June 2019 - NLNOG - mailman3.nlnog.net

weet iemand wie deze amateurs zijn?
by Sabri Berisha 01 Feb '21

01 Feb '21

Hi, Elke 30 seconden proberen ze het opnieuw: Jan 1 07:50:14 mail postfix/smtpd[1243]: NOQUEUE: filter: RCPT from unknown[185.103.159.70]: <vsaveliev(a)openprovider.ru>: Sender address triggers FILTER smtp-amavis:[127.0.0.1]:10024; from=<vsaveliev(a)openprovider.ru> to=<null(a)null.nl> proto=ESMTP helo=<mail-dev101-01.openprovider.nl> Jan 1 07:50:14 mail postfix/smtpd[1243]: NOQUEUE: reject: RCPT from unknown[185.103.159.70]: 554 5.7.1 <null(a)null.nl>: from=<vsaveliev(a)openprovider.ru> to=<null(a)null.nl> proto=ESMTP helo=<mail-dev101-01.openprovider.nl> root@mail:/var/log# host 185.103.159.70 70.159.103.185.in-addr.arpa domain name pointer hosted.by.pcextreme. <--- lekker profi PTR. role: PCextreme - Global NOC address: PCextreme B.V. address: Gyroscoopweg 134 En was dat hele openprovider.nl niet van Beefje? Thanks, Sabri Jr Network Amateur

2 2

bgp filter guide bogon prefixes 192.88.99.0/24
by Lannert, Julian 25 Jun '19

25 Jun '19

Hi All, First I wanted to thank you for the great bgp filter guide you provide. It is awesome to see crucial information collected and published openly for everyone. I am in the process of implementing more and better filters and while looking over the bogon prefixes v4 I stumbled upon the prefix 192.88.99.0/24 . You cite rfc7562 as a reference for adding this prefix to the bogon list and therefore not accepting this prefix but as far as I can see this the rfc clearly states "Networks SHOULD NOT filter out packets whose source address is 192.88.99.1" . If I do not accept a route to 192.88.99.0/24 I effectively blackhole that network to my customers and block returning packets to 192.88.99.1 from my and my customers networks. I checked other bogon lists that I could find, like team-cymru or kees (https://github.com/coloclue/kees/blob/e353ca9a06bca19147dcc6f607290cfd59303…) who do not include 192.88.99.0/24 in their bogon prefix list. Can you tell me the reasoning behind the decision to include this prefix in your bogon list? Best Regards Julian Julian Lannert Network Engineer e-shelter services GmbH Eschborner Landstraße 100 60489 Frankfurt am Main T: +49 69 7801-2422 F: +49 69 7801-2139 julian.lannert(a)e-shelter.com www.e-shelter.com Geschäftsführer: Ingmar Dilßner Volker Ludwig Rupprecht Rittweger Florian Winkler Sitz der Gesellschaft: Hattersheim am Main Amtsgericht Frankfurt am Main HRB 77478 Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail ist nicht gestattet. This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden.

3 3

NLNOG Expert session & BBQ SOLD OUT!
by Nathalie Trenaman 18 Jun '19

18 Jun '19

Hi all, The weather forecast looks bright & sunny, the experts are booked and the BBQ reached max capacity with 50 people! We’re all looking forward to see you, but in the case you already know you can’t make it, please let us know or cancel your ticket. This way, we can allow people who are late to sign up still to join :) Thanks, Nathalie Trenaman NLNOG Crew

1 0

Reminder: NLNOG Expertsessions & BBQ
by Nathalie Trenaman 15 Jun '19

15 Jun '19

Hoi all, In minder dan een week (!) is het zover: De NLNOG Expertsessions & BBQ! Je hebt nog een paar dagen om je in te schrijven voor de Expertsessions en/of de BBQ: https://www.eventbrite.nl/e/nlnog-expert-sessions-bbq-2019-registration-606… <https://www.eventbrite.nl/e/nlnog-expert-sessions-bbq-2019-registration-606…> Nog even: Wil je een sessie boeken met een expert (https://nlnog.net/experts-2019/ <https://nlnog.net/experts-2019/>) boeken, doe dat dan vandaag nog. Er zijn nog maar een paar plekjes over! Je kan een sessie van 50 minuten aanvragen, maar dat is *uitsluitend* bedoeld voor de expertise van de expert om jou verder te helpen, beschrijf dus goed hoe je die 50 minuten wil benutten. Sales pitches, bijpraat sessies en kennismaken kan bij de BBQ (behalve die sales pitches! Verboden!) Of course, English is fine as well!. This event will be mixed Dutch/English We will start the BBQ at 17:30/18:00 and the weather looks promising. In case you have any dietary restrictions, don’t forget to let us know. See you on Friday! Groetjes, The NLNOG Crew

1 0

Spoofer Report for NLNOG for May 2019
by CAIDA Spoofer Project 08 Jun '19

08 Jun '19

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within nld. Inferred improvements during May 2019: ASN Name Fixed-By 58329 RACKPLACE 2019-05-07 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during May 2019: ASN Name First-Spoofed Last-Spoofed 12222 AKAMAI 2018-02-14 2019-05-23 28878 SIGNET 2018-06-27 2019-05-27 47886 EQUINIX-NL-ASN 2018-08-09 2019-05-24 16243 VIRTU 2018-08-09 2019-05-24 8737 PT 2019-01-16 2019-05-05 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=nld&no_block=1 Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0