swinog

swinog@lists.swinog.ch

1 participants
2916 discussions

Swisscom operating Business Customer Mailservices from 'Mobile' IP Ranges?
by Benoit Panizzon 15 Mar '19

15 Mar '19

Hello List We have some issues with emails sent from the kpt.ch online plattform over Swisscom Mobile IP Range: inetnum: 138.188.0.0 - 138.188.255.255 netname: Swisscom-Mobile country: CH There is no SPF entry and the sending ip addresses are not listed by dnswl.org nor the Swinog Whitelist, causing greylisting to delay emails (containing login tokens valid for a couple of minutes only) from those potentially infected end customer ip ranges :-) Has Swisscom started to assign IP Addresses from this range to it's email sending platform? The hostname and swisscom's own SPF entry let's me suspect this is the case: mailout153.swisscom.com[138.188.176.153] spf.swisscom.com descriptive text "v=spf1 ip4:193.222.81.224/27 ip4:193.222.81.96/27 ip4:194.11.148.48/28 ip4:194.11.148.64/28 ip4:194.6.164.0/24 ip4:138.190.12.80/28 ip4:138.190.12.32/27 ip4:138.188.176.0/26 ip4:138.188.176.128/26 ip4:138.188.166.96/27 ~all" Well I guess I add those ranges to the SWINOG Whitelist. Mit freundlichen Grüssen -Benoît Panizzon- -- I m p r o W a r e A G - Leiter Commerce Kunden ______________________________________________________ Zurlindenstrasse 29 Tel +41 61 826 93 00 CH-4133 Pratteln Fax +41 61 826 93 01 Schweiz Web http://www.imp.ch ______________________________________________________

1 0

Invitation to DNSHeads Switzerland Meeting 16.5. 15:00
by Michael Hausding 14 Mar '19

14 Mar '19

Dear List SWITCH is hosting the 1st DNSHeads Meetup in Switzerland on May 16 from 15:00 on. If you run a resolver or an authoritative DNS Server you might want to join us in Zurich to discuss DNS-specific topics in an informal setup (yes, this could mean beer is involved.) More Information and registration is here: https://www.meetup.com/de-DE/DNSHeads-Switzerland/events/259123657/ Hope to see you in Zurich! Michael ------------------------------------ Michael Hausding, Competence Lead DNS & Domain Abuse SWITCH-CERT Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland phone +41 44 268 15 77, incident phone +41 44 268 15 40 michael.hausding(a)switch.ch http://securityblog.switch.ch

1 0

SBB.ch / IPv6 MTU / fragmentation problem
by Nico Schottelius 12 Mar '19

12 Mar '19

Good morning, is anyone from sbb.ch reading here? https://sbb.ch does not load on IPv6 for us. It seems that packets > 1420 bytes are dropped inside the SBB network, Local PMTU / fragmentation seems to work, my local outgoing MTU is 1420. MTR below. Best, Nico [10:23] line:~% mtr -w -c1 -s 1500 sbb.ch Start: 2019-03-12T10:24:17+0100 HOST: line Loss% Snt Last Avg Best Wrst StDev 1.|-- 2a0a:e5c1:111:111::42 0.0% 1 11.2 11.2 11.2 11.2 0.0 2.|-- ??? 100.0 1 0.0 0.0 0.0 0.0 0.0 3.|-- 2a0a:e5c0:2:12::7 0.0% 1 69.8 69.8 69.8 69.8 0.0 4.|-- 2a0a:e5c0:1:1::9 0.0% 1 74.3 74.3 74.3 74.3 0.0 5.|-- 2001:1620:20e6::1 0.0% 1 69.4 69.4 69.4 69.4 0.0 6.|-- r1zrh2.core.init7.net 0.0% 1 69.1 69.1 69.1 69.1 0.0 7.|-- r1olt2.core.init7.net 0.0% 1 58.0 58.0 58.0 58.0 0.0 8.|-- r1brn1.core.init7.net 0.0% 1 62.8 62.8 62.8 62.8 0.0 9.|-- r2brn1.core.init7.net 0.0% 1 65.4 65.4 65.4 65.4 0.0 10.|-- r1epe1.core.init7.net 0.0% 1 75.2 75.2 75.2 75.2 0.0 11.|-- r1qls1.core.init7.net 0.0% 1 78.4 78.4 78.4 78.4 0.0 12.|-- r1gva3.core.init7.net 0.0% 1 81.0 81.0 81.0 81.0 0.0 13.|-- gw-sunrise.init7.net 0.0% 1 64.4 64.4 64.4 64.4 0.0 14.|-- 2001:1700:1:7:120::2 0.0% 1 84.4 84.4 84.4 84.4 0.0 15.|-- 2001:1700:4d00:2::2 0.0% 1 81.3 81.3 81.3 81.3 0.0 16.|-- 2a00:4bc0:ffff:ff00::1d 0.0% 1 67.0 67.0 67.0 67.0 0.0 17.|-- ??? 100.0 1 0.0 0.0 0.0 0.0 0.0 [10:24] line:~% mtr -w -c1 -s 1400 sbb.ch Start: 2019-03-12T10:24:35+0100 HOST: line Loss% Snt Last Avg Best Wrst StDev 1.|-- 2a0a:e5c1:111:111::42 0.0% 1 3.2 3.2 3.2 3.2 0.0 2.|-- 2a0a:e5c1:100::1 0.0% 1 69.0 69.0 69.0 69.0 0.0 3.|-- 2a0a:e5c0:2:12::7 0.0% 1 74.7 74.7 74.7 74.7 0.0 4.|-- 2a0a:e5c0:1:1::9 0.0% 1 69.9 69.9 69.9 69.9 0.0 5.|-- 2001:1620:20e6::1 0.0% 1 60.5 60.5 60.5 60.5 0.0 6.|-- r1zrh2.core.init7.net 0.0% 1 75.3 75.3 75.3 75.3 0.0 7.|-- r1olt2.core.init7.net 0.0% 1 70.7 70.7 70.7 70.7 0.0 8.|-- r1brn1.core.init7.net 0.0% 1 69.1 69.1 69.1 69.1 0.0 9.|-- r2brn1.core.init7.net 0.0% 1 54.6 54.6 54.6 54.6 0.0 10.|-- r1epe1.core.init7.net 0.0% 1 75.9 75.9 75.9 75.9 0.0 11.|-- r1qls1.core.init7.net 0.0% 1 78.8 78.8 78.8 78.8 0.0 12.|-- r1gva3.core.init7.net 0.0% 1 79.8 79.8 79.8 79.8 0.0 13.|-- gw-sunrise.init7.net 0.0% 1 69.9 69.9 69.9 69.9 0.0 14.|-- 2001:1700:1:7:120::2 0.0% 1 77.5 77.5 77.5 77.5 0.0 15.|-- 2001:1700:4d00:2::2 0.0% 1 59.3 59.3 59.3 59.3 0.0 16.|-- 2a00:4bc0:ffff:ff00::1d 0.0% 1 70.1 70.1 70.1 70.1 0.0 17.|-- ??? 100.0 1 0.0 0.0 0.0 0.0 0.0 18.|-- ??? 100.0 1 0.0 0.0 0.0 0.0 0.0 19.|-- ??? 100.0 1 0.0 0.0 0.0 0.0 0.0 20.|-- ??? 100.0 1 0.0 0.0 0.0 0.0 0.0 21.|-- ??? 100.0 1 0.0 0.0 0.0 0.0 0.0 22.|-- ??? 100.0 1 0.0 0.0 0.0 0.0 0.0 23.|-- ??? 100.0 1 0.0 0.0 0.0 0.0 0.0 24.|-- ??? 100.0 1 0.0 0.0 0.0 0.0 0.0 25.|-- 2a00:4bc0:ffff:ffff::c296:f58e 0.0% 1 58.3 58.3 58.3 58.3 0.0 [10:24] line:~% [10:25] line:~% mtr -w -c1 -s 1420 sbb.ch Start: 2019-03-12T10:25:44+0100 HOST: line Loss% Snt Last Avg Best Wrst StDev 1.|-- 2a0a:e5c1:111:111::42 0.0% 1 16.3 16.3 16.3 16.3 0.0 2.|-- 2a0a:e5c1:100::1 0.0% 1 77.0 77.0 77.0 77.0 0.0 3.|-- 2a0a:e5c0:2:12::7 0.0% 1 67.0 67.0 67.0 67.0 0.0 4.|-- 2a0a:e5c0:1:1::9 0.0% 1 66.7 66.7 66.7 66.7 0.0 5.|-- 2001:1620:20e6::1 0.0% 1 78.8 78.8 78.8 78.8 0.0 6.|-- r1zrh2.core.init7.net 0.0% 1 64.5 64.5 64.5 64.5 0.0 7.|-- r1olt2.core.init7.net 0.0% 1 68.3 68.3 68.3 68.3 0.0 8.|-- r1brn1.core.init7.net 0.0% 1 74.9 74.9 74.9 74.9 0.0 9.|-- r2brn1.core.init7.net 0.0% 1 73.6 73.6 73.6 73.6 0.0 10.|-- r1epe1.core.init7.net 0.0% 1 62.2 62.2 62.2 62.2 0.0 11.|-- r1qls1.core.init7.net 0.0% 1 74.3 74.3 74.3 74.3 0.0 12.|-- r1gva3.core.init7.net 0.0% 1 63.6 63.6 63.6 63.6 0.0 13.|-- gw-sunrise.init7.net 0.0% 1 69.1 69.1 69.1 69.1 0.0 14.|-- 2001:1700:1:7:120::2 0.0% 1 77.4 77.4 77.4 77.4 0.0 15.|-- 2001:1700:4d00:2::2 0.0% 1 78.8 78.8 78.8 78.8 0.0 16.|-- 2a00:4bc0:ffff:ff00::1d 0.0% 1 75.7 75.7 75.7 75.7 0.0 17.|-- ??? 100.0 1 0.0 0.0 0.0 0.0 0.0 18.|-- ??? 100.0 1 0.0 0.0 0.0 0.0 0.0 19.|-- ??? 100.0 1 0.0 0.0 0.0 0.0 0.0 20.|-- ??? 100.0 1 0.0 0.0 0.0 0.0 0.0 21.|-- ??? 100.0 1 0.0 0.0 0.0 0.0 0.0 22.|-- ??? 100.0 1 0.0 0.0 0.0 0.0 0.0 23.|-- ??? 100.0 1 0.0 0.0 0.0 0.0 0.0 24.|-- ??? 100.0 1 0.0 0.0 0.0 0.0 0.0 25.|-- 2a00:4bc0:ffff:ffff::c296:f58e 0.0% 1 83.8 83.8 83.8 83.8 0.0 [10:25] line:~% mtr -w -c1 -s 1430 sbb.ch Start: 2019-03-12T10:25:55+0100 HOST: line Loss% Snt Last Avg Best Wrst StDev 1.|-- 2a0a:e5c1:111:111::42 0.0% 1 7.3 7.3 7.3 7.3 0.0 2.|-- ??? 100.0 1 0.0 0.0 0.0 0.0 0.0 3.|-- 2a0a:e5c0:2:12::7 0.0% 1 60.4 60.4 60.4 60.4 0.0 4.|-- 2a0a:e5c0:1:1::9 0.0% 1 61.9 61.9 61.9 61.9 0.0 5.|-- 2001:1620:20e6::1 0.0% 1 72.2 72.2 72.2 72.2 0.0 6.|-- r1zrh2.core.init7.net 0.0% 1 65.2 65.2 65.2 65.2 0.0 7.|-- r1olt2.core.init7.net 0.0% 1 64.9 64.9 64.9 64.9 0.0 8.|-- r1brn1.core.init7.net 0.0% 1 64.9 64.9 64.9 64.9 0.0 9.|-- r2brn1.core.init7.net 0.0% 1 71.7 71.7 71.7 71.7 0.0 10.|-- r1epe1.core.init7.net 0.0% 1 64.4 64.4 64.4 64.4 0.0 11.|-- r1qls1.core.init7.net 0.0% 1 63.2 63.2 63.2 63.2 0.0 12.|-- r1gva3.core.init7.net 0.0% 1 77.9 77.9 77.9 77.9 0.0 13.|-- gw-sunrise.init7.net 0.0% 1 64.5 64.5 64.5 64.5 0.0 14.|-- 2001:1700:1:7:120::2 0.0% 1 63.5 63.5 63.5 63.5 0.0 15.|-- 2001:1700:4d00:2::2 0.0% 1 81.7 81.7 81.7 81.7 0.0 16.|-- 2a00:4bc0:ffff:ff00::1d 0.0% 1 74.4 74.4 74.4 74.4 0.0 17.|-- ??? 100.0 1 0.0 0.0 0.0 0.0 0.0 [10:26] line:~% icmp6, frag works locally: 10:29:44.919328 IP6 2a0a:e5c1:111:111:3185:e802:6548:658c > 2a00:4bc0:ffff:ffff::c296:f58e: frag (0|1368) ICMP6, echo request, seq 33000, length 1368 10:29:44.919368 IP6 2a0a:e5c1:111:111:3185:e802:6548:658c > 2a00:4bc0:ffff:ffff::c296:f58e: frag (1368|92) -- Your Swiss, Open Source and IPv6 Virtual Machine. Now on www.datacenterlight.ch.

4 6

Security Chat 5.0 - March 25
by Raffael Marty 12 Mar '19

12 Mar '19

The Security Chat is Back! We are gathering for an evening of short security-related presentations and networking with peers in the industry. Security Chat 5.0 Monday, March 25th, 18.00 - 20.30 AdNovum Informatik AG (Headquarters), 22 Röntgenstrasse, 8005 Zürich (free) singup at: http://bit.ly/securitychat50 If you are interested in giving a short presentation, please indicate on the signup or email me directly. Any topics are welcome: Projects, research, questions you would like to get answers from the attendees, an embarrassing security story - the stage is yours. Keep the rest of your evening open if you can. Last time people stayed until 11pm; chatting and networking. Hope to see you at the event! -Raffy

1 0

Security Chat 5.0 - March 25 - Save the Date
by Raffael Marty 09 Mar '19

09 Mar '19

SAVE THE DATE! The Security Chat 5.0 will be taking place in Zurich on Monday the 25th of March at 6pm. This is a free event open to anyone who has an interest in security. We will listen to a few short (10-15 minute) presentations and then have a chance to network with each other. Last time we had a fabulous turn out of security practitioners, startup founders, geeks, cyber experts, and people who like to mingle until 11pm, making new friends in the security community. The exact location and signup information will follow soon. For now, mark your calendar and spread the word! You will have a chance to sign up to give a presentation when the official invite goes out. Hope to see you all in a couple of weeks! -Raffy

1 0

routing to bluewin.ch
by Martin Schenkel 05 Mar '19

05 Mar '19

Hi Has anybody else seen this weird announcement to the bluewin.ch /24 through AS60633? Network Path *> 213.3.75.0/24 1836 59622 64521 60633 i * 213.3.75.0/24 1836 59622 64521 60633 i Cheers, Martin

2 1

UPC-Contact off-list
by Swiss Network Operators Group (SwiNOG) 28 Feb '19

28 Feb '19

Hi list Can somebody from UPC contact me off-list regarding some suspicious DNS queries (from an UPC-IP) to our authoritative NS? Thanks in advance. Kind regards, Thomas Amgarten arcade solutions ag +41 41 417 31 73

1 1

##### SwiNOG #35 - Call for Papers (2019-May-08) #####
by Simon Ryf 12 Feb '19

12 Feb '19

Dear SwiNOG supporter, this is the official Call for Paper email. Please submit your proposal via https://www.swinog.ch/cfp/ The 35th meeting of the Swiss Network Operators Group (SwiNOG) will be held in Berne on top of the Gurten on Thursday May 8th 2019. Important Dates for https://www.swinog.ch/meetings/swinog35/: 12.02.2019 Call for Papers tbd Registration opens 28.04.2019 Final publication of agenda 03.05.2019 Registration closes 06.05.2019 Deadline for all slides 08.05.2019 Meeting day Topics for Presentations/Talks The number and length of presentations per session is not fixed, although due to time constraints we would prefer the length of the presentations to be between 5 to 45 minutes. Here is a non-exhaustive list of typical SwiNOG meeting topics: * Security, DDOS Mitigation, * IPv6 * Open Source tools and interesting Github projects * International view of the internet (incidents, outages, measurements) * Routing * Server applications (DNS, Web, etc.) * Legal issues (BüPF, etc.) * Telecommunication politics (Net Neutrality, Incumbent monopoly, etc.) -> PLEASE feel free to talk to us about any kind of topic and collaboration!!! You can always start a discussion on the list - I'm sure people join in. Language of Slides and Talks The whole day will be held in English, therefore we kindly ask you to produce your presentation in English. Submission Guidelines All submissions must have a strong technical bias and must not be solely promotional for your employer. Please remember that your presentations should be suitable for a target audience of technicians from varied backgrounds, working for companies whose sizes may vary considerably. To submit a proposal for a presentation, we request that you to fill in the form at https://www.swinog.ch/cfp/ We also welcome suggestions for specific presentations which you feel would be valuable to the SwiNOG community. Please be aware that your presentation will be published on the SwiNOG website after the event. We can publish modified slides if requested - it might be that some confidential data will be presented by you which are not intended for publication on the internet. Greetings, Simon Ryf SwiNOG Core Team General Information (SwiNOG Community) The Swiss Network Operators Group (SwiNOG) is an informal group of people who are concerned with engineering and operation of the Swiss Internet. SwiNOG exists to enhance the quality of Internet services available in Switzerland. It does this by fostering the free exchange of technical ideas and information between different companies and organisations. SwiNOG is a community for professionals who are operating, designing or researching the Internet. It provides a technical forum where those working on, with and for the Internet can come together to solve problems with every aspect of their (net)work. The meeting is designed to provide an opportunity for the exchange of information among network operators, engineers, researchers and other professionals close to the network community. More information about SwiNOG can be found at http://www.swinog.ch/, Facebook, Xing, Information about the meeting will be published at http://www.swinog.ch/meetings/swinog31/ General Information (SwiNOG Organisation) The SwiNOG Organisation Association is a non-profit association under article 60 and further of the swiss civil law. It manages the SwiNOG community ressources (domain, web, mailing-lists, etc..) and organises SwiNOG meetings. Contact: SwiNOG Organisation 8000 Zurich Switzerland

1 0

JunOS Filter Question
by Viktor Steinmann 01 Feb '19

01 Feb '19

Dear SwiNOGers I'm new to JunOS. I like this OS so far, but I'm having a hard time, securing this stuff... Something's wrong in my JunOS filters... Basically I want to block everyone from accessing the interface on the router itself, but I want to allow traffic to pass the interface. Somehow that doesn't work. See below the (relevant) configuration parts: interfaces { xe-0/1/2 { description blabla; vlan-tagging; } unit 100 { description Blabla; vlan-id 100; family inet { filter { input INTERFACE-INCOMING; } address 192.168.1.1/24 } } } policy-options { prefix-list MYINTERFACE { 192.168.1.1/32; } } firewall { family inet { filter INTERFACE-INCOMING { term WAN-ADDRESS { from { destination-prefix-list { MYINTERFACE; } } then { discard; } } term ALLOW-ALL { then accept; } } } } Anybody with a hint, why this filter doesn't actually block traffic to 192.168.1.1? I can still ping it. Kind regards, Viktor

2 2

Weird Bluewin Server Problem (occasional 550 5.1.1)
by Benoit Panizzon 24 Jan '19

24 Jan '19

Dear List Has anyone else experienced this problem? According to our customer, it occurred a couple of times in the last days: Sender and Destinations are the same in all examples: Our customer is sending an email to bluewin: Jan 23 13:32:42 obelix postfix-submit.obelix/smtp[28721 C5015C0CE5: to=<****(a)bluewin.ch>, relay=mxbw.lb.bluewin.ch[195.186.120.50]:25, delay=57, delays=1.6/0.01/44/11, dsn=2.0.0, status=sent (250 2.0.0 mHh5gTobfzOqbmHhngLDSm mail accepted for delivery) Bluewin Customer replies: Jan 23 17:10:17 obelix milter-greylist: (unknown id): skipping greylist because address 195.186.120.132 is in DNSRBL, (from=<****(a)bluewin.ch>, rcpt=<****(a)breitband.ch>, addr=vimdzmsp-sfwd03.bluewin.ch[195.186.120.132]) ACL 196 Our customer replies: Jan 23 17:24:38 obelix postfix-submit.obelix/smtp[12583 D0AE7C10EE: to=<****(a)bluewin.ch>, relay=mxbw.lb.bluewin.ch[195.186.120.50]:25, delay=101, delays=0.27/0.01/66/35, dsn=5.1.1, status=bounced (host mxbw.lb.bluewin.ch[195.186.120.50] said: 550 5.1.1 <*****(a)bluewin.ch> recipient rejected, address unknown (in reply to RCPT TO command)) Same IP Address of same bluewin server as before, not replies the destination does not exist. I can assure you, it is the same address as before. Our customer tries again: Jan 23 17:32:23 obelix postfix-submit.obelix/smtp[26676 C9470C1271: to=<*****(a)bluewin.ch>, relay=mxbw.lb.bluewin.ch[195.186.227.50]:25, delay=3, delays=0.24/0.02/0.59/2.1, dsn=2.0.0, status=sent (250 2.0.0 mJApg3d9Gp4S3mJAqgsUex mail accepted for delivery) Now the email is getting through! Mit freundlichen Grüssen -Benoît Panizzon- -- I m p r o W a r e A G - Leiter Commerce Kunden ______________________________________________________ Zurlindenstrasse 29 Tel +41 61 826 93 00 CH-4133 Pratteln Fax +41 61 826 93 01 Schweiz Web http://www.imp.ch ______________________________________________________

3 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

swinog