October 2022 - NANOG - lists.nanog.org

ARIN RPA updated (again) to address TAL distribution (Re: ARIN RPKI services terms/conditions - Change to Management of the Trust Anchor Locator for ARIN’s RPKI Service)
by Christopher S. Yoo 02 Nov '22

02 Nov '22

As the coauthors of the 2019 NSF-supported report that contributed to the current momentum toward overcoming the barriers RPKI adoption, a prior posting asked for our assessment of the changes. Our apologies that we won't be able to join you at this NANOG. We hope to put together some type of program in Atlanta in February. We would say that intent of ARIN's Sept. 26 and 29 updates ((link<https://www.arin.net/announcements/2022/documents/rpa_092622_redline.pdf> and link<https://www.arin.net/announcements/2022/documents/rpa_092922_redline.pdf>) to the RPA-to permit distribution of the TAL without signing the RPA-represent positive steps to address the most significant concern that we raised. In particular, the language in Section 5 added by the Sept. 29 update explicitly stating, "Notwithstanding the foregoing, You are specifically allowed to publicly distribute the ARIN TAL, including by embedding the ARIN TAL in relying party software," appears to authorize including ARIN's TAL in all distributions of validator software, and RPKI adopters would no longer need to download ARIN's TAL from its website. If effective, this is would remove the single most important legal obstacle to broader use of RPKI. The continuing wrinkle is that Section 5 authorizes distribution of ORCP services (including the ARIN TAL) only as permitted by the ORCP service terms. Section 9 requires third parties receiving this information either to have agreed to the RPA or to have entered into an agreement with the distributing party that includes the key terms of the RPA. That would suggest that anyone distributing validator software with ARIN's TAL must ensure that the recipient has agreed to the RPA in order to avoid violating the ORCP service terms. Although open source typically relies on licenses that are good against all users regardless of knowledge or assent (because they sound in property instead of contract), assent to the terms of the RPA could be incorporated into the distribution process, perhaps in the same manner used for other certificate authorities, which typically have terms of use. Another comment on this thread asked if ARIN has now addressed the other issues raised by our report. It is our assessment that ARIN has adequately addressed three of our other concerns, has announced its intention to address two others, and partially addressed one. The three issues that ARIN has adequately addressed include: * Dropping provision of the RSA requiring legacy address holders to acknowledge ARIN's property rights in IP addresses: dropped in update to LRSA dated Sept. 12, 2022 (link<https://www.arin.net/about/corporate/agreements/rsav13_changes.pdf>). * Drop provision of RPA prohibiting sharing of RPKI-derived data in a machine-readable format: authorized for informational purposes by update to RPA dated Oct. 21, 2019 (link<https://www.arin.net/vault/announcements/2019/20191021.html>); authorized for routing purposes by update to RPA dated Sept. 26, 2022 (link<https://www.arin.net/announcements/2022/documents/rpa_092622_redline.pdf>). * Better dissemination of best practices to the community: addressed by expansion of RPKI training at FISPA, WISPA, CaribNOG, and NANOG. ARIN has its intention to address two of our other concerns in the near future: * Better disclosure to government agencies of ARIN's willingness to waive insemination and choice of law clauses when barred by law: likely to be addressed by ARIN's announced plans to create webpage specifically for governments. * Better disclosure of operational practices, such as uptime, update frequency, and response expectations: likely to be addressed further by planned update to certificate practices statement. It partially addressed one concern that we raised. * Dropping blanket indemnification clause in favor of disclaimer of warranties and liability: revised RPA to exclude indemnification for ARIN's gross negligence by update to RPA dated Oct. 21, 2019 (link<https://www.arin.net/vault/announcements/2019/20191021.html>). We hope these comments are helpful and look forward to continuing to work with the community on removing the remaining legal barriers to RPKI adoption. Christopher Yoo (on behalf of myself and David Wishnick)

2 2

itojun
by Randy Bush 28 Oct '22

28 Oct '22

and the third giant to have died in october, itojun hagino died on this day in 2007. ipv6 owes a great debt to itojun; as do a bunch of other technoogies and many people. a wise and gentle soul. i dread october. randy http://www.itojun.org/itojun.html http://www.itojun.org/personal.html https://asiajin.com/blog/2007/10/jun-ichiro-itojun-hagino-dies-at-37-ipv6-d…

1 0

Weekly Global IPv4 Routing Table Report
by Routing Table Analysis Role Account 28 Oct '22

28 Oct '22

This is an automated weekly mailing describing the state of the Global IPv4 Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net. For historical data, please see https://thyme.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. IPv4 Routing Table Report 04:00 +10GMT Sat 29 Oct, 2022 BGP Table (Global) as seen in Japan. Report Website: https://thyme.apnic.net Detailed Analysis: https://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 913431 Prefixes after maximum aggregation (per Origin AS): 344677 Deaggregation factor: 2.65 Unique aggregates announced (without unneeded subnets): 440775 Total ASes present in the Internet Routing Table: 73756 Prefixes per ASN: 12.38 Origin-only ASes present in the Internet Routing Table: 63346 Origin ASes announcing only one prefix: 26009 Transit ASes present in the Internet Routing Table: 10410 Transit-only ASes present in the Internet Routing Table: 411 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 55 Max AS path prepend of ASN (265020) 50 Prefixes from unregistered ASNs in the Routing Table: 1068 Number of instances of unregistered ASNs: 1071 Number of 32-bit ASNs allocated by the RIRs: 40510 Number of 32-bit ASNs visible in the Routing Table: 33589 Prefixes from 32-bit ASNs in the Routing Table: 162188 Number of bogon 32-bit ASNs visible in the Routing Table: 14 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 527 Number of addresses announced to Internet: 3064049024 Equivalent to 182 /8s, 161 /16s and 173 /24s Percentage of available address space announced: 82.8 Percentage of allocated address space announced: 82.8 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.6 Total number of prefixes smaller than registry allocations: 310290 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 238504 Total APNIC prefixes after maximum aggregation: 67891 APNIC Deaggregation factor: 3.51 Prefixes being announced from the APNIC address blocks: 233487 Unique aggregates announced from the APNIC address blocks: 96685 APNIC Region origin ASes present in the Internet Routing Table: 13050 APNIC Prefixes per ASN: 17.89 APNIC Region origin ASes announcing only one prefix: 3749 APNIC Region transit ASes present in the Internet Routing Table: 1763 Average APNIC Region AS path length visible: 4.6 Max APNIC Region AS path length visible: 33 Number of APNIC region 32-bit ASNs visible in the Routing Table: 8296 Number of APNIC addresses announced to Internet: 773644800 Equivalent to 46 /8s, 28 /16s and 226 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-151865 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 266822 Total ARIN prefixes after maximum aggregation: 121568 ARIN Deaggregation factor: 2.19 Prefixes being announced from the ARIN address blocks: 268075 Unique aggregates announced from the ARIN address blocks: 128894 ARIN Region origin ASes present in the Internet Routing Table: 19061 ARIN Prefixes per ASN: 14.06 ARIN Region origin ASes announcing only one prefix: 6959 ARIN Region transit ASes present in the Internet Routing Table: 1924 Average ARIN Region AS path length visible: 3.8 Max ARIN Region AS path length visible: 35 Number of ARIN region 32-bit ASNs visible in the Routing Table: 4661 Number of ARIN addresses announced to Internet: 1289996800 Equivalent to 76 /8s, 227 /16s and 202 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-401308 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 261940 Total RIPE prefixes after maximum aggregation: 120746 RIPE Deaggregation factor: 2.17 Prefixes being announced from the RIPE address blocks: 258812 Unique aggregates announced from the RIPE address blocks: 154488 RIPE Region origin ASes present in the Internet Routing Table: 28152 RIPE Prefixes per ASN: 9.19 RIPE Region origin ASes announcing only one prefix: 11998 RIPE Region transit ASes present in the Internet Routing Table: 3966 Average RIPE Region AS path length visible: 4.2 Max RIPE Region AS path length visible: 34 Number of RIPE region 32-bit ASNs visible in the Routing Table: 10864 Number of RIPE addresses announced to Internet: 716309888 Equivalent to 42 /8s, 178 /16s and 5 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-213403 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 116612 Total LACNIC prefixes after maximum aggregation: 28105 LACNIC Deaggregation factor: 4.15 Prefixes being announced from the LACNIC address blocks: 116120 Unique aggregates announced from the LACNIC address blocks: 48367 LACNIC Region origin ASes present in the Internet Routing Table: 10985 LACNIC Prefixes per ASN: 10.57 LACNIC Region origin ASes announcing only one prefix: 2707 LACNIC Region transit ASes present in the Internet Routing Table: 2246 Average LACNIC Region AS path length visible: 5.0 Max LACNIC Region AS path length visible: 55 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 8744 Number of LACNIC addresses announced to Internet: 175875840 Equivalent to 10 /8s, 123 /16s and 167 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-273820 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 28485 Total AfriNIC prefixes after maximum aggregation: 5578 AfriNIC Deaggregation factor: 5.11 Prefixes being announced from the AfriNIC address blocks: 36410 Unique aggregates announced from the AfriNIC address blocks: 11915 AfriNIC Region origin ASes present in the Internet Routing Table: 1698 AfriNIC Prefixes per ASN: 21.44 AfriNIC Region origin ASes announcing only one prefix: 596 AfriNIC Region transit ASes present in the Internet Routing Table: 326 Average AfriNIC Region AS path length visible: 5.1 Max AfriNIC Region AS path length visible: 30 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 1024 Number of AfriNIC addresses announced to Internet: 107920128 Equivalent to 6 /8s, 110 /16s and 187 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 9074 8884 50 CHINAMOBILE-CN China Mobile Communicati 7545 5937 786 695 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4726 4192 75 ERX-CERNET-BKB China Education and Rese 7552 3614 1330 20 VIETEL-AS-AP Viettel Group, VN 7713 3500 1042 61 TELKOMNET-AS-AP PT Telekomunikasi Indon 45899 3390 1877 66 VNPT-AS-VN VNPT Corp, VN 4766 2533 11252 600 KIXS-AS-KR Korea Telecom, KR 9498 2491 499 237 BBIL-AP BHARTI Airtel Ltd., IN 24560 2243 851 409 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd 45090 2179 1438 79 TENCENT-NET-AP Shenzhen Tencent Compute Complete listing at https://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 7449 10588 2892 AMAZON-02, US 11492 4631 306 502 CABLEONE, US 7155 3898 265 32 VIASAT-SP-BACKBONE, US 22773 3733 3057 322 ASN-CXA-ALL-CCI-22773-RDC, US 16625 3533 1843 2542 AKAMAI-AS, US 6327 3516 1320 63 SHAW, CA 749 3029 50727 2287 DNIC-AS-00749, US 7018 2612 24153 1578 ATT-INTERNET4, US 30036 2606 372 243 MEDIACOM-ENTERPRISE-BUSINESS, US 396982 2558 3480 349 GOOGLE-CLOUD-PLATFORM, US Complete listing at https://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 6919 1730 144 UNI2-AS, ES 9121 6835 1692 17 TTNET, TR 20940 4108 3400 182 AKAMAI-ASN1, NL 39891 4010 234 47 ALJAWWALSTC-AS, SA 8551 3980 374 38 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 12389 2950 2290 913 ROSTELECOM-AS, RU 9009 2625 252 1348 M247, RO 6849 2439 339 20 UKRTELNET, UA 34984 2240 357 614 TELLCOM-AS, TR 47331 2077 322 1580 TTNET, TR Complete listing at https://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 10856 3298 605 Uninet S.A. de C.V., MX 10620 3471 510 838 Telmex Colombia S.A., CO 11830 2295 369 64 Instituto Costarricense de Electricidad 13999 2091 341 548 Mega Cable, S.A. de C.V., MX 28573 1334 2328 263 Claro NXT Telecomunicacoes Ltda, BR 6503 1295 338 521 Axtel, S.A.B. de C.V., MX 3816 1285 722 152 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 11664 1090 181 467 Techtel LMDS Comunicaciones Interactiva 6147 1087 369 22 Telefonica del Peru S.A.A., PE 26615 989 2466 43 TIM SA, BR Complete listing at https://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1575 393 21 LINKdotNET-AS, EG 24835 1545 521 31 RAYA-AS, EG 36992 1350 1519 270 ETISALAT-MISR, EG 36903 1248 550 99 MT-MPLS, MA 29571 992 68 32 ORANGE-COTE-IVOIRE, CI 36935 815 520 42 Vodafone-, EG 6713 612 1863 34 IAM-AS, MA 15399 526 53 42 WANANCHI-, KE 37342 495 32 1 MOVITEL, MZ 23889 400 231 14 MauritiusTelecom, MU Complete listing at https://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 10856 3298 605 Uninet S.A. de C.V., MX 9808 9074 8884 50 CHINAMOBILE-CN China Mobile Communicati 16509 7449 10588 2892 AMAZON-02, US 12479 6919 1730 144 UNI2-AS, ES 9121 6835 1692 17 TTNET, TR 7545 5937 786 695 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4726 4192 75 ERX-CERNET-BKB China Education and Rese 11492 4631 306 502 CABLEONE, US 20940 4108 3400 182 AKAMAI-ASN1, NL 39891 4010 234 47 ALJAWWALSTC-AS, SA Complete listing at https://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 9808 9074 9024 CHINAMOBILE-CN China Mobile Communications Grou 9121 6835 6818 TTNET, TR 12479 6919 6775 UNI2-AS, ES 7545 5937 5242 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4726 4651 ERX-CERNET-BKB China Education and Research Net 16509 7449 4557 AMAZON-02, US 11492 4631 4129 CABLEONE, US 39891 4010 3963 ALJAWWALSTC-AS, SA 8551 3980 3942 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 20940 4108 3926 AKAMAI-ASN1, NL Complete listing at https://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 398083 UNALLOCATED 5.133.124.0/24 399587 UT, US 33123 UNALLOCATED 8.10.69.0/24 11168 SCC, US 16641 UNALLOCATED 8.10.194.0/24 3356 LEVEL3, US 16641 UNALLOCATED 8.10.210.0/24 3356 LEVEL3, US 25674 UNALLOCATED 8.12.76.0/24 3356 LEVEL3, US 16641 UNALLOCATED 8.12.250.0/24 3356 LEVEL3, US 25674 UNALLOCATED 8.14.115.0/24 3356 LEVEL3, US 12169 UNALLOCATED 8.15.207.0/24 32787 PROLEXIC-TECHNOLOGIES-DDOS-M 25674 UNALLOCATED 8.19.146.0/24 3356 LEVEL3, US 53775 UNALLOCATED 8.20.88.0/24 7029 WINDSTREAM, US Complete listing at https://thyme.apnic.net/current/data-badAS Prefixes from the Special Purpose Address Registry (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at https://thyme.apnic.net/current/data-spar Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.136.112.0/24 Origin: 54835 UNASSIGNED 23.136.112.0/24 Transit: 21559 OSNET, PR 23.141.0.0/24 Origin: 395350 UNASSIGNED 23.141.0.0/24 Transit: 11426 TWC-11426-CAROLINAS, US 23.158.240.0/24 Origin: 13465 UNASSIGNED 23.158.240.0/24 Transit: 33185 HIVE-DATA-CENTER, CA 23.181.240.0/24 Origin: 399613 UNASSIGNED 23.181.240.0/24 Transit: 11992 CENTENNIAL-, PR 24.48.128.0/19 Origin: 29866 OPTICALTEL, US 24.48.128.0/19 Transit: 3257 GTT-BACKBONE GTT, US Complete listing at https://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:13 /10:39 /11:100 /12:294 /13:589 /14:1202 /15:2045 /16:13495 /17:8343 /18:13975 /19:25200 /20:44384 /21:52211 /22:109833 /23:97775 /24:543132 /25:785 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 9121 5981 6835 TTNET, TR 12479 5926 6919 UNI2-AS, ES 8151 4819 10856 Uninet S.A. de C.V., MX 11492 3537 4631 CABLEONE, US 8551 3444 3980 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 6327 3324 3516 SHAW, CA 39891 3193 4010 ALJAWWALSTC-AS, SA 7155 2988 3898 VIASAT-SP-BACKBONE, US 22773 2767 3733 ASN-CXA-ALL-CCI-22773-RDC, US 6849 2302 2439 UKRTELNET, UA Complete listing at https://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1905 2:1015 3:167 4:5 5:3998 6:116 7:5 8:1598 9:1 11:173 12:1621 13:354 14:2341 15:277 16:69 17:359 18:346 20:241 21:4 22:188 23:5980 24:2466 25:6 27:2710 29:19 31:2453 32:94 34:7 35:92 36:1799 37:4498 38:3742 39:753 40:159 41:3908 42:1180 43:2300 44:297 45:16294 46:4208 47:375 49:1724 50:1931 51:244 52:1500 54:398 55:843 56:8 57:78 58:1790 59:1164 60:996 61:2404 62:2583 63:1968 64:5628 65:2328 66:4853 67:2980 68:1379 69:4157 70:1300 71:679 72:2971 74:2652 75:1473 76:600 77:2251 78:3964 79:3146 80:2041 81:1823 82:1521 83:1218 84:1438 85:3734 86:731 87:1918 88:2843 89:3423 90:549 91:7595 92:2068 93:2549 94:3546 95:4822 96:1353 97:346 98:1169 99:739 100:69 101:1068 102:2336 103:30323 104:4519 105:477 106:890 107:2539 108:905 109:4324 110:2003 111:3323 112:2050 113:1551 114:1520 115:2023 116:1922 117:2475 118:2321 119:1849 120:1731 121:1090 122:2565 123:2117 124:1553 125:2183 128:1262 129:986 130:975 131:2015 132:846 133:379 134:1889 135:290 136:876 137:900 138:2496 139:1515 140:1127 141:1467 142:1402 143:1402 144:1203 145:353 146:1872 147:1536 148:2260 149:1830 150:875 151:1135 152:1824 153:469 154:3821 155:1428 156:1638 157:1302 158:1045 159:2206 160:2562 161:1383 162:3503 163:1433 164:1684 165:1637 166:809 167:1718 168:3815 169:903 170:4536 171:851 172:3463 173:3109 174:1041 175:1155 176:3595 177:4760 178:3528 179:2121 180:2341 181:3319 182:3238 183:1942 184:2356 185:19846 186:4531 187:3951 188:4047 189:3473 190:8984 191:1432 192:10987 193:8755 194:7175 195:5089 196:2976 197:2473 198:6008 199:6067 200:7605 201:5818 202:10544 203:10038 204:4601 205:3497 206:3902 207:3420 208:4092 209:4800 210:4336 211:2437 212:4055 213:3577 214:1082 215:53 216:6486 217:2624 218:1292 219:576 220:2045 221:924 222:827 223:2014 End of report

1 0

AMS-IX @ 350 Cermak issue?
by Bryan Holloway 28 Oct '22

28 Oct '22

Anyone else having issues with AMS-IX at 350 Cermak? Our circuit has been bouncing on and off all day. I'd suspect our optics/port, except that when it's up, some BGP sessions come up, but not all. The ones that don't come up aren't pingable. Leads me to believe it's not us. E-mails to their NOC have gone unanswered. Thanks all ...

1 0

Equinix routeservers (MLPE) behavior c/f no_export
by Elmar K. Bins 28 Oct '22

28 Oct '22

Hi guys (and others), I couldn't find an official description/explanation of this (EQX docs only mention that this should behave the same as their "set the no_export" TE community. We are using Equinix' IXP platform's routeserver service (MLPE) in a few locations on the planet, and due to the nature of our anycast structure, we are sending our prefixes with the well-known NO_EXPORT community attached. It seems to me that, at least in some places (i.e. Warsaw, ex-PLIX), the routeservers will not forward the routes further, being intransparent to the NO_EXPORT setting. My assumption was transparency, so the prefixes would be forwarded unchanged, including the NO_EXPORT community attached. It would be nice to hear directly from Equinix, of course, but if anybody on this list has hard knowledge of this, please share, so that I can take the appropriate measures... Thanks in advance, Elmar.

2 2

Hotmail/Outlook/Microsoft Email Switches to IPv6, Causing Email Failures
by Peter Beckman 27 Oct '22

27 Oct '22

At Oct 24 21:06:13 UTC, after years of being IPv4-only, Microsoft Hotmail published two IPv6 records for the hotmail.com MX record. Great! Progress! Hurrah! Except that one hour later, Oct 24 22:00:57 UTC, our IPv6 address was blocked, after just 9 emails sent, as "spam." Prior to this date, as far back as our logs go, we have had ZERO issue with the almost 700,000 emails sent and accepted by Hotmail users since May 29, 2022. So I visited the trusty Smart Network Data Service and Junk Mail Reporting Program to try to troubleshoot. Except that these two services are still IPv4-only, so I cannot even attempt to try to self-troubleshoot why Microsoft is blocking email via IPv6. I have opened a support ticket, but I figured I would see if anyone here has seend or heard or had this issue, or if any Microsoft lurkers might see this and investigate. Support request number: SR1543766049 I have not been able to find any mention in Google or elsewhere of the planned switch to enable IPv6 for Hotmail, nor any updated way to register with Microsoft with IPv6 address space. Yes, we sign with DKIM and have up-to-date SPF records with both IPv4 and IPv6 addresses. Google seems to have no issue here. Thanks All Beckman --------------------------------------------------------------------------- Peter Beckman Internet Guy beckman(a)angryox.com https://www.angryox.com/ ---------------------------------------------------------------------------

1 1

any dangers of filtering every /24 on full internet table to preserve FIB space ?
by Edvinas Kairys 27 Oct '22

27 Oct '22

Hello, We're considering to buy some Cisco boxes - NCS-55A1-24H. That box has 24x100G, but only 2.2mln route (FIB) memory entries. In a near future it will be not enough - so we're thinking to deny all /24s to save the memory. What do you think about that approach - I know it could provide some misbehavior. But theoretically every filtered /24 could be routed via smaller prefix /23 /22 /21 or etc. But of course it could be a situation when denied /24 will not be covered by any smaller prefix. What do you think about this approach ? Also maybe you know - some advices for edge routers that have at least 8x100G interfaces and "good" memory for prefix count ? Thanks

32 52

Next-gen firewalls and URL / domain reputation and classification
by Devern Adams 26 Oct '22

26 Oct '22

Greetings and good day. What products/services are folks using on their networks for domain reputation or classification-based filtering? There are various vendors (Fortinet, Palo Alto, Talos/Cisco, McAfee, etc) who maintain their own databases for this purpose, and I'm working to make sure a recently acquired domain name is classified and evaluated correctly. I have been seeing reports from end users on a handful of different ISP networks being blocked or redirected to something like safebrowse.io due to this sort of reputation-based filter. Re-classifications have been submitted to a lot of the major vendors in this space, but I don't maintain an exhaustive list, and individual ISPs seem to have varying degrees of success responding to these requests. Any input on the subject, or anecdotes from anyone with operational experience is much appreciated. Thanks, Devern -- Devern Adams devernadams(a)gmail.com

2 1

Weekly Global IPv4 Routing Table Report
by Routing Table Analysis Role Account 21 Oct '22

21 Oct '22

This is an automated weekly mailing describing the state of the Global IPv4 Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net. For historical data, please see https://thyme.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. IPv4 Routing Table Report 04:00 +10GMT Sat 22 Oct, 2022 BGP Table (Global) as seen in Japan. Report Website: https://thyme.apnic.net Detailed Analysis: https://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 913066 Prefixes after maximum aggregation (per Origin AS): 344590 Deaggregation factor: 2.65 Unique aggregates announced (without unneeded subnets): 440326 Total ASes present in the Internet Routing Table: 73756 Prefixes per ASN: 12.38 Origin-only ASes present in the Internet Routing Table: 63346 Origin ASes announcing only one prefix: 25997 Transit ASes present in the Internet Routing Table: 10410 Transit-only ASes present in the Internet Routing Table: 406 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 55 Max AS path prepend of ASN (265020) 50 Prefixes from unregistered ASNs in the Routing Table: 1071 Number of instances of unregistered ASNs: 1074 Number of 32-bit ASNs allocated by the RIRs: 40454 Number of 32-bit ASNs visible in the Routing Table: 33551 Prefixes from 32-bit ASNs in the Routing Table: 161990 Number of bogon 32-bit ASNs visible in the Routing Table: 14 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 527 Number of addresses announced to Internet: 3064300672 Equivalent to 182 /8s, 165 /16s and 132 /24s Percentage of available address space announced: 82.8 Percentage of allocated address space announced: 82.8 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.6 Total number of prefixes smaller than registry allocations: 310145 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 238444 Total APNIC prefixes after maximum aggregation: 67879 APNIC Deaggregation factor: 3.51 Prefixes being announced from the APNIC address blocks: 233482 Unique aggregates announced from the APNIC address blocks: 96704 APNIC Region origin ASes present in the Internet Routing Table: 13033 APNIC Prefixes per ASN: 17.91 APNIC Region origin ASes announcing only one prefix: 3749 APNIC Region transit ASes present in the Internet Routing Table: 1754 Average APNIC Region AS path length visible: 4.6 Max APNIC Region AS path length visible: 27 Number of APNIC region 32-bit ASNs visible in the Routing Table: 8277 Number of APNIC addresses announced to Internet: 773734912 Equivalent to 46 /8s, 30 /16s and 66 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-151865 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 266668 Total ARIN prefixes after maximum aggregation: 121596 ARIN Deaggregation factor: 2.19 Prefixes being announced from the ARIN address blocks: 267868 Unique aggregates announced from the ARIN address blocks: 128736 ARIN Region origin ASes present in the Internet Routing Table: 19057 ARIN Prefixes per ASN: 14.06 ARIN Region origin ASes announcing only one prefix: 6949 ARIN Region transit ASes present in the Internet Routing Table: 1929 Average ARIN Region AS path length visible: 3.8 Max ARIN Region AS path length visible: 35 Number of ARIN region 32-bit ASNs visible in the Routing Table: 4649 Number of ARIN addresses announced to Internet: 1290070784 Equivalent to 76 /8s, 228 /16s and 235 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-401308 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 261853 Total RIPE prefixes after maximum aggregation: 120667 RIPE Deaggregation factor: 2.17 Prefixes being announced from the RIPE address blocks: 258723 Unique aggregates announced from the RIPE address blocks: 154172 RIPE Region origin ASes present in the Internet Routing Table: 28174 RIPE Prefixes per ASN: 9.18 RIPE Region origin ASes announcing only one prefix: 12012 RIPE Region transit ASes present in the Internet Routing Table: 3975 Average RIPE Region AS path length visible: 4.2 Max RIPE Region AS path length visible: 34 Number of RIPE region 32-bit ASNs visible in the Routing Table: 10855 Number of RIPE addresses announced to Internet: 716370304 Equivalent to 42 /8s, 178 /16s and 241 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-213403 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 116487 Total LACNIC prefixes after maximum aggregation: 28055 LACNIC Deaggregation factor: 4.15 Prefixes being announced from the LACNIC address blocks: 116038 Unique aggregates announced from the LACNIC address blocks: 48355 LACNIC Region origin ASes present in the Internet Routing Table: 10983 LACNIC Prefixes per ASN: 10.57 LACNIC Region origin ASes announcing only one prefix: 2685 LACNIC Region transit ASes present in the Internet Routing Table: 2246 Average LACNIC Region AS path length visible: 4.9 Max LACNIC Region AS path length visible: 55 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 8746 Number of LACNIC addresses announced to Internet: 175887616 Equivalent to 10 /8s, 123 /16s and 213 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-273820 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 28543 Total AfriNIC prefixes after maximum aggregation: 5600 AfriNIC Deaggregation factor: 5.10 Prefixes being announced from the AfriNIC address blocks: 36428 Unique aggregates announced from the AfriNIC address blocks: 11935 AfriNIC Region origin ASes present in the Internet Routing Table: 1699 AfriNIC Prefixes per ASN: 21.44 AfriNIC Region origin ASes announcing only one prefix: 602 AfriNIC Region transit ASes present in the Internet Routing Table: 325 Average AfriNIC Region AS path length visible: 5.0 Max AfriNIC Region AS path length visible: 31 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 1024 Number of AfriNIC addresses announced to Internet: 107936768 Equivalent to 6 /8s, 110 /16s and 252 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 9071 8884 50 CHINAMOBILE-CN China Mobile Communicati 7545 5928 786 694 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4726 4192 75 ERX-CERNET-BKB China Education and Rese 7552 3594 1330 20 VIETEL-AS-AP Viettel Group, VN 7713 3501 1042 61 TELKOMNET-AS-AP PT Telekomunikasi Indon 45899 3389 1877 66 VNPT-AS-VN VNPT Corp, VN 4766 2533 11252 600 KIXS-AS-KR Korea Telecom, KR 9498 2491 499 237 BBIL-AP BHARTI Airtel Ltd., IN 24560 2241 851 415 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd 45090 2179 1438 79 TENCENT-NET-AP Shenzhen Tencent Compute Complete listing at https://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 7419 10586 2886 AMAZON-02, US 11492 4612 305 508 CABLEONE, US 7155 3899 265 32 VIASAT-SP-BACKBONE, US 22773 3771 3065 348 ASN-CXA-ALL-CCI-22773-RDC, US 16625 3544 1851 2544 AKAMAI-AS, US 6327 3504 1320 63 SHAW, CA 749 3027 50696 2294 DNIC-AS-00749, US 7018 2639 24156 1591 ATT-INTERNET4, US 30036 2600 367 258 MEDIACOM-ENTERPRISE-BUSINESS, US 396982 2554 3479 346 GOOGLE-CLOUD-PLATFORM, US Complete listing at https://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 6909 1730 144 UNI2-AS, ES 9121 6834 1692 17 TTNET, TR 20940 4111 3400 182 AKAMAI-ASN1, NL 39891 4010 234 47 ALJAWWALSTC-AS, SA 8551 3982 374 38 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 12389 2946 2290 913 ROSTELECOM-AS, RU 9009 2623 252 1348 M247, RO 6849 2477 339 20 UKRTELNET, UA 34984 2243 357 616 TELLCOM-AS, TR 47331 2076 322 1579 TTNET, TR Complete listing at https://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 10744 3314 605 Uninet S.A. de C.V., MX 10620 3469 510 837 Telmex Colombia S.A., CO 11830 2301 369 64 Instituto Costarricense de Electricidad 13999 2075 338 538 Mega Cable, S.A. de C.V., MX 28573 1337 2330 260 Claro NXT Telecomunicacoes Ltda, BR 6503 1294 338 520 Axtel, S.A.B. de C.V., MX 3816 1285 722 152 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 6147 1089 369 22 Telefonica del Peru S.A.A., PE 11664 1089 181 466 Techtel LMDS Comunicaciones Interactiva 26615 986 2466 43 TIM SA, BR Complete listing at https://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1574 393 21 LINKdotNET-AS, EG 24835 1518 521 31 RAYA-AS, EG 36992 1350 1519 270 ETISALAT-MISR, EG 36903 1260 550 99 MT-MPLS, MA 29571 1014 68 32 ORANGE-COTE-IVOIRE, CI 36935 815 520 42 Vodafone-, EG 6713 612 1863 34 IAM-AS, MA 15399 526 53 42 WANANCHI-, KE 37342 486 32 1 MOVITEL, MZ 23889 400 231 14 MauritiusTelecom, MU Complete listing at https://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 10744 3314 605 Uninet S.A. de C.V., MX 9808 9071 8884 50 CHINAMOBILE-CN China Mobile Communicati 16509 7419 10586 2886 AMAZON-02, US 12479 6909 1730 144 UNI2-AS, ES 9121 6834 1692 17 TTNET, TR 7545 5928 786 694 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4726 4192 75 ERX-CERNET-BKB China Education and Rese 11492 4612 305 508 CABLEONE, US 20940 4111 3400 182 AKAMAI-ASN1, NL 39891 4010 234 47 ALJAWWALSTC-AS, SA Complete listing at https://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 9808 9071 9021 CHINAMOBILE-CN China Mobile Communications Grou 9121 6834 6817 TTNET, TR 12479 6909 6765 UNI2-AS, ES 7545 5928 5234 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4726 4651 ERX-CERNET-BKB China Education and Research Net 16509 7419 4533 AMAZON-02, US 11492 4612 4104 CABLEONE, US 39891 4010 3963 ALJAWWALSTC-AS, SA 8551 3982 3944 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 20940 4111 3929 AKAMAI-ASN1, NL Complete listing at https://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 398083 UNALLOCATED 5.133.124.0/24 399587 UT, US 33123 UNALLOCATED 8.10.69.0/24 11168 SCC, US 16641 UNALLOCATED 8.10.194.0/24 3356 LEVEL3, US 16641 UNALLOCATED 8.10.210.0/24 3356 LEVEL3, US 25674 UNALLOCATED 8.12.76.0/24 3356 LEVEL3, US 16641 UNALLOCATED 8.12.250.0/24 3356 LEVEL3, US 25674 UNALLOCATED 8.14.115.0/24 3356 LEVEL3, US 25674 UNALLOCATED 8.19.146.0/24 3356 LEVEL3, US 53775 UNALLOCATED 8.20.88.0/24 7029 WINDSTREAM, US 62828 UNALLOCATED 8.21.130.0/24 3356 LEVEL3, US Complete listing at https://thyme.apnic.net/current/data-badAS Prefixes from the Special Purpose Address Registry (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at https://thyme.apnic.net/current/data-spar Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.136.112.0/24 Origin: 54835 UNASSIGNED 23.136.112.0/24 Transit: 21559 OSNET, PR 23.141.0.0/24 Origin: 395350 UNASSIGNED 23.141.0.0/24 Transit: 11426 TWC-11426-CAROLINAS, US 23.158.240.0/24 Origin: 13465 UNASSIGNED 23.158.240.0/24 Transit: 33185 HIVE-DATA-CENTER, CA 23.181.240.0/24 Origin: 399613 UNASSIGNED 23.181.240.0/24 Transit: 11992 CENTENNIAL-, PR 24.48.128.0/19 Origin: 29866 OPTICALTEL, US 24.48.128.0/19 Transit: 3257 GTT-BACKBONE GTT, US Complete listing at https://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:13 /10:39 /11:100 /12:294 /13:589 /14:1202 /15:2046 /16:13513 /17:8343 /18:13980 /19:25194 /20:44406 /21:52220 /22:109690 /23:97714 /24:542921 /25:786 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 9121 5980 6834 TTNET, TR 12479 5918 6909 UNI2-AS, ES 8151 4740 10744 Uninet S.A. de C.V., MX 11492 3519 4612 CABLEONE, US 8551 3446 3982 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 6327 3312 3504 SHAW, CA 39891 3193 4010 ALJAWWALSTC-AS, SA 7155 2988 3899 VIASAT-SP-BACKBONE, US 22773 2782 3771 ASN-CXA-ALL-CCI-22773-RDC, US 6849 2340 2477 UKRTELNET, UA Complete listing at https://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1908 2:1029 3:166 4:5 5:3945 6:116 7:5 8:1591 9:1 11:173 12:1623 13:347 14:2375 15:275 16:69 17:360 18:343 20:241 21:4 22:188 23:5967 24:2473 25:6 27:2713 29:19 31:2452 32:94 34:7 35:90 36:1867 37:4484 38:3650 39:753 40:159 41:3969 42:1181 43:2298 44:296 45:16261 46:4225 47:375 49:1719 50:1930 51:242 52:1500 54:394 55:838 56:8 57:78 58:1791 59:1164 60:994 61:2386 62:2542 63:1968 64:5628 65:2327 66:4845 67:2967 68:1377 69:4164 70:1303 71:678 72:2998 74:2652 75:1474 76:599 77:2249 78:3959 79:3156 80:2051 81:1826 82:1527 83:1220 84:1424 85:3744 86:738 87:1914 88:2841 89:3438 90:545 91:7599 92:2078 93:2548 94:3541 95:4799 96:1345 97:348 98:1171 99:739 100:68 101:1064 102:2318 103:30334 104:4544 105:477 106:890 107:2543 108:900 109:4333 110:2019 111:3323 112:2066 113:1551 114:1525 115:2019 116:1922 117:2482 118:2323 119:1853 120:1738 121:1089 122:2555 123:2116 124:1553 125:2188 128:1244 129:981 130:972 131:2007 132:834 133:379 134:1906 135:290 136:869 137:889 138:2528 139:1522 140:1137 141:1475 142:1399 143:1418 144:1204 145:349 146:1879 147:1535 148:2253 149:1830 150:875 151:1120 152:1823 153:469 154:3795 155:1426 156:1638 157:1303 158:1046 159:2185 160:2571 161:1373 162:3502 163:1436 164:1678 165:1635 166:812 167:1717 168:3825 169:893 170:4545 171:852 172:3457 173:3104 174:1034 175:1147 176:3593 177:4746 178:3558 179:2107 180:2340 181:3283 182:3234 183:1939 184:2355 185:19837 186:4533 187:3956 188:4041 189:3450 190:8996 191:1453 192:10982 193:8737 194:7160 195:5062 196:2984 197:2461 198:6005 199:6064 200:7616 201:5833 202:10554 203:10061 204:4562 205:3477 206:3883 207:3444 208:4095 209:4789 210:4338 211:2435 212:4046 213:3561 214:1099 215:53 216:6477 217:2624 218:1294 219:571 220:2046 221:924 222:826 223:2014 End of report

1 0

Detecting, mitigating, and preventing distributed large-scale prefix de-aggregation attacks
by Lars Prehn 20 Oct '22

20 Oct '22

Dear NANOG, Our apologies to those who received this message via multiple channels. My colleagues and I recently revisited the topic of prefix de-aggregation attacks. We believe that the current IPv6 allocation policies combined with the ever-growing number of interconnection opportunities may facilitate those attacks to the point where they may circumvent traditional prevention mechanisms. Hence, we'd like to raise awareness on how to detect, mitigate, and prevent these kinds of attacks. # Prefix De-aggregation Attacks While allocation policies in IPv4 are very tight, even a new LIR can obtain, e.g., a /29 IPv6 address block from RIPE without justification [1]. This /29 may source more than a million unique IPv6 prefixes when using all CIDR sizes between /29 and /48 (the largest CIDR size that is not filtered). To prevent this many prefixes from flooding the DFZ, many ASes set a maximum prefix limit on their eBGP sessions. When initially introduced, these max-prefix limits prevented prefix de-aggregation attacks. In today's hyper-connected world, prefix limits transform these attacks into session-hunting challenges. To better illustrate this relationship, consider the following example: If an adversary combines two remote-peering offerings of BSO's IXReach [2] and Epsilon's Infinity Platform [3], they can establish ports at more than a hundred peering LANs. If this adversary uses Hurricane Electric as their IPv6 transit provider and establish a BGP session at every in-common peering LAN [4], this will lead to 100+ sessions. With a per-session limit of e.g. 500 prefixes, the adversary could redistribute 50K unique prefixes via this setup alone. If an adversary further increases the number of remote peering providers, adds announcements from BGP-enabled VPS services (e.g., Vultr [5] among many others [6]), and contracts additional IPv6 transit providers, they may globally increase the current IPv6 routing table size manifold. Notably, each of these new routes would have a valid ROV status once the adversary adds a single ROA entry for a /29 with a max CIDR size of /48; hence, they would pass the redistribution requirements for various transit providers. While many current router models support multiple million IPv6 routes, especially older models may crash, drop sessions, or behave in other unintended ways when either their FIB or RIB runs out of memory. When the adversary also withdraws all routes simultaneously, the number of updates generated from BGP's path-hunting may further lead to very high load for extended periods of time. To put this into perspective: Some of you might have noticed increased CPU load alongside other effects when Vultr was de-aggregating 12k IPv6 prefixes on October 5th [7]. Using the different methods described above, an highly-motivated adversary might be able to produce 1-2 orders of magnitude more updates. Please note that we performed various smaller (<600 prefixes) de-aggregation tests as part of our research---see sections 6 and 8 in the document referenced at the end of this notification for detailed explanations. While our experimental setup was very similar to the October 5th incident (we also announced address space obtained from SecureBit via VMs within Vultr), we are in no way related to that incident neither did we share any information about our research or findings with individuals outside our research group prior to the start of our private disclosure phase on October 11th. # Detection, Mitigation, and Prevention Mechanisms. Luckily, prefix de-aggregation attacks are easily detectable (e.g., based on prefix-limit notification thresholds or direct routing table size monitoring) and can be mitigated quickly by filtering either the more specifics of the covering prefix or all prefixes announced by the adversary's ASN(s). Effectively, damage can only be done within the human reaction time---which we hope to shorten with this notification. To protect yourself from prefix de-aggregation attacks, you may establish dynamic yet tight per-session limits on all eBGP sessions. As an adversary could enter unreasonably large values into databases such as PeeringDB, we'd recommend to not solely rely on them but also accept at most 1.5-2x the number of yesterday's prefixes for peers and customers and 1.2x yesterday's routing table size for transit providers (which would currently reflect a headroom of ~32k prefixes with a yearly growth rate of <50k prefixes [8]). We'd also recommend ensuring that the summed prefix limits across all sessions do not drastically exceed the router's maximal FIB size. To protect others, you may: (i) ensure that you only redistribute a certain number of routes per origin; currently, AS 9808 announces the most (~4K) IPv6 prefixes. (ii) ensure that you only redistribute a certain number of more-specific routes for each assigned address block; currently, 2409:8000::/20 is the prefix with the most (~10K) more-specifics. If you want to know more about the research that initiated this notification (including our concluded private disclosure process), you may find a write-up at: https://arxiv.org/pdf/2210.10676.pdf Best regards, Lars [1] https://www.ripe.net/publications/docs/ripe-738#initial_size [2] https://www.ixreach.com/services/remote-peering/ [3] https://epsilontel.com/global-network-footprint/internet-exchanges/ [4] https://he.net/peering.html [5] https://www.vultr.com/features/advanced-networking/ [6] https://docs.google.com/spreadsheets/d/1abmV_mXWWCsVxHLfouSivyS7ch-PcUww8S6… <https://docs.google.com/spreadsheets/d/1abmV_mXWWCsVxHLfouSivyS7ch-PcUww8S6…> [7] https://twitter.com/Qrator_Radar/status/1577748939805278209 [8] https://bgp.potaroo.net/v6/as2.0/index.html

2 1