December 2025 - NANOG - lists.nanog.org

Correctly dealing with bots and scrapers.
by Andrew Latham 21 Mar '26

21 Mar '26

I just had an issue with a web-server where I had to block a /18 of a large scraper. I have some topics I could use some input on. 1. What tools or setups have people found most successful for dealing with bots/scrapers that do not respect robots.txt for example? 2. What tools for response rate limiting deal with bots/scrapers that cycle over a large variety of IPs with the exact same user agent? 3. Has anyone written or found a tool to concentrate IP addresses into networks for IPTABLES or NFT? (60% of IPs for network X in list so add network X and remove individual IP entries.) -- - Andrew "lathama" Latham -

17 31

New c-nsp, j-nsp, a-nsp, etc mailing lists
by Drew Weaver 20 Jan '26

20 Jan '26

I was a big fan of the *-nsp(a)puck.nether.net<mailto:*-nsp@puck.nether.net> mailing lists that now seem to be completely gone without any indication of whether or when they might return. I've been considering just setting up new ones. Please email me off-list if you think this might be useful. Thanks, -Drew

15 25

What do you consider acceptable packet / session modification for a network operator?
by Andrew 30 Dec '25

30 Dec '25

I’m doing a bit of research on how consumer-focused ISPs are modifying their user’s traffic, and I think you guys would have useful insight into legitimate reasons to touch user packets. Almost all of these examples have been seen in the wild by at least one US ISP, so none of these are purely hypothetical. So, how do you feel about where to draw the line for what is acceptable from an ISP? Examples: - Using different source IP ranges in CGNat for ‘web’ traffic vs ’non-web’ (i.e. port 80/443 vs all other ports) - this can break local IP discovery for peer-to-peer stuff if it relies on a ‘web’ port for an API endpoint - Using any form of NAT / packet translation with IPv6 (not including nat64 / other v4 transition related) - Dropping non-TCP/UDP/ICMP protocols (outside of CGNat) - such as ‘raw’ IPSec ESP / AH without UDP encapsulation, or SCTP - TCP MSS - MSS Clamping all connections - TCP MSS - MSS Clamping, but you instead (accidentally?) set MSS to your desired value even if it was lower before - Other TCP options - Dropping syn packets with invalid/unknown options - TCP connection interception - Network operator terminates TCP session from user and then establishes a new one with the original destination. All TCP options, sequence numbers, .. are lost in this translation - Related to above - Network accepts TCP connection which it will intercept (sends SYN/ACK to user) before it confirms that the destination is reachable - Dropping/resetting port 80 sessions that don't ‘look like’ HTTP - Dropping/resetting port 443 sessions that don't ‘look like’ TLS - Redirecting port 53 DNS queries to ISP’s own servers, regardless of destination IP - HTTP header injection into port 80 HTTP traffic (i.e. for user tracking) - HTTP content injection into port 80 HTTP traffic (i.e. replacing ads, adding dialogs, …) (and not blanket redirection for non-payment) Thanks, Andrew ‘apalrd’ Palardy www.apalrd.net https://www.youtube.com/c/apalrdsadventures

17 28

anyone in the list from Oracle?
by jordi.palet＠consulintel.es 27 Dec '25

27 Dec '25

Please contact me off-line. There are presumable malicious activities from some of their IPv6 and IPv4 prefixes. Tried to contact them several times weeks ago. It seems to me that they are not processing emails at abuse(a)oracleemaildelivery.com <mailto:abuse@oracleemaildelivery.com> (from whois OrgAbuseEmail) Regards, Jordi @jordipalet ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

1 0

Weekly Global IPv4 Routing Table Report
by Routing Table Analysis Role Account 26 Dec '25

26 Dec '25

This is an automated weekly mailing describing the state of the Global IPv4 Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG UKNOF, TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net. For historical data, please see https://thyme.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. IPv4 Routing Table Report 04:00 +10GMT Sat 27 Dec, 2025 IPv4 BGP Table (Global) as seen at Japan. Report Website: https://thyme.apnic.net Detailed Analysis: https://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 1024767 Prefixes after maximum aggregation (per Origin AS): 394615 Deaggregation factor: 2.60 Unique aggregates announced (without unneeded subnets): 505865 Number of IPv4 prefixes with a valid ROA: 603996 Number of IPv4 prefixes with an invalid ROA: 1569 Number of IPv4 prefixes with no ROA: 419202 Total ASes present in the Internet Routing Table: 77673 Prefixes per ASN: 13.19 Origin-only ASes present in the Internet Routing Table: 66752 Origin ASes announcing only one prefix: 27110 Transit ASes present in the Internet Routing Table: 10921 Transit-only ASes present in the Internet Routing Table: 547 Average AS path length visible in the Internet Routing Table: 4.7 Max AS path length visible: 69 Max AS path prepend of ASN (269326) 61 Prefixes from unregistered ASNs in the Routing Table: 967 Number of instances of unregistered ASNs: 1005 Number of 32-bit ASNs allocated by the RIRs: 48313 Number of 32-bit ASNs visible in the Routing Table: 39535 Prefixes from 32-bit ASNs in the Routing Table: 219802 Number of bogon 32-bit ASNs visible in the Routing Table: 107 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 625 Number of addresses announced to Internet: 3106737024 Equivalent to 185 /8s, 45 /16s and 11 /24s Percentage of available address space announced: 83.9 Percentage of allocated address space announced: 83.9 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.6 Total number of prefixes smaller than registry allocations: 334716 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 278257 Total APNIC prefixes after maximum aggregation: 81423 APNIC Deaggregation factor: 3.42 Prefixes being announced from the APNIC address blocks: 264734 Unique aggregates announced from the APNIC address blocks: 106366 APNIC Region origin ASes present in the Internet Routing Table: 14965 APNIC Prefixes per ASN: 17.69 APNIC Region origin ASes announcing only one prefix: 4566 APNIC Region transit ASes present in the Internet Routing Table: 1978 Average APNIC Region AS path length visible: 4.7 Max APNIC Region AS path length visible: 34 Number of APNIC region 32-bit ASNs visible in the Routing Table: 10519 Number of APNIC addresses announced to Internet: 754221568 Equivalent to 44 /8s, 244 /16s and 130 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-155961 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 300338 Total ARIN prefixes after maximum aggregation: 134999 ARIN Deaggregation factor: 2.22 Prefixes being announced from the ARIN address blocks: 300613 Unique aggregates announced from the ARIN address blocks: 145664 ARIN Region origin ASes present in the Internet Routing Table: 19370 ARIN Prefixes per ASN: 15.52 ARIN Region origin ASes announcing only one prefix: 7053 ARIN Region transit ASes present in the Internet Routing Table: 1929 Average ARIN Region AS path length visible: 4.3 Max ARIN Region AS path length visible: 28 Number of ARIN region 32-bit ASNs visible in the Routing Table: 5420 Number of ARIN addresses announced to Internet: 1343116544 Equivalent to 80 /8s, 14 /16s and 85 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-402332 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 54/8, 55/8, 56/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 283023 Total RIPE prefixes after maximum aggregation: 139990 RIPE Deaggregation factor: 2.02 Prefixes being announced from the RIPE address blocks: 283883 Unique aggregates announced from the RIPE address blocks: 184021 RIPE Region origin ASes present in the Internet Routing Table: 29124 RIPE Prefixes per ASN: 9.75 RIPE Region origin ASes announcing only one prefix: 12071 RIPE Region transit ASes present in the Internet Routing Table: 3947 Average RIPE Region AS path length visible: 4.8 Max RIPE Region AS path length visible: 31 Number of RIPE region 32-bit ASNs visible in the Routing Table: 12895 Number of RIPE addresses announced to Internet: 735306112 Equivalent to 43 /8s, 211 /16s and 225 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-216475 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 53/8, 57/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 126031 Total LACNIC prefixes after maximum aggregation: 30630 LACNIC Deaggregation factor: 4.11 Prefixes being announced from the LACNIC address blocks: 121822 Unique aggregates announced from the LACNIC address blocks: 49760 LACNIC Region origin ASes present in the Internet Routing Table: 11335 LACNIC Prefixes per ASN: 10.75 LACNIC Region origin ASes announcing only one prefix: 2684 LACNIC Region transit ASes present in the Internet Routing Table: 2519 Average LACNIC Region AS path length visible: 5.3 Max LACNIC Region AS path length visible: 69 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 9333 Number of LACNIC addresses announced to Internet: 170550784 Equivalent to 10 /8s, 42 /16s and 102 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-275868 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 36151 Total AfriNIC prefixes after maximum aggregation: 6917 AfriNIC Deaggregation factor: 5.23 Prefixes being announced from the AfriNIC address blocks: 53090 Unique aggregates announced from the AfriNIC address blocks: 19548 AfriNIC Region origin ASes present in the Internet Routing Table: 2003 AfriNIC Prefixes per ASN: 26.51 AfriNIC Region origin ASes announcing only one prefix: 736 AfriNIC Region transit ASes present in the Internet Routing Table: 389 Average AfriNIC Region AS path length visible: 5.3 Max AfriNIC Region AS path length visible: 42 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 1368 Number of AfriNIC addresses announced to Internet: 103225600 Equivalent to 6 /8s, 39 /16s and 25 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 13455 8945 104 CHINAMOBILE-CN China Mobile Communication 7545 6037 834 581 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 5022 4193 77 ERX-CERNET-BKB China Education and Resear 9498 4655 542 333 BBIL-AP BHARTI Airtel Ltd., IN 7552 4043 1332 29 VIETEL-AS-AP Viettel Group, VN 7713 3729 1044 65 TELKOMNET-AS-AP PT Telekomunikasi Indones 56046 3389 831 184 CMNET-JIANGSU-AP China Mobile communicati 45899 3330 1868 98 VNPT-AS-VN VNPT Corp, VN 17561 3171 199 637 LCS-AS-AP LARUS Limited, HK 24560 2961 865 500 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd., Complete listing at https://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 14000 38461 5440 AMAZON-02, US 22773 4747 3116 377 ASN-CXA-ALL-CCI-22773-RDC, US 11492 4688 311 948 CABLEONE, US 7155 3861 286 85 VIASAT-SP-BACKBONE, US 6327 3690 1320 82 SHAW, CA 174 3467 8769 862 COGENT-174, US 396982 3316 4867 490 GOOGLE-CLOUD-PLATFORM, US 749 3144 54729 2395 DNIC-AS-00749, US 16625 2844 1218 2134 AKAMAI-AS, US 36352 2703 222 888 AS-COLOCROSSING, US Complete listing at https://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 7283 1711 149 UNI2-AS, ES 39891 4901 302 70 ALJAWWALSTC-AS, SA 9009 3963 369 2270 M247, RO 20940 3835 3394 122 AKAMAI-ASN1, NL 12389 3175 2317 871 ROSTELECOM-AS PJSC Rostelecom. Technical 212238 2560 182 1860 CDNEXT, GB 34984 2421 371 575 TELLCOM-AS, TR 8452 1699 1852 14 TE-AS TE-AS, EG 203020 1617 242 783 HOSTROYALE, IN 13188 1607 100 27 TRIOLAN, UA Complete listing at https://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 12640 3277 590 UNINET, MX 10620 3434 457 1108 Telmex Colombia S.A., CO 13999 2488 506 351 Mega Cable, S.A. de C.V., MX 11830 1987 369 65 Instituto Costarricense de Electricidad y 11664 1371 278 33 Techtel LMDS Comunicaciones Interactivas 28573 1369 2429 273 Claro NXT Telecomunicacoes Ltda, BR 3816 1339 770 213 COLOMBIA TELECOMUNICACIONES S.A. ESP BIC, 6147 1259 371 22 Telefonica del Peru S.A.A., PE 22884 1057 67 359 TOTAL PLAY TELECOMUNICACIONES SA DE CV, M 26615 1011 2486 56 TIM SA, BR Complete listing at https://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24835 1952 484 24 RAYA-AS, EG 36992 1846 1538 335 ETISALAT-MISR, EG 24863 1264 389 16 LINKdotNET-AS, EG 36903 1232 555 98 MT-MPLS, MA 37069 1100 1096 13 MOBINIL, EG 29571 1072 94 22 ORANGE-COTE-IVOIRE, CI 36935 1059 519 31 Vodafone-, EG 20011 580 154 212 NTT-DATA-Inc, ZA 36914 562 82 3 KENET-AS, KE 328608 546 48 160 Africa-on-Cloud-AS, ZA Complete listing at https://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 14000 38461 5440 AMAZON-02, US 9808 13455 8945 104 CHINAMOBILE-CN China Mobile Communication 8151 12640 3277 590 UNINET, MX 12479 7283 1711 149 UNI2-AS, ES 7545 6037 834 581 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 5022 4193 77 ERX-CERNET-BKB China Education and Resear 39891 4901 302 70 ALJAWWALSTC-AS, SA 22773 4747 3116 377 ASN-CXA-ALL-CCI-22773-RDC, US 11492 4688 311 948 CABLEONE, US 9498 4655 542 333 BBIL-AP BHARTI Airtel Ltd., IN Complete listing at https://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 9808 13455 13351 CHINAMOBILE-CN China Mobile Communications Grou 8151 12640 12050 UNINET, MX 12479 7283 7134 UNI2-AS, ES 7545 6037 5456 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 5022 4945 ERX-CERNET-BKB China Education and Research Net 39891 4901 4831 ALJAWWALSTC-AS, SA 22773 4747 4370 ASN-CXA-ALL-CCI-22773-RDC, US 9498 4655 4322 BBIL-AP BHARTI Airtel Ltd., IN 7552 4043 4014 VIETEL-AS-AP Viettel Group, VN 7155 3861 3776 VIASAT-SP-BACKBONE, US Complete listing at https://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 393266 UNALLOCATED 8.23.52.0/24 46887 CROWNCASTLE-AS46887, US 396894 UNALLOCATED 8.28.201.0/24 3356 LEVEL3, US 394936 UNALLOCATED 8.33.224.0/24 22442 HOU-PHONOSCOPE, US 395195 UNALLOCATED 8.38.115.0/24 3356 LEVEL3, US 1782 UNALLOCATED 8.42.19.0/24 3356 LEVEL3, US 54739 UNALLOCATED 8.44.198.0/23 13335 CLOUDFLARENET, US 13342 UNALLOCATED 12.17.5.0/24 174 COGENT-174, US 26345 UNALLOCATED 12.21.93.0/24 40264 TWC-40264-WI-MN-UPPERMI 396831 UNALLOCATED 12.23.198.0/24 7018 ATT-INTERNET4, US 21861 UNALLOCATED 12.37.59.0/24 7018 ATT-INTERNET4, US Complete listing at https://thyme.apnic.net/current/data-badAS Prefixes from the Special Purpose Address Registry (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at https://thyme.apnic.net/current/data-spar Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.137.48.0/24 Origin: 16904 ARVIG-16904, US 23.137.48.0/24 Transit: 3257 GTT-BACKBONE GTT, US 23.137.200.0/24 Origin: 16276 OVH, FR 23.137.200.0/24 Transit: 2516 KDDI KDDI CORPORATION, JP 23.140.216.0/24 Origin: 27176 DATAWAGON, US 23.140.216.0/24 Transit: 20278 NEXEON, US 23.141.0.0/24 Origin: 395350 RESERVED, ZZ 23.141.0.0/24 Transit: 11426 TWC-11426-CAROLINAS, US 23.142.24.0/24 Origin: 62164 HEYMMAN-2, CA 23.142.24.0/24 Transit: 64236 UNREAL-SERVERS, US Complete listing at https://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:14 /10:41 /11:93 /12:299 /13:580 /14:1200 /15:2094 /16:13717 /17:8308 /18:13587 /19:25066 /20:45680 /21:52654 /22:113608 /23:105994 /24:641118 /25:698 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 8151 6845 12640 UNINET, MX 12479 6214 7283 UNI2-AS, ES 39891 3587 4901 ALJAWWALSTC-AS, SA 11492 3533 4688 CABLEONE, US 6327 3478 3690 SHAW, CA 22773 3051 4747 ASN-CXA-ALL-CCI-22773-RDC, US 7155 2820 3861 VIASAT-SP-BACKBONE, US 16509 2456 14000 AMAZON-02, US 30036 2323 2666 MEDIACOM-ENTERPRISE-BUSINESS, US 10620 2214 3434 Telmex Colombia S.A., CO Complete listing at https://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1808 2:1517 3:978 4:10 5:4921 6:185 7:6 8:1523 9:10 11:172 12:1230 13:600 14:2664 15:417 16:274 17:383 18:914 20:587 21:4 22:188 23:8097 24:2562 25:2 27:2741 29:19 31:3394 32:32 33:1 34:81 35:290 36:4623 37:4526 38:10394 39:1220 40:437 41:4531 42:963 43:2871 44:411 45:19612 46:5060 47:397 49:2154 50:2057 51:598 52:1257 54:225 55:1129 56:11 57:311 58:2220 59:1408 60:1172 61:3063 62:3107 63:1761 64:5994 65:2124 66:5937 67:3235 68:1504 69:4200 70:1033 71:619 72:3082 74:2930 75:1516 76:601 77:2750 78:1928 79:1797 80:2317 81:2095 82:3939 83:1473 84:2030 85:3651 86:1099 87:2350 88:1362 89:4627 90:836 91:8432 92:2831 93:3001 94:4278 95:4550 96:1434 97:313 98:957 99:782 100:68 101:1269 102:4337 103:32293 104:5466 105:762 106:921 107:2815 108:1223 109:4263 110:2308 111:4054 112:2834 113:1684 114:2097 115:2240 116:2157 117:3180 118:2487 119:2110 120:2452 121:1566 122:2961 123:2286 124:1675 125:2968 126:125 128:1587 129:966 130:1547 131:2247 132:762 133:462 134:1640 135:539 136:1500 137:1274 138:3010 139:1589 140:1831 141:1560 142:2437 143:2135 144:1366 145:626 146:2192 147:2139 148:2787 149:2912 150:1314 151:2574 152:2262 153:820 154:9541 155:2274 156:4759 157:2243 158:1474 159:2733 160:3649 161:1993 162:3988 163:2325 164:1961 165:2641 166:1312 167:2199 168:3924 169:812 170:5458 171:1119 172:4529 173:3424 174:903 175:1343 176:3788 177:4734 178:4317 179:2292 180:2849 181:4357 182:3871 183:2459 184:2051 185:21690 186:5530 187:4778 188:4536 189:4465 190:9673 191:1536 192:11446 193:9522 194:7872 195:5664 196:3270 197:3199 198:6231 199:6110 200:8225 201:6381 202:10710 203:10528 204:4674 205:3770 206:4435 207:3956 208:4353 209:5503 210:4983 211:2774 212:4945 213:4039 214:1063 215:54 216:7111 217:3456 218:1662 219:581 220:2190 221:1295 222:917 223:3255 End of report

1 0

Re: What do you consider acceptable packet / session modification for a network operator?
by Andrew 25 Dec '25

25 Dec '25

Glad everyone agrees ISPs should not be doing this! Most of these things are currently being done by a US national wireless ISP to their ~100M customers. I’m sure you can guess who it is, there are only 3 choices. I spent an afternoon hand-crafting packets on their network to a remote cloud VPS to try to understand wtf their network is doing. I did all of this over IPv6 to avoid CGNAT. The first clue to me is that a ‘what is my IP’ website does not report the same IPv6 as the device. Obviously we should never be using NAT in IPv6, so clearly this ISP is doing something suspicious, and the ‘what is my IP’ IPv6 ends in ::8 which is also suspiciously manually generated. I eventually concluded that all traffic with a TCP or UDP destination port of 443 was being NATed via this ::8 address, while a random high numbered destination port was coming from the device’s IPv6 as expected. I drilled down into the behavior of this port 443 proxy and concluded: - The proxy responds to all TCP SYNs with a SYN ACK and establishes a connection - After the connection is established, it will then dial the remote side, so if I never send the ACK it will never dial the remote side - If the remote side rejects the connection, the proxy will ‘eat’ all of the bytes which have already been sent and then close the connection without any error on the client side - The proxy will still pass arbitrary bytes after the connection is established, even if they are not TLS traffic, it also does not appear to impact TLS traffic in any way that I could detect - The proxy re-negotiates all of the TCP options, so setting MSS manually on either side does not get passed through. Congestion control will also be impacted by this. The proxy seems to choose 1370 as its preferred MSS on both sides. I cannot understand a legitimate use case for an ISP to run such a proxy on port 443, and the resources required to proxy essentially all of the TLS traffic for 100M customers must be enormous. I then tried to scan all ports with TCP SYNs to see if any proxy responded with a SYN ACK, but hit some sort of rate limit on new connections and got unreliable responses (this could have been in my handset, which is acting as a hotspot). I limited my search to the first 1024 ports and found similar behavior on ports 21, 80, 443, and 554. All four proxies each have their own public IP, and it is different for each (so ‘what is my ip’ on port 80 is different than on 443). Digging in to the port 80 proxy, when connecting over HTTP to any destiatnation on port 80, the proxy adds a ‘Via:’ header to the HTTP request. This includes a seemingly random but never changing ID which is formatted as a DNS name, although the specific subdomain does not exist. I suspect this is a unique identifier which identifies me as a subscriber uniquely for advertising purposes. It's also found that sending a valid HTTP response with an invalid HTTP status code number will cause the proxy to return an HTML page which says 503 Service Unavailable. I was not able to detect any modification of data, but again I have no idea if it may be modifying only certain sites / … Again, this is not my network, I am trying to understand why a network operator would interfere with their users in this way. Andrew

2 1

What are folks using for serial consoles these days?
by Dan Mahoney 25 Dec '25

25 Dec '25

Hey there folks. Dayjob has historically used USB TTY pods attached to real BSD machines to talk to our cisco consoles, with the amazing benefit that with a program like Vixie's rtty (or conserver) you can also capture the output of those consoles in real-time, and perhaps use that data to identify a connected device. As a bonus, because the rackmount devices have real DE-9's on them, it means they work with any kind of cable you get (not just your standard rj45 cisco rollover like you might get with a Cyclades thing -- and you don't have to come up with the weird-ass mappings for rj45-serial like you might need like our ME4012 NAS (the serial cable is a stereo plug), our smart power strips (it's either a stereo plug, or an rj12), or something like an older brocade switch (it's a DE9, but it's friggin ODD, and I think it may also be the wrong gender). It also means, since you're running a real OS, you have patches as long as the OS is supported (so you're not stuck with "gee it only speaks rsa1024"), versus some EOL appliance. But it's also 2u, and since we're recently buying a lot of Dell hardware, that's Super Overkill for a dell, so I'm evaluating maybe just going "Appliance". If we stick with an existing unix box for this, I'd want something with proper IPMI/OOB (so Rpi is out) but maybe the dumbest, shallowest-depth atom64 supermicro you can find, in the event you need to do a reinstall or catch a hung system. Are there things that other folks are using that are "easy" to work with that you've found to have Long firmware lives, decent warranties and low hassle? Does anything these days actually have DE9s on it? -Dan (You may have also seen my note earlier about the Cisco ASR920, which has RS232 pins in a USB-A header. No, not via a PL2032 chip inside the host that provides a virtual serial...direct txd/rxd/gnd/cts etc, on the USB pins. I've seen things you people would't believe)

26 46

Re: What do you consider acceptable packet / session modification for a network operator?
by Andrew 25 Dec '25

25 Dec '25

I’m talking about consumer ISPs, who are providing service to their paid customers. Not ‘managed’ business / edu / shared housing networks Andrew

1 0

Testing Out Of Band Management Tooling
by Andrew Latham 23 Dec '25

23 Dec '25

All Related to the Serial console topic I wanted to do a quick test. I hit a hiccup in my documentation and addressed it. Questions: A: How often should one do dry run testing on OOBM? B: How often should one call and confirm emergency numbers for remote vendor sites? C: How could Out Of Band Management equipment be monitored better in 2025? If you have other thoughts about questions, pop them in starting at D -- - Andrew "lathama" Latham -

5 4

NTP at NIST Boulder has lost power
by Anne Johnson 20 Dec '25

20 Dec '25

reposting from the Internet time service list jeff.s...(a)nist.gov <jeff.sherman(a)nist.gov>: Dec 19 05:18PM -0800 Dear colleagues, In short, the atomic ensemble time scale at our Boulder campus has failed due to a prolonged utility power outage. One impact is that the Boulder Internet Time Services no longer have an accurate time reference. At time of writing the Boulder servers are still available due a standby power generator, but I will attempt to disable them to avoid disseminating incorrect time. The affected servers are: time-a-b.nist.gov time-b-b.nist.gov time-c-b.nist.gov time-d-b.nist.gov time-e-b.nist.gov ntp-b.nist.gov (authenticated NTP) No time to repair estimate is available until we regain staff access and power. Efforts are currently focused on obtaining an alternate source of power so the hydrogen maser clocks survive beyond their battery backups. More details follow. Due to prolonged high wind gusts there have been a combination of utility power line damage and preemptive utility shutdowns (in the interest of wildfire prevention) in the Boulder, CO area. NIST's campus lost utility power Wednesday (Dec. 17 2025) around 22:23 UTC. At time of writing utility power is still off to the campus. Facility operators anticipated needing to shutdown the heat-exchange infrastructure providing air cooling to many parts of the building, including some internal networking closets. As a result, many of these too were preemptively shutdown with the result that our group lacks much of the monitoring and control capabilities we ordinarily have. Also, the site has been closed to all but emergency personnel Thursday and Friday, and at time of writing remains closed. At initial power loss, there was no immediate impact to the NIST atomic time scale or distribution services because the projects are afforded standby power generators. However, we now have strong evidence one of the crucial generators has failed. In the downstream path is the primary signal distribution chain, including to the Boulder Internet Time Service. Another campus building houses additional clocks backed up by a different power generator; if these survive it will allow us to re-align the primary time scale when site stability returns without making use of external clocks or reference signals. Best wishes, -Jeff Sherman project email: internet-time-service(a)nist.gov AnneJ (watching from Edinburgh, UK)

1 0