April 2023 - NANOG - lists.nanog.org

Call for paper - AusNOG 2023 Conference
by Mark 13 Apr '23

13 Apr '23

Hi all, AusNOG 2023 will be held at the Sea World Conference Centre on the Gold Coast, Queensland (Yes this is not a typo, it is not in Sydney or Melbourne this year) on the 7th & 8th of September, 2023. That’s Aussie Spring time, a great time of year to make some side-trips to our beautiful beaches, hike the hinterlands and explore our Sunshine state! The Program Committee is seeking submissions from people wishing to present at the conference. Please note that AusNOG 2023 is a technical conference so presentations must be of a technical nature (i.e. no sales or marketing presentations). Preference will be given to presentations that result in actual operational outcomes. We plan on recording presentations for release after the event for those who are unable to attend, please don’t let that deter you from submitting, if your presentation can not be published let us know and we will ensure to not record it. For further information, details of important dates, or to make a submission please see the website at the URL https://www.ausnog.net/events/ausnog-2023 Lastly, feel free to reach out to our PC committee with any questions; Jocelyn Bateman (Program Chair), Belynda Pagram, Mark Duffell and Phil Mawson.

1 0

Call for Participation -- ICANN DNSSEC and Security Workshop for ICANN77 Policy Forum
by Jacques Latour 13 Apr '23

13 Apr '23

Call for Participation -- ICANN DNSSEC and Security Workshop for ICANN77 Policy Forum In cooperation with the ICANN Security and Stability Advisory Committee (SSAC), we are planning a DNSSEC and Security Workshop for the ICANN77 Policy Forum being held in Washington, DC and as a hybrid meeting from 12-15 June 2023 in the Eastern Time Zone (UTC -4). This workshop date will be determined once ICANN creates a block schedule for us to follow; then we will be able to request a day and time. The DNSSEC and Security Workshop has been a part of ICANN meetings for several years and has provided a forum for both experienced and new people to meet, present and discuss current and future DNSSEC deployments. For reference, the most recent session was held at the ICANN76 Community Forum on Wednesday, 15 March 2023. The presentations and transcripts are available at: https://icann76.sched.com/event/1J2JA/dnssec-and-security-workshop-1-of-3, https://icann76.sched.com/event/1J2JD/dnssec-and-security-workshop-2-of-3 and https://icann76.sched.com/event/1J2JE/dnssec-and-security-workshop-3-of-3. The DNSSEC Workshop Program Committee is developing a program for the upcoming meeting. Proposals will be considered for the following topic areas and included if space permits. In addition, we welcome suggestions for additional topics either for inclusion in the ICANN77 workshop, or for consideration for future workshops. 1. Global DNSSEC Activities Panel For this panel, we are seeking participation from those who have been involved in DNSSEC deployment as well as from those who have not deployed DNSSEC but who have a keen interest in the challenges and benefits of deployment, including Root Key Signing Key (KSK) Rollover activities and plans. 2. DNSSEC Best Practice Now that DNSSEC has become an operational norm for many registries, registrars, and ISPs, what have we learned about how we manage DNSSEC? * Do you still submit/accept DS records with Digest Type 1? * What is the best practice around key roll-overs? * What about Algorithm roll-overs? * Do you use and support DNSKEY Algorithms 13-16? * How often do you review your disaster recovery procedures? * Is there operational familiarity within your customer support teams? * What operational statistics have been gathered about DNSSEC? * Are there experiences being documented in the form of best practices, or something similar, for transfer of signed zones? Activities and issues related to DNSSEC in the DNS Root Zone are also desired. 3. DNSSEC Deployment Challenges The program committee is seeking input from those that are interested in implementation of DNSSEC but have general or particular concerns with DNSSEC. In particular, we are seeking input from individuals that would be willing to participate in a panel that would discuss questions of the following nature: * Are there any policies directly or indirectly impeding your DNSSEC deployment? (RRR model, CDS/CDNSKEY automation) * What are your most significant concerns with DNSSEC, e.g., complexity, training, implementation, operation or something else? * What do you expect DNSSEC to do for you and what doesn't it do? * What do you see as the most important trade-offs with respect to doing or not doing DNSSEC? 4. Security Panel The program committee is looking for presentations on DNS, DNSSEC, routing and other topics that could impact the security and/or stability of the Internet. We are looking for presentations that cover implementation issues, challenges, opportunities and best practices for: * Emerging threats that could impact the security and/or stability of the Internet * DoH and DoT * RPKI (Resource Public Key Infrastructure) * BGP routing & secure implementations * MANRS ( Mutually Agreed Norms for Routing Security) * Browser security - DNS, DNSSEC, DoH * EMAIL & DNS related security - DMARC, DKIM, TLSA, etc... If you are interested in participating, please send a brief (1-3 sentence) description of your proposed presentation to dnssec-security-workshop(a)icann.org<mailto:dnssec-security-workshop@icann.org> by Friday, 12 May 2023. Thank you, Jacques On behalf of the DNSSEC Workshop Program Committee: Steve Crocker, Shinkuro Mark Elkins, DNS/ZACR Jacques Latour, .CA Russ Mundy, Parsons Ondrej Filip, CZ.NIC Yoshiro Yoneya, JPRS Fred Baker, ISC Dan York, Internet Society

1 0

Auth0 geolocation?
by Tim Burke 13 Apr '23

13 Apr '23

Anyone know who Auth0 is using for geolocation services? Have a customer reporting that Auth0, Lowes, Bank of America, and some other sites are reporting their IP in the wrong location. Checked the usual suspects, BrothersWISP.com<http://BrothersWISP.com> geolocation providers list, etcetera and they’re all showing in the correct location. Thanks, Tim

3 6

TLS issues with Lumen (CenturyLink)
by Andrew Gray 12 Apr '23

12 Apr '23

Can someone from Lumen/CenturyLink contact me off-list? We are seeing issues with some traffic coming from customers inside AS209 (and only AS209) that appear to be hitting some sort of in-the-middle inspection that is causing TLS issues (showing that the certificates are invalid). Thanks!

1 0

N88 Sponsorships, Peering Forum, Final Call for Presentations + CaribNOG 25 Empowers Underserved Students + Inspires Community
by Nanog News 12 Apr '23

12 Apr '23

*Become a Sponsor of NANOG 88!* *Invest in the Strength of the Community We've Built * *Sponsorship Benefits: * • Showcase your newest technologies + solutions • Increase your brand’s visibility + reach • Amplify your organization’s message • Connect with industry influencers + decision makers • Empower people + inspire change *MORE INFO* <https://nanog.org/events/sponsorship/sponsorship-opportunities/> *Creating Global Connectivity by Connecting Globally* *CaribNOG 25 Empowers Underserved Students + Inspires Community* Network Engineer II at Akamai Technologies, Aaron Atac, is a part of the millennial community at NANOG and serves on the Outreach and Programming Committee. This was his first time attending CaribNOG, and "events like these" originally motivated him to get involved. Atac has a shared mission in helping these communities inspired by his dad, who grew up in Turkey with limited access to education. *READ NOW <https://nanog.org/stories/creating-global-connectivity-by-connecting-global…>* *Sign up for the NANOG 88 Peering Forum * *Meet + Greet Peers in this 90 Min Session * The Peering Coordination Forum applications will remain open until 20 applications have been received or until the deadline date of 05, June. The forum provides time for attendees to meet and network with others in the peering community present at NANOG. <https://nanog.org/events/nanog-88/> *MORE INFO* <https://nanog.org/events/nanog-88/> *Fundamentals of Designing and Deploying Computer Networks* *ISOC Presents Moderated Course with Instructor * This course will discuss the fundamentals of networking, Ethernet, and WIFI technologies. It will additionally teach the planning, design, and deployment of simple LANs and cover how to connect a LAN to the Internet. *MORE INFO <https://nanog.org/events/fundamentals-of-designing-and-deploying-computer-n…>* *Deadline for N88 Presentations is Approaching!* *Presentation Submission Deadline is Monday, 24 April* The NANOG PC is looking to schedule over 1,600 minutes of content between General Session and Breakout Rooms for NANOG 88 - so don’t wait! *MORE INFO * <https://nanog.org/program/call-presentations/>

1 0

ABQNOG -- May 4, 2023
by John Osmon 12 Apr '23

12 Apr '23

For folks that might be in the southwest US (and any that want to visit!), we're going to hold an operators group meeting on May 4, 2023 in Albuquerque, New Mexico. Come to the land of green chile chessburgers, and meet some of the local operators. This inaugural meeting is free. We hope to see you in May! http://abqnog.org

2 1

Your DNS Servers are not working correctly.
by Mark Andrews 12 Apr '23

12 Apr '23

I work for a DNS vendor and saw reports about DNS resolution errors when looking up names under dhhs.gov. It looks like your servers are not returning non-existence answers over UDP which breaks servers that are trying to do DNS QNAME minimisation (See RFC 7816). Below are three queries that the servers should be capable of answering if they are following the DNS protocol correctly. dhhs.gov is answered but foobar.dhhs.gov doesn’t return anything and I would expect a NXDOMAIN (Name Error) response. Additionally 355.dhhs.gov should be returning a NODATA/NOERROR response at a minimum as it part of your DNS servers names. If I ask the same questions over TCP instead of UDP I get answers. This really smells like a misconfigured firewall. Mark % dig dhhs.gov @158.74.30.99 ; <<>> DiG 9.19.11-dev <<>> dhhs.gov @158.74.30.99 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59012 ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; WARNING: recursion requested but not available ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ; COOKIE: 7b8cd5530b5fa45190ac7ac264364fe858d1f83093c6da62 (good) ;; QUESTION SECTION: ;dhhs.gov. IN A ;; ANSWER SECTION: dhhs.gov. 9000 IN A 52.7.111.176 ;; Query time: 243 msec ;; SERVER: 158.74.30.99#53(158.74.30.99) (UDP) ;; WHEN: Wed Apr 12 16:30:00 AEST 2023 ;; MSG SIZE rcvd: 81 % dig foobar.dhhs.gov @158.74.30.99 ;; communications error to 158.74.30.99#53: timed out ;; communications error to 158.74.30.99#53: timed out ;; communications error to 158.74.30.99#53: timed out ; <<>> DiG 9.19.11-dev <<>> foobar.dhhs.gov @158.74.30.99 ;; global options: +cmd ;; no servers could be reached [ant-7641:~/git/bind9] marka% dig 355.dhhs.gov @158.74.30.99 ;; communications error to 158.74.30.99#53: timed out ;; communications error to 158.74.30.99#53: timed out ;; communications error to 158.74.30.99#53: timed out ; <<>> DiG 9.19.11-dev <<>> 355.dhhs.gov @158.74.30.99 ;; global options: +cmd ;; no servers could be reached % % dig dhhs.gov @158.74.30.99 +tcp ; <<>> DiG 9.19.11-dev <<>> dhhs.gov @158.74.30.99 +tcp ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18254 ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; WARNING: recursion requested but not available ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ; COOKIE: 710a14c38e16a91fd4060d86643652ecca2dce18d21e3144 (good) ;; QUESTION SECTION: ;dhhs.gov. IN A ;; ANSWER SECTION: dhhs.gov. 9000 IN A 52.7.111.176 ;; Query time: 246 msec ;; SERVER: 158.74.30.99#53(158.74.30.99) (TCP) ;; WHEN: Wed Apr 12 16:42:52 AEST 2023 ;; MSG SIZE rcvd: 81 % dig 355.dhhs.gov @158.74.30.99 +tcp ; <<>> DiG 9.19.11-dev <<>> 355.dhhs.gov @158.74.30.99 +tcp ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56223 ;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; WARNING: recursion requested but not available ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ; COOKIE: e10fe6bd8dccc0ed038bbff1643652fb582c8d51b5d3a25c (good) ;; QUESTION SECTION: ;355.dhhs.gov. IN A ;; AUTHORITY SECTION: dhhs.gov. 3600 IN SOA rh120ns1.368.dhhs.gov. hostmaster.psc.hhs.gov. 2023021759 1200 300 2419200 3600 ;; Query time: 246 msec ;; SERVER: 158.74.30.99#53(158.74.30.99) (TCP) ;; WHEN: Wed Apr 12 16:43:07 AEST 2023 ;; MSG SIZE rcvd: 137 % -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka(a)isc.org

1 0

Santander bank contact
by Matthew Crocker 11 Apr '23

11 Apr '23

If anyone on this list is affiliated with Santander bank please reach me off-list. You are blocking one of my subnets and my customers cannot access your bank website. Thanks -Matt

1 0

Fwd: WG Last Call on draft-ietf-idr-bgp-model-16
by Jeffrey Haas 11 Apr '23

11 Apr '23

The IETF BGP YANG module authors would like to draw your collective attention to a Working Group Last Call that has begun for the IETF BGP YANG module. This module provides the base for core IETF BGP technologies, and will serve as the primary point of extension for BGP-related technologies modeled in YANG in the IETF, including the BGP portion of VPN technologies. Your operational wisdom and scrutiny would be greatly appreciated. A URL for the WGLC mail is here: https://mailarchive.ietf.org/arch/msg/idr/263_yrn_ZnNRokmUwgye7Id5mHo/ For those of you who haven't participated in IETF mail lists before, the IDR datatracker page has subscription information for the mailing list: https://datatracker.ietf.org/wg/idr/about/ Thanks! -- Jeff (for the authors) > Begin forwarded message: > > From: "Dongjie (Jimmy)" <jie.dong(a)huawei.com> > Subject: WG Last Call on draft-ietf-idr-bgp-model-16 > Date: April 10, 2023 at 10:17:26 PM EDT > To: "idr(a)ietf.org" <idr(a)ietf.org> > Cc: "idr-chairs(a)ietf.org" <idr-chairs(a)ietf.org>, "Dongjie (Jimmy)" <jie.dong(a)huawei.com> > Resent-From: <alias-bounces(a)ietf.org> > Resent-To: skh(a)ndzh.com, keyur(a)arrcus.com, jhaas(a)pfrc.org, jie.dong(a)huawei.com > > Hi WG, > > This begins the Working Group Last Call for "YANG Model for Border Gateway Protocol (BGP-4)", draft-ietf-idr-bgp-model-16. The draft could be found at: https://datatracker.ietf.org/doc/html/draft-ietf-idr-bgp-model-16 <https://datatracker.ietf.org/doc/html/draft-ietf-idr-bgp-model-16>. > > Since all the IDR chairs are coauthors of this document, I’m helping with this last call procedure. Please reply to the list with your comments. Considering this is a long document with a big YANG model, the last call will last for 4 weeks and conclude on Sunday, 7 May, 2023. > > The authors are requested to state whether they are aware of applicable IPR related to this draft. Similarly, if others in the Working Group are aware of applicable IPR, please also disclose them. > > People are encouraged to indicate whether there is implementation of this document. According to the IDR rule, at least two implementations will be required to advance the document. > > > Best regards, > Jie (on behalf of the IDR chairs)

1 0

Spoofer Report for NANOG for Mar 2023
by CAIDA Spoofer Project 08 Apr '23

08 Apr '23

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Mar 2023: ASN Name Fixed-By 33185 TGLO-VGLO 2023-03-03 54825 PACKET 2023-03-08 62005 AdNet-Telecom 2023-03-20 399445 2023-03-27 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Mar 2023: ASN Name First-Spoofed Last-Spoofed 6939 HURRICANE 2016-02-22 2023-03-24 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2023-03-30 20412 CLARITY-TELECOM 2016-09-30 2023-03-31 6181 FUSE-NET 2016-10-10 2023-03-26 25787 ROWE-NETWORKS 2016-10-21 2023-03-30 10796 TWC-10796-MIDWEST 2016-10-24 2023-03-30 271 BCNET 2016-10-24 2023-03-31 1403 EBOX 2016-11-12 2023-03-28 2828 XO-AS15 2016-11-21 2023-03-17 852 ASN852 2017-04-16 2023-03-26 6461 ZAYO-6461 2017-06-21 2023-03-28 33452 RW 2018-09-19 2023-03-26 21804 ACCESS-SK 2019-06-09 2023-03-05 11814 DISTRIBUTEL-AS11814 2020-11-22 2023-03-22 398836 2021-03-12 2023-03-27 22773 ASN-CXA-ALL-CCI-22773-RDC 2021-10-24 2023-03-13 46997 2021-12-22 2023-03-29 394414 E2WS 2022-05-08 2023-03-28 397086 GLOBAL-FRAG-NETWORKS-HOUSTON 2022-06-16 2023-03-27 11976 FIDN 2022-11-16 2023-03-29 12183 TALKIE-COMMUNICATIONS 2022-12-10 2023-03-30 21555 LHTC 2023-01-01 2023-03-24 33185 TGLO-VGLO 2023-02-04 2023-03-03 399852 2023-02-16 2023-03-26 210546 2023-02-27 2023-03-07 203394 asn-Lighting 2023-03-07 2023-03-21 199785 2023-03-11 2023-03-24 211380 2023-03-15 2023-03-29 964 GONET-ASN-17 2023-03-15 2023-03-29 140224 2023-03-18 2023-03-18 199868 2023-03-18 2023-03-24 41378 KirinoNET 2023-03-23 2023-03-30 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0