- connect-wg - mailman.ripe.net

RIPE 83 Connect WG minutes
by Florence Lavroff 17 May '22

17 May '22

Dear friends of the Connect WG, Please find below the minutes of the Connect session at RIPE 83, to be approved during the next session at RIPE 84, tomorrow : https://www.ripe.net/participate/ripe/wg/active-wg/connect/minutes/connect-… Thanks, Best regards, Florence, Remco and Will Connect-WG co-chairs -- Florence Lavroff / lavroff(a)google.com / +31 6 11 01 55 80 Infrastructure Acquisition and Interconnect / Google EMEA

1 0

Call for presentations for Connect WG - RIPE 84 - Berlin
by Will van Gulik 10 May '22

10 May '22

Dear friends of the Connect WG, In about 3 weeks, we will, for some of us, meet LIVE at RIPE 84, that will take place in Berlin between May 16th and 20th 2022. Our session is scheduled for Wednesday, May 18th between 12:00 and 13:00 CEST (UTC+2) . If there is any topic you are interested to present during the session, please let us know ! Thanks, Kind regards, Florence, Remco and Will Connect-WG co-chairs

2 1

Last call and final reminder for nominations to the 2022 Rob Blokzijl Award
by Carsten Schiefner 14 Mar '22

14 Mar '22

[Apologies for cross-posting to various RIPE lists] Dear Connect WG members - this is the last call and final reminder for nominations to the 2022 Rob Blokzijl Award that will be accepted until this Friday, 18th March, at 23:59 UTC. In seeking nominations for this prestigious award, which was created to celebrate Rob's contributions to the development of the Internet, the Award Committee (https://rob-blokzijl-foundation.org/2021/11/22/2022-award-committee/) is interested to receive nominations of those who have reflected Rob's approach in either a technical or operational capacity. Please give some consideration to nominating individuals - but also teams and groups of people! - in your own community and/or the wider industry in the RIPE region who, in your opinion, deserve to be recognised for their work to make the internet and/or internet community better. To specifically have this emphasised again after some according queries: nominations of teams and groups of people are very well possible and wished for as well in case their collective work would match the criteria of the call as laid out! The Award Committee is particularly interested to receive nominations of contributors who, in addition to their own contributions, have also supported and enabled others anywhere in the world. Also, the Award Committee would like to encourage those making nominations to consider not only the community members in the later stages of their careers or who are widely known but also those who may have contributed greatly in the springtime of their career or discreetly for the greater good or who may be considered to be part of an unrepresented group. And last but not least: those of you who previously have made a nomination other than Wilfried Woeber, the 2018 awardee, may want to consider resubmitting a nomination. The complete details of the call and the nomination process can be found at: https://rob-blokzijl-foundation.org/2021/11/25/call-for-nominations-2022/ Best wishes and kind regards Carsten (on behalf of the Award Committee)

1 0

RIPE 82 Connect WG minutes
by Florence Lavroff 15 Nov '21

15 Nov '21

Dear friends of the Connect WG, Please find below the minutes of the Connect session at RIPE 82, to be approved during the next session at RIPE 83 : https://www.ripe.net/participate/ripe/wg/active-wg/connect/minutes /connect-working-group-minutes-ripe-82 Thanks, Best regards, Florence, Remco and Will Connect-WG co-chairs -- Florence Lavroff / lavroff(a)google.com / +31 6 11 01 55 80 Infrastructure Acquisition and Interconnect / Google EMEA

1 0

IXP neutrality discussion
by Michalis Oikonomakos 21 Sep '21

21 Sep '21

Dear connect WG fellows, I hope you all are well! I notice that most IXPs use the term "neutral" to describe themselves. This “neutrality” is usually loosely associated to “fairness” and “non-discrimination” among the members, however the term is generic and ambiguous and leaves a lot of room for different interpretations by IXPs and IXP customers. I was wondering whether there is some consensus on this term – and even if not, what are the different points of view? Some points (which do not necessarily express my own opinion) to start the discussion: - Is uniform pricing among its members a significant part of IXP neutrality? Do promos and offers affect this neutrality and under what terms can they be offered without a problem? Are welcome packs (e.g. free ports) allowed in order to attract significant members? Under what conditions is it possible that an IXP offers discounted or free ports, without this affecting its neutrality (e.g. for root NS or similar services/infrastructure)? - Do you consider it significant that all members of a neutral IXP have access to the same service portfolio and options? To what extent and for what reasons can a member be treated exceptionally? Are small exceptions allowed (e.g. allowing a second IP in the peering LAN when forbidden by policy), in order to attract a new, important customer? How does this conflict with the IXP’s need to adapt to new technologies or test new services (e.g. running a pilot with selected members)? - How important is the uniformity of all contractual terms to an IXP neutrality? E.g. billing and payment terms, SLAs, penalties etc? How flexible can an IXP be, e.g. for a significant customer? Should a contract template be used to ensure such uniformity? If yes, does this preclude a neutral IXP from signing customized contracts or customers’ contracts and if not, under what conditions? - Should the price list be public? Should the contract template be public? - Is openness part of neutrality? Should the members list be public? Should the number of ports and port speeds be public? Should a neutral IXP adopt certain APIs, e.g. the Euro-IX API? - Is it acceptable for a neutral IXP to have other activities (e.g. sell/resell Internet or other IXPs, colocation, integration & consulting, etc.)? To what extent? - Does connectivity between IXP POPs within metro/country/global affect neutrality? Under what circumstances is this acceptable? - Does the nature of an IXP entity affect neutrality? E.g. member-based vs state owned vs commercial vs non-profit vs academic? - Should financial data be published (especially for IXPs that are not standalone entities)? To which detail? - How are the above affected by IXP resellers? (e.g. should there be "fairness" between resellers and how is this achieved? What about "fairness" for resold members?) - How are the above affected by cloud exchange services (where members are by definition distinguished between providers and consumers)? Feel free to comment on as many topics as you like or add your own. Answers from IXPs and IXP customers are both welcome. Once again, I understand that there are different and conflicting views on this, but I believe it would be interesting to see if there is a baseline consensus and what the different points of view are. I expect that some interesting results will come up and, if they do, I promise to try to gather them and present them in a future meeting. Thank you in advance for your input. Best regards, Michalis

2 1

Announcing NLNOG Day and my newest RIPE Labs article on RIPE Community Resilience
by Vesna Manojlovic 31 Aug '21

31 Aug '21

Dear colleagues, on Thursday 2 September, NLNOG is organising a hybrid event: in-person, for the first time since pandemic restrictions in early 2020, and online / with remote participation: https://nlnog.net/nlnog-day-2021/ Great line-up of speakers might interest the techies on this list -- and I will be giving a talk too: "Technical Communities Resilience During COVID-19 Pandemic". The presentation is based on my series of 10 articles, the most recent one published today: "Every Society Has the Internet they Deserve" : https://labs.ripe.net/author/becha/ripe-community-resilience-every-society-… Please join us at NLNOG Day, and do give me comments on the article(s) on RIPE Labs or on the list! Kind regards, Vesna Manojlovic -- Community Builder, RIPE NCC https://labs.ripe.net/author/becha/

1 0

Announcing the SDIA Open Data Hub
by Michael J. Oghia 16 Aug '21

16 Aug '21

Hi everyone, I hope you're well and enjoying the summer. I want to share a RIPE Labs post <https://labs.ripe.net/author/michael_oghia/transparency-meets-sustainabilit…> I wrote last week about a new transparency and sustainability initiative that my organisation, the Sustainable Digital Infrastructure Alliance (SDIA), is in the process of building. You can see the announcement below, and I'd be happy to answer any questions you have. Best, -Michael __________________ Director of Communications & External Relations Sustainable Digital Infrastructure Alliance (SDIA <https://sdialliance.org/> ) ICT sustainability advocate | IRPC <https://internetrightsandprinciples.org/> Steering Committee member Belgrade, Serbia (UTC+2) | Twitter <https://www.twitter.com/MikeOghia> | LinkedIn <https://www.linkedin.com/in/mikeoghia> ---------- Forwarded message --------- From: Antony Gollan <agollan(a)ripe.net> Date: Fri, Aug 13, 2021 at 3:36 PM Subject: [ripe-list] New on RIPE Labs: Transparency Meets Sustainability - Announcing the SDIA Open Data Hub Dear colleagues, The lack of reliable data is one of the most foundational issues in creating a sustainable ICT ecosystem. In a new article on RIPE Labs, Michael Oghia introduces the Open Data Hub, a resource to boost transparency, trust, and data availability managed by the Sustainable Digital Infrastructure Alliance (SDIA). https://labs.ripe.net/author/michael_oghia/transparency-meets-sustainabilit… Kind regards, Antony Gollan Communications Team Leader RIPE NCC

1 0

Re: [connect-wg] [anti-abuse-wg] Input request for system on how to approach abuse filtering on Route Servers - bad hosters
by Erik Bais 20 May '21

20 May '21

Hi Michele, I’m not looking at tapping traffic, nor would I expect an IXP to do so. There are other sources that we should look at to get the data. Erik From: Michele Neylon - Blacknight <michele(a)blacknight.com> Date: Thursday 20 May 2021 at 10:03 To: Erik Bais <ebais(a)a2b-internet.com>, Thomas King <thomas.king(a)de-cix.net>, Erik Bais <erik(a)bais.name>, "connect-wg(a)ripe.net" <connect-wg(a)ripe.net>, "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] Input request for system on how to approach abuse filtering on Route Servers - bad hosters Erik But wouldn’t creating this list involve looking at the traffic *somewhere*? Personally I’d love to see scummy providers marginalised as much as possible, but the “how” is important to get right. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ https://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of Erik Bais <ebais(a)a2b-internet.com> Date: Wednesday 19 May 2021 at 13:00 To: Thomas King <thomas.king(a)de-cix.net>, Erik Bais <erik(a)bais.name>, "connect-wg(a)ripe.net" <connect-wg(a)ripe.net>, "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] Input request for system on how to approach abuse filtering on Route Servers - bad hosters [EXTERNAL EMAIL] Please use caution when opening attachments from unrecognised sources. Hi Thomas, Thank you for your reply and insight. I’m not asking for IXP’s to look in the traffic.. I’m looking for a top 50 list of badhosts.. that is generated in a way that we as a community would feel comfortable with as a start. Use that top 50 list .. as the ASn filtering, to get to a way of clean internet for the default Routeserver customer. ( secure by design / default ) If that customer would like to receive the unfiltered option, they could set that via the IXP portal in their member account and receive the unfiltered view. Or setup direct peerings .. It is already possible to do this for someone if they know how to do it, via BGP communities or RPSL in the RIPE DB.. But the problem is that the list might not get updated .. and it is easier to do this for the whole group with regular updates, without re-configing all routers on a peering lan. As we are now talking about this in the Dutch community, it should be possible to push this also to other regions .. and it should be open for everyone to see why they would be listed and what the qualifiers are that they are there … That way we can avoid the real badhosts to pick out an internet exchange that doesn’t support filtering on this, just so they can push their bad packets into some networks. Regards, Erik Bais From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of Thomas King <thomas.king(a)de-cix.net> Date: Wednesday 19 May 2021 at 13:14 To: Erik Bais <erik(a)bais.name>, "connect-wg(a)ripe.net" <connect-wg(a)ripe.net>, "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] Input request for system on how to approach abuse filtering on Route Servers - bad hosters Hi Erik, This is a vital topic! You focused a bit on the Dutch community. However, I think it is globally significant. We at DE-CIX are very active in reacting to abusive peers on our IXPs. We have disconnected peers who were (repeatedly) not obeying the law or the DE-CIX Terms and Conditions. I gave a talk about what DE-CIX does in this regard during RIPE75 (https://ripe75.ripe.net/archives/video/103/). Disclaimer: I am not a lawyer. The European telecommunication law does not allow IXPs to look into peers' traffic on the application level (for a good reason, I believe). So, we do not know if a peer hosts malware or is sending out spam only. DE-CIX is only allowed to look into the operational data (e.g., Route or ASN hijacks) or behavior (e.g., unwanted traffic due to static routes on the Peering LAN). Based on this information, DE-CIX is acting. I am highlighting this because I see issues if IXPs (or carriers and transit providers) are used as central infrastructure to filter data due to information they cannot verify or generate. Just think about the central DNS filtering and censoring discussion we had on a European level to stop certain abusive and harmful Internet services from being accessible. Best regards, Thomas -- Dr. Thomas King Chief Technology Officer (CTO) DE-CIX Management GmbH | Lindleystraße 12 | 60314 Frankfurt am Main | Germany | www.de-cix.net<http://www.de-cix.net> | Phone +49 69 1730902 87 | Mobile +49 175 1161428 | Fax +49 69 4056 2716 | thomas.king(a)de-cix.net<mailto:thomas.king@de-cix.net> | Geschaeftsfuehrer Harald A. Summa and Sebastian Seifert | Registergericht AG Koeln HRB 51135 DE-CIX 25th anniversary: Without you the Internet would not be the same! Join us on the journey at https://withoutyou.de-cix.net From: connect-wg <connect-wg-bounces(a)ripe.net<mailto:connect-wg-bounces@ripe.net>> On Behalf Of Erik Bais Sent: Tuesday, 18 May 2021 21:52 To: connect-wg(a)ripe.net<mailto:connect-wg@ripe.net>; anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net> Subject: [connect-wg] Input request for system on how to approach abuse filtering on Route Servers - bad hosters Hi, As I asked during the Connect WG today, there are discussions currently going on in the Dutch network community to see if there is a way to get a cleaner feed from routeservers on internet exchanges. ( by default ) As you may know there is an Dutch Anti Abuse Network initiative ( AAN ) – abuse.nl The companies associated with AAN setup and all signed a manifest ( in Dutch - https://www.abuse.nl/manifest/ ) that states that we will all do our best to provide a better and cleaner internet. As members of the member organisation of the largest Internet Exchange, AMS-IX, we like to start with the discussion on asking the AMS-IX to filter certain AS numbers from the default routeserver view. The issue is that even if you don’t peer with certain networks directly, the change is very real that you will receive or that the other network receive your prefixes and that you may not want to peer with those networks. What we like to have is an independent way of generating a list with badhosts ( say a top 50 ) .. ( and with our Dutch infrastructure we have a couple on the Dutch infrastructure as well.. ) A couple years ago there was the list of HostExploit .. or one could have a look at the drop-list of SH .. Personally I would like a proper model that one can explain why a certain network is listed on a certain list with a clear method explaining of what kind of abuse is noted in the said network. Topics that should be included on the rating for the list : * Phishing (hosting sites / domain registrations ) * Malware hosting ( binaries and C&C’s ) * DDOS traffic ( number of amplification devices in the network compared to the number of IP address ratio ) * Login attacks / excessive port scanning * Hosting of Child exploitation content * Infected websites / Zeus Botnets * Etc So yeah, something similar as the Top 50 of HostExploit ranking .. but HostExploit stopped producing these lists in 2014. By filtering a top 50 of badness hosters on the Routeservers would remove the cheap IXP option for network connectivity at the better Internet Exchanges and provide a way to remove any DDOS traffic via BGP null-routing via Transits. And companies that would still want to peer with a certain network, can still do so by direct peering setup via the IXP infra. And it will not bring the IXP in a position where it will be asked on why they are still offering services to certain parties .. as that might become legally difficult especially in a membership organisation. So we don’t mind if we take their money as long as are not forced to peer with them via the routeservers. Your constructive feedback is highly appreciated. Regards, Erik Bais A2B Internet

1 0

Input request for system on how to approach abuse filtering on Route Servers - bad hosters
by Erik Bais 19 May '21

19 May '21

Hi, As I asked during the Connect WG today, there are discussions currently going on in the Dutch network community to see if there is a way to get a cleaner feed from routeservers on internet exchanges. ( by default ) As you may know there is an Dutch Anti Abuse Network initiative ( AAN ) – abuse.nl The companies associated with AAN setup and all signed a manifest ( in Dutch - https://www.abuse.nl/manifest/ ) that states that we will all do our best to provide a better and cleaner internet. As members of the member organisation of the largest Internet Exchange, AMS-IX, we like to start with the discussion on asking the AMS-IX to filter certain AS numbers from the default routeserver view. The issue is that even if you don’t peer with certain networks directly, the change is very real that you will receive or that the other network receive your prefixes and that you may not want to peer with those networks. What we like to have is an independent way of generating a list with badhosts ( say a top 50 ) .. ( and with our Dutch infrastructure we have a couple on the Dutch infrastructure as well.. ) A couple years ago there was the list of HostExploit .. or one could have a look at the drop-list of SH .. Personally I would like a proper model that one can explain why a certain network is listed on a certain list with a clear method explaining of what kind of abuse is noted in the said network. Topics that should be included on the rating for the list : * Phishing (hosting sites / domain registrations ) * Malware hosting ( binaries and C&C’s ) * DDOS traffic ( number of amplification devices in the network compared to the number of IP address ratio ) * Login attacks / excessive port scanning * Hosting of Child exploitation content * Infected websites / Zeus Botnets * Etc So yeah, something similar as the Top 50 of HostExploit ranking .. but HostExploit stopped producing these lists in 2014. By filtering a top 50 of badness hosters on the Routeservers would remove the cheap IXP option for network connectivity at the better Internet Exchanges and provide a way to remove any DDOS traffic via BGP null-routing via Transits. And companies that would still want to peer with a certain network, can still do so by direct peering setup via the IXP infra. And it will not bring the IXP in a position where it will be asked on why they are still offering services to certain parties .. as that might become legally difficult especially in a membership organisation. So we don’t mind if we take their money as long as are not forced to peer with them via the routeservers. Your constructive feedback is highly appreciated. Regards, Erik Bais A2B Internet

2 2

Re: [connect-wg] Input request for system on how to approach abuse filtering on Route Servers - bad hosters
by Harry Cross 19 May '21

19 May '21

Hi Erik, Thank you for your talk yesterday, was very insightful. I have an issue with the concept of tagging an entire ASN/IP block with a negative brush, but I suspect this all boils down into how you define a “bad” ISP/IP block and the criteria needed to earn a blocking/place on the naughty list (back in 2010, there was a very interesting comparison of different blocklists here: https://labs.ripe.net/author/jsq/asn-ranking-correlations-between-spam-bloc… <https://labs.ripe.net/author/jsq/asn-ranking-correlations-between-spam-bloc…> but this does refer to purely spam email). I suppose my major issue with this is collateral damage, for example say you’ve got a /24 with shared web hosting servers in there (which instinctively have lots of users on the same IP addresses, with no pre-filtering of content going online). I’ve seen situations where shared hosting domains with thousands of users have been revoked because one user hosted one malicious binary and I’d like to be assured that this can’t happen here, where one user is the downfall of everyone. I can easily see end-user eyeball ISP support getting confused with this, making un-needed blocks hard to remove. Thanks Harry > On 19 May 2021, at 11:00, connect-wg-request(a)ripe.net wrote: > > Send connect-wg mailing list submissions to > connect-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.ripe.net/mailman/listinfo/connect-wg > or, via email, send a message with subject or body 'help' to > connect-wg-request(a)ripe.net > > You can reach the person managing the list at > connect-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of connect-wg digest..." > > > Today's Topics: > > 1. Input request for system on how to approach abuse filtering > on Route Servers - bad hosters (Erik Bais) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 18 May 2021 19:52:15 +0000 > From: Erik Bais <erik(a)bais.name> > To: "connect-wg(a)ripe.net" <connect-wg(a)ripe.net>, > "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> > Subject: [connect-wg] Input request for system on how to approach > abuse filtering on Route Servers - bad hosters > Message-ID: <9515151D-5223-457D-8BFC-D9610CEDA340(a)bais.name> > Content-Type: text/plain; charset="utf-8" > > Hi, > > As I asked during the Connect WG today, there are discussions currently going on in the Dutch network community to see if there is a way to get a cleaner feed from routeservers on internet exchanges. ( by default ) > > As you may know there is an Dutch Anti Abuse Network initiative ( AAN ) ? abuse.nl > > The companies associated with AAN setup and all signed a manifest ( in Dutch - https://www.abuse.nl/manifest/ ) that states that we will all do our best to provide a better and cleaner internet. > > As members of the member organisation of the largest Internet Exchange, AMS-IX, we like to start with the discussion on asking the AMS-IX to filter certain AS numbers from the default routeserver view. > The issue is that even if you don?t peer with certain networks directly, the change is very real that you will receive or that the other network receive your prefixes and that you may not want to peer with those networks. > > What we like to have is an independent way of generating a list with badhosts ( say a top 50 ) .. ( and with our Dutch infrastructure we have a couple on the Dutch infrastructure as well.. ) > > A couple years ago there was the list of HostExploit .. or one could have a look at the drop-list of SH .. > Personally I would like a proper model that one can explain why a certain network is listed on a certain list with a clear method explaining of what kind of abuse is noted in the said network. > > Topics that should be included on the rating for the list : > > > * Phishing (hosting sites / domain registrations ) > * Malware hosting ( binaries and C&C?s ) > * DDOS traffic ( number of amplification devices in the network compared to the number of IP address ratio ) > * Login attacks / excessive port scanning > * Hosting of Child exploitation content > * Infected websites / Zeus Botnets > * Etc > > So yeah, something similar as the Top 50 of HostExploit ranking .. but HostExploit stopped producing these lists in 2014. > > By filtering a top 50 of badness hosters on the Routeservers would remove the cheap IXP option for network connectivity at the better Internet Exchanges and provide a way to remove any DDOS traffic via BGP null-routing via Transits. > And companies that would still want to peer with a certain network, can still do so by direct peering setup via the IXP infra. > > And it will not bring the IXP in a position where it will be asked on why they are still offering services to certain parties .. as that might become legally difficult especially in a membership organisation. > > So we don?t mind if we take their money as long as are not forced to peer with them via the routeservers. > > Your constructive feedback is highly appreciated. > > Regards, > Erik Bais > A2B Internet > >

1 0