January 2026 - NANOG - lists.nanog.org

Correctly dealing with bots and scrapers.
by Andrew Latham 25 Mar '26

25 Mar '26

I just had an issue with a web-server where I had to block a /18 of a large scraper. I have some topics I could use some input on. 1. What tools or setups have people found most successful for dealing with bots/scrapers that do not respect robots.txt for example? 2. What tools for response rate limiting deal with bots/scrapers that cycle over a large variety of IPs with the exact same user agent? 3. Has anyone written or found a tool to concentrate IP addresses into networks for IPTABLES or NFT? (60% of IPs for network X in list so add network X and remove individual IP entries.) -- - Andrew "lathama" Latham -

18 33

RPKI's 2025 Year in Review
by Job Snijders 04 Mar '26

04 Mar '26

Dear all, Happy new year! Wanna know how RPKI evolved throughout 2025? Read on! :) In this memo I'll share some RPKI statistics, summarize highlights from the IETF Standards Development process, and reflect on emerging trends. Year to Year Growth of the distributed RPKI database =============================================================== A straight-forward method to compare 2024 and 2025 is to look at the absolute numbers. The below table was constructed using data collected by RPKIViews.org between January 1st, 2025 and December 31st, 2025 with the ARIN, AfriNIC, APNIC, LACNIC, and RIPE NCC Trust Anchors. EOY 2024 / EOY 2025 Snapshot differences: ----------------------------------------- 2024-12-31 2025-12-31 ( diff) Total validated cache size (KB): 767,245 923,058 (+ 20%) Total number of files (object count): 415,384 493,707 (+ 19%) Wall time validation run (seconds): 46 35 (- 23%) Wall time without outliner CA (seconds): 26 33 (+ 27%) Publication servers (FQDNs): 53 60 (+ 13%) Certification authorities: 44,935 49,721 (+ 11%) Route Origin Authorizations (ROAs): 280,692 344,209 (+ 23%) Uniq Validated ROA Payloads: 639,900 787,737 (+ 23%) Average ROAIPAddresses per ROA: 2.3 1.8 (- 22%) Unique origin ASNs in ROAs: 47,282 52,661 (+ 11%) IPv4 addresses covered: 2,726,513,768 2,783,187,105 (+ 2%) Uniq IPv4 addresses covered: 1,658,281,248 1,818,913,944 (+ 10%) IPv6 addresses covered: 17,392 * 10^30 18,684 * 10^30 (+ 7%) Uniq IPv6 addresses covered: 15,139 * 10^30 16,384 * 10^30 (+ 8%) Unique ASPA Customer ASIDs: 87 556 (+539%) The number of IP addresses covered by RPKI ROAs grew by 10%. This is similar to last year's report. However, ASPA object count absolutely skyrocketed in 2025! The "Uniq ASPA Customer ASIDs" field is a simple gauge counter for global ASPA deployment on the signer side. At the moment of writing, for about 0.5% of Autonomous Systems in the Internet global routing system an ASPA record is published. That's a very interesting development. The ability to publish ASPA objects became readily available [4] in the RIPE NCC region in 2025, and as of January 2026 also fully available through ARIN Online [5]. The "Wall time validation run (seconds)" metric is produced by revalidating the data contained in the two snapshots multiple times in a benchmark using the same modern multi-threaded RPKI cache implementation on the same 4 CPU core machine, without performing any network operations (i.e. offline validation mode). This metric relates to the hypothesis that as the RPKI grows (in size and number of objects), without also improving efficiency (information density), the overall processing time to validate the complete dataset will increase. This year's benchmark environment: Rpki-client 9.7, OpenSSL 3.5.4, Debian 13, on Intel Xeon. WITH EVERY RPKI CA, FIRST 2024 THEN 2025: $ hyperfine -w2 'rpki-client -p4 -P 1735689171 -n -d rpki-20241231T235251Z/data /tmp' Time (mean ± σ): 46.514 s ± 0.172 s [User: 173.345 s, System: 5.264 s] Range (min … max): 46.257 s … 46.756 s 10 runs $ hyperfine -w2 'rpki-client -p4 -P 1767225374 -n -d rpki-20251231T235614Z/data /tmp' Time (mean ± σ): 35.046 s ± 0.206 s [User: 125.092 s, System: 5.894 s] Range (min … max): 34.756 s … 35.444 s 10 runs FIRST 2024 THEN 2025, WITHOUT THE OUTLINER CA: 20241231T235251Z: Time (mean ± σ): 26.257 s ± 0.152 s [User: 92.878 s, System: 4.590 s] Range (min … max): 26.069 s … 26.485 s 10 runs 20251231T235614Z: Time (mean ± σ): 32.903 s ± 0.143 s [User: 117.059 s, System: 5.444 s] Range (min … max): 32.635 s … 33.127 s 10 runs This year the "wall time" metric _seemingly_ deflated... but, unfortunately, further sleuthing shows that the 2024 numbers were heavily skewed by the products issued by a specific large CA under ARIN, an outliner so to speak. In the 2024 snapshot that one CA had 50,125 Manifest entries and 15,944 CRL entries, while in the 2025 snapshot the same CA had 48,896 Manifest entries and only 33 CRL entries. The key observation here is that the impact of large CRLs becomes more pronounced with longer Manifests. In conclusion and discounting the products of that one outliner CA, overall processing time of the RPKI increased by 25%. [ Note: the wall time metric is not comparable between successive annual reports (for example, next year I might use a different computer, or use a different validator implementation) - but within the context of a single annual report the comparison between the snapshots is apples to apples! ] The "Average ROAIPAddresses per ROA" metric shows how many IP prefixes, on average, are contained within a single ROA object. The higher the number of ROAIPAddresses per ROA is, the higher computational efficiency likely is to be. "Efficiency" in this context is viewed as how many ROAIPAddress entries are packed together and signed with a single EE certificate. A higher number means more efficiency (and less RP bandwidth consumption) The RIPE NCC hosted CA system yields 6.6 prefixes per ROA, while the current ARIN and LACNIC approach result in only 1.1 and 1.3 prefixes per ROA, respectively (almost the worst possible case). APNIC and its community lead in efficiency with 8.2 per ROA. The impact that CA implementation choices have on the RPKI's scalability remains an area of concern: large CA operators (such as the RIRs) need to take special care when deciding on parameters such as ROAIPAddress packing and certificate validity periods, in order to curb uneconomical Manifest & CRL growth. Issuing RPKI objects aiming for high information density helps improve predictable delivery trajectories towards relying parties. Statistics on accumulating counters throughout the year: -------------------------------------------------------- The following statistics were produced using the RPKIViews 2024 Amalgamation [6] and RPKIViews 2025 Amalgamation [7] datasets. I believe these datasets to be a near complete collection of all signed RPKI data produced in those years. Almost every ROA! The objects in the Zenodo hosted archives can be inspected with "rpki-client -jf" (filemode). 2024 2025 Number of Rpkiviews snapshots produced: 64,923 90,523 (+ 39%) Newly discovered RPKI objects: 56,586,149 61,524,413 (+ 9%) Avg number of new objects per second: 1.79 1.98 (+ 10%) Median object size (bytes): 1,924 1,924 ( -) Mean object size (bytes): 2,193 2,531 (+ 15%) Cumulative size of all objects (KB): 121,211,067 152,094,584 (+ 25%) The above numbers can be used to better understand RPKI transport protocol efficiency. More on that next year! IETF SIDROPS - Working Group developments ========================================= Some fun updates from the IETF working group responsible for development and maintenance of the RPKI technology stack... *** SIDROPS ***. This RPKI-focused design & implementation group now operates with a new charter. The most significant change in modus operandi being that RFC publication now requires multiple implementations to exist and interoperate. Read the full charter here: https://datatracker.ietf.org/wg/sidrops/about/ ASPA - where we at? ------------------- Close to Working Group Last call! Depending our luck this might mean the specifications are published in late 2026. Word on the streets is that various commercial-off-the-shelf/hardware vendors are working on ASPA implementations, and a number of BGP open source projects already made ASPA verification implementations available to the wider public. Other (New) Work in SIDROPS --------------------------- 1/ A new scalable data synchronisation protocol called Erik Synchronisation is in the works. It is a HTTP-based protocol using Merkle trees, a content-addressable naming scheme, and concurrency control using monotonically increasing sequence numbers. https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-rpki-erik-protocol 2/ What MRT Tabledumps meant for researching BGP, is what CCR is intended to be for the RPKI. CCR (Canonical Cache Representation) is a new small and efficient binary file format to record validation outcomes and hash markers. https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-rpki-ccr SIDROPS Finished work --------------------- One new clarification RFC was published: * RFC 9829 - Handling of Resource Public Key Infrastructure (RPKI) Certificate Revocation List (CRL) Number Extensions https://www.rfc-editor.org/rfc/rfc9829.html Small Point On Housekeeping: ============================ The RPKIViews archive data collection approach and structure were revised at the start of 2026. A number of rpkiviews gatherer nodes now use a Tar+Zstandard spooling system to store raw data and associated snapshots in Canonical Cache Representation format. The changes in how RPKIviews data is stored should have a positive effect, meaning more snapshots can be gathered per hour while at the same time consuming less disk storage space than previously. I'm curious to see what this increase in data resolution might show us next year! Final words =============================================================== The RPKI remains an important tool in the toolbox to identify & prevent routing incidents. Deployment of RPKI allows operators to improve network reliability by strengthening the security and integrity of their interconnection with the global Internet routing system. The system is working pretty good and will continue to serve us well if special care is taken to continually monitor and optimize the RPKI's data packing practises & delivery methods. Kinds regards, Job Snijders ps. Shout out to Lee Hetherington, Matsuzaki "maz" Yoshinobu, Niels Bakker, Jeroen Lauwers, Jeroen Massar, Digital Ocean, and Tom Scholl for their help to the RPKIViews.org project. References: RPKIViews - http://www.rpkiviews.org/ https://dango.attn.jp/rpkidata/2024/12/31/rpki-20241231T235251Z.tgz https://josephine.sobornost.net/rpkidata/2025/12/31/rpki-20251231T235614Z.t… Last year's report: https://blog.apnic.net/2025/01/28/rpkis-2024-year-in-review/ 2023 report: https://labs.ripe.net/author/job_snijders/rpki-2023-review-growth-governmen… [4]: https://labs.ripe.net/author/tim_bruijnzeels/aspa-in-the-rpki-dashboard-a-n… [5]: https://www.arin.net/announcements/20260120/ [6]: Snijders, J., "RPKIViews 2024 Amalgamation". Zenodo. https://doi.org/10.5281/zenodo.18328474 [7]: Snijders, J., "RPKIViews 2025 Amalgamation". Zenodo. https://doi.org/10.5281/zenodo.18332099

15 25

What's up with BGP communities?
by Ronan Pigott 20 Feb '26

20 Feb '26

Hi, First off, apologies if I'm completely lost. I'm not a network professional of any kind, just a random with a question I can't find the answer to on the internet. Basically, I was poking around on this website called bgp.tools and many ASN have a page describing BGP communities known by the network, e.g. https://bgp.tools/communities/13335. It includes descriptions for each one: > 13335:10106 PoP: bos01 > 13335:10358 PoP: cwb03 > 13335:10712 PoP: den04 > 13335:10766 PoP: maa05 > 13335:10920 PoP: zrh02 > [...] I want to know, where does this supplementary information about the communities come from, in this case the "PoP: blah" bits? I don't think it is communicated by BGP directly, so is there some standard out of band mechanism to describe the communities? Or am I just ignorant of this BGP feature? The background is that I live in AZ, USA, and am I subscribed to Cox for my internet service. I noticed that my ping to "example.com" (literally) is slower on IPv6 compared to IPv4: $ ping -4 example.com PING example.com (104.18.27.120) 56(84) bytes of data. 64 bytes from 104.18.27.120: icmp_seq=1 ttl=251 time=9.58 ms 64 bytes from 104.18.27.120: icmp_seq=2 ttl=251 time=5.94 ms 64 bytes from 104.18.27.120: icmp_seq=3 ttl=251 time=7.76 ms 64 bytes from 104.18.27.120: icmp_seq=4 ttl=251 time=6.85 ms [...] $ ping -6 example.com PING example.com (2606:4700::6812:1b78) 56 data bytes 64 bytes from 2606:4700::6812:1b78: icmp_seq=1 ttl=57 time=20.0 ms 64 bytes from 2606:4700::6812:1b78: icmp_seq=2 ttl=57 time=19.0 ms 64 bytes from 2606:4700::6812:1b78: icmp_seq=3 ttl=57 time=20.8 ms 64 bytes from 2606:4700::6812:1b78: icmp_seq=4 ttl=57 time=19.8 ms [...] $ traceroute -IAen4 -z1 example.com traceroute to example.com (104.18.26.120), 30 hops max, 60 byte packets 1 10.3.0.254 [*] 0.249 ms 0.361 ms 0.362 ms 2 10.40.160.1 [*] 8.978 ms 8.658 ms 7.745 ms 3 100.127.73.232 [*] 6.957 ms 8.557 ms 6.881 ms 4 68.1.0.187 [AS22773] 8.067 ms 10.434 ms * 5 184.183.131.9 [AS22773] 13.818 ms 37.728 ms 17.832 ms 6 162.158.140.23 [AS13335] 16.822 ms 8.761 ms 16.768 ms 7 104.18.26.120 [AS13335] 8.813 ms 7.852 ms 9.451 ms $ traceroute -IAen6 -z1 example.com traceroute to example.com (2606:4700::6812:1b78), 30 hops max, 80 byte packets 1 2600:8800:1780:c000::1 [AS22773] 0.315 ms 0.360 ms 0.362 ms 2 2600:8800:17ff:ffff::1111 [AS22773] 6.601 ms 24.911 ms 9.655 ms 3 2001:578:800:6:8100::818 [AS22773] 31.164 ms 8.727 ms 9.075 ms 4 2001:578:900:4::2 [AS22773] 8.763 ms 7.661 ms 6.873 ms 5 2001:578:1:0:172:17:249:32 [AS22773] 29.991 ms 35.838 ms 19.517 ms 6 2001:578:20:a000::7:1 [AS22773] 21.781 ms 20.676 ms * 7 2400:cb00:12:3:: [AS13335] 20.474 ms 20.099 ms 19.824 ms 8 2606:4700::6812:1b78 [AS13335] 20.078 ms 19.747 ms 20.788 ms It's not really a problem, but still I just want to know... why? I thought it would be kind of odd to have example.com hosted only on IPv4 in the Phoenix area so I was trying to see if I could determine whether or not that was the case looking at https://bgp.tools/communities/13335?show-prefixes=13335%3a10066, but I think there just simply isn't enough information available online for me to find out. Thanks, Ronan

44 122

DSCP-45 - from Zayo, Hurricane Electric, Lumen
by Livingood, Jason 06 Feb '26

06 Feb '26

In support of IETF L4S and NQB dual queue low latency standards, Comcast (and other networks) have been actively deploying this technology. L4S uses ECN marks and, since ECN is rarely modified in packet headers, this generally works find across domain boundaries. The more challenging one is NQB, since this is predicated on the DSCP-45 mark crossing domain boundaries - and as I think we all know, network domains all implement DSCP differently and so tend to remark DSCP on ingress. Thus, to support NQB, a network will allow DSCP-45 at ingress and classify the traffic as best effort (like default internet traffic). Comcast has done so and we have >10M homes with dual queue (aka Low Latency DOCSIS, a DOCSIS implementation of L4S and NQB). The volume of DSCP-45 traffic is beginning to grow, so we have started to look at traffic sources as we quantify improvements in application quality of experience (e.g., lower loaded latency and lower jitter). Apart from the expected sources we have observed double digit Mbps (far <1% of DSCP-45 volume) - from Zayo, Hurricane Electric, and Lumen. If you run one of those networks, you may want to look at the source of DSCP-45 traffic to ensure your DSCP policies are squared away. Feel free to ping me for more information if you have any questions. Thanks Jason For more info: 1. TSV NQB draft is in the publishing queue (https://datatracker.ietf.org/doc/draft-ietf-tsvwg-nqb/) 2. In support of this, IANA have entered DSCP code point 45 into their registry (https://www.iana.org/assignments/dscp-registry/dscp-registry.xhtml)

2 1

NANOG 96 - Where to Watch + Community Meeting, Pickleball + SF Fun Facts!
by Nanog News 30 Jan '26

30 Jan '26

*** NANOG 96 - Where to Watch* ------------------------------------------------------------ *Whether you’re Joining us in San Francisco or Tuning in from Anywhere in the World, N96 is Easy to Watch Live* *In-Person Attendees* You must be signed in to view the webcast. Consult the daily agenda to master the art of being in two places at once. *Virtual Attendees* Can’t make it to San Francisco? No problem. Registered virtual attendees can stream sessions live via the NANOG online platform, accessible through your NANOG account. Log in, grab your coffee, and join the conversation in real time. *Pro tip: *Live sessions mean live Q&A. Bring your questions. The Internet was built by people who asked good ones. *WHERE TO WATCH* (https://nanog.org/events/nanog-96/watch-n96-webcast/) *** Stay in the Know: Don't Miss the N96 Community Meeting!* ------------------------------------------------------------ *Join Us Monday at 2:45 pm in the Grand Ballroom* This is your opportunity to hear about what is happening within the NANOG organization and the various NANOG Committees. *** NANOG 96 is Active* ------------------------------------------------------------ *Stimulate Your Brain by Moving Your Body!* Get moving with NANOG next week during the conference! 🏃‍♂️🎾🧘‍♀️ *• Run Club: *6:45–7:45 am. Meet by the large sponsor banner in Grand Ballroom Foyer. Depending on how many show up, we might have a couple of groups at different paces and distances. Typically, we have one group aiming for 3 miles (5 km) in 30 mins. *• Pickleball: *7 am @ East Cut Crossing. Games will start at 7 am. Meet in the hotel lobby at 6:45 am, or at the courts at 7 am. *• Yoga:* 7:30–8:15 am (mats provided)! Meet in Pacific M on the Pacific Concourse Level of the Hyatt. *Specific meeting locations and details are located on the daily agenda.* *AGENDA* (https://nanog.org/events/nanog-96/agenda/) *** Fun Facts About San Francisco, Home of NANOG 96 Location!* ------------------------------------------------------------ *Attendee Icebreakers & Fun Facts About Our NANOG Host City* Here are some fun facts that may surprise even the most seasoned San Francisco visitor. Go ahead, introduce yourself to another NANOG attendee with a fun fact about the city. These tidbits of knowledge are much more intriguing than talking about the weather. *READ MORE* ( https://nanog.org/stories/nanog-96-san-francisco-fun-facts-about-our-next-n… ) *** Stay Connected* ------------------------------------------------------------ http://www.facebook.com http://www.instagram.com/nanog_org/ http://www.linkedin.com/company/nanog/ https://www.twitter.com/nanog/ http://nanog.org

1 0

Weekly Global IPv4 Routing Table Report
by Routing Table Analysis Role Account 30 Jan '26

30 Jan '26

This is an automated weekly mailing describing the state of the Global IPv4 Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG UKNOF, TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net. For historical data, please see https://thyme.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. IPv4 Routing Table Report 04:00 +10GMT Sat 31 Jan, 2026 IPv4 BGP Table (Global) as seen at Japan. Report Website: https://thyme.apnic.net Detailed Analysis: https://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 1030983 Prefixes after maximum aggregation (per Origin AS): 396131 Deaggregation factor: 2.60 Unique aggregates announced (without unneeded subnets): 507975 Number of IPv4 prefixes with a valid ROA: 610651 Number of IPv4 prefixes with an invalid ROA: 1435 Number of IPv4 prefixes with no ROA: 418897 Total ASes present in the Internet Routing Table: 77844 Prefixes per ASN: 13.24 Origin-only ASes present in the Internet Routing Table: 66880 Origin ASes announcing only one prefix: 27218 Transit ASes present in the Internet Routing Table: 10964 Transit-only ASes present in the Internet Routing Table: 545 Average AS path length visible in the Internet Routing Table: 4.7 Max AS path length visible: 209 Max AS path prepend of ASN (214570) 200 Prefixes from unregistered ASNs in the Routing Table: 1058 Number of instances of unregistered ASNs: 1097 Number of 32-bit ASNs allocated by the RIRs: 48540 Number of 32-bit ASNs visible in the Routing Table: 39739 Prefixes from 32-bit ASNs in the Routing Table: 221229 Number of bogon 32-bit ASNs visible in the Routing Table: 120 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 459 Number of addresses announced to Internet: 3106721920 Equivalent to 185 /8s, 44 /16s and 208 /24s Percentage of available address space announced: 83.9 Percentage of allocated address space announced: 83.9 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.6 Total number of prefixes smaller than registry allocations: 335870 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 281351 Total APNIC prefixes after maximum aggregation: 82465 APNIC Deaggregation factor: 3.41 Prefixes being announced from the APNIC address blocks: 267587 Unique aggregates announced from the APNIC address blocks: 107029 APNIC Region origin ASes present in the Internet Routing Table: 15049 APNIC Prefixes per ASN: 17.78 APNIC Region origin ASes announcing only one prefix: 4613 APNIC Region transit ASes present in the Internet Routing Table: 1984 Average APNIC Region AS path length visible: 4.8 Max APNIC Region AS path length visible: 35 Number of APNIC region 32-bit ASNs visible in the Routing Table: 10597 Number of APNIC addresses announced to Internet: 754874368 Equivalent to 44 /8s, 254 /16s and 120 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-155961 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 302820 Total ARIN prefixes after maximum aggregation: 135686 ARIN Deaggregation factor: 2.23 Prefixes being announced from the ARIN address blocks: 302437 Unique aggregates announced from the ARIN address blocks: 146295 ARIN Region origin ASes present in the Internet Routing Table: 19389 ARIN Prefixes per ASN: 15.60 ARIN Region origin ASes announcing only one prefix: 7071 ARIN Region transit ASes present in the Internet Routing Table: 1920 Average ARIN Region AS path length visible: 4.3 Max ARIN Region AS path length visible: 28 Number of ARIN region 32-bit ASNs visible in the Routing Table: 5447 Number of ARIN addresses announced to Internet: 1343591168 Equivalent to 80 /8s, 21 /16s and 147 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-402332 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 54/8, 55/8, 56/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 283052 Total RIPE prefixes after maximum aggregation: 140058 RIPE Deaggregation factor: 2.02 Prefixes being announced from the RIPE address blocks: 285166 Unique aggregates announced from the RIPE address blocks: 185168 RIPE Region origin ASes present in the Internet Routing Table: 29165 RIPE Prefixes per ASN: 9.78 RIPE Region origin ASes announcing only one prefix: 12100 RIPE Region transit ASes present in the Internet Routing Table: 3983 Average RIPE Region AS path length visible: 4.8 Max RIPE Region AS path length visible: 209 Number of RIPE region 32-bit ASNs visible in the Routing Table: 12962 Number of RIPE addresses announced to Internet: 733645440 Equivalent to 43 /8s, 186 /16s and 138 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-216475 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 53/8, 57/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 126253 Total LACNIC prefixes after maximum aggregation: 30295 LACNIC Deaggregation factor: 4.17 Prefixes being announced from the LACNIC address blocks: 122121 Unique aggregates announced from the LACNIC address blocks: 49455 LACNIC Region origin ASes present in the Internet Routing Table: 11353 LACNIC Prefixes per ASN: 10.76 LACNIC Region origin ASes announcing only one prefix: 2694 LACNIC Region transit ASes present in the Internet Routing Table: 2530 Average LACNIC Region AS path length visible: 5.4 Max LACNIC Region AS path length visible: 69 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 9355 Number of LACNIC addresses announced to Internet: 170930176 Equivalent to 10 /8s, 48 /16s and 48 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-275868 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 36449 Total AfriNIC prefixes after maximum aggregation: 6942 AfriNIC Deaggregation factor: 5.25 Prefixes being announced from the AfriNIC address blocks: 53213 Unique aggregates announced from the AfriNIC address blocks: 19638 AfriNIC Region origin ASes present in the Internet Routing Table: 2016 AfriNIC Prefixes per ASN: 26.40 AfriNIC Region origin ASes announcing only one prefix: 740 AfriNIC Region transit ASes present in the Internet Routing Table: 387 Average AfriNIC Region AS path length visible: 5.3 Max AfriNIC Region AS path length visible: 53 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 1378 Number of AfriNIC addresses announced to Internet: 103397888 Equivalent to 6 /8s, 41 /16s and 186 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 13700 8945 102 CHINAMOBILE-CN China Mobile Communication 7545 6021 833 571 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 5031 4193 77 ERX-CERNET-BKB China Education and Resear 9498 4735 544 339 BBIL-AP BHARTI Airtel Ltd., IN 7552 4037 1332 29 VIETEL-AS-AP Viettel Group, VN 7713 3729 1044 65 TELKOMNET-AS-AP PT Telekomunikasi Indones 56046 3422 831 184 CMNET-JIANGSU-AP China Mobile communicati 45899 3330 1868 98 VNPT-AS-VN VNPT Corp, VN 17561 3129 196 619 LCS-AS-AP LARUS Limited, HK 24560 2967 865 497 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd., Complete listing at https://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 14089 38850 5518 AMAZON-02 - Amazon.com, Inc., US 22773 4780 3116 367 ASN-CXA-ALL-CCI-22773-RDC - Cox Communica 11492 4637 308 1020 CABLEONE - CABLE ONE, INC., US 7155 3858 286 85 VIASAT-SP-BACKBONE - ViaSat,Inc., US 6327 3699 1321 71 SHAW - Shaw Communications, CA 174 3661 8768 856 COGENT-174 - Cogent Communications, LLC, 396982 3322 4866 496 GOOGLE-CLOUD-PLATFORM - Google LLC, US 749 3142 54728 2393 DNIC-AS-00749 - United States Department 16625 2817 1209 2121 AKAMAI-AS - Akamai Technologies, Inc., US 36352 2704 222 893 AS-COLOCROSSING - HostPapa, US Complete listing at https://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 7241 1711 149 UNI2-AS, ES 39891 4901 302 71 ALJAWWALSTC-AS, SA 9009 3905 365 2230 M247, RO 20940 3818 3393 112 AKAMAI-ASN1, NL 12389 3179 2318 869 ROSTELECOM-AS PJSC Rostelecom. Technical 212238 2557 182 1856 CDNEXT, GB 34984 2434 366 578 TELLCOM-AS, TR 8452 1711 1852 14 TE-AS TE-AS, EG 13188 1607 100 27 TRIOLAN, UA 203020 1592 241 767 HOSTROYALE, IN Complete listing at https://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 12637 3295 619 UNINET, MX 10620 3445 457 1107 Telmex Colombia S.A., CO 13999 2482 506 350 Mega Cable, S.A. de C.V., MX 11830 1990 369 65 Instituto Costarricense de Electricidad y 11664 1384 278 33 Techtel LMDS Comunicaciones Interactivas 28573 1375 2430 272 Claro NXT Telecomunicacoes Ltda, BR 3816 1339 770 213 COLOMBIA TELECOMUNICACIONES S.A. ESP BIC, 6147 1257 371 22 INTEGRATEL PERU S.A.A., PE 22884 1056 67 358 TOTAL PLAY TELECOMUNICACIONES SA DE CV, M 26615 1007 2486 57 TIM SA, BR Complete listing at https://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24835 1983 646 33 RAYA-AS, EG 36992 1843 1532 339 ETISALAT-MISR, EG 24863 1282 389 16 LINKdotNET-AS, EG 36903 1232 555 98 MT-MPLS, MA 36935 1146 524 47 Vodafone-, EG 37069 1117 1112 11 MOBINIL, EG 29571 1070 78 20 ORANGE-COTE-IVOIRE, CI 20011 580 154 212 NTT-DATA-Inc, ZA 328608 573 49 167 Africa-on-Cloud-AS, ZA 36914 569 82 3 KENET-AS, KE Complete listing at https://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 14089 38850 5518 AMAZON-02 - Amazon.com, Inc., US 9808 13700 8945 102 CHINAMOBILE-CN China Mobile Communication 8151 12637 3295 619 UNINET, MX 12479 7241 1711 149 UNI2-AS, ES 7545 6021 833 571 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 5031 4193 77 ERX-CERNET-BKB China Education and Resear 39891 4901 302 71 ALJAWWALSTC-AS, SA 22773 4780 3116 367 ASN-CXA-ALL-CCI-22773-RDC - Cox Communica 9498 4735 544 339 BBIL-AP BHARTI Airtel Ltd., IN 11492 4637 308 1020 CABLEONE - CABLE ONE, INC., US Complete listing at https://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 9808 13700 13598 CHINAMOBILE-CN China Mobile Communications Grou 8151 12637 12018 UNINET, MX 12479 7241 7092 UNI2-AS, ES 7545 6021 5450 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 5031 4954 ERX-CERNET-BKB China Education and Research Net 39891 4901 4830 ALJAWWALSTC-AS, SA 22773 4780 4413 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 9498 4735 4396 BBIL-AP BHARTI Airtel Ltd., IN 7552 4037 4008 VIETEL-AS-AP Viettel Group, VN 7155 3858 3773 VIASAT-SP-BACKBONE - ViaSat,Inc., US Complete listing at https://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 393266 UNALLOCATED 8.23.52.0/24 46887 CROWNCASTLE-AS46887 - C 396894 UNALLOCATED 8.28.201.0/24 3356 LEVEL3 - Level 3 Parent 394936 UNALLOCATED 8.33.224.0/24 22442 HOU-PHONOSCOPE - Phonos 395195 UNALLOCATED 8.38.115.0/24 3356 LEVEL3 - Level 3 Parent 1782 UNALLOCATED 8.42.19.0/24 3356 LEVEL3 - Level 3 Parent 13342 UNALLOCATED 12.17.5.0/24 174 COGENT-174 - Cogent Com 26345 UNALLOCATED 12.21.93.0/24 40264 TWC-40264-WI-MN-UPPERMI 396831 UNALLOCATED 12.23.198.0/24 7018 ATT-INTERNET4 - AT&T En 395476 UNALLOCATED 12.36.194.0/24 7018 ATT-INTERNET4 - AT&T En 395476 UNALLOCATED 12.36.195.0/24 3356 LEVEL3 - Level 3 Parent Complete listing at https://thyme.apnic.net/current/data-badAS Prefixes from the Special Purpose Address Registry (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE - Hurricane Electric LLC, US Complete listing at https://thyme.apnic.net/current/data-spar Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.137.48.0/24 Origin: 16904 ARVIG-16904 - Arvig Enterprises Inc., US 23.137.48.0/24 Transit: 3257 GTT-BACKBONE GTT, US 23.137.200.0/24 Origin: 16276 OVH, FR 23.137.200.0/24 Transit: 2516 KDDI KDDI CORPORATION, JP 23.140.216.0/24 Origin: 27176 DATAWAGON - DataWagon LLC, US 23.140.216.0/24 Transit: 20278 NEXEON - Nexeon Technologies, Inc., US 23.141.0.0/24 Origin: 395350 RESERVED, ZZ 23.141.0.0/24 Transit: 11426 TWC-11426-CAROLINAS - Charter Communicat 23.142.24.0/24 Origin: 62164 HEYMMAN-2, CA 23.142.24.0/24 Transit: 64236 UNREAL-SERVERS - UnReal Servers, LLC, US Complete listing at https://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:14 /10:40 /11:93 /12:302 /13:580 /14:1195 /15:2088 /16:13727 /17:8338 /18:13588 /19:25082 /20:46034 /21:52783 /22:113892 /23:106531 /24:645997 /25:683 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 8151 6817 12637 UNINET, MX 12479 6169 7241 UNI2-AS, ES 39891 3651 4901 ALJAWWALSTC-AS, SA 11492 3497 4637 CABLEONE - CABLE ONE, INC., US 6327 3479 3699 SHAW - Shaw Communications, CA 22773 3050 4780 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc., US 7155 2817 3858 VIASAT-SP-BACKBONE - ViaSat,Inc., US 16509 2509 14089 AMAZON-02 - Amazon.com, Inc., US 30036 2315 2660 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom Communications Corp, US 10620 2225 3445 Telmex Colombia S.A., CO Complete listing at https://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1846 2:1523 3:984 4:9 5:5039 6:185 7:6 8:1529 9:15 11:172 12:1227 13:616 14:2672 15:419 16:179 17:392 18:918 20:597 21:4 22:188 23:8141 24:2627 25:2 27:2740 29:19 31:3435 32:32 34:81 35:294 36:4649 37:4516 38:10333 39:1260 40:439 41:4535 42:964 43:2915 44:415 45:19715 46:4929 47:403 48:38 49:2193 50:2050 51:599 52:1255 54:238 55:1130 56:11 57:316 58:2227 59:1423 60:1174 61:3122 62:3105 63:1768 64:6203 65:2105 66:6027 67:3254 68:1495 69:4205 70:1036 71:617 72:3088 74:2976 75:1510 76:599 77:2698 78:1930 79:1805 80:2321 81:2162 82:4026 83:1468 84:2025 85:3701 86:1104 87:2397 88:1344 89:4655 90:823 91:8408 92:2865 93:3005 94:4320 95:4556 96:1449 97:314 98:950 99:782 100:69 101:1511 102:4381 103:32316 104:5405 105:794 106:919 107:2836 108:1232 109:4198 110:2305 111:4128 112:3129 113:1706 114:2176 115:2239 116:2162 117:3375 118:2501 119:2111 120:2698 121:1572 122:2966 123:2299 124:1686 125:2990 126:125 128:1661 129:947 130:1573 131:2341 132:777 133:461 134:1628 135:543 136:1633 137:1417 138:2959 139:1610 140:1828 141:1567 142:2478 143:2164 144:1596 145:628 146:2203 147:2273 148:2785 149:2952 150:1315 151:2671 152:2302 153:893 154:9691 155:2293 156:4586 157:2235 158:1510 159:2757 160:3650 161:2000 162:4040 163:2334 164:1970 165:2640 166:1291 167:2215 168:3947 169:910 170:5487 171:1115 172:4566 173:3443 174:892 175:1339 176:3779 177:4753 178:4372 179:2293 180:2972 181:4398 182:3913 183:2613 184:2011 185:21697 186:5552 187:4857 188:4607 189:4469 190:9677 191:1535 192:11480 193:9514 194:7837 195:5655 196:3242 197:3240 198:6231 199:6104 200:8195 201:6391 202:10819 203:10557 204:4731 205:3786 206:4457 207:3972 208:4359 209:5475 210:5009 211:2785 212:4972 213:4033 214:1077 215:54 216:7144 217:3473 218:1664 219:591 220:2185 221:1312 222:1074 223:3300 End of report

1 0

Input on the scope of review of MANRS Actions
by Andrei Robachevsky 30 Jan '26

30 Jan '26

Hi, To ensure that the MANRS Actions continue to serve their purpose effectively, MANRS (https://manrs.org) has launched a community survey to gather input on whether a future review of the MANRS Actions is needed — and, if so, what its scope and priorities should be. Your input is crucial, and it only takes 2 minutes to complete. The survey is available here: https://www.surveymonkey.com/r/JG22RHK More details about this particular effort: https://manrs.org/2026/01/help-shape-the-future-of-manrs-actions-community-… More information about the MANRS programs: https://manrs.org/programs/ Thank you for your input Regards, Andrei Robachevsky MANRS Secretariat

1 0

Sorry, a short rant about Digital Realty, Hivelocity and 350 E. Cermak
by John Palmer 30 Jan '26

30 Jan '26

So, it looks like Hivelocity sold their data center at 350 E Cermak to Digital Realty. I guess DR is getting into the business of actually running data centers (Althogh Telx's name is all over the paperwork). We have some servers colocated at this data center. We received no notice of this transfer either by e-mail or on paper. The only notice we got was an invoice. I spent 2 weeks trying to contact them and they never responded to my e-mail until a few days ago. Seems that their outbound MTA is incapable of delivering e-mail to our MTA, which is located AT THEIR DATA CENTER at 350 E Cermak. When I finally got in touch with them after trying for 2 weeks, it appears that 1) They have no online customer management portal (or are not giving us access to it), 2) They don't take credit cards and require a check or wire transfer (so 1960's) and 3) As I said, their MTA seems incapable of communicating with another MTA in THEIR DATA CENTER. Has anyone else had problems with them related to this transfer from Hivelocity? I think Hivelocity sold them their Miami data center as well. Hoping their service gets better soon. My suspicion is that they didn't plan the transition from Hivelocity very well and are scrambling to fix the issues.

11 15

BGP Security Intelligence Platform – Feedback Requested
by bogdancyber 28 Jan '26

28 Jan '26

Hi all, I’ve developed a tool called the BGP Security Intelligence Platform, which provides predictive routing-risk intelligence by analyzing origin-side ASN vulnerability and prefix-level structural risk across the global Internet. The platform continuously collects and processes live BGP control-plane data, RPKI validation, IRR records, CAIDA AS relationships, and multi-source prefix visibility measurements. Using this, it produces a ranked list of high-risk ASN–prefix combinations, highlighting where malformed or malicious announcements are most likely to propagate in practice. Key features and capabilities include: - Global ASN origin-side vulnerability scoring - Prefix structural risk analytics - Combined ASN–prefix risk ranking with ML-based classification - Real-world propagation and permissiveness modeling - Continuous intelligence generation for operators and security teams - Actionable outputs to prioritize filtering, mitigation, and routing-policy decisions The full article and partial excerpts from the tool are available here: https://zenodo.org/records/18407267 DOI: https://doi.org/10.5281/zenodo.18407267 **Note:** The Zenodo upload **does not include the full tool code**, only selected excerpts. Some data and parts of the code are extremely sensitive and cannot be made public. I am happy to share additional details privately upon request. Also, all files are copyrighted. I’m seeking feedback from experienced operators and engineers on: 1) Whether this tool would be useful in real-world BGP operations, does it have any value 2) Who in the community might benefit most from using it 3) Any suggestions for improvements or additional metrics to include (I was recommended to add ASPA and OTC in the future) Thank you very much for your time and insights. Best regards, Bogdan Pantelimon

2 2

The web beneath our waves - undersea cables book
by Suresh Ramasubramanian 28 Jan '26

28 Jan '26

I just realised that this book my old friend Samanth Subramanian was working on came out last year. Been a long time since the last book I heard of on this subject. https://lareviewofbooks.org/article/power-hangs-by-a-literal-thread/ --srs

5 7