- lir-wg - mailman.ripe.net

New RIPE NCC reverse delegation procedure
by RIPE NCC IN-ADDR. ARPA Role Account 13 Sep '99

13 Sep '99

Dear Working Group, we intend to rewrite the software that we use to automate reverse delegation requests, with the (main) goals: - simplify/improve the request procedure - maximise automation to keep resource demands reasonable e.g. improving our internal system, including, for example, IPv6 automation - improve the maintainability of the software There are several issues which come up with regard to the request procedure. I've outlined some of our *intentions* below in the hope of soliciting feedback. ---> Requesters will only need to write to a single automatic mailbox <auto-inaddr(a)ripe.net>, to request reverse delegation. Database update will take place automatically once all other checks are passed. + simplifies and speeds up procedure ---> If we attempt a zone tranfer to check that the contents of a zone are syntactically correct and consistent with other nameservers, and the transfer fails, we will not reject the request. We will check all of the data which can be queried without a transfer. + many zone administrators are very happy. - we cannot check some of the zone contents for problems. However, we think that the information we can collect without the transfers is sufficient to decide whether the delegation itself is well setup, even if it's contents are not. [Note: zone tranfers to our network will still be *required* to be enabled for reverse /16 zones, since we will continue to require that ns.ripe.net be included as a secondary for these zones.] ---> It will be mandatory that a registry ID is included in all requests for reverse delegation, as is currently the case for requests to <hostmaster(a)ripe.net>. We will require that all requests come from an LIR receiving service (i.e. paying for services), and that the requester is one of the registry contact people/ contact role-account. + resource efficient. We only deal with people who are experienced in the reverse delegation procedure and aware of the RIPE NCC and RIPE DB procedures in general -> minimal time explaining procedure and general registry system concepts. Currently we spend much time dealing with inexperienced end-users who will set up only one or a few zones and therefore do not spend the time to become knowledgable concerning the procedures. + fair to paying members. We do not spend time guiding people who do not contribute to the costs. ---> We will only accept requests in the form of a RIPE DB domain object (as opposed to also accepting inetnum objects). + uniform update procedure for all types and sizes of zone, procedure becomes much clearer, confusion and doubt are banished. + removes possibility of 3-way inconsistency between domain objects in the RIPE DB, inetnum objects in the RIPE DB and the corresponding zone file delegations. + clear to users of DB in what type of object they need to look for contact info on the zone. + removes problem where errors in a single reverse zone of a corresponding large inetnum mean the whole inetnum has to be resubmitted, - for requests involving large numbers of zones lots of domain objects will be needed. We'll lessen this by making possible a shorthand domain object like this: domain: x-y.w.z.in-addr.arpa This will result in all reverse zones x-y being delegated (upon success), and x-y domain objects being entered in the database. This option will only be possible for corresponding address space which is occupied by a single inetnum object, to reduce the possibilty of misuse/mistakes. Thanks in advance for any input, Lee Wilmot RIPE NCC

1 0

RIPE 34 LIR WG Draft Agenda [SPT1999091000000043]
by support＠waldonet.net.mt 10 Sep '99

10 Sep '99

Dear lir-wg(a)ripe.net, This is an automated response from Support Pools . We received your message on 10/09/99 at 5:11:32 PM. We would like to offer our sincere thanks to you for writing to us. Your tracking number for this message is : SPT1999091000000043. Our staff are available to respond to messages during regular business hours, excluding holidays. Messages are normally answered within one business day. You should be receiving a personal response by e-mail from one of our staff shortly. In the event you need to contact us regarding your original message, please refer to the tracking number at the top of this message. This will help our staff locate and review your correspondence with us. Thanks once again for writing. You should hear from one of our staff shortly. Waldonet Ltd Telephone (Sales & Admin) 419100 Telephone (Customer Support) 419200 Fax: 419300

1 0

RIPE 34 LIR WG Draft Agenda
by hph＠sys.sol.no 10 Sep '99

10 Sep '99

Dear Working Group Member ! I have put together a first draft of the agenda for the upcoming working group meeting. Please read it carefully and make suggestions for additions and changes. Remember: this is YOUR forum, please send me YOUR suggestions on what you want us to spend time on at the meeting in Amsterdam, Looking forward to meet you there, Hans Petter Holen LIR WG Chair ---------------------------------------------------- RIPE 34 - Local IR Working Group first draft Agenda 1. Admin scribe participant list charter mailinglists 2. Agenda 3. Introduction of the new Registration Services manager, Nurani Nimpuno. meet the RIPE NCC hostmasters 4. RIPE 33 minutes actions 5. Reports from the Registries RIPE APNIC 6. The RIPE community POLICY making process by Mirjam Discussion: is this well understood and 7. ICANN - ASO Current status, Further work Definition of the selection procedure for the address council selection 8. AOB

1 0

MoU based ASO proposal accepted by ICANN
by RIPE NCC Staff 08 Sep '99

08 Sep '99

[Apologies for duplicate mails] This is an update to our earlier posting regarding a proposal to form an Address Supporting Organisation (ASO) within the framework of the International Corporation for the Assignment of Names and Numbers (ICANN). RIPE NCC, together with the other Regional Internet Registries (RIR), ARIN and APNIC submitted this proposal for ICANN to consider at their August 26th Board meeting in Santiago, Chile. The RIPE NCC is pleased to report that ICANN has accepted this proposal. The resolutions approved at the recent ICANN Board meeting can be found at: http://www.icann.org/santiago/santiago-resolutions.htm The RIR Boards have worked to produce a draft Memorandum of Understanding that will form the ASO. This document can be found at: http://www.ripe.net/info/ncc/mou-draft.html In addition we need to progress with the selection of nominations for the Address Council. A formal call for nominations has been published outlining the process of the initial formation of the Address Council. The call for nominations can be found at: http://www.ripe.net/info/ncc/asonomin.html We would like thank you for your continued support in this process. Paul Rendek Communications Officer RIPE NCC

1 0

ICANN: Call for nominees to the Addres Council
by RIPE NCC Staff 08 Sep '99

08 Sep '99

Dear Colleagues, We are pleased to announce a call for nominations to the ICANN ASO committee. Please read this carefully as it is an important step in the process of furthering development in this area. In our effort to reach as many interested parties as possible we may unavoidably send you two copies. Please accept our apologies for this. ========= Call for Nominations for Members of the Address Council of ICANN - RIPE NCC Service Region Amsterdam, 8 September 1999 This is a call for nominations of individuals to serve as members of the Address Council, a body that is to be established under the authority of the Address Supporting Organisation (ASO) of ICANN. This document describes the process that will be followed in the selection of Address Council members. If you are interested in nominating an individual, or if you are interested in being nominated as a member of the Address Council, please read through the Memorandum of Understanding (MoU) and this document carefully. 1. The Address Supporting Organisation ----------------------------------------------------- The ASO will be created though a MoU that will be executed between the current Regional Internet Registries (RIRs) and ICANN. The latest version of this MoU is available under the ICANN and ASO current issues section on the RIPE NCC Web site at: http://www.ripe.net/info/ncc/icann.html Section 2(a) of the MoU provides a framework for the regional selection procedure of Address Council members. Due to additional time constraints set by the current ICANN board the schedule proposed in section 2(a) cannot be realised. Therefore in accordance with section 2(a)(v) a modified procedure will be followed to select the initial Address Council members with emphasis on openness and transparency. The RIPE NCC Association has chosen to make use of the existing open processes in their region to select Address Council members. The selection of the Address Council members will take place at the first following RIPE Meeting scheduled to take place from 21-24 September 1999 in Amsterdam, The Netherlands. In accordance with section 2(a)(v) the definition of the selection procedure will be part of the Local Internet Registry Working Group (Local IR WG) meeting scheduled for Wednesday, 22 September 1999 at 14:00 at the upcoming RIPE meeting. This working group has traditionally served as the RIPE NCC's IP address related policy making forum and is open to all interested parties. The actual selection will take place at the RIPE 34 Meeting - Plenary session to be held on Thursday, 23 September 1999 starting at 14:00. Further information about the upcoming RIPE Meeting can be found at: http://www.ripe.net/meetings/ripe/index.htmlripe-34/ 2. Address Council Nominations Process ------------------------------------------------------ Three individuals from the RIPE NCC Region will be selected to serve as initial members of the Address Council. The selection will be made from the set of individuals who have been nominated within this process. Any individual may be nominated within this process, with the exception of any staff member of any Regional Internet Registry. Self-nominations are permitted. Nominations are to be sent by email to: nominations(a)ripe.net The information included with the nomination is to be in English, and should include: Name of Nominee Organisation Email Address Postal Address Phone Number Motivation for Nomination All nominations are to be emailed to the above address on or before Sunday, 19 September 1999. All nominees will be contacted via email to confirm their willingness to serve as an Address Council member. If the nominee cannot be contacted via email then the nomination will not be confirmed. All confirmed nominations will be listed on the RIPE NCC Web site as soon as they are confirmed. Important Dates: 19 September 1999: deadline for Address Council nominations 21-24 September 1999: RIPE Meeting 34 - Amsterdam, The Netherlands Keith Mitchell, Chairman, RIPE NCC Executive Board Rob Blokzijl, Chairman, RIPE

1 0

Tracking stealth portscan/pepsi attacks
by Petra Zeidler 07 Sep '99

07 Sep '99

Dear colleagues, there seems to have been quite a wash of stealth portscans and/or pepsi attacks lately (stealth portscan: you portscan with 99% of the sender addresses faked, but your own are among them; pepsi: "only" a DoS attack, you don't bother hiding your own address in the random sender flood, both of course UDP). cybercity.dk must have been seeing some of these attacks pass, first glance judging from http://stat.cybercity.dk/ripe/ and the fallout in de.xlink (where I positively know the addresses not to be routed) and de.zz (where most of the address space is handled by RIPE nowadays). Also my private machine at home has been attacked over several days, much good it did them, but that makes it a personal axe to grind :-> Besides, lots of people who admin firewalls don't necessarily expect such stealth attacks to happen and complain to all the owners of the faked addresses about the port scans, thus generation additional workload on the abuse people. I'd like to have a chance to catch the perpetrators. This would need to be a multi-provider cooperation in the majority of cases. Do we have an appropriate forum to discuss this at the next RIPE meeting? kind regards, Petra Zeidler -- i.A. Petra Zeidler, Neukundenanschluss Xlink Internet Service GmbH [X] zeidler(a)xlink.net [X] Tel: 0721/9652-220 [X] Fax: 0721/9652-209 [X] Geschaeftsfuehrer: Michael Rotert. Amtsgericht Karlsruhe HRB 8161. [X] Auftraege erledigen wir zu unseren Allgemeinen Geschaeftsbedingungen.

14 24

Top 100 Maintainers List
by RIPE Database Administration 06 Sep '99

06 Sep '99

3 2

Re: Tracking stealth portscan/pepsi attacks
by Berislav Todorovic 06 Sep '99

06 Sep '99

Dear collagues, The traffic on this list has increased rapidly since we started to discuss various security details. Regrettably, almost no persons from various CERTs are subscribed to this list, while they deal with day-to-day requests for intrusion and attack coordination. Therefore, a security-related RIPE WG might really be needed. Its aims would be to: * enhance incident coordination among ISPs; * ensure exchange of ideas and experiences in network and systems security; * issue security-related recommendations and BCP documents; * establish tighter relatioship between the ISPs and the CERTs. The group should be open to any interested party. The group should also elect a representative who would participate in activities of the CERT and IRT community (meetings, workshops, mailing lists etc.) and/or provide continuous input from various CERTs and IRTs. Few days ago, I received an interesting message from Karel Vietsch, Secretary General of TERENA, related to the subject we're talking about. I'm forwarding it, hoping it would be interesting for wider community (NOTE: the meeting, mentioned in Mr Vietsch's message is closed - only CERT community memebers can participate, but if we find time to create the Security-WG, a representative of the WG can apply to attend it): -------------------------- Begin included message -------------------------- Date: Fri, 03 Sep 1999 22:43:51 +0200 From: Karel Vietsch <vietsch(a)terena.nl> Subject: European collaboration between CERTs To: Berislav Todorovic <BERI(a)etf.bg.ac.yu> Cc: B.Gilmore(a)ed.ac.uk, dyer(a)terena.nl, demchenko(a)terena.nl Dear Mr. Todorovic, A colleague drew my attention to your message below. Indeed, almost three years ago Daniel Karrenberg posted a proposal for a SIRCE service to be provided by the RIPE NCC but he could not realise this plan due to lack of financial commitments. Perhaps you are not aware that Daniel's initiative was actually a proposed response to a call for tender for the SIRCE pilot service, organised by TERENA. As mentioned above, the RIPE NCC was not able to put forward a proposal, but some other organisations did, the best proposal was selected and the SIRCE pilot service started in May 1997. It is currently being provided by UKERNA. See the SIRCE Web site <www.sirce.net> for further details on the current pilot service. The pilot will come to an end later this month, and a meeting has been organised to discuss plans for future collaboration between CERTs in Europe, following on from the SIRCE pilot. This meeting will take place in Amsterdam on Friday 24 September 1999, immediately following the next RIPE meeting. See the invitation below. If you are interested in attending this meeting, please let me know. Best regards, Karel Vietsch TERENA Secretary General +++++++++++++++++++++++++++ Dear colleagues, It is my pleasure to invite you to a meeting to discuss the future collaboration of CERTs in Europe. The meeting will be held on Friday 24 September 1999, 11:00 - 15:00 hours, at the TERENA Secretariat in Amsterdam. Background Collaboration and co-ordination between CERTs in Europe has been under discussion at least since 1992. The report of the TERENA Task Force "CERTs in Europe" (1995) led to a pilot ("SIRCE") for a European CERT co-ordination service. This pilot, which started in May 1997 and is currently being provided by UKERNA, will come to an end later this month. In general the responses to the pilot service have been positive, and many have expressed their appreciation for the work done and the experiences gained during the past 2.5 years. Nevertheless, it has become clear that it will not be possible to establish a permanent operational European CERT co-ordination service at the end of the pilot phase. This is mainly because the needs of the various networks in Europe and their CERTs are so different that it is not possible to collect a sufficient critical mass to provide the (substantial) funds that would be needed to fund such a professional permanent service. Still there is a clear need for and willingness of CERTs in Europe to collaborate on issues of common interest. Such collaboration can take the form of exchange of information, limited work provided by one or more CERTs for the entire European CERT community and joint activities of CERTs who are interested in jointly solving a particular common problem. Rather than a model of a centrally provided service, one would then adopt a model of collaborative activities in one or more working groups, task forces and/or small projects. This thought has been put forward by a number of CERTs in the final discussions on SIRCE, and several examples of possible joint activities have been given. Now that the SIRCE pilot is being completed this month, the time seems ripe to discuss these suggestions in more detail and to agree on future activities. Purpose of the meeting The purpose of the meeting on 24 September 1999 is to identify issues that can be addressed, (information) services that can be provided, activities that can be undertaken and problems that can be jointly solved, through collaborative actions of CERTs in Europe. It is the intention to identify for each of these: which CERTs (and possibly other parties) are interested in the issue, how they feel the issue should be addressed and what they can commit (in manpower or other resources) to joint work on the issue. Agreements should then be reached as to when and how to start such work, and how to organize it. We would hope that the meeting will lead to one or more joint working groups, task forces and/or projects that can be started very soon. Who should attend the meeting? The envisaged participants in the meeting will be the (leading) staff members of CERTs in Europe. Many of the current active CERTs in Europe are attached to Research and Education Networks (NRENs), but representatives of other CERTs who are interested in collaboration with the NREN CERTs are most welcome to participate in the meeting. The host Having been instrumental in European CERT collaboration in recent years (e.g. through the TERENA Task Forces and by making the arrangements for the SIRCE pilot), TERENA feels it as its responsibility to facilitate the best possible future collaboration between CERTs in Europe now that the SIRCE pilot is nearing its completion. Hence TERENA , in consultation with the contributors to the SIRCE pilot, has taken the initiative to organize and host the meeting on 24 September to discuss future plans. The meeting will be chaired by Brian Gilmore, member of TERENA's Executive Committee. Meeting preparation An agenda and other documents for the meeting will be sent out during the next two weeks. Obviously it will help people to prepare for the meeting if those who have specific suggestions for collaborative activities of CERTs in the coming years, could briefly describe their ideas and circulate them to the other meeting participants. Please send your suggestions by e-mail to me at <vietsch(a)terena.nl>. Logistics The address of the TERENA Secretariat is: Singel 468, 1017 AW Amsterdam, The Netherlands. Phone: +31 20 5304488. Please see http://www.terena.nl/info/secretariat/location.html for a description of how to reach our office. The meeting on 24 September is scheduled to follow immediately on a RIPE meeting which will take place in Amsterdam during the preceding days, for the convenience of those who would be interested to attend both meetings. For others it is important to note that with the meeting starting at 11:00 and finishing before 15:00 hours it will be possible for most people in Europe to make this a one-day trip, travelling to Amsterdam early in the morning and back in the late afternoon. In case you will nevertheless need to spend one or more nights in Amsterdam, TERENA's Secretary Ms. Carol de Groot <secretariat(a)terena.nl> can help you find suitable accommodation. Since hotels in Amsterdam are extremely full, you are urged to make your hotel arrangements (either directly with the hotel or via Carol de Groot) ** as soon as possible **. Finally, in order to help us prepare for the meeting, please let me know as soon as possible whether you will be able to attend the meeting. My e-mail address is: <vietsch(a)terena.nl>. We will then include you in further mailings and send you the documents for the meeting. I am looking forward to seeing you in Amsterdam on Friday 24 September and I hope that we will have a very fruitful meeting! Best regards, Karel Vietsch TERENA Secretary General PS. : In case not you yourself but one of your colleagues will be the appropriate person to participate in the meeting: please pass on this invitation! ++++++++++++++++++++++++++++++++++++++++++++++ Karel Vietsch TERENA Secretary General Singel 468, 1017 AW Amsterdam, The Netherlands phone: +31 20 5304488 fax: +31 20 5304499 e-mail: <vietsch(a)terena.nl> WWW: http://www.terena.nl .-------. | --+-- | Berislav Todorovic, B.Sc.E.E. | E-mail: BERI(a)etf.bg.ac.yu | /|\ Hostmaster of the YU TLD | |-(-+-)-| School of Electrical Engineering | Phone: (+381-11) 3221-419 | \|/ Bulevar Revolucije 73 | 3218-350 | --+-- | 11000 Belgrade SERBIA, YUGOSLAVIA | Fax: (+381-11) 3248-681 `-------' --------------------------------------------------------------------

3 2

Re: Tracking stealth portscan/pepsi attacks
by Berislav Todorovic 03 Sep '99

03 Sep '99

>> How do you manage large BGP customers with lots of networks? One idea is to generate access lists automatically from the data in the route registry. However, that may have some significant drawbacks. First, there are many inconsistences between the IRR and reality, so some connectivity problems may arise. Aside of that, the amount of access lists might affect router perfomance. Regards, Beri .-------. | --+-- | Berislav Todorovic, B.Sc.E.E. | E-mail: BERI(a)etf.bg.ac.yu | /|\ Hostmaster of the YU TLD | |-(-+-)-| School of Electrical Engineering | Phone: (+381-11) 3221-419 | \|/ Bulevar Revolucije 73 | 3218-350 | --+-- | 11000 Belgrade SERBIA, YUGOSLAVIA | Fax: (+381-11) 3248-681 `-------' --------------------------------------------------------------------

1 0

Re: Tracking stealth portscan/pepsi attacks
by Berislav Todorovic 02 Sep '99

02 Sep '99

>> I'd vote for a WG focussing on these things. IIRC there have been >> plans on a RIPE-Security WG around RIPE-29 or 30. If there's a bigger >> interest on this topics what about a Security-BOF next RIPE? In >> general, net-abuse has become one of the major problems these days, >> included but not limited to attacks, scans, mailbombs, a.s.o. Three years ago, Daniel Karrenberg posted a proposal for creation of a pilot incident response team, called Security Incident Response and Coordination in Europe (SIRCE). The team should have been operating under the RIPE NCC umbrella. Everyone was pretty happy with the proposal itself, but when it came to finances - only a small number of ISPs agreed to participate in funding. Therefore, as far as I remember, the RIPE NCC had to widthdraw the proposal. That, however, doesn't mean we can't think about resurrection of SIRCE. At least, we can start with a WG, but a central IRT that will coordinate the incidents is really needed. Regards, Beri .-------. | --+-- | Berislav Todorovic, B.Sc.E.E. | E-mail: BERI(a)etf.bg.ac.yu | /|\ Hostmaster of the YU TLD | |-(-+-)-| School of Electrical Engineering | Phone: (+381-11) 3221-419 | \|/ Bulevar Revolucije 73 | 3218-350 | --+-- | 11000 Belgrade SERBIA, YUGOSLAVIA | Fax: (+381-11) 3248-681 `-------' --------------------------------------------------------------------

1 0