms 13 xe-5-3-0.cr1.iah1.us.nlayer.net (69.22.142.121) 167.796 ms 167.996 ms 168.156 ms 14 xe-3-1-1.cr1.dfw1.us.nlayer.net (69.22.142.3) 171.539 ms 194.181 ms 193.122 ms 15 xe-0-2-1.cr1.ord1.us.nlayer.net (69.22.142.4) 190.842 ms 190.634 ms 190.443 ms 16 ae0-60g.cr2.ord1.us.nlayer.net (69.31.111.154) 191.285 ms 190.151 ms 189.922 ms 17 ae2-20g.ar1.ord6.us.nlayer.net (69.31.110.254) 192.570 ms 195.793 ms 195.315 ms 18 * * * 19 * * * 20 * * * 21 * * * mmmmm. that looks like a long trip to Wellington or Auckland Whois that IP: Serenity:~ alexander$ whois 199.83.134.194 # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html # # # Query terms are ambiguous. The query is assumed to be: # "n 199.83.134.194" # # Use "?" to get help. # # # The following results may also be obtained via: # http://whois.arin.net/rest/nets;q=199.83.134.194?showDetails=true&showARIN=… # NetRange: 199.83.128.0 - 199.83.135.255 CIDR: 199.83.128.0/21 OriginAS: AS19551 NetName: INCAPSULA NetHandle: NET-199-83-128-0-1 Parent: NET-199-0-0-0-0 NetType: Direct Assignment RegDate: 2011-01-14 Updated: 2012-02-24 Ref: http://whois.arin.net/rest/net/NET-199-83-128-0-1 OrgName: Incapsula Inc OrgId: INCAP-5 Address: 3500 SOUTH DUPONT HIGHWAY City: Dover StateProv: DE PostalCode: 19901 Country: US RegDate: 2010-09-15 Updated: 2014-02-25 Ref: http://whois.arin.net/rest/org/INCAP-5 OrgAbuseHandle: INCAP1-ARIN OrgAbuseName: Incapsula AbuseDesk OrgAbusePhone: +1-866-250-7659 OrgAbuseEmail: abuse(a)incapsula.com OrgAbuseRef: http://whois.arin.net/rest/poc/INCAP1-ARIN OrgTechHandle: INCAP2-ARIN OrgTechName: Incapsula Operations OrgTechPhone: +1-866-250-7659 OrgTechEmail: ip(a)incapsula.com OrgTechRef: http://whois.arin.net/rest/poc/INCAP2-ARIN OrgNOCHandle: INCAP2-ARIN OrgNOCName: Incapsula Operations OrgNOCPhone: +1-866-250-7659 OrgNOCEmail: ip(a)incapsula.com OrgNOCRef: http://whois.arin.net/rest/poc/INCAP2-ARIN # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html # Serenity:~ alexander$ hmmmm, Delaware, now thats a funny place for it. It doesn’t seem to be any CDN or anything, I wonder if they are just going best price for their hosting, or does this path lead through the 5 Eyes network? Maybe our network lords and masters will be telling us to embed our network systems in foreign countries as part of our new approvals. Regards Alexander Alexander Neilson Neilson Productions Limited alexander(a)neilson.net.nz 021 329 681 022 456 2326

5 10

Open NTP servers in New Zealand.
by Dean Pemberton 26 Feb '14

26 Feb '14

Hi All, One of the sessions this morning was from Geoff Huston on the recent NTP server DDoS attacks. The presentation is here https://conference.apnic.net/data/37/2014-02-25-ntpddos_1392941955.pdf In short if you appear on the http://openntpproject.org/ list then you should be looking to clean this up before you contribute to global DDoS attacks the size of which we have not seen in the past. I've run the WIX and APE peering ASNs against the page and here are the number of open NTP servers. You can do this yourself by substituting your AS (instead of 9483) into the following URL http://openntpproject.org/searchby-asn.cgi?search_asn=9483 If you want it as a csv then use http://openntpproject.org/searchby-asn.cgi?search_asn=9483&csv=1 Here is the WIX & APE list. Bear in mind that this only covers the NTP servers which are in the AS that peers on the exchange. Not the customers of that AS. You should use the page above to check all your customer ASNs as well and work with them to patch any servers. WIX Open NTP servers 4823 total 709 AS4770 618 AS2687 603 AS9503 368 AS23838 304 AS23655 272 AS17746 256 AS18119 205 AS24183 187 AS45280 187 AS24466 158 AS18400 122 AS10022 118 AS18015 117 AS55454 91 AS9872 73 AS132040 63 AS24324 58 AS38477 53 AS18353 51 AS45177 39 AS17412 27 AS17435 25 AS42 23 AS9433 19 AS17705 17 AS24347 12 AS23905 10 AS8674 8 AS9834 4 AS24074 4 AS24005 4 AS17649 4 AS17484 3 AS38329 3 AS132003 3 AS12076 2 AS24006 1 AS7696 1 AS18021 1 AS17792 APE Open NTP servers 11877 total 2472 AS4739 1773 AS9889 1236 AS9738 709 AS4770 618 AS2687 603 AS9503 460 AS4826 368 AS23838 304 AS23655 285 AS45459 272 AS17746 256 AS18119 229 AS38333 205 AS24183 187 AS45280 187 AS24466 185 AS24130 158 AS18400 125 AS9790 125 AS9245 122 AS10022 118 AS18015 97 AS56030 91 AS9872 73 AS132040 63 AS24324 58 AS38477 53 AS18353 51 AS45177 44 AS58666 39 AS17412 37 AS55561 27 AS17435 26 AS9303 25 AS42 23 AS9898 23 AS9433 19 AS55752 19 AS17705 17 AS9431 16 AS18199 10 AS24398 10 AS23710 8 AS9834 7 AS17492 6 AS55785 5 AS9559 5 AS55872 4 AS24074 4 AS24005 4 AS17649 3 AS45946 3 AS12076 2 AS9897 2 AS9896 2 AS37974 1 AS38451 1 AS132347 1 AS132304 1 AS10200

12 13

IPAM software
by Glen Eustace 25 Feb '14

25 Feb '14

A year or maybe two back, Andy presented a demo of some software that CityLink were using that if I recall did both the IPAM And inventory function. I think it was an open source system from a US university but I can't remember what it was called. If you can can you let me know. Thanks. Glen.

6 10

Work Practices of Cyber Security Professionals
by Muhammad Adnan 24 Feb '14

24 Feb '14

Dear Sir/Madam, I am a university researcher who is investigating the development of new, usable tools that will improve the work practices of cyber security professionals. As a first step to achieve this goal, I am undertaking a survey to gain an in-depth understanding of the day-to-day activities of cyber security professionals. The targeted participants for this survey are those who perform security related activities as a part of their job (e.g. security analysts, network administrators, systems administrators, etc.). I would be very grateful if you could spare some time and complete this short (approx. 10-15 minutes) survey for me. It can be accessed at the following link: http://edu.surveygizmo.com/s3/1536165/Work-Practices-of-Cyber-Security-Prof… If you have questions or concerns about this research, please contact me ( Muhammad.Adnan(a)gcu.ac.uk) or my Ph.D. supervisor Dr. Mike Just ( Mike.Just(a)gcu.ac.uk), both at the Interactive and Trustworthy Technologies research group (http://www.ittgroup.org/) Glasgow Caledonian University, UK. Kind regards, Adnan

1 0

NZNOG 2014 Videos
by Richard Naylor 19 Feb '14

19 Feb '14

http://www.r2.co.nz/20140130/ The videos from NZNOG 2014 should be available about now. The CDN/cache is filling at the moment. If a file plays poorly, it could still be loading, so be patient. HD files also require a decent CPU to play. All talks except the Lightning talks are in both SD and HD. There is about 28GB of video. The lightning talks are numbered sequentially. I can add names and topics if a kind person sends me those details. Thanks for waiting patiently, there was a lot to get through while we were doing other jobs. rich

2 1

Those RPKI stats
by Michael Fincham 18 Feb '14

18 Feb '14

Hi all, Firstly, thanks NZNOG folks for a great conference. In spite of getting sick and missing ~ 50% I'd still have to say I enjoyed myself :) It's been long enough now that we've probably all forgotten that I'd promised to pony up some more "interesting" RPKI stats at NZNOG, so just to keep you on your toes here they are. ---> First order of business: Did we really hijack the Internet? <--- Sadly no, we just broke BGPMON. It's a long story. ---> RPKI data for the IXes, "domestic transit" <--- I've published a fixed slide deck + some other potentially useful info on my personal website at: <http://hotplate.co.nz/archive/nznog/2014/rpki/> The website includes a link to a web based "relying party cache query tool" I've put together, for anyone interested in having a play with validating some "real world" route data. This tool is also available directly at <http://rpki-validator.lab.hotplate.co.nz/>. In short, the totals for the IXes look like this: APE: 64 invalid, 165 valid, 5474 unvalidated routes out of 3694 unique prefixes WIX: 48 invalid, 92 valid, 1875 unvalidated routes out of 1190 unique prefixes CHIX: 8 invalid, 48 valid, 769 unvalidated routes out of 728 unique prefixes A detailed breakdown of what's valid / invalid and "why" is available from the web page above, along with the raw data so these results can be replicated if desired. Does my data look dodgy or suspect? Is my methodology bogus? Probably! Please do let me know :) -- Michael Fincham

1 0

Interesting Adwords Advert..
by Craig Whitmore 18 Feb '14

18 Feb '14

I just noticed this today.. http://finch.am/scratch/dnc_discontent.png (This is what the advert looks like) It was an adwords advert I presume targeted towards NZers. Which links to.. http://dnc.org.nz/2ld-policy-amendments?gclid=CIzyxuPd1rwCFcEnpQodmFUAOQ Does anyone know who is paying for these adverts . As far as I know the new 2LD domain policy won¹t result in people loosing their .co.nz domain names. (Is this ³false² advertising?) Thanks Craig

2 3

LICA Boundaries
by Liam Farr 18 Feb '14

18 Feb '14

Hi, Does anyone out there know of or have an accurate definition of all the NZ LICA boundaries they could point me to or provide off list? Or otherwise be able to point me at the correct person to ask, Chorus / NAD / MBIE perhaps? I am trying to produce some sort of useful graphical tool, (e.g. google maps overlay) to assist a customer, where they can punch in an address and get the correct LICA displayed for that address. (I also have a stockpile of spare liquor if that helps :D). -- Kind Regards Liam Farr liamfarr(a)me.com +64-22-610-7884

3 2

Re: [nznog] LICA Boundaries
by Peter Lambrechtsen 18 Feb '14

18 Feb '14

Or the mapping folks from Chrous... I have some maps but don't think I will be allowed to share them :/ Sent from my phone on the smartphonetwork. -------- Original message -------- From: Peter Gent <Peter.Gent(a)mbie.govt.nz> Date: 19/02/2014 8:19 AM (GMT+12:00) To: NZNOG(a)list.waikato.ac.nz Subject: Re: [nznog] LICA Boundaries Hi, Have you tried contacting the people behind www.nad.ord.nz<http://www.nad.ord.nz> to start with? Regards Peter -----Original Message----- From: nznog-bounces(a)list.waikato.ac.nz [mailto:nznog-bounces(a)list.waikato.ac.nz] On Behalf Of Liam Farr Sent: Tuesday, 18 February 2014 11:32 p.m. To: Nznog List Subject: [nznog] LICA Boundaries Hi, Does anyone out there know of or have an accurate definition of all the NZ LICA boundaries they could point me to or provide off list? Or otherwise be able to point me at the correct person to ask, Chorus / NAD / MBIE perhaps? I am trying to produce some sort of useful graphical tool, (e.g. google maps overlay) to assist a customer, where they can punch in an address and get the correct LICA displayed for that address. (I also have a stockpile of spare liquor if that helps :D). -- Kind Regards Liam Farr liamfarr(a)me.com +64-22-610-7884 _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog http://newzealand.govt.nz/ - connecting you to New Zealand central & local government services Any opinions expressed in this message are not necessarily those of the Ministry of Business, Innovation and Employment. This message and any files transmitted with it are confidential and solely for the use of the intended recipient. If you are not the intended recipient or the person responsible for delivery to the intended recipient, be advised that you have received this message in error and that any use is strictly prohibited. Please contact the sender and delete the message and any attachment from your computer. _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0