- NLNOG - mailman3.nlnog.net

FW: Input request for system on how to approach abuse filtering on Route Servers - bad hosters
by Erik Bais 18 May '21

18 May '21

Hi, In het licht van de discussie die we recent hadden op IRC mbt hoe we bep. badhosts makkelijk(er) kunnen de-peeren op de internet exchange routeservers, heb ik de onderstaande email gestuurd naar zowel de Anti-Abuse WG als de Connect-WG ( voor IXP’s ) van RIPE. Ik hoop dat we vanuit de community informatie krijgen om van daaruit deze discussie met oa AMS-IX op te nemen. Aangezien AMS-IX het AAN Manifest heeft ondertekend, is het dus aan ons als community om ook te vragen om daad bij het woord te gaan voegen. Ik zou het prettig vinden om deze discussie iets breder te trekken dan alleen de AMS-IX en denk zelf dat er meer IXP’s een soortgelijke methode zouden kunnen accepteren, net zoals we dat ook met RPKI filtering by default hebben opgestart. Uiteraard is het handig als jullie dit idee zouden supporten of als jullie je input hier (maar ook ) via de onderstaande 2 ML’s zouden kunnen delen. Mvg, Erik Bais A2B Internet From: Erik Bais <erik(a)bais.name> Date: Tuesday 18 May 2021 at 21:52 To: "connect-wg(a)ripe.net" <connect-wg(a)ripe.net>, "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: Input request for system on how to approach abuse filtering on Route Servers - bad hosters Hi, As I asked during the Connect WG today, there are discussions currently going on in the Dutch network community to see if there is a way to get a cleaner feed from routeservers on internet exchanges. ( by default ) As you may know there is an Dutch Anti Abuse Network initiative ( AAN ) – abuse.nl The companies associated with AAN, setup and all signed a manifest ( in Dutch - https://www.abuse.nl/manifest/ ) that states that we will all do our best to provide a better and cleaner internet. As members of the member organisation of the largest Internet Exchange, AMS-IX, we like to start with the discussion on asking the AMS-IX to filter certain AS numbers from the default routeserver view. The issue is that even if you don’t peer with certain networks directly, the change is very real that you will receive or that the other network receive your prefixes and that you may not want to peer with those networks. What we like to have is an independent way of generating a list with badhosts ( say a top 50 ) .. ( and with our Dutch infrastructure we have a couple on the Dutch infrastructure as well.. ) A couple years ago there was the list of HostExploit .. or one could have a look at the drop-list of SH .. Personally I would like a proper model that one can explain why a certain network is listed on a certain list with a clear method explaining of what kind of abuse is noted in the said network. Topics that should be included on the rating for the list : * Phishing (hosting sites / domain registrations ) * Malware hosting ( binaries and C&C’s ) * DDOS traffic ( number of amplification devices in the network compared to the number of IP address ratio ) * Login attacks / excessive port scanning * Hosting of Child exploitation content * Infected websites / Zeus Botnets * Etc So yeah, something similar as the Top 50 of HostExploit ranking .. but HostExploit stopped producing these lists in 2014. By filtering a top 50 of badness hosters on the Routeservers would remove the cheap IXP option for network connectivity at the better Internet Exchanges and provide a way to remove any DDOS traffic via BGP null-routing via Transits. And companies that would still want to peer with a certain network, can still do so by direct peering setup via the IXP infra. And it will not bring the IXP in a position where it will be asked on why they are still offering services to certain parties .. as that might become legally difficult especially in a membership organisation. So we don’t mind if we take their money as long as are not forced to peer with them via the routeservers. Your constructive feedback is highly appreciated. Regards, Erik Bais A2B Internet

1 0

Wij zoeken een nieuw bestuurslid voor Stichting NLNOG
by Nathalie Trenaman 11 May '21

11 May '21

Hoi allemaal, Wij zoeken een nieuw bestuurslid voor Stichting NLNOG Wat doet het bestuur van Stichting NLNOG? Om de leukste events voor netwerk engineers te kunnen organiseren, onderhoudt het bestuur van Stichting NLNOG contact met zo’n 20 sponsoren, beheren we de website, de mailserver, de IRC server en zorgen we ervoor dat projecten en tools voor Netwerk Engineers beschikbaar zijn (IRR Explorer, NLNOG BGP filter guide, de NLNOG Ring). We doen dit met een klein team van vrijwilligers. Het bestuur van NLNOG ontvangt voor haar werkzaamheden geen financiële vergoeding. Wie zoeken we? NLNOG is er voor netwerk engineers, door netwerk engineers. Daarom verwachten we dat je een enthousiaste (netwerk) engineer bent. Het liefst kan je ook de website, mailserver en IRC server onderhouden zodat je goed kunt samenwerken met de vrijwilligers die bijvoorbeeld het IRC kanaal modereren of de Ring servers onderhouden. Je beheerst de Nederlandse en Engelse taal prima en je bent bereid om wanneer nodig, bijvoorbeeld in de voorbereiding van een event, tijd vrij te maken en mee te helpen waar nodig. In de aanloop van zo’n event kunnen de werkzaamheden voor NLNOG dan best een aantal uur per week kosten. Buiten de events om vergaderen we als bestuur eens in de 3 weken een uurtje. Dit gebeurt normaal gesproken op een doordeweekse middag. Volgend jaar bestaat NLNOG 20 jaar! Hier willen we natuurlijk iets extra’s voor doen en we hopen dat jij daar ook in mee wil denken. Wil je meehelpen om Stichting NLNOG ‘up’ te houden? Stuur je motivatie naar stichting(a)nlnog.net <mailto:stichting@nlnog.net>. We zien je reactie graag tegemoet! Niels, Melchior, Thomas en Nathalie NLNOG Bestuur

1 0

Spoofer Report for NLNOG for Apr 2021
by CAIDA Spoofer Project 08 May '21

08 May '21

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within nld. Inferred improvements during Apr 2021: none inferred Source Address Validation issues inferred during Apr 2021: ASN Name First-Spoofed Last-Spoofed 1136 KPN 2019-09-04 2021-04-29 8587 Infracom 2019-10-28 2021-04-28 213268 Cloudwebservices 2020-12-07 2021-04-29 207375 FIBO 2021-02-19 2021-04-28 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=nld&no_block=1 Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

Spoofer Report for NLNOG for Mar 2021
by CAIDA Spoofer Project 08 Apr '21

08 Apr '21

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within nld. Inferred improvements during Mar 2021: ASN Name Fixed-By 34373 XXLnet 2021-03-22 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Mar 2021: ASN Name First-Spoofed Last-Spoofed 33915 TNF 2019-01-28 2021-03-30 8587 Infracom 2019-10-28 2021-03-24 213251 de-srv-2-mnt 2020-07-30 2021-03-24 213268 Cloudwebservices 2020-12-07 2021-03-26 207375 FIBO 2021-02-19 2021-03-26 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=nld&no_block=1 Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

Spoofer Report for NLNOG for Feb 2021
by CAIDA Spoofer Project 08 Mar '21

08 Mar '21

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within nld. Inferred improvements during Feb 2021: none inferred Source Address Validation issues inferred during Feb 2021: ASN Name First-Spoofed Last-Spoofed 8587 Infracom 2019-10-28 2021-02-17 213268 Cloudwebservices 2020-12-07 2021-02-27 34373 XXLnet 2021-02-09 2021-02-09 207375 FIBO 2021-02-19 2021-02-19 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=nld&no_block=1 Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

Call for Presentations: RIPE 82
by Jelte Jansen 25 Feb '21

25 Feb '21

*RIPE 82 will be a free virtual event and will take place from 17-21 May 2021* The RIPE Programme Committee (PC) is now seeking content proposals from the RIPE community for the plenary sessions, lightning talks and BoFs. Please note that no workshops or tutorials will be organised at this meeting. The RIPE 82 Meeting plan is available here: https://ripe82.ripe.net/programme/meeting-plan/ You have until *19 March 2021* to submit your presentations proposals. Proposals submitted after this date will be considered depending on the slots still available in the programme. The PC is looking for presentations covering topics of network engineering and operations, including but not limited to: - IPv6 deployment - Managing IPv4 scarcity - Data centre technologies - Network and DNS operations - Internet governance and regulatory practices - Network and routing security - Content delivery - Internet peering and mobile data exchange - Connected Things (aka. Internet of Things - IoT) RIPE Meeting attendees are quite sensitive to keeping presentations non-commercial, and product marketing talks are strongly discouraged. Most successful talks focus on operational experience, research results, or case studies. For example, presenters wishing to describe a commercial solution should focus on the underlying technology and should not attempt a product demonstration. --------------------------------------------------------------------- Submissions --------------------------------------------------------------------- The following general requirements apply: - Proposals must be submitted using the meeting submission system, https://ripe82.ripe.net/submit-topic/submission-form/ - All presentation proposals will only be considered by the PC if they contain at least draft presentation slides (slides may be updated later on). For panels, proposals must contain a clear description, as well as the names of invited panelists, presenters and moderators. - Presenters should indicate how much time their presentations will require. Here’s an indication of the average duration of each session format: o Plenary presentations: 20-25 minutes presentation with 10-5 minutes discussion o Lightning talks: 10 minutes for both the presentation and discussion o BoFs: one hour - Lightning talks should also be submitted using the same meeting submission system and can be submitted any time up to and including the meeting week. The allocation of lightning talks will be announced the week before the RIPE Meeting. - Presenters who propose a BoF are encouraged to include speakers from several (perhaps even competing) companies and/or a neutral facilitator. More detail on the presentation formats can be found here: https://ripe82.ripe.net/submit-topic/presentation-formats/ --------------------------------------------------------------------- Plenary or Working Group? --------------------------------------------------------------------- Presenters should be clear on whether they wish to submit a presentation for a plenary or working group session. At present, most working groups will solicit policy proposals, discussion points or other content directly via their mailing lists. If you’re not sure what kind of session you should be presenting at, please visit: https://ripe82.ripe.net/submit-topic/plenary-or-wg/ --------------------------------------------------------------------- The RIPE Meeting Code of Conduct --------------------------------------------------------------------- To ensure that RIPE Meeting values are upheld and that attendees experience a professional, respectful and safe meeting is a priority, please read the RIPE Meeting Code of Conduct: https://www.ripe.net/participate/meetings/ripe-meetings/ripe-meeting-code-o… --------------------------------------------------------------------- If you have any questions or requests concerning content submissions, please email pc at ripe.net . Jelte Jansen On Behalf of the RIPE PC

1 0

Spoofer Report for NLNOG for Jan 2021
by CAIDA Spoofer Project 08 Feb '21

08 Feb '21

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within nld. Inferred improvements during Jan 2021: none inferred Source Address Validation issues inferred during Jan 2021: ASN Name First-Spoofed Last-Spoofed 33915 TNF 2019-01-28 2021-01-19 8587 Infracom 2019-10-28 2021-01-27 213251 de-srv-2-mnt 2020-07-30 2021-01-13 213268 Cloudwebservices 2020-12-07 2021-01-12 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=nld&no_block=1 Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

Re: [NLNOG] weet iemand wie deze amateurs zijn?
by Thomas de Looff 02 Feb '21

02 Feb '21

Hoi Sabri, Bedankt voor het melden van de Abuse, dit heb ik doorgegeven. Zie dat er inderdaad een probleem is met ons AbuseIO systeem. Hier wordt aan gewerkt. PS: Het is ook mogelijk om de PCextreme support hiervoor te contacteren. Met vriendelijke groet, Thomas de Looff From: NLNOG <nlnog-bounces(a)nlnog.net> on behalf of Sabri Berisha <sabri(a)cluecentral.net> Date: Monday, 1 February 2021 at 20:31 To: nlnog <nlnog(a)nlnog.net> Subject: Re: [NLNOG] weet iemand wie deze amateurs zijn? Hi, Dusss... 3 jaar geleden werd ik nog geflamed toen ik deze club "amateurs" noemde (zij die mij kennen, weten precies wat we daar mee bedoelen). Dit, daarentegen, doet wel een klein beetje echt amateuristisch aan. Zit er iemand van pcextreme op de lijst? Ik had al ff op #nlnog rondgevraagd, zonder success. This is the mail system at host abuseio.pcextreme.nl. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to postmaster. If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system <notifier(a)abuseio.pcextreme.nl>: Command died with status 1: "/usr/bin/php -q /opt/abuseio/libexec/mda". Command output: Could not open input file: /opt/abuseio/libexec/mda Ik wou alleen wat info@ spam melden. Thanks, Sabri ----- On Feb 22, 2018, at 10:41 AM, Sabri Berisha <sabri(a)cluecentral.net> wrote: Hi, Elke 30 seconden proberen ze het opnieuw: Jan 1 07:50:14 mail postfix/smtpd[1243]: NOQUEUE: filter: RCPT from unknown[185.103.159.70]: <vsaveliev(a)openprovider.ru>: Sender address triggers FILTER smtp-amavis:[127.0.0.1]:10024; from=<vsaveliev(a)openprovider.ru> to=<null(a)null.nl> proto=ESMTP helo=<mail-dev101-01.openprovider.nl> Jan 1 07:50:14 mail postfix/smtpd[1243]: NOQUEUE: reject: RCPT from unknown[185.103.159.70]: 554 5.7.1 <null(a)null.nl>: from=<vsaveliev(a)openprovider.ru> to=<null(a)null.nl> proto=ESMTP helo=<mail-dev101-01.openprovider.nl> root@mail:/var/log# host 185.103.159.70 70.159.103.185.in-addr.arpa domain name pointer hosted.by.pcextreme. <--- lekker profi PTR. role: PCextreme - Global NOC address: PCextreme B.V. address: Gyroscoopweg 134 En was dat hele openprovider.nl niet van Beefje? Thanks, Sabri Jr Network Amateur _______________________________________________ NLNOG mailing list NLNOG(a)nlnog.net http://mailman.nlnog.net/listinfo/nlnog _______________________________________________ NLNOG mailing list NLNOG(a)nlnog.net http://mailman.nlnog.net/listinfo/nlnog

1 0

weet iemand wie deze amateurs zijn?
by Sabri Berisha 01 Feb '21

01 Feb '21

Hi, Elke 30 seconden proberen ze het opnieuw: Jan 1 07:50:14 mail postfix/smtpd[1243]: NOQUEUE: filter: RCPT from unknown[185.103.159.70]: <vsaveliev(a)openprovider.ru>: Sender address triggers FILTER smtp-amavis:[127.0.0.1]:10024; from=<vsaveliev(a)openprovider.ru> to=<null(a)null.nl> proto=ESMTP helo=<mail-dev101-01.openprovider.nl> Jan 1 07:50:14 mail postfix/smtpd[1243]: NOQUEUE: reject: RCPT from unknown[185.103.159.70]: 554 5.7.1 <null(a)null.nl>: from=<vsaveliev(a)openprovider.ru> to=<null(a)null.nl> proto=ESMTP helo=<mail-dev101-01.openprovider.nl> root@mail:/var/log# host 185.103.159.70 70.159.103.185.in-addr.arpa domain name pointer hosted.by.pcextreme. <--- lekker profi PTR. role: PCextreme - Global NOC address: PCextreme B.V. address: Gyroscoopweg 134 En was dat hele openprovider.nl niet van Beefje? Thanks, Sabri Jr Network Amateur

2 2

10 years of NLNOG RING!
by Martin Pels 31 Jan '21

31 Jan '21

Hi all, This month marks the tenth anniversary of the NLNOG RING project. A good moment to look back on how the project came to be and how it evolved over this past decade: https://ring.nlnog.net/post/10-years-of-nlnog-ring/ Thanks to all participants for making the project a huge success! Kind regards, Martin (on behalf of the NLNOG RING Admins)

1 0