- NLNOG - NLNOG

Can a Customer take their IP's with them? (Court says yes!)
by homme＠cambrium.nl 29 Jun '04

29 Jun '04

On Tue, 2004-06-29 at 09:37, Arjan wrote: > Je denkt nu alleen in colo oid, maar what about klanten die een /24 hebben > en deze in hun kantoornetwerk gebruiken. > > "Sorry, maar ik moet dan 250 machines omconfigureren, we maken gebruik van > trust-relaties op basis van IP adres, etc." Dat is dan dom van ze, want alle RFCs geven duidelijk aan dat je dat niet op IP adres moet doen maar op basis van domeinnaam. Als ze iemand willen aanklagen, gaan ze maar naar het bedrijf/de personen die dit soort dingen fout voor ze hebben geconfigureerd. De IP range die de klant nu claimed, zal ie bij RIPE moeten gaan claimen en niet bij de ISP, dat lijkt me ook een goede manier om snel van dit soort gezever af te komen. Als we met z'n allen dit soort types direct naar RIPE doorsturen gaan ze daar te horen krijgen dat RIPE er geen zin in heeft en dat die het in heel europa voor het zeggen hebben. Als er dan nog geneuzel is, dan gaat dat naar RIPE, die hebben daar hele goede juristen voor die van het geld wat ze van de ISPs krijgen betaald worden om dit soort randdebielen uit ons vaarwater te houden. H.

1 0

Can a Customer take their IP's with them? (Court says yes!)
by alex＠bit.nl 29 Jun '04

29 Jun '04

On Tue, 29 Jun 2004, Arjan wrote: > Je nummer van je SIM kaart (bestaat dat? volgens mij is je EMEI je layer-2 > adressering) vormt in die hoedanigheid geen instrument dat van belang kan > zijn voor de klant, een IP adres is dat wel (althans: de klant kan > argumenten aanvoeren waarom dat zo zou zijn). Je SIM heeft ook een nummer, GSM nummers zijn gebonden aan je SIM, niet aan je telefoon. Het nummer van je SIM staat op de factuur vermeld, bij KPN in ieder geval. > Ik ben het met je stelling eens, de vraag is of een clueless klant een > onnozele rechter cq. toezichthouder zover kan krijgen hem te steunen in > z'n onnozele mening. Argh, the horror ! In Nederland zou dat een klusje voor OPTA zijn. Die krijgen we er wel van overtuigd denk ik. -- Met vriendelijke groet, Alex Bik, BIT BV AB2298-RIPE

1 0

Can a Customer take their IP's with them? (Court says yes!)
by alex＠bit.nl 29 Jun '04

29 Jun '04

On Tue, 29 Jun 2004, Arjan wrote: > Gezien de gedwongen portabiliteit bij telecom operators en in het > bankwezen is een dergelijke angst niet eens zo ver van ons bed, ben ik > bang. Ik zie dat anders. Als je van mobiele operator verandert kun je inderdaad je telefoonnummer (domeinnaam) meenemen, maar niet het nummer van je SIM kaart (IP adres). -- Met vriendelijke groet, Alex Bik, BIT BV AB2298-RIPE

1 0

Can a Customer take their IP's with them? (Court says yes!)
by homme＠cambrium.nl 29 Jun '04

29 Jun '04

On Tue, 2004-06-29 at 09:28, Arjan wrote: > On Tue, 29 Jun 2004 at 09:23 +0200, Homme R. Bitter wrote: > > > Amerikaanse toestanden. > > Gezien de gedwongen portabiliteit bij telecom operators en in het > bankwezen is een dergelijke angst niet eens zo ver van ons bed, ben ik > bang. Daarom zijn domeinnamen portable. Juist om te zorgen dat niet-portable IP space geen probleem is, kan je daarmee toch van provider veranderen zonder dat je klanten of je andere computersystemen je machines niet meer weten te vinden. Zolang dat als argument gebruikt blijft worden, moet het mogelijk zijn om de IP space bij de providers te houden. H.

1 0

[alex@nac.net: Can a Customer take their IP's with them? (Court says yes!)]
by sabri＠cluecentral.net 29 Jun '04

29 Jun '04

Quote van Patrick Gilmore: >Who cares what the court thinks? Are you mentioned in the TRO? If >not, do a quick look at all CIDRs in ^8001$ and find any sub-CIDRs >without _8001_ in the path. Your routers, you decide what to do with >the prefix. >Of course, if you just happen to uphold INTERNET STANDARDS and only >accept routes from where they should originate, I'll buy you a drink at >the next NANOG for being a good netizien. :) ----- Forwarded message from Alex Rubenstein <alex at nac.net> ----- Date: Mon, 28 Jun 2004 23:24:27 -0400 (Eastern Standard Time) From: Alex Rubenstein <alex(a)nac.net> To: nanog at nanog.org Subject: Can a Customer take their IP's with them? (Court says yes!) Please read -- this is lengthy, and important to the industry as a whole. We ask for, and solicit, comments, letters of support, etc., for our position. We are looking for people to take a position on this, and come forward, perhaps even to provide an affidavit or certification. Something along the lines of a 'friend of the court' brief, or even comments as to why we are wrong. Read on. There has been a Temporary Restraining Order (TRO) issued by state court that customers may take non-portable IP space with them when they leave their provider. Important to realize: THIS TEMPORARY RESTRAINING ORDER HAS BEEN GRANTED, AND IS CURRENTLY IN EFFECT. THIS IS NOT SOMETHING THAT COULD HAPPEN, THIS IS SOMETHING THAT HAS HAPPENED. THERE IS AN ABILITY TO DISSOLVE IT, AND THAT IS WHAT WE ARE TRYING TO DO. This is a matter is of great importance to the entire Internet community. This type of precedent is very dangerous. If this ruling is upheld it has the potential to disrupt routing throughout the Internet, and change practices of business for any Internet Service Provider. In the TRO, the specific language that is enforced is as follows: "NAC shall permit CUSTOMER to continue utilization through any carrier or carriers of CUSTOMER's choice of any IP addresses that were utilized by, through or on behalf of CUSTOMER under the April 2003 Agreement during the term thereof (the "Prior CUSTOMER Addresses") and shall not interfere in any way with the use of the Prior CUSTOMER Addresses, including, but not limited to: (i) by reassignment of IP address space to any customer; aggregation and/or BGP announcement modifications, (ii) by directly or indirectly causing the occurrence of superseding or conflicting BGP Global Routing Table entries; filters and/or access lists, and/or (iii) by directly or indirectly causing reduced prioritization or access to and/or from the Prior CUSTOMER Addresses, (c) provide CUSTOMER with a Letter of Authorization (LOA) within seven (7) days of CUSTOMER's written request for same to the email address/ticket system (network at nac.net) and (d) permit announcement of the Prior CUSTOMER Addresses to any carrier, IP transit or IP peering network." We believe this order to be in direct violation of ARIN policy and the standard contract that is signed by every entity that is given an allocation of IP space. The ARIN contract strictly states that the IP space is NOT property of the ISP and can not be sold or transferred. The IP blocks in question in this case are very clearly defined as non-portable space by ARIN. Section 9 of ARIN's standard Service Agreement clearly states: "9. NO PROPERTY RIGHTS. Applicant acknowledges and agrees that the numbering resources are not property (real, personal or intellectual) and that Applicant shall not acquire any property rights in or to any numbering resources by virtue of this Agreement or otherwise. Applicant further agrees that it will not attempt, directly or indirectly, to obtain or assert any trademark, service mark, copyright or any other form of property rights in any numbering resources in the United States or any other country." [ Full ARIN agreement http://www.arin.net/library/agreements/rsa.pdf ] Further, it is important to realize that this CUSTOMER has already gotten allocations from ARIN over 15 months ago, and has chosen not to renumber out of NAC IP space. They have asserted that ARIN did not supply them with IP space fast enough to allow them to renumber. Since they have gotten allocations from ARIN, we are confident they have signed ARIN's RSA as well, and are aware of the above point (9). If this ruling stands and a new precedent is set, any customer of any carrier would be allowed to take their IP space with them when they leave just because it is not convenient for them to renumber. That could be a single static IP address for a dial-up customer or many thousands of addresses for a web hosting company. This could mean that if you want to revoke the address space of a spammer customer, that the court could allow the customer to simply take the space with them and deny you as the carrier (and ARIN) their rights to control the space as you (and ARIN) see fit. REMEMBER, THE INTERNET USED TO BE BASED UPON PORTABLE IP SPACE, AND IS NO LONGER FOR SEVERAL TECHNICAL REASONS. It is important to understand that this is not a situation where a customer is being forced to leave on short notice. NAC has not revoked the IP space of the customer. This is a situation where a customer is exercising their option not to renew their services and is leaving voluntarily. In addition the customer in question was granted their own IP space OVER A YEAR AGO and simply chose not to renumber their entire network. The key issue is that they want to take the space with them AFTER they leave NAC and are NO LONGER A CUSTOMER. Why this TRO is bad for the Internet: 1. It undermines ARIN's entire contract and authority to assign IP space. 2. It means that once IP addresses have been assigned / SWIP'ed to a Customer that the Customer may now have the right to continued use of those addresses even if the customer leaves the service of the Provider. In other words the right of the Provider to maintain control and use of the address space assigned to his network, is to now be subject to the Customer going to a State Court and getting an Order to take such space with them. Instead of the Addresses being allocated by delegated authority of the Department of Commerce and ARIN they become useable by anyone who convinces a Judge that they have a need for the addresses. It appears the Customer can keep the addresses for as long as it pleases the State Court and as long as the Customer can judicially hijack the space. The tragic part of this is that the Court which issues the Order does not even have to hear expert testimony. So the Court can issue such Order without fully understanding the Internet Technology that is affected or the havoc it could cause in National and International Communications. 3. Significant potential for routing havoc as pieces of non-portable blocks of space are no longer controlled by the entity that has the assignment from ARIN, but by the end user customer for as long as that customer wants to use them. If the customer was causing a routing problem by improper routing confirmation the carrier would lose their authority to revoke or limit the use of the IP space to protect the stability of the carrier's network. In other words, court-compelled LOAs are a 'bad thing.' 4. Because the IP space is still assigned to the carrier, the carrier would potentially be responsible to continue to respond to all SPAM and hacking complaints, DMCA violations, and all other forms of abuse. All of this abuse responsibility and liability would continue with no recourse to revoke or limit IP space of that customer and no ability to receive financial compensation for that task. This is not a theoretical problem, in the case of this customer we have received numerous abuse complaints throughout their history as a customer. While they have generally resolved these issues, it still is a real cost for us to handle. This is something that has the potential to create a massive burden for the carrier. 5. It would fundamentally change the long standing policy that the carrier that has the IP space assigned to them has the right to assign and revoke the IP space as it sees fit, and that the customer has no rights to the IP space other then the rights that the carrier gives them (through a delegation from ARIN). 6. If the customer is being DDOSed, or attacked (perhaps they may even instigate it purposely), and then stops announcing the more specific routes, the attack when then flow to us, the innocent bystander. Essentially, the customer could cause a DDOS for which I will then be billed for. This type of thing has been known to happen in the past (but not with this CUSTOMER). As you can see, this TRO has widespread effects, and is something that everyone in the industry could be affected by. If this precedent is set, you will soon have everyone acting as if IP's are property, and something that they are entitled to. I ask for input from everyone in the community on this. We don't think we're crazy, but want to make sure. ----- End forwarded message ----- -- Sabri, "I route, therefore you are" Bescherm de digitale burgerrechten: http://www.bof.nl/donateur.html

2 1

Hammer-time ...
by erik＠is.nl 24 Jun '04

24 Jun '04

Geachte NLNOG'ers, IS Interned Services heeft in de afgelopen periode een vrij grote toename gezien in de hoeveelheid relay-denied messages van zombie PC's. De hoeveelheid email welke per 12 Juni 2004 hierdoor is binnen gekomen, ligt in de buurt van het twintigvoudige van wat we daarvoor per dag binnen kregen. We zijn momenteel bezig met het automatisch parsen van de error-meldingen van dit gebeuren. IP's die meer dan 100 Relay denied messages genereren worden op een blacklist gezet. We hebben zelfs een aantal IP nr's die meer dan 50.000 meldingen genereren binnen 1 dag... Het is onze bedoeling om deze hammering IP nr's 24 uur op de blacklist te houden en ze daarna weer een kans te geven. Aangezien het weinig nut heeft om deze IP's op een lijst te hebben, als er verder niets mee gedaan wordt, zouden we graag per ISP een werkend (abuse@) email adres willen hebben, waar we de meldingen binnenkort automatisch heen kunnen sturen. Hierdoor kunnen deze IP's zsm ge-blackholed worden bij de ISP waar het vandaan komt of kan de Helpdesk van de ISP zelf contact met hun klant opnemen. Als je dit emailadres niet publiekelijk mag/wilt communiceren op deze lijst, gaarne mij dan off-list per email jullie werkende adres te geven. Ik weet dat Sabri van BIT ( sabri at bit.nl ) ook met zo'n lijst bezig is, ivm de VIRBL (http://virbl.bit.nl ) dus als je toch mailt, zet hem direct even op de cc: ;) De toepassing is vrijwel hetzelfde.. Ons project is nog niet in een status waar het voor algemeen gebruik beschikbaar is, maar zodra dat zover is, laten we het weten. Met vriendelijke groeten, Erik Bais -------- I S - I N T E R N E D - S E R V I C E S - B V -------- domeinregistratie - webhosting - colocating - dedicated servers www.is.nl - info at is.nl - T: 0299-476185 Gorslaan 18 - 1441 RG - Purmerend ---------------------------------------------------------------

1 0

ISC DHCPD lek
by sabri＠cluecentral.net 23 Jun '04

23 Jun '04

http://www.us-cert.gov/cas/techalerts/TA04-174A.html -- Sabri, "I route, therefore you are" Bescherm de digitale burgerrechten: http://www.bof.nl/donateur.html

1 0

meer discussie!
by niels＠fusix.nl 22 Jun '04

22 Jun '04

On Tue, Jun 22, 2004 at 03:50:12PM +0200, Arien Vijn wrote: > >Dat laatste niet, maar er zijn mensen die slechte ervaringen hebben met > >het bespreken van bepaalde zaken binnen nlnog (waarmee ik, naast de > >mailing list, ook op het IRC-kanaal doel) > > Verklaar u nader voor wat de mailing list betreft. Het concrete voorbeeld kan ik niet meer vinden (dat staat nog op een harde schijf die ergens ten kantore van Demon moet liggen, waarschijnlijk) maar het kwam erop neer dat iets dat 'in vertrouwen' en semi-grappig op deze lijst was gezegd, ineens bij een potentiele klant terechtkwam. Nu had de persoon in kwestie waarschijnlijk moeten beseffen dat de verspreiding van deze mailing list best groot is en ik wil er dus ook geen al te groot punt van maken, vooral omdat de grote verspreiding juist een pluspunt moet zijn (een van de oorspronkelijke ideeen van de lijst was namelijk om snel berichten uit te kunnen wisselen als "Bij ons doet Enertel het niet meer in de regio 043, bij jullie ook?", om maar een willekeurig voorbeeld te noemen). Ik geef toe dat mijn grootste zorg het IRC-kanaal is. Het lijkt me echter niet dat dat onder de hier besproken charter moet gaan vallen. -- Niels Raijer | "Everyone knows niels at fusix.nl | that rivers will swell http://www.fusix.nl | But they always find money for floods..."

4 3

meer discussie!
by bvisser-nlnog＠xs4all.nl 22 Jun '04

22 Jun '04

> Sabri, > > On Tue, 22 Jun 2004, Sabri Berisha wrote: > >> Meningen? > > Sinds wanneer is NLNOGs charter gelijk geworden aan die van NSP-SEC? Inderdaad, het charter kwam mij ook al bekend voor. Ik vind de voorwaarden van NSP-SEC gegeven het doel en doelgroep [en uit te sluiten doelgroepen] begrijpelijk, maar voor nlnog , in elk geval gezien de discussies van de afgelopen jaren enigzins overkill. Ik heb in elk geval niet de indruk dat er op nlnog dingen bewust niet besproken zijn, of discussies afgebroken/doodgebloed omdat het (informele) charter niet is zoals dat van nsp-sec . Voorzover nlnog een .nl variant van nanog (of swinog etc) wil zijn, hoort daar m.i. ook een wat ruimer charter bij dan dat van nsp-sec . Boudewijn > > Tx, > Said. > > _______________________________________________ > NLNOG mailing list > NLNOG at nlnog.net > http://mailman.nlnog.net/mailman/listinfo/nlnog >

2 1

meer discussie!
by sabri＠cluecentral.net 22 Jun '04

22 Jun '04

Hi, Naar aanleiding van wat discussie in het IRC kanaal, bijgaand de volgende 'voorwaarden' die ik vond over een soortgelijke mailinglijst als nlnog. Mijn voorstel is om iets soortgelijks van toepassing te verklaren op deze lijst. Met name het stukje over vertrouwelijkheid (als ik op deze lijst zeg dat AS12859 netwerkpanne had wil ik dat niet morgen op Webwereld teruglezen) staat mij wel aan. Uiteraard zou eea ook van toepassing zijn op het irc kanaal. Meningen? "Cyber defenders, ever vigilant, ever responsive." -Marjorie Gilbert, 2003 Step one is to insure you meet the qualifications for NLNOG. Some common questions to ask yourself are: Do you work for some type of IP transit provider, huge multi-homed content provider, or service provider? Does your job include Operational Services? Are you willing to offer free services, data, forensic, and other monitoring data to the NOG community? Do you have authorization to actively mitigate incidents in your network? Do you actually log into a router and do something to mitigate an attack or call someone to task them to do the work? Do you have the time for a real-time NSP mitigation forum? If yes, then you might fit the expectations to be on the NLNOG Mitigation or Discussion Forums. NLNOG PARTICIPATION EXPECTATIONS NLNOG is a forum to get work done in the service of the community. As such, realistic expectations are placed on the NLNOG membership. These expectations are periodically reviewed by the NLNOG moderators to ensure that an individuals community membership is relevant, productive, and adds value to the mission of NLNOG. These expectations, which have evolved through active membership feedback include: All posts to NLNOG must have an organizational affiliation via either a corporate email address that is identifable as an ISP/NSP, or via a signature that includes your organizational affiliation or ASN. Lurking and learning does not contribute to the community there are other forums for that. Silence often indicates that people are not handling the information provided by the NLNOG community or that the information provided is of little relevence to the member. Acknowledgements of action whether publicly on the mailing list or privately to the people involved provides members of the community an indication that contributions are being made. Recognizing specific national laws, regulations, and/or corporate policies may prevent some members from posting on the public NLNOG alias; these limitations do not prevent private mitigation correspondence. Taking information provided on the NLNOG forums and using it for commercial gain is not allowed. It is a violation of trust to the community. NLNOG is built on trust. Therefore, reposting NLNOG communications to individuals inside or outside your organization is a violation of that trust. NLNOG members should have the span of control to take action on the information from an NLNOG correspondence without widely posting the information inside their organization. If forwarding inside the organization is required, permission of the posters must be sought. NLNOG postings must not be CCed or BCCed to any other forum. Internal dialog must be re-crafted for internal use as mentioned in previous guildelines. NLNOG APPLICATION EXPECTATIONS Membership in NLNOG is restricted to those actively involved in the mitigation of NSP security incidents within organizations in the IP transit, content, and service provider community. Therefore, it will be limited to operators, vendors, researchers. That means no press and (hopefully) none of the "bad guys." It also means that engineers who do not directly work in the core transit/content provider network do not fit the purview of NLNOG and should look for other forums NLNOG is not a community for lurkers who wish to "learn more about NSP security." Individuals who are part of the NSP attack mitigation community at times create whitepapers, presentations, and training materials to educate the larger community. Much of this material will be presented to NANOG (http://www.nanog.org) and other NSP operations forums (RIPE, APRICOT, and AFNOG, etc.). A set of links below offers help for those looking to learn more about the tools, techniques, and training used by the NLNOG community. NLNOG will use a simple trust/peering relationship. This model is not as "secure" as an encrypted conversation, yet it is better than a wide-open public dialog. All applications must be accompanied by at least two existing members who will vouch for the new applicant. We will establish the trust by asking members of the list to vouch for new subscriber requests. If the list administrators know the person, then they can vouch for them. No information presented in this list is allowed to be forwarded or shared outside the NLNOG community without specific permission from the poster. It is expected that members strictly adhere to this policy to ensure list confidentiality. NLNOG APPLICATION FOR MEMBERSHIP INSTRUCTIONS Step one is to insure you meet the qualifications for NLNOG. Some common questions to ask yourself are: Do you work for some type of IP transit provider, content provider, or service provider? Does your job include Operational Security? Are you willing to offer free services, data, forensic, and other monitoring data to the NSP community? Do you have authorization to actively mitigate incidents in your network? Do you actually log into a router and do something to mitigate an attack or call someone to task them to do the work? Do you have the time for a real-time NSP mitigation forum? If you'd like to be considered for membership, please provide the following information via email to: bofh at nlnog.net Name: E-mail: DayPhone: 24hrPhone: iNOC Phone: Company/Employer: ASNs Responsible for: JobDesc: Internet security references (names & emails): PGP Key Location: For Job Description be as detailed and descriptive as possible. After sending the above form via email go to the section below and issue a "subscription" request via the form. NEW MEMBERS When a new member requests membership and provides his/her "bio" (as above), once the moderators decide that the potential member has passed their initial review, that person's bio will be sent to the full list. All applications must be accompanied by at least two existing members who will "vouch" for the new applicant (preferably not from the same organization). Any existing member will have 48 hours to send reservations about that potential member to the moderators. The moderators promise to review in depth any facts that are raised in regards to any potential new member. RESERVATIONS AND REBUTTAL Any reservation about an existing or new member that is sent privately to the -owner list will have all identifying aspects stripped out of the email and forwarded to the potential rejectee for rebuttal. That person will have 72 hours to send a rebuttal before a decision is taken. The moderators of the NLNOG list will attempt to take all matters into consideration before rendering a decision. REMOVAL A majority of the moderators will be required to remove an existing member or to override a new potential members candidacy for the list. NLNOG REVETTING The NLNOG Moderators will periodically review the membership and select some members for revetting. This is required to ensure that all members of the list continue to fit the charter characteristics. Both employment and the charter can change over time - this mechanism allows the list to remain true to its charter. The revetting process occurs in three steps: 1. The member selected for revetting will be asked to update their information, and submit it to the NLNOG Administrators. 2. Should the member continue to meet the required characteristics for NLNOG membership, the members information will be sent to the list for revetting. 3. At least two members of the list must re-approve membership. At least one of the approvers must be from a different company than the member who is being revetted. In addition, other members selected for revetting during the same cycle may not approve each other. Note that not meeting the requirements of each step will result in removal from the NSPSec mailing list. Those so removed may reapply through the normal method, although the two-company approval requirements will continue to apply. NLNOG PHYSICAL MEETINGS The IETF experience demonstrates that the most effective way to build a community on the Internet is through a combination of virtual meetings (e-mail forum) and physical meetings. NLNOG follows the same formula, having small meetings and BOFs at the various operations and engineering meetings around the world. Following is a list of the active NLNOG meetings and the contacts for the chaperons/facilitators for these meetings. Please let the community know if you are interested in coordinating, chaperoning, or facilitating meetings at other forums. Volunteerism in service to the community is welcomed. -- Sabri Berisha - SAB666-RIPE BIT BV - http://www.bit.nl/ AS12859 and AS31064 - lg: http://noc.bit.nl/traceroute

3 3