August 2008 - NANOG - lists.nanog.org

RE: SLAAC(autoconfig) vs DHCPv6
by Scott Weeks 18 Aug '08

18 Aug '08

-----Original Message----- From: Scott Weeks [mailto:surfer@mauigateway.com] ---------- trejrco(a)gmail.com wrote: ------------ As a general rule, most clients are following the "If we gave them static IPv4 addresses we will give them static IPv6 addresses" (infrastructure, servers, etc). The whole SLAAC(autoconfig) vs DHCPv6 is a separate (albeit related) conversation ... ---------------------------------------------------- I'm still an IPv6 wussie and would like to learn more before moving forward, so would anyone care to share info on experiences with this decision? -- hcb(a)netcases.net wrote: From: "Howard C. Berkowitz" <hcb(a)netcases.net> To try to stay operational about this <snip> ------------------------ Seeing Howard's quick response saying "To try to stay operational about this..." makes me realize I may have inadvertently invited a religious flame fest. Please! Operational content and hands-on experiences only to the best of your ability. I want to learn from this, not delete the whole thread. scott

2 1

impossible circuit
by Jon Lewis 18 Aug '08

18 Aug '08

After all the messages recently about how to fix DNS, I was seriously tempted to title this messsage "And now, for something completely different", but impossible circuit is more descriptive. Before you read further, I need everyone to put on their thinking WAY outside the box hats. I've heard from enough people already that I'm nuts and what I'm seeing can't happen, so it must not be happening...even though we see the results of it happening. I've got this private line DS3. It connects cisco 7206 routers in Orlando (at our data center) and in Ocala (a colo rack in the Embarq CO). According to the DLR, it's a real circuit, various portions of it ride varying sized OC circuits, and then it's handed off to us at each end the usual way (copper/coax) and plugged into PA-2T3 cards. Last Tuesday, at about 2:30PM, "something bad happened." We saw a serious jump in traffic to Ocala, and in particular we noticed one customer's connection (a group of load sharing T1s) was just totally full. We quickly assumed it was a DDoS aimed at that customer, but looking at the traffic, we couldn't pinpoint anything that wasn't expected flows. Then we noticed the really weird stuff. Pings to anything in Ocala responded with multiple dupes and ttl exceeded messages from a Level3 IP. Traceroutes to certain IPs in Ocala would get as far our Ocala router, then inexplicably hop onto Sprintlink's network, come back to us over our Level3 transit connection, get to Ocala, then hop over to Sprintlink again, repeating that loop as many times as max TTL would permit. Pings from router to router crossing just the DS3 would work, but we'd see 10 duplicate packets for every 1 expected packet. BTW, the cisco CLI hides dupes unless you turn on ip icmp debugging. I've seen some sort of similar things (though contained within an AS) with MPLS and routing misconfigurations, but traffic jumping off our network (to a network to which we're not directly connected) was seemingly impossible. We did all sorts of things to troubleshoot it (studied our router configs in rancid, temporarily shut every interface on the Ocala side other than the DS3, changed IOS versions, changed out the hardware, opened a ticket with cisco TAC) but then it occurred to me, that if traffic was actually jumping off our network and coming back in via Level3, I could see/block at least some of that using an ACL on our interface to Level3. How do you explain it, when you ping the remote end of a DS3 interface with a single echo request packet and see 5 copies of that echo request arrive at one of your transit provider interfaces? Here's a typical traceroute with the first few hops (from my home internet connection) removed. BTW, hop 9 is a customer router conveniently configured with no ip unreachables. 7 andc-br-3-f2-0.atlantic.net (209.208.9.138) 47.951 ms 56.096 ms 56.154 ms 8 ocalflxa-br-1-s1-0.atlantic.net (209.208.112.98) 56.199 ms 56.320 ms 56.196 ms 9 * * * 10 sl-bb20-dc-6-0-0.sprintlink.net (144.232.8.174) 80.774 ms 81.030 ms 81.821 ms 11 sl-st20-ash-10-0.sprintlink.net (144.232.20.152) 75.731 ms 75.902 ms 77.128 ms 12 te-10-1-0.edge2.Washington4.level3.net (4.68.63.209) 46.548 ms 53.200 ms 45.736 ms 13 vlan69.csw1.Washington1.Level3.net (4.68.17.62) 42.918 ms vlan79.csw2.Washington1.Level3.net (4.68.17.126) 55.438 ms vlan69.csw1.Washington1.Level3.net (4.68.17.62) 42.693 ms 14 ae-81-81.ebr1.Washington1.Level3.net (4.69.134.137) 48.935 ms ae-61-61.ebr1.Washington1.Level3.net (4.69.134.129) 49.317 ms ae-91-91.ebr1.Washington1.Level3.net (4.69.134.141) 48.865 ms 15 ae-2.ebr3.Atlanta2.Level3.net (4.69.132.85) 59.642 ms 56.278 ms 56.671 ms 16 ae-61-60.ebr1.Atlanta2.Level3.net (4.69.138.2) 47.401 ms 62.980 ms 62.640 ms 17 ae-1-8.bar1.Orlando1.Level3.net (4.69.137.149) 40.300 ms 40.101 ms 42.690 ms 18 ae-6-6.car1.Orlando1.Level3.net (4.69.133.77) 40.959 ms 40.963 ms 41.016 ms 19 unknown.Level3.net (63.209.98.66) 246.744 ms 240.826 ms 239.758 ms 20 andc-br-3-f2-0.atlantic.net (209.208.9.138) 39.725 ms 37.751 ms 42.262 ms 21 ocalflxa-br-1-s1-0.atlantic.net (209.208.112.98) 43.524 ms 45.844 ms 43.392 ms 22 * * * 23 sl-bb20-dc-6-0-0.sprintlink.net (144.232.8.174) 63.752 ms 61.648 ms 60.839 ms 24 sl-st20-ash-10-0.sprintlink.net (144.232.20.152) 66.923 ms 65.258 ms 70.609 ms 25 te-10-1-0.edge2.Washington4.level3.net (4.68.63.209) 67.106 ms 93.415 ms 73.932 ms 26 vlan99.csw4.Washington1.Level3.net (4.68.17.254) 88.919 ms 75.306 ms vlan79.csw2.Washington1.Level3.net (4.68.17.126) 75.048 ms 27 ae-61-61.ebr1.Washington1.Level3.net (4.69.134.129) 69.508 ms 68.401 ms ae-71-71.ebr1.Washington1.Level3.net (4.69.134.133) 79.128 ms 28 ae-2.ebr3.Atlanta2.Level3.net (4.69.132.85) 64.048 ms 67.764 ms 67.704 ms 29 ae-71-70.ebr1.Atlanta2.Level3.net (4.69.138.18) 68.372 ms 67.025 ms 68.162 ms 30 ae-1-8.bar1.Orlando1.Level3.net (4.69.137.149) 65.112 ms 65.584 ms 65.525 ms Our circuit provider's support people have basically just maintained that this behavior isn't possible and so there's nothing they can do about it. i.e. that the problem has to be something other than the circuit. I got tired of talking to their brick wall, so I contacted Sprint and was able to confirm with them that the traffic in question really was inexplicably appearing on their network...and not terribly close geographically to the Orlando/Ocala areas. So, I have a circuit that's bleeding duplicate packets onto an unrelated IP network, a circuit provider who's got their head in the sand and keeps telling me "this can't happen, we can't help you", and customers who were getting tired of receiving all their packets in triplicate (or more) saturating their connections and confusing their applications. After a while, I had to give up on finding the problem and focus on just making it stop. After trying a couple of things, the solution I found was to change the encapsulation we use at each end of the DS3. I haven't gotten confirmation of this from Sprint, but I assume they're now seeing massive input errors one the one or more circuits where our packets were/are appearing. The important thing (for me) is that this makes the packets invalid to Sprint's routers and so it keeps them from forwarding the packets to us. Cisco TAC finally got back to us the day after I "fixed" the circuit...but since it was obviously not a problem with our cisco gear, I haven't pursued it with them. The only things I can think of that might be the cause are misconfiguration in a DACS/mux somewhere along the circuit path or perhaps a mishandled lawful intercept. I don't have enough experience with either or enough access to the systems that provide the circuit to do any more than speculate. Has anyone else ever seen anything like this? If someone from Level3 transport can wrap their head around this, I'd love to know what's really going on...but at least it's no longer an urgent problem for me. ---------------------------------------------------------------------- Jon Lewis | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

10 15

NANOG List Monthly Post.
by NANOG Mail List Committee 18 Aug '08

18 Aug '08

General Information =================== About NANOG: http://www.nanog.org/about.html NANOG News: http://www.nanog.org/ The NANOG list: http://www.nanog.org/mailinglist.html NANOG List AUP: http://www.nanog.org/aup.html NANOG List FAQ: http://www.nanog.org/listfaq.html To Subscribe or Unsubscribe from the list: http://mailman.nanog.org/mailman/listinfo/nanog To contact the list's admins: admins(a)nanog.org Posting Policy ============== The NANOG list has over 10,000 subscribers so it is very easy for a thread to have scores of posts while being off-topic and only of interest to only a small proportion of subscribers. Please consider before each post if your email will be of interest to the majority of members or might alternatively be emailed directly the people of interest or posted to another forum. Please read the FAQ and AUP policy before posting for more details. Especially the following are discouraged: * Is a certain site down? Other Outages not affecting half the Internet. Please use http://downforeveryoneorjustme.com/ or a similar site. Please post to the BB-Outage mailing lists http://www.dataoutages.com/ * Spam Please use SPAM-L - http://www.claws-and-paws.com/spam-l * Contacting People * http://puck.nether.net/netops/ * Please try other methods of contacting sites before you post to NANOG. Saying something like "I tried calling 213-555-3333 but no answer" shows you _have_ tried alternative methods first. * Political Issues * Topics such as ICANN policy, Government Policy or Law changes that do not have short term Operational impact should be avoided. * Operation topics with more specific lists * DNS - http://lists.oarci.net/mailman/listinfo/dns-operations * Email - http://www.mailop.org/ * NANOG Mailing list policy Please use the nanog-futures list or contact admins(a)nanog.org Please also avoid ================= * Sending posts to the list relevant to only one or two people on this list, such as tests or traceroutes in response to another post for comparison to those originally posted. * Jokes, Puns, amusing observations, spelling corrections. Other NANOG related lists ========================= * NANOG-futures - for discussion of the evolution of NANOG, including organizational structure, policies and procedures, and agendas for NANOG meetings. Such topics aren't appropriate for the main NANOG mailing list. http://mailman.nanog.org/mailman/listinfo/nanog-futures * nanog-attendees - For discussion of venue-specific issues relevant to attendees of the current NANOG physical meeting. * nanog-announce - For announcements of NANOG meetings an other Important NANOG related announcements. Low traffic and all posts are also sent to main list. http://mailman.nanog.org/mailman/listinfo/nanog-announce Other Mailing Lists =================== Information about related lists is at the end of the FAQ here: http://www.nanog.org/listfaq.html#pointers

1 0

Re: Is it time to abandon bogon prefix filters?
by Eric Jensen 18 Aug '08

18 Aug '08

> >Message: 3 >Date: Mon, 18 Aug 2008 08:21:38 -0500 >From: Pete Templin <petelists(a)templin.org> >Subject: Re: Is it time to abandon bogon prefix filters? > >None of these suggestions (including the wisecrack "ACLs") provide full >filtering: > >If a miscreant originates a route in bogon space, their transit >provider(s) doesn't filter their customers, and you or your peer/transit >doesn't filter their peers/transits, your router will accept the route >in bogon space and will accept the bogon packets. Filtering has not >been accomplished, and the bogon attack vector remains open. We recently expanded our network, separating our multi-homed transit network from our corporate and 'network services' LANs. We use BGP sessions between our transit and services networks to trade internal (RFC1918) routes as well as supply a default route. We do not trade external routes over these news sessions. A happy side-effect of this is that our black-hole router, with a cymru bogon feed, now populates the corporate routing table, rather than our full transit table, and by using strict URPF all bogon traffic gets dropped (inbound), and no more-specific routes learned by the transit routers will override our BH routes. - Eric AS17103

1 0

Public shaming list for ISPs announcing other ISPs IP space by mistake
by Mikael Abrahamsson 18 Aug '08

18 Aug '08

The italian courts seem to have told ISPs there to block ThePirateBay (bittorrent tracker), and this evening (CET) LLNW (AS22822) originated 88.80.6.0/24 via 6762 (telecom italia) to what I presume is most of Europe. Basically same thing that happened when people tried to block YouTube a few months back (afghanistan?). How do we hinder this in the short term? I know there are a lot of long term solutions that very few is implementing, but would the fact that these mistakes are brought up into the (lime)light by a public shaming list make ISPs shape up and perform less mistakes? I am still waiting for a response from LLNW NOC on the issue. -- Mikael Abrahamsson email: swmike(a)swm.pp.se

23 49

Weekly Routing Table Report
by Routing Analysis Role Account 15 Aug '08

15 Aug '08

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.apnic.net. If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 16 Aug, 2008 Report Website: http://thyme.apnic.net Detailed Analysis: http://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 266031 Prefixes after maximum aggregation: 129676 Deaggregation factor: 2.05 Unique aggregates announced to Internet: 129417 Total ASes present in the Internet Routing Table: 28943 Prefixes per ASN: 9.19 Origin-only ASes present in the Internet Routing Table: 25197 Origin ASes announcing only one prefix: 12205 Transit ASes present in the Internet Routing Table: 3746 Transit-only ASes present in the Internet Routing Table: 79 Average AS path length visible in the Internet Routing Table: 3.6 Max AS path length visible: 25 Max AS path prepend of ASN ( 3816) 15 Prefixes from unregistered ASNs in the Routing Table: 581 Unregistered ASNs in the Routing Table: 214 Number of 32-bit ASNs allocated by the RIRs: 57 Prefixes from 32-bit ASNs in the Routing Table: 7 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 814 Number of addresses announced to Internet: 1891631072 Equivalent to 112 /8s, 191 /16s and 255 /24s Percentage of available address space announced: 51.0 Percentage of allocated address space announced: 62.0 Percentage of available address space allocated: 82.3 Percentage of address space in use by end-sites: 73.2 Total number of prefixes smaller than registry allocations: 130342 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 61134 Total APNIC prefixes after maximum aggregation: 22712 APNIC Deaggregation factor: 2.69 Prefixes being announced from the APNIC address blocks: 58105 Unique aggregates announced from the APNIC address blocks: 26152 APNIC Region origin ASes present in the Internet Routing Table: 3328 APNIC Prefixes per ASN: 17.46 APNIC Region origin ASes announcing only one prefix: 878 APNIC Region transit ASes present in the Internet Routing Table: 514 Average APNIC Region AS path length visible: 3.5 Max APNIC Region AS path length visible: 22 Number of APNIC addresses announced to Internet: 371611424 Equivalent to 22 /8s, 38 /16s and 87 /24s Percentage of available APNIC address space announced: 79.1 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079 APNIC Address Blocks 58/8, 59/8, 60/8, 61/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 121924 Total ARIN prefixes after maximum aggregation: 65148 ARIN Deaggregation factor: 1.87 Prefixes being announced from the ARIN address blocks: 91111 Unique aggregates announced from the ARIN address blocks: 34743 ARIN Region origin ASes present in the Internet Routing Table: 12358 ARIN Prefixes per ASN: 7.37 ARIN Region origin ASes announcing only one prefix: 4754 ARIN Region transit ASes present in the Internet Routing Table: 1184 Average ARIN Region AS path length visible: 3.3 Max ARIN Region AS path length visible: 17 Number of ARIN addresses announced to Internet: 360325024 Equivalent to 21 /8s, 122 /16s and 31 /24s Percentage of available ARIN address space announced: 74.1 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 ARIN Address Blocks 24/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 173/8, 174/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 57391 Total RIPE prefixes after maximum aggregation: 34803 RIPE Deaggregation factor: 1.65 Prefixes being announced from the RIPE address blocks: 52507 Unique aggregates announced from the RIPE address blocks: 35275 RIPE Region origin ASes present in the Internet Routing Table: 11737 RIPE Prefixes per ASN: 4.47 RIPE Region origin ASes announcing only one prefix: 6169 RIPE Region transit ASes present in the Internet Routing Table: 1778 Average RIPE Region AS path length visible: 4.0 Max RIPE Region AS path length visible: 18 Number of RIPE addresses announced to Internet: 369143104 Equivalent to 22 /8s, 0 /16s and 173 /24s Percentage of available RIPE address space announced: 84.6 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-48127 RIPE Address Blocks 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 21007 Total LACNIC prefixes after maximum aggregation: 5308 LACNIC Deaggregation factor: 3.96 Prefixes being announced from the LACNIC address blocks: 19258 Unique aggregates announced from the LACNIC address blocks: 10747 LACNIC Region origin ASes present in the Internet Routing Table: 981 LACNIC Prefixes per ASN: 19.63 LACNIC Region origin ASes announcing only one prefix: 324 LACNIC Region transit ASes present in the Internet Routing Table: 169 Average LACNIC Region AS path length visible: 4.1 Max LACNIC Region AS path length visible: 25 Number of LACNIC addresses announced to Internet: 54404608 Equivalent to 3 /8s, 62 /16s and 38 /24s Percentage of available LACNIC address space announced: 54.0 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 186/8, 187/8, 189/8, 190/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 3993 Total AfriNIC prefixes after maximum aggregation: 1225 AfriNIC Deaggregation factor: 3.26 Prefixes being announced from the AfriNIC address blocks: 4347 Unique aggregates announced from the AfriNIC address blocks: 1868 AfriNIC Region origin ASes present in the Internet Routing Table: 248 AfriNIC Prefixes per ASN: 17.53 AfriNIC Region origin ASes announcing only one prefix: 80 AfriNIC Region transit ASes present in the Internet Routing Table: 52 Average AfriNIC Region AS path length visible: 3.9 Max AfriNIC Region AS path length visible: 14 Number of AfriNIC addresses announced to Internet: 12726016 Equivalent to 0 /8s, 194 /16s and 47 /24s Percentage of available AfriNIC address space announced: 37.9 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4755 1693 537 180 Videsh Sanchar Nigam Ltd. Aut 17488 1300 89 99 Hathway IP Over Cable Interne 9583 1176 92 493 Sify Limited 4766 858 6390 351 Korea Telecom (KIX) 4134 836 13523 339 CHINANET-BACKBONE 23577 823 35 698 Korea Telecom (ATM-MPLS) 4780 714 353 61 Digital United Inc. 18101 692 167 33 Reliance Infocom Ltd Internet 9498 674 291 54 BHARTI BT INTERNET LTD. 4808 616 1109 135 CNCGROUP IP network: China169 Complete listing at http://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 3198 3358 208 bellsouth.net, inc. 209 2881 3857 619 Qwest 6298 2004 323 735 Cox Communicatons 2386 1562 692 899 AT&T Data Communications Serv 4323 1491 1078 379 Time Warner Telecom 1785 1454 478 100 AppliedTheory Corporation 7018 1412 5830 988 AT&T WorldNet Services 11492 1214 151 22 Cable One 20115 1113 1080 573 Charter Communications 18566 1045 296 10 Covad Communications Complete listing at http://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 3292 414 1776 372 TDC Tele Danmark 3215 371 2756 106 France Telecom Transpac 8452 357 188 11 TEDATA 3301 332 1444 303 TeliaNet Sweden 3320 323 7047 271 Deutsche Telekom AG 8866 317 77 21 Bulgarian Telecommunication C 5462 296 666 27 Telewest Broadband 8551 289 270 39 Bezeq International 680 274 2047 264 DFN-IP service G-WiN 6746 269 126 243 Dynamic Network Technologies, Complete listing at http://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 1517 2592 222 UniNet S.A. de C.V. 11830 664 299 9 Instituto Costarricense de El 22047 565 270 14 VTR PUNTO NET S.A. 7303 479 236 65 Telecom Argentina Stet-France 16814 426 27 10 NSS, S.A. 6471 417 85 48 ENTEL CHILE S.A. 11172 410 118 72 Servicios Alestra S.A de C.V 10620 371 99 90 TVCABLE BOGOTA 14117 348 23 9 Telefonica del Sur S.A. 28573 318 432 33 NET Servicos de Comunicao S.A Complete listing at http://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 496 64 28 LINKdotNET AS number 20858 402 34 3 EgyNet 3741 267 855 224 The Internet Solution 2018 211 213 130 Tertiary Education Network 6713 143 135 11 Itissalat Al-MAGHRIB 33783 136 10 13 EEPAD TISP TELECOM & INTERNET 5713 129 540 74 Telkom SA Ltd 5536 120 8 17 Internet Egypt Network 33776 119 6 3 Starcomms Nigeria Limited 29571 107 13 8 Ci Telecom Autonomous system Complete listing at http://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 3198 3358 208 bellsouth.net, inc. 209 2881 3857 619 Qwest 6298 2004 323 735 Cox Communicatons 4755 1693 537 180 Videsh Sanchar Nigam Ltd. Aut 2386 1562 692 899 AT&T Data Communications Serv 8151 1517 2592 222 UniNet S.A. de C.V. 4323 1491 1078 379 Time Warner Telecom 1785 1454 478 100 AppliedTheory Corporation 7018 1412 5830 988 AT&T WorldNet Services 17488 1300 89 99 Hathway IP Over Cable Interne Complete listing at http://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 209 2881 2262 Qwest 4755 1693 1513 Videsh Sanchar Nigam Ltd. Aut 1785 1454 1354 AppliedTheory Corporation 8151 1517 1295 UniNet S.A. de C.V. 6298 2004 1269 Cox Communicatons 17488 1300 1201 Hathway IP Over Cable Interne 11492 1214 1192 Cable One 4323 1491 1112 Time Warner Telecom 18566 1045 1035 Covad Communications 22773 959 897 Cox Communications, Inc. Complete listing at http://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 65530 PRIVATE 8.7.233.0/24 20473 Net Transactions LLC 16927 UNALLOCATED 12.0.252.0/23 7018 AT&T WorldNet Servic 22492 UNALLOCATED 12.2.46.0/24 7018 AT&T WorldNet Servic 15132 UNALLOCATED 12.9.150.0/24 7018 AT&T WorldNet Servic 32567 UNALLOCATED 12.14.170.0/24 7018 AT&T WorldNet Servic 13632 UNALLOCATED 12.20.55.0/24 6517 Yipes Communications 13746 UNALLOCATED 12.24.56.0/24 7018 AT&T WorldNet Servic 32567 UNALLOCATED 12.25.107.0/24 7018 AT&T WorldNet Servic 13632 UNALLOCATED 12.31.25.0/24 6517 Yipes Communications 27220 UNALLOCATED 12.35.204.0/24 7018 AT&T WorldNet Servic Complete listing at http://thyme.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 24.51.159.0/24 7843 Adelphia Corp. 24.53.86.0/24 7843 Adelphia Corp. 24.54.224.0/19 20001 HoldCo LLC - Road Runner 24.55.0.0/18 20001 HoldCo LLC - Road Runner 24.75.160.0/19 7843 Adelphia Corp. 24.142.40.0/21 7018 AT&T WorldNet Services 24.142.160.0/19 7018 AT&T WorldNet Services 24.246.0.0/17 7018 AT&T WorldNet Services 24.246.128.0/18 7018 AT&T WorldNet Services 62.61.220.0/24 24974 Tachyon Europe BV - Wireless Complete listing at http://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:18 /9:9 /10:17 /11:45 /12:146 /13:293 /14:527 /15:1055 /16:10032 /17:4359 /18:7547 /19:16006 /20:18673 /21:18275 /22:22986 /23:24093 /24:139274 /25:834 /26:1018 /27:722 /28:85 /29:9 /30:1 /31:0 /32:7 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 6389 2035 3198 bellsouth.net, inc. 6298 1977 2004 Cox Communicatons 209 1645 2881 Qwest 2386 1240 1562 AT&T Data Communications Serv 11492 1195 1214 Cable One 17488 1107 1300 Hathway IP Over Cable Interne 1785 1069 1454 AppliedTheory Corporation 4755 1042 1693 Videsh Sanchar Nigam Ltd. Aut 9583 1032 1176 Sify Limited 18566 1026 1045 Covad Communications Complete listing at http://thyme.apnic.net/current/data/sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:8 8:133 12:2100 13:2 14:1 15:22 16:3 17:5 18:13 20:35 24:1083 32:59 38:482 40:92 41:703 43:1 44:2 47:12 52:3 55:3 56:3 57:27 58:526 59:505 60:453 61:983 62:1198 63:2032 64:3211 65:2365 66:3426 67:1226 68:767 69:2280 70:863 71:131 72:2039 73:6 74:1101 75:165 76:307 77:757 78:817 79:225 80:979 81:844 82:605 83:379 84:573 85:982 86:399 87:707 88:338 89:1309 90:33 91:1417 92:243 93:766 94:109 96:54 97:50 98:307 99:3 114:90 115:40 116:941 117:331 118:195 119:459 120:73 121:587 122:816 123:375 124:893 125:1178 128:355 129:201 130:135 131:410 132:70 133:9 134:188 135:33 136:223 137:94 138:145 139:94 140:503 141:103 142:407 143:340 144:398 145:51 146:372 147:156 148:517 149:197 150:129 151:183 152:144 153:136 154:10 155:278 156:173 157:288 158:166 159:294 160:273 161:118 162:262 163:155 164:518 165:456 166:362 167:333 168:626 169:139 170:426 171:33 172:10 173:12 188:1 189:473 190:2121 192:5794 193:4126 194:3239 195:2554 196:1016 198:3728 199:3312 200:5579 201:1521 202:7683 203:8093 204:3953 205:2146 206:2369 207:2759 208:3489 209:3419 210:2607 211:1075 212:1425 213:1610 214:179 215:50 216:4375 217:1203 218:346 219:429 220:1060 221:455 222:310 End of report

1 0

facebook worm
by Gadi Evron 15 Aug '08

15 Aug '08

Hi all. You may want to be ready for a *possible* support lines flood today. Yesterday I discovered a fast-spreading facebook worm. It spreads by sending messages to all your facebook friends, from your account, asking them to click on a link in the .pl ccTLD. This worm is somewhat similar to zlob, here is a link to a kaspersky paper on a previous iteration of it, they call it koobface: http://www.kaspersky.com/news?id=207575670 The worm collects spam subject lines from, and then sends the users personal data to the following C&C: zzzping.com I spoke with DirectNIC last night and the Registrar Operations (reg-ops) mailing list was updated that the domain is no longer reachable. That was very fast response time from DirectNIC, which we appreciate. The worm is still fast-spreading, watch the statistics as they fly: http://www.d9.pl/system/stats.php The facebook security team is working on this, and they are quite capable. The security operations community has been doing analysis and take-downs, but the worm seems to still be spreading. All anti virus vendors have been notified, and detection (if not removal) should be added within a few hours to a few days. For now, while users may get infected, their information is safe (unless the worm has a secondary contact C&C which I have not verified yet). It seems like some users may have learned not to click on links in email, but any other medium does not compute. Gadi.

10 11

Re: Public shaming list for ISPs announcing other ISPs IP space by mis take
by Paul Ferguson 15 Aug '08

15 Aug '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Danny McPherson <danny(a)tcb.net> wrote: >OK, so we were talking past one another. I agree with everything >you said above, and simply meant to highlight the fact that RPKI >validation will change things (quite necessarily, IMO), and folks >need to be paying attention to this. Okay, I admit I haven't paid the closest attention to RPKI, but I have to ask: Is this a two-way shared-key issue, or (worse) a case where we need to rely on a central entity to be a key clearinghouse? The reason why I mention this is obvious -- the entire PKI effort has been stalled (w.r.t. authority) because of this particular issue. Any thoughts on that? - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFIpRYsq1pz9mNUZTMRArLnAKC5C6uLw3khwDreYlWw3m3vEmYJAACg81By z3hYv0xseQegh/2yzYbeARw= =/xK7 -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

7 9

WebEx
by Jon Kibler 15 Aug '08

15 Aug '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Yesterday, Cisco announced a critical vulnerability in WebEx: http://www.cisco.com/warp/public/707/cisco-sa-20080814-webex.shtml The interesting thing about this vulnerability is that you can clean up all of your WebEx installs, but as soon as you create a session with a WebEx server that has not been upgraded, you are once again vulnerable. In other words, you are at the mercy of your WebEx presenter. BTW, despite the fact that Cisco says exploits are available, there is not the first mention of this vulnerability on the WebEx web site. Jon Kibler - -- Jon R. Kibler Chief Technical Officer Advanced Systems Engineering Technology, Inc. Charleston, SC USA o: 843-849-8214 c: 843-224-2494 s: 843-564-4224 My PGP Fingerprint is: BAA2 1F2C 5543 5D25 4636 A392 515C 5045 CF39 4253 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkiliucACgkQUVxQRc85QlMpJgCgiCPz+nXKOFrVsWkI/7o0HnHI OhAAnRVH6X9IU3+oc/TRnDrFOqAkadmo =aulb -----END PGP SIGNATURE----- ================================================== Filtered by: TRUSTEM.COM's Email Filtering Service http://www.trustem.com/ No Spam. No Viruses. Just Good Clean Email.

1 1

Re: route policy (Re: Public shaming list for ISPs announcing other ISPs IP space by mistake)
by Brandon Butterworth 15 Aug '08

15 Aug '08

> > Yes, RIPE rock. Please make it all not suck. > > Unfortunately, RIPE DB will allow anyone to add any route objects for > prefixes that are not under the RIPE management :-(. For example, > anyone could add route objects for most of DNS root server prefixes. Little details get used to avoid fixing bigger problems, see the please stop sucking bit. If there was somewhere else the aliens had to be registered then they could be dropped from RIPE brandon

4 3