- NANOG - lists.nanog.org

Weekly Routing Table Report
by Routing Analysis Role Account 03 Feb '12

03 Feb '12

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, LacNOG, TRNOG, CaribNOG and the RIPE Routing Working Group. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 04 Feb, 2012 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 395820 Prefixes after maximum aggregation: 169388 Deaggregation factor: 2.34 Unique aggregates announced to Internet: 191947 Total ASes present in the Internet Routing Table: 40003 Prefixes per ASN: 9.89 Origin-only ASes present in the Internet Routing Table: 32689 Origin ASes announcing only one prefix: 15521 Transit ASes present in the Internet Routing Table: 5393 Transit-only ASes present in the Internet Routing Table: 142 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 33 Max AS path prepend of ASN (48687) 24 Prefixes from unregistered ASNs in the Routing Table: 315 Unregistered ASNs in the Routing Table: 120 Number of 32-bit ASNs allocated by the RIRs: 2257 Number of 32-bit ASNs visible in the Routing Table: 1921 Prefixes from 32-bit ASNs in the Routing Table: 4672 Special use prefixes present in the Routing Table: 2 Prefixes being announced from unallocated address space: 120 Number of addresses announced to Internet: 2512081104 Equivalent to 149 /8s, 187 /16s and 80 /24s Percentage of available address space announced: 67.8 Percentage of allocated address space announced: 67.8 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 92.0 Total number of prefixes smaller than registry allocations: 167934 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 97613 Total APNIC prefixes after maximum aggregation: 31507 APNIC Deaggregation factor: 3.10 Prefixes being announced from the APNIC address blocks: 93918 Unique aggregates announced from the APNIC address blocks: 39044 APNIC Region origin ASes present in the Internet Routing Table: 4648 APNIC Prefixes per ASN: 20.21 APNIC Region origin ASes announcing only one prefix: 1238 APNIC Region transit ASes present in the Internet Routing Table: 731 Average APNIC Region AS path length visible: 4.3 Max APNIC Region AS path length visible: 18 Number of APNIC region 32-bit ASNs visible in the Routing Table: 140 Number of APNIC addresses announced to Internet: 635833440 Equivalent to 37 /8s, 230 /16s and 12 /24s Percentage of available APNIC address space announced: 80.6 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 131072-132095, 132096-133119 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 148115 Total ARIN prefixes after maximum aggregation: 75385 ARIN Deaggregation factor: 1.96 Prefixes being announced from the ARIN address blocks: 120087 Unique aggregates announced from the ARIN address blocks: 49290 ARIN Region origin ASes present in the Internet Routing Table: 14884 ARIN Prefixes per ASN: 8.07 ARIN Region origin ASes announcing only one prefix: 5683 ARIN Region transit ASes present in the Internet Routing Table: 1577 Average ARIN Region AS path length visible: 4.0 Max ARIN Region AS path length visible: 22 Number of ARIN region 32-bit ASNs visible in the Routing Table: 15 Number of ARIN addresses announced to Internet: 804133824 Equivalent to 47 /8s, 238 /16s and 27 /24s Percentage of available ARIN address space announced: 63.9 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 393216-394239 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 173/8, 174/8, 184/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 98052 Total RIPE prefixes after maximum aggregation: 52278 RIPE Deaggregation factor: 1.88 Prefixes being announced from the RIPE address blocks: 89929 Unique aggregates announced from the RIPE address blocks: 55955 RIPE Region origin ASes present in the Internet Routing Table: 16285 RIPE Prefixes per ASN: 5.52 RIPE Region origin ASes announcing only one prefix: 7995 RIPE Region transit ASes present in the Internet Routing Table: 2598 Average RIPE Region AS path length visible: 4.7 Max RIPE Region AS path length visible: 33 Number of RIPE region 32-bit ASNs visible in the Routing Table: 1322 Number of RIPE addresses announced to Internet: 498585736 Equivalent to 29 /8s, 183 /16s and 208 /24s Percentage of available RIPE address space announced: 80.3 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 196608-198655 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 176/8, 178/8, 185/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 38255 Total LACNIC prefixes after maximum aggregation: 8059 LACNIC Deaggregation factor: 4.75 Prefixes being announced from the LACNIC address blocks: 37876 Unique aggregates announced from the LACNIC address blocks: 19445 LACNIC Region origin ASes present in the Internet Routing Table: 1569 LACNIC Prefixes per ASN: 24.14 LACNIC Region origin ASes announcing only one prefix: 442 LACNIC Region transit ASes present in the Internet Routing Table: 294 Average LACNIC Region AS path length visible: 4.3 Max LACNIC Region AS path length visible: 24 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 440 Number of LACNIC addresses announced to Internet: 95986568 Equivalent to 5 /8s, 184 /16s and 163 /24s Percentage of available LACNIC address space announced: 63.6 LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 262144-263167 plus ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 8951 Total AfriNIC prefixes after maximum aggregation: 2087 AfriNIC Deaggregation factor: 4.29 Prefixes being announced from the AfriNIC address blocks: 6957 Unique aggregates announced from the AfriNIC address blocks: 2150 AfriNIC Region origin ASes present in the Internet Routing Table: 512 AfriNIC Prefixes per ASN: 13.59 AfriNIC Region origin ASes announcing only one prefix: 163 AfriNIC Region transit ASes present in the Internet Routing Table: 115 Average AfriNIC Region AS path length visible: 4.6 Max AfriNIC Region AS path length visible: 25 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 4 Number of AfriNIC addresses announced to Internet: 30867968 Equivalent to 1 /8s, 215 /16s and 2 /24s Percentage of available AfriNIC address space announced: 46.0 AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4766 2474 11102 982 Korea Telecom (KIX) 17974 1723 503 36 PT TELEKOMUNIKASI INDONESIA 7545 1642 303 85 TPG Internet Pty Ltd 4755 1529 385 155 TATA Communications formerly 7552 1408 1064 7 Vietel Corporation 9829 1167 989 28 BSNL National Internet Backbo 9583 1123 82 483 Sify Limited 4808 1102 2051 313 CNCGROUP IP network: China169 24560 1014 385 167 Bharti Airtel Ltd., Telemedia 17488 934 161 224 Hathway IP Over Cable Interne Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 3445 3807 201 bellsouth.net, inc. 7029 3211 1017 199 Windstream Communications Inc 18566 2093 382 177 Covad Communications 1785 1865 680 125 PaeTec Communications, Inc. 20115 1627 1552 627 Charter Communications 4323 1609 1062 384 Time Warner Telecom 22773 1498 2910 109 Cox Communications, Inc. 30036 1437 253 743 Mediacom Communications Corp 19262 1386 4683 400 Verizon Global Networks 7018 1305 7007 851 AT&T WorldNet Services Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8402 1712 480 15 Corbina telecom 2118 1391 99 14 EUnet/RELCOM Autonomous Syste 15557 1096 2161 64 LDCOM NETWORKS 34984 643 188 172 BILISIM TELEKOM 6830 642 1927 412 UPC Distribution Services 20940 602 195 467 Akamai Technologies European 12479 561 642 54 Uni2 Autonomous System 31148 532 37 9 FreeNet ISP 3320 531 8162 397 Deutsche Telekom AG 8551 530 360 81 Bezeq International Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 10620 1735 323 170 TVCABLE BOGOTA 28573 1618 1083 72 NET Servicos de Comunicao S.A 8151 1336 2995 344 UniNet S.A. de C.V. 7303 1260 757 180 Telecom Argentina Stet-France 26615 887 640 33 Tim Brasil S.A. 11172 697 95 75 Servicios Alestra S.A de C.V 27947 650 73 99 Telconet S.A 22047 581 322 17 VTR PUNTO NET S.A. 3816 550 237 91 Empresa Nacional de Telecomun 7738 550 1050 31 Telecomunicacoes da Bahia S.A Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 8452 1131 958 13 TEDATA 24863 834 155 43 LINKdotNET AS number 6713 485 649 18 Itissalat Al-MAGHRIB 3741 280 939 229 The Internet Solution 15706 238 32 6 Sudatel Internet Exchange Aut 33776 237 13 13 Starcomms Nigeria Limited 29571 214 17 12 Ci Telecom Autonomous system 12258 197 28 62 Vodacom Internet Company 24835 193 80 8 RAYA Telecom - Egypt 16637 163 664 82 MTN Network Solutions Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 3445 3807 201 bellsouth.net, inc. 7029 3211 1017 199 Windstream Communications Inc 4766 2474 11102 982 Korea Telecom (KIX) 18566 2093 382 177 Covad Communications 1785 1865 680 125 PaeTec Communications, Inc. 10620 1735 323 170 TVCABLE BOGOTA 17974 1723 503 36 PT TELEKOMUNIKASI INDONESIA 8402 1712 480 15 Corbina telecom 7545 1642 303 85 TPG Internet Pty Ltd 20115 1627 1552 627 Charter Communications Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 7029 3211 3012 Windstream Communications Inc 18566 2093 1916 Covad Communications 1785 1865 1740 PaeTec Communications, Inc. 8402 1712 1697 Corbina telecom 17974 1723 1687 PT TELEKOMUNIKASI INDONESIA 10620 1735 1565 TVCABLE BOGOTA 7545 1642 1557 TPG Internet Pty Ltd 28573 1618 1546 NET Servicos de Comunicao S.A 4766 2474 1492 Korea Telecom (KIX) 7552 1408 1401 Vietel Corporation Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 15132 UNALLOCATED 12.9.150.0/24 7018 AT&T WorldNet Servic 32567 UNALLOCATED 12.14.170.0/24 4323 Time Warner Telecom 32567 UNALLOCATED 12.25.107.0/24 4323 Time Warner Telecom 25639 UNALLOCATED 12.41.169.0/24 7018 AT&T WorldNet Servic 13317 UNALLOCATED 12.44.10.0/24 7018 AT&T WorldNet Servic 23502 UNALLOCATED 12.44.44.0/24 7018 AT&T WorldNet Servic 17300 UNALLOCATED 12.45.103.0/24 7018 AT&T WorldNet Servic 17300 UNALLOCATED 12.45.110.0/24 701 UUNET Technologies, 16476 UNALLOCATED 12.46.27.0/24 7018 AT&T WorldNet Servic 32873 UNALLOCATED 12.46.100.0/23 10912 InterNAP Network Ser Complete listing at http://thyme.rand.apnic.net/current/data-badAS Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 128.0.0.0/21 12654 RIPE NCC RIS Project 128.0.24.0/24 12654 RIPE NCC RIS Project Complete listing at http://thyme.rand.apnic.net/current/data-dsua Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 14.192.0.0/22 45464 Room 201, TGU Bldg 14.192.4.0/22 45464 Room 201, TGU Bldg 14.192.8.0/22 45464 Room 201, TGU Bldg 14.192.12.0/22 45464 Room 201, TGU Bldg 14.192.16.0/22 45464 Room 201, TGU Bldg 14.192.20.0/22 45464 Room 201, TGU Bldg 14.192.24.0/22 45464 Room 201, TGU Bldg 14.192.28.0/22 45464 Room 201, TGU Bldg 37.77.128.0/21 8492 Siris 37.77.152.0/21 44176 RIPE Network Coordination Cen Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:12 /10:27 /11:80 /12:231 /13:458 /14:817 /15:1466 /16:12151 /17:6170 /18:10294 /19:20359 /20:28181 /21:29140 /22:39550 /23:36869 /24:206457 /25:1189 /26:1430 /27:786 /28:43 /29:59 /30:14 /31:0 /32:18 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 7029 2841 3211 Windstream Communications Inc 6389 2115 3445 bellsouth.net, inc. 18566 2042 2093 Covad Communications 8402 1691 1712 Corbina telecom 10620 1629 1735 TVCABLE BOGOTA 30036 1396 1437 Mediacom Communications Corp 11492 1117 1154 Cable One 1785 1063 1865 PaeTec Communications, Inc. 15557 1046 1096 LDCOM NETWORKS 7011 1033 1149 Citizens Utilities Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:499 2:475 4:14 5:1 6:3 8:378 12:1954 13:1 14:595 15:11 16:3 17:6 20:9 23:125 24:1725 27:1187 31:852 32:65 33:2 34:2 36:9 37:161 38:791 40:114 41:3108 42:92 43:1 44:3 46:1279 47:3 49:322 50:514 52:13 54:2 55:8 56:3 57:38 58:958 59:491 60:344 61:1186 62:927 63:2000 64:4147 65:2287 66:4421 67:2048 68:1167 69:3149 70:916 71:410 72:1794 74:2646 75:452 76:323 77:963 78:913 79:498 80:1221 81:877 82:562 83:538 84:582 85:1163 86:746 87:910 88:341 89:1539 90:253 91:4473 92:540 93:1555 94:1338 95:1134 96:417 97:310 98:811 99:38 100:20 101:138 103:737 106:4 107:143 108:142 109:1467 110:687 111:837 112:429 113:525 114:596 115:757 116:860 117:722 118:906 119:1249 120:356 121:682 122:1627 123:1064 124:1338 125:1360 128:538 129:189 130:213 131:590 132:164 133:21 134:231 135:59 136:214 137:152 138:285 139:140 140:489 141:261 142:378 143:400 144:509 145:70 146:484 147:227 148:724 149:274 150:168 151:194 152:446 153:170 154:7 155:398 156:211 157:367 158:156 159:513 160:329 161:243 162:341 163:188 164:532 165:397 166:556 167:455 168:765 169:147 170:833 171:110 172:4 173:1757 174:591 175:414 176:468 177:470 178:1246 180:1176 181:64 182:703 183:274 184:430 185:1 186:2028 187:853 188:1030 189:1168 190:5444 192:5979 193:5525 194:4330 195:3390 196:1299 197:180 198:3615 199:4359 200:5710 201:1728 202:8404 203:8598 204:4343 205:2443 206:2747 207:2817 208:4064 209:3558 210:2724 211:1475 212:1976 213:1841 214:855 215:93 216:4984 217:1472 218:553 219:341 220:1243 221:555 222:321 223:274 End of report

1 0

Re: [rt-users] External Auth using Active Directory 2008
by james machado 03 Feb '12

03 Feb '12

I would use ldapsearch on that machine to make sure you can bind to the AD server using the login credentials in your Site_Config. Make sure you are using the proper certificates to connect via the TLS you have configured. I've noticed that being one of the biggest problems with ldap and Windows 2008 and 2008 R2 AD servers. james

1 1

[POLITICS] ICANN elections
by bmanning＠vacation.karoshi.com 03 Feb '12

03 Feb '12

There are four really good candidates. Please consider sending in a statement of support for one of them. /bill ----- Forwarded message ----- Date: Fri, 03 Feb 2012 09:38:06 +1000 To: Bill Manning <bmanning(a)karoshi.com> Subject: Comment Period for ICANN Board Seat 9 Election Consistent with the ASO Memorandum of Understanding and ICANN Bylaws, the Address Supporting Organization Address Council (ASO AC) is responsible for the appointment of a representative to serve on Seat Number 9 of the ICANN Board. The ASO AC is pleased to announce the following four candidates for its upcoming appointment. The Candidates are: - Thomas Eric Brunner-Williams - Martin J. Levy - William Manning - Raymond Alan Plzak In accordance with the ASO AC election procedures, a comment period is now open. A short biography is available and supporting comment facilities for each candidate may be found at: http://aso.icann.org/people/icann-board-elections/2012-elections/ The comment period will close at 23:59 UTC on 19 April 2012. Comments will be moderated. ASO Secretariat secretariat(a)aso.icann.org ----- End forwarded message -----

2 1

Fwd: [#135346] Unauthorized BGP Announcements (follow up to Hijacked Networks)
by Kelvin Williams 03 Feb '12

03 Feb '12

I hope none of you ever get hijacked by a spammer housed at Phoenix NAP. :) We're still not out of the woods, announcing /24s and working with upper tier carriers to filter out our lists. However, I just got this response from Phoenix NAP and found it funny. The "thief" is a former customer, whom we terminated their agreement with. They then forged an LOA, submitted it to CWIE.net and Phoenix NAP and resumed using space above and beyond their terminated agreement. So now any request for assistance to stop our networks from being announced is now responded to with an instruction to contact the thief's lawyer. kw ---------- Forwarded message ---------- From: Kelvin Williams <kwilliams(a)altuscgi.com> Date: Tue, Jan 31, 2012 at 7:43 PM Subject: Re: [#135346] Unauthorized BGP Announcements To: noc(a)phoenixnap.com We'll be forwarding this to our peers in the industry--rather funny that Phoenix NAP would rather send us to the attorney of the people stealing our space than bothering to perform an ARIN WHOIS search, or querying any of the IRRs. Interesting... Very interesting... So, who all do you have there--spammers and child pornographers? Is this level of protection what you give to them all? On Tue, Jan 31, 2012 at 7:30 PM, Brandon S <BrandonS(a)phoenixnap.com> wrote: > Hello, > > Thank you for your email. Please direct any further questions regarding > this issue to the following contact. > > Bennet Kelley > 100 Wilshire Blvd. > Suite 950 > Santa Monica, CA 90401 > bkelley(a)internetlawcenter.net > > Telephone > 310-452-0401 > > Facsimile > 702-924-8740 > > -- > Brandon S. > NOC Services Technician > > ** We want to hear from you!** > We care about the quality of our service. If you’ve received > anything less than a prompt response or exceptional service or would like > to share any > feedback regarding your experience, please let us know by sending an email > to management: > supportfeedback(a)phoenixnap.com > > -- Kelvin Williams Sr. Service Delivery Engineer Broadband & Carrier Services Altus Communications Group, Inc. "If you only have a hammer, you tend to see every problem as a nail." -- Abraham Maslow

26 49

Re: [#135346] Unauthorized BGP Announcements (follow up to Hijacked
by Milo Medin 03 Feb '12

03 Feb '12

>> Where is Milo Medin when we need him? > how would he be helping? He would have pulled the plug. The story is from the very early days of the internet, probably long before NANOG existed. Milo worked at NASA and found a cracker from Finland on one of NASAs machines. The link from Finland to the rest of the world went through Norway to NASA. (That's THE link, there was only one link connecting all of Scandinavia to the rest of the net.) So Milo called the guy in Finland and said "Please fix it". The reply was "We can't do anything. We respect civil liberties." Soon he got the message because he wasn't connected to the net any more. If anybody has a good URL for the story, please let me know. I found one reference in google-books that said 1988. Hmm, is this how people talk about you after you are dead? J Dave Burstein dropped me a note about this thread – I don’t usually follow NANOG much these days. So I figured I should respond to make sure all the facts were straight. Let me clarify what happened in the case of the Finnish idiot. At the time, I worked for NASA and among other things ran the root nameserver at Ames (ns.nasa.gov) We managed systems very tightly, and the root was instrumented well and was notifying that someone at one of the larger Finnish universities was trying the usual measures to break into the machine. We saw these all the time – people tried the usual tftp or other tricks, and moved on when they didn’t get satisfaction. But this particular individual just kept on trying different things over the course of a couple days, and distinguished himself as being a real pain. So I figured I needed to take some action. I went to the NIC database, and called up the University’s POC for the address block, saying that one of their students was attempting to break into a US Government computing resource (a criminal offense) and violating the AUP of the networks that connected them. They refused to act – basically saying that they didn’t feel bound by US law, blah blah, etc… So then I called up the Nordunet guys in Stockholm, who connected all Scandinavian countries together via a 128 Kbps link to the JVNC supercomputer center in Princeton. As I recall, no one returned my call or my emails, though Mats and company usually were quite on the ball. The probing was continuing on the root, so I decided to call my friend Elise Gerich at the NSFnet, and ask her if she wouldn’t put in a null route to the university in Finland in the core backbone network, figuring that cutting off the connectivity to the university would get someone’s attention. She said that she would really prefer I call Sergio Heker at Princeton, who managed the link and could install a null route there where the link came in as a more targeted solution. When I told Sergio what was happening (one of the root’s being attacked), and that no one was doing anything about it, he said he would take care of it. Instead of installing a null route, he walked into the machine room where the main JVNC nodes were located, walked to the satellite DSU that connected JVNC to Stockholm, and pushed the loopback button. So it is really Sergio who deserves credit for this story, not me. No more probes on the root server. J I am told the following morning the grad student responsible for this was met by a group of angry system administrators as he entered his office. The conversation went like something this according to one of the people there: IT admin: Did you notice that the Internet is down today? Student: I noticed that – is something broken with our connection? IT admin: In fact, not only our university can’t talk to the Internet, but no one in Finland can. Student: Oh, really? IT admin: In fact, no one in all of Scandinavia can reach the Internet today. Student: Wow, that is a big problem. Why are talking to me about it? IT admin: Because it is all YOUR fault! Stop messing around with those NASA servers! The connection was restored later that day, and no one from Finland tried breaking into the root anymore, at least not while I was still there at Ames. I don’t believe the grad student was ever jailed, though I suspect he may have needed a fresh set of underwear that day. This is the story as best as I can remember it, and it was around 1990 as opposed to 1988 as I recall. Back in the old days, people cared about policing bad behavior. I could tell you tons of stories where people had to take action to keep the routing system safe from abuse. If there was routing braindamage, people would just fix it. The old AUP served as the enforcement vehicle. Now of course things are much more complicated, and folks are less concerned with “public health” than honoring contracts, etc… But it was not always this way. Thanks, Milo

7 7

new routeviews collector: TELX Atlanta
by John Kemp 02 Feb '12

02 Feb '12

We just brought up a new collector at the TELX Atlanta facility. Peering information is at: http://www.peeringdb.com/view.php?asn=6447&peerParticipantsPublics_mPage=2 route-views.telxatl.routeviews.org If anyone is interested an peering and sharing full views, please e-mail us at help(a)routeviews.org. Much thanks to the TELX guys. They have gone above and beyond in helping us get this going. John Kemp (kemp(a)routeviews.org) help(a)routeviews.org

1 0

antisocial security
by Randy Bush 02 Feb '12

02 Feb '12

from a stateside host psg.com:/usr/home/randy> dig ssa.gov. ns ; <<>> DiG 9.4.3-P2 <<>> ssa.gov. ns ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37734 ;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 4 ;; QUESTION SECTION: ;ssa.gov. IN NS ;; ANSWER SECTION: ssa.gov. 24370 IN NS dns1.ssa.gov. ssa.gov. 24370 IN NS dns6.ssa.gov. ssa.gov. 24370 IN NS dns5.ssa.gov. ssa.gov. 24370 IN NS dns2.ssa.gov. ;; ADDITIONAL SECTION: dns1.ssa.gov. 34072 IN A 199.173.231.82 dns2.ssa.gov. 34073 IN A 199.173.231.83 dns5.ssa.gov. 34073 IN A 137.200.4.30 dns6.ssa.gov. 34074 IN A 137.200.4.31 ;; Query time: 0 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Thu Feb 2 03:45:15 2012 ;; MSG SIZE rcvd: 165 psg.com:/usr/home/randy> dig +short @199.173.231.82 www.ssa.gov. any www.socialsecurity.gov. CNAME 7 3 60 20120224201936 20120125195419 21905 ssa.gov. XSnBe3L3rTcD2FO778x43NOJaVf2OeMoSN8hBOSJFqfUfXAyH9qE5X1Q +tuRgigLs4qE7Fr40GI7SANxkltYdICJbEfvYikKMDW/hi8wp8mKHYQP SmXRGZz3ZizUaLb1DNTTWePIJDCrwEkZ5oVSEqoaV5xjDnWQ0twwILve I3Q= psg.com:/usr/home/randy> dig +short @199.173.231.83 www.ssa.gov. any www.socialsecurity.gov. CNAME 7 3 60 20120224201936 20120125195419 21905 ssa.gov. XSnBe3L3rTcD2FO778x43NOJaVf2OeMoSN8hBOSJFqfUfXAyH9qE5X1Q +tuRgigLs4qE7Fr40GI7SANxkltYdICJbEfvYikKMDW/hi8wp8mKHYQP SmXRGZz3ZizUaLb1DNTTWePIJDCrwEkZ5oVSEqoaV5xjDnWQ0twwILve I3Q= psg.com:/usr/home/randy> dig +short @137.200.4.30 www.ssa.gov. any www.socialsecurity.gov. CNAME 7 3 60 20120224201936 20120125195419 21905 ssa.gov. XSnBe3L3rTcD2FO778x43NOJaVf2OeMoSN8hBOSJFqfUfXAyH9qE5X1Q +tuRgigLs4qE7Fr40GI7SANxkltYdICJbEfvYikKMDW/hi8wp8mKHYQP SmXRGZz3ZizUaLb1DNTTWePIJDCrwEkZ5oVSEqoaV5xjDnWQ0twwILve I3Q= psg.com:/usr/home/randy> dig +short @137.200.4.31 www.ssa.gov. any www.socialsecurity.gov. CNAME 7 3 60 20120224201936 20120125195419 21905 ssa.gov. XSnBe3L3rTcD2FO778x43NOJaVf2OeMoSN8hBOSJFqfUfXAyH9qE5X1Q +tuRgigLs4qE7Fr40GI7SANxkltYdICJbEfvYikKMDW/hi8wp8mKHYQP SmXRGZz3ZizUaLb1DNTTWePIJDCrwEkZ5oVSEqoaV5xjDnWQ0twwILve I3Q= psg.com:/usr/home/randy> traceroute 199.173.231.82 traceroute to 199.173.231.82 (199.173.231.82), 64 hops max, 40 byte packets 1 r0.sea.rg.net (147.28.0.4) 0.314 ms 1.224 ms 0.202 ms 2 r1.sea.rg.net (147.28.0.5) 0.340 ms 0.306 ms 0.349 ms 3 sl-gw20-sea-3-2-1.sprintlink.net (144.232.9.61) 0.355 ms 0.305 ms 0.228 ms 4 144.232.3.126 (144.232.3.126) 0.352 ms 0.379 ms 0.353 ms 5 0.xe-11-3-0.BR2.SEA7.ALTER.NET (204.255.168.217) 14.365 ms 1.081 ms 1.075 ms 6 0.ge-2-3-0.XT2.SEA7.ALTER.NET (152.63.104.21) 1.097 ms 1.127 ms 1.082 ms 7 0.ge-1-2-0.XT2.DCA6.ALTER.NET (152.63.40.46) 73.575 ms 73.635 ms 73.528 ms 8 GigabitEthernet7-0-0.GW8.DCA6.ALTER.NET (152.63.40.81) 75.535 ms 75.595 ms 75.545 ms 9 ssa-gw.customer.alter.net (152.179.9.34) 76.652 ms 76.522 ms 76.671 ms 10 * *^C psg.com:/usr/home/randy> traceroute 137.200.4.30 traceroute to 137.200.4.30 (137.200.4.30), 64 hops max, 40 byte packets 1 r0.sea.rg.net (147.28.0.4) 0.378 ms 0.253 ms 0.332 ms 2 r1.sea.rg.net (147.28.0.5) 0.340 ms 0.394 ms 0.339 ms 3 sl-gw20-sea-3-2-1.sprintlink.net (144.232.9.61) 0.348 ms 0.263 ms 0.214 ms 4 144.232.3.126 (144.232.3.126) 66.830 ms 0.345 ms 0.323 ms 5 0.xe-11-3-0.BR2.SEA7.ALTER.NET (204.255.168.217) 0.977 ms 1.006 ms 1.100 ms 6 0.ge-2-3-0.XT2.SEA7.ALTER.NET (152.63.104.21) 26.587 ms 1.173 ms 1.086 ms 7 0.ge-7-0-0.XL2.RDU1.ALTER.NET (152.63.33.38) 86.052 ms 86.084 ms 86.024 ms 8 POS7-0.GW5.RDU1.ALTER.NET (152.63.35.177) 83.282 ms 83.371 ms 83.145 ms 9 157.130.212.98 (157.130.212.98) 85.254 ms 84.998 ms 85.170 ms 10 137.200.1.123 (137.200.1.123) 92.646 ms 92.727 ms 92.762 ms 11 *^C so they have a firewall, but i can get there. but from tokyo rair.psg.com:/Users/randy> dig +short @199.173.231.82 www.ssa.gov. any ;; connection timed out; no servers could be reached rair.psg.com:/Users/randy> dig +short @199.173.231.83 www.ssa.gov. any ;; connection timed out; no servers could be reached rair.psg.com:/Users/randy> dig +short @137.200.4.30 www.ssa.gov. any ;; connection timed out; no servers could be reached rair.psg.com:/Users/randy> dig +short @137.200.4.31 www.ssa.gov. any ;; connection timed out; no servers could be reached rair.psg.com:/Users/randy> traceroute 199.173.231.82 traceroute to 199.173.231.82 (199.173.231.82), 64 hops max, 52 byte packets 1 192.168.0.1 (192.168.0.1) 5.528 ms 2.325 ms 2.504 ms 2 tokyo10-f01.flets.2iij.net (210.149.34.66) 6.912 ms 9.912 ms 11.519 ms 3 tokyo10-ntteast1.flets.2iij.net (210.149.34.113) 5.684 ms 5.820 ms 5.621 ms 4 tky001lip21.iij.net (210.149.34.101) 8.553 ms 6.054 ms 6.600 ms 5 tky001bb10.iij.net (58.138.100.217) 5.350 ms 5.412 ms 5.058 ms 6 tky001bf00.iij.net (58.138.80.1) 11.748 ms tky001bf01.iij.net (58.138.80.5) 5.268 ms 7.389 ms 7 sjc002bf01.iij.net (216.98.96.62) 104.972 ms sjc002bf02.iij.net (206.132.169.109) 106.686 ms sjc002bf01.iij.net (216.98.96.62) 105.618 ms 8 sjc002bb10.iij.net (206.132.169.2) 126.691 ms sjc002bb10.iij.net (206.132.169.6) 134.246 ms sjc002bb10.iij.net (206.132.169.10) 108.460 ms 9 gigabitethernet1-1.gw2.sjc7.alter.net (152.179.48.1) 110.772 ms 109.116 ms 114.488 ms 10 0.so-0-0-1.xl4.sjc7.alter.net (152.63.51.50) 102.308 ms 106.149 ms 109.410 ms 11 0.so-7-3-0.xt2.dca6.alter.net (152.63.0.245) 187.469 ms 183.993 ms 194.484 ms 12 gigabitethernet7-0-0.gw8.dca6.alter.net (152.63.40.81) 259.830 ms 234.873 ms 186.634 ms 13 * * * ^C rair.psg.com:/Users/randy> traceroute 137.200.4.30 traceroute to 137.200.4.30 (137.200.4.30), 64 hops max, 52 byte packets 1 192.168.0.1 (192.168.0.1) 10.197 ms 1.979 ms 4.218 ms 2 tokyo10-f01.flets.2iij.net (210.149.34.66) 9.268 ms 6.284 ms 6.184 ms 3 tokyo10-ntteast1.flets.2iij.net (210.149.34.113) 5.913 ms 10.127 ms 6.532 ms 4 tky001lip21.iij.net (210.149.34.101) 7.983 ms 6.036 ms 6.199 ms 5 tky001bb10.iij.net (58.138.100.217) 5.774 ms 21.691 ms 7.265 ms 6 tky001bf01.iij.net (58.138.80.5) 9.906 ms tky008bf00.iij.net (58.138.80.9) 8.371 ms tky001bf01.iij.net (58.138.80.5) 5.930 ms 7 sjc002bf00.iij.net (216.98.96.186) 117.184 ms 113.652 ms sjc002bf01.iij.net (216.98.96.62) 104.728 ms 8 sjc002bb10.iij.net (206.132.169.10) 114.864 ms sjc002bb10.iij.net (206.132.169.6) 111.701 ms sjc002bb10.iij.net (206.132.169.10) 142.274 ms 9 gigabitethernet1-1.gw2.sjc7.alter.net (152.179.48.1) 123.611 ms 115.159 ms 112.298 ms 10 0.so-0-0-1.xl4.sjc7.alter.net (152.63.51.50) 111.010 ms 104.429 ms 108.738 ms 11 0.so-1-2-0.xl2.rdu1.alter.net (152.63.27.38) 349.150 ms 209.448 ms 207.871 ms 12 pos7-0.gw5.rdu1.alter.net (152.63.35.177) 222.413 ms 208.135 ms 269.150 ms 13 * *^C and, i noticed the problem because i can not get to the web site at http://www.ssa.gov/ from tokyo. randy

6 6

Re: US DOJ victim letter
by Jay Hennigan 02 Feb '12

02 Feb '12

On 1/19/12 1:01 PM, Dave Ellis wrote: > I've also received the emails, I assumed they were fake as our normal > contacts haven't mentioned anything. The body of the email indeed reads like a poorly-executed phish including elements such as "null" and "<personalized code here>" but headers seem legit. -- Jay Hennigan - CCIE #7880 - Network Engineering - jay(a)impulse.net Impulse Internet Service - http://www.impulse.net/ Your local telephone and internet company - 805 884-6323 - WB6RDV

25 30

Fwd: IPv6 RA-Guard: Advice on the implementation (feedback requested)
by Fernando Gont 02 Feb '12

02 Feb '12

Folks, Not sure if I had posted on this list about RA-Guard evasion issues. Anyway...nowadays most implementations remain vulnerable. If you care to get this fixed, please provide feedback about this I-D on the IETF *v6ops* mailing-list <v6ops(a)ietf.org>, and CC me if possible (please see below). Thanks! Best regards, Fernando -------- Original Message -------- Subject: RA-Guard: Advice on the implementation (feedback requested) Date: Wed, 01 Feb 2012 21:44:29 -0300 From: Fernando Gont <fgont(a)si6networks.com> Organization: SI6 Networks To: IPv6 Operations <v6ops(a)ietf.org> Folks, We have just published a revision of our I-D "Implementation Advice for IPv6 Router Advertisement Guard (RA-Guard)" <http://tools.ietf.org/id/draft-gont-v6ops-ra-guard-implementation-01.txt>. In essence, this is the problem statement, and what this I-D is about: * RA-Guard is essential to have feature parity with IPv4. * Most (all?) existing RA-Guard implementations can be trivially evaded: if the attacker includes extension headers in his packets, the RA-Guard devices fail to identify the Router Advertisement messages. -- For instance, THC's "IPv6 attack suite" (<http://www.thc.org/thc-ipv6/>) contains tools that can evade RA-Guard as indicated. * The I-D discusses this problem, and provides advice on how to implement RA-Guard, such that the aforementioned vulnerabilities are eliminated, we have an effective RA-Guard device, and hence feature-parity with IPv4. We'd like feedback on this I-D, including high-level comments on whether you support the proposal in this I-D. Thanks! Best regards, -- Fernando Gont e-mail: fernando(a)gont.com.ar || fgont(a)si6networks.com PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

1 0

AS8300 - Swisscom hijacking.. Just what are you testing?
by Schiller, Heather A 02 Feb '12

02 Feb '12

AS8300 started announcing one of the Rove Digital dns changer IP ranges. (The IP ranges the FBI is sending 'you are infected' letters about) Swisscom's announcement is less specific than the prefixes being announced by ISC during the remediation effort, so it's not impacting traffic... But AS8300 seems to announce less specifics a lot. Last fall they announced 63/8 and half of that is allocated to 701. AFAIK, we weren't notified they were going to announce a less specific of our space. As long as folks have pullup routes, and don't have an outage that withdraws their announcements, then Swisscom should only be getting darknet traffic. The record for AS8300 says 'Test' and the entry for it in CIDR report says "This AS is not currently used to announce prefixes in the global routing table, nor is it used as a visible transit AS." .. But their announcements certainly do show up in the global routing table, whether they are transiting for someone or not, they could get traffic for anything that doesn't have a more specific. Given the recent YAHT (yet another hijack thread) it's worth pointing out that hijacking more specifics is bad, but less specifics can be bad as well. (Not suggesting that is the case here..) I searched around and couldn't find any mention of what they might be testing. Anyone know? route-views>sh ip bgp 85.255.112.0/20 BGP routing table entry for 85.255.112.0/20, version 2177063753 Paths: (11 available, no best path) Not advertised to any peer 6079 3303 8300 (history entry) 207.172.6.20 from 207.172.6.20 (207.172.6.20) Origin IGP, metric 85, localpref 100, external Dampinfo: penalty 495, flapped 2 times in 00:24:37 3277 3267 174 3303 8300 (history entry) 194.85.102.33 from 194.85.102.33 (194.85.4.4) Origin IGP, localpref 100, external Community: 3277:3267 3277:65321 3277:65323 3277:65330 Dampinfo: penalty 501, flapped 2 times in 00:24:22 .... --Heather

5 5