November 2023 - NANOG - lists.nanog.org

BGP-iSec: Improved Security of Internet Routing Against Post-ROV Attacks
by Amir Herzberg 21 Nov '23

21 Nov '23

Hi NANOGers, We will present our new work, titled: `BGP-iSec: Improved Security of Internet Routing Against Post-ROV Attacks', in NDSS'24. If you're interested in security of Internet routing (BGP), and want a copy, see URL below, drop me a message/email - or see us in the conference - or just read the final version. Available from: https://www.researchgate.net/publication/375553362_BGP-iSec_Improved_Securi… -- Amir Herzberg Comcast professor of Security Innovations, Computer Science and Engineering, University of Connecticut Homepage: https://sites.google.com/site/amirherzberg/home `Applied Introduction to Cryptography' textbook and lectures: https://sites.google.com/site/amirherzberg/cybersecurity

4 6

Help with Frontier circuits AS5650
by Dennis Burgess 20 Nov '23

20 Nov '23

I have two frontier circuits that are not working correctly with BGP, prefixes that are announced are not showing in the global table etc. Any frontier people can tell me where I can call to find someone that can assist. End users are currently down ☹ been calling numbers for the past hour, no one is picking up. [LTI-Full_175px] Dennis Burgess Mikrotik : Trainer, Network Associate, Routing Engineer, Wireless Engineer, Traffic Control Engineer, Inter-Networking Engineer, Security Engineer, Enterprise Wireless Engineer Hurricane Electric: IPv6 Sage Level Cambium: ePMP Author of "Learn RouterOS- Second Edition” Link Technologies, Inc -- Mikrotik & WISP Support Services Office: 314-735-0270 Website: http://www.linktechs.net<http://www.linktechs.net/> Create your own Tickets via https://hd.linktechs.net Create Wireless Coverage’s with www.towercoverage.com Need MikroTik Cloud Management: https://cloud.linktechs.net<https://cloud.linktechs.net/> Remote Winbox Service: http://rwb.linktechs.net

3 2

ipv6 address management - documentation
by Aaron Gould 20 Nov '23

20 Nov '23

For years I've used an MS Excel spreadsheet to manage my IPv4 addresses. IPv6 is going to be maddening to manage in a spreadsheet. What does everyone use for their IPv6 address prefix management and documentation? Are there open source tools/apps for this? -- -Aaron

17 16

CBS / Paramount+ geoloctaion contact
by George Toma 20 Nov '23

20 Nov '23

We are getting Unauthorized location response headers from Irtdeto on Paramount Plus content when accessed from some of our subnets (several subnets within a particular /21). {"code":130301,"message":"Content is not available in this location."} Other subnets (different /22s) of ours work fine. Irdeto says the geolocation acceptance is done by the customer, in this case Paramount Plus / CBS. Does anybody have a contact at CBS/Paramount+ with whom I could escalate these issues? Thank you. George Toma VISNETWORK SRL

1 0

Call for Participation -- ICANN DNSSEC and Security Workshop for ICANN79 Community Forum
by Jacques Latour 20 Nov '23

20 Nov '23

Call for Participation – ICANN DNSSEC and Security Workshop for ICANN79 Community Forum In cooperation with the ICANN Security and Stability Advisory Committee (SSAC), we are planning a DNSSEC and Security Workshop for the ICANN79 Community Forum being held as a hybrid meeting from 02-07 March 2024 San Juan, Puerto Rico in the Atlantic Standard Time - AST (UTC-4). This workshop date will be determined once ICANN creates a block schedule for us to follow; then we will be able to request a day and time. The DNSSEC and Security Workshop has been a part of ICANN meetings for several years and has provided a forum for both experienced and new people to meet, present and discuss current and future DNSSEC deployments. For reference, the most recent session was held at the ICANN78 The Annual General Meeting on Wednesday, 25 October 2023. The presentations and transcripts are available at: https://icann78.sched.com/. The DNSSEC Workshop Program Committee is developing a program for the upcoming meeting. Proposals will be considered for the following topic areas and included if space permits. In addition, we welcome suggestions for additional topics either for inclusion in the ICANN78 workshop, or for consideration for future workshops. 1. Global DNSSEC Activities Panel For this panel, we are seeking participation from those who have been involved in DNSSEC deployment as well as from those who have not deployed DNSSEC but who have a keen interest in the challenges and benefits of deployment, including Root Key Signing Key (KSK) Rollover activities and plans. 2. DNSSEC Best Practice Now that DNSSEC has become an operational norm for many registries, registrars, and ISPs, what have we learned about how we manage DNSSEC? * Do you still submit/accept DS records with Digest Type 1? * What is the best practice around key roll-overs? * What about Algorithm roll-overs? * Do you use and support DNSKEY Algorithms 13-16? * How often do you review your disaster recovery procedures? * Is there operational familiarity within your customer support teams? * What operational statistics have been gathered about DNSSEC? * Are there experiences being documented in the form of best practices, or something similar, for transfer of signed zones? Activities and issues related to DNSSEC in the DNS Root Zone are also desired. 3. DNSSEC Deployment Challenges The program committee is seeking input from those that are interested in implementation of DNSSEC but have general or particular concerns with DNSSEC. In particular, we are seeking input from individuals that would be willing to participate in a panel that would discuss questions of the following nature: * Are there any policies directly or indirectly impeding your DNSSEC deployment? (RRR model, CDS/CDNSKEY automation) * What are your most significant concerns with DNSSEC, e.g., complexity, training, implementation, operation or something else? * What do you expect DNSSEC to do for you and what doesn't it do? * What do you see as the most important trade-offs with respect to doing or not doing DNSSEC? 4. Security Panel The program committee is looking for presentations on DNS, DNSSEC, routing and other topics that could impact the security and/or stability of the Internet. We are looking for presentations that cover implementation issues, challenges, opportunities and best practices for: * Emerging threats that could impact the security and/or stability of the Internet * DoH and DoT * RPKI (Resource Public Key Infrastructure) * BGP routing & secure implementations * MANRS ( Mutually Agreed Norms for Routing Security) * Browser security – DNS, DNSSEC, DoH * EMAIL & DNS related security – DMARC, DKIM, TLSA, etc… If you are interested in participating, please send a brief (1-3 sentence) description of your proposed presentation to dnssec-security-workshop(a)icann.org<mailto:dnssec-security-workshop@icann.org> by COB Friday, 19 January 2024. Thank you, Kim and Kathy On behalf of the DNSSEC Workshop Program Committee: Steve Crocker, Edgemoor Research Institute Mark Elkins, DNS/ZARC Jacques Latour, .CA Russ Mundy, Tislabs Yoshiro Yoneya Dan York, Internet Society CLASSIFICATION:PUBLIC

1 0

Engineering contact at CenturyLink for McAfee traffic filtering
by Darrin Veit 19 Nov '23

19 Nov '23

If anyone has an engineering contact at CenturyLink that they can forward, that would be much appreciated. Darrin Veit Xbox Platform Engineering

1 0

Does anyone have *any* contact at Centurylink?
by Anne Mitchell 18 Nov '23

18 Nov '23

If anybody has *any* contact, no matter how tenuous, at Centurylink, can you please connect with me (ideally offlist so as to not clutter up the list). It's quite urgent. Thank you! Anne --- Anne P. Mitchell, Esq. Email Law & Policy Attorney CEO Institute for Social Internet Public Policy (ISIPP) Author: Section 6 of the CAN-SPAM Act of 2003 (the Federal email marketing law) Creator of the term 'deliverability' and founder of the deliverability industry Author: The Email Deliverability Handbook Board of Directors, Denver Internet Exchange Dean Emeritus, Cyberlaw & Cybersecurity, Lincoln Law School Prof. Emeritus, Lincoln Law School Chair Emeritus, Asilomar Microcomputer Workshop Counsel Emeritus, eMail Abuse Prevention System (MAPS)

1 0

announcing IPs by scrubbing service to help with DDoS attacks and ROAs
by Amir Herzberg 18 Nov '23

18 Nov '23

Hi, do people use scrubbing services, when under DDoS attack, by having the scrubbing service announce the attacked IP prefix(es)? If so, and you have a ROA for these prefixes, do you authorize the scrubbing AS (by issuing ROA or otherwise), and if so, do you do it in advance or only when you need the scrubbing service to announce your prefix? To clarify: we have a possible method to allow such `emergency ROAs' but I'm not convinced if we have a solution to a real problem - or if we just found a cute crypto solution and will end up writing it for a non-real problem. I prefer not to waste our time on presenting cute solutions to non-real problems :) So thanks for your help! Use your judgement if to respond on list or off list. Many thanks, Amir -- Amir Herzberg Comcast professor of Security Innovations, Computer Science and Engineering, University of Connecticut Homepage: https://sites.google.com/site/amirherzberg/home `Applied Introduction to Cryptography' textbook and lectures: https://sites.google.com/site/amirherzberg/cybersecurity

2 2

Weekly Global IPv4 Routing Table Report
by Routing Table Analysis Role Account 17 Nov '23

17 Nov '23

This is an automated weekly mailing describing the state of the Global IPv4 Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG UKNOF, TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net. For historical data, please see https://thyme.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. IPv4 Routing Table Report 04:00 +10GMT Sat 18 Nov, 2023 BGP Table (Global) as seen in Japan. Report Website: https://thyme.apnic.net Detailed Analysis: https://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 935368 Prefixes after maximum aggregation (per Origin AS): 355908 Deaggregation factor: 2.63 Unique aggregates announced (without unneeded subnets): 454806 Total ASes present in the Internet Routing Table: 75063 Prefixes per ASN: 12.46 Origin-only ASes present in the Internet Routing Table: 64423 Origin ASes announcing only one prefix: 26500 Transit ASes present in the Internet Routing Table: 10640 Transit-only ASes present in the Internet Routing Table: 481 Average AS path length visible in the Internet Routing Table: 4.2 Max AS path length visible: 55 Max AS path prepend of ASN (265020) 50 Prefixes from unregistered ASNs in the Routing Table: 1058 Number of instances of unregistered ASNs: 1060 Number of 32-bit ASNs allocated by the RIRs: 43068 Number of 32-bit ASNs visible in the Routing Table: 35403 Prefixes from 32-bit ASNs in the Routing Table: 177707 Number of bogon 32-bit ASNs visible in the Routing Table: 30 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 533 Number of addresses announced to Internet: 3050179328 Equivalent to 181 /8s, 206 /16s and 11 /24s Percentage of available address space announced: 82.4 Percentage of allocated address space announced: 82.4 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.6 Total number of prefixes smaller than registry allocations: 310771 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 248769 Total APNIC prefixes after maximum aggregation: 71647 APNIC Deaggregation factor: 3.47 Prefixes being announced from the APNIC address blocks: 241951 Unique aggregates announced from the APNIC address blocks: 99167 APNIC Region origin ASes present in the Internet Routing Table: 13773 APNIC Prefixes per ASN: 17.57 APNIC Region origin ASes announcing only one prefix: 4141 APNIC Region transit ASes present in the Internet Routing Table: 1854 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 32 Number of APNIC region 32-bit ASNs visible in the Routing Table: 9105 Number of APNIC addresses announced to Internet: 771745152 Equivalent to 45 /8s, 255 /16s and 229 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-153913 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 273597 Total ARIN prefixes after maximum aggregation: 124288 ARIN Deaggregation factor: 2.20 Prefixes being announced from the ARIN address blocks: 278287 Unique aggregates announced from the ARIN address blocks: 132362 ARIN Region origin ASes present in the Internet Routing Table: 19079 ARIN Prefixes per ASN: 14.59 ARIN Region origin ASes announcing only one prefix: 6971 ARIN Region transit ASes present in the Internet Routing Table: 1964 Average ARIN Region AS path length visible: 3.7 Max ARIN Region AS path length visible: 25 Number of ARIN region 32-bit ASNs visible in the Routing Table: 4827 Number of ARIN addresses announced to Internet: 1277108480 Equivalent to 76 /8s, 31 /16s and 33 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-401308 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 262331 Total RIPE prefixes after maximum aggregation: 124580 RIPE Deaggregation factor: 2.11 Prefixes being announced from the RIPE address blocks: 256858 Unique aggregates announced from the RIPE address blocks: 160709 RIPE Region origin ASes present in the Internet Routing Table: 28479 RIPE Prefixes per ASN: 9.02 RIPE Region origin ASes announcing only one prefix: 12089 RIPE Region transit ASes present in the Internet Routing Table: 3924 Average RIPE Region AS path length visible: 4.3 Max RIPE Region AS path length visible: 37 Number of RIPE region 32-bit ASNs visible in the Routing Table: 11440 Number of RIPE addresses announced to Internet: 714984576 Equivalent to 42 /8s, 157 /16s and 204 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-216475 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 119556 Total LACNIC prefixes after maximum aggregation: 28659 LACNIC Deaggregation factor: 4.17 Prefixes being announced from the LACNIC address blocks: 118379 Unique aggregates announced from the LACNIC address blocks: 49353 LACNIC Region origin ASes present in the Internet Routing Table: 11041 LACNIC Prefixes per ASN: 10.72 LACNIC Region origin ASes announcing only one prefix: 2670 LACNIC Region transit ASes present in the Internet Routing Table: 2334 Average LACNIC Region AS path length visible: 4.9 Max LACNIC Region AS path length visible: 55 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 8882 Number of LACNIC addresses announced to Internet: 178410240 Equivalent to 10 /8s, 162 /16s and 83 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-273820 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 30057 Total AfriNIC prefixes after maximum aggregation: 6022 AfriNIC Deaggregation factor: 4.99 Prefixes being announced from the AfriNIC address blocks: 39360 Unique aggregates announced from the AfriNIC address blocks: 12774 AfriNIC Region origin ASes present in the Internet Routing Table: 1807 AfriNIC Prefixes per ASN: 21.78 AfriNIC Region origin ASes announcing only one prefix: 629 AfriNIC Region transit ASes present in the Internet Routing Table: 346 Average AfriNIC Region AS path length visible: 4.9 Max AfriNIC Region AS path length visible: 28 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 1149 Number of AfriNIC addresses announced to Internet: 107500288 Equivalent to 6 /8s, 104 /16s and 83 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 9736 8730 44 CHINAMOBILE-CN China Mobile Communicati 7545 5701 786 696 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4921 4192 75 ERX-CERNET-BKB China Education and Rese 18403 4280 347 25 FPT-AS-AP FPT Telecom Company, VN 7713 3600 1047 70 TELKOMNET-AS-AP PT Telekomunikasi Indon 9498 3262 493 245 BBIL-AP BHARTI Airtel Ltd., IN 45899 3262 1872 99 VNPT-AS-VN VNPT Corp, VN 7552 2982 1330 20 VIETEL-AS-AP Viettel Group, VN 24560 2585 852 376 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd 4766 2532 11270 600 KIXS-AS-KR Korea Telecom, KR Complete listing at https://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 9216 11055 3348 AMAZON-02, US 11492 4556 302 675 CABLEONE, US 7155 4176 288 99 VIASAT-SP-BACKBONE, US 6327 3555 1320 67 SHAW, CA 22773 3512 3055 301 ASN-CXA-ALL-CCI-22773-RDC, US 749 3158 54932 2410 DNIC-AS-00749, US 16625 3046 1381 2291 AKAMAI-AS, US 367 3036 3867 1437 DNIC-ASBLK-00306-00371, US 396982 2723 3631 374 GOOGLE-CLOUD-PLATFORM, US 7018 2512 23615 1589 ATT-INTERNET4, US Complete listing at https://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 7460 1713 145 UNI2-AS, ES 39891 4570 271 54 ALJAWWALSTC-AS, SA 20940 4009 3397 142 AKAMAI-ASN1, NL 8551 3438 368 34 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 9009 3421 297 1590 M247, RO 12389 2958 2295 911 ROSTELECOM-AS, RU 34984 2323 361 590 TELLCOM-AS, TR 58224 1651 910 584 TCI, IR 13188 1607 100 26 TRIOLAN, UA 8452 1523 1852 14 TE-AS TE-AS, EG Complete listing at https://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 12048 3374 598 UNINET, MX 10620 3525 499 876 Telmex Colombia S.A., CO 13999 2457 335 642 Mega Cable, S.A. de C.V., MX 11830 2003 369 64 Instituto Costarricense de Electricidad 28573 1332 2321 242 Claro NXT Telecomunicacoes Ltda, BR 3816 1299 778 190 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 6503 1250 342 505 Axtel, S.A.B. de C.V., MX 6147 1102 369 22 Telefonica del Peru S.A.A., PE 11664 1075 173 437 Techtel LMDS Comunicaciones Interactiva 26615 1039 2502 52 TIM SA, BR Complete listing at https://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1606 393 19 LINKdotNET-AS, EG 24835 1548 545 28 RAYA-AS, EG 36992 1358 1518 280 ETISALAT-MISR, EG 36903 1248 553 98 MT-MPLS, MA 29571 1045 67 53 ORANGE-COTE-IVOIRE, CI 36935 935 521 43 Vodafone-, EG 6713 551 1861 34 IAM-AS, MA 15399 522 54 47 WANANCHI-, KE 24757 480 73 5 EthioNet-AS, ET 37342 476 32 1 MOVITEL, MZ Complete listing at https://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 12048 3374 598 UNINET, MX 9808 9736 8730 44 CHINAMOBILE-CN China Mobile Communicati 16509 9216 11055 3348 AMAZON-02, US 12479 7460 1713 145 UNI2-AS, ES 7545 5701 786 696 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4921 4192 75 ERX-CERNET-BKB China Education and Rese 39891 4570 271 54 ALJAWWALSTC-AS, SA 11492 4556 302 675 CABLEONE, US 18403 4280 347 25 FPT-AS-AP FPT Telecom Company, VN 7155 4176 288 99 VIASAT-SP-BACKBONE, US Complete listing at https://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 9808 9736 9692 CHINAMOBILE-CN China Mobile Communications Grou 12479 7460 7315 UNI2-AS, ES 16509 9216 5868 AMAZON-02, US 7545 5701 5005 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4921 4846 ERX-CERNET-BKB China Education and Research Net 39891 4570 4516 ALJAWWALSTC-AS, SA 18403 4280 4255 FPT-AS-AP FPT Telecom Company, VN 7155 4176 4077 VIASAT-SP-BACKBONE, US 11492 4556 3881 CABLEONE, US 20940 4009 3867 AKAMAI-ASN1, NL Complete listing at https://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 65536 DOCUMENT 5.102.30.0/24 65512 -Private Use AS-, ZZ 33492 UNALLOCATED 8.6.184.0/23 33650 COMCAST-33650, US 33123 UNALLOCATED 8.10.69.0/24 11168 SCC, US 12169 UNALLOCATED 8.15.207.0/24 32787 PROLEXIC-TECHNOLOGIES-DDOS-M 40493 UNALLOCATED 8.17.26.0/24 3356 LEVEL3, US 53775 UNALLOCATED 8.20.88.0/24 7029 WINDSTREAM, US 62828 UNALLOCATED 8.21.130.0/24 3356 LEVEL3, US 393266 UNALLOCATED 8.23.52.0/24 46887 LIGHTOWER, US 396894 UNALLOCATED 8.28.201.0/24 46887 LIGHTOWER, US 394936 UNALLOCATED 8.33.224.0/24 22442 HOU-PHONOSCOPE, US Complete listing at https://thyme.apnic.net/current/data-badAS Prefixes from the Special Purpose Address Registry (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at https://thyme.apnic.net/current/data-spar Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.140.216.0/24 Origin: 27176 DATAWAGON, US 23.140.216.0/24 Transit: 20278 NEXEON, US 23.141.0.0/24 Origin: 395350 RESERVED, ZZ 23.141.0.0/24 Transit: 11426 TWC-11426-CAROLINAS, US 23.176.160.0/24 Origin: 397327 RESERVED, ZZ 23.176.160.0/24 Transit: 19108 SUDDENLINK-COMMUNICATIONS, US 23.189.192.0/24 Origin: 27593 RESERVED, ZZ 23.189.192.0/24 Transit: 174 COGENT-174, US 36.255.139.0/24 Origin: 56050 NEW-SHINE-INTERNET-TH 134 Yenchit Road, 36.255.139.0/24 Transit: 58913 HCL-TH 4819 Supapong 3 Alley, Srinakarin Complete listing at https://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:14 /10:38 /11:99 /12:299 /13:582 /14:1195 /15:2062 /16:13470 /17:8334 /18:13834 /19:25158 /20:44399 /21:51591 /22:110694 /23:99516 /24:563340 /25:727 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 6549 7460 UNI2-AS, ES 8151 6068 12048 UNINET, MX 11492 3469 4556 CABLEONE, US 6327 3364 3555 SHAW, CA 39891 3324 4570 ALJAWWALSTC-AS, SA 7155 3122 4176 VIASAT-SP-BACKBONE, US 8551 2915 3438 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 22773 2565 3512 ASN-CXA-ALL-CCI-22773-RDC, US 30036 2136 2481 MEDIACOM-ENTERPRISE-BUSINESS, US 10620 2118 3525 Telmex Colombia S.A., CO Complete listing at https://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:2254 2:1427 3:272 4:5 5:4379 6:162 7:6 8:1543 9:1 11:172 12:1492 13:365 14:2322 15:304 16:206 17:364 18:669 20:318 21:4 22:188 23:6500 24:2566 25:2 27:2528 29:19 31:2569 32:58 34:31 35:118 36:2021 37:4446 38:5621 39:877 40:149 41:3985 42:2072 43:2320 44:330 45:16801 46:4364 47:373 49:1879 50:1887 51:573 52:1591 54:393 55:863 56:5 57:128 58:1902 59:1172 60:1010 61:2566 62:2706 63:1903 64:5500 65:2345 66:5014 67:3063 68:1348 69:4131 70:1190 71:606 72:2924 74:2637 75:1563 76:627 77:2347 78:1827 79:3016 80:2113 81:1849 82:1515 83:1301 84:1611 85:2990 86:777 87:1952 88:1231 89:3952 90:627 91:7892 92:2146 93:2647 94:3578 95:4000 96:1300 97:315 98:1083 99:736 100:96 101:1149 102:2946 103:32369 104:4773 105:576 106:986 107:2781 108:1134 109:4209 110:2133 111:3180 112:2079 113:1737 114:1717 115:1997 116:1932 117:2481 118:2723 119:1949 120:1805 121:1255 122:2626 123:2229 124:1625 125:2666 128:1486 129:917 130:1058 131:1985 132:825 133:408 134:1706 135:298 136:920 137:987 138:2706 139:1578 140:1330 141:1327 142:1541 143:1525 144:1007 145:343 146:1968 147:1635 148:2462 149:2343 150:1014 151:1252 152:1842 153:524 154:5337 155:1388 156:2103 157:1352 158:1058 159:2208 160:2610 161:1605 162:3558 163:1622 164:1659 165:1856 166:1083 167:1752 168:3862 169:790 170:4660 171:966 172:3801 173:2992 174:957 175:1192 176:3626 177:4544 178:3523 179:2178 180:2265 181:3589 182:3417 183:2005 184:2274 185:20644 186:4755 187:4242 188:4050 189:3976 190:9352 191:1474 192:11024 193:8983 194:7302 195:5213 196:3126 197:2467 198:6022 199:6527 200:8088 201:6252 202:10618 203:10042 204:4561 205:3697 206:4420 207:3517 208:4122 209:4929 210:4519 211:2559 212:4258 213:3405 214:1110 215:71 216:6719 217:2769 218:1324 219:586 220:2029 221:1004 222:866 223:2212 End of report

1 0

Your Input Needed: Can ROA Replace LOA? – Short Survey (7 mins)
by Christopher Hawker 16 Nov '23

16 Nov '23

Hello everyone, Aftab Siddiqui is currently exploring the possibility of using Route Object Authorisations (ROAs) as a potential replacement to LOAs. Separate to this (and unknowing of Aftab's research), I had started a discussion on the RPKI Community guild on Discord (https://discord.gg/9jYcqpbdRE) discussing the usage of ROAs instead of LOAs. An LOA, or "Letter of Authority" / "Letter of Authorization," is a formal document granting permission for third parties to take specific actions regarding network resources or services. In the service provider industry, its primary use is for advertising address resources (IPv4/v6 and ASN). When an organization intends to announce its IP prefixes through its own or a transit provider's ASN to the global internet, it typically needs to provide an LOA to their transit provider, confirming their custodianship or ownership of the resources. RPKI ROA, stands for "Resource Public Key Infrastructure Route Origin Authorization," is part of a security framework designed to validate the authenticity of internet routing information. It involves a digitally signed object that specifies which Autonomous Systems (ASes) are permitted to announce specific IP address prefixes. Could you please take a moment to fill out our brief survey? Your feedback will play a crucial role in our understanding of this topic. Survey Link: https://www.surveymonkey.com/r/JCHLWBB Thanks, Christopher Hawker

7 7