April 2020 - NANOG - lists.nanog.org

Route aggregation w/o AS-Sets
by Lars Prehn 15 Apr '20

15 Apr '20

Hi everyone, how exactly do you aggregate routes? When do you add the AS_SET attribute, when do you omit it? How does the latter interplay with RPKI? Best regards, Lars

6 7

Netflix Open Connect
by John Alcock 14 Apr '20

14 Apr '20

I figure Netflix is busy just like every other company during the pandemic. I sent a request several weeks ago for Netflix OCA. I have not heard anything. Anyone from Netflix contact me off list? I am in charge of AS395437 John

2 1

Re: Constant Abuse Reports / Borderline Spamming from RiskIQ
by Tom Beecher 14 Apr '20

14 Apr '20

Jonathan- First time posts to the list are , pardon the phrase, quarantined out of the gate. Once it's obvious that it's not spam or a problem individual, that gets released and future messages go straight out. This is still a manual process done by one person in the NANOG organization, so it's not always that fast. You likely just got caught up in that, and didn't do anything incorrectly. On Tue, Apr 14, 2020 at 4:25 AM Jonathan M <jonathan-m(a)riskiq.net> wrote: > My bad - This was not for Rich but for Kushal who initiated the thread > taking the survey about us being "spammers". I'm contacting the > administrator at Nanog.org now to figure out what I did wrong to properly > post to the thread as I haven't used the mailing list before. Have a good > day. Jonathan > > On Mon, Apr 13, 2020 at 9:55 PM Jonathan M <jonathan-m(a)riskiq.net> wrote: > >> This may not have been approved yet by the moderator but was sent to the >> list about 30 minutes ago....I'm sorry, but I'm just learning how to use >> this list and I am concerned that my post was not properly sent--thus, >> replying to the thread here....thx >> >> Re: https://twitter.com/RiskIQ_IRT/status/1249721818602070016?s=20 >> >> Hi, Rich, >> >> I hope you are well. If you ever encounter an incident that you think >> could have been handled better on our end, we aspire to continuously >> improve, and don't claim to be perfect. >> >> Rather than blocking our abuse notification to the abuse POC, it would be >> better to let us know you have concerns so that we can improve our >> communications. Blocking us on Twitter and shutting off communication is no >> better than if we were to just send your customer's domain to a blacklist >> without notifying you of a compromise so that it can possibly be patched. >> Let's keep the overall goal in mind -- it's to make the internet safer by >> flagging possible violations of your acceptable use policy that may lead to >> compromised personal data or sensitive credentials of innocent visitors >> online. >> >> Before anything is posted to Twitter, I personally review the history of >> the event to see if we have exhausted all reasonable steps to mitigate >> harmful cyber activity or operations on network infrastructure short of >> always picking up the phone or using the fax. While we have attempted to do >> that in the past for each event, there is just too much harmful cyber >> activity going on for us to be relying on phone calls to try and reach the >> abuse team to ask that our ticket be prioritised after an unreasonable >> period of time has elapsed. We have thousands of escalations that we need >> to handle and most of the time though not across the board, when we call to >> reach the abuse teams, we are unsuccessful in reducing the time to >> remediation. >> >> The goal is not to shame anyone per se. It's to create more transparency >> regarding a problem that we all need to work together on. It's similar to >> where nation state actors use public attribution as part of mitigation to >> improve the Internet from cyber attacks. We did not block you on Twitter, >> and after every tweet, we follow-up to the appropriate abuse point of >> contact to raise visibility of the matter, as well as to the PR team, and >> applicable computer emergency response teams as well as attorney generals >> or other applicable authorities. >> >> We all need to work together. Please do not hesitate to contact me and I >> will make sure we are meeting our end of aspiring to be a good partner, and >> look forward to working with you as the need arises. Stay safe and healthy >> in these challenging times, and we wish you the best. >> >> I'm happy to discuss offline as well. We can set up a time to discuss and >> improve the mitigation workflow on both sides. >> >> Best regards, >> Jonathan Matkowsky >> VP, Digital Risk >> RiskIQ, Inc. >> >> >> On Mon, Apr 13, 2020 at 9:41 PM Tom Beecher <beecher(a)beecher.cc> wrote: >> >>> I would agree that Twitter is not a primary place for abuse reporting. >>> >>> If they are reporting things via your correct abuse channel and you are >>> indeed handling them within 48 business hours, then I would also agree this >>> much extra spray and pray is excessive. However RiskIQ is known to be >>> pretty responsible, so if they are doing this they likely feel like they >>> are NOT getting appropriate responses from you and are resorting to >>> scorched earth. Have you attempted to reach out to them and make sure they >>> have the proper direct channel for abuse reporting? >>> >>> On Mon, Apr 13, 2020 at 1:45 PM Kushal R. <kushal.r(a)h4g.co> wrote: >>> >>>> All abuse reports that we receive are dealt within 48 business hours. >>>> As far as that tweet is concerned, it’s pending for 16 days because they >>>> have been blocked from sending us any emails due to the sheer amount of >>>> emails they started sending and then our live support chats. >>>> >>>> We send our abuse reports to, but we don’t spam them to every publicly >>>> available email address for an organisation, it isn’t difficult to lookup >>>> the Abuse POC for an IP or network and just because you do not get a >>>> response in 24 hours does not mean you forward the same report to 10 other >>>> email addresses. Similarly twitter isn’t a place to report abuse either. >>>> >>>> >>>> On Apr 13, 2020 at 9:37 PM, <Rich Kulawiec <rsk(a)gsp.org>> wrote: >>>> >>>> >>>> On Mon, Apr 13, 2020 at 07:55:37PM +0530, Kushal R. wrote: > We understand these reports and deal with them as per our policies and timelines but this constant spamming by them from various channels is not appreciated. Quoting from: https://twitter.com/RiskIQ_IRT/status/1249696689985740800 which is dated 9:15 AM 4/13/2020: 5 #phishing URLs on admin12.find-textbook[.]com were reported to @Host4Geeks (Walnut, CA) from as far back as 16 days ago, and they are all STILL active 16 days is unacceptable. If you can't do better than that -- MUCH better -- then shut down your entire operation today as it's unworthy of being any part of the Internet community. ---rsk >>>> >>>> >>>> > ******************************************************************* > This message was sent from RiskIQ, and is intended only for the designated > recipient(s). It may contain confidential or proprietary information and > may be subject to confidentiality protections. If you are not a designated > recipient, you may not review, copy or distribute this message. If you > receive this in error, please notify the sender by reply e-mail and delete > this message. Thank you. > > *******************************************************************

1 0

Re: Constant Abuse Reports / Borderline Spamming from RiskIQ
by Kushal R. 14 Apr '20

14 Apr '20

I’ll reaching out to you off list. > > On Apr 14, 2020 at 1:55 PM, <Jonathan M (mailto:jonathan-m@riskiq.net)> wrote: > > > > > My bad - This was not for Rich but for Kushal who initiated the thread taking the survey about us being "spammers". I'm contacting the administrator at Nanog.org now to figure out what I did wrong to properly post to the thread as I haven't used the mailing list before. Have a good day. Jonathan > > > > On Mon, Apr 13, 2020 at 9:55 PM Jonathan M <jonathan-m(a)riskiq.net (mailto:jonathan-m@riskiq.net)> wrote: > > > > > > > This may not have been approved yet by the moderator but was sent to the list about 30 minutes ago....I'm sorry, but I'm just learning how to use this list and I am concerned that my post was not properly sent--thus, replying to the thread here....thx > > > > > > Re: https://twitter.com/RiskIQ_IRT/status/1249721818602070016?s=20 > > > > > > Hi, Rich, > > > > > > > > I hope you are well. If you ever encounter an incident that you think could have been handled better on our end, we aspire to continuously improve, and don't claim to be perfect. > > > > > > > > Rather than blocking our abuse notification to the abuse POC, it would be better to let us know you have concerns so that we can improve our communications. Blocking us on Twitter and shutting off communication is no better than if we were to just send your customer's domain to a blacklist without notifying you of a compromise so that it can possibly be patched. Let's keep the overall goal in mind -- it's to make the internet safer by flagging possible violations of your acceptable use policy that may lead to compromised personal data or sensitive credentials of innocent visitors online. > > > > > > > > Before anything is posted to Twitter, I personally review the history of the event to see if we have exhausted all reasonable steps to mitigate harmful cyber activity or operations on network infrastructure short of always picking up the phone or using the fax. While we have attempted to do that in the past for each event, there is just too much harmful cyber activity going on for us to be relying on phone calls to try and reach the abuse team to ask that our ticket be prioritised after an unreasonable period of time has elapsed. We have thousands of escalations that we need to handle and most of the time though not across the board, when we call to reach the abuse teams, we are unsuccessful in reducing the time to remediation. > > > > > > > > The goal is not to shame anyone per se. It's to create more transparency regarding a problem that we all need to work together on. It's similar to where nation state actors use public attribution as part of mitigation to improve the Internet from cyber attacks. We did not block you on Twitter, and after every tweet, we follow-up to the appropriate abuse point of contact to raise visibility of the matter, as well as to the PR team, and applicable computer emergency response teams as well as attorney generals or other applicable authorities. > > > > > > > > We all need to work together. Please do not hesitate to contact me and I will make sure we are meeting our end of aspiring to be a good partner, and look forward to working with you as the need arises. Stay safe and healthy in these challenging times, and we wish you the best. > > > > > > > > I'm happy to discuss offline as well. We can set up a time to discuss and improve the mitigation workflow on both sides. > > > > > > > > Best regards, > > > > Jonathan Matkowsky > > > > VP, Digital Risk > > > > RiskIQ, Inc. > > > > > > > > > > > > > > > > On Mon, Apr 13, 2020 at 9:41 PM Tom Beecher <beecher(a)beecher.cc> wrote: > > > > > > > > I would agree that Twitter is not a primary place for abuse reporting. > > > > > > > > > If they are reporting things via your correct abuse channel and you are indeed handling them within 48 business hours, then I would also agree this much extra spray and pray is excessive. However RiskIQ is known to be pretty responsible, so if they are doing this they likely feel like they are NOT getting appropriate responses from you and are resorting to scorched earth. Have you attempted to reach out to them and make sure they have the proper direct channel for abuse reporting? > > > > > > > > > > > > > > > On Mon, Apr 13, 2020 at 1:45 PM Kushal R. <kushal.r(a)h4g.co (mailto:kushal.r@h4g.co)> wrote: > > > > > > > > > > > > > > > > > > > > > > > All abuse reports that we receive are dealt within 48 business hours. As far as that tweet is concerned, it’s pending for 16 days because they have been blocked from sending us any emails due to the sheer amount of emails they started sending and then our live support chats. > > > > > > > > > > > > > > > > We send our abuse reports to, but we don’t spam them to every publicly available email address for an organisation, it isn’t difficult to lookup the Abuse POC for an IP or network and just because you do not get a response in 24 hours does not mean you forward the same report to 10 other email addresses. Similarly twitter isn’t a place to report abuse either. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > On Apr 13, 2020 at 9:37 PM, <Rich Kulawiec (mailto:rsk@gsp.org)> wrote: > > > > > > > > > > > > > > > > > > > > On Mon, Apr 13, 2020 at 07:55:37PM +0530, Kushal R. wrote: > We understand these reports and deal with them as per our policies and timelines but this constant spamming by them from various channels is not appreciated. Quoting from: https://twitter.com/RiskIQ_IRT/status/1249696689985740800 which is dated 9:15 AM 4/13/2020: 5 #phishing URLs on admin12.find-textbook[.]com were reported to @Host4Geeks (Walnut, CA) from as far back as 16 days ago, and they are all STILL active 16 days is unacceptable. If you can't do better than that -- MUCH better -- then shut down your entire operation today as it's unworthy of being any part of the Internet community. ---rsk > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > ******************************************************************* > This message was sent from RiskIQ, and is intended only for the designated recipient(s). It may contain confidential or proprietary information and may be subject to confidentiality protections. If you are not a designated recipient, you may not review, copy or distribute this message. If you receive this in error, please notify the sender by reply e-mail and delete this message. Thank you. > > > > ******************************************************************* >

1 0

Any Zayo peeps on the list?
by Mike Lyon 14 Apr '20

14 Apr '20

Howdy! Any Zayo peeps on the list? Seeing some packet loss on your network and your NCC seems to be clueless. Please shoot me an email offlist. Thank You, Mike

3 2

IS-IS IPAM platform
by JASON BOTHE 13 Apr '20

13 Apr '20

Does anyone have any recommendations for a database or IPAM platform that can house IS-IS addressing? Can’t seem to find anything out there. Thanks J~

6 7

AS27594 / UTSA contact?
by Bryan Holloway 13 Apr '20

13 Apr '20

Howdy ... if anyone from University of Texas, San Antonio (AS27594) is lurking, could you please reach out to me off-list? We have a mutual reachability problem through an IX in Dallas. Thanks!

1 1

Hulu contact (ipadmin unresponsive)
by Josh Luthman 13 Apr '20

13 Apr '20

I have customers on different parts of the network saying that Hulu doesn't work. They've all said other video services work (Amazon, Youtube, Netflix, etc). Same complaint from all of them - Hulu just doesn't start. Can someone from Hulu provide some support for our mutual customer? Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373

1 0

Any Bing engineers?
by John Von Essen 11 Apr '20

11 Apr '20

Seeing global latency issues to Bing search API…. -John

1 0

Weekly Routing Table Report
by cscora＠apnic.net 10 Apr '20

10 Apr '20

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 11 Apr, 2020 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 805484 Prefixes after maximum aggregation (per Origin AS): 305957 Deaggregation factor: 2.63 Unique aggregates announced (without unneeded subnets): 393305 Total ASes present in the Internet Routing Table: 67689 Prefixes per ASN: 11.90 Origin-only ASes present in the Internet Routing Table: 58122 Origin ASes announcing only one prefix: 24256 Transit ASes present in the Internet Routing Table: 9567 Transit-only ASes present in the Internet Routing Table: 295 Average AS path length visible in the Internet Routing Table: 4.5 Max AS path length visible: 38 Max AS path prepend of ASN ( 27978) 31 Prefixes from unregistered ASNs in the Routing Table: 1239 Number of instances of unregistered ASNs: 1242 Number of 32-bit ASNs allocated by the RIRs: 31261 Number of 32-bit ASNs visible in the Routing Table: 25806 Prefixes from 32-bit ASNs in the Routing Table: 119426 Number of bogon 32-bit ASNs visible in the Routing Table: 22 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 1117 Number of addresses announced to Internet: 2854271488 Equivalent to 170 /8s, 32 /16s and 186 /24s Percentage of available address space announced: 77.1 Percentage of allocated address space announced: 77.1 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.5 Total number of prefixes smaller than registry allocations: 271215 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 212043 Total APNIC prefixes after maximum aggregation: 61938 APNIC Deaggregation factor: 3.42 Prefixes being announced from the APNIC address blocks: 204843 Unique aggregates announced from the APNIC address blocks: 85571 APNIC Region origin ASes present in the Internet Routing Table: 10519 APNIC Prefixes per ASN: 19.47 APNIC Region origin ASes announcing only one prefix: 2924 APNIC Region transit ASes present in the Internet Routing Table: 1565 Average APNIC Region AS path length visible: 4.6 Max APNIC Region AS path length visible: 35 Number of APNIC region 32-bit ASNs visible in the Routing Table: 5585 Number of APNIC addresses announced to Internet: 766795648 Equivalent to 45 /8s, 180 /16s and 95 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-141625 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 235626 Total ARIN prefixes after maximum aggregation: 108397 ARIN Deaggregation factor: 2.17 Prefixes being announced from the ARIN address blocks: 233072 Unique aggregates announced from the ARIN address blocks: 118306 ARIN Region origin ASes present in the Internet Routing Table: 18423 ARIN Prefixes per ASN: 12.65 ARIN Region origin ASes announcing only one prefix: 6716 ARIN Region transit ASes present in the Internet Routing Table: 1912 Average ARIN Region AS path length visible: 3.9 Max ARIN Region AS path length visible: 22 Number of ARIN region 32-bit ASNs visible in the Routing Table: 3200 Number of ARIN addresses announced to Internet: 1079232768 Equivalent to 64 /8s, 83 /16s and 201 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-399260 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 228817 Total RIPE prefixes after maximum aggregation: 105651 RIPE Deaggregation factor: 2.17 Prefixes being announced from the RIPE address blocks: 225628 Unique aggregates announced from the RIPE address blocks: 132097 RIPE Region origin ASes present in the Internet Routing Table: 26999 RIPE Prefixes per ASN: 8.36 RIPE Region origin ASes announcing only one prefix: 11735 RIPE Region transit ASes present in the Internet Routing Table: 3828 Average RIPE Region AS path length visible: 4.4 Max RIPE Region AS path length visible: 31 Number of RIPE region 32-bit ASNs visible in the Routing Table: 9086 Number of RIPE addresses announced to Internet: 724642176 Equivalent to 43 /8s, 49 /16s and 41 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-213403 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 105579 Total LACNIC prefixes after maximum aggregation: 24490 LACNIC Deaggregation factor: 4.31 Prefixes being announced from the LACNIC address blocks: 106900 Unique aggregates announced from the LACNIC address blocks: 46248 LACNIC Region origin ASes present in the Internet Routing Table: 9686 LACNIC Prefixes per ASN: 11.04 LACNIC Region origin ASes announcing only one prefix: 2399 LACNIC Region transit ASes present in the Internet Routing Table: 1837 Average LACNIC Region AS path length visible: 5.5 Max LACNIC Region AS path length visible: 38 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 7264 Number of LACNIC addresses announced to Internet: 174542592 Equivalent to 10 /8s, 103 /16s and 79 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-270748 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 22179 Total AfriNIC prefixes after maximum aggregation: 4713 AfriNIC Deaggregation factor: 4.71 Prefixes being announced from the AfriNIC address blocks: 33924 Unique aggregates announced from the AfriNIC address blocks: 10107 AfriNIC Region origin ASes present in the Internet Routing Table: 1379 AfriNIC Prefixes per ASN: 24.60 AfriNIC Region origin ASes announcing only one prefix: 482 AfriNIC Region transit ASes present in the Internet Routing Table: 273 Average AfriNIC Region AS path length visible: 5.1 Max AfriNIC Region AS path length visible: 23 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 671 Number of AfriNIC addresses announced to Internet: 108475648 Equivalent to 6 /8s, 119 /16s and 53 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7545 5388 681 629 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4335 4192 73 ERX-CERNET-BKB China Education and Rese 7552 3390 1330 22 VIETEL-AS-AP Viettel Group, VN 45899 3146 1802 105 VNPT-AS-VN VNPT Corp, VN 7713 2706 831 503 TELKOMNET-AS-AP PT Telekomunikasi Indon 9808 2569 9043 61 CMNET-GD Guangdong Mobile Communication 4766 2289 11102 560 KIXS-AS-KR Korea Telecom, KR 9498 2258 434 221 BBIL-AP BHARTI Airtel Ltd., IN 4755 2134 441 192 TATACOMM-AS TATA Communications formerl 9394 2035 4898 24 CTTNET China TieTong Telecommunications Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 11492 4095 273 633 CABLEONE, US 7155 4034 280 28 VIASAT-SP-BACKBONE, US 16509 3959 7856 1747 AMAZON-02, US 22773 3532 2969 152 ASN-CXA-ALL-CCI-22773-RDC, US 6327 3364 1324 92 SHAW, CA 16625 3032 1582 2163 AKAMAI-AS, US 209 2386 5077 537 CENTURYLINK-US-LEGACY-QWEST, US 30036 2353 361 92 MEDIACOM-ENTERPRISE-BUSINESS, US 5650 2300 2981 1621 FRONTIER-FRTR, US 26484 2195 137 171 IKGUL-26484, US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 5830 1603 132 UNI2-AS, ES 31334 4836 484 13 KABELDEUTSCHLAND-AS, DE 39891 3651 203 20 ALJAWWALSTC-AS, SA 8551 3179 379 45 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 20940 2967 467 2032 AKAMAI-ASN1, US 12389 2494 2250 726 ROSTELECOM-AS, RU 9009 2151 226 1163 M247, GB 34984 2055 350 563 TELLCOM-AS, TR 9121 1871 1691 18 TTNET, TR 13188 1606 100 36 TRIOLAN, UA Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 6381 3307 603 Uninet S.A. de C.V., MX 10620 3358 530 515 Telmex Colombia S.A., CO 11830 2671 369 63 Instituto Costarricense de Electricidad 6503 1677 327 387 Axtel, S.A.B. de C.V., MX 7303 1554 1032 259 Telecom Argentina S.A., AR 28573 1368 2242 204 CLARO S.A., BR 13999 1278 479 327 Mega Cable, S.A. de C.V., MX 6147 1139 379 39 Telefonica del Peru S.A.A., PE 3816 1096 564 146 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 11172 956 112 71 Alestra, S. de R.L. de C.V., MX Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1382 393 20 LINKdotNET-AS, EG 36992 1079 1537 74 ETISALAT-MISR, EG 24835 1070 574 25 RAYA-AS, EG 36903 890 467 88 MT-MPLS, MA 29571 592 68 12 ORANGE-COTE-IVOIRE, CI 6713 587 1863 34 IAM-AS, MA 37342 480 32 1 MOVITEL, MZ 36935 387 521 47 Vodafone-, EG 23889 382 231 15 MauritiusTelecom, MU 15399 338 45 10 WANANCHI-, KE Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 6381 3307 603 Uninet S.A. de C.V., MX 12479 5830 1603 132 UNI2-AS, ES 7545 5388 681 629 TPG-INTERNET-AP TPG Telecom Limited, AU 31334 4836 484 13 KABELDEUTSCHLAND-AS, DE 4538 4335 4192 73 ERX-CERNET-BKB China Education and Rese 11492 4095 273 633 CABLEONE, US 7155 4034 280 28 VIASAT-SP-BACKBONE, US 16509 3959 7856 1747 AMAZON-02, US 39891 3651 203 20 ALJAWWALSTC-AS, SA 22773 3532 2969 152 ASN-CXA-ALL-CCI-22773-RDC, US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 12479 5830 5698 UNI2-AS, ES 31334 4836 4823 KABELDEUTSCHLAND-AS, DE 7545 5388 4759 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4335 4262 ERX-CERNET-BKB China Education and Research Net 7155 4034 4006 VIASAT-SP-BACKBONE, US 39891 3651 3631 ALJAWWALSTC-AS, SA 11492 4095 3462 CABLEONE, US 22773 3532 3380 ASN-CXA-ALL-CCI-22773-RDC, US 7552 3390 3368 VIETEL-AS-AP Viettel Group, VN 6327 3364 3272 SHAW, CA Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 62828 UNALLOCATED 8.21.130.0/24 3356 LEVEL3, US 393266 UNALLOCATED 8.23.52.0/24 174 COGENT-174, US 62485 UNALLOCATED 8.23.229.0/24 3356 LEVEL3, US 32985 UNALLOCATED 8.28.31.0/24 3356 LEVEL3, US 394936 UNALLOCATED 8.33.224.0/24 174 COGENT-174, US 14109 UNALLOCATED 8.38.252.0/24 3356 LEVEL3, US 23061 UNALLOCATED 8.39.119.0/24 3356 LEVEL3, US 26584 UNALLOCATED 8.42.62.0/23 209 CENTURYLINK-US-LEGACY-QWEST, 395438 UNALLOCATED 8.42.206.0/24 3356 LEVEL3, US 40544 UNALLOCATED 12.0.33.0/24 6461 ZAYO-6461, US Complete listing at http://thyme.rand.apnic.net/current/data-badAS Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at http://thyme.rand.apnic.net/current/data-dsua Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.137.192.0/24 Origin: 31798 CANAD-86-31798, CA Transit: 174 COGENT-174, US 27.100.7.0/24 Origin: 56096 UNASSIGNED Transit: 45455 TH-2S1N-AP Two S One N Co Ltd, Internet 27.126.156.0/22 Origin: 55827 UNASSIGNED Transit: 9930 TTNET-MY TIME dotCom Berhad, MY 27.126.156.0/23 Origin: 55827 UNASSIGNED Transit: 9930 TTNET-MY TIME dotCom Berhad, MY 27.126.158.0/23 Origin: 55827 UNASSIGNED Transit: 9930 TTNET-MY TIME dotCom Berhad, MY Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:10 /9:11 /10:38 /11:98 /12:285 /13:579 /14:1165 /15:1912 /16:13358 /17:8163 /18:13874 /19:25751 /20:40365 /21:47945 /22:99620 /23:82117 /24:468908 /25:1285 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 4827 5830 UNI2-AS, ES 31334 4681 4836 KABELDEUTSCHLAND-AS, DE 11492 3215 4095 CABLEONE, US 6327 3152 3364 SHAW, CA 7155 3125 4034 VIASAT-SP-BACKBONE, US 39891 2801 3651 ALJAWWALSTC-AS, SA 22773 2750 3532 ASN-CXA-ALL-CCI-22773-RDC, US 8551 2638 3179 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 8151 2180 6381 Uninet S.A. de C.V., MX 30036 2100 2353 MEDIACOM-ENTERPRISE-BUSINESS, US Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1584 2:1138 3:30 4:19 5:3320 6:51 8:1400 9:1 11:1 12:1797 13:499 14:2276 15:75 16:9 17:299 18:81 20:83 23:3484 24:2296 25:2 27:2554 31:3102 32:106 34:3 35:39 36:925 37:3298 38:1940 39:319 40:123 41:3570 42:687 43:2109 44:196 45:14023 46:3711 47:284 49:1426 50:1240 51:93 52:1121 54:270 55:673 56:6 57:52 58:1898 59:1175 60:718 61:2227 62:2267 63:1943 64:5078 65:2299 66:4892 67:2859 68:1228 69:3844 70:1431 71:678 72:2824 74:2610 75:1433 76:682 77:2794 78:1868 79:2350 80:1899 81:1576 82:1271 83:1175 84:1205 85:2482 86:547 87:1711 88:1108 89:2724 90:314 91:7918 92:1494 93:2453 94:2650 95:3974 96:1051 97:335 98:955 99:961 100:87 101:1117 102:881 103:23445 104:3415 105:377 106:828 107:1968 108:699 109:3735 110:1808 111:2041 112:1599 113:1406 114:1548 115:1870 116:1792 117:2089 118:2161 119:1738 120:844 121:1042 122:2428 123:1991 124:1552 125:2021 128:1349 129:934 130:629 131:1857 132:756 133:300 134:1269 135:278 136:609 137:852 138:2174 139:989 140:635 141:931 142:905 143:1220 144:978 145:328 146:1481 147:1031 148:2133 149:1175 150:815 151:1283 152:1489 153:378 154:4733 155:1036 156:3403 157:1102 158:824 159:1940 160:1916 161:1021 162:3043 163:846 164:1464 165:1271 166:537 167:1628 168:3697 169:519 170:4270 171:764 172:1920 173:2439 174:1014 175:1014 176:2631 177:4236 178:3054 179:1463 180:2176 181:2525 182:3082 183:1132 184:2403 185:16344 186:3766 187:2674 188:4066 189:2228 190:8630 191:1452 192:10326 193:7443 194:6100 195:4365 196:3534 197:1875 198:6092 199:5952 200:7198 201:5197 202:10530 203:10159 204:4514 205:3090 206:3255 207:3286 208:4044 209:4423 210:4004 211:1989 212:3309 213:3047 214:1164 215:60 216:5941 217:2389 218:877 219:606 220:2029 221:897 222:981 223:1493 End of report

1 0