- connect-wg - mailman.ripe.net

Re: [connect-wg] Input request for system on how to approach abuse filtering on Route Servers - bad hosters
by Harry Cross 19 May '21

19 May '21

Hi Erik, Thank you for your talk yesterday, was very insightful. I have an issue with the concept of tagging an entire ASN/IP block with a negative brush, but I suspect this all boils down into how you define a “bad” ISP/IP block and the criteria needed to earn a blocking/place on the naughty list (back in 2010, there was a very interesting comparison of different blocklists here: https://labs.ripe.net/author/jsq/asn-ranking-correlations-between-spam-bloc… <https://labs.ripe.net/author/jsq/asn-ranking-correlations-between-spam-bloc…> but this does refer to purely spam email). I suppose my major issue with this is collateral damage, for example say you’ve got a /24 with shared web hosting servers in there (which instinctively have lots of users on the same IP addresses, with no pre-filtering of content going online). I’ve seen situations where shared hosting domains with thousands of users have been revoked because one user hosted one malicious binary and I’d like to be assured that this can’t happen here, where one user is the downfall of everyone. I can easily see end-user eyeball ISP support getting confused with this, making un-needed blocks hard to remove. Thanks Harry > On 19 May 2021, at 11:00, connect-wg-request(a)ripe.net wrote: > > Send connect-wg mailing list submissions to > connect-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.ripe.net/mailman/listinfo/connect-wg > or, via email, send a message with subject or body 'help' to > connect-wg-request(a)ripe.net > > You can reach the person managing the list at > connect-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of connect-wg digest..." > > > Today's Topics: > > 1. Input request for system on how to approach abuse filtering > on Route Servers - bad hosters (Erik Bais) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 18 May 2021 19:52:15 +0000 > From: Erik Bais <erik(a)bais.name> > To: "connect-wg(a)ripe.net" <connect-wg(a)ripe.net>, > "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> > Subject: [connect-wg] Input request for system on how to approach > abuse filtering on Route Servers - bad hosters > Message-ID: <9515151D-5223-457D-8BFC-D9610CEDA340(a)bais.name> > Content-Type: text/plain; charset="utf-8" > > Hi, > > As I asked during the Connect WG today, there are discussions currently going on in the Dutch network community to see if there is a way to get a cleaner feed from routeservers on internet exchanges. ( by default ) > > As you may know there is an Dutch Anti Abuse Network initiative ( AAN ) ? abuse.nl > > The companies associated with AAN setup and all signed a manifest ( in Dutch - https://www.abuse.nl/manifest/ ) that states that we will all do our best to provide a better and cleaner internet. > > As members of the member organisation of the largest Internet Exchange, AMS-IX, we like to start with the discussion on asking the AMS-IX to filter certain AS numbers from the default routeserver view. > The issue is that even if you don?t peer with certain networks directly, the change is very real that you will receive or that the other network receive your prefixes and that you may not want to peer with those networks. > > What we like to have is an independent way of generating a list with badhosts ( say a top 50 ) .. ( and with our Dutch infrastructure we have a couple on the Dutch infrastructure as well.. ) > > A couple years ago there was the list of HostExploit .. or one could have a look at the drop-list of SH .. > Personally I would like a proper model that one can explain why a certain network is listed on a certain list with a clear method explaining of what kind of abuse is noted in the said network. > > Topics that should be included on the rating for the list : > > > * Phishing (hosting sites / domain registrations ) > * Malware hosting ( binaries and C&C?s ) > * DDOS traffic ( number of amplification devices in the network compared to the number of IP address ratio ) > * Login attacks / excessive port scanning > * Hosting of Child exploitation content > * Infected websites / Zeus Botnets > * Etc > > So yeah, something similar as the Top 50 of HostExploit ranking .. but HostExploit stopped producing these lists in 2014. > > By filtering a top 50 of badness hosters on the Routeservers would remove the cheap IXP option for network connectivity at the better Internet Exchanges and provide a way to remove any DDOS traffic via BGP null-routing via Transits. > And companies that would still want to peer with a certain network, can still do so by direct peering setup via the IXP infra. > > And it will not bring the IXP in a position where it will be asked on why they are still offering services to certain parties .. as that might become legally difficult especially in a membership organisation. > > So we don?t mind if we take their money as long as are not forced to peer with them via the routeservers. > > Your constructive feedback is highly appreciated. > > Regards, > Erik Bais > A2B Internet > >

1 0

Connect-WG session agenda for RIPE 82
by Florence Lavroff 16 May '21

16 May '21

Dear friends of the RIPE Connect WG, Here is the agenda for the Connect WG session taking place on Tuesday, 18th May from 14:30 to 15:30 (UTC+2) : - Opening (Welcome, scribe appointment, agenda, proposed session format) - Housekeeping (RIPE 81 minutes, WG chair selection process, RIPE Code of Conduct, RIPE Policy development, RIPE meeting chat logs, feedback about virtual RIPE Connect-WG sessions) - Presentation #1 - IXP Traffic in the Covid Era - MIX - Presentation #2 - Euro-IX update - Bijal Sanghani, Euro-IX - Open discussion - Closure Very much looking forward to seeing you all during the session, Kind regards, Florence, Remco and Will Connect-WG co-chairs -- Florence Lavroff / lavroff(a)google.com / +31 6 11 01 55 80 Infrastructure Acquisition and Interconnect / Google EMEA

1 0

Call for Presentations - RIPE 82
by Florence Lavroff 21 Apr '21

21 Apr '21

Dear friends of the RIPE Connect WG, RIPE 82 will take place from May 17th to 21st 2021 and will be virtual again. Our next Connect-WG session is scheduled on Tuesday, May 18th for 1 hour. We have a couple of slots left still. If there is any topic, you are interested to present during the session, please let us know ! Thanks, Kind regards, Florence, Remco and Will Connect-WG co-chairs -- Florence Lavroff / lavroff(a)google.com / +31 6 11 01 55 80 Infrastructure Acquisition and Interconnect / Google EMEA

1 0

New on RIPE Labs: Does The Internet Route Around Damage? - Edition 2021
by Alun Davies 14 Apr '21

14 Apr '21

Dear colleagues, In this new article on RIPE Labs, to investigate whether the Internet routes around damage in 2021, Emile Aben carries out an analysis of the impact of the recent LINX London outage. The full article is available here on the new and improved RIPE Labs: https://labs.ripe.net/author/emileaben/does-the-internet-route-around-damag… Kind regards, Alun Davies RIPE Labs Editor RIPE NCC

1 0

Let's talk, Let's act - Exploring the power of mentoring
by Bijal Sanghani 25 Mar '21

25 Mar '21

Hi everyone, I’d like to invite you to our next Lets Talk, Let’s Act panel, the session will take place on Tuesday 30th March at 13:00 - 14:30 UTC where we will dive deeper into the topic of mentoring. During our last panel discussions the topic of mentoring came up a number of times and we thought we would explore further and hear from others who have some experiences to share. We’ll be hearing about the different types of mentoring, structured vs lightweight, what to expect as a mentor and how to get the most of mentoring from a mentee point of view. For more information and to register for the session, please see here - https://www.euro-ix.net/en/events/virtual-events/lets-talk-lets-act/lets-ta… Kind regards, Bijal Sanghani

1 0

New on RIPE Labs: The PeeringDB Survey 2020 - Results and Roadmap
by Alun Davies 16 Mar '21

16 Mar '21

Dear colleagues, Last November, we put out a call for respondents to the PeeringDB survey 2020. With the results now gathered and analysed, Leo Vegoda takes a look at how the feedback received has helped the team build their roadmap for 2021. Read more on RIPE Labs: https://labs.ripe.net/Members/leo_vegoda_2/the-peeringdb-survey-2020-result… Kind regards, Alun Davies RIPE Labs Editor RIPE NCC

1 0

Basics of Governance and Best Practices for NFP Boards - Workshop
by Bijal Sanghani 16 Feb '21

16 Feb '21

Hi everyone, As part of the Euro-IX “Learn With Us” series on Tuesday 23rd February Vinciane Koenigsfeld from ICANN and EXEC Sarl will lead the workshop “Basics of Governance and Best Practices for NFP Boards”. The key learning objectives are; - Distinguish between the complementary functions of board governance and management - Recognise the key responsibilities of a nonprofit board of Directors - Cultivate characteristics of high impact Board of Directors within the context of being a nonprofit organisation (incl. do’s & don’ts) If you’re thinking about applying for a Board position and not sure what your role and responsibilities would be or if you’re already on a Board and need a refresher, join us and learn with us by registering here - https://zoom.us/meeting/register/tJ0vfu-rqD8tHtxC3DeQoMk202Tv1Elg9eBO <https://zoom.us/meeting/register/tJ0vfu-rqD8tHtxC3DeQoMk202Tv1Elg9eBO> Kind regards, Bijal Sanghani

1 0

Euro-IX Virtual Forum - Join us!
by Bijal Sanghani 01 Dec '20

01 Dec '20

Hi everyone, Euro-IX is hosting a virtual forum tomorrow from 13:00 - 16:00 UTC / 14:00 - 17:00 CET, we’ve got some presentations about 5G, analysis on cloud WAN peering by CAIDA and a panel that will discuss the pros and cons of IXP Marketplaces. If your interested in these topics, please join us by registering here - https://www.eventbrite.com/e/euro-ix-forum-looking-into-the-future-registra… <https://www.eventbrite.com/e/euro-ix-forum-looking-into-the-future-registra…> If you’d like more information about the event please see here - https://app.swapcard.com/event/euro-ix-virtual-meeting-4 <https://app.swapcard.com/event/euro-ix-virtual-meeting-4> Hope to see many of you then! Kind regards, Bijal Sanghani

1 0

New on RIPE Labs: The PeeringDB Survey 2020
by Alun Davies 05 Nov '20

05 Nov '20

Dear colleagues, The latest PeeringDB survey is live now! To help spread the word, this RIPE Labs article from Leo Vegoda takes a look at the survey and how, by taking just a moment to fill it in, PeeringDB users can help make peering better and easier for everyone: https://labs.ripe.net/Members/leo_vegoda_2/the-peeringdb-survey-2020 Kind regards, Alun Davies RIPE NCC

1 0

Agenda for Connect-WG @ RIPE 81
by Florence Lavroff 22 Oct '20

22 Oct '20

Dear friends of the Connect-WG, Exciting times : RIPE 81 is right around the corner. Here is the agenda for our Connect WG session, scheduled for Wednesday, October 28th from 1pm to 1.45pm : 1. Opening (Welcome, scribe appointment, agenda, proposed session format) 2. Peering (Dis)Agreements during Covid-19 Times, Revisited - Will Van Gulik - 5 minutes 3. IXP Manager - An Open Source Success Story for Better Internet Connectivity - Barry O'Donovan, INEX - 8 min 4. MIX, Namex and TOP-IX, Italian incumbent peering update - Luca Cicchelli, Top-IX - 5 mins 5. Covid-19 IXP Update - Bijal Sanghani, Euro-IX - 5 minutes 6. Closure See you all soon (online), Best regards, Florence Remco and Will Connect-WG co-chairs -- Florence Lavroff / lavroff(a)google.com / +31 6 11 01 55 80 Infrastructure Acquisition and Interconnect / Google EMEA

1 0