swinog

swinog@lists.swinog.ch

1 participants
2935 discussions

planned ddos - alert
by Pascal Gloor 24 Jul '21

24 Jul '21

Dear SwiNOG, We (Init7) expect a >100Gbps ddos this Thursday or Friday. The attack will be directed against a transit customer of ours and will be the 2nd attack from this known group against this customer. Please make sure you’re not a source and keep an eye on your graphs Thanks! Pascal

2 1

##### SwiNOG #37 - Call for Papers #####
by Simon Ryf 22 Jul '21

22 Jul '21

Dear SwiNOG community, Please forward me to whomever you think should now about our community. This is the official Call for Paper email. Please submit your proposal via https://www.swinog.ch/cfp/ The 37th meeting of the Swiss Network Operators Group (SwiNOG) will be held in Berne on top of the Gurten on Thursday December 2nd 2021. Important Dates for https://www.swinog.ch/meetings/swinog37/: 23.07.2021 Call for Papers 01.10.2021 Registration opens 31.10.2021 Call for Papers closing 15.11.2021 Final publication of agenda 25.11.2021 Registration closes 26.11.2021 Deadline for all slides 02.12.2021 Meeting day Topics for Presentations/Talks Please re-submit your paper if you're still up with a topic which you have submitted during … yeah whatever you call this period…! The number and length of presentations per session is not fixed, although we prefer the length of the presentations to be between 5 to 45 minutes. Here is a non-exhaustive list of typical SwiNOG meeting topics: * Security, DDOS Mitigation, * IPv6 * Open-Source tools and interesting Github projects * International view of the internet (incidents, outages, measurements) * Routing * Peering * Server applications (DNS, Web, etc.) * Legal issues (BÜPF, etc.) * Telecommunication politics (Net Neutrality, Incumbent monopoly, etc.) * Off-Topic if you think the audience will enjoy * Feel free to talk to us about any kind of topic and collaboration! Or you can always start a discussion on the list - I'm sure people join in. Or join our telegram group at https://t.me/SWINOG Language of Slides and Talks The whole day will be hold in English, therefore we kindly ask you to produce your presentation in English. Submission Guidelines All submissions must have a strong technical bias (or be completely off topic) and must not be promotional for your employer. Please remember that your presentations should be suitable for a target audience of technicians from varied backgrounds, working for companies whose sizes may vary considerably. To submit a proposal for a presentation, we request that you to fill in the form at https://www.swinog.ch/cfp/ We also welcome suggestions for specific presentations which you feel would be valuable to the SwiNOG community. Please be aware that your presentation will be published on the SwiNOG website after the event. We can publish modified slides if requested - it might be that some confidential data will be presented by you which are not intended for publication on the internet. Greetings, Simon SwiNOG Core Team General Information (SwiNOG Community) The Swiss Network Operators Group (SwiNOG) is an informal group of people who are concerned with engineering and operation of the Swiss Internet. SwiNOG exists to enhance the quality of Internet services available in Switzerland. It does this by fostering the free exchange of technical ideas and information between different companies and organisations. SwiNOG is a community for professionals who are operating, designing or researching the Internet. It provides a technical forum where those working on, with and for the Internet can come together to solve problems with every aspect of their (net)work. The meeting is designed to provide an opportunity for the exchange of information among network operators, engineers, researchers and other professionals close to the network community. More information about SwiNOG can be found at http://www.swinog.ch/, Facebook, Xing, Information about the meeting will be published at http://www.swinog.ch/meetings/swinog37/ General Information (SwiNOG Organisation) The SwiNOG Organisation Association is a non-profit association under article 60 and further of the swiss civil law. It manages the SwiNOG community ressources (domain, web, mailing-lists, etc..) and organises SwiNOG meetings. Contact: SwiNOG Organisation 8000 Zurich Switzerland

1 0

[FYI] Call for Presentations for the virtual European Peering Forum 2021
by Arnold Nipper 13 Jul '21

13 Jul '21

Dear all This is a call for Presentations for the virtual European Peering Forum 2021 AMS-IX, DE-CIX, LINX, Netnod are happy to host the virtual European Peering Forum (EPF) 2021 from the 20th - 22th September 2021. The event will welcome peering managers and coordinators from networks connected to the host Internet exchanges. Besides some interesting topical agenda, the three-day event accommodates room for attendees to meet virtually on a one-to-one basis to discuss bilateral peering business opportunities. The programme committee will be looking for presentations related to peering and technical topics of interconnection. Your presentation should address * Interconnection Automation * Regional Peering * Interconnection / Peering Internet Governance and Regulatory Topics * Economic and Product Trends * Peering / Interconnection strategies * Interesting findings about Peering / Interconnection * 400GE and beyond * Any other hot topic related to Interconnection / Peering Submissions =========== Presentations must be of a non-commercial nature. Product or marketing-heavy talks are strongly discouraged. Submissions of presentations should be made to the programme committee <epf-pc(a)peering-forum.eu>. Please include: * Author's name and e-mail address * Presentation title * Abstract * Slides (if available) * Time requested (max. 30 minutes incl. Q&A) Deadlines ========= Please send in your presentation asap. We decide on a first come first serve basis. The latest date for submission is July 30th. More information about the event and other activities around the virtual EPF 2021 may be found at * https://peering-forum.eu/ * https://www.facebook.com/groups/1586607564933665/ Cheers Arnold -- Keep calm, keep distance, keep connected! Arnold Nipper email: arnold(a)nipper.de mobile: +49 172 2650958

1 0

Swisscom (Emergency) Phone Outage Post-Mortem
by Tobias Brunner 12 Jul '21

12 Jul '21

Hi all, Does anyone see a chance to get hands on the post-mortem they (hopefully) write about the phone outage from last week? I'm very interested in technical details, as I always feel that from such stories we can all learn and improve. Cheers, Tobias

2 1

Geldspielgesetz: 404 COMLOT renamed to GESPA? (or did they get hacked!?)
by Jeroen Massar 07 Jul '21

07 Jul '21

Hi Folks, Is there an official announcement that I missed? Seems that blocklist.gespa.ch is the new place, and that all of comlot.ch now points to gespa.ch, but filenames have been renamed too. (see previous brokeness email in the mailarchive for old details). Considering neither is under admin.ch, cannot really say it is an official website either. Anybody got an official update about this, or did they just break the system again? Cannot find any duckduckgoogle references either. Why did Swiss Voters vote for this broken system if it is not working anyway? (it is not, because otherwise it is a perfect list to find your casinos that are 'illegal' or something).... All those poor* casino users that now have access to a bunch of unlicensed casinos... what a sad day again. Greets, Jeroen * = as the house always wins ----- $ wget -v https://blacklist.comlot.ch/blacklist.comlot.ch.pub --2021-06-03 08:21:02-- https://blacklist.comlot.ch/blacklist.comlot.ch.pub Resolving blacklist.comlot.ch (blacklist.comlot.ch)... 194.187.88.5 Connecting to blacklist.comlot.ch (blacklist.comlot.ch)|194.187.88.5|:443... connected. HTTP request sent, awaiting response... 301 Moved Permanently Location: https://blocklist.gespa.ch//blacklist.comlot.ch.pub [following] --2021-06-03 08:21:03-- https://blocklist.gespa.ch//blacklist.comlot.ch.pub Resolving blocklist.gespa.ch (blocklist.gespa.ch)... 194.187.88.5 Connecting to blocklist.gespa.ch (blocklist.gespa.ch)|194.187.88.5|:443... connected. HTTP request sent, awaiting response... 404 Not Found 2021-06-03 08:21:05 ERROR 404: Not Found. ----- It seems the "official specification" (comlot.ch redirects is gone): https://www.gespa.ch/download/pictures/9a/e78461lvxuzcv82c505b1kpckd58pf/sp… still have blocklist.comlot.ch in it. Except for the URL itself, Google also finds nothing about this: https://www.google.com/search?hl=en&q=%22blacklist.gespa.ch%22 $ dig +short comlot.ch 194.187.88.3 $ dig +short comlot.ch aaaa <none> $ dig +short comlot.ch mx 10 mx.cmsbox.com. $ dig +short comlot.ch ns ns3.netstyle.ch. ns1.netstyle.ch. ns2.netstyle.ch. $ dig +short gespa.ch a 194.187.88.3 $ dig +short gespa.ch aaaa 2a00:c38:2:9f62::2:3 dig +short comlot.ch mx 10 mx.cmsbox.com. $ dig +short gespa.ch ns ns3.netstyle.ch. ns2.netstyle.ch. ns1.netstyle.ch. I also gotta love the generic wildcard Let's Encrypt cert, though comlot.ch did that too https://crt.sh/?q=gespa.ch https://crt.sh/?q=comlot.ch Looks like a rather generic hoster. Maybe the whole domain got hacked?

2 2

Cloudflare DMCA Takedown requests - but content not present under mentioned IP
by Benoit Panizzon 06 Jul '21

06 Jul '21

Dear List I am a bit puzzled by repeated Cloudflare Takedown Requests regarding the domain: lord-film.cash we are getting. lord-film.cash has address 172.67.181.230 lord-film.cash has address 104.21.32.5 lord-film.cash has IPv6 address 2606:4700:3035::6815:2005 lord-film.cash has IPv6 address 2606:4700:3032::ac43:b5e6 According to Cloudflare, the content is hosted at an IP address under our control, on a Webserver on Port 80. I told them some time ago, there is no Webserver running under the IP address they mention. They replied, they could verify the IP with: curl -v -H "Host: lord-film.cash" [IPADDRESS]/ Still, every time I try, I don't get a connection. No wonder, that is a NAT router with Firewall. So I wonder, if either the user of that IP Address has cleverly set up a firewall which blocks all requests not via Cloudflare proxies, or if this domain uses some kind of P2P Protocol and the IP of that user is just one of 'many' which is only reachable, when some P2P tool is running and opening a UPNP Port. When I try to access the site itself: http://lord-film.cash/ I get 'access denied' from Cloudflare. Do others get similar takedown notices? Maybe even for that same domain? Mit freundlichen Grüssen -Benoît Panizzon- -- I m p r o W a r e A G - Leiter Commerce Kunden ______________________________________________________ Zurlindenstrasse 29 Tel +41 61 826 93 00 CH-4133 Pratteln Fax +41 61 826 93 01 Schweiz Web http://www.imp.ch ______________________________________________________

5 5

sendinblue / newsletter sender whitelisting?
by Michael Koloff 01 Jul '21

01 Jul '21

Hello Together Question for mail infrastructure operators: In the last weeks we had requests from customers, whose "newsletter" via sendinblue could not be delivered to us. In the logs I see at the given time, that the IP of sendinblue was on the blacklist of spamcop.net. That is, the mails were rejected by us. The customer now says the mails go through everywhere else (I'm looking at you bluewin.ch), just not with you. sendinblue suggests to whitelist their IPs (> 100'000 ip addresses) (https://help.sendinblue.com/hc/de/articles/208848409-SendinBlue-IP-Bereiche) Of course I would like to avoid this. Question: How do other providers deal with such senders? Let everything from sendinblue through for the sake of the customers? Thanks for your answers. -- Michael Koloff sasag Kabelkommunikation AG

2 1

MELANI BGP Blackhole Service
by Fredy Künzler 29 Jun '21

29 Jun '21

A customer (!) pointed us to the MELANI BGP Blackhole Service which has been around for almost two years, apparently. For technical details see the attached file. Are we the only ones not aware of it? I don't recall an official announcement by the MELANI team in this list or elsewhere in the community, and as far as I know it hasn't been discussed yet within SwiNOG. While the technical implementation seems to be rather simple - an eBGP multihop session to the IP address mentioned (hosted by nine.ch), a number of legal, operational and political questions are remaining: - no IPv6 implementation, no backup (2nd) host - how is the list of IP addresses maintained? Is there a regular check and removal procedure of no-longer-botnet-addresses? - is there any guarantee that the infrastructure will never be abused for (state) censorship? - how to implement it only for end users which do want the service while not distributing the black holes in the whole backbone - and, last but not least, why MELANI team or the so called "Outreach Team vom Bund" (Quote customers email) never told the SwiNOG community about the idea? Instead, they are suggesting strange things: "Gemäss outreach, ist das bei Init7 nicht möglich da dieses gegen eure Policy verstosst?" I suppose MELANI and the "Outreach Team vom Bund" should give some explanations. They do know where to find the SwiNOG community, and their style of (non-)communication is not acceptable. -- Fredy Künzler Init7 (Switzerland) Ltd. Technoparkstrasse 5 CH-8406 Winterthur https://www.init7.net/

1 0

more S3
by Eliot Lear 28 Jun '21

28 Jun '21

Colleagues, Sorry for the terse note earlier (I hit the wrong key). In any case, I was seeing latency of anywhere from 89-300ms earlier from two vantage points- Cablecom, where it is still a bit of an issue, and Datasource, where it is now clearing. Eliot

1 0

S3 problems?
by Eliot Lear 28 Jun '21

28 Jun '21

Is anyone else seeing high latency to S3 today?

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

swinog