July 2026 - NANOG - lists.nanog.org

How long AS-PATH policies have you used
by Saku Ytti 20 Oct '26

20 Oct '26

We've had problems in various NOS in generating large prefix-lists. In absolute configuration size, as well as prefix-set sizes. I'd like to hear about operational experiences, how long AS-PATH policies people have successfully run and in which NOS. I am not interested in exact AS_PATH contents, I am only interested that it contains a named set of AS numbers, in any order and any repetition. In Junos speak ^[1 42 500 1212]*$ How many ASN can I iterate, before I become market leading and have to work with vendors to fix bugs? The interest is because of RPKI we could get rid of prefix-lists, but we might still want to verify AS_PATH. Consider AS-YTTI having AS43792. a) They advertise google with invalid origin b) They advertise google with valid origin Maybe these come from some BGP optimization tool they run. A) is dropped by RPKI, B) is passed. But B) can be dropped by prefix-list filter or AS-PATH filter which doesn't allow Google ASN to exist in the AS_PATH. So I don't really need to check the prefix again, after it passed RPKI. AS_PATH check is equally strong. -- ++ytti

7 32

twitch contact?
by Bryan Holloway 09 Sep '26

09 Sep '26

If anyone from Twitch is lurking, could you please reach out to me off-list to resolve a long-standing peering issue? Thank you!

2 2

IS-IS Flat Network Size
by ttaggart＠kingcounty.gov 07 Aug '26

07 Aug '26

Hello, I'm wondering what some practical/real experiences have been with building out a large flat IS-IS network. I've read a lot of threads on conjecture and older docs on what the vendors recommend but haven't found anything yet or real world examples. Two questions, 1) Is anyone running a flat IS-IS L2 network with approx 300 routers? If not, what is the higher end you've seen? 2) On aggregation routers, what is the upper end of IS-IS adj to downstream routers? Would agg routers with approx 100 connections be an issue moving to IS-IS with the addition of keeping track of that many adj? Thanks.

9 15

Carpet bombing, what's it look like now
by Mike Hammett 01 Aug '26

01 Aug '26

The single destination case is easy enough. You RTBH the /32, renumber the customer, and move on. Carpet bombing takes that option away, since there's nowhere to move anyone to and nothing crosses a per-host threshold to trigger on in the first place. I'm curious what it actually looks like for those of you dealing with it regularly. Everything I've read says ports and packet sizes are randomized wide enough now that signature matching isn't worth much, though I'd rather hear that from someone watching it happen than from a vendor report. Does destination prefix plus protocol and port still get you something tight enough to act on, and if so, how many rules do you end up carrying mid-attack? Somewhat related, does packet length matching actually work on your hardware? I've been reminded lately that documented and functional aren't always the same thing. What are you feeding detection with, and does it keep up? sFlow, IPFIX, port mirror, something else. With attacks routinely over inside a couple of minutes I'm not convinced sampled telemetry is fast enough to matter, and I'd like to know whether people are installing rules after the thing already ended. If you're sampling, has any ratio worked well enough that the low per-host rates of a carpet bomb still trip an aggregate threshold in time to act? The other half of this is lifecycle. How long do you leave rules installed, and what tells you it's safe to pull them? Pull too early and you re-detect the same attack. Leave them in and you're carrying stale state indefinitely. Once you've got a signature, what do you actually do with it? Drop outright, rate limit, or hand it to a scrubber? I'd expect that to track how confident you are that nothing legitimate matches, but I'm curious where people really draw those lines. Our bar is customers not noticing rather than stopping every packet, and those turn out to be different targets. What's everyone doing for v6? Flowspec support looks thin enough there that a carpet bomb against v6 space puts you back to blackholing hosts one at a time. Separate question: is anyone pairing FastNetMon or similar detection with a self-hosted scrubber like VPP or Gatekeeper, rather than handing the traffic off to a provider? Interested in the outbound direction as well, catching a compromised customer before the traffic leaves. If you do answer, rough network size helps. Forty rules at 10G and forty rules at 1T aren't the same finding. ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP

4 10

Weekly Global IPv4 Routing Table Report
by Routing Table Analysis Role Account 31 Jul '26

31 Jul '26

This is an automated weekly mailing describing the state of the Global IPv4 Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG UKNOF, TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net. For historical data, please see https://thyme.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. IPv4 Routing Table Report 04:00 +10GMT Sat 01 Aug, 2026 IPv4 BGP Table (Global) as seen at Japan. Report Website: https://thyme.apnic.net Detailed Analysis: https://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 1065956 Prefixes after maximum aggregation (per Origin AS): 408663 Deaggregation factor: 2.61 Unique aggregates announced (without unneeded subnets): 526257 Number of IPv4 prefixes with a valid ROA: 718950 Number of IPv4 prefixes with an invalid ROA: 1697 Number of IPv4 prefixes with no ROA: 345309 Total ASes present in the Internet Routing Table: 78975 Prefixes per ASN: 13.50 Origin-only ASes present in the Internet Routing Table: 67847 Origin ASes announcing only one prefix: 27685 Transit ASes present in the Internet Routing Table: 11128 Transit-only ASes present in the Internet Routing Table: 604 Average AS path length visible in the Internet Routing Table: 4.7 Max AS path length visible: 69 Max AS path prepend of ASN (269326) 61 Prefixes from unregistered ASNs in the Routing Table: 1286 Number of instances of unregistered ASNs: 1328 Number of 32-bit ASNs allocated by the RIRs: 50656 Number of 32-bit ASNs visible in the Routing Table: 41235 Prefixes from 32-bit ASNs in the Routing Table: 236275 Number of bogon 32-bit ASNs visible in the Routing Table: 118 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 498 Number of addresses announced to Internet: 3120141312 Equivalent to 185 /8s, 249 /16s and 148 /24s Percentage of available address space announced: 84.3 Percentage of allocated address space announced: 84.3 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.6 Total number of prefixes smaller than registry allocations: 348654 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 292200 Total APNIC prefixes after maximum aggregation: 84766 APNIC Deaggregation factor: 3.45 Prefixes being announced from the APNIC address blocks: 278124 Unique aggregates announced from the APNIC address blocks: 108919 APNIC Region origin ASes present in the Internet Routing Table: 15320 APNIC Prefixes per ASN: 18.15 APNIC Region origin ASes announcing only one prefix: 4744 APNIC Region transit ASes present in the Internet Routing Table: 2025 Average APNIC Region AS path length visible: 4.7 Max APNIC Region AS path length visible: 37 Number of APNIC region 32-bit ASNs visible in the Routing Table: 10898 Number of APNIC addresses announced to Internet: 749468288 Equivalent to 44 /8s, 171 /16s and 250 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-155961 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 308029 Total ARIN prefixes after maximum aggregation: 138215 ARIN Deaggregation factor: 2.23 Prefixes being announced from the ARIN address blocks: 306502 Unique aggregates announced from the ARIN address blocks: 150317 ARIN Region origin ASes present in the Internet Routing Table: 19488 ARIN Prefixes per ASN: 15.73 ARIN Region origin ASes announcing only one prefix: 7143 ARIN Region transit ASes present in the Internet Routing Table: 1913 Average ARIN Region AS path length visible: 4.3 Max ARIN Region AS path length visible: 35 Number of ARIN region 32-bit ASNs visible in the Routing Table: 5707 Number of ARIN addresses announced to Internet: 1348451072 Equivalent to 80 /8s, 95 /16s and 187 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-404380 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 54/8, 55/8, 56/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 296127 Total RIPE prefixes after maximum aggregation: 146444 RIPE Deaggregation factor: 2.02 Prefixes being announced from the RIPE address blocks: 300631 Unique aggregates announced from the RIPE address blocks: 195869 RIPE Region origin ASes present in the Internet Routing Table: 29665 RIPE Prefixes per ASN: 10.13 RIPE Region origin ASes announcing only one prefix: 12278 RIPE Region transit ASes present in the Internet Routing Table: 4027 Average RIPE Region AS path length visible: 4.8 Max RIPE Region AS path length visible: 34 Number of RIPE region 32-bit ASNs visible in the Routing Table: 13667 Number of RIPE addresses announced to Internet: 749575552 Equivalent to 44 /8s, 173 /16s and 157 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-219547 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 53/8, 57/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 130608 Total LACNIC prefixes after maximum aggregation: 31393 LACNIC Deaggregation factor: 4.16 Prefixes being announced from the LACNIC address blocks: 125089 Unique aggregates announced from the LACNIC address blocks: 51070 LACNIC Region origin ASes present in the Internet Routing Table: 11470 LACNIC Prefixes per ASN: 10.91 LACNIC Region origin ASes announcing only one prefix: 2779 LACNIC Region transit ASes present in the Internet Routing Table: 2601 Average LACNIC Region AS path length visible: 5.3 Max LACNIC Region AS path length visible: 69 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 9544 Number of LACNIC addresses announced to Internet: 168412416 Equivalent to 10 /8s, 9 /16s and 197 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-275868 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 37706 Total AfriNIC prefixes after maximum aggregation: 7117 AfriNIC Deaggregation factor: 5.30 Prefixes being announced from the AfriNIC address blocks: 55112 Unique aggregates announced from the AfriNIC address blocks: 19657 AfriNIC Region origin ASes present in the Internet Routing Table: 2055 AfriNIC Prefixes per ASN: 26.82 AfriNIC Region origin ASes announcing only one prefix: 741 AfriNIC Region transit ASes present in the Internet Routing Table: 385 Average AfriNIC Region AS path length visible: 5.3 Max AfriNIC Region AS path length visible: 54 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 1419 Number of AfriNIC addresses announced to Internet: 103957248 Equivalent to 6 /8s, 50 /16s and 67 /24s AfriNIC AS Blocks 36864-37887, 327680-330751 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 14184 8921 101 CHINAMOBILE-CN - China Mobile Communicati 7545 5837 818 450 TPG-INTERNET-AP - TPG Telecom Limited, AU 4538 5067 4192 74 ERX-CERNET-BKB - China Education and Rese 9498 5060 558 341 BBIL-AP - BHARTI Airtel Ltd., IN 18403 4615 347 24 FPT-VN - FPT Telecom Company, VN 7552 4023 1331 24 VIETEL-AS-AP - Viettel Group, VN 7713 3763 1044 63 telkomnet-as-ap - PT Telekomunikasi Indon 17561 3680 231 642 LCS-AS-AP - LARUS Limited, HK 56046 3588 887 179 CMNET-Jiangsu-AP - China Mobile communica 45899 3400 1868 99 VNPT-AS-VN - VNPT Corp, VN Complete listing at https://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 15642 41524 5648 AMAZON-02 - Amazon.com, Inc., US 22773 4801 3174 371 ASN-CXA-ALL-CCI-22773-RDC - Cox Communica 11492 4616 306 1124 CABLEONE - CABLE ONE, INC., US 7155 3989 286 111 VIASAT-SP-BACKBONE - ViaSat,Inc., US 6327 3727 1305 75 SHAW - Shaw Communications, CA 396982 3450 4878 540 GOOGLE-CLOUD-PLATFORM - Google LLC, US 36352 3189 238 1118 AS-COLOCROSSING - HostPapa, US 749 3135 54727 2386 DNIC-AS-00749 - United States Department 7029 2712 2535 879 WINDSTREAM - Windstream Communications LL 30036 2551 357 551 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom C Complete listing at https://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 7016 1711 150 UNI2-AS - Orange Espagne SA, ES 39891 4907 302 76 ALJAWWALSTC-AS - Saudi Telecom Company JS 9009 4194 379 2572 M247 - M247 Europe SRL, RO 20940 3809 3389 109 AKAMAI-ASN1 - Akamai International B.V., 212238 3484 250 2626 CDNEXT - Datacamp Limited, GB 12389 3161 2332 871 ROSTELECOM-AS - PJSC Rostelecom, RU 29355 2549 151 25 KCELL-AS - Kcell JSC, KZ 34984 2489 367 586 TELLCOM-AS - Superonline Iletisim Hizmetl 44559 1803 113 840 ITHOSTLINE - IT HOSTLINE LTD, CY 8452 1714 1852 17 TE-AS - IDDQD-AS, EG Complete listing at https://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 12927 3286 618 AS8151 - UNINET, MX 10620 3444 451 1107 AS10620 - Telmex Colombia S.A., CO 13999 2281 499 332 AS13999 - Mega Cable, S.A. de C.V., MX 11830 1897 369 65 AS11830 - Instituto Costarricense de Elec 11664 1493 277 34 AS11664 - Techtel LMDS Comunicaciones Int 28573 1376 2431 269 AS28573 - Claro NXT Telecomunicacoes Ltda 3816 1342 768 213 AS3816 - COLOMBIA TELECOMUNICACIONES S.A. 6147 1211 371 21 AS6147 - INTEGRATEL PERU S.A.A., PE 22884 1097 70 386 AS22884 - TOTAL PLAY TELECOMUNICACIONES, 26615 1053 2384 95 AS26615 - TIM S/A, BR Complete listing at https://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24835 1987 601 34 Vodafone Data - Vodafone Data, EG 36992 1930 1543 333 ETISALAT MISR - ETISALAT MISR, EG 36903 1350 587 104 Office National des Postes et Telecommuni 24863 1320 389 16 Link Egypt (Link.NET) - Link Egypt (Link. 36935 1274 523 48 Vodafone Data - Vodafone Data, EG 37069 1112 1100 11 The Egyptian Company for Mobile Services 29571 1086 70 18 Orange Côte d'Ivoire - Orange Côte d'Iv 328608 583 54 194 Africa on Cloud - Africa on Cloud, ZA 15399 563 58 63 Wananchi Group (Kenya) Limited - Wananchi 36914 555 82 3 Kenya Education Network - Kenya Education Complete listing at https://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 15642 41524 5648 AMAZON-02 - Amazon.com, Inc., US 9808 14184 8921 101 CHINAMOBILE-CN - China Mobile Communicati 8151 12927 3286 618 AS8151 - UNINET, MX 12479 7016 1711 150 UNI2-AS - Orange Espagne SA, ES 7545 5837 818 450 TPG-INTERNET-AP - TPG Telecom Limited, AU 4538 5067 4192 74 ERX-CERNET-BKB - China Education and Rese 9498 5060 558 341 BBIL-AP - BHARTI Airtel Ltd., IN 39891 4907 302 76 ALJAWWALSTC-AS - Saudi Telecom Company JS 22773 4801 3174 371 ASN-CXA-ALL-CCI-22773-RDC - Cox Communica 11492 4616 306 1124 CABLEONE - CABLE ONE, INC., US Complete listing at https://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 9808 14184 14083 CHINAMOBILE-CN - China Mobile Communications Gr 8151 12927 12309 AS8151 - UNINET, MX 12479 7016 6866 UNI2-AS - Orange Espagne SA, ES 7545 5837 5387 TPG-INTERNET-AP - TPG Telecom Limited, AU 4538 5067 4993 ERX-CERNET-BKB - China Education and Research N 39891 4907 4831 ALJAWWALSTC-AS - Saudi Telecom Company JSC, SA 9498 5060 4719 BBIL-AP - BHARTI Airtel Ltd., IN 18403 4615 4591 FPT-VN - FPT Telecom Company, VN 22773 4801 4430 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 7552 4023 3999 VIETEL-AS-AP - Viettel Group, VN Complete listing at https://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 394928 UNALLOCATED 8.2.70.0/24 6461 ZAYO-6461 - Zayo Bandwi 395729 UNALLOCATED 8.28.60.0/24 32787 PROLEXIC-TECHNOLOGIES-D 396894 UNALLOCATED 8.28.201.0/24 3356 LEVEL3 - Level 3 Parent 394936 UNALLOCATED 8.33.224.0/24 174 COGENT-174 - Cogent Com 396243 UNALLOCATED 8.34.113.0/24 3356 LEVEL3 - Level 3 Parent 397274 UNALLOCATED 8.36.79.0/24 3356 LEVEL3 - Level 3 Parent 396243 UNALLOCATED 8.37.112.0/24 3356 LEVEL3 - Level 3 Parent 396243 UNALLOCATED 8.37.123.0/24 3356 LEVEL3 - Level 3 Parent 395195 UNALLOCATED 8.38.115.0/24 3356 LEVEL3 - Level 3 Parent 397274 UNALLOCATED 8.40.70.0/24 3356 LEVEL3 - Level 3 Parent Complete listing at https://thyme.apnic.net/current/data-badAS Prefixes from the Special Purpose Address Registry (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE - Hurricane Electric LLC, US Complete listing at https://thyme.apnic.net/current/data-spar Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.131.100.0/24 Origin: 401541 UNASSIGNED 23.131.100.0/24 Transit: 38733 CMCTELECOM-VN - CMC Telecom Infrastructu 23.131.156.0/24 Origin: 401541 UNASSIGNED 23.131.156.0/24 Transit: 38733 CMCTELECOM-VN - CMC Telecom Infrastructu 23.131.212.0/24 Origin: 401541 UNASSIGNED 23.131.212.0/24 Transit: 38733 CMCTELECOM-VN - CMC Telecom Infrastructu 23.133.212.0/24 Origin: 18604 UNASSIGNED 23.133.212.0/24 Transit: 32217 GPIEX - GPIEX INC, US 23.137.48.0/24 Origin: 16904 ARVIG-16904 - Arvig Enterprises Inc., US 23.137.48.0/24 Transit: 3257 GTT-BACKBONE - GTT Communications Inc., Complete listing at https://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:14 /10:39 /11:97 /12:299 /13:586 /14:1183 /15:2123 /16:13757 /17:8381 /18:13363 /19:25756 /20:46902 /21:54039 /22:113925 /23:110554 /24:674225 /25:697 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 8151 7119 12927 AS8151 - UNINET, MX 12479 5943 7016 UNI2-AS - Orange Espagne SA, ES 39891 3656 4907 ALJAWWALSTC-AS - Saudi Telecom Company JSC, SA 11492 3510 4616 CABLEONE - CABLE ONE, INC., US 6327 3506 3727 SHAW - Shaw Communications, CA 22773 3056 4801 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc., US 16509 2953 15642 AMAZON-02 - Amazon.com, Inc., US 7155 2943 3989 VIASAT-SP-BACKBONE - ViaSat,Inc., US 10620 2248 3444 AS10620 - Telmex Colombia S.A., CO 30036 2206 2551 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom Communications Corp, US Complete listing at https://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:2640 2:2829 3:1026 4:5 5:5261 6:206 7:6 8:1390 9:94 11:172 12:1102 13:802 14:2782 15:483 16:258 17:455 18:947 20:601 21:4 22:188 23:8544 24:2788 25:2 27:2803 28:5 29:19 31:3822 32:37 34:94 35:293 36:4884 37:4457 38:10150 39:1379 40:423 41:4604 42:2215 43:3306 44:479 45:20076 46:4987 47:461 48:168 49:2257 50:2014 51:792 52:1372 54:302 55:1245 56:11 57:331 58:2479 59:1411 60:1214 61:3190 62:3177 63:1753 64:6543 65:2144 66:6230 67:3343 68:1287 69:4067 70:1055 71:605 72:3266 74:3058 75:1602 76:596 77:2933 78:2109 79:1827 80:2386 81:2287 82:4264 83:1484 84:2170 85:3914 86:1107 87:2885 88:1323 89:4821 90:768 91:8494 92:2747 93:3035 94:4490 95:4733 96:1456 97:312 98:932 99:967 100:73 101:1354 102:4731 103:32451 104:5653 105:831 106:912 107:2980 108:1352 109:3913 110:2285 111:4238 112:3143 113:1947 114:2526 115:2202 116:2097 117:3683 118:3013 119:2100 120:2838 121:1712 122:3056 123:2228 124:1730 125:3029 126:156 128:1578 129:971 130:1720 131:2543 132:891 133:493 134:1771 135:646 136:1557 137:1448 138:3416 139:1793 140:1932 141:1805 142:2619 143:2149 144:1868 145:697 146:2190 147:2305 148:2814 149:3604 150:1405 151:2943 152:2441 153:1944 154:9922 155:2380 156:4640 157:2447 158:1627 159:2897 160:3908 161:2054 162:4214 163:2680 164:2388 165:2780 166:1214 167:2370 168:4256 169:903 170:5646 171:1129 172:4911 173:3477 174:890 175:1390 176:4039 177:5246 178:4521 179:2501 180:3235 181:4680 182:4057 183:2857 184:2052 185:21952 186:6553 187:5558 188:4755 189:4683 190:9962 191:1786 192:11836 193:9646 194:7968 195:5915 196:3447 197:3148 198:6348 199:6127 200:8435 201:6672 202:10772 203:10561 204:4750 205:3783 206:4433 207:4122 208:4331 209:5491 210:4906 211:2805 212:5231 213:4135 214:1022 215:47 216:7320 217:3752 218:1931 219:584 220:2286 221:1355 222:1102 223:3593 End of report

1 0

Looking for Akamai peering guru with a clue ...
by Bryan Holloway 30 Jul '26

30 Jul '26

Akamai keeps bugging us that our PNI is down, but it's not. The IPs they send for us are incorrect; the AS number is incorrect. I've explained this three times now to no avail. I get asked for the same information over and over, even though it's already in the ticket. I just got a fourth request asking that we look into this PNI that has been up without incident for 170+ days. Could someone please reach out to me off-list? Thank you!

1 1

DisneyPlus incorrect geolocation
by Andy Ringsmuth 30 Jul '26

30 Jul '26

Good evening all, Might there be someone here from DisneyPlus who can help sort out an incorrect geolocation issue? I’ve got an IPv6 address block that, everywhere I look, is correctly geolocated in Kansas City. But DisneyPlus persistently insists I’m in Herne, Germany. The usual support options are of course clueless. I’ve tried reaching out to their WHOIS contacts and a few others I found but it all seems to go into a black hole. Thanks! ---- Andy Ringsmuth andy(a)andyring.com Love others, encourage others, help others.

6 8

New DNS vulnerability: political overreach
by Kevin Tillery 30 Jul '26

30 Jul '26

A Texas court has suspended the .com domain of a Dutch porn site which doesn't have any business presence in Texas, because it doesn't comply with Texas rules about porn (which are extremely onerous): https://www.texasattorneygeneral.gov/news/releases/attorney-general-ken-pax… Clearly the US is not fit to manage top-level domains (other than .us of course) even though it ended up with them by historical accident. It worked for a while but now it's not working any more. Has anyone come up with any plan to solve this and make the DNS more neutral? As a first step I'd think about experimenting with a DNS resolver that would move all US TLDs to subdomains of .us. However that obviously would just break the current internet for whoever is using this resolver, at least due to widespread use of vhosts. Kevin

27 48

Accepting the unacceptable (reserved / unallocated space)
by Jeroen Massar 30 Jul '26

30 Jul '26

Hola all, TLDR: Can people call their sales contacts (the ones cold calling everybody normally) at transits/hosters and ask why they are forwarding BGP prefixes from reserved/unallocated ASN/prefixes? A wee bit of a long rant... but maybe we can make the Internet finally a wee bit better: For many many many years already, Geoff Huston has been monthly sending out the CIDR Report to various NOG lists. In that report there is a section of Unallocated and Reserved ASNs and Prefixes being announced wild on the Internet: https://www.cidr-report.org/#Bogons (IPv4) https://www.cidr-report.org/v6/as2.0/#Bogons (IPv6) There are vasts amounts of unallocated/reserved space being allocated, or worse IMHO, ASNs in the path that are reserved/unallocated. Fun ones like the DoD, Department of Defense eh War apparently... should be even a national security concern would they not be? Noting that even big cloud "security" folks have prefixes they do not check their customers for: eg https://bgp.tools/prefix/216.120.131.0/24 or https://bgp.tools/as/40186#connectivity but there are many transits, for which we pay bits, who do not filter either... That means, even if anybody normally would even reply to an abuse message for known prefixes (some sites still do fortunately answer, but with webforms as abuse reporting etc it is rarer and rarer, let alone that action is done) there is no abuse contact as there is these are unknown what is actually behind it, except: the upstreams = transits. It definitely means though that whatever ASN is passing that BGP on, that they did not do their due diligence on who their customer is, if they are allowed to announce that prefix, or even if that ASN is theirs to announce (and reserved/unallocated means, that it is not). In the current world, not everybody checks RPKI ROA's yet, let alone ASPA, but they should, and it is relatively cheap to do. As most ISPs and transits do not yet though, we cannot yet rely on ROA = VALID to accept prefixes as there are too many that are currently UNKNOWN. Improving that status by implementing ROV validation would help the Internet at whole a lot. Anybody playing transit though MUST do that: when they require RPKI ROA validity from their customers, it ensures that they are not passing on BGP announcements that are invalid. Even if the clients status with a RIR changes. If a transit sees a prefix that is ROA UNKNOWN, that should ring alert bells; in the same way that if one sees a prefix in the CIDR report with your ASN in that path, check it out, fix it. APNIC actually publishes an AS0 ROA for unallocated/reserved space. https://www.apnic.net/community/security/resource-certification/apnic-limit… though as one can see from the lists above, even APNIC space is included in those very lists, received by APNIC... Seems nobody honors that AS0 ROA either ;) With all the aggressive scraping happening today, it would be good to at least kinda attribute that to something, which is hard when there is not even a real registered entity behind a prefix or ASN (unless one blames the upstream!). Thus next to demanding from your transits that they know their customers and that those are legit to pass traffic, one could verify it yourself. Where can you find the unallocated/reserved data? at the RIRs, in the delegated files: https://ftp.afrinic.net/pub/stats/afrinic/delegated-afrinic-extended-latest https://ftp.lacnic.net/pub/stats/lacnic/delegated-lacnic-extended-latest https://ftp.apnic.net/stats/apnic/delegated-apnic-extended-latest https://ftp.ripe.net/pub/stats/ripencc/delegated-ripencc-extended-latest https://ftp.arin.net/pub/stats/arin/delegated-arin-extended-latest The data is there (as used by CIDR-Report), thus one can verify this. One trick I do is to generate a unallocated.json in the style of rpki-client.json (see https://console.rpki-client.org <https://console.rpki-client.org/> and then the /rpki.json link from there) and feed that to StayRTR (https://github.com/bgp/stayrtr/) in a separate instance from the normal ROA edition. Then simply check if prefixes are VALID (as that means there is a fake ROA for them) and voila, reason to take action, read: drop, that prefix/ASN. Currently a rpki-client.json is about 100MiB / 980k lines, an unallocated.json comes in at 40MiB / 333k lines Of course, the only advantage is that it is a few prefixes less of possible abuse, as noted, abuse reporting has been long as good as dead, and the actors behind various attacks just use residental proxies nowadays that are everywhere... End of rant, back to your 'operational issues', good luck out there, especially those in heatwaves, forest fires and facing other problems... Regards, Jeroen

1 0

Re: New DNS vulnerability: political overreach
by John R. Levine 29 Jul '26

29 Jul '26

According to Tom Beecher via NANOG <nanog(a)lists.nanog.org>: >> >> My concern, and this is where I think the law could stand improvement, >> is that the court co-opted a distant third party in its remedy for the >> dispute. They interfered with a contract between Verisign and one of >> its registrars, neither of which was a party to the lawsuit about >> Kick's behavior, neither of which was accused of any wrongdoing, and >> neither of which was more than tenuously operating within the court's >> geographical jurisdiction. That doesn't seem like something the law >> should allow, at least not of a state court. >I agree. But I don't think it's a case of the law needing improvement. This >is a problem with the Texas state courts ruling on things that seem to be >very clearly a federal question , which they have been doing with >increasing regularity in the last decade or so. That's the way courts work in the US. If someone files a case in a state court, the court will assume it has jurisdiction unless the defendant argues otherwise. That's why it's such a bad idea to default: the court's not going to make your argument for you. I have my concerns about Texas courts, but I believe in this kind of situation any state court would have done the same. R's, John -- Regards, John Levine, johnl(a)taugh.com, Primary Perpetrator of "The Internet for Dummies", Please consider the environment before reading this e-mail. https://jl.ly

5 7