- NLNOG - NLNOG

Spoofer Report for NLNOG for Jun 2021
by CAIDA Spoofer Project 08 Jul '21

08 Jul '21

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within nld. Inferred improvements during Jun 2021: ASN Name Fixed-By 34373 XXLnet 2021-06-01 8283 COLOCLUE 2021-06-18 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Jun 2021: ASN Name First-Spoofed Last-Spoofed 57866 FUSIX 2018-09-25 2021-06-18 1136 KPN 2019-09-04 2021-06-20 8587 Infracom 2019-10-28 2021-06-25 207375 FIBO 2021-02-19 2021-06-21 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=nld&no_block=1 Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

Call for Presentations for the virtual European Peering Forum 2021
by Petra Wensing 02 Jul '21

02 Jul '21

Dear all, AMS-IX, DE-CIX, LINX, Netnod are happy to host the virtual European Peering Forum (EPF) 2021 from the 20th - 22th September 2021. The event will welcome peering managers and coordinators from networks connected to the host Internet exchanges. Besides some interesting topical agenda, the three-day event accommodates room for attendees to virtually meet on a one-to-one basis to discuss bilateral peering business opportunities. The programme committee will be looking for presentations and related to peering and technical topics of interconnection. Your presentation should address * Interconnection Automation * Regional Peering * Interconnection / Peering Internet Governance and Regulatory Topics * Economic and Product Trends * Peering / Interconnection strategies * Interesting findings about Peering / Interconnection * 400GE and beyond * Any other hot topic related to Interconnection / Peering Submissions =========== Presentations must be of a non-commercial nature. Product or marketing heavy talks are strongly discouraged. Submissions of presentations should be made to the programme committee <epf-pc(a)peering-forum.eu>. Please include: * Author's name and e-mail address * Presentation title * Abstract * Slides (if available) * Time requested (max. 15 minutes incl. Q&A) Deadlines ========= Please send in your presentation asap. We decide on a first come first serve basis. The latest date for submission is July 30th. More information about the event and other activities around the virtual EPF 2021 may be found at * https://peering-forum.eu/ * https://www.facebook.com/groups/1586607564933665/ Best regards, The EPF hosts, AMS-IX, DE-CIX, LINX, NETNOD

1 0

NLNOG Day 2021 Invitation and registration
by Melchior Aelmans 02 Jul '21

02 Jul '21

Hi NLNOG! The one and only technical event for network operators, engineers and sysadmins, NLNOG Day will take place again Thursday September 2, 2021! We are looking forward to a day full of inspiring, provocative, fun and educational presentations, discussion and, maybe even more important, meeting everyone again. As we are still not 100% done with the pandemic and travel restrictions might still be in place NLNOG Day 2021 will be a hybrid event with options to participate and present in person or remote. To get an idea of the program and what we’ve done during previous NLNOG Days, please see the website https://www.nlnog.net/ The day starts at 09:00 local Amsterdam time. For those participating in person coffee/tea, lunch, dinner, wifi and drinks are all arranged for. If you choose to participate remote there is no need to register as the whole day will be streamed live. In case you do want to receive a t-shirt we do ask you to register and select the appropriate option. There is limited space so make sure to register and get your ticket in time if you want to participate in person. Register via https://www.eventbrite.nl/e/tickets-nlnog-day-2021-161612436147 . As always we are catering the pay what you want model. More information, location details and the agenda will be published on https://nlnog.net/nlnog-day-2021/ <https://nlnog.net/nlnog-day-2019/> Throughout the day we will adhere to all local government restrictions and regulations. Call for speakers ----------------- Are you working on an interesting project? Did you save the world by mitigating the largest attack on the internet? Are you handling any mind-blowing security incidents? Are you ready to expose the next big thing? Please take this opportunity to share your knowledge with friends. Presentations (including some Q&A) take between 15 and 30 minutes. The slides & presentation should be in English. Submit your proposal to events(a)nlnog.net. We will assess every proposal on its merit and x-factor. We are looking forward to NLNOG Day 2021 and hope to see you there! Kind regards, Melchior, Nathalie, Niels, Thomas NLNOG Foundation

1 0

Spoofer Report for NLNOG for May 2021
by CAIDA Spoofer Project 08 Jun '21

08 Jun '21

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within nld. Inferred improvements during May 2021: ASN Name Fixed-By 213268 Cloudwebservices 2021-05-09 48347 MTW 2021-05-18 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during May 2021: ASN Name First-Spoofed Last-Spoofed 33915 TNF 2019-01-28 2021-05-18 8587 Infracom 2019-10-28 2021-05-12 34373 XXLnet 2020-11-09 2021-05-27 213268 Cloudwebservices 2020-12-07 2021-05-06 207375 FIBO 2021-02-19 2021-05-19 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=nld&no_block=1 Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

DANE Survey
by Moritz Müller 01 Jun '21

01 Jun '21

Hoi, (English below) DANE voor SMTP wordt nog niet op grote schaal gebruikt. Via een enquête willen wij, als onderdeel van een samenwerking met Seoul National University, Virginia Tech en de University of Twente, antwoord krijgen op de vraag waarom dit het geval is en achterhalen tegen welke problemen operators aanlopen als het gaat om DANE. Ook willen we graag weten hoe DANE juist wél succesvol ingezet wordt. Met het uiteindelijke doel om oplossingen te ontwikkelen die het beheren van DANE makkelijker maken. Het invullen van de enquete duurt tussen 10 en 20 minuten. Wij zouden jullie deelname erg waarderen. https://forms.gle/QUHA2cHpDjGWW47J7 —————— DANE for SMTP is not deployed on large scale. Together with researchers from Seoul National University, Virginia Tech en de University of Twente, we would like to understand which challenges operators face when deploying DANE for SMTP. Also, we would like to understand how operators deploy DANE successfully. Finally, we want to develop solutions to simplify DANE deployment for SMTP. Filling in the survey should take between 10 and 20 minutes. We would highly appreciate your participation. https://forms.gle/qpxtbi9zecT4haxC8 — Moritz Müller | Research Engineer SIDN | Meander 501 | 6825 MD | Postbus 5022 | 6802 EA | ARNHEM T +31 (0)26 352 55 00 moritz.muller(a)sidn.nl | www.sidn.nl

1 0

FW: Input request for system on how to approach abuse filtering on Route Servers - bad hosters
by Erik Bais 18 May '21

18 May '21

Hi, In het licht van de discussie die we recent hadden op IRC mbt hoe we bep. badhosts makkelijk(er) kunnen de-peeren op de internet exchange routeservers, heb ik de onderstaande email gestuurd naar zowel de Anti-Abuse WG als de Connect-WG ( voor IXP’s ) van RIPE. Ik hoop dat we vanuit de community informatie krijgen om van daaruit deze discussie met oa AMS-IX op te nemen. Aangezien AMS-IX het AAN Manifest heeft ondertekend, is het dus aan ons als community om ook te vragen om daad bij het woord te gaan voegen. Ik zou het prettig vinden om deze discussie iets breder te trekken dan alleen de AMS-IX en denk zelf dat er meer IXP’s een soortgelijke methode zouden kunnen accepteren, net zoals we dat ook met RPKI filtering by default hebben opgestart. Uiteraard is het handig als jullie dit idee zouden supporten of als jullie je input hier (maar ook ) via de onderstaande 2 ML’s zouden kunnen delen. Mvg, Erik Bais A2B Internet From: Erik Bais <erik(a)bais.name> Date: Tuesday 18 May 2021 at 21:52 To: "connect-wg(a)ripe.net" <connect-wg(a)ripe.net>, "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: Input request for system on how to approach abuse filtering on Route Servers - bad hosters Hi, As I asked during the Connect WG today, there are discussions currently going on in the Dutch network community to see if there is a way to get a cleaner feed from routeservers on internet exchanges. ( by default ) As you may know there is an Dutch Anti Abuse Network initiative ( AAN ) – abuse.nl The companies associated with AAN, setup and all signed a manifest ( in Dutch - https://www.abuse.nl/manifest/ ) that states that we will all do our best to provide a better and cleaner internet. As members of the member organisation of the largest Internet Exchange, AMS-IX, we like to start with the discussion on asking the AMS-IX to filter certain AS numbers from the default routeserver view. The issue is that even if you don’t peer with certain networks directly, the change is very real that you will receive or that the other network receive your prefixes and that you may not want to peer with those networks. What we like to have is an independent way of generating a list with badhosts ( say a top 50 ) .. ( and with our Dutch infrastructure we have a couple on the Dutch infrastructure as well.. ) A couple years ago there was the list of HostExploit .. or one could have a look at the drop-list of SH .. Personally I would like a proper model that one can explain why a certain network is listed on a certain list with a clear method explaining of what kind of abuse is noted in the said network. Topics that should be included on the rating for the list : * Phishing (hosting sites / domain registrations ) * Malware hosting ( binaries and C&C’s ) * DDOS traffic ( number of amplification devices in the network compared to the number of IP address ratio ) * Login attacks / excessive port scanning * Hosting of Child exploitation content * Infected websites / Zeus Botnets * Etc So yeah, something similar as the Top 50 of HostExploit ranking .. but HostExploit stopped producing these lists in 2014. By filtering a top 50 of badness hosters on the Routeservers would remove the cheap IXP option for network connectivity at the better Internet Exchanges and provide a way to remove any DDOS traffic via BGP null-routing via Transits. And companies that would still want to peer with a certain network, can still do so by direct peering setup via the IXP infra. And it will not bring the IXP in a position where it will be asked on why they are still offering services to certain parties .. as that might become legally difficult especially in a membership organisation. So we don’t mind if we take their money as long as are not forced to peer with them via the routeservers. Your constructive feedback is highly appreciated. Regards, Erik Bais A2B Internet

1 0

Wij zoeken een nieuw bestuurslid voor Stichting NLNOG
by Nathalie Trenaman 11 May '21

11 May '21

Hoi allemaal, Wij zoeken een nieuw bestuurslid voor Stichting NLNOG Wat doet het bestuur van Stichting NLNOG? Om de leukste events voor netwerk engineers te kunnen organiseren, onderhoudt het bestuur van Stichting NLNOG contact met zo’n 20 sponsoren, beheren we de website, de mailserver, de IRC server en zorgen we ervoor dat projecten en tools voor Netwerk Engineers beschikbaar zijn (IRR Explorer, NLNOG BGP filter guide, de NLNOG Ring). We doen dit met een klein team van vrijwilligers. Het bestuur van NLNOG ontvangt voor haar werkzaamheden geen financiële vergoeding. Wie zoeken we? NLNOG is er voor netwerk engineers, door netwerk engineers. Daarom verwachten we dat je een enthousiaste (netwerk) engineer bent. Het liefst kan je ook de website, mailserver en IRC server onderhouden zodat je goed kunt samenwerken met de vrijwilligers die bijvoorbeeld het IRC kanaal modereren of de Ring servers onderhouden. Je beheerst de Nederlandse en Engelse taal prima en je bent bereid om wanneer nodig, bijvoorbeeld in de voorbereiding van een event, tijd vrij te maken en mee te helpen waar nodig. In de aanloop van zo’n event kunnen de werkzaamheden voor NLNOG dan best een aantal uur per week kosten. Buiten de events om vergaderen we als bestuur eens in de 3 weken een uurtje. Dit gebeurt normaal gesproken op een doordeweekse middag. Volgend jaar bestaat NLNOG 20 jaar! Hier willen we natuurlijk iets extra’s voor doen en we hopen dat jij daar ook in mee wil denken. Wil je meehelpen om Stichting NLNOG ‘up’ te houden? Stuur je motivatie naar stichting(a)nlnog.net <mailto:stichting@nlnog.net>. We zien je reactie graag tegemoet! Niels, Melchior, Thomas en Nathalie NLNOG Bestuur

1 0

Spoofer Report for NLNOG for Apr 2021
by CAIDA Spoofer Project 08 May '21

08 May '21

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within nld. Inferred improvements during Apr 2021: none inferred Source Address Validation issues inferred during Apr 2021: ASN Name First-Spoofed Last-Spoofed 1136 KPN 2019-09-04 2021-04-29 8587 Infracom 2019-10-28 2021-04-28 213268 Cloudwebservices 2020-12-07 2021-04-29 207375 FIBO 2021-02-19 2021-04-28 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=nld&no_block=1 Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

Spoofer Report for NLNOG for Mar 2021
by CAIDA Spoofer Project 08 Apr '21

08 Apr '21

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within nld. Inferred improvements during Mar 2021: ASN Name Fixed-By 34373 XXLnet 2021-03-22 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Mar 2021: ASN Name First-Spoofed Last-Spoofed 33915 TNF 2019-01-28 2021-03-30 8587 Infracom 2019-10-28 2021-03-24 213251 de-srv-2-mnt 2020-07-30 2021-03-24 213268 Cloudwebservices 2020-12-07 2021-03-26 207375 FIBO 2021-02-19 2021-03-26 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=nld&no_block=1 Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

Spoofer Report for NLNOG for Feb 2021
by CAIDA Spoofer Project 08 Mar '21

08 Mar '21

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within nld. Inferred improvements during Feb 2021: none inferred Source Address Validation issues inferred during Feb 2021: ASN Name First-Spoofed Last-Spoofed 8587 Infracom 2019-10-28 2021-02-17 213268 Cloudwebservices 2020-12-07 2021-02-27 34373 XXLnet 2021-02-09 2021-02-09 207375 FIBO 2021-02-19 2021-02-19 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=nld&no_block=1 Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0