- NANOG - lists.nanog.org

Guest Column: Kentik's Doug Madory, Last Call for Upcoming ISOC Course + More
by Nanog News 13 Sep '23

13 Sep '23

*Guest Column: Kentik's Doug Madory* *BGP Incidents: From Traffic-Disrupting BGP Leaks to Crypto-Stealing BGP Hijacks* BGP routing incidents can be problematic for a range of reasons. In some cases, they simply disrupt the flow of legitimate internet traffic while in others, they can result in the misdirection of communications, posing a security risk from interception or manipulation. *READ MORE <https://www.google.com/url?q=https://nanog.us20.list-manage.com/track/click…>Last Call for Upcoming ISOC Course: 11 Sept. * *Fundamentals of Designing and Deploying Computer Networks* This course will discuss the fundamentals of networking, Ethernet, and WIFI technologies. It will additionally teach the planning, design, and deployment of simple LANs and cover how to connect a LAN to the Internet. *LEARN MORE <https://www.google.com/url?q=https://nanog.us20.list-manage.com/track/click…>* *Reminder: Board Nominations are Open! * *Your Choice, Your Vote* *Elections: 2023* The NANOG Board of Directors is an active and engaged part of NANOG. The Board is responsible for and works closely with committees to promote, support, and improve NANOG. *VIEW MORE <https://www.google.com/url?q=https://nanog.us20.list-manage.com/track/click…>* *What's Trending on the Mailing List? * *Find a Solution Via our Community Forum Online Discussion Boards * ****Remember you must log in or create an account to access the Community Forum.* Lossy cogent p2p experiences? Replies: 62 JunOS/FRR/Nokia et al BGP critical issue Replies: 13 Re: Destination Preference Attribute for BGP Replies: 20 v6 route mess frm AS266970 Replies: 5 *VIEW MORE <https://community.nanog.org/latest>* *Video of the Week * *The Future is Now: Delivering the Next Generation Brilliant Network* Brilliant networks delivering next-generation connected experiences are here. Comcast Chief Network Officer Elad Nafshi will share how 10G network technologies are evolving related experiences in real-time, even as they continue to get more innovative, faster, reliable, and secure for future generations. *WATCH NOW * <https://www.youtube.com/watch?v=jNluliEMKvY&t=313s>

14 19

Root zone operational announcement: introducing ZONEMD for the root zone
by Wessels, Duane 12 Sep '23

12 Sep '23

I am pleased to announce that Message Digests for DNS Zones, also known as ZONEMD, will be added to the root zone later this year. This feature, specified in RFC 8976, adds cryptographic data protections to the zone as a whole, allowing the recipient to verify the authenticity of the zone’s contents. ZONEMD will be added to the root zone using a phased approach. On September 13, 2023, a ZONEMD record will make its first appearance in the root zone. At this time the Hash Algorithm field will be set to a private use algorithm number, making the ZONEMD record deliberately unverifiable. On December 6, 2023, the ZONEMD record will be published with the SHA-384 Hash Algorithm, thereby making it verifiable. We expect no operational impacts for end users. ZONEMD does not affect root zone queries and responses. The root server operators have agreed to not alter their zone ingestion processes for at least a year after ZONEMD is first introduced. Anyone that downloads the root zone file from www.internic.net or rs.internic.net should be aware that it will include the new ZONEMD resource record in its native presentation format starting on September 6th. Please feel free to follow up with any questions or concerns. References and further reading: [1] RFC 8976: “Message Digest for DNS Zones”, https://www.rfc-editor.org/rfc/rfc8976 [2] Root Server Operators Statement on adding ZONEMD to the root zone, https://root-servers.org/media/news/2022-08-Statement_on_ZONEMD.pdf [3] RZERC003: “Adding Zone Data Protections to the Root Zone”, https://www.icann.org/uploads/ckeditor/rzerc-003-en.pdf [4] Verisign Blog: “Adding ZONEMD Protections to the Root Zone”, https://blog.verisign.com/security/root-zone-zonemd/ [5] APNIC Ping Podcast episode “Adding ZONEMD protections to the root zone”, https://blubrry.com/ping_podcast/108940688/adding-zonemd-protections-to-the… DW

1 1

EDU zone operational announcement: DNSSEC algorithm rollover
by Wessels, Duane 12 Sep '23

12 Sep '23

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Verisign is pleased to announce that an algorithm 13 (ECDSA) DS record has been published for the EDU zone, and the algorithm 8 record has been removed. Over the next few days, the algorithm 8 DNSKEY records will be removed from the EDU zone, followed by the removal of algorithm 8 signatures. We continue to expect no operational impacts for end users, but please feel free to reach out to us with concerns or any observations of anomalous behavior related to this algorithm rollover. DW -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBCAAGBQJlAIwcAAoJEGyZpGmowJiNEj4H/R07bC4outa2znVIh7BIsolu mamlG2+NlOBmdAOTzk8vdmoUMy11RHeG0W+6o6oQS9gALUgj4shxPF5z+Je0R6Us Y54HDnE4mi1KAGKOtg/AE5RYCZeA/rhLk/qxRnLiUBtlmuRwMpjkJ5k+viCEFVX+ IyZPWEJyDSC8bFx4LThYt7AP093r74vjKHa2wMffa+3VHZgrEpHReL6Na149+u3L Idb1In9cCs6nYFp/DuMopdVHy3EqK6psPSCt7jCG27qAtM4+ormsCPYYo4KI7RUo lF7X2SdDmVUfoL4lzrLUzl7MFBxJxNYCt/yPvN/VBLw2Yby2AhPHVQt7lpjIQXo= =/uAl -----END PGP SIGNATURE-----

1 0

Prize Picks - gelocation/vpn/fraud system
by Justin Krejci 11 Sep '23

11 Sep '23

Yes, unfortunate geolocation/vpn troubles strike again. If any from PrizePicks.com are on here I would appreciate if you would reach out to me regarding a mutual customer not able to use your services. If anyone else on NANOG has a contact there, I would appreciate some help getting in contact to resolve an issue that the regular support channel is unable to do. Thanks! Justin Krejci

1 0

Captive portal for suspended accounts
by Steve Saner 11 Sep '23

11 Sep '23

We are a combination fiber and fixed wireless ISP with around 20k subscribers. Management is wanting to develop something along the lines of a captive portal for suspended accounts such that those customers are forced to a portal that allows them to make payment and get reactivated. This is a common thing for a cafe wifi hotspot or something, but has anyone here attempted to do it at this kind of scale who would be willing to share their experiences? If someone has successfully done this, I would love to pick your brain a bit to understand how you accomplished it. Thanks much. -- *Steve Saner* | Senior Network Engineer ideatek INTERNET FREEDOM™ FOR ALL 316-640-8715 ext. 4005 | 111 Old Mill St., Buhler KS,67522 | <http://ideatek.com/>ideatek.com This email transmission and any documents, files or previous email messages attached to it may contain confidential information. If the reader of this message is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you are not or believe you may not be the intended recipient, please advise the sender immediately by return email or by calling 620.543.5026. Then, please take all steps necessary to permanently delete the email and all attachments from your computer system. No trees were affected by this transmission – though a few billion photons were mildly inconvenienced.

6 6

Lossy cogent p2p experiences?
by David Hubbard 11 Sep '23

11 Sep '23

Hi all, curious if anyone who has used Cogent as a point to point provider has gone through packet loss issues with them and were able to successfully resolve? I’ve got a non-rate-limited 10gig circuit between two geographic locations that have about 52ms of latency. Mine is set up to support both jumbo frames and vlan tagging. I do know Cogent packetizes these circuits, so they’re not like waves, and that the expected single session TCP performance may be limited to a few gbit/sec, but I should otherwise be able to fully utilize the circuit given enough flows. Circuit went live earlier this year, had zero issues with it. Testing with common tools like iperf would allow several gbit/sec of TCP traffic using single flows, even without an optimized TCP stack. Using parallel flows or UDP we could easily get close to wire speed. Starting about ten weeks ago we had a significant slowdown, to even complete failure, of bursty data replication tasks between equipment that was using this circuit. Rounds of testing demonstrate that new flows often experience significant initial packet loss of several thousand packets, and will then have ongoing lesser packet loss every five to ten seconds after that. There are times we can’t do better than 50 Mbit/sec, but it’s rare to achieve gigabit most of the time unless we do a bunch of streams with a lot of tuning. UDP we also see the loss, but can still push many gigabits through with one sender, or wire speed with several nodes. For equipment which doesn’t use a tunable TCP stack, such as storage arrays or vmware, the retransmits completely ruin performance or may result in ongoing failure we can’t overcome. Cogent support has been about as bad as you can get. Everything is great, clean your fiber, iperf isn’t a good test, install a physical loop oh wait we don’t want that so go pull it back off, new updates come at three to seven day intervals, etc. If the performance had never been good to begin with I’d have just attributed this to their circuits, but since it worked until late June, I know something has changed. I’m hoping someone else has run into this and maybe knows of some hints I could give them to investigate. To me it sounds like there’s a rate limiter / policer defined somewhere in the circuit, or an overloaded interface/device we’re forced to traverse, but they assure me this is not the case and claim to have destroyed and rebuilt the logical circuit. Thanks!

10 25

Re: Lossy cogent p2p experiences?
by Mike Hammett 10 Sep '23

10 Sep '23

I wouldn't call 50 megabit/s an elephant flow ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com ----- Original Message ----- From: "Mark Tinka" <mark(a)tinka.africa> To: "Mike Hammett" <nanog(a)ics-il.net>, "Saku Ytti" <saku(a)ytti.fi> Cc: nanog(a)nanog.org Sent: Friday, September 1, 2023 8:56:03 AM Subject: Re: Lossy cogent p2p experiences? On 9/1/23 15:44, Mike Hammett wrote: and I would say the OP wasn't even about elephant flows, just about a network that can't deliver anything acceptable. Unless Cogent are not trying to accept (and by extension, may not be able to guarantee) large Ethernet flows because they can't balance them across their various core links, end-to-end... Pure conjecture... Mark.

13 54

Weekly Global IPv4 Routing Table Report
by Routing Table Analysis Role Account 08 Sep '23

08 Sep '23

This is an automated weekly mailing describing the state of the Global IPv4 Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG UKNOF, TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net. For historical data, please see https://thyme.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. IPv4 Routing Table Report 04:00 +10GMT Sat 09 Sep, 2023 BGP Table (Global) as seen in Japan. Report Website: https://thyme.apnic.net Detailed Analysis: https://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 927731 Prefixes after maximum aggregation (per Origin AS): 352669 Deaggregation factor: 2.63 Unique aggregates announced (without unneeded subnets): 452710 Total ASes present in the Internet Routing Table: 74776 Prefixes per ASN: 12.41 Origin-only ASes present in the Internet Routing Table: 64229 Origin ASes announcing only one prefix: 26357 Transit ASes present in the Internet Routing Table: 10547 Transit-only ASes present in the Internet Routing Table: 454 Average AS path length visible in the Internet Routing Table: 4.2 Max AS path length visible: 70 Max AS path prepend of ASN (263725) 64 Prefixes from unregistered ASNs in the Routing Table: 1053 Number of instances of unregistered ASNs: 1055 Number of 32-bit ASNs allocated by the RIRs: 42576 Number of 32-bit ASNs visible in the Routing Table: 35055 Prefixes from 32-bit ASNs in the Routing Table: 175008 Number of bogon 32-bit ASNs visible in the Routing Table: 54 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 601 Number of addresses announced to Internet: 3056133888 Equivalent to 182 /8s, 40 /16s and 231 /24s Percentage of available address space announced: 82.5 Percentage of allocated address space announced: 82.5 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.5 Total number of prefixes smaller than registry allocations: 308927 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 246243 Total APNIC prefixes after maximum aggregation: 70661 APNIC Deaggregation factor: 3.48 Prefixes being announced from the APNIC address blocks: 239918 Unique aggregates announced from the APNIC address blocks: 98702 APNIC Region origin ASes present in the Internet Routing Table: 13628 APNIC Prefixes per ASN: 17.60 APNIC Region origin ASes announcing only one prefix: 4057 APNIC Region transit ASes present in the Internet Routing Table: 1797 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 24 Number of APNIC region 32-bit ASNs visible in the Routing Table: 8946 Number of APNIC addresses announced to Internet: 772854656 Equivalent to 46 /8s, 16 /16s and 211 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-153913 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 271947 Total ARIN prefixes after maximum aggregation: 123794 ARIN Deaggregation factor: 2.20 Prefixes being announced from the ARIN address blocks: 274838 Unique aggregates announced from the ARIN address blocks: 131523 ARIN Region origin ASes present in the Internet Routing Table: 19086 ARIN Prefixes per ASN: 14.40 ARIN Region origin ASes announcing only one prefix: 6946 ARIN Region transit ASes present in the Internet Routing Table: 1964 Average ARIN Region AS path length visible: 3.7 Max ARIN Region AS path length visible: 24 Number of ARIN region 32-bit ASNs visible in the Routing Table: 4827 Number of ARIN addresses announced to Internet: 1279836416 Equivalent to 76 /8s, 72 /16s and 193 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-401308 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 260388 Total RIPE prefixes after maximum aggregation: 123026 RIPE Deaggregation factor: 2.12 Prefixes being announced from the RIPE address blocks: 256431 Unique aggregates announced from the RIPE address blocks: 160008 RIPE Region origin ASes present in the Internet Routing Table: 28388 RIPE Prefixes per ASN: 9.03 RIPE Region origin ASes announcing only one prefix: 12038 RIPE Region transit ASes present in the Internet Routing Table: 3932 Average RIPE Region AS path length visible: 4.3 Max RIPE Region AS path length visible: 34 Number of RIPE region 32-bit ASNs visible in the Routing Table: 11311 Number of RIPE addresses announced to Internet: 716692096 Equivalent to 42 /8s, 183 /16s and 218 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-216475 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 118386 Total LACNIC prefixes after maximum aggregation: 28500 LACNIC Deaggregation factor: 4.15 Prefixes being announced from the LACNIC address blocks: 117393 Unique aggregates announced from the LACNIC address blocks: 49158 LACNIC Region origin ASes present in the Internet Routing Table: 11024 LACNIC Prefixes per ASN: 10.65 LACNIC Region origin ASes announcing only one prefix: 2693 LACNIC Region transit ASes present in the Internet Routing Table: 2318 Average LACNIC Region AS path length visible: 4.9 Max LACNIC Region AS path length visible: 70 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 8841 Number of LACNIC addresses announced to Internet: 178478848 Equivalent to 10 /8s, 163 /16s and 95 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-273820 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 29714 Total AfriNIC prefixes after maximum aggregation: 5967 AfriNIC Deaggregation factor: 4.98 Prefixes being announced from the AfriNIC address blocks: 38550 Unique aggregates announced from the AfriNIC address blocks: 12815 AfriNIC Region origin ASes present in the Internet Routing Table: 1791 AfriNIC Prefixes per ASN: 21.52 AfriNIC Region origin ASes announcing only one prefix: 623 AfriNIC Region transit ASes present in the Internet Routing Table: 334 Average AfriNIC Region AS path length visible: 4.9 Max AfriNIC Region AS path length visible: 28 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 1130 Number of AfriNIC addresses announced to Internet: 107811840 Equivalent to 6 /8s, 109 /16s and 20 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 9489 8729 41 CHINAMOBILE-CN China Mobile Communicati 7545 5727 785 689 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4864 4192 75 ERX-CERNET-BKB China Education and Rese 18403 4337 347 25 FPT-AS-AP FPT Telecom Company, VN 7713 3598 1043 63 TELKOMNET-AS-AP PT Telekomunikasi Indon 45899 3332 1840 98 VNPT-AS-VN VNPT Corp, VN 9498 3149 498 251 BBIL-AP BHARTI Airtel Ltd., IN 7552 2931 1330 20 VIETEL-AS-AP Viettel Group, VN 4766 2543 11270 601 KIXS-AS-KR Korea Telecom, KR 24560 2498 848 389 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd Complete listing at https://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 9060 10989 3267 AMAZON-02, US 11492 4512 299 673 CABLEONE, US 7155 4179 288 101 VIASAT-SP-BACKBONE, US 22773 3551 3056 310 ASN-CXA-ALL-CCI-22773-RDC, US 6327 3536 1319 66 SHAW, CA 749 3152 54959 2404 DNIC-AS-00749, US 16625 3004 1442 2277 AKAMAI-AS, US 367 2967 3827 1395 DNIC-ASBLK-00306-00371, US 396982 2690 3596 387 GOOGLE-CLOUD-PLATFORM, US 30036 2487 356 405 MEDIACOM-ENTERPRISE-BUSINESS, US Complete listing at https://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 7359 1713 145 UNI2-AS, ES 39891 4897 290 61 ALJAWWALSTC-AS, SA 20940 4076 3398 153 AKAMAI-ASN1, NL 8551 3456 368 34 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 12389 2981 2296 914 ROSTELECOM-AS, RU 9009 2718 252 1391 M247, RO 34984 2328 362 597 TELLCOM-AS, TR 58224 1752 933 517 TCI, IR 13188 1606 100 27 TRIOLAN, UA 61317 1504 101 1169 ASDETUK www.heficed.com, US Complete listing at https://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 11767 3367 596 UNINET, MX 10620 3538 506 849 Telmex Colombia S.A., CO 13999 2406 343 627 Mega Cable, S.A. de C.V., MX 11830 2002 369 64 Instituto Costarricense de Electricidad 28573 1324 2324 232 Claro NXT Telecomunicacoes Ltda, BR 6503 1302 344 510 Axtel, S.A.B. de C.V., MX 3816 1295 764 191 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 11664 1127 183 427 Techtel LMDS Comunicaciones Interactiva 6147 1112 370 22 Telefonica del Peru S.A.A., PE 26615 1027 2501 49 TIM SA, BR Complete listing at https://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1593 393 19 LINKdotNET-AS, EG 24835 1457 497 26 RAYA-AS, EG 36992 1357 1518 281 ETISALAT-MISR, EG 36903 1242 550 99 MT-MPLS, MA 29571 1045 67 45 ORANGE-COTE-IVOIRE, CI 36935 780 520 36 Vodafone-, EG 6713 550 1861 34 IAM-AS, MA 15399 535 55 52 WANANCHI-, KE 37342 485 32 1 MOVITEL, MZ 24757 480 73 5 EthioNet-AS, ET Complete listing at https://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 11767 3367 596 UNINET, MX 9808 9489 8729 41 CHINAMOBILE-CN China Mobile Communicati 16509 9060 10989 3267 AMAZON-02, US 12479 7359 1713 145 UNI2-AS, ES 7545 5727 785 689 TPG-INTERNET-AP TPG Telecom Limited, AU 39891 4897 290 61 ALJAWWALSTC-AS, SA 4538 4864 4192 75 ERX-CERNET-BKB China Education and Rese 11492 4512 299 673 CABLEONE, US 18403 4337 347 25 FPT-AS-AP FPT Telecom Company, VN 7155 4179 288 101 VIASAT-SP-BACKBONE, US Complete listing at https://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 9808 9489 9448 CHINAMOBILE-CN China Mobile Communications Grou 12479 7359 7214 UNI2-AS, ES 16509 9060 5793 AMAZON-02, US 7545 5727 5038 TPG-INTERNET-AP TPG Telecom Limited, AU 39891 4897 4836 ALJAWWALSTC-AS, SA 4538 4864 4789 ERX-CERNET-BKB China Education and Research Net 18403 4337 4312 FPT-AS-AP FPT Telecom Company, VN 7155 4179 4078 VIASAT-SP-BACKBONE, US 20940 4076 3923 AKAMAI-ASN1, NL 11492 4512 3839 CABLEONE, US Complete listing at https://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 33492 UNALLOCATED 8.6.184.0/23 33650 COMCAST-33650, US 33123 UNALLOCATED 8.10.69.0/24 11168 SCC, US 12169 UNALLOCATED 8.15.207.0/24 32787 PROLEXIC-TECHNOLOGIES-DDOS-M 40493 UNALLOCATED 8.17.26.0/24 3356 LEVEL3, US 53775 UNALLOCATED 8.20.88.0/24 7029 WINDSTREAM, US 62828 UNALLOCATED 8.21.130.0/24 3356 LEVEL3, US 393266 UNALLOCATED 8.23.52.0/24 46887 LIGHTOWER, US 396894 UNALLOCATED 8.28.201.0/24 46887 LIGHTOWER, US 394936 UNALLOCATED 8.33.224.0/24 22442 HOU-PHONOSCOPE, US 54338 UNALLOCATED 8.33.241.0/24 6461 ZAYO-6461, US Complete listing at https://thyme.apnic.net/current/data-badAS Prefixes from the Special Purpose Address Registry (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at https://thyme.apnic.net/current/data-spar Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.140.216.0/24 Origin: 27176 DATAWAGON, US 23.140.216.0/24 Transit: 20278 NEXEON, US 23.141.0.0/24 Origin: 395350 RESERVED, ZZ 23.141.0.0/24 Transit: 11426 TWC-11426-CAROLINAS, US 23.176.160.0/24 Origin: 397327 RESERVED, ZZ 23.176.160.0/24 Transit: 19108 SUDDENLINK-COMMUNICATIONS, US 23.178.240.0/24 Origin: 399517 RESERVED, ZZ 23.178.240.0/24 Transit: 32425 SKB3-ARIN-BGP, US 23.189.192.0/24 Origin: 27593 RESERVED, ZZ 23.189.192.0/24 Transit: 174 COGENT-174, US Complete listing at https://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:14 /10:39 /11:102 /12:298 /13:578 /14:1197 /15:2069 /16:13519 /17:8281 /18:13864 /19:25134 /20:44418 /21:51170 /22:110066 /23:99070 /24:557155 /25:741 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 6445 7359 UNI2-AS, ES 8151 5800 11767 UNINET, MX 39891 3632 4897 ALJAWWALSTC-AS, SA 11492 3424 4512 CABLEONE, US 6327 3346 3536 SHAW, CA 7155 3124 4179 VIASAT-SP-BACKBONE, US 8551 2924 3456 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 22773 2598 3551 ASN-CXA-ALL-CCI-22773-RDC, US 30036 2147 2487 MEDIACOM-ENTERPRISE-BUSINESS, US 10620 2101 3538 Telmex Colombia S.A., CO Complete listing at https://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:2256 2:1394 3:258 4:5 5:4558 6:136 7:6 8:1544 9:1 11:172 12:1511 13:376 14:2319 15:304 16:195 17:370 18:637 20:282 21:4 22:188 23:6373 24:2500 25:6 27:2503 29:19 31:2520 32:80 34:25 35:117 36:1989 37:4531 38:5200 39:870 40:146 41:4009 42:2107 43:2294 44:320 45:16492 46:4306 47:378 49:1817 50:1884 51:596 52:1598 54:394 55:956 56:8 57:122 58:1868 59:1174 60:1001 61:2513 62:2682 63:1914 64:5643 65:2337 66:4913 67:3032 68:1342 69:4140 70:1195 71:658 72:2958 74:2603 75:1562 76:622 77:2324 78:1836 79:2991 80:2113 81:1835 82:1462 83:1288 84:1549 85:3010 86:766 87:1995 88:1170 89:3851 90:618 91:7825 92:2062 93:2624 94:3514 95:4015 96:1297 97:321 98:1083 99:735 100:90 101:1077 102:2862 103:31987 104:4604 105:555 106:896 107:2680 108:1124 109:4221 110:2132 111:3180 112:2067 113:1817 114:1665 115:1975 116:1906 117:2431 118:2688 119:1986 120:1796 121:1160 122:2597 123:2192 124:1624 125:2550 128:1476 129:925 130:1038 131:1948 132:814 133:408 134:1795 135:306 136:911 137:969 138:2632 139:1574 140:1164 141:1294 142:1512 143:1495 144:993 145:346 146:1943 147:1606 148:2453 149:2263 150:869 151:1232 152:1871 153:523 154:4919 155:1378 156:1955 157:1321 158:1084 159:2248 160:2598 161:1584 162:3533 163:1593 164:1702 165:1838 166:1065 167:1723 168:3728 169:909 170:4650 171:865 172:3705 173:2957 174:981 175:1184 176:3777 177:4419 178:3542 179:2128 180:2447 181:3549 182:3358 183:1991 184:2279 185:20518 186:4693 187:4149 188:4166 189:3796 190:9195 191:1450 192:10956 193:8953 194:7257 195:5215 196:3085 197:2471 198:6001 199:6103 200:7945 201:6030 202:10539 203:10000 204:4552 205:3675 206:4362 207:3485 208:4153 209:4923 210:4482 211:2532 212:4223 213:3401 214:1094 215:58 216:6689 217:2779 218:1285 219:575 220:2032 221:978 222:844 223:2162 End of report

1 0

Spoofer Report for NANOG for Aug 2023
by CAIDA Spoofer Project 08 Sep '23

08 Sep '23

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Aug 2023: ASN Name Fixed-By 53274 3DB-WIRELESS 2023-08-15 10745 ARIN-ASH-CHA 2023-08-18 400517 2023-08-18 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Aug 2023: ASN Name First-Spoofed Last-Spoofed 3356 LEVEL3 2016-03-06 2023-08-17 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2023-08-25 20412 CLARITY-TELECOM 2016-09-30 2023-08-31 25787 ROWE-NETWORKS 2016-10-21 2023-08-31 11427 TWC-11427-TEXAS 2016-10-21 2023-08-29 10796 TWC-10796-MIDWEST 2016-10-24 2023-08-30 271 BCNET 2016-10-24 2023-08-26 25660 CTC 2017-01-11 2023-08-21 852 ASN852 2017-04-16 2023-08-01 22883 CONDENAST 2019-05-29 2023-08-22 199524 GCORE 2020-09-02 2023-08-23 26231 SFIA-ASN 2021-10-27 2023-08-07 46997 2021-12-22 2023-08-31 394414 E2WS 2022-05-08 2023-08-30 400517 2022-10-03 2023-08-25 12183 TALKIE-COMMUNICATIONS 2022-12-10 2023-08-30 41378 KirinoNET 2023-03-23 2023-08-25 3701 NERONET 2023-04-18 2023-08-30 400282 2023-04-27 2023-08-25 13693 NTS-ONLINE 2023-05-05 2023-08-26 46690 SNET-FCC 2023-05-20 2023-08-27 36687 WILINE 2023-08-02 2023-08-21 209114 LUIZ-AMARAL 2023-08-08 2023-08-08 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

Paging AS13335/Cloudflare to the courtesy phone
by Jim Popovitch 07 Sep '23

07 Sep '23

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Why are you sending me this crap...please stop. I've reached out to your NOC to no avail. Sep 7 19:11:19 web4.domainmail.net nginx: 172.68.1.193 - +AF8 +ACI-POST /dms2/services2/ServerMMS2 HTTP/2.0+ACI 400 150 +ACI--+ACI +ACI-Agent-Probe+ACI Sep 7 19:11:19 web4.domainmail.net nginx: 172.68.1.193 - +AF8 +ACI-POST /dms2/services2/ServerMMS2 HTTP/2.0+ACI 400 150 +ACI--+ACI +ACI-Agent-Probe+ACI Sep 7 19:11:19 web4.domainmail.net nginx: 172.68.1.161 - +AF8 +ACI-POST /dms2/services2/ServerII2 HTTP/2.0+ACI 400 150 +ACI--+ACI +ACI-Mozilla/5.0 (Windows NT 10.0+ADs Win64+ADs compatible) MSPAnywhere/7.50.0.1500+ACI Sep 7 19:11:19 web4.domainmail.net nginx: 172.68.170.148 - +AF8 +ACI-POST /dms2/services2/ServerMMS2 HTTP/2.0+ACI 400 150 +ACI--+ACI +ACI-Agent-Probe+ACI Sep 7 19:11:19 web4.domainmail.net nginx: 172.68.170.148 - +AF8 +ACI-POST /dms2/services2/ServerMMS2 HTTP/2.0+ACI 400 150 +ACI--+ACI +ACI-Agent-Probe+ACI Sep 7 19:11:19 web4.domainmail.net nginx: 172.68.1.153 - +AF8 +ACI-POST /bosh/bosh/ HTTP/2.0+ACI 400 150 +ACI--+ACI +ACI--+ACI Sep 7 19:11:19 web4.domainmail.net nginx: 172.68.1.193 - +AF8 +ACI-POST /dms2/services2/ServerMMS2 HTTP/2.0+ACI 400 150 +ACI--+ACI +ACI-Agent-Probe+ACI Sep 7 19:11:20 web4.domainmail.net nginx: 172.71.142.51 - +AF8 +ACI-POST /dms2/services2/ServerMMS2 HTTP/2.0+ACI 400 150 +ACI--+ACI +ACI-Agent-Probe+ACI Sep 7 19:11:24 web4.domainmail.net nginx: 172.68.1.190 - +AF8 +ACI-POST /dms2/services2/ServerMMS2 HTTP/2.0+ACI 400 150 +ACI--+ACI +ACI-Agent-Probe+ACI Sep 7 19:11:24 web4.domainmail.net nginx: 172.68.1.196 - +AF8 +ACI-POST /bosh/bosh/ HTTP/2.0+ACI 400 150 +ACI--+ACI +ACI--+ACI Sep 7 19:11:24 web4.domainmail.net nginx: 172.68.1.193 - +AF8 +ACI-POST /bosh/bosh/ HTTP/2.0+ACI 400 150 +ACI--+ACI +ACI--+ACI Sep 7 19:11:24 web4.domainmail.net nginx: 172.68.1.193 - +AF8 +ACI-POST /bosh/bosh/ HTTP/2.0+ACI 400 150 +ACI--+ACI +ACI--+ACI Sep 7 19:11:24 web4.domainmail.net nginx: 172.68.1.193 - +AF8 +ACI-POST /dms2/services2/ServerMMS2 HTTP/2.0+ACI 400 150 +ACI--+ACI +ACI-Agent-Probe+ACI Sep 7 19:11:25 web4.domainmail.net nginx: 172.68.1.130 - +AF8 +ACI-POST /dms2/services2/ServerII2 HTTP/2.0+ACI 400 150 +ACI--+ACI +ACI-Mozilla/5.0 (Windows NT 10.0+ADs Win64+ADs compatible) MSPAnywhere/7.50.0.1500+ACI Sep 7 19:11:26 web4.domainmail.net nginx: 172.68.1.196 - +AF8 +ACI-POST /dms2/services2/ServerMMS2 HTTP/2.0+ACI 400 150 +ACI--+ACI +ACI-Agent-Probe+ACI Sep 7 19:11:26 web4.domainmail.net nginx: 172.68.1.143 - +AF8 +ACI-POST /dms2/services2/ServerMMS2 HTTP/2.0+ACI 400 150 +ACI--+ACI +ACI-Agent-Probe+ACI Sep 7 19:11:29 web4.domainmail.net nginx: 172.68.1.196 - +AF8 +ACI-POST /bosh/bosh/ HTTP/2.0+ACI 400 150 +ACI--+ACI +ACI--+ACI Sep 7 19:11:29 web4.domainmail.net nginx: 172.69.214.218 - +AF8 +ACI-POST /dms2/services2/ServerMMS2 HTTP/2.0+ACI 400 150 +ACI--+ACI +ACI-Agent-Probe+ACI Sep 7 19:11:29 web4.domainmail.net nginx: 172.69.214.218 - +AF8 +ACI-POST /dms2/services2/ServerMMS2 HTTP/2.0+ACI 400 150 +ACI--+ACI +ACI-Agent-Probe+ACI Sep 7 19:11:30 web4.domainmail.net nginx: 172.68.1.193 - +AF8 +ACI-POST /dms2/services2/ServerMMS2 HTTP/2.0+ACI 400 150 +ACI--+ACI +ACI-Agent-Probe+ACI Sep 7 19:11:30 web4.domainmail.net nginx: 172.68.1.174 - +AF8 +ACI-POST /dms2/services2/ServerMMS2 HTTP/2.0+ACI 400 150 +ACI--+ACI +ACI-Agent-Probe+ACI Sep 7 19:11:31 web4.domainmail.net nginx: 172.71.142.51 - +AF8 +ACI-POST /dms2/services2/ServerMMS2 HTTP/2.0+ACI 400 150 +ACI--+ACI +ACI-Agent-Probe+ACI Sep 7 19:11:31 web4.domainmail.net nginx: 172.71.142.51 - +AF8 +ACI-POST /dms2/services2/ServerMMS2 HTTP/2.0+ACI 400 150 +ACI--+ACI +ACI-Agent-Probe+ACI Sep 7 19:11:31 web4.domainmail.net nginx: 172.68.1.193 - +AF8 +ACI-POST /dms2/services2/ServerMMS2 HTTP/2.0+ACI 400 150 +ACI--+ACI +ACI-Agent-Probe+ACI Sep 7 19:11:33 web4.domainmail.net nginx: 172.71.147.97 - +AF8 +ACI-POST /dms2/services2/ServerMMS2 HTTP/2.0+ACI 400 150 +ACI--+ACI +ACI-Agent-Probe+ACI Thanks+ACE - -Jim P. -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEE3RmV4WutJ2KyCS2zPcxbabkKGJ8FAmT6ITUACgkQPcxbabkK GJ+zpw//SWKtHPgqwVBiqNDi9SRSOGoE8yJIj2OXhLrOXI850GBDNN9DflNqVAiO uAYHRLMZXaaUBgpa0qTWQw+p7s6UJQv1T9BCQPKIwtj6tVFts3WJtEUfbtJ+4WxC aOF04nym5EooMRE2CNz8Hlt8Axa+rlp2N+R5LqBNe7vwtGXbLoA/YcqzEjkMjgci jdrbR+MMFaM59iZrD3Ife1cbdrycruohopzgFFXE5ILB+fuGT0obrj/WDe99lDgY Z6uWPaoLivGkviLaVUXWxecDulOIsQkNs5k9UUUq8CgMRRJox9RYu369zIqUNAuX N9xCl3IFQZ0Kl50wmbf8ajjI0swfh971jqeAIto8xEAgF66Iy3ty4nPEqTZjr/gv YZAjNa1UCkXKyyXHPuYWZC4bMaxvQACVsG2h1siylDmDB236Wr6OSMvys9q16SHd t2837hXJOpVlNwlKAapZQMs35+LpI10elE5s6SyYA29UJq6XwA/rvsIT+QtrM/fM rctyoCqv+hSR/3dJB+Pw3uMcxlPQNr1kZp8J/7bqPxIz0VMP5xVinraYdjcVOv6W AvSaXSP5iWG3NJWpUVgbU5GKpJp24c+sukcd1wsABWSQV6RWc7V2A2+TF75wxK3c O+8tjzqkvS+4Xg6KG/uyfXtZ+aol+IgPA2ZvyChjNCV2Fp83XfU= =ldq2 -----END PGP SIGNATURE-----

1 0