July 2018 - NLNOG - mailman3.nlnog.net

weet iemand wie deze amateurs zijn?
by Sabri Berisha 01 Feb '21

01 Feb '21

Hi, Elke 30 seconden proberen ze het opnieuw: Jan 1 07:50:14 mail postfix/smtpd[1243]: NOQUEUE: filter: RCPT from unknown[185.103.159.70]: <vsaveliev(a)openprovider.ru>: Sender address triggers FILTER smtp-amavis:[127.0.0.1]:10024; from=<vsaveliev(a)openprovider.ru> to=<null(a)null.nl> proto=ESMTP helo=<mail-dev101-01.openprovider.nl> Jan 1 07:50:14 mail postfix/smtpd[1243]: NOQUEUE: reject: RCPT from unknown[185.103.159.70]: 554 5.7.1 <null(a)null.nl>: from=<vsaveliev(a)openprovider.ru> to=<null(a)null.nl> proto=ESMTP helo=<mail-dev101-01.openprovider.nl> root@mail:/var/log# host 185.103.159.70 70.159.103.185.in-addr.arpa domain name pointer hosted.by.pcextreme. <--- lekker profi PTR. role: PCextreme - Global NOC address: PCextreme B.V. address: Gyroscoopweg 134 En was dat hele openprovider.nl niet van Beefje? Thanks, Sabri Jr Network Amateur

2 2

NLNOG Day 2018 Fellowship
by Job Snijders 31 Jul '18

31 Jul '18

Dear all, On September 7th we're hosting the annual NLNOG Day - a gathering in Amsterdam for network- and system enthusiasts. We've got an excellent set of speakers that make it worth your while to drop by and participate All info can be found here: https://nlnog.net/nlnog-day-2018/ NLNOG RING Fellowship --------------------- This year we'd like to make it possible for someone based outside the Netherlands (who normally wouldn't be able to attend the NLNOG Day), to come over and participate. The NLNOG Foundation will cover travel costs & lodging. In return, we ask that you give a presentation about a problem scenario where the NLNOG RING was critical in helping analyse or identify some kind of problem. The talk will be recorded. The goal of the talk is to inspire other operators on novel uses of the NLNOG RING, or to join the RING! If this sounds cool to you, please reach out to stichting(a)nlnog.net and we'll discuss the problem scenario & presentation and other logistical aspects. The board will review all applications select one candidate. Kind regards, Job NLNOG Foundation

1 0

RIPE77 in Amsterdam!
by Nathalie Trenaman 31 Jul '18

31 Jul '18

Hoi allemaal, In oktober is er weer een RIPE meeting in Amsterdam en het zou leuk zijn een flinke delegatie NLNOGers daar te zien. Hieronder staat de mail die Martina (onze event organiser) heeft rondgestuurd. Cheers, Nathalie ------ Dear colleagues, You can now register for the RIPE 77 Meeting at: https://ripe77.ripe.net/attend/register/ <https://ripe77.ripe.net/attend/register/> RIPE 77 will take place at the Hotel Okura in Amsterdam from 15-19 October 2018. ------------- Ticket Options ------------- Week ticket: EUR 350 Day ticket: EUR 125 Student (week) ticket: EUR 50 You can find more information about ticket options at: https://ripe77.ripe.net/attend/ <https://ripe77.ripe.net/attend/> ------------- Call for Presentations ------------- The RIPE Programme Committee (PC) is now seeking content proposals from the RIPE community for the plenary sessions, BoFs (Birds of a Feather sessions), workshops, tutorials and lightning talks at RIPE 77. Proposals must be submitted for full consideration no later than 27 August. More information at: https://ripe77.ripe.net/cfp/ <https://ripe77.ripe.net/cfp/> ------------- RIPE Fellowship ------------- If you are in the RIPE NCC service region and need financial assistance to attend RIPE 77, please consider applying for a RIPE Fellowship. We will cover travel, accommodation and a full-week meeting ticket. Apply before 29 August at: https://www.ripe.net/participate/ripe/ripe-fellowship <https://www.ripe.net/participate/ripe/ripe-fellowship> ------------- RACI ------------- The RIPE Academic Cooperation Initiative (RACI) will cover the cost of the meeting ticket, travel and accommodation for successful applicants to present their research at RIPE 77. Apply before 12 August at: https://www.ripe.net/raci/ <https://www.ripe.net/raci/> ---------------- Quantum Internet Hackathon ---------------- The next RIPE NCC Hackathon will be held the weekend before the RIPE 77 meeting in Amsterdam (13-14 October). You can already apply at: https://www.ripe.net/participate/forms/apply/quantum-internet-hackathon/ <https://www.ripe.net/participate/forms/apply/quantum-internet-hackathon/> ------------- Discounted Room Rates ------------- The Hotel Okura and other hotels nearby are offering RIPE 77 attendees a discounted room rate, which is subject to availability. Reserve now to avoid disappointment at: https://ripe77.ripe.net/venue/accommodation/ <https://ripe77.ripe.net/venue/accommodation/> ------------- On-site Childcare ------------- We're making it easier for parents to fully participate in the RIPE Meeting by offering professional, on-site childcare at the meeting venue for children aged 6 months to 10 years. Space is limited, so be sure to register soon to confirm your child's place. For more information and to register, see: http://ripe77.ripe.net/on-site/on-site-childcare/ <http://ripe77.ripe.net/on-site/on-site-childcare/> ---------------- RIPE Networking App ---------------- We are pleased to announce that the RIPE Networking App is available to use for RIPE 77. It's a simple way to schedule meetings with other attendees who are using the app. You’ll need a RIPE NCC Access account to use the app. To learn more, please visit: https://ripe77.ripe.net/on-site/ripe-networking-app/ <https://ripe77.ripe.net/on-site/ripe-networking-app/> ---------------- Important Dates and Deadlines ---------------- RACI: 12 August RIPE 77 CfP: 27 August RIPE Fellowship: 29 August Quantum Internet Hackathon: 13-14 October RIPE 77: 15-19 October Discounted hotel rooms: First come, first served – limited rooms available On-site childcare: First come, first served – limited places available More information on RIPE 77 can be found at: https://ripe77.ripe.net/ <https://ripe77.ripe.net/> Follow us on Twitter: @ripemeeting, #RIPE77 See you in Amsterdam in October! Kind regards, RIPE Meetings Organisation Team

4 3

FW: NTT now treats RPKI ROAs as IRR route(6)-objects
by Job Snijders 20 Jul '18

20 Jul '18

FYI ----- Forwarded message from Job Snijders <job(a)ntt.net> ----- Date: Thu, 19 Jul 2018 21:08:12 +0000 From: Job Snijders <job(a)ntt.net> To: routing-wg(a)ripe.net Subject: NTT now treats RPKI ROAs as IRR route(6)-objects Dear RIPE Routing-WG, [ TL:DR - From now on, NTT / AS 2914 allows customers to either register their announcements in the IRR, or as RPKI ROAs. This is a convenience service for relevant regions of the world where IRR is not the norm but RPKI is commonly available. Previously NTT only accepted IRR and ARIN-WHOIS. I hope competitors and partners will use this approach too! ] As most of you know, the Resource Public Key Infrastructure (RPKI) is a modern reimagination of the good ole' IRR system we have come to love and hate. The main advantage of the RPKI is that a consumer of the data can cryptographically verify whether it was the actual owner of the IP prefix that created a so-called "RPKI ROA". (more reading: https://en.wikipedia.org/wiki/Resource_Public_Key_Infrastructure) Given that RPKI ROAs are somewhat equivalent to IRR route-objects, but more reliable in terms of authoritativeness, NTT now has an automated nightly process that converts RPKI information into IRR format so that our toolchain can consume the data as if it were just another IRR source. Using RPKI ROAs as if they are IRR route(6)-objects is a transitional step towards increased security in the routing ecosystem. We are not the first to explore this method (see post-scriptum), but I think we are the first to republish elements from RPKI ROAs via a publicly accessible IRRd instance queryable with the RADB IRRd protocol. This means that anyone that points their bgpq3 or peval programs at rr.ntt.net can leverage this method without having to update anything else in the pipeline. An example can be inspected here: job@eng0 ~$ whois -h rr.ntt.net 193.0.6.139 [Querying rr.ntt.net] [rr.ntt.net] route: 193.0.0.0/21 descr: RIPE-NCC origin: AS3333 mnt-by: RIPE-NCC-MNT changed: unread(a)ripe.net 20000101 source: RIPE remarks: **************************** remarks: * THIS OBJECT IS MODIFIED remarks: * Please note that all data that is generally regarded as personal remarks: * data has been removed from this object. remarks: * To view the original object, please query the RIPE Database at: remarks: * http://www.ripe.net/whois remarks: **************************** route: 193.0.0.0/21 descr: RPKI ROA for 193.0.0.0/21 remarks: This route object represents routing data retrieved from the RPKI remarks: The original data can be found here: https://rpki.gin.ntt.net/r/AS3333/193.0.0.0/21 remarks: This route object is the result of an automated RPKI-to-IRR conversion process. remarks: maxLength 21 origin: AS3333 mnt-by: MAINT-JOB changed: job(a)ntt.net 20180718 source: RPKI # Trust Anchor: RIPE NCC RPKI Root job@eng0 ~$ The first object is an actual IRR "route:" object from the RIPE NCC operated IRR, the second object is a representation of the RPKI ROA in RPSL format published via rr.ntt.net. In general we can state that RPKI data is very good quality data, however please keep in mind that it may not be /correct/ data. In this context "Good Quality" means that it cannot easily be forged or tampered with by adversaries (but of course that doesn't protect the legitimate owner against making misconfigurations). Just like with IRR route(6)-objects, owners may input the wrong origin ASN in this type of object or configure the wrong MaxLength. NTT operates a "RPKI Cache Validator" at https://rpki.gin.ntt.net/ Everyone is free to inspect and click around in this webinterface. Instead of https://rpki.gin.ntt.net/, there also is a command line interface available via BGPMon's whois service: job@vurt ~$ whois -h whois.bgpmon.com 193.0.0.0/21 % This is the BGPmon.net whois Service % You can use this whois gateway to retrieve information % about an IP adress or prefix % We support both IPv4 and IPv6 address. % % For more information visit: % https://portal.bgpmon.net/bgpmonapi.php Prefix: 193.0.0.0/21 Prefix description: RIPE-NCC Country code: NL Origin AS: 3333 Origin AS Name: Reseaux IP Europeens Network Coordination Centre (RIPE NCC) RPKI status: ROA validation successful First seen: 2011-10-19 Last seen: 2018-07-19 Seen by #peers: 77 Notice in the above output the "ROA validation successful". Nota bene: the fact that NTT uses RPKI ROA information in the prefix filter generation process - does _not_ mean that NTT does "RPKI Origin Validation" for BGP updates (yet). RPKI Origin Validation is an additional security layer that we hope to deploy in the not too distant future. Using RPKI ROAs in this way is an important step forward in this process. Kind regards, Job Snijders Post scriptum on prior work: Dragon Research Labs implemented the idea in 2015: https://github.com/dragonresearch/rpki.net/blob/master/potpourri/roa-to-irr… RIPE NCC's RPKI Validator added RPSL export functionality in 2015: https://mailman.nanog.org/pipermail/nanog/2015-May/075185.html Arouteserver added native support for this method in October 2017. https://github.com/pierky/arouteserver/issues/19 ----- End forwarded message -----

2 2

deploying RPKI based Origin Validation
by Job Snijders 19 Jul '18

19 Jul '18

Volgens mij gaat Nederland wereldleider routing security worden! Hoe/waar zijn jullie met implementaties van RPKI Origin Validation? Hebben mensen hulp nodig? Groeten, Job ----- Forwarded message from Job Snijders <job(a)ntt.net> ----- Date: Thu, 12 Jul 2018 17:50:29 +0000 From: Job Snijders <job(a)ntt.net> To: nanog(a)nanog.org Subject: deploying RPKI based Origin Validation Hi all, I wanted to share with you that a ton of activity is taking place in the Dutch networker community to deploy RPKI based BGP Origin Validation. The mantra is "invalid == reject" on all EBGP sessions. What's of note here is that we're now seeing the first commercial ISPs doing Origin Validation. This is a significant step forward compared to what we observed so far (it seemed OV was mostly limited to academic institutions & toy networks). But six months ago Amsio (https://www.amsio.com/en/) made the jump, and today Fusix deployed (https://fusix.nl/deploying-rpki/) We've also seen an uptake of Origin Validation at Internet Exchange route servers: AMS-IX and FranceIX have already deployed. I've read that RPKI OV is under consideration at a number of other exchanges. Other cool news is that Cloudflare launched a Certificate Transparency initiative to help keep everyone honest. Announcement at: https://twitter.com/grittygrease/status/1017224762542587907 Certificate Transparency is a fascinating tool, really a necessity to build confidence in any PKI systems. Anyone here working to deploy RPKI based Origin Validation in their network and reject invalid announcements? Anything of note to share? Kind regards, Job ----- End forwarded message -----

5 8

Implementation plan and dates for NWI5 - Out-of-region ROUTE(6) objects and removal of ASN authorisation for ROUTE(6) object creation.
by Nathalie Trenaman 19 Jul '18

19 Jul '18

Dear colleagues, In February 2018, the RIPE Database Working Group reached consensus on NWI-5 - creating out of region ROUTE(6) objects in the RIPE Database. We will soon be making changes to the way out-of-region objects are handled in the RIPE Database. It's important that database users are aware of these changes and what they mean: 1. The RIPE Routing Registry will no longer support the creation of out-of-region ROUTE(6) and AUT-NUM objects 2. Existing out-of-region objects will have their "source:” attribute changed to "RIPE-NONAUTH” 3. The creation of ROUTE(6) objects will no longer need authorisation from the ASN holder We will implement these changes in the Release Candidate environment on Thursday, 2 August and go to full production on Tuesday, 4 September. Our implementation plan can be found at: https://www.ripe.net/manage-ips-and-asns/db/impact-analysis-for-nwi-5-imple… <https://www.ripe.net/manage-ips-and-asns/db/impact-analysis-for-nwi-5-imple…> The RIPE Database Working Group chairs also wrote a RIPE Labs article that describes the background of NWI-5: https://labs.ripe.net/Members/denis/out-of-region-route-6-and-aut-num-objec… <https://labs.ripe.net/Members/denis/out-of-region-route-6-and-aut-num-objec…> <https://labs.ripe.net/Members/denis/out-of-region-route-6-and-aut-num-objec… <https://labs.ripe.net/Members/denis/out-of-region-route-6-and-aut-num-objec…>> Please contact ripe-dbm(a)ripe.net <mailto:ripe-dbm@ripe.net> if you still have questions after reading the implementation plan. Best regards, Nathalie Trenaman Product Manager RIPE NCC

1 0

Looking for Netflix contact
by Mark Schouten 16 Jul '18

16 Jul '18

Hi, Netflix decided that AS197731 is using a proxy and blocking all views. I'm looking for someone within Netflix that understands that 'contacting my ISP' is not a solution. Does anybody know anyone within Netflix? Please reply off-list, since this is a public mailing list! We wouldn't want internal Netflix contacts on the internets. -- Kerio Operator in de Cloud? https://www.kerioindecloud.nl/ Mark Schouten | Tuxis Internet Engineering KvK: 61527076 | http://www.tuxis.nl/ T: 0318 200208 | info(a)tuxis.nl

3 2

Spoofer Report for_NLNOG for Jun 2018
by CAIDA Spoofer Project 08 Jul '18

08 Jul '18

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within nld. Inferred improvements during Jun 2018: ASN Name Fixed-By 25459 NEDZONE 2018-06-20 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Jun 2018: ASN Name First-Spoofed Last-Spoofed 12222 AKAMAI 2018-02-14 2018-06-12 203201 IT-SUPERNAP 2018-06-13 2018-06-13 205406 Hostio 2018-06-21 2018-06-21 28878 SIGNET 2018-06-27 2018-06-27 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=nld&no_block=1 Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0