- NLNOG - mailman3.nlnog.net

NLNOG Day 2018 Fellowship
by Job Snijders 31 Jul '18

31 Jul '18

Dear all, On September 7th we're hosting the annual NLNOG Day - a gathering in Amsterdam for network- and system enthusiasts. We've got an excellent set of speakers that make it worth your while to drop by and participate All info can be found here: https://nlnog.net/nlnog-day-2018/ NLNOG RING Fellowship --------------------- This year we'd like to make it possible for someone based outside the Netherlands (who normally wouldn't be able to attend the NLNOG Day), to come over and participate. The NLNOG Foundation will cover travel costs & lodging. In return, we ask that you give a presentation about a problem scenario where the NLNOG RING was critical in helping analyse or identify some kind of problem. The talk will be recorded. The goal of the talk is to inspire other operators on novel uses of the NLNOG RING, or to join the RING! If this sounds cool to you, please reach out to stichting(a)nlnog.net and we'll discuss the problem scenario & presentation and other logistical aspects. The board will review all applications select one candidate. Kind regards, Job NLNOG Foundation

1 0

RIPE77 in Amsterdam!
by Nathalie Trenaman 31 Jul '18

31 Jul '18

Hoi allemaal, In oktober is er weer een RIPE meeting in Amsterdam en het zou leuk zijn een flinke delegatie NLNOGers daar te zien. Hieronder staat de mail die Martina (onze event organiser) heeft rondgestuurd. Cheers, Nathalie ------ Dear colleagues, You can now register for the RIPE 77 Meeting at: https://ripe77.ripe.net/attend/register/ <https://ripe77.ripe.net/attend/register/> RIPE 77 will take place at the Hotel Okura in Amsterdam from 15-19 October 2018. ------------- Ticket Options ------------- Week ticket: EUR 350 Day ticket: EUR 125 Student (week) ticket: EUR 50 You can find more information about ticket options at: https://ripe77.ripe.net/attend/ <https://ripe77.ripe.net/attend/> ------------- Call for Presentations ------------- The RIPE Programme Committee (PC) is now seeking content proposals from the RIPE community for the plenary sessions, BoFs (Birds of a Feather sessions), workshops, tutorials and lightning talks at RIPE 77. Proposals must be submitted for full consideration no later than 27 August. More information at: https://ripe77.ripe.net/cfp/ <https://ripe77.ripe.net/cfp/> ------------- RIPE Fellowship ------------- If you are in the RIPE NCC service region and need financial assistance to attend RIPE 77, please consider applying for a RIPE Fellowship. We will cover travel, accommodation and a full-week meeting ticket. Apply before 29 August at: https://www.ripe.net/participate/ripe/ripe-fellowship <https://www.ripe.net/participate/ripe/ripe-fellowship> ------------- RACI ------------- The RIPE Academic Cooperation Initiative (RACI) will cover the cost of the meeting ticket, travel and accommodation for successful applicants to present their research at RIPE 77. Apply before 12 August at: https://www.ripe.net/raci/ <https://www.ripe.net/raci/> ---------------- Quantum Internet Hackathon ---------------- The next RIPE NCC Hackathon will be held the weekend before the RIPE 77 meeting in Amsterdam (13-14 October). You can already apply at: https://www.ripe.net/participate/forms/apply/quantum-internet-hackathon/ <https://www.ripe.net/participate/forms/apply/quantum-internet-hackathon/> ------------- Discounted Room Rates ------------- The Hotel Okura and other hotels nearby are offering RIPE 77 attendees a discounted room rate, which is subject to availability. Reserve now to avoid disappointment at: https://ripe77.ripe.net/venue/accommodation/ <https://ripe77.ripe.net/venue/accommodation/> ------------- On-site Childcare ------------- We're making it easier for parents to fully participate in the RIPE Meeting by offering professional, on-site childcare at the meeting venue for children aged 6 months to 10 years. Space is limited, so be sure to register soon to confirm your child's place. For more information and to register, see: http://ripe77.ripe.net/on-site/on-site-childcare/ <http://ripe77.ripe.net/on-site/on-site-childcare/> ---------------- RIPE Networking App ---------------- We are pleased to announce that the RIPE Networking App is available to use for RIPE 77. It's a simple way to schedule meetings with other attendees who are using the app. You’ll need a RIPE NCC Access account to use the app. To learn more, please visit: https://ripe77.ripe.net/on-site/ripe-networking-app/ <https://ripe77.ripe.net/on-site/ripe-networking-app/> ---------------- Important Dates and Deadlines ---------------- RACI: 12 August RIPE 77 CfP: 27 August RIPE Fellowship: 29 August Quantum Internet Hackathon: 13-14 October RIPE 77: 15-19 October Discounted hotel rooms: First come, first served – limited rooms available On-site childcare: First come, first served – limited places available More information on RIPE 77 can be found at: https://ripe77.ripe.net/ <https://ripe77.ripe.net/> Follow us on Twitter: @ripemeeting, #RIPE77 See you in Amsterdam in October! Kind regards, RIPE Meetings Organisation Team

4 3

FW: NTT now treats RPKI ROAs as IRR route(6)-objects
by Job Snijders 20 Jul '18

20 Jul '18

FYI ----- Forwarded message from Job Snijders <job(a)ntt.net> ----- Date: Thu, 19 Jul 2018 21:08:12 +0000 From: Job Snijders <job(a)ntt.net> To: routing-wg(a)ripe.net Subject: NTT now treats RPKI ROAs as IRR route(6)-objects Dear RIPE Routing-WG, [ TL:DR - From now on, NTT / AS 2914 allows customers to either register their announcements in the IRR, or as RPKI ROAs. This is a convenience service for relevant regions of the world where IRR is not the norm but RPKI is commonly available. Previously NTT only accepted IRR and ARIN-WHOIS. I hope competitors and partners will use this approach too! ] As most of you know, the Resource Public Key Infrastructure (RPKI) is a modern reimagination of the good ole' IRR system we have come to love and hate. The main advantage of the RPKI is that a consumer of the data can cryptographically verify whether it was the actual owner of the IP prefix that created a so-called "RPKI ROA". (more reading: https://en.wikipedia.org/wiki/Resource_Public_Key_Infrastructure) Given that RPKI ROAs are somewhat equivalent to IRR route-objects, but more reliable in terms of authoritativeness, NTT now has an automated nightly process that converts RPKI information into IRR format so that our toolchain can consume the data as if it were just another IRR source. Using RPKI ROAs as if they are IRR route(6)-objects is a transitional step towards increased security in the routing ecosystem. We are not the first to explore this method (see post-scriptum), but I think we are the first to republish elements from RPKI ROAs via a publicly accessible IRRd instance queryable with the RADB IRRd protocol. This means that anyone that points their bgpq3 or peval programs at rr.ntt.net can leverage this method without having to update anything else in the pipeline. An example can be inspected here: job@eng0 ~$ whois -h rr.ntt.net 193.0.6.139 [Querying rr.ntt.net] [rr.ntt.net] route: 193.0.0.0/21 descr: RIPE-NCC origin: AS3333 mnt-by: RIPE-NCC-MNT changed: unread(a)ripe.net 20000101 source: RIPE remarks: **************************** remarks: * THIS OBJECT IS MODIFIED remarks: * Please note that all data that is generally regarded as personal remarks: * data has been removed from this object. remarks: * To view the original object, please query the RIPE Database at: remarks: * http://www.ripe.net/whois remarks: **************************** route: 193.0.0.0/21 descr: RPKI ROA for 193.0.0.0/21 remarks: This route object represents routing data retrieved from the RPKI remarks: The original data can be found here: https://rpki.gin.ntt.net/r/AS3333/193.0.0.0/21 remarks: This route object is the result of an automated RPKI-to-IRR conversion process. remarks: maxLength 21 origin: AS3333 mnt-by: MAINT-JOB changed: job(a)ntt.net 20180718 source: RPKI # Trust Anchor: RIPE NCC RPKI Root job@eng0 ~$ The first object is an actual IRR "route:" object from the RIPE NCC operated IRR, the second object is a representation of the RPKI ROA in RPSL format published via rr.ntt.net. In general we can state that RPKI data is very good quality data, however please keep in mind that it may not be /correct/ data. In this context "Good Quality" means that it cannot easily be forged or tampered with by adversaries (but of course that doesn't protect the legitimate owner against making misconfigurations). Just like with IRR route(6)-objects, owners may input the wrong origin ASN in this type of object or configure the wrong MaxLength. NTT operates a "RPKI Cache Validator" at https://rpki.gin.ntt.net/ Everyone is free to inspect and click around in this webinterface. Instead of https://rpki.gin.ntt.net/, there also is a command line interface available via BGPMon's whois service: job@vurt ~$ whois -h whois.bgpmon.com 193.0.0.0/21 % This is the BGPmon.net whois Service % You can use this whois gateway to retrieve information % about an IP adress or prefix % We support both IPv4 and IPv6 address. % % For more information visit: % https://portal.bgpmon.net/bgpmonapi.php Prefix: 193.0.0.0/21 Prefix description: RIPE-NCC Country code: NL Origin AS: 3333 Origin AS Name: Reseaux IP Europeens Network Coordination Centre (RIPE NCC) RPKI status: ROA validation successful First seen: 2011-10-19 Last seen: 2018-07-19 Seen by #peers: 77 Notice in the above output the "ROA validation successful". Nota bene: the fact that NTT uses RPKI ROA information in the prefix filter generation process - does _not_ mean that NTT does "RPKI Origin Validation" for BGP updates (yet). RPKI Origin Validation is an additional security layer that we hope to deploy in the not too distant future. Using RPKI ROAs in this way is an important step forward in this process. Kind regards, Job Snijders Post scriptum on prior work: Dragon Research Labs implemented the idea in 2015: https://github.com/dragonresearch/rpki.net/blob/master/potpourri/roa-to-irr… RIPE NCC's RPKI Validator added RPSL export functionality in 2015: https://mailman.nanog.org/pipermail/nanog/2015-May/075185.html Arouteserver added native support for this method in October 2017. https://github.com/pierky/arouteserver/issues/19 ----- End forwarded message -----

2 2

deploying RPKI based Origin Validation
by Job Snijders 19 Jul '18

19 Jul '18

Volgens mij gaat Nederland wereldleider routing security worden! Hoe/waar zijn jullie met implementaties van RPKI Origin Validation? Hebben mensen hulp nodig? Groeten, Job ----- Forwarded message from Job Snijders <job(a)ntt.net> ----- Date: Thu, 12 Jul 2018 17:50:29 +0000 From: Job Snijders <job(a)ntt.net> To: nanog(a)nanog.org Subject: deploying RPKI based Origin Validation Hi all, I wanted to share with you that a ton of activity is taking place in the Dutch networker community to deploy RPKI based BGP Origin Validation. The mantra is "invalid == reject" on all EBGP sessions. What's of note here is that we're now seeing the first commercial ISPs doing Origin Validation. This is a significant step forward compared to what we observed so far (it seemed OV was mostly limited to academic institutions & toy networks). But six months ago Amsio (https://www.amsio.com/en/) made the jump, and today Fusix deployed (https://fusix.nl/deploying-rpki/) We've also seen an uptake of Origin Validation at Internet Exchange route servers: AMS-IX and FranceIX have already deployed. I've read that RPKI OV is under consideration at a number of other exchanges. Other cool news is that Cloudflare launched a Certificate Transparency initiative to help keep everyone honest. Announcement at: https://twitter.com/grittygrease/status/1017224762542587907 Certificate Transparency is a fascinating tool, really a necessity to build confidence in any PKI systems. Anyone here working to deploy RPKI based Origin Validation in their network and reject invalid announcements? Anything of note to share? Kind regards, Job ----- End forwarded message -----

5 8

Implementation plan and dates for NWI5 - Out-of-region ROUTE(6) objects and removal of ASN authorisation for ROUTE(6) object creation.
by Nathalie Trenaman 19 Jul '18

19 Jul '18

Dear colleagues, In February 2018, the RIPE Database Working Group reached consensus on NWI-5 - creating out of region ROUTE(6) objects in the RIPE Database. We will soon be making changes to the way out-of-region objects are handled in the RIPE Database. It's important that database users are aware of these changes and what they mean: 1. The RIPE Routing Registry will no longer support the creation of out-of-region ROUTE(6) and AUT-NUM objects 2. Existing out-of-region objects will have their "source:” attribute changed to "RIPE-NONAUTH” 3. The creation of ROUTE(6) objects will no longer need authorisation from the ASN holder We will implement these changes in the Release Candidate environment on Thursday, 2 August and go to full production on Tuesday, 4 September. Our implementation plan can be found at: https://www.ripe.net/manage-ips-and-asns/db/impact-analysis-for-nwi-5-imple… <https://www.ripe.net/manage-ips-and-asns/db/impact-analysis-for-nwi-5-imple…> The RIPE Database Working Group chairs also wrote a RIPE Labs article that describes the background of NWI-5: https://labs.ripe.net/Members/denis/out-of-region-route-6-and-aut-num-objec… <https://labs.ripe.net/Members/denis/out-of-region-route-6-and-aut-num-objec…> <https://labs.ripe.net/Members/denis/out-of-region-route-6-and-aut-num-objec… <https://labs.ripe.net/Members/denis/out-of-region-route-6-and-aut-num-objec…>> Please contact ripe-dbm(a)ripe.net <mailto:ripe-dbm@ripe.net> if you still have questions after reading the implementation plan. Best regards, Nathalie Trenaman Product Manager RIPE NCC

1 0

Looking for Netflix contact
by Mark Schouten 16 Jul '18

16 Jul '18

Hi, Netflix decided that AS197731 is using a proxy and blocking all views. I'm looking for someone within Netflix that understands that 'contacting my ISP' is not a solution. Does anybody know anyone within Netflix? Please reply off-list, since this is a public mailing list! We wouldn't want internal Netflix contacts on the internets. -- Kerio Operator in de Cloud? https://www.kerioindecloud.nl/ Mark Schouten | Tuxis Internet Engineering KvK: 61527076 | http://www.tuxis.nl/ T: 0318 200208 | info(a)tuxis.nl

3 2

Spoofer Report for_NLNOG for Jun 2018
by CAIDA Spoofer Project 08 Jul '18

08 Jul '18

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within nld. Inferred improvements during Jun 2018: ASN Name Fixed-By 25459 NEDZONE 2018-06-20 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Jun 2018: ASN Name First-Spoofed Last-Spoofed 12222 AKAMAI 2018-02-14 2018-06-12 203201 IT-SUPERNAP 2018-06-13 2018-06-13 205406 Hostio 2018-06-21 2018-06-21 28878 SIGNET 2018-06-27 2018-06-27 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=nld&no_block=1 Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

Call for presentations RIPE 77
by Benno Overeinder 25 Jun '18

25 Jun '18

Dear colleagues, Please find the CFP for RIPE 77 below or at: https://ripe77.ripe.net/submit-topic/cfp/. The deadline for submissions is *26 August 2018*. Please also note that speakers do not receive any extra reduction or funding towards the meeting fee at the RIPE Meetings, see the "Speakers" paragraph in CFP for more information. Kind regards, Benno Overeinder RIPE PC Chair https://ripe77.ripe.net/ripe-pc/ -------------------->>><<<-------------------- Call for Presentations A RIPE Meeting is an open event where Internet Service Providers, network operators and other interested parties get together. Although the meeting is mostly technical, it is also a chance for people to meet and network with others in their field. *RIPE 77 will take place from 15-19 October in Amsterdam, The Netherlands* The RIPE Programme Committee (PC) is now seeking content proposals from the RIPE community for the plenary sessions, BoFs (Birds of a Feather sessions), panels, workshops, tutorials and lightning talks at RIPE 77. See the full descriptions of the different presentation formats: https://ripe77.ripe.net/submit-topic/presentation-formats/ Proposals for plenary sessions, BoFs, panels, workshops and tutorials must be submitted for full consideration no later than *26 August 2018*. Proposals submitted after this date will be considered depending on the slots still available in the programme. The PC is looking for presentations covering the topics of network engineering and operations, including but not limited to: - IPv6 deployment - Managing IPv4 scarcity - Data centre technologies - Network and DNS operations - Internet governance and regulatory practices - Network and routing security - Content delivery - Internet peering and mobile data exchange - Connected Things (aka. Internet of Things - IoT) ---- Speakers ---- Presenters, RIPE Working Group Chairs and the RIPE Programme Committee are required to cover their own costs to attend a RIPE Meeting (meeting ticket, travel and accommodation). We have various ticket options available depending on your needs. In extraordinary circumstances, the RIPE Chair can waive the meeting fee for presenters. These requests are dealt with on a case-by-case basis via pc(a)ripe.net. Also note that, on an individual basis, participants can apply for a RIPE Fellowship or RACI to develop their professional or academic career. For more information, please visit: https://www.ripe.net/participate/ripe/ripe-fellowship https://www.ripe.net/participate/ripe/raci ---- Submissions ---- Presenters should be clear on whether they wish to submit a presentation for a plenary or working group (WG) session. At present, most working groups will solicit policy proposals, discussion points or other content directly via their mailing lists. If you’re not sure what kind of session you should be presenting at, please visit: https://ripe77.ripe.net/plenary-or-wg/ RIPE Meeting attendees are quite sensitive to keeping presentations non-commercial, and product marketing talks are strongly discouraged. Repeated audience feedback shows that the most successful talks focus on operational experience, research results, or case studies. For example, presenters wishing to describe a commercial solution should focus on the underlying technology and should not attempt a product demonstration. Presenters should indicate how much time they will require. In general, the time allocated for the different presentation formats is as follows: - Plenary presentations: 20-25 minutes presentation with 5-10 minutes discussion - Tutorials: up to two hours (Monday morning) - Workshops: one hour (during evening sessions) to two hours (Monday morning) - BoFs: approximately one hour (during evening sessions) - Lightning talks: 10 minutes in total for both the presentation and any discussion The following general requirements apply: - Proposals must be submitted using the meeting submission system, https://ripe77.ripe.net/submit-topic/ - Lightning talks should also be submitted using the meeting submission system (https://ripe77.ripe.net/submit-topic/) and can be submitted any time up to and including the meeting week. The allocation of lightning talks will be announced on short notice, in some cases on the same day but often one day prior to the time slot allocated. - Presenters who propose a panel or BoF are encouraged to include speakers from several (perhaps even competing) companies and/or a neutral facilitator. - All presentation proposals will only be considered by the PC if they contain at least draft presentation slides (slides may be updated later on). For panels, proposals must contain a clear description, as well as the names of invited panellists, presenters and moderators. ---- Diversity and Inclusion - On-Site Childcare and the RIPE Meeting Code of Conduct ---- Did you know that RIPE Meetings now have on-site childcare? You can reserve a spot for your child (age 6 months – 10 years) during the registration process for the meeting. Registrations for RIPE 77 will open mid-July. Childcare places are limited, so please be quick to reserve a spot for your child! Read about the experiences of our next generation of engineers at: https://labs.ripe.net/Members/agowland/ripe-meeting-diversity-efforts-on-si… Ensuring that RIPE Meeting values are upheld and that attendees experience a professional, respectful and safe meeting is a priority. Please do read the RIPE Meeting Code of Conduct: https://www.ripe.net/participate/meetings/ripe-meetings/ripe-meeting-code-o… --- If you have any questions or requests concerning content submissions, please email pc(a)ripe.net.

1 0

NLNOG day 2018
by Job Snijders 19 Jun '18

19 Jun '18

Hi all, Friday September 7th we'll be kicking off the annual NLNOG day! The one and only technical event for network operators, sysadmins, and geeks. ***EXPATS ARE SUPER WELCOME***. It'll be a day full of inspiring, provocative and educational lectures and discussion. Take a look at what we did last year: https://nlnog.net/nlnog-day-2017/ We'll close the day out with the infamous "NLNOG Quiz" with crazy cool prizes INCLUDING A FREAKING IPV4 /24!!! The day starts at 09:00 in Amsterdam - coffee/thee, lunch, dinner, wifi and drinks are all part of the deal. There is limited space so make sure you get your ticket in time! Registration is at https://nlnogday2018.eventbrite.nl/ (pay what you want!). Call for speakers ----------------- Are you working on some automation projects? Are you handling crazy security incidents? Did Theo tell you to disable hyperthreading on all your CPUs? Did you save your company $$$ last year by doing this one simple trick? Please take this opportunity to share your knowledge with competitors! Presentations (including some Q&A) take between 15 and 30 minutes. The slides & speech should be in English. Submit your proposal to events(a)nlnog.net. The organisation will assess every proposal on its merit and x-factor. Kind regards, Job, Nathalie, Niels, Sander, Thomas NLNOG Foundation ps. Bring your friends & coworkers - shared fun is double the fun!

1 0

Aankondiging: NLNOG dag 2018
by Job Snijders 15 Jun '18

15 Jun '18

Beste NLNOGers! Vrijdag 7 september is het weer zover! De enige echte technische netwerkbeheerder-dag van Nederland! De NLNOG dag is een dag vol inspirerende, provocatieve, maar bovenal leerzame presentaties. En natuurlijk sluiten we weer de dag af met de niet te missen, zeer gevreesde NLNOG Quiz met ook dit jaar krankjorum goede prijzen ;) Vanaf 09:00 in Amsterdam. Koffie/thee, wifi, lunch, avondeten én een uitgebreide borrel worden allemaal verzorgd. Er is plek voor mensen, dus wees er snel bij. Aanmelden is verplicht en kan via https://nlnogday2018.eventbrite.nl/. Toegang is gratis, maar je kunt ook kiezen voor één van de betaalde tickets om zo het evenement te steunen! Oproep aan sprekers! -------------------- Ben je bezig geweest met gave automatiseringsprojecten? Heb je te maken gehad met bizarre security incidenten? Of stond afgelopen jaar in het teken van slimme oplossingen bedenken om kosten en tijd te drukken? Grijp deze dag aan om je vrienden en collega's hierover te vertellen tijdens een presentatie! Een presentatie inclusief Q & A duurt ± 30 minuten, slides in het Engels, spreken in het Engels. Stuur je voorstel naar events(a)nlnog.net, bij voorkeur met (ruwe) slides. De organisatie zal elk voorstel beoordelen op basis van kwaliteit en X-factor. Groeten, Job, Nathalie, Niels, Sander, Thomas

1 0