- BCOP - mailman.ripe.net

DNS open resolver BCP
by Blake Willis 16 Oct '13

16 Oct '13

Greetings BCOP list, Sitting here in the DNS WG at RIPE67, it seems like a key task for the BCOP project is creating a repository (or pointers) to getting one's DNS servers properly configured & secured (the largest sources of DNS amp/reflection traffic are the networks with the least clue, & the least-deployed BCP38). There are certainly plenty of resources out there (including vendor documentation) but "google.com/search?q=DNS+open+resolver+BCP" isn't particularly conclusive. I feel the task at hand is really more of an education campaign than a technical problem... Best regards, -- Blake Willis Network Architecture Consultant & Co-Founder L33 Networks blake at l33 dot fr

1 0

Re: [bcop] [Ccrsr] Some ideas on the content of the "code of conduct" (the first one - we need a better name!)
by Job Snijders 14 Oct '13

14 Oct '13

On Tue, Oct 08, 2013 at 05:39:05PM +0200, Andrei Robachevsky wrote: > Colleagues, > > 1. basic routing hygiene & BGP security Would you consider not deaggregating your prefixes part of basic routing hygiene? I do. :-) I can understand that if a network has two different locations, with no backbone, that split up their space in two. But all to often I see networks announcing both more specific and covering aggregate, with only one endpoint, so the more specifics just waste space. > 2. anti-spoofing > 3. topology and connectivity Maybe a strong recommendation can be put in the code that a participant promises to keep peeringdb.com up2date? > 4. collaboration and coordination Here too peeringdb often plays a vital role in contacting the other party to cooperate to resolve an issue. > Any of these items? Only 4? Anything missing we'd like to include? 5. Enabling others in debugging efforts Maybe this falls under under one of the four other subjects, but I desperatly want networks to offer looking glasses from multiple points in their network, for both IPv4 and IPv6 with BGP, ping and traceroute, without a captcha, without a members login :-) > - I also got a comment regarding "Participation Requirements", > > 1. Endorsement from the management (C-level, public statement)? > 2. Demonstration of commitment through a set of measurable metrics - > what is feasible to measure? > 3. Public endorsement on the website (leave internal specifics to the > ISP and leave assessment to the operator community) > 4. Something different 1 or 3 is fine by me. I envision slapping networks with the code when they publicly endorse it but don't abide by it. One of the strongest drivers in this industry is the fear for name and shame I suppose, we all want to act like well educated boys because everything is visible. :-) Kind regards, Job

1 1

Re: [bcop] Presentation Submitted -- [Best Current Operational Practices (BCOP) – updates from around the world]
by ws＠ripe.net 14 Oct '13

14 Oct '13

Dear Benno Overreinder, Jan Zorz, Thank you for uploading your presentation titled "Best Current Operational Practices (BCOP) – updates from around the world". It is now available for viewing at: https://ripe67.ripe.net/presentations/ In order to (irreversibly!) delete the uploaded presentation, please use this link: https://ripe67.ripe.net/presentations/presentation-archive/delid/3320177476 If you have any questions, please reply to this message. RIPE 67 Meeting team

1 0

BCOP BoF in Athens
by Jan Zorz - ISOC 12 Oct '13

12 Oct '13

Good people on BCOP@RIPE mailing list ;) In Athens we have scheduled a BCOP BoF on monday at 18h, after the plenary part of RIPE meeting ends - this time the BoF will be "lead" by Benno Overeinder and myself. Thnx Benno for volunteering :) Benno and myself will do the lightning talk update on BCOP activities around the world on the same day at around 17h during the plenary, so be there to learn what's going on globally. You are all invited to attend the BoF, we'll discuss many interesting things and initiatives for operational documents. We identified some topics and some people already started doing some work. I'll present the beta-preview-draft of the document titled "Generic IPv6 troubleshooting procedures for helpdesks around the world", with contributors and co-authors Lee Howard, John Jason Brzozowski, David Freedman, Jason Fesler, Tim Chown, Sander Steffann, Chris Grundemann and myself. We'll also discuss the proposal from Andrei Robachevsky (ISOC) of creating a routing code of conduct, an interesting initiative to make Internet better. We might get Nick Hilliard interested to talk about BGP operational practices at IXP and so on. If anyone is interested in participating and presenting the work on the operational document that is being done - more than welcome to send an email to Benno or me. See you all on Monday afternoon in Athens, join us and bring everyone that is interested in operational practices. Cheers, Jan Zorz

1 0

BCOP BoF RIPE 67 agenda, Monday 14 October
by Benno Overeinder 02 Oct '13

02 Oct '13

Hi, For the BCOP BoF on Monday at RIPE 67 in Athens, we have a (provisional) agenda of about one hour. Some of you already indicated that they are willing to give a short presentation on some ideas for a document, but there is still room for other enthusiast presenters to discuss a subject. Please contact us or send a mail to BCOP list. Here is the provisional agenda: - Positioning and grand perspective of local BCOP initiatives and interaction between the groups. Update of feedback on BCOP in other regions like ARIN/NANOG, LACNIC, APNIC, etc. - Brief overview of subjects that have been proposed, see http://www.internetsociety.org/deploy360/about/bcop/topics/ - Two (or more?) detailed/in-depth discussions of topics. - Discussion & closing: Who is willing to work on (part of) items, next steps, etc. Best regards, Jan and Benno -- Benno J. Overeinder NLnet Labs http://www.nlnetlabs.nl/

1 0

Re: [bcop] BCOP BoF at RIPE67 in Athens
by MA Yan 11 Sep '13

11 Sep '13

2 1

Re: [bcop] Suggestions for top-10 IPv6 issues that trigger residentialusers to call helpdesk
by 马严 10 Sep '13

10 Sep '13

2 1

Suggestions for top-10 IPv6 issues that trigger residential users to call helpdesk
by Jan Zorz - ISOC 09 Sep '13

09 Sep '13

Dear BCOP group ;) I'm trying to put together a list of (at least) top-10 problems/situations/issues on IPv6 that annoys the end user to the point that he calls operators helpdesk and claims that "internet is not working". What are possible issues, that a guy at helpdesk will encounter and the IPv6 could be the cause? What can go wrong? The areas that I identified are: - Addressing issues - DNS issues - Firewall issues - Tunneling issues - Transition mechanisms issues - Happy eyeballs issues - Why avoiding at all cost saying “if you have issues just disable IPv6” Any suggestions and ideas in building top-10 or top-15 most common issues would be greatly appreciated. As this document is aiming to document the best current operational practice for the operator, I'll also ask for suggestions the IPv6 working group (if the chairs will permit me to do so) and maybe gain some more interested experts to join our (for now) small group. Cheers, Jan

1 0

BCOP BoF at RIPE67 in Athens
by Jan Zorz - ISOC 02 Sep '13

02 Sep '13

Dear BCOP "crowd" :) We got the BCOP BoF accepted for RIPE67 in Athens, with a note that we would like to have it on Monday after the "BCOP updates" lightning talk, where I'll do a short update on the BCOP activities around the world and some identified topics that came out of discussion on this mailing list (and also some others). I would like to announce with great pleasure, that Benno Overeinder from NLNET Labs volunteered and made a step forward to help with BCOP activity in RIPE community - so he'll do the ligtning talk with me and co-run the BCOP BoF in Athens. We have a small web page with some information about BCOPs around the world: http://www.internetsociety.org/deploy360/about/bcop/ ...and a list of some identified topics: http://www.internetsociety.org/deploy360/about/bcop/topics/ Now we need to start drafting some of this documents. Pick the topic and draft a "table of content", send it to the list and ask for co-authors. Anyone? I'll start the draft titled "Basic IPv6 troubleshooting for helpdesks around the world" document, that would bring the ISPs a simple template with some generic information that their helpdesk should know about when they put IPv6 in production. Document should be really just a start with "add-your-own-specifics" in mind. I think this should remove the next speedbump in IPv6 deployment, I have the same feeling like I had when I started a document, that later became RIPE-501 and RIPE-554. Would anyone like to help me with this? I would also like to suggest that we have some short presentations of ideas of BCOP documents in Athens - but we need to start doing something prior to that - and we have less than 2 months to do something. Cheers, Jan Zorz

1 0

First email to BCOP discussion list...
by Jan Zorz - ISOC 24 Jul '13

24 Jul '13

Hi all, Finally we have a mailing list (thnx to staff @RIPE-NCC) that we identified as one of the first next steps at BOF in Dublin RIPE meeting. Please send emails to: bcop(a)ripe.net This is the place, where we can discuss how to move forward with the Best Current Operational Practices work, how to maybe move it forward towards more official status, who is willing to participate and start the documents - but first of all - we agreed that we need to identify the topics of discussion. First few that I heard were: - source addr antispoofing operational practices - peering good practices - how to implement IPv6 at ISP (different network types and flavors) - DNSsec how-to and practices ... I would like to invite all to send suggestions so we can identify the topics - and then we can see later where we can start some effort and form a groups that would start producing a documentation. Thank you all for participating at BOF, we are aiming for another BOF in Athens (this time with beer and chips in the room, as the BOF should be :) ) Cheers, Jan Zorz

4 6

Some ideas
by Nash, Steve 05 Jul '13

05 Jul '13

As a very early starting point, having scanned the ietf BCPs, I table the following. I believe we need to consider both what the requirements should be, and also what incentives there might be for compliance. I suggest the emphasis should be on satisfying the world at large that the Internet community encourages its members to behave responsibly. A secondary objective might be education for new operators. ========================================== RIPE Implementation Requirements 1. INHIBIT ADDRESS SPOOFING 1.1 BCP 38 (rfc 2827) with BCP 84 (rfc 3704) Ingress Filtering Implemented at every access router and switch as appropriate for: 1. Single host 2. Non-Transit subnet 3. Registered sub-network transit (tell ISP of additional address spaces) 4. Open Transit (restrict to BGP?) 5...... 1.2 Install RIPE supplied anti-spoofing probe at 10% of access PoPs 1.3 [Consider] TCP/UDP/SCTP.... port filtering Accept DNS replies (src port 53) only from customers requesting DNS support. Block dest port 53 toward non-hosting clients. 2. POLICIES FOR PEERING Register External Routing Policy in RIPE Db. Ask Peers to comply with this doc (? Inter-RIR ?) ? Apply route filtering At IX ask Peers to maintain AS-MAC mapping, in order to facilitate back-tracking 3. DNS POLICIES ?rfc 2870 (BCP 40) ?rfc 2219 BCP 17 ?rfc 2182 BCP 16 4. POLICIES FOR EMAIL ?rfc 2505 (BCP 30) Steve Nash 17 June 2013 steve.nash(a)theiet.org ================================

2 1