May 2021 - NLNOG - mailman3.nlnog.net

NLNOG at MCH2021
by Nathalie Trenaman 25 Feb '22

25 Feb '22

Hi all, As you might know, the organisers of MCH2021 ( https://mch2021.org/#/ <https://mch2021.org/#/>) have started the ticket sales. Some of us in the board of NLNOG thought it would be cool to have an NLNOG Village there. But we had an NLNOG Camp a few years back and although it was great fun, if was a bit expensive for the amount of people that attended. That’s why we decided to first find out if there is enough interest to move forward with this. We’ve set up a 3 question (30 seconds!) questionnaire on SurveyMonkey: https://nl.surveymonkey.com/r/LT86B8G <https://nl.surveymonkey.com/r/LT86B8G> If you don’t want to click links, you can also reply to the questions in this mail: -Are you considering to attend MCH2021? -Would you join the NLNOG Village? -Would you be interested to help out organising? (build-up, program, bar, etc.) It would help us tremendously if you could take 30 seconds to reply or fill in the survey on SurveyMonkey! (Also if you’re not going to attend MCH2021!) Thanks and happy holidays from all of us! NLNOG Crew

3 2

FW: Input request for system on how to approach abuse filtering on Route Servers - bad hosters
by Erik Bais 18 May '21

18 May '21

Hi, In het licht van de discussie die we recent hadden op IRC mbt hoe we bep. badhosts makkelijk(er) kunnen de-peeren op de internet exchange routeservers, heb ik de onderstaande email gestuurd naar zowel de Anti-Abuse WG als de Connect-WG ( voor IXP’s ) van RIPE. Ik hoop dat we vanuit de community informatie krijgen om van daaruit deze discussie met oa AMS-IX op te nemen. Aangezien AMS-IX het AAN Manifest heeft ondertekend, is het dus aan ons als community om ook te vragen om daad bij het woord te gaan voegen. Ik zou het prettig vinden om deze discussie iets breder te trekken dan alleen de AMS-IX en denk zelf dat er meer IXP’s een soortgelijke methode zouden kunnen accepteren, net zoals we dat ook met RPKI filtering by default hebben opgestart. Uiteraard is het handig als jullie dit idee zouden supporten of als jullie je input hier (maar ook ) via de onderstaande 2 ML’s zouden kunnen delen. Mvg, Erik Bais A2B Internet From: Erik Bais <erik(a)bais.name> Date: Tuesday 18 May 2021 at 21:52 To: "connect-wg(a)ripe.net" <connect-wg(a)ripe.net>, "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: Input request for system on how to approach abuse filtering on Route Servers - bad hosters Hi, As I asked during the Connect WG today, there are discussions currently going on in the Dutch network community to see if there is a way to get a cleaner feed from routeservers on internet exchanges. ( by default ) As you may know there is an Dutch Anti Abuse Network initiative ( AAN ) – abuse.nl The companies associated with AAN, setup and all signed a manifest ( in Dutch - https://www.abuse.nl/manifest/ ) that states that we will all do our best to provide a better and cleaner internet. As members of the member organisation of the largest Internet Exchange, AMS-IX, we like to start with the discussion on asking the AMS-IX to filter certain AS numbers from the default routeserver view. The issue is that even if you don’t peer with certain networks directly, the change is very real that you will receive or that the other network receive your prefixes and that you may not want to peer with those networks. What we like to have is an independent way of generating a list with badhosts ( say a top 50 ) .. ( and with our Dutch infrastructure we have a couple on the Dutch infrastructure as well.. ) A couple years ago there was the list of HostExploit .. or one could have a look at the drop-list of SH .. Personally I would like a proper model that one can explain why a certain network is listed on a certain list with a clear method explaining of what kind of abuse is noted in the said network. Topics that should be included on the rating for the list : * Phishing (hosting sites / domain registrations ) * Malware hosting ( binaries and C&C’s ) * DDOS traffic ( number of amplification devices in the network compared to the number of IP address ratio ) * Login attacks / excessive port scanning * Hosting of Child exploitation content * Infected websites / Zeus Botnets * Etc So yeah, something similar as the Top 50 of HostExploit ranking .. but HostExploit stopped producing these lists in 2014. By filtering a top 50 of badness hosters on the Routeservers would remove the cheap IXP option for network connectivity at the better Internet Exchanges and provide a way to remove any DDOS traffic via BGP null-routing via Transits. And companies that would still want to peer with a certain network, can still do so by direct peering setup via the IXP infra. And it will not bring the IXP in a position where it will be asked on why they are still offering services to certain parties .. as that might become legally difficult especially in a membership organisation. So we don’t mind if we take their money as long as are not forced to peer with them via the routeservers. Your constructive feedback is highly appreciated. Regards, Erik Bais A2B Internet

1 0

Wij zoeken een nieuw bestuurslid voor Stichting NLNOG
by Nathalie Trenaman 11 May '21

11 May '21

Hoi allemaal, Wij zoeken een nieuw bestuurslid voor Stichting NLNOG Wat doet het bestuur van Stichting NLNOG? Om de leukste events voor netwerk engineers te kunnen organiseren, onderhoudt het bestuur van Stichting NLNOG contact met zo’n 20 sponsoren, beheren we de website, de mailserver, de IRC server en zorgen we ervoor dat projecten en tools voor Netwerk Engineers beschikbaar zijn (IRR Explorer, NLNOG BGP filter guide, de NLNOG Ring). We doen dit met een klein team van vrijwilligers. Het bestuur van NLNOG ontvangt voor haar werkzaamheden geen financiële vergoeding. Wie zoeken we? NLNOG is er voor netwerk engineers, door netwerk engineers. Daarom verwachten we dat je een enthousiaste (netwerk) engineer bent. Het liefst kan je ook de website, mailserver en IRC server onderhouden zodat je goed kunt samenwerken met de vrijwilligers die bijvoorbeeld het IRC kanaal modereren of de Ring servers onderhouden. Je beheerst de Nederlandse en Engelse taal prima en je bent bereid om wanneer nodig, bijvoorbeeld in de voorbereiding van een event, tijd vrij te maken en mee te helpen waar nodig. In de aanloop van zo’n event kunnen de werkzaamheden voor NLNOG dan best een aantal uur per week kosten. Buiten de events om vergaderen we als bestuur eens in de 3 weken een uurtje. Dit gebeurt normaal gesproken op een doordeweekse middag. Volgend jaar bestaat NLNOG 20 jaar! Hier willen we natuurlijk iets extra’s voor doen en we hopen dat jij daar ook in mee wil denken. Wil je meehelpen om Stichting NLNOG ‘up’ te houden? Stuur je motivatie naar stichting(a)nlnog.net <mailto:stichting@nlnog.net>. We zien je reactie graag tegemoet! Niels, Melchior, Thomas en Nathalie NLNOG Bestuur

1 0

Spoofer Report for NLNOG for Apr 2021
by CAIDA Spoofer Project 08 May '21

08 May '21

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within nld. Inferred improvements during Apr 2021: none inferred Source Address Validation issues inferred during Apr 2021: ASN Name First-Spoofed Last-Spoofed 1136 KPN 2019-09-04 2021-04-29 8587 Infracom 2019-10-28 2021-04-28 213268 Cloudwebservices 2020-12-07 2021-04-29 207375 FIBO 2021-02-19 2021-04-28 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=nld&no_block=1 Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0