November 2024 - NANOG - lists.nanog.org

CGNAT growing pains
by Jon Lewis 17 Apr '25

17 Apr '25

We started rolling out CGNAT about 6 months ago. It was smooth sailing for the first few months, but we eventually did run into a number of issues. Our customer base is primarily FTTH with "dynamic" IP assignment via DHCP. Since connections are always-on, customer ONTs/routers get an IP assigned, and then when the lease is renewed, they request a new lease for the existing IP, and, in general, that request is granted. This gives customers the mistaken impression they have a static IP. So, my impression, from working with some customers who've needed to be moved from CGNAT back to public IP is that customers who are doing port-forwarding don't even bother with dynamic DNS. They just know they can connect to their IP as they've never seen it change. We do offer/sell static IP, but pre-CGNAT, it was strictly for business customers. i.e. A residential customer could only get static IP service by converting their account to a business account. That may change in the near future. One issue we didn't foresee has been IP Geo issues. i.e. We all knew that streaming services like Netflix use IP Geo to determine what content should be made available, but that's, AFAIK, limited by country or region. What we didn't anticipate is services like Hulu Live TV doing IP Geo down to the city level to determine which local channels are a subscriber's local channels. We're using Juniper MX gear and SPC3 cards for our CGNAT routers, each one having a single large external pool. Since we serve most of FL, one external pool can't IP Geo correctly for customers as far apart as Miami and Jacksonville hitting the same CGNAT router. We don't currently have an acceptable solution to this other than moving impacted customers off CGNAT. One of the great unknowns (at least for us) with CGNAT was what our PBA settings should be. i.e. How large each port-block should be, and how many port-blocks to allow per customer. We started with 256x4. It seemed to work. We eventually noticed that we were logging port-block exceeded errors. This is one aspect where Juniper's CGNAT support is lacking. There's a counter for these errors, and it's available via SNMP, but there's no way to attribute the errors to subscriber IPs. We're polling the mib and graphing it, so we know it's a continuing issue and can see when it's incrementing faster/slower, but Junos provides no means for determining if "PBEs" are all being caused by a single customer, a handful of customers, etc. We have a JTAC case open on this. As a quick & hopeful fix, we both increased the port-block size and block limit. That helped, but didn't stop the errors. It also cut our CGNAT ratio by more than half (64:1 -> 28:1), if we stay at this ratio, we'll need much larger external pools than originally anticipated. Tuning these settings is kind of painful as JTAC strongly recommends bouncing the CGNAT service anytime CGNAT related config changes are made. This means briefly breaking Internet access for all CGNAT'd customers. For the PBEs, JTAC's suggestions so far have been to shorten some of the timeouts in the config and to keep doing what we're doing, which is a cron job that essentially does a "show services nat source port-block", parses the output looking for subscriber IPs that have used up the ports in several of their port-blocks, then does a "show services sessions source-prefix ..." and logs all of this. This at least gives us snapshots of "who's a heavy user right now" and lets us look at how they were using all their ports. i.e. was it bittorent, are they compromised and scanning the internet for more systems to compromise, is it legit looking traffic - just lots of it, etc.? The latest CGNAT issue is a customer with a Palo Alto Networks firewall connected to our network and several of their employees are our FTTH customers. On their PANW firewall, they're doing IP Geo based filtering, limiting access to internal servers to "US IPs". Since we only CGNAT traffic to the external Internet, their on-net employees hit the firewall from their 100.64/10 IPs and get blocked. I suggested they whitelist 100.64/10, saying we block traffic from 100.64/10 from entering our network via peering and transit, so they can be assured anything from 100.64/10 came from inside our network / our customers. They say the firewall won't let them whitelist 100.64.0.0/10, giving an error that it's invalid IP space. I know we're not the first to implement CGNAT, so I'm curious if others have run into these sorts of issues, or others we haven't run into yet, and if so, how you solved them. ---------------------------------------------------------------------- Jon Lewis, MCP :) | I route Blue Stream Fiber, Sr. Neteng | therefore you are _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

10 16

Re: ECN
by Toke Høiland-Jørgensen 25 Mar '25

25 Mar '25

On 13 November 2019 17:20:18 CET, Matt Corallo <netadmin(a)as397444.net> wrote: >This sounds like a bug on Cloudflare’s end (cause trying to do anycast >TCP is... out of spec to say the least), not a bug in ECN/ECMP. Even without anycast, an ECMP shouldn't hash on the ECN bits. Doing so will split the flow over multiple paths; avoiding that is the whole point of doing the flow-based hashing in the first place. Anycast "only" turns a potential degradation of TCP performance into a hard failure... :) -Toke

6 8

DNSSEC & WIldcards
by Dennis Burgess 01 Feb '25

01 Feb '25

So have *.app.linktechs.net that I have been trying to get to work, we have DNSSEC on this, and its failing, but cannot for the life of me understand why. I think it may have something to do with proving it exists as a wildcard, but any DNSSEC experts want to take a stab at it ? Dennis Burgess

11 16

Implementing Decentralized RPKI with Blockchain Technology
by Brandon Z. 20 Jan '25

20 Jan '25

Hi there, Currently, due to political factors, some countries are not particularly proactive in deploying RPKI. Imagine if the RIR of a region were forced to revoke all IP resources of a particular country from RPKI, effectively isolating that country from the global internet. To address this, one approach is for autonomous networks within a region to establish two trusted RPKI CA servers: one from the major RIRs and another locally managed. The locally managed CA would take precedence, allowing autonomous networks to submit their IP resources to the RPKI server of their peers (and potentially backed by a national mandate to trust this CA). This setup could prevent a scenario where an entire country’s IP resources are revoked, leading to all IPs being marked as invalid. Another concept is to use blockchain technology. While cryptocurrencies use computational power to verify ownership, BGP could use peer count. If an IP resource is marked as valid by a majority of high-influence networks (with many peers), it could be trusted by the entire internet. Could this approach work? Perhaps there’s existing research on similar methods? *Brandon Z.* HUIZE LTD www.huize.asia <https://huize.asia/>| www.ixp.su | Twitter This e-mail and any attachments or any reproduction of this e-mail in whatever manner are confidential and for the use of the addressee(s) only. HUIZE LTD can’t take any liability and guarantee of the text of the email message and virus.

17 43

APRICOT 2025: CfP
by Mark Tinka 06 Jan '25

06 Jan '25

Hello all. The APRICOT 2025 Programme Committee is now seeking contributions for Presentations and Tutorials for the APRICOT 2025 Conference, which will be held in Petaling Jaya, Malaysia, 19th - 27th, February 2025. Details about the Call for Papers, and how you can submit a proposal for a conference, peering and tutorial talk, and the submission deadlines, can be found at the link below: https://2025.apricot.net/programme/callforpresentations We look forward to receiving your papers, and seeing you in Malaysia. Many thanks! Mark Tinka, Achie Atienza & Mark Duffell APRICOT 2025 Programme Committee Chairs

1 2

Shaping the Future of ICP-2: Community Input Extended to December 2024
by John Curran 30 Dec '24

30 Dec '24

NANOGers - In October 2023, the Number Resource Organization initiated a process to undertake a significant update to Internet Coordination Policy 2 (ICP-2); the policy which specifies the criteria for establishing new Regional Internet Registries (RIRs). The Address Supporting Organization Address Council (ASO AC) has been tasked with managing the revision process, emphasizing community engagement and transparency. The ASO AC has drafted a document which outlines the principles for the proposed ICP-2 Version 2 policy, and this document is available online for review here - https://www.nro.net/policy/internet-coordination-policy-2/proposed-icp-2-ve… The ASO AC is actively seeking feedback from the Internet number resource community and the broader internet community on these proposed principles. At this stage, comments are being solicited on the principles themselves, rather than specific amendments to the text of the document. This collaborative approach aims to refine the principles before drafting a revised version of ICP-2 for further stakeholder input. To facilitate community engagement, there is a questionnaire seeking feedback that available in multiple languages, including English, French, Spanish, and Portuguese. The questionnaire is designed to gather diverse perspectives and can be completed in approximately 7–10 minutes. Recognizing the importance of comprehensive community input, the deadline for input has via the questionnaire has been extended to 6 December 2024. If you have an interest in the governance principles that should be applicable to RIRs, and a moment available to provide input, please consider doing so. More details about the principles and questionnaire are available on the NRO website - https://www.nro.net/nro-announces-that-the-deadline-for-the-icp-2-questionn… Thanks! /John John Curran President and CEO American Registry for Internet Numbers

13 63

Chairman of Senate Intelligence Committee calls salt typhoon "worst telecom hack in our nation's history"
by Eric Kuhnke 10 Dec '24

10 Dec '24

Re: compromise of lawful intercept / CALEA related features: https://archive.is/jZt59 Original URL: https://www.washingtonpost.com/national-security/2024/11/21/salt-typhoon-ch… *The hackers, part of a group dubbed Salt Typhoon, have been able to listen in on audio calls in real time and have in some cases moved from one telecom network to another, exploiting relationships of “trust,” said Sen. Mark R. Warner (D-Virginia), chairman of the Senate Intelligence Committee and a former telecom venture capitalist. Warner added that intruders are still in the networks.*

5 4

Carrier Ethernet Demarc
by John Stitt 30 Nov '24

30 Nov '24

I'm currently searching out options for providing carrier ethernet demarc at 10Gbps and 25Gbps port speeds to evaluate for some upcoming projects. 10Gbps options abound, but it seems like the next step up with most vendors is 100Gb handoff. I'm not having much luck finding 25Gbps options other than ADVA/Adtran FSP 150-XJ128 and FSP 150-XG404 variants. Currently the majority of our customers are PON based (Calix), and we have non-PON handoffs with smaller Juniper switches as the demarc, so we're looking to step up to something actually designed for this purpose. We'd like to be able to perform y.1564 testing and use MEF compliant devices. I'm reaching out to some vendors/resellers to see what options they can provide, but I'm interested in hearing real-world experiences with different vendors in this space and especially any recommendations on the 25Gb demarc, as we have had some specific requests for that port speed recently. Feel free to reach out off list if that's your preference. John Stitt

5 7

Weekly Global IPv4 Routing Table Report
by Routing Table Analysis Role Account 29 Nov '24

29 Nov '24

This is an automated weekly mailing describing the state of the Global IPv4 Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG UKNOF, TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net. For historical data, please see https://thyme.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. IPv4 Routing Table Report 04:00 +10GMT Sat 30 Nov, 2024 IPv4 BGP Table (Global) as seen at Japan. Report Website: https://thyme.apnic.net Detailed Analysis: https://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 970194 Prefixes after maximum aggregation (per Origin AS): 368819 Deaggregation factor: 2.63 Unique aggregates announced (without unneeded subnets): 471550 Number of IPv4 prefixes with a valid ROA: 513828 Number of IPv4 prefixes with an invalid ROA: 1328 Number of IPv4 prefixes with no ROA: 455038 Total ASes present in the Internet Routing Table: 76507 Prefixes per ASN: 12.68 Origin-only ASes present in the Internet Routing Table: 65558 Origin ASes announcing only one prefix: 26837 Transit ASes present in the Internet Routing Table: 10949 Transit-only ASes present in the Internet Routing Table: 527 Average AS path length visible in the Internet Routing Table: 5.3 Max AS path length visible: 56 Max AS path prepend of ASN (265020) 50 Prefixes from unregistered ASNs in the Routing Table: 1053 Number of instances of unregistered ASNs: 1067 Number of 32-bit ASNs allocated by the RIRs: 45927 Number of 32-bit ASNs visible in the Routing Table: 37524 Prefixes from 32-bit ASNs in the Routing Table: 195832 Number of bogon 32-bit ASNs visible in the Routing Table: 49 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 483 Number of addresses announced to Internet: 3029300224 Equivalent to 180 /8s, 143 /16s and 116 /24s Percentage of available address space announced: 81.8 Percentage of allocated address space announced: 81.7 Percentage of available address space allocated: 100.1 Percentage of address space in use by end-sites: 99.6 Total number of prefixes smaller than registry allocations: 316773 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 259098 Total APNIC prefixes after maximum aggregation: 75902 APNIC Deaggregation factor: 3.41 Prefixes being announced from the APNIC address blocks: 251233 Unique aggregates announced from the APNIC address blocks: 101879 APNIC Region origin ASes present in the Internet Routing Table: 14484 APNIC Prefixes per ASN: 17.35 APNIC Region origin ASes announcing only one prefix: 4435 APNIC Region transit ASes present in the Internet Routing Table: 1902 Average APNIC Region AS path length visible: 5.5 Max APNIC Region AS path length visible: 38 Number of APNIC region 32-bit ASNs visible in the Routing Table: 9927 Number of APNIC addresses announced to Internet: 759042176 Equivalent to 45 /8s, 62 /16s and 16 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-153913 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 283836 Total ARIN prefixes after maximum aggregation: 126658 ARIN Deaggregation factor: 2.24 Prefixes being announced from the ARIN address blocks: 286294 Unique aggregates announced from the ARIN address blocks: 136257 ARIN Region origin ASes present in the Internet Routing Table: 19209 ARIN Prefixes per ASN: 14.90 ARIN Region origin ASes announcing only one prefix: 6970 ARIN Region transit ASes present in the Internet Routing Table: 2002 Average ARIN Region AS path length visible: 4.6 Max ARIN Region AS path length visible: 36 Number of ARIN region 32-bit ASNs visible in the Routing Table: 5085 Number of ARIN addresses announced to Internet: 1266282240 Equivalent to 75 /8s, 121 /16s and 239 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-402332 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 54/8, 55/8, 56/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 269331 Total RIPE prefixes after maximum aggregation: 130247 RIPE Deaggregation factor: 2.07 Prefixes being announced from the RIPE address blocks: 266368 Unique aggregates announced from the RIPE address blocks: 169617 RIPE Region origin ASes present in the Internet Routing Table: 28818 RIPE Prefixes per ASN: 9.24 RIPE Region origin ASes announcing only one prefix: 12109 RIPE Region transit ASes present in the Internet Routing Table: 3966 Average RIPE Region AS path length visible: 5.3 Max RIPE Region AS path length visible: 35 Number of RIPE region 32-bit ASNs visible in the Routing Table: 12148 Number of RIPE addresses announced to Internet: 722010240 Equivalent to 43 /8s, 9 /16s and 0 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-216475 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 53/8, 57/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 122933 Total LACNIC prefixes after maximum aggregation: 28799 LACNIC Deaggregation factor: 4.27 Prefixes being announced from the LACNIC address blocks: 120465 Unique aggregates announced from the LACNIC address blocks: 48678 LACNIC Region origin ASes present in the Internet Routing Table: 11167 LACNIC Prefixes per ASN: 10.79 LACNIC Region origin ASes announcing only one prefix: 2630 LACNIC Region transit ASes present in the Internet Routing Table: 2495 Average LACNIC Region AS path length visible: 5.9 Max LACNIC Region AS path length visible: 56 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 9091 Number of LACNIC addresses announced to Internet: 177524224 Equivalent to 10 /8s, 148 /16s and 206 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-274844 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 33943 Total AfriNIC prefixes after maximum aggregation: 6556 AfriNIC Deaggregation factor: 5.18 Prefixes being announced from the AfriNIC address blocks: 45351 Unique aggregates announced from the AfriNIC address blocks: 14712 AfriNIC Region origin ASes present in the Internet Routing Table: 1914 AfriNIC Prefixes per ASN: 23.69 AfriNIC Region origin ASes announcing only one prefix: 693 AfriNIC Region transit ASes present in the Internet Routing Table: 374 Average AfriNIC Region AS path length visible: 5.9 Max AfriNIC Region AS path length visible: 39 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 1273 Number of AfriNIC addresses announced to Internet: 104184320 Equivalent to 6 /8s, 53 /16s and 186 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 10075 8753 90 CHINAMOBILE-CN China Mobile Communication 7545 6163 842 661 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4890 4192 73 ERX-CERNET-BKB China Education and Resear 18403 4525 347 23 FPT-AS-AP FPT Telecom Company, VN 9498 3961 518 289 BBIL-AP BHARTI Airtel Ltd., IN 7552 3902 1331 25 VIETEL-AS-AP Viettel Group, VN 7713 3671 1036 72 TELKOMNET-AS-AP PT Telekomunikasi Indones 45899 3252 1869 100 VNPT-AS-VN VNPT Corp, VN 24560 2800 835 543 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd., 4766 2284 11520 588 KIXS-AS-KR Korea Telecom, KR Complete listing at https://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 11088 11969 3947 AMAZON-02, US 11492 4677 311 552 CABLEONE, US 174 4562 8768 892 COGENT-174, US 7155 4168 287 85 VIASAT-SP-BACKBONE, US 6327 3606 1320 79 SHAW, CA 22773 3403 3033 186 ASN-CXA-ALL-CCI-22773-RDC, US 749 3261 54895 2508 DNIC-AS-00749, US 7018 3208 23568 2046 ATT-INTERNET4, US 396982 2884 3655 433 GOOGLE-CLOUD-PLATFORM, US 16625 2863 1248 2122 AKAMAI-AS, US Complete listing at https://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 7668 1709 143 UNI2-AS, ES 39891 4750 290 62 ALJAWWALSTC-AS, SA 20940 3919 3395 129 AKAMAI-ASN1, NL 9009 3672 317 1862 M247, RO 12389 2950 2295 882 ROSTELECOM-AS, RU 34984 2343 360 575 TELLCOM-AS, TR 212238 1836 134 1356 CDNEXT, GB 8452 1614 1852 14 TE-AS TE-AS, EG 13188 1606 100 33 TRIOLAN, UA 62240 1491 98 747 CLOUVIDER Clouvider - Global ASN, GB Complete listing at https://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 11460 3221 606 UNINET, MX 10620 3542 494 942 Telmex Colombia S.A., CO 13999 2534 537 371 Mega Cable, S.A. de C.V., MX 11830 1992 369 64 Instituto Costarricense de Electricidad y 28573 1334 2310 261 Claro NXT Telecomunicacoes Ltda, BR 3816 1325 782 203 COLOMBIA TELECOMUNICACIONES S.A. ESP BIC, 6503 1155 374 163 Axtel, S.A.B. de C.V., MX 11664 1119 278 33 Techtel LMDS Comunicaciones Interactivas 6147 1115 371 22 Telefonica del Peru S.A.A., PE 22884 1068 98 372 TOTAL PLAY TELECOMUNICACIONES SA DE CV, M Complete listing at https://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24835 1659 593 29 RAYA-AS, EG 24863 1636 389 16 LINKdotNET-AS, EG 29571 1421 90 59 ORANGE-COTE-IVOIRE, CI 36992 1421 1518 288 ETISALAT-MISR, EG 36903 1249 554 96 MT-MPLS, MA 36935 1015 523 46 Vodafone-, EG 20011 942 165 258 INTERNET-SOLUTIONS, ZA 37069 882 1083 15 MOBINIL, EG 6713 558 1861 35 IAM-AS, MA 36914 553 82 3 KENET-AS, KE Complete listing at https://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 11460 3221 606 UNINET, MX 16509 11088 11969 3947 AMAZON-02, US 9808 10075 8753 90 CHINAMOBILE-CN China Mobile Communication 12479 7668 1709 143 UNI2-AS, ES 7545 6163 842 661 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4890 4192 73 ERX-CERNET-BKB China Education and Resear 39891 4750 290 62 ALJAWWALSTC-AS, SA 11492 4677 311 552 CABLEONE, US 174 4562 8768 892 COGENT-174, US 18403 4525 347 23 FPT-AS-AP FPT Telecom Company, VN Complete listing at https://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 9808 10075 9985 CHINAMOBILE-CN China Mobile Communications Grou 12479 7668 7525 UNI2-AS, ES 16509 11088 7141 AMAZON-02, US 7545 6163 5502 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4890 4817 ERX-CERNET-BKB China Education and Research Net 39891 4750 4688 ALJAWWALSTC-AS, SA 18403 4525 4502 FPT-AS-AP FPT Telecom Company, VN 11492 4677 4125 CABLEONE, US 7155 4168 4083 VIASAT-SP-BACKBONE, US 7552 3902 3877 VIETEL-AS-AP Viettel Group, VN Complete listing at https://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 33123 UNALLOCATED 8.10.69.0/24 174 COGENT-174, US 12169 UNALLOCATED 8.15.207.0/24 32787 PROLEXIC-TECHNOLOGIES-D 40493 UNALLOCATED 8.17.26.0/24 3356 LEVEL3, US 46639 UNALLOCATED 8.17.66.0/24 701 UUNET, US 53775 UNALLOCATED 8.20.88.0/24 7029 WINDSTREAM, US 393266 UNALLOCATED 8.23.52.0/24 46887 CROWNCASTLE-AS46887, US 396894 UNALLOCATED 8.28.201.0/24 46887 CROWNCASTLE-AS46887, US 394936 UNALLOCATED 8.33.224.0/24 22442 HOU-PHONOSCOPE, US 54338 UNALLOCATED 8.33.241.0/24 3356 LEVEL3, US 46639 UNALLOCATED 8.38.73.0/24 3356 LEVEL3, US Complete listing at https://thyme.apnic.net/current/data-badAS Prefixes from the Special Purpose Address Registry (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at https://thyme.apnic.net/current/data-spar Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 14.192.20.0/22 Origin: 26658 HENGTONG-IDC-LLC, US 14.192.20.0/22 Transit: 6939 HURRICANE, US 23.139.32.0/24 Origin: 14727 RESERVED, ZZ 23.139.32.0/24 Transit: 6939 HURRICANE, US 23.140.216.0/24 Origin: 27176 DATAWAGON, US 23.140.216.0/24 Transit: 20278 NEXEON, US 23.141.0.0/24 Origin: 395350 RESERVED, ZZ 23.141.0.0/24 Transit: 11426 TWC-11426-CAROLINAS, US 23.152.48.0/24 Origin: 46167 RESERVED, ZZ 23.152.48.0/24 Transit: 7018 ATT-INTERNET4, US Complete listing at https://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:16 /10:36 /11:91 /12:296 /13:576 /14:1170 /15:2051 /16:13180 /17:8279 /18:13731 /19:24703 /20:45237 /21:52437 /22:112303 /23:100678 /24:594708 /25:686 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 6658 7668 UNI2-AS, ES 8151 5664 11460 UNINET, MX 11492 3555 4677 CABLEONE, US 39891 3441 4750 ALJAWWALSTC-AS, SA 6327 3401 3606 SHAW, CA 7155 3112 4168 VIASAT-SP-BACKBONE, US 22773 2536 3403 ASN-CXA-ALL-CCI-22773-RDC, US 16509 2264 11088 AMAZON-02, US 30036 2205 2545 MEDIACOM-ENTERPRISE-BUSINESS, US 10620 2172 3542 Telmex Colombia S.A., CO Complete listing at https://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:2299 2:1550 3:526 4:8 5:4458 6:166 7:6 8:1495 9:1 11:172 12:1410 13:368 14:2503 15:334 16:269 17:361 18:901 20:447 21:4 22:188 23:7081 24:2650 25:2 27:2614 29:19 31:3036 32:41 34:70 35:172 36:2393 37:4510 38:9066 39:891 40:149 41:4158 42:2176 43:2491 44:340 45:17827 46:4908 47:297 49:2027 50:1858 51:586 52:1575 54:316 55:947 56:8 57:231 58:2318 59:1244 60:1153 61:2765 62:2835 63:1845 64:5419 65:2273 66:4640 67:3021 68:1289 69:4002 70:1117 71:590 72:2862 74:2790 75:1631 76:638 77:2560 78:1854 79:1622 80:2216 81:2050 82:1769 83:1471 84:1772 85:3188 86:967 87:2416 88:1258 89:4371 90:732 91:8263 92:2645 93:2844 94:3859 95:4205 96:1244 97:313 98:1067 99:734 100:71 101:1172 102:3446 103:32356 104:4440 105:731 106:984 107:2409 108:1189 109:4000 110:2240 111:3322 112:2042 113:1811 114:1943 115:2150 116:2017 117:2723 118:2870 119:1979 120:1872 121:1414 122:2743 123:2169 124:1625 125:2858 126:62 128:1528 129:948 130:1260 131:1865 132:814 133:448 134:1527 135:321 136:1305 137:1147 138:2859 139:1530 140:1490 141:1456 142:1834 143:1592 144:1029 145:404 146:2113 147:2049 148:2575 149:2813 150:1157 151:1464 152:2114 153:499 154:7346 155:1546 156:2771 157:1862 158:1229 159:2450 160:3349 161:1704 162:3587 163:1779 164:1940 165:2152 166:1346 167:1859 168:4116 169:803 170:5106 171:1000 172:3961 173:3144 174:921 175:1258 176:3548 177:4803 178:3746 179:2267 180:2547 181:3946 182:3359 183:2065 184:2260 185:21297 186:5018 187:4206 188:4210 189:4053 190:9563 191:1505 192:11175 193:9278 194:7645 195:5407 196:3207 197:3507 198:6043 199:8229 200:8165 201:6295 202:10566 203:10474 204:4643 205:3707 206:4653 207:3602 208:4225 209:5129 210:4813 211:2634 212:4497 213:3695 214:1058 215:48 216:6573 217:3077 218:1358 219:551 220:2096 221:1052 222:841 223:2307 End of report

1 0

DNS-OARC Cfp - Closing Soon
by Merike Kaeo 28 Nov '24

28 Nov '24

Hello all. The Programme Committee is seeking contributions from the community. This workshop will be a hybrid event. Date - 6-7 February 2025 Location - Atlanta Marriott Marquis - Atlanta, Georgia, USA Time zone - EST (UTC -5) Co-located with NANOG 93 Deadline for Submissions - 2024-12-02 23:59 UTC All DNS-related subjects and discussion topics are welcome although we're particularly keen to hear about operational and security related experiences, best practices and practical advice; both for newcomers to the DNS arena and those who have been around for longer who want to learn more about new features and opportunities to improve resilience, security and privacy. If you have something interesting to share with the community that lies outside of the focus above, please don't be put off - if it's good, we'll be happy to include it. If you'd like to offer a talk, but are not quite sure what to pick, here's a non-exhaustive list of ideas: - Operations: Any operational gotchas, lessons learned from an outage, details/reasons for a recent outage (how to improve time to recovery, tooling), interoperability concerns and experience. - Deployment: DNS config management and release process. - Monitoring: Log ingestion pipeline, analytics infrastructure, anomaly detection. - Scaling: DNS performance management and metrics. Increasing DNS server efficiency. - Security: DoS experience, attacks on the DNS, DNSSEC signing and validation. - Privacy: Encrypted transports, qname minimization, data anonymization. - Resilience: Provisioning planning, load-balancing services, features (e.g. serve-stale) For further details please see https://www.dns-oarc.net/oarc44 Merike Kaeo, for the DNS-OARC Programme Committee Merike Kaeo Founder/vCISO, Double Shot Security Email: merike(a)doubleshotsecurity.com <mailto:merike@doubleshotsecurity.com> Mobile: +1 206-669-6394

1 0