January 2009 - NANOG - lists.nanog.org

RE: Security team successfully cracks SSL using 200 PS3's and MD5 flaw.
by Skywing 04 Jan '09

04 Jan '09

That md5 has now been deprecated for awhile is certainly also true; and people should have definitely moved on by now. Then again, I just got yet another Debian DSA mail which has plaintext download links for new binaries. The integrity verification mechanism for said binaries is, you guessed it: PGP-signed md5sums. We still have a long way to go. :) – S -----Original Message----- From: Steven M. Bellovin <smb(a)cs.columbia.edu> Sent: Friday, January 02, 2009 15:07 To: Skywing <Skywing(a)valhallalegends.com> Cc: Deepak Jain <deepak(a)ai.net>; NANOG <nanog(a)nanog.org> Subject: Re: Security team successfully cracks SSL using 200 PS3's and MD5 flaw. On Fri, 2 Jan 2009 16:51:53 -0600 Skywing <Skywing(a)valhallalegends.com> wrote: > Of course, md5 *used* to be good crypto. > See http://www.cs.columbia.edu/~smb/blog/2008-12/2008-12-30.html for the links, but MD5 has been suspect for a very long time. Dobbertin found problems with it in 1996. The need for caution with it was not just knowable but known, and stated publicly. I'm sure others did so as well; I can only easily quote my own works. From the second edition of my Firewalls book, in 2003: Additionally, \i{SHA} has replaced \i{MD5}, as the latter appears to be weaker than previously believed. and Hints of weakness have shown up in MD5 and RIPEMD-160; cautious people will eschew them, though none of the attacks are of use against either function when used with HMAC\@. As of this writing, the \i{NIST} algorithm appears to be the best choice. For many purposes, the newer versions of SHA are better; these have block sizes ranging from 256 to 512 bits. Even if that were not enough, Wang et al presented the actual collisions in 2004. There have been many updates and patches to more or less everything since then... Yes -- if you pick something that's very weak, you can get caught by surprise. But modern algorithms don't fall all at once. I should add, of course, that if you use bad algorithms or bad protocols, it doesn't matter where you store the public key. When I said that the update problem was easier, what I was saying is that you're not relying on outside parties for verification of identity, etc., it's all your own data. --Steve Bellovin, http://www.cs.columbia.edu/~smb

5 5

RE: Security team successfully cracks SSL using 200 PS3's and MD5 flaw.
by Skywing 03 Jan '09

03 Jan '09

What's the cost to switching to something other than MD5 here, though? I agree that users not checking download links is likely more probablistic. But as checking the sums is already entirely a manual process, what's the trouble with switching to sha256 now abd stating this in the DSA mails? No, there probably won't be another major md5 break in six months. Or maybe a year, or two, or... However, the both of us well know that the attacks here won't do anything but get better. Even if it's not a thing to sound a fire drill about, I have to admit that hearing that Debian's going to continue moving forward with md5 until an unspecified somewhen date in the future is a bit disappointing. Not (yet) the end of the world, but I would like to understand the reason (cost) for the pushback here. – S -----Original Message----- From: Florian Weimer <fw(a)deneb.enyo.de> Sent: Saturday, January 03, 2009 08:23 To: Skywing <Skywing(a)valhallalegends.com> Cc: Steven M. Bellovin <smb(a)cs.columbia.edu>; NANOG <nanog(a)nanog.org> Subject: Re: Security team successfully cracks SSL using 200 PS3's and MD5 flaw. > Then again, I just got yet another Debian DSA mail which has > plaintext download links for new binaries. The integrity > verification mechanism for said binaries is, you guessed it: > PGP-signed md5sums. I can assure you that you will continue to receive these messages for a while (unless you unsubscribe from the relevant mailing lists). Our rationale is that in order to carry out currently known attacks on MD5, you need to create a twin of documents, one evil and one harmless. In Debian's case, we prepare the data we sign on our trusted infrastructure. If someone can sneak in an evil twin due to a breach, more direct means of attack are available. In practice, the download links themselves are the larger problem because users might use them without checking anything. Eventually, they will go away, together with the MD5 hashes. Newer versions of APT also use the SHA-256 checksums embedded in the Release and Packages files.

2 1

NANOG 45: ISP Security BOF - Call for participants
by Warren Kumari 03 Jan '09

03 Jan '09

Hello and Happy New Years all, NANOG 45 is fast approaching and so here is the call for participants for the ISP Security BOF. This is *your* chance to talk about interesting security related topics and provide some feedback on what you would (and would not) like to hear about... Some security thing been buggin' you all year? Some topic that you feel strongly about and would like a change to inform others about? Step right up and give a talk... Slides are welcome, but not required... W

1 0

RR Routing Loop?
by Neil 02 Jan '09

02 Jan '09

So my night was fun: I was in the middle of configuring a mail server over SSH when suddenly it goes unresponsive... It seems (to me, but I'm by no means an expert) to be a routing loop. This is off a residential line in Southern California, between about 2-4:30am PST. Does anyone know what was going on there? 1 cpe-75-82-48-1.socal.res.rr.com (75.82.48.1) 23.890 ms 11.594 ms 10.598 ms 2 gig11-35.vnnyca2-rtr2.socal.rr.com (76.167.5.141) 12.732 ms 11.605 ms 10.378 ms 3 * * * 4 prt24.lsanca3-rtr2.socal.rr.com (76.167.2.14) 28.318 ms 30.164 ms 25.177 ms 5 * * * 6 * * * 7 prt24.lsanca3-rtr2.socal.rr.com (76.167.2.14) 43.524 ms 43.117 ms 42.888 ms 8 * * * 9 * * * 10 prt24.lsanca3-rtr2.socal.rr.com (76.167.2.14) 60.265 ms 59.196 ms 59.076 ms 11 * * * 12 * * * [snip] 28 prt24.lsanca3-rtr2.socal.rr.com (76.167.2.14) 150.724 ms 154.224 ms * 29 prt23.vnnyca2-rtr1.socal.rr.com (76.167.2.11) 154.232 ms * * [snip] 56 * * * 57 * * * 58 prt24.lsanca3-rtr2.socal.rr.com (76.167.2.14) 173.394 ms 173.101 ms 168.737 ms 59 * * * 60 * * * 61 prt24.lsanca3-rtr2.socal.rr.com (76.167.2.14) 178.986 ms 178.072 ms * 62 * * * 63 * * * 64 prt24.lsanca3-rtr2.socal.rr.com (76.167.2.14) 189.424 ms 188.331 ms 196.333 ms

1 0

London Demon Internet NOC/ENG contact?
by Mike Lyon 02 Jan '09

02 Jan '09

Could you please hit me up off list? E-mails to your helpdesk and NOC have gone unanswered. It's in regards to a routing loop: 16 227 ms 204 ms 204 ms park-ll-1-7200.access.demon.net[194.159.245.133] 17 225 ms 204 ms 204 ms lon1-service-1e2-xxx.router.demon.net[194.159.245.130] 18 175 ms 204 ms 204 ms 194.159.245.129 19 175 ms 204 ms 204 ms lon1-service-1e2-xxx.router.demon.net[194.159.245.130] 20 227 ms 204 ms 204 ms 194.159.245.129 21 227 ms 204 ms 204 ms lon1-service-1e2-xxx.router.demon.net[194.159.245.130] 22 227 ms 204 ms 204 ms 194.159.245.129 23 227 ms 205 ms 203 ms lon1-service-1e2-xxx.router.demon.net[194.159.245.130] Thanks in advance. Cheers, Mike

1 0

RE: Security team successfully cracks SSL using 200 PS3's and MD5 flaw.
by Skywing 02 Jan '09

02 Jan '09

Of course, md5 *used* to be good crypto. – S -----Original Message----- From: Steven M. Bellovin <smb(a)cs.columbia.edu> Sent: Friday, January 02, 2009 14:46 To: Deepak Jain <deepak(a)ai.net> Cc: NANOG <nanog(a)nanog.org> Subject: Re: Security team successfully cracks SSL using 200 PS3's and MD5 flaw. On Fri, 2 Jan 2009 16:13:45 -0500 Deepak Jain <deepak(a)ai.net> wrote: > > If done properly, that's actually an easier task: you build the > > update key into the browser. When it pulls in an update, it > > verifies that it was signed with the proper key. > > > > If you build it into the browser, how do you revoke it when someone > throws 2000 PS3s to crack it, or your hash, or your [pick algorithmic > mistake here]. > If you use bad crypto, you lose no matter what. If you use good crypto, 2,000,000,000 PS3s won't do the job. --Steve Bellovin, http://www.cs.columbia.edu/~smb

2 1

Re: Anyone else seeing loss in SAVVIS?
by Henry Linneweh 02 Jan '09

02 Jan '09

Target Name: N/A IP: 204.70.95.25 Date/Time: 1/2/2009 1:59:37 PM 1 1 ms 0 ms home [192.168.1.254] 2 11 ms 11 ms adsl-75-18-183-254.dsl.pltn13.sbcglobal.net [75.18.183.254] 3 10 ms 10 ms [64.164.107.130] 4 11 ms 9 ms bb1-g3-0.pltnca.sbcglobal.net [151.164.43.54] 5 12 ms 12 ms ex1-p10-0.eqsjca.sbcglobal.net [151.164.191.66] 6 11 ms 12 ms [151.164.251.146] 7 11 ms 12 ms pr2-ge-2-0-0.SanJoseEquinix.savvis.net [204.70.200.130] 8 * * [-] destination address unreachable ________________________________ From: Tomas L. Byrnes <tomb(a)byrneit.net> To: nanog(a)merit.edu Sent: Friday, January 2, 2009 1:53:19 PM Subject: Anyone else seeing loss in SAVVIS? 7 170 ms 163 ms 167 ms cr2-pos-0-3-0-2.sanfrancisco.savvis.net [204.70. 95.25] 8 * 208 ms * cr1-tengig-0-15-0-0.NewYork.savvis.net [204.70.1 6.117] 9 170 ms * * kar1-ge-0-0-0.newyork.savvis.net [204.70.193.1] 10 * * * Request timed out.

1 0

Anyone else seeing loss in SAVVIS?
by Tomas L. Byrnes 02 Jan '09

02 Jan '09

7 170 ms 163 ms 167 ms cr2-pos-0-3-0-2.sanfrancisco.savvis.net [204.70. 95.25] 8 * 208 ms * cr1-tengig-0-15-0-0.NewYork.savvis.net [204.70.1 6.117] 9 170 ms * * kar1-ge-0-0-0.newyork.savvis.net [204.70.193.1] 10 * * * Request timed out.

2 1

Happy New Year! Let the botnets loose!
by Jack Bates 02 Jan '09

02 Jan '09

From reports in the CBL database, it appears they have enjoyed some DOS traffic yesterday, and I'm currently enjoying a little 40k+ botnet attack (small botnet beats large one when you host the victim IP). Anyone have any good resources on the breakdowns of the current known botnets and their traffic patterns? This one appears to use random IP protocol numbers, and extremely small packets. IP 255 and ICMP type 70 seem popular on this one, but I see a lot of randomness. Feel free to reply offlist if you have some good resources. Jack Bates

1 0

Weekly Routing Table Report
by Routing Analysis Role Account 02 Jan '09

02 Jan '09

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.apnic.net. If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 03 Jan, 2009 Report Website: http://thyme.apnic.net Detailed Analysis: http://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 275280 Prefixes after maximum aggregation: 131723 Deaggregation factor: 2.09 Unique aggregates announced to Internet: 133384 Total ASes present in the Internet Routing Table: 30197 Prefixes per ASN: 9.12 Origin-only ASes present in the Internet Routing Table: 26280 Origin ASes announcing only one prefix: 12806 Transit ASes present in the Internet Routing Table: 3917 Transit-only ASes present in the Internet Routing Table: 95 Average AS path length visible in the Internet Routing Table: 3.6 Max AS path length visible: 24 Max AS path prepend of ASN ( 3816) 15 Prefixes from unregistered ASNs in the Routing Table: 523 Unregistered ASNs in the Routing Table: 188 Number of 32-bit ASNs allocated by the RIRs: 70 Prefixes from 32-bit ASNs in the Routing Table: 12 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 231 Number of addresses announced to Internet: 1980712736 Equivalent to 118 /8s, 15 /16s and 71 /24s Percentage of available address space announced: 53.4 Percentage of allocated address space announced: 63.2 Percentage of available address space allocated: 84.6 Percentage of address space in use by end-sites: 75.1 Total number of prefixes smaller than registry allocations: 134788 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 63617 Total APNIC prefixes after maximum aggregation: 22614 APNIC Deaggregation factor: 2.81 Prefixes being announced from the APNIC address blocks: 60489 Unique aggregates announced from the APNIC address blocks: 25957 APNIC Region origin ASes present in the Internet Routing Table: 3492 APNIC Prefixes per ASN: 17.32 APNIC Region origin ASes announcing only one prefix: 956 APNIC Region transit ASes present in the Internet Routing Table: 537 Average APNIC Region AS path length visible: 3.5 Max APNIC Region AS path length visible: 24 Number of APNIC addresses announced to Internet: 395968416 Equivalent to 23 /8s, 153 /16s and 255 /24s Percentage of available APNIC address space announced: 78.7 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079 APNIC Address Blocks 58/8, 59/8, 60/8, 61/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 122871 Total ARIN prefixes after maximum aggregation: 64857 ARIN Deaggregation factor: 1.89 Prefixes being announced from the ARIN address blocks: 92460 Unique aggregates announced from the ARIN address blocks: 35159 ARIN Region origin ASes present in the Internet Routing Table: 12687 ARIN Prefixes per ASN: 7.29 ARIN Region origin ASes announcing only one prefix: 4890 ARIN Region transit ASes present in the Internet Routing Table: 1213 Average ARIN Region AS path length visible: 3.3 Max ARIN Region AS path length visible: 20 Number of ARIN addresses announced to Internet: 405423904 Equivalent to 24 /8s, 42 /16s and 71 /24s Percentage of available ARIN address space announced: 78.0 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 ARIN Address Blocks 24/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 108/8, 173/8, 174/8, 184/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 61292 Total RIPE prefixes after maximum aggregation: 36722 RIPE Deaggregation factor: 1.67 Prefixes being announced from the RIPE address blocks: 56859 Unique aggregates announced from the RIPE address blocks: 37994 RIPE Region origin ASes present in the Internet Routing Table: 12432 RIPE Prefixes per ASN: 4.57 RIPE Region origin ASes announcing only one prefix: 6539 RIPE Region transit ASes present in the Internet Routing Table: 1884 Average RIPE Region AS path length visible: 4.0 Max RIPE Region AS path length visible: 18 Number of RIPE addresses announced to Internet: 383811168 Equivalent to 22 /8s, 224 /16s and 126 /24s Percentage of available RIPE address space announced: 88.0 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-49151 RIPE Address Blocks 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 22931 Total LACNIC prefixes after maximum aggregation: 5719 LACNIC Deaggregation factor: 4.01 Prefixes being announced from the LACNIC address blocks: 21036 Unique aggregates announced from the LACNIC address blocks: 11601 LACNIC Region origin ASes present in the Internet Routing Table: 1047 LACNIC Prefixes per ASN: 20.09 LACNIC Region origin ASes announcing only one prefix: 341 LACNIC Region transit ASes present in the Internet Routing Table: 170 Average LACNIC Region AS path length visible: 4.1 Max LACNIC Region AS path length visible: 18 Number of LACNIC addresses announced to Internet: 59299968 Equivalent to 3 /8s, 136 /16s and 216 /24s Percentage of available LACNIC address space announced: 58.9 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 186/8, 187/8, 189/8, 190/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 4068 Total AfriNIC prefixes after maximum aggregation: 1396 AfriNIC Deaggregation factor: 2.91 Prefixes being announced from the AfriNIC address blocks: 4338 Unique aggregates announced from the AfriNIC address blocks: 2165 AfriNIC Region origin ASes present in the Internet Routing Table: 268 AfriNIC Prefixes per ASN: 16.19 AfriNIC Region origin ASes announcing only one prefix: 80 AfriNIC Region transit ASes present in the Internet Routing Table: 58 Average AfriNIC Region AS path length visible: 4.0 Max AfriNIC Region AS path length visible: 15 Number of AfriNIC addresses announced to Internet: 12971264 Equivalent to 0 /8s, 197 /16s and 237 /24s Percentage of available AfriNIC address space announced: 25.8 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4766 1647 6410 372 Korea Telecom (KIX) 17488 1477 104 101 Hathway IP Over Cable Interne 4755 1176 434 165 TATA Communications formerly 9583 902 131 67 Sify Limited 4134 896 15977 360 CHINANET-BACKBONE 18101 782 168 30 Reliance Infocom Ltd Internet 9498 759 292 47 BHARTI BT INTERNET LTD. 4780 721 360 66 Digital United Inc. 24560 662 227 169 Bharti Airtel Ltd. 7545 661 152 82 TPG Internet Pty Ltd Complete listing at http://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 4381 3435 345 bellsouth.net, inc. 209 2843 4032 621 Qwest 20115 1848 1455 741 Charter Communications 1785 1705 717 154 PaeTec Communications, Inc. 4323 1606 1059 378 Time Warner Telecom 2386 1580 706 894 AT&T Data Communications Serv 7018 1425 5872 985 AT&T WorldNet Services 11492 1231 192 12 Cable One 3356 1105 10994 432 Level 3 Communications, LLC 18566 1060 296 10 Covad Communications Complete listing at http://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 3292 434 1764 383 TDC Tele Danmark 30890 391 80 203 SC Kappa Invexim SRL 12479 383 578 6 Uni2 Autonomous System 3301 336 1413 303 TeliaNet Sweden 3320 333 7065 282 Deutsche Telekom AG 8866 330 109 22 Bulgarian Telecommunication C 3215 327 2857 96 France Telecom Transpac 29049 323 26 3 AzerSat LLC. 8551 304 287 35 Bezeq International 8452 271 188 7 TEDATA Complete listing at http://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 1400 2820 224 UniNet S.A. de C.V. 10620 688 149 57 TVCABLE BOGOTA 11830 671 299 9 Instituto Costarricense de El 22047 565 302 14 VTR PUNTO NET S.A. 7303 505 249 76 Telecom Argentina Stet-France 6471 429 86 40 ENTEL CHILE S.A. 16814 426 27 10 NSS, S.A. 11172 411 118 72 Servicios Alestra S.A de C.V 28573 364 489 26 NET Servicos de Comunicao S.A 7738 360 730 27 Telecomunicacoes da Bahia S.A Complete listing at http://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 518 71 83 LINKdotNET AS number 3741 270 857 227 The Internet Solution 20858 258 34 3 This AS will be used to conne 2018 239 215 140 Tertiary Education Network 33783 147 10 13 EEPAD TISP TELECOM & INTERNET 6713 145 139 12 Itissalat Al-MAGHRIB 29571 121 15 8 Ci Telecom Autonomous system 5536 120 8 17 Internet Egypt Network 5713 119 555 68 Telkom SA Ltd 33776 118 6 3 Starcomms Nigeria Limited Complete listing at http://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 4381 3435 345 bellsouth.net, inc. 209 2843 4032 621 Qwest 20115 1848 1455 741 Charter Communications 1785 1705 717 154 PaeTec Communications, Inc. 4766 1647 6410 372 Korea Telecom (KIX) 4323 1606 1059 378 Time Warner Telecom 2386 1580 706 894 AT&T Data Communications Serv 17488 1477 104 101 Hathway IP Over Cable Interne 7018 1425 5872 985 AT&T WorldNet Services 8151 1400 2820 224 UniNet S.A. de C.V. Complete listing at http://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 209 2843 2222 Qwest 1785 1705 1551 PaeTec Communications, Inc. 17488 1477 1376 Hathway IP Over Cable Interne 4766 1647 1275 Korea Telecom (KIX) 4323 1606 1228 Time Warner Telecom 11492 1231 1219 Cable One 8151 1400 1176 UniNet S.A. de C.V. 20115 1848 1107 Charter Communications 18566 1060 1050 Covad Communications 4755 1176 1011 TATA Communications formerly Complete listing at http://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 16927 UNALLOCATED 12.0.252.0/23 7018 AT&T WorldNet Servic 15132 UNALLOCATED 12.9.150.0/24 7018 AT&T WorldNet Servic 32567 UNALLOCATED 12.14.170.0/24 7018 AT&T WorldNet Servic 13746 UNALLOCATED 12.24.56.0/24 7018 AT&T WorldNet Servic 32567 UNALLOCATED 12.25.107.0/24 7018 AT&T WorldNet Servic 26973 UNALLOCATED 12.39.152.0/24 7018 AT&T WorldNet Servic 26973 UNALLOCATED 12.39.154.0/23 7018 AT&T WorldNet Servic 26973 UNALLOCATED 12.39.159.0/24 7018 AT&T WorldNet Servic 32326 UNALLOCATED 12.40.49.0/24 7018 AT&T WorldNet Servic 25639 UNALLOCATED 12.41.169.0/24 7018 AT&T WorldNet Servic Complete listing at http://thyme.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 24.75.116.0/22 10796 ServiceCo LLC - Road Runner 24.75.160.0/19 7843 Adelphia Corp. 24.142.40.0/21 7018 AT&T WorldNet Services 24.142.160.0/19 7018 AT&T WorldNet Services 24.246.0.0/17 7018 AT&T WorldNet Services 24.246.128.0/18 7018 AT&T WorldNet Services 62.61.220.0/24 24974 Tachyon Europe BV - Wireless 62.61.221.0/24 24974 Tachyon Europe BV - Wireless 63.140.213.0/24 22555 Universal Talkware Corporatio 63.143.251.0/24 22555 Universal Talkware Corporatio Complete listing at http://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:20 /9:9 /10:20 /11:54 /12:158 /13:310 /14:562 /15:1102 /16:10283 /17:4528 /18:7753 /19:16641 /20:19591 /21:19140 /22:24233 /23:24626 /24:144146 /25:655 /26:822 /27:513 /28:98 /29:8 /30:1 /31:0 /32:7 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 6389 2864 4381 bellsouth.net, inc. 209 1589 2843 Qwest 4766 1382 1647 Korea Telecom (KIX) 17488 1263 1477 Hathway IP Over Cable Interne 2386 1257 1580 AT&T Data Communications Serv 11492 1200 1231 Cable One 1785 1168 1705 PaeTec Communications, Inc. 18566 1041 1060 Covad Communications 20115 930 1848 Charter Communications 7011 837 936 Citizens Utilities Complete listing at http://thyme.apnic.net/current/data/sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:12 8:173 12:2177 13:2 15:21 16:3 17:5 20:35 24:1107 32:54 38:532 40:96 41:824 43:1 44:2 47:9 52:3 55:3 56:3 57:26 58:525 59:600 60:455 61:1097 62:1113 63:2002 64:3397 65:2448 66:3607 67:1440 68:655 69:2415 70:530 71:173 72:1591 73:7 74:1339 75:193 76:306 77:785 78:512 79:302 80:945 81:845 82:561 83:378 84:593 85:1061 86:394 87:638 88:354 89:1377 90:41 91:1811 92:307 93:1076 94:866 95:145 96:96 97:153 98:172 99:10 110:1 111:1 113:56 114:151 115:176 116:1112 117:434 118:244 119:590 120:130 121:701 122:892 123:480 124:772 125:1345 128:358 129:220 130:134 131:410 132:72 133:9 134:323 135:34 136:219 137:133 138:144 139:92 140:415 141:109 142:382 143:306 144:320 145:53 146:371 147:142 148:605 149:219 150:139 151:208 152:149 153:131 154:10 155:254 156:168 157:271 158:162 159:299 160:273 161:131 162:255 163:141 164:519 165:501 166:364 167:348 168:676 169:159 170:462 171:38 172:10 173:144 174:18 187:17 188:1 189:358 190:2484 192:5818 193:4176 194:3308 195:2655 196:1033 198:3694 199:3314 200:5544 201:1484 202:7782 203:8080 204:3924 205:2168 206:2324 207:2769 208:3794 209:3501 210:2688 211:1159 212:1557 213:1629 214:67 215:29 216:4538 217:1157 218:374 219:403 220:1236 221:399 222:294 End of report

1 0