- NLNOG - NLNOG

2nd call for presentations RIPE 77
by Benno Overeinder 20 Aug '18

20 Aug '18

RIPE 77 Meeting dit najaar weer in Amsterdam! Groeten, -- Benno Dear colleagues, Please note the approaching deadline of *26 August 2018* for RIPE 77 plenary programme submissions. You can find the CFP for RIPE 77 below or at https://ripe77.ripe.net/submit-topic/cfp/, for your proposals for plenary session presentations, tutorials, workshops, BoFs (Birds of a Feather sessions) and lightning talks. Please also note that speakers do not receive any extra reduction or funding towards the meeting fee at the RIPE Meetings, see the "Speakers" paragraph in CFP for more information. Kind regards, Benno Overeinder RIPE PC Chair https://ripe77.ripe.net/ripe-pc/ -------------------->>><<<-------------------- Call for Presentations A RIPE Meeting is an open event where Internet Service Providers, network operators and other interested parties get together. Although the meeting is mostly technical, it is also a chance for people to meet and network with others in their field. *RIPE 77 will take place from 15-19 October in Amsterdam, The Netherlands* The RIPE Programme Committee (PC) is now seeking content proposals from the RIPE community for the plenary sessions, BoFs (Birds of a Feather sessions), panels, workshops, tutorials and lightning talks at RIPE 77. See the full descriptions of the different presentation formats: https://ripe77.ripe.net/submit-topic/presentation-formats/ Proposals for plenary sessions, BoFs, panels, workshops and tutorials must be submitted for full consideration no later than *26 August 2018*. Proposals submitted after this date will be considered depending on the slots still available in the programme. The PC is looking for presentations covering the topics of network engineering and operations, including but not limited to: - IPv6 deployment - Managing IPv4 scarcity - Data centre technologies - Network and DNS operations - Internet governance and regulatory practices - Network and routing security - Content delivery - Internet peering and mobile data exchange - Connected Things (aka. Internet of Things - IoT) ---- Speakers ---- Presenters, RIPE Working Group Chairs and the RIPE Programme Committee are required to cover their own costs to attend a RIPE Meeting (meeting ticket, travel and accommodation). We have various ticket options available depending on your needs. In extraordinary circumstances, the RIPE Chair can waive the meeting fee for presenters. These requests are dealt with on a case-by-case basis via pc(a)ripe.net. Also note that, on an individual basis, participants can apply for a RIPE Fellowship or RACI to develop their professional or academic career. For more information, please visit: https://www.ripe.net/participate/ripe/ripe-fellowship https://www.ripe.net/participate/ripe/raci ---- Submissions ---- Presenters should be clear on whether they wish to submit a presentation for a plenary or working group (WG) session. At present, most working groups will solicit policy proposals, discussion points or other content directly via their mailing lists. If you’re not sure what kind of session you should be presenting at, please visit: https://ripe77.ripe.net/plenary-or-wg/ RIPE Meeting attendees are quite sensitive to keeping presentations non-commercial, and product marketing talks are strongly discouraged. Repeated audience feedback shows that the most successful talks focus on operational experience, research results, or case studies. For example, presenters wishing to describe a commercial solution should focus on the underlying technology and should not attempt a product demonstration. Presenters should indicate how much time they will require. In general, the time allocated for the different presentation formats is as follows: - Plenary presentations: 20-25 minutes presentation with 5-10 minutes discussion - Tutorials: up to two hours (Monday morning) - Workshops: one hour (during evening sessions) to two hours (Monday morning) - BoFs: approximately one hour (during evening sessions) - Lightning talks: 10 minutes in total for both the presentation and any discussion The following general requirements apply: - Proposals must be submitted using the meeting submission system, https://ripe77.ripe.net/submit-topic/ - Lightning talks should also be submitted using the meeting submission system (https://ripe77.ripe.net/submit-topic/) and can be submitted any time up to and including the meeting week. The allocation of lightning talks will be announced on short notice, in some cases on the same day but often one day prior to the time slot allocated. - Presenters who propose a panel or BoF are encouraged to include speakers from several (perhaps even competing) companies and/or a neutral facilitator. - All presentation proposals will only be considered by the PC if they contain at least draft presentation slides (slides may be updated later on). For panels, proposals must contain a clear description, as well as the names of invited panellists, presenters and moderators. ---- Diversity and Inclusion - On-Site Childcare and the RIPE Meeting Code of Conduct ---- Did you know that RIPE Meetings now have on-site childcare? You can reserve a spot for your child (age 6 months – 10 years) during the registration process for the meeting. Registrations for RIPE 77 will open mid-July. Childcare places are limited, so please be quick to reserve a spot for your child! Read about the experiences of our next generation of engineers at: https://labs.ripe.net/Members/agowland/ripe-meeting-diversity-efforts-on-si… Ensuring that RIPE Meeting values are upheld and that attendees experience a professional, respectful and safe meeting is a priority. Please do read the RIPE Meeting Code of Conduct: https://www.ripe.net/participate/meetings/ripe-meetings/ripe-meeting-code-o… --- If you have any questions or requests concerning content submissions, please email pc(a)ripe.net.

1 0

Fw: celebrating 10 years of routing insecurity
by Job Snijders 10 Aug '18

10 Aug '18

FYI :-) ----- Forwarded message from Job Snijders <job(a)ntt.net> ----- Date: Fri, 10 Aug 2018 12:30:38 +0000 From: Job Snijders <job(a)ntt.net> To: nanog(a)nanog.org Subject: celebrating 10 years of routing insecurity Dear all, Today marks the 10th anniversary of the famous Kapela-Pilosov Man-in-the-middle BGP attack! It is a fantastic and innovative attack that would be worthy of referencing in the next Mr Robot season. :-) video: https://www.youtube.com/watch?v=S0BM6aB90n8 slide: https://www.defcon.org/images/defcon-16/dc16-presentations/defcon-16-piloso… So, what is the state of routing security anno 2018? It seems that as an industry we're on an upwards trajectory: various IRR registries are locking themselves down to prevent creation of unauthorized route(6) objects, new filter generation tools are becoming available, RPKI based BGP Origin Validation is slowly seeing more and more deployment, and the concept of blocking route announcements with improbable AS_PATHs is gaining popularity as well. Let's see where we are 10 years from now! Kind regards, Job ----- End forwarded message -----

1 0

Open consultaties Forum Standaardisatie
by Marco Hogewoning 10 Aug '18

10 Aug '18

All, [apologies to the non Dutch, but as this concerns Dutch government and all base documents are in Dutch as well] Voor wie ze niet kent, het Forum Standaardisatie bepaald welke standaarden de Nederlandse overheid moet gebruiken of afdwingen in aanbestedingen, hieronder vallen uiteraard ook een groot aantal IT and Internet standaarden. Deze standaarden, bijvoorbeeld IPv6, kunnen geplaatst worden op een zgn pas-toe-of-leg-uit lijst, of zelfs simpelweg benoemd worden tot verplichte standaard. Eens in de zoveel tijd wordt de lijst herzien en waar nodig aangepast, bijvoorbeeld om nieuwe versies te introduceren of gedateerde standaarden te verwijderen. Zulke wijzigingen worden gemaakt op basis van observaties of feedback van de betrokken industrie en vergezeld van een rapport met het advies van relevante experts (zelf ooit meegeschreven aan de IPv6 evaluatie). Hierna volgt een openbare consultatie, waarbij iedereen zijn of haar visie kan geven of een bepaalde standaard daadwerkelijk toegevoegd (of afgevoerd moet worden). Er loopt op dit moment een vrij uitgebreide consultatie ronde, met deadline 10 september, waar ook een aantal voor de Internet community belangrijke standaarden onder staan: - Toepassing van TLS 1.3 als vervanging van 1.2 - Uitbreiding van het toepassen van DANE en STARTTLS - Toepassing van S/MIME voor email ondertekening Mocht je nu of in de toekomst zakendoen met de Nederlandse overheid kan het zijn dat je gevraagd wordt deze standaarden te ondersteunen, en dan zou ik zeker even kijken of het nuttig is om input te leveren. Of misschien heb je veel ervaring met een van deze standaarden en wil je die expertise delen. Grijp je kans om je mening te geven, lees de rapporten en geef feedback. De lijst met standaarden en het proces staan beschreven op https://www.forumstandaardisatie.nl/thema/openbare-consultatie en daar vindt je ook het adres waar je je commentaar naartoe kan sturen. Groet, MarcoH (die gevraagd was om dit onder de aandacht te brengen van relevante stakeholders) -- "Life is like riding a bicycle. To keep your balance you must keep moving" -- Albert Einstein

2 2

NLNOGday 2018: We're sold out!
by Nathalie Trenaman 10 Aug '18

10 Aug '18

Hi all, We just (1 minute ago) reached that point where all 200 tickets for NLNOGday 2018 are gone! The location is set, the program is almost finished and it’s going to be a fun and inspiring day again. If you still want to attend but didn’t register yet, please drop an e-mail to events(a)nlnog.net <mailto:events@nlnog.net> and we’ll add you to the waiting list. In case you already know you can’t make it to NLNOGday on the 7th of September, also please let us know, so we can pass your ticket to someone else. This has worked very well last year, we ended up with no-one on the waiting list and very few no-shows. All information about the program and location can be found here: https://nlnog.net/nlnog-day-2018/ <https://nlnog.net/nlnog-day-2018/> Looking forward to see you all on the 7th of September! Cheers, Nathalie

2 1

Spoofer Report for NLNOG for Jul 2018
by CAIDA Spoofer Project 08 Aug '18

08 Aug '18

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within nld. Inferred improvements during Jul 2018: none inferred Source Address Validation issues inferred during Jul 2018: ASN Name First-Spoofed Last-Spoofed 28878 SIGNET 2018-06-27 2018-07-11 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=nld&no_block=1 Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

NLNOG Day 2018 Fellowship
by Job Snijders 31 Jul '18

31 Jul '18

Dear all, On September 7th we're hosting the annual NLNOG Day - a gathering in Amsterdam for network- and system enthusiasts. We've got an excellent set of speakers that make it worth your while to drop by and participate All info can be found here: https://nlnog.net/nlnog-day-2018/ NLNOG RING Fellowship --------------------- This year we'd like to make it possible for someone based outside the Netherlands (who normally wouldn't be able to attend the NLNOG Day), to come over and participate. The NLNOG Foundation will cover travel costs & lodging. In return, we ask that you give a presentation about a problem scenario where the NLNOG RING was critical in helping analyse or identify some kind of problem. The talk will be recorded. The goal of the talk is to inspire other operators on novel uses of the NLNOG RING, or to join the RING! If this sounds cool to you, please reach out to stichting(a)nlnog.net and we'll discuss the problem scenario & presentation and other logistical aspects. The board will review all applications select one candidate. Kind regards, Job NLNOG Foundation

1 0

RIPE77 in Amsterdam!
by Nathalie Trenaman 30 Jul '18

30 Jul '18

Hoi allemaal, In oktober is er weer een RIPE meeting in Amsterdam en het zou leuk zijn een flinke delegatie NLNOGers daar te zien. Hieronder staat de mail die Martina (onze event organiser) heeft rondgestuurd. Cheers, Nathalie ------ Dear colleagues, You can now register for the RIPE 77 Meeting at: https://ripe77.ripe.net/attend/register/ <https://ripe77.ripe.net/attend/register/> RIPE 77 will take place at the Hotel Okura in Amsterdam from 15-19 October 2018. ------------- Ticket Options ------------- Week ticket: EUR 350 Day ticket: EUR 125 Student (week) ticket: EUR 50 You can find more information about ticket options at: https://ripe77.ripe.net/attend/ <https://ripe77.ripe.net/attend/> ------------- Call for Presentations ------------- The RIPE Programme Committee (PC) is now seeking content proposals from the RIPE community for the plenary sessions, BoFs (Birds of a Feather sessions), workshops, tutorials and lightning talks at RIPE 77. Proposals must be submitted for full consideration no later than 27 August. More information at: https://ripe77.ripe.net/cfp/ <https://ripe77.ripe.net/cfp/> ------------- RIPE Fellowship ------------- If you are in the RIPE NCC service region and need financial assistance to attend RIPE 77, please consider applying for a RIPE Fellowship. We will cover travel, accommodation and a full-week meeting ticket. Apply before 29 August at: https://www.ripe.net/participate/ripe/ripe-fellowship <https://www.ripe.net/participate/ripe/ripe-fellowship> ------------- RACI ------------- The RIPE Academic Cooperation Initiative (RACI) will cover the cost of the meeting ticket, travel and accommodation for successful applicants to present their research at RIPE 77. Apply before 12 August at: https://www.ripe.net/raci/ <https://www.ripe.net/raci/> ---------------- Quantum Internet Hackathon ---------------- The next RIPE NCC Hackathon will be held the weekend before the RIPE 77 meeting in Amsterdam (13-14 October). You can already apply at: https://www.ripe.net/participate/forms/apply/quantum-internet-hackathon/ <https://www.ripe.net/participate/forms/apply/quantum-internet-hackathon/> ------------- Discounted Room Rates ------------- The Hotel Okura and other hotels nearby are offering RIPE 77 attendees a discounted room rate, which is subject to availability. Reserve now to avoid disappointment at: https://ripe77.ripe.net/venue/accommodation/ <https://ripe77.ripe.net/venue/accommodation/> ------------- On-site Childcare ------------- We're making it easier for parents to fully participate in the RIPE Meeting by offering professional, on-site childcare at the meeting venue for children aged 6 months to 10 years. Space is limited, so be sure to register soon to confirm your child's place. For more information and to register, see: http://ripe77.ripe.net/on-site/on-site-childcare/ <http://ripe77.ripe.net/on-site/on-site-childcare/> ---------------- RIPE Networking App ---------------- We are pleased to announce that the RIPE Networking App is available to use for RIPE 77. It's a simple way to schedule meetings with other attendees who are using the app. You’ll need a RIPE NCC Access account to use the app. To learn more, please visit: https://ripe77.ripe.net/on-site/ripe-networking-app/ <https://ripe77.ripe.net/on-site/ripe-networking-app/> ---------------- Important Dates and Deadlines ---------------- RACI: 12 August RIPE 77 CfP: 27 August RIPE Fellowship: 29 August Quantum Internet Hackathon: 13-14 October RIPE 77: 15-19 October Discounted hotel rooms: First come, first served – limited rooms available On-site childcare: First come, first served – limited places available More information on RIPE 77 can be found at: https://ripe77.ripe.net/ <https://ripe77.ripe.net/> Follow us on Twitter: @ripemeeting, #RIPE77 See you in Amsterdam in October! Kind regards, RIPE Meetings Organisation Team

4 3

FW: NTT now treats RPKI ROAs as IRR route(6)-objects
by Job Snijders 20 Jul '18

20 Jul '18

FYI ----- Forwarded message from Job Snijders <job(a)ntt.net> ----- Date: Thu, 19 Jul 2018 21:08:12 +0000 From: Job Snijders <job(a)ntt.net> To: routing-wg(a)ripe.net Subject: NTT now treats RPKI ROAs as IRR route(6)-objects Dear RIPE Routing-WG, [ TL:DR - From now on, NTT / AS 2914 allows customers to either register their announcements in the IRR, or as RPKI ROAs. This is a convenience service for relevant regions of the world where IRR is not the norm but RPKI is commonly available. Previously NTT only accepted IRR and ARIN-WHOIS. I hope competitors and partners will use this approach too! ] As most of you know, the Resource Public Key Infrastructure (RPKI) is a modern reimagination of the good ole' IRR system we have come to love and hate. The main advantage of the RPKI is that a consumer of the data can cryptographically verify whether it was the actual owner of the IP prefix that created a so-called "RPKI ROA". (more reading: https://en.wikipedia.org/wiki/Resource_Public_Key_Infrastructure) Given that RPKI ROAs are somewhat equivalent to IRR route-objects, but more reliable in terms of authoritativeness, NTT now has an automated nightly process that converts RPKI information into IRR format so that our toolchain can consume the data as if it were just another IRR source. Using RPKI ROAs as if they are IRR route(6)-objects is a transitional step towards increased security in the routing ecosystem. We are not the first to explore this method (see post-scriptum), but I think we are the first to republish elements from RPKI ROAs via a publicly accessible IRRd instance queryable with the RADB IRRd protocol. This means that anyone that points their bgpq3 or peval programs at rr.ntt.net can leverage this method without having to update anything else in the pipeline. An example can be inspected here: job@eng0 ~$ whois -h rr.ntt.net 193.0.6.139 [Querying rr.ntt.net] [rr.ntt.net] route: 193.0.0.0/21 descr: RIPE-NCC origin: AS3333 mnt-by: RIPE-NCC-MNT changed: unread(a)ripe.net 20000101 source: RIPE remarks: **************************** remarks: * THIS OBJECT IS MODIFIED remarks: * Please note that all data that is generally regarded as personal remarks: * data has been removed from this object. remarks: * To view the original object, please query the RIPE Database at: remarks: * http://www.ripe.net/whois remarks: **************************** route: 193.0.0.0/21 descr: RPKI ROA for 193.0.0.0/21 remarks: This route object represents routing data retrieved from the RPKI remarks: The original data can be found here: https://rpki.gin.ntt.net/r/AS3333/193.0.0.0/21 remarks: This route object is the result of an automated RPKI-to-IRR conversion process. remarks: maxLength 21 origin: AS3333 mnt-by: MAINT-JOB changed: job(a)ntt.net 20180718 source: RPKI # Trust Anchor: RIPE NCC RPKI Root job@eng0 ~$ The first object is an actual IRR "route:" object from the RIPE NCC operated IRR, the second object is a representation of the RPKI ROA in RPSL format published via rr.ntt.net. In general we can state that RPKI data is very good quality data, however please keep in mind that it may not be /correct/ data. In this context "Good Quality" means that it cannot easily be forged or tampered with by adversaries (but of course that doesn't protect the legitimate owner against making misconfigurations). Just like with IRR route(6)-objects, owners may input the wrong origin ASN in this type of object or configure the wrong MaxLength. NTT operates a "RPKI Cache Validator" at https://rpki.gin.ntt.net/ Everyone is free to inspect and click around in this webinterface. Instead of https://rpki.gin.ntt.net/, there also is a command line interface available via BGPMon's whois service: job@vurt ~$ whois -h whois.bgpmon.com 193.0.0.0/21 % This is the BGPmon.net whois Service % You can use this whois gateway to retrieve information % about an IP adress or prefix % We support both IPv4 and IPv6 address. % % For more information visit: % https://portal.bgpmon.net/bgpmonapi.php Prefix: 193.0.0.0/21 Prefix description: RIPE-NCC Country code: NL Origin AS: 3333 Origin AS Name: Reseaux IP Europeens Network Coordination Centre (RIPE NCC) RPKI status: ROA validation successful First seen: 2011-10-19 Last seen: 2018-07-19 Seen by #peers: 77 Notice in the above output the "ROA validation successful". Nota bene: the fact that NTT uses RPKI ROA information in the prefix filter generation process - does _not_ mean that NTT does "RPKI Origin Validation" for BGP updates (yet). RPKI Origin Validation is an additional security layer that we hope to deploy in the not too distant future. Using RPKI ROAs in this way is an important step forward in this process. Kind regards, Job Snijders Post scriptum on prior work: Dragon Research Labs implemented the idea in 2015: https://github.com/dragonresearch/rpki.net/blob/master/potpourri/roa-to-irr… RIPE NCC's RPKI Validator added RPSL export functionality in 2015: https://mailman.nanog.org/pipermail/nanog/2015-May/075185.html Arouteserver added native support for this method in October 2017. https://github.com/pierky/arouteserver/issues/19 ----- End forwarded message -----

2 2

deploying RPKI based Origin Validation
by Job Snijders 19 Jul '18

19 Jul '18

Volgens mij gaat Nederland wereldleider routing security worden! Hoe/waar zijn jullie met implementaties van RPKI Origin Validation? Hebben mensen hulp nodig? Groeten, Job ----- Forwarded message from Job Snijders <job(a)ntt.net> ----- Date: Thu, 12 Jul 2018 17:50:29 +0000 From: Job Snijders <job(a)ntt.net> To: nanog(a)nanog.org Subject: deploying RPKI based Origin Validation Hi all, I wanted to share with you that a ton of activity is taking place in the Dutch networker community to deploy RPKI based BGP Origin Validation. The mantra is "invalid == reject" on all EBGP sessions. What's of note here is that we're now seeing the first commercial ISPs doing Origin Validation. This is a significant step forward compared to what we observed so far (it seemed OV was mostly limited to academic institutions & toy networks). But six months ago Amsio (https://www.amsio.com/en/) made the jump, and today Fusix deployed (https://fusix.nl/deploying-rpki/) We've also seen an uptake of Origin Validation at Internet Exchange route servers: AMS-IX and FranceIX have already deployed. I've read that RPKI OV is under consideration at a number of other exchanges. Other cool news is that Cloudflare launched a Certificate Transparency initiative to help keep everyone honest. Announcement at: https://twitter.com/grittygrease/status/1017224762542587907 Certificate Transparency is a fascinating tool, really a necessity to build confidence in any PKI systems. Anyone here working to deploy RPKI based Origin Validation in their network and reject invalid announcements? Anything of note to share? Kind regards, Job ----- End forwarded message -----

5 8

Implementation plan and dates for NWI5 - Out-of-region ROUTE(6) objects and removal of ASN authorisation for ROUTE(6) object creation.
by Nathalie Trenaman 19 Jul '18

19 Jul '18

Dear colleagues, In February 2018, the RIPE Database Working Group reached consensus on NWI-5 - creating out of region ROUTE(6) objects in the RIPE Database. We will soon be making changes to the way out-of-region objects are handled in the RIPE Database. It's important that database users are aware of these changes and what they mean: 1. The RIPE Routing Registry will no longer support the creation of out-of-region ROUTE(6) and AUT-NUM objects 2. Existing out-of-region objects will have their "source:” attribute changed to "RIPE-NONAUTH” 3. The creation of ROUTE(6) objects will no longer need authorisation from the ASN holder We will implement these changes in the Release Candidate environment on Thursday, 2 August and go to full production on Tuesday, 4 September. Our implementation plan can be found at: https://www.ripe.net/manage-ips-and-asns/db/impact-analysis-for-nwi-5-imple… <https://www.ripe.net/manage-ips-and-asns/db/impact-analysis-for-nwi-5-imple…> The RIPE Database Working Group chairs also wrote a RIPE Labs article that describes the background of NWI-5: https://labs.ripe.net/Members/denis/out-of-region-route-6-and-aut-num-objec… <https://labs.ripe.net/Members/denis/out-of-region-route-6-and-aut-num-objec…> <https://labs.ripe.net/Members/denis/out-of-region-route-6-and-aut-num-objec… <https://labs.ripe.net/Members/denis/out-of-region-route-6-and-aut-num-objec…>> Please contact ripe-dbm(a)ripe.net <mailto:ripe-dbm@ripe.net> if you still have questions after reading the implementation plan. Best regards, Nathalie Trenaman Product Manager RIPE NCC

1 0