- MANRS Community - MANRS Mailing Lists

Routine Monitoring of Source Address Validation Deployment by Operators
by Brandon April 26, 2024

April 26, 2024

Dear MANRS and RIPE members, My name is Gaoxing Zhang, and I am a computer enthusiast from the High School Competition Team at Hangzhou Dongfang High School. Recently, I've observed that although MANRS requirements mandate Source Address Validation(SAV) for its members, some operators have not fully implemented this practice in their networks. Therefore, I propose to routinely monitor the deployment status of SAV across ASNs to ensure compliance with MANRS guidelines and enhance network security. I am currently unaware of any existing projects with a similar focus. It has come to my attention that operators at IXP facilities, even including major entities like Google, fail to enable SAV. This issue also persists in-home broadband services obtained through PPPoE, which could lead to Infected Home Routers becoming sources of DDoS Attacks and Are Difficult to Trace. In my tests, I announced my IP thought tunnel on a different operator’s network and configured the Next-hop Address to a home broadband gateway obtained via PPPoE. The results indicated that Source Address Validation by China Telecom’s home broadband is only partially implemented in Mainland China, with most IP addresses from the region being accessible through this method. Here are some methods I have considered for ongoing monitoring: 1. Announce a new IP block upstream to receive inbound traffic. 2. Deploy a tunnel on the device connected to the ISP being tested, which will link to the upstream receiving the inbound traffic. 3. The IP block will not be announced to the ISP being tested but only to the upstream used to receive inbound traffic. Check the connectivity to major public DNS servers when the Next-hop address is set to the ISP being tested. 4. If it is reachable, it indicates that the ISP’s device lacks Source Address Validation. I plan to deploy test equipment at major IXPs (currently seeking equipment sponsors) and access points for some residential ISPs (with the assistance of volunteers). The testing environment will be a Linux-based VM, utilizing Python to switch Next-hop based on test targets and assess the accessibility to major public DNS servers, as well as to upload data to a backend system. I would really appreciate it if you could share your valuable suggestions or feedback on this initiative. Best regards, *Brandon Zhang* Huicast Telecom Limited www.huicast.com | Twitter This e-mail and any attachments or any reproduction of this e-mail in whatever manner are confidential and for the use of the addressee(s) only. Huicast Telecom Limited can’t take any liability and guarantee of the text of the email message and virus.

1 0

MANRS Community MeetUp at APRICOT - February 27th
by Kevin Chege Feb. 20, 2024

Feb. 20, 2024

Greetings Dear MANRS Community, We're glad to invite you to an in person MANRS Community Meet-up at APRICOT 2024 during the Routing Security session<https://2024.apricot.net/program/program#/day/7/routing-security--apricot/> taking place on the 27th of February at the APRICOT venue<https://2024.apricot.net/>. This gathering is aimed at enthusiasts who are passionate about promoting routing security, preventing BGP hijacking, and advocating for the broader implementation of RPKI. It's a prime opportunity to engage with fellow experts, discuss the challenges we face, and celebrate successes. Event Details: * Date: February 27th 2024 * Time: 11:30 to 13:00 (Local time, Bangkok) * Location: APRICOT venue, Room Terrace A&B Draft Agenda: * A quick introduction to RPKI (ROA-ROV Stats) (5mins) * Knowledge Sharing: An opportunity to share your RPKI insights with the community. (15mins) * Hands-On Experience: Experiment with Relying Party Software (validators) and activating ROV on routers. (40 mins) * MANRS Community Meet-up: Connect with enthusiasts passionate about routing security and RPKI. (30 mins) In addition to our regular discussions, this session will cover the significant transition of MANRS to the Global Cyber Alliance (GCA) and what opportunities it opens up for MANRS and how we can all contribute to this new chapter in routing security. No separate registration is required. A calendar invite can be obtained from this page: https://2024.apricot.net/program/program#/day/7/ Regards Kevin G. Chege ISOC

1 0

Re: [manrs-community] Upcoming changes to the MANRS measurement framework
by Pablo Lopez-Aguilar Beltran Jan. 19, 2024

Jan. 19, 2024

Dear MANRS participants, We are glad to inform you that the features we announced back in December are now deployed in the MANRS Observatory. We also updated the Measurement framework https://www.manrs.org/manrs-observatory/measurement-framework/ to reflect these changes. Again, we encourage you to use the *feedback function* in the detailed reports to remove possible false positives and improve your MANRS readiness score. Best regards, • • • • *Pablo López-Aguilar* *Operations and Business Associate Director, Internet Integrity Program* Global Cyber Alliance plopezaguilar(a)globalcyberalliance.org +34 670527760 [image: GCA Website] <https://www.globalcyberalliance.org/> [image: GCA Twitter] <https://twitter.com/GlobalCyberAlln> [image: GCA Facebook] <https://www.facebook.com/GlobalCyberAlliance/> [image: GCA LinkedIn] <https://www.linkedin.com/company/global-cyber-alliance/> [image: GCA YouTube] <https://www.youtube.com/channel/UCC5x4cUnZqWsV7OqBx1vCOQ> [image: GCA GitHub] <https://github.com/GlobalCyberAlliance/> [image: GCA Email Signup] <https://www.globalcyberalliance.org/#signup> [image: GCA Instagram] <https://www.instagram.com/globalcyberalliance/> [image: GCA Forums] <https://community.globalcyberalliance.org/> GCA takes your privacy seriously. To review our privacy policy, please click here <https://www.globalcyberalliance.org/privacy-policy/>. On 14/12/2023, 15:03, "Andrei Robachevsky" <robachevsky(a)isoc.org> wrote: Dear MANRS participants, In July 2023, we started publishing the MANRS Readiness Scores <https://www.manrs.org/2023/06/manrs-readiness-scores-to-be-made-public-for-…> for Actions 2, 3, and 4 (IRR and RPKI) for participants in the NetOps program. We didn't publish Action 1 scores at the time due to legitimate concerns within the community that the data used to calculate the scores produced too many false positives. As I presented during the MANRS Community Meeting on 28 November, we've done several improvements in the quality of these data and the scores. Below, you will find a summary of the upcoming changes — more detailed information can be found here: https://www.manrs.org/2023/12/the-road-to-publishing-action-1-netops-scores/. Please review these changes and let us know your questions or concerns. We plan to deploy these changes in January 2024. Note: Action 1 scores *will not be published yet* on the MANRS website to allow participants ample time to assess the changes' actual impact on the readiness scores. 1. The M1 and M1C metrics will no longer be included in the Action 1 score calculation. 2. The M2 and M2C metrics derived from BGPStream data have been removed completely from the Observatory due to low confidence. 3. The M2 and M2C metrics derived from GRIP data will be filtered based on the RPKI and IRR data to remove many false positives. 4. The M3 and M3C metrics will also be filtered. We will split all bogon prefixes into "full" and "administrative" bogons. The reason for doing so is that the operational practice is that "administrative bogons" are still being routed in some cases. Only "full" bogons will be considered when calculating the scores. 5. The M4 and M4C metrics will be filtered into "full" and "administrative bogons in the same way. These changes will lead to higher confidence in the data and the scores. Statistical analysis of filtered data revealed no false positives and, in some cases, led to an 80% reduction in reported incidents. We understand that false positives cannot be eliminated completely. To give you an opportunity to flag residual false positives a “feedback” function <https://www.manrs.org/2021/07/new-data-source-feedback-loop-enhance-manrs-o…> has been in place since July 2021. After being reviewed by an auditor, such incidents will be removed. We encourage you to use *this function when reviewing your report*. We always welcome feedback on the MANRS Observatory and any of its data, whether due to these changes or for any other reason. You can send your feedback to this mailing list, email contact(a)manrs.org, or submit feedback via the website <https://www.manrs.org/about/contact/>. Regards, Andrei Robachevsky MANRS Secretariat

1 0

Observatory December data outage
by Andy Clyde Jan. 11, 2024

Jan. 11, 2024

Hi all, We had an outage with the CIDR bogon report towards the end of December. This meant that we were unable to update the December data for several days. Partial December data was available until 4th January but it was then removed to avoid scores based on the partial data being published. We worked with CIDR to re-download the correct data for the period of the outage and have reprocessed all December and January data in the Observatory. It is all now available and the full December scores have been published. Thanks Andy Clyde MANRS Senior Application Developer

1 0

Upcoming changes to the MANRS measurement framework
by Andrei Robachevsky Dec. 14, 2023

Dec. 14, 2023

Dear MANRS participants, In July 2023, we started publishing the MANRS Readiness Scores<https://www.manrs.org/2023/06/manrs-readiness-scores-to-be-made-public-for-…> for Actions 2, 3, and 4 (IRR and RPKI) for participants in the NetOps program. We didn't publish Action 1 scores at the time due to legitimate concerns within the community that the data used to calculate the scores produced too many false positives. As I presented during the MANRS Community Meeting on 28 November, we've done several improvements in the quality of these data and the scores. Below, you will find a summary of the upcoming changes — more detailed information can be found here: https://www.manrs.org/2023/12/the-road-to-publishing-action-1-netops-scores/. Please review these changes and let us know your questions or concerns. We plan to deploy these changes in January 2024. Note: Action 1 scores will not be published yet on the MANRS website to allow participants ample time to assess the changes' actual impact on the readiness scores. 1. The M1 and M1C metrics will no longer be included in the Action 1 score calculation. 2. The M2 and M2C metrics derived from BGPStream data have been removed completely from the Observatory due to low confidence. 3. The M2 and M2C metrics derived from GRIP data will be filtered based on the RPKI and IRR data to remove many false positives. 4. The M3 and M3C metrics will also be filtered. We will split all bogon prefixes into "full" and "administrative" bogons. The reason for doing so is that the operational practice is that "administrative bogons" are still being routed in some cases. Only "full" bogons will be considered when calculating the scores. 5. The M4 and M4C metrics will be filtered into "full" and "administrative bogons in the same way. These changes will lead to higher confidence in the data and the scores. Statistical analysis of filtered data revealed no false positives and, in some cases, led to an 80% reduction in reported incidents. We understand that false positives cannot be eliminated completely. To give you an opportunity to flag residual false positives a “feedback” function<https://www.manrs.org/2021/07/new-data-source-feedback-loop-enhance-manrs-o…> has been in place since July 2021. After being reviewed by an auditor, such incidents will be removed. We encourage you to use this function when reviewing your report. We always welcome feedback on the MANRS Observatory and any of its data, whether due to these changes or for any other reason. You can send your feedback to this mailing list, email contact(a)manrs.org<mailto:contact@manrs.org>, or submit feedback via the website<https://www.manrs.org/about/contact/>. Regards, Andrei Robachevsky MANRS Secretariat

1 0

MANRS: Upcoming events
by Robbie Mitchell Nov. 28, 2023

Nov. 28, 2023

++MANRS Community Meeting @ RIPE87++ MANRS will host a hybrid Community Meeting at the upcoming RIPE 87 meeting in Rome, Italy, on Tuesday, 28 November, from 11:30 to 13:00 (UTC). If you or your colleagues are attending the RIPE meeting, we welcome you to participate in person to share your MANRS and routing security experience with fellow community members. Likewise, you can watch and contribute to the session via Zoom. * In-person RIPE 87 (The Club House Restaurant, Sheraton Rome Parco de’ Medici, Rome, Italy) * Virtual Register<https://isoc.zoom.us/webinar/register/WN_ZUsxNOi9STSANDwGphE_8A> and join via Zoom. Note the simulcast will begin at 12:00 UTC as the MANRS Mentors and Ambassadors Symposium will be broadcast during the first 30 minutes of the in-person event. Note: Attendance is free. Participation is capped at the first 30 pax. A buffet lunch will be served at the in-person meeting. See the MANRS event page for the agenda<https://www.manrs.org/event/manrs-community-meeting-14/>. ++MANRS Mentors and Ambassadors Symposium++ Join this virtual symposium, also happening simultaneously on Tuesday, 28 November, from 11:30 to 13:00 (UTC), to hear the 2023 MANRS Mentors and Ambassadors share their achievements over the last six months in making the global routing infrastructure more robust and secure. Mentors — well-respected routing security professionals – help guide Ambassadors — emerging leaders — to improve their skills while working together in their regions and industries. During the six-month program (June to December), the Mentors and Ambassadors work across the MANRS training, research, or policy tracks. Register<https://www.manrs.org/event/2023-manrs-mentors-and-ambassadors-symposium/> via the MANRS event page. Note: We will broadcast the first half of the MANRS Mentors and Ambassadors Symposium during the first 30 minutes of the MANRS Community Meeting happening at RIPE87<https://www.manrs.org/event/manrs-community-meeting-14/> which will happen simultaneously. Recordings of both sessions will be made available after the events.

5 8

Re: [manrs-community] Reminder: MANRS@RIPE 87 and MANRS M&A Symposium, Tuesday, 28 November
by Kevin Chege Nov. 28, 2023

Nov. 28, 2023

Hi JMC, MANRS applications will still be via the MANRS website<https://manrs.org/> so that is not changing. Regards Kevin From: Manrs-community <manrs-community-bounces(a)elists.manrs.org> on behalf of "jeanmichel.combes(a)orange.com" <jeanmichel.combes(a)orange.com> Date: Tuesday, November 28, 2023 at 3:44 PM To: Hanna Kreitem <Kreitem(a)isoc.org>, Robbie Mitchell <mitchell(a)isoc.org>, "manrs-community(a)elists.manrs.org" <manrs-community(a)elists.manrs.org> Subject: Re: [manrs-community] Reminder: MANRS@RIPE 87 and MANRS M&A Symposium, Tuesday, 28 November Thx. BTW, question on CGA transition I didn’t have time to write on the chat and get an answer: For new application to the MANRS initiative, is it expected to still apply on the MANRS web site? Or the new application will have to be fulfilled on the CGA web site? Thx for your answer. Best regards, JMC. De : Hanna Kreitem <Kreitem(a)isoc.org> Envoyé : mardi 28 novembre 2023 13:23 À : COMBES Jean-Michel INNOV/NET <jeanmichel.combes(a)orange.com>; Robbie Mitchell <mitchell(a)isoc.org>; manrs-community(a)elists.manrs.org Objet : Re: Reminder: MANRS@RIPE 87 and MANRS M&A Symposium, Tuesday, 28 November Please use this link: https://isoc.zoom.us/j/82626956788 Hanna. ________________________________ From: Manrs-community <manrs-community-bounces(a)elists.manrs.org<mailto:manrs-community-bounces@elists.manrs.org>> on behalf of jeanmichel.combes(a)orange.com<mailto:jeanmichel.combes@orange.com> <jeanmichel.combes(a)orange.com<mailto:jeanmichel.combes@orange.com>> Sent: Tuesday, November 28, 2023 1:18:03 PM To: Robbie Mitchell <mitchell(a)isoc.org<mailto:mitchell@isoc.org>>; manrs-community(a)elists.manrs.org<mailto:manrs-community@elists.manrs.org> <manrs-community(a)elists.manrs.org<mailto:manrs-community@elists.manrs.org>> Subject: Re: [manrs-community] Reminder: MANRS@RIPE 87 and MANRS M&A Symposium, Tuesday, 28 November Hi, Impossible to connect to the meeting: it is indicated that “the host is in another meeting”. Thanks in advance for your help. Best regards, JMC. De : Manrs-community <manrs-community-bounces(a)elists.manrs.org<mailto:manrs-community-bounces@elists.manrs.org>> De la part de Robbie Mitchell Envoyé : vendredi 24 novembre 2023 08:00 À : manrs-community(a)elists.manrs.org<mailto:manrs-community@elists.manrs.org> Objet : [manrs-community] Reminder: MANRS@RIPE 87 and MANRS M&A Symposium, Tuesday, 28 November Reminder ++MANRS Community Meeting @ RIPE87++ MANRS will host a hybrid Community Meeting at the upcoming RIPE 87 meeting in Rome, Italy, on Tuesday, 28 November, from 11:30 to 13:00 (UTC). If you or your colleagues are attending the RIPE meeting, we welcome you to participate in person to share your MANRS and routing security experience with fellow community members. Likewise, you can watch and contribute to the session via Zoom. * In-person RIPE 87 (The Club House Restaurant, Sheraton Rome Parco de’ Medici, Rome, Italy) * Virtual Register<https://isoc.zoom.us/webinar/register/WN_ZUsxNOi9STSANDwGphE_8A> and join via Zoom. Note the simulcast will begin at 12:00 UTC as the MANRS Mentors and Ambassadors Symposium will be broadcast during the first 30 minutes of the in-person event. Note: Attendance is free. Participation is capped at the first 30 pax. A buffet lunch will be served at the in-person meeting. See the MANRS event page for the agenda<https://www.manrs.org/event/manrs-community-meeting-14/>. ++MANRS Mentors and Ambassadors Symposium++ Join this virtual symposium, also happening simultaneously on Tuesday, 28 November, from 11:30 to 13:00 (UTC), to hear the 2023 MANRS Mentors and Ambassadors share their achievements over the last six months in making the global routing infrastructure more robust and secure. Mentors — well-respected routing security professionals – help guide Ambassadors — emerging leaders — to improve their skills while working together in their regions and industries. During the six-month program (June to December), the Mentors and Ambassadors work across the MANRS training, research, or policy tracks. Register<https://www.manrs.org/event/2023-manrs-mentors-and-ambassadors-symposium/> via the MANRS event page. Note: We will broadcast the first half of the MANRS Mentors and Ambassadors Symposium during the first 30 minutes of the MANRS Community Meeting happening at RIPE87<https://www.manrs.org/event/manrs-community-meeting-14/> which will happen simultaneously. Recordings of both sessions will be made available after the events. ____________________________________________________________________________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. Thank you. Orange Restricted ____________________________________________________________________________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. Thank you.

1 0

Invitation to attend the IETF SAVENT meeting at IETF118 (8 November, 9:30 – 11:30 AM CET), for the IETF118 registered participants
by Georgios Karagiannis Nov. 6, 2023

Nov. 6, 2023

Dear MANRS participants, This is an invitation to participate in the IETF savnet WG) meeting that will take place on Wednesday, 8 November 2023 (9:30 AM – 11:30 AM CET) Information on savnet ((Source Address Validation in Intra-domain and Inter-domain Networks) can be found via: https://datatracker.ietf.org/group/savnet/about/ For the IETF118 on site (registered) participants: meeting room is: Congress Hall 3<https://datatracker.ietf.org/meeting/118/floor-plan?room=congress-hall-3> For the IETF118 online (registered) participants, the URL for the online tool is: https://meetings.conf.meetecho.com/ietf118/?session=31675 Best regards, Georgios

1 0

A new phase for MANRS
by Kevin Chege Nov. 2, 2023

Nov. 2, 2023

Dear MANRS Community, As you may know, the Internet Society, in collaboration with a broad range of stakeholders, launched the MANRS initiative in 2014 and has performed the operational (secretariat) functions since. As part of its role, the Internet Society has been seeking partnerships to expand MANRS and guarantee its long-term financial sustainability. We are pleased to inform you that the Internet Society has reached a partnership agreement with the Global Cyber Alliance (GCA) <https://globalcyberalliance.org> for it to assume the day-to-day operational responsibility for MANRS effective 1st January 2024. GCA, a MANRS partner since 2020,<https://www.manrs.org/2020/12/partnering-with-global-cyber-alliance-on-open…> is a non-profit organization whose mission and status are well aligned to further expand MANRS. The GCA is passionate about an open and secure Internet built on technology with routing security being one of their focus areas<https://www.globalcyberalliance.org/blog/?_search=routing>. As part of the partnership, the Internet Society will continue to financially support MANRS and provide training and global advocacy over the next five years, while GCA will provide the secretariat function and operate the MANRS Observatory. The MANRS Steering Committee have expressed their full confidence that MANRS will continue to be a growing, thriving community dedicated to the reliable operation of the Internet’s core routing function under the GCA’s stewardship. As a MANRS participant, you can expect the transition will yield no interruption in operational processes, functions, and systems. Information sharing, support, training, and development will continue as they have during the transition period. The ongoing MANRS Steering Committee elections will also not be affected in any way. This blog on the MANRS website<https://www.manrs.org/2023/11/achieving-greater-heights-for-manrs/> has more info on this partnership. If you have any questions, please send an email to manrs-questions(a)isoc.org<mailto:manrs-questions@isoc.org>. Regards Kevin Chege ISOC

1 0

Reminder: Nominations for MANRS Steering Committee Elections Close Saturday 28 October
by Robbie Mitchell Oct. 25, 2023

Oct. 25, 2023

If you would like to volunteer or nominate someone else to take a leading role in improving the resilience and security of a critical component of the Internet infrastructure, please fill in the nomination form by 28 October 23.59 UTC. https://www.manrs.org/about/governance/2023-manrs-steering-committee-electi… Everyone is eligible to serve on the Steering Committee — MANRS participation is not required. Voting will begin 31 October (00.01 UTC) and end on 2 November 2022 (23.59 UTC). Each participant may submit one ballot. Please contact us <mailto:contact@manrs.org> if you have any questions about the process. To read the full details, read the full Appointment Process<https://www.manrs.org/about/governance/manrs-steering-committee-appointment…>.

1 0