- NLNOG - NLNOG

NLNOG Camp 2018 - Call for Content
by Job Snijders 20 Apr '18

20 Apr '18

Dear all, You might have heard we're working on organising the first ever NLNOG Camp! Slowly things are falling into place, you can find the first details in this e-mail, but we haven't opened the registration yet, we will do that soon. At the moment, we are looking for your interesting content: presentations, workshops, tutorials, you name it. We will have 2 tents, one in a presentation set-up, and a workshop tent. So, if you ever wanted to give a hands on splicing workshop, tell us about your latest open source contribution, network automation, deliver a hands-on BGP how-to, show your home automation setup, talk about your IETF draft, pitch an idea, anything is possible! Send an e-mail to events(a)nlnog.net and we’ll make it work. Our funding is limited though, so if you need equipment, we're going to need your help to get it. Here are some more details about what we are planning: Date: Friday 1 June 18:00 - Sunday 3 June 13:00 Place: Scouting Landgoed Zeewolde Nulderpad 5, 3896 Zeewolde Fee: 50 Euro per person. What will you get for the 50 Euro: - A place for you and your tent from Friday 1 June 19:00 till Sunday 3 June 14:00 - Toilets and warm showers - Power - Internet - Catering Wait, what... Catering? Yes, we plan to have drinks and pizza on Friday evening, breakfast on Saturday and Sunday morning, a warm lunch on Saturday and drinks and a BBQ on Saturday evening. Still working out the details, but we'll make sure you will not be hungry or thirsty. So, think about want you want to do at NLNOG Camp and let us know! Cheers, The NLNOG Crew ps. There are hotels close by for those of you that prefer glamping!

1 0

EPF : Call for presentations
by Petra Wensing 10 Apr '18

10 Apr '18

Dear all, AMS-IX, DE-CIX, LINX and Netnod are happy to host the 13rd European Peering Forum (EPF) in Athens, Greece from the 17th – 19th September 2018. The event will welcome up to 300 peering managers and coordinators from networks connected to the host Internet exchanges. Besides an interesting topical agenda, the three-day event accommodates room for attendees to meet on a one-to-one basis to discuss bilateral peering business opportunities. Although registration is not yet open (it opens at April 13th) the programme committee is already looking for presentations and lightning talks related to peering and technical topics of interconnection. Your presentation should address: * Interconnection Automation * Regional Peering * Interconnection / Peering Internet Governance and Regulatory Topics * Economic and Product Trends * Peering / interconnection strategies * Interesting findings about peering / interconnection * 400GE and beyond Submissions =========== Presentations must be of a non-commercial nature. Product or marketing heavy talks are strongly discouraged. Submissions of presentations should be made to the programme committee <epf-pc(a)peering-forum.eu>. Please include: * Author's name and e-mail * Presentation title * Abstract * Slides (if available) * Time requested Deadlines ========= Presentation Abstract Deadline 16/07/2018 12:00 UTC Final Selection of Speakers 27/07/2018 Presentation Slides Submission Deadline 03/09/2018 12:00 UTC More information about the event and other activities around EPF13 may be found at * https://peering-forum.eu * https://www.facebook.com/groups/1486607564933665 On behalf of the EPF organisers, Best regards, Petra Wensing | Marketing Communications & Event Manager | AMS-IX Frederiksplein 42, 1017 XN Amsterdam, The Netherlands M +31 6 2231 2849 | T +31 20 305 8998 ams-ix.net

1 0

Spoofer Report for NLNOG for Mar 2018
by CAIDA Spoofer Project 10 Apr '18

10 Apr '18

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within nld. Inferred improvements during Mar 2018: ASN Name First-Fixed 60404 Liteserver 2018-03-15 29073 QUASINETWORKS 2018-03-31 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Mar 2018: ASN Name First-Spoofed Last-Spoofed 25459 NEDZONE-AS 2018-03-15 2018-03-29 44858 PROXSYS-AS 2018-03-15 2018-03-30 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=nld&no_block=1 Please send any feedback or suggestions to spoofer-info(a)caida.org

2 1

(no subject)
by TU Delft - infospoofing project 14 Mar '18

14 Mar '18

Every day, attackers exploit IP spoofing for their criminal operations. Despite being a known vulnerability for at least 25 years, IP source address spoofing still remains a popular attack method for redirection, amplification, and anonymity attacks. This situation persists partially because of the lack of visibility into which operators lack adequate anti-spoofing measures -- that is, their networks are not compliant with BCP38 and related norms. In the effort to help increase the adoption of anti-spoofing measures, researchers from TU Delft and CAIDA have been conducting measurements on which networks are compliant. We would like to engage the network operator community to reach out to non-compliant operators and instigate remediating actions. We have created an overview of our findings on networks in the Netherlands. You can see them on our website: https://www.infospoofing.com/nl/ID=68 The good news is: over 90% of Dutch operators have measures in place against IP spoofing! We would like to ask your help to get the remaining 6% on board. Feel free to share the link to our website or otherwise help mobilize the non-compliant operators. At our site, you can also find more information about anti-spoofing best practices as articulated by the MANRS initiative. Help us to make the Netherlands a spoofing-free country! Best regards, Orcun Cetin, Luigi Tuttobene, Carlos Gañán, Michel van Eeten Researchers at Delft University of Technology --- Faculteit Techniek, Bestuur en Management TU Delft Postbus 5015, 2600GA Delft +31 (0)15 27 88784

1 0

Chrome / Symantec
by Job Snijders 09 Mar '18

09 Mar '18

Hallo allen, Heads-up: https://security.googleblog.com/2018/03/distrust-of-symantec-pki-immediate.… ”Distrust of the Symantec PKI: Immediate action needed by site operators” Groeten, Job

1 0

Memcached server list
by niels=nlnog＠bakker.net 09 Mar '18

09 Mar '18

Hoi allemaal, Recent is een lijst met open memcached server en een simpel exploit van memcrashed gepost. Hier is de lijst, voorzien van AS-nummers: http://swm.pp.se/memcached-verbose.txt Zoek op je ASN (of op '| NL |' als je mensen kent). KPN, SURFnet, XS4ALL, AMSIO, Ziggo, Interconnect, Zeelandnet, Trueserver, We-Dare, TransIP, Caveo, Netholding, NedZone, ReasonNet, Denit, Edutel, NForce, Greenhost, Netrouting, i3D, SpeakUp, A2B, Leaseweb, Tilaa, HostNet zijn enkele voorbeelden van service providers die ik verwacht deze mailing list te lezen. Groeten, -- Niels. --

2 2

memcached UDP/11211 IOS XR ratelimit example
by Job Snijders 01 Mar '18

01 Mar '18

Dear all, As you've probably read by now, there we're facing a significant threat in the shape of the memcached UDP protocol. The current best practise is to apply rate-limits on all external facing ports and police UDP/11211 traffic down to something managable. This protects both your own infrastructure and your customers. Here are numerous pointers: http://www.senki.org/memcached-on-port-11211-udp-tcp-being-exploited/ I recommend adding memcached UDP/11211 to the same "exploitable ports" list as NTP, CHARGEN and SSDP. Below is a configuration example for IOS XR to rate-limit these amplification-sensitive UDP ports to 1% of of the port's capacity. ipv4 access-list exploitable-ports permit udp any eq ntp any permit udp any eq 1900 any permit udp any eq 19 any permit udp any eq 11211 any ! ipv6 access-list exploitable-ports-v6 permit udp any eq ntp any permit udp any eq 1900 any permit udp any eq 19 any permit udp any eq 11211 any ! class-map match-any exploitable-ports match access-group ipv4 exploitable-ports match access-group ipv6 exploitable-ports-v6 end-class-map ! policy-map ntt-external-in class exploitable-ports police rate percent 1 conform-action transmit exceed-action drop ! set precedence 0 set mpls experimental topmost 0 ! class class-default set mpls experimental imposition 0 set precedence 0 ! end-policy-map ! interface Bundle-Ether19 description Customer: the best customer service-policy input ntt-external-in ipv4 address xxx/x ipv6 address yyy/y ... ! interface Bundle-Ether20 service-policy input ntt-external-in ... ... etc ... Please share your own examples too! Kind regards, Job

1 0

Fwd: [nznog] Removing the four stale TAL from the APNIC RPKI validation set.
by Job Snijders 27 Feb '18

27 Feb '18

FYI ---------- Forwarded message --------- From: George Michaelson <ggm(a)apnic.net> Date: Tue, 27 Feb 2018 at 05:34 Subject: [nznog] Removing the four stale TAL from the APNIC RPKI validation set. To: <nznog(a)list.waikato.ac.nz> Updating RPKI trust anchor configuration ------------------------------------------------------- APNIC has completed the process of transitioning from its previous Resource Public Key Infrastructure (RPKI) trust anchor arrangement to a new single trust anchor configuration. Each RIR will publish an 'all resources' global trust anchor, under which its own regional resources (IP addresses and ASNs) will be certified. APNICs trust anchor is one of the previous five, which has been retained as the sole trust anchor over all APNIC resource certificate products. If you are using relying-party software, such as the Dragon Research Labs RPKI Toolkit, RPSTIR or the RIPE NCC’s RPKI Validator, you are advised to update your software’s configuration to use only the current APNIC trust anchor, rather than the set of five APNIC trust anchors that were previously in use. The update is to remove four of the five: One has been retained as the current live Trust Anchor. Note: this update is not critical. However, if it is not done, the software will log or report warnings about being unable to retrieve the trust anchors that are no longer being used. All resources now validate under the single active trust anchor and no orphan products are valid under the other prior trust anchors. The current APNIC TAL is as follows: ------ rsync://rpki.apnic.net/repository/apnic-rpki-root-iana-origin.cer MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx9RWSL61YAAYumEiU8z8 qH2ETVIL01ilxZlzIL9JYSORMN5Cmtf8V2JblIealSqgOTGjvSjEsiV73s67zYQI 7C/iSOb96uf3/s86NqbxDiFQGN8qG7RNcdgVuUlAidl8WxvLNI8VhqbAB5uSg/Mr LeSOvXRja041VptAxIhcGzDMvlAJRwkrYK/Mo8P4E2rSQgwqCgae0ebY1CsJ3Cjf i67C1nw7oXqJJovvXJ4apGmEv8az23OLC6Ki54Ul/E6xk227BFttqFV3YMtKx42H cCcDVZZy01n7JjzvO8ccaXmHIgR7utnqhBRNNq5Xc5ZhbkrUsNtiJmrZzVlgU6Ou 0wIDAQAB ------ Configuring Relying Party Software ----------------------------------------------- RIPE NCC RPKI Validator: If you upgrade to RIPE validator rpki-validator-app-2.24 the correct Trust Anchor is configured. No further work is required. Dragon Research Labs Rcynic Validator: If you run rcynic, you need to remove all the TAL, TA or CER entries in rcynic.conf except ones which point to apnic-rpki-root-iana-origin.cer or the related TAL. If you use the trusted-certs/ directory, simply remove the four files which are named for the non-APNIC RIR as follows: cd /etc/trust-anchors # or wherever you place the TAL files rm apnic-rpki-root-ripe-origin.tal rm apnic-rpki-root-arin-origin.tal rm apnic-rpki-root-lacnic-origin.tal rm apnic-rpki-root-afrinic-origin.tal RPSTIR To modify an installed RPSTIR system, locate the /usr/local/etc/rpstir directory and remove all but the current live APNIC TAL. More information is in the attached PDF describing how to update the trust anchor configuration in these three popular relying-partner software systems. -George _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz https://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

What if… DNS over TCP?
by Mark Schouten 09 Feb '18

09 Feb '18

Hi, I've had this idea, read about it and let me know what you think. https://www.tuxis.nl/blog/what-if-dns-over-tcp-20180207/ -- Kerio Operator in de Cloud? https://www.kerioindecloud.nl/ Mark Schouten | Tuxis Internet Engineering KvK: 61527076 | http://www.tuxis.nl/ T: 0318 200208 | info(a)tuxis.nl

3 3

Call for presentations RIPE 76
by Benno Overeinder 23 Jan '18

23 Jan '18

Dear colleagues, Please find the CFP for RIPE 76 below or at: https://ripe76.ripe.net/submit-topic/cfp/. The deadline for submissions is *11 March 2018*. Please also note that speakers do not receive any extra reduction or funding towards the meeting fee at the RIPE Meetings, see the "Speakers" paragraph in CFP for more information. Kind regards, Benno Overeinder RIPE PC Chair https://ripe76.ripe.net/ripe-pc/ -------------------->>><<<-------------------- Call for Presentations A RIPE Meeting is an open event where Internet Service Providers, network operators and other interested parties get together. Although the meeting is mostly technical, it is also a chance for people to meet and network with others in their field. RIPE 76 will take place from 14-18 May in Marseille, France. The RIPE Programme Committee (PC) is now seeking content proposals from the RIPE community for the plenary sessions, BoFs (Birds of a Feather sessions), panels, workshops, tutorials and lightning talks at RIPE 76. See the full descriptions of the different presentation formats, https://ripe76.ripe.net/submit-topic/presentation-formats/. Proposals for plenary sessions, BoFs, panels, workshops and tutorials must be submitted for full consideration no later than *11 March 2018*. Proposals submitted after this date will be considered depending on the remaining available space in the programme. The PC is looking for presentations covering topics of network engineering and operations, including but not limited to: - IPv6 deployment - Managing IPv4 scarcity - Data centre technologies - Network and DNS operations - Internet governance and regulatory practices - Network and routing security - Content delivery - Internet peering and mobile data exchange - Connected Things (aka. Internet of Things - IoT) Speakers Presenters, RIPE Working Group Chairs and the RIPE Programme Committee are required to cover their own costs to attend a RIPE Meeting (meeting ticket, travel and accommodation). We have various ticket options available depending on your needs. In extraordinary circumstances, the RIPE Chair can waive the meeting fee for presenters. These requests are dealt with on a case-by-case basis via pc(a)ripe.net. Also note that, on an individual basis, participants can apply for a RIPE Fellowship to develop their professional or academic career. For more information, please visit: https://www.ripe.net/participate/ripe/ripe-fellowship Submissions Presenters should be clear on whether they wish to submit a presentation for a plenary or working group (WG) session. At present, most working groups will solicit policy proposals, discussion points or other content directly via their mailing lists. If you’re not sure what kind of session you should be presenting at, please visit: https://ripe76.ripe.net/plenary-or-wg/ RIPE Meeting attendees are quite sensitive to keeping presentations non-commercial, and product marketing talks are strongly discouraged. Repeated audience feedback shows that the most successful talks focus on operational experience, research results, or case studies. For example, presenters wishing to describe a commercial solution should focus on the underlying technology and not attempt a product demonstration. Presenters should indicate how much time they will require. In general, the time allocated for the different presentation formats is as follows: - Plenary presentations: 20-25 minutes presentation with 5-10 minutes discussion - Tutorials: up to two hours (Monday morning) - Workshops: one hour (during evening sessions) to two hours (Monday morning) - BoFs: approximately one hour (during evening sessions) - Lightning talks: 10 minutes total for both presentation and any discussion The following general requirements apply: - Proposals must be submitted using the meeting submission system, https://ripe76.ripe.net/submit-topic/ - Lightning talks should also be submitted using the meeting submission system (https://ripe76.ripe.net/submit-topic/) and can be submitted any time up to and including the meeting week. The allocation of lightning talks will be announced on short notice, in some cases on the same day but often one day prior to the time slot allocated. - Presenters who propose a panel or BoF are encouraged to include speakers from several (perhaps even competing) companies and/or a neutral facilitator. - All presentation proposals will only be considered by the PC if they contain at least draft presentation slides (slides may be updated later on). For panels, proposals must contain a clear description, as well as the names of invited panellists, presenters and moderators. If you have any questions or requests concerning content submissions, please email pc(a)ripe.net. -- Benno J. Overeinder NLnet Labs https://www.nlnetlabs.nl/

1 0