- NANOG - lists.nanog.org

SD-WAN Packet Duplication
by Mike Hammett 15 Sep '25

15 Sep '25

One of the results of another thread mentioned that some SD-WAN technologies employ packet duplication across multiple WAN circuits as a part of their service. What are your experiences like with platforms like that? What would your recommendation be for a fairly low bit rate requirement of packet duplication? ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com

2 1

MD5 is slow
by Vasilenko Eduard 15 Sep '25

15 Sep '25

Hi all, So many smart people are in the discussion about MD5 ... I have a temptation to ask: why hash in the first place?!? (does not matter MD5 or SHA-2) Any hash MUST be slow (by design) to withstand brute force. In the network device case, it is about 5ms for SHA-2 (of course, dependent on the control plane processor). It should be checked on every hop for routing event propagation. Hence, it creates a delay for the event propagation that is typically much higher than RTT. When "Packet Design" was alive, they measured 300ms cross-US. A decade later, it should be faster, but anyway slow enough. It is a big part (maybe even the biggest) of the "sub-second" convergence of IGP protocols. Actually, it greatly undermines the value of ISIS IETF performance tunings: https://datatracker.ietf.org/doc/html/rfc9681. Why do people not use symmetric encryption for networking protocols? Symmetric encryption has a typical latency of 10s of microseconds. Of course, it is possible to calculate how much energy would be saved on hash calculations worldwide, but people in this group would probably not welcome a green agenda. And this number would be miserable against bitcoin. Eduard

17 61

Lexington Electric System blames internet outages on shotgun pellets
by Sean Donelan 15 Sep '25

15 Sep '25

Lexington Electric System's post [...] "With dove season in full swing, we ask all our customers to please be mindful of their surroundings and avoid shooting doves on or near fiber/electric lines." https://www.facebook.com/LexingtonElectricSystem/posts/pfbid02sLbWAfYptUyMG…

4 3

Weekly Global IPv4 Routing Table Report
by Routing Table Analysis Role Account 12 Sep '25

12 Sep '25

This is an automated weekly mailing describing the state of the Global IPv4 Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG UKNOF, TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net. For historical data, please see https://thyme.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. IPv4 Routing Table Report 04:00 +10GMT Sat 13 Sep, 2025 IPv4 BGP Table (Global) as seen at Japan. Report Website: https://thyme.apnic.net Detailed Analysis: https://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 1001645 Prefixes after maximum aggregation (per Origin AS): 388980 Deaggregation factor: 2.58 Unique aggregates announced (without unneeded subnets): 493970 Number of IPv4 prefixes with a valid ROA: 565327 Number of IPv4 prefixes with an invalid ROA: 1405 Number of IPv4 prefixes with no ROA: 434913 Total ASes present in the Internet Routing Table: 77324 Prefixes per ASN: 12.95 Origin-only ASes present in the Internet Routing Table: 66440 Origin ASes announcing only one prefix: 27060 Transit ASes present in the Internet Routing Table: 10884 Transit-only ASes present in the Internet Routing Table: 532 Average AS path length visible in the Internet Routing Table: 4.7 Max AS path length visible: 57 Max AS path prepend of ASN ( 37447) 53 Prefixes from unregistered ASNs in the Routing Table: 1083 Number of instances of unregistered ASNs: 1121 Number of 32-bit ASNs allocated by the RIRs: 47403 Number of 32-bit ASNs visible in the Routing Table: 38957 Prefixes from 32-bit ASNs in the Routing Table: 209842 Number of bogon 32-bit ASNs visible in the Routing Table: 105 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 446 Number of addresses announced to Internet: 3108529536 Equivalent to 185 /8s, 72 /16s and 101 /24s Percentage of available address space announced: 84.0 Percentage of allocated address space announced: 84.0 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.6 Total number of prefixes smaller than registry allocations: 326604 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 267698 Total APNIC prefixes after maximum aggregation: 79736 APNIC Deaggregation factor: 3.36 Prefixes being announced from the APNIC address blocks: 257831 Unique aggregates announced from the APNIC address blocks: 105656 APNIC Region origin ASes present in the Internet Routing Table: 14829 APNIC Prefixes per ASN: 17.39 APNIC Region origin ASes announcing only one prefix: 4530 APNIC Region transit ASes present in the Internet Routing Table: 1964 Average APNIC Region AS path length visible: 4.7 Max APNIC Region AS path length visible: 35 Number of APNIC region 32-bit ASNs visible in the Routing Table: 10364 Number of APNIC addresses announced to Internet: 751076352 Equivalent to 44 /8s, 196 /16s and 132 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-155961 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 294075 Total ARIN prefixes after maximum aggregation: 133685 ARIN Deaggregation factor: 2.20 Prefixes being announced from the ARIN address blocks: 295289 Unique aggregates announced from the ARIN address blocks: 142601 ARIN Region origin ASes present in the Internet Routing Table: 19293 ARIN Prefixes per ASN: 15.31 ARIN Region origin ASes announcing only one prefix: 7055 ARIN Region transit ASes present in the Internet Routing Table: 1925 Average ARIN Region AS path length visible: 4.3 Max ARIN Region AS path length visible: 28 Number of ARIN region 32-bit ASNs visible in the Routing Table: 5327 Number of ARIN addresses announced to Internet: 1349597184 Equivalent to 80 /8s, 113 /16s and 56 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-402332 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 54/8, 55/8, 56/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 278862 Total RIPE prefixes after maximum aggregation: 137796 RIPE Deaggregation factor: 2.02 Prefixes being announced from the RIPE address blocks: 278097 Unique aggregates announced from the RIPE address blocks: 179857 RIPE Region origin ASes present in the Internet Routing Table: 29061 RIPE Prefixes per ASN: 9.57 RIPE Region origin ASes announcing only one prefix: 12111 RIPE Region transit ASes present in the Internet Routing Table: 3930 Average RIPE Region AS path length visible: 4.8 Max RIPE Region AS path length visible: 26 Number of RIPE region 32-bit ASNs visible in the Routing Table: 12695 Number of RIPE addresses announced to Internet: 732231552 Equivalent to 43 /8s, 164 /16s and 247 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-216475 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 53/8, 57/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 125008 Total LACNIC prefixes after maximum aggregation: 30211 LACNIC Deaggregation factor: 4.14 Prefixes being announced from the LACNIC address blocks: 121225 Unique aggregates announced from the LACNIC address blocks: 49406 LACNIC Region origin ASes present in the Internet Routing Table: 11286 LACNIC Prefixes per ASN: 10.74 LACNIC Region origin ASes announcing only one prefix: 2646 LACNIC Region transit ASes present in the Internet Routing Table: 2508 Average LACNIC Region AS path length visible: 5.3 Max LACNIC Region AS path length visible: 37 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 9243 Number of LACNIC addresses announced to Internet: 170745344 Equivalent to 10 /8s, 45 /16s and 94 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-274844 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 34919 Total AfriNIC prefixes after maximum aggregation: 6830 AfriNIC Deaggregation factor: 5.11 Prefixes being announced from the AfriNIC address blocks: 48757 Unique aggregates announced from the AfriNIC address blocks: 16055 AfriNIC Region origin ASes present in the Internet Routing Table: 1966 AfriNIC Prefixes per ASN: 24.80 AfriNIC Region origin ASes announcing only one prefix: 718 AfriNIC Region transit ASes present in the Internet Routing Table: 384 Average AfriNIC Region AS path length visible: 5.4 Max AfriNIC Region AS path length visible: 57 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 1328 Number of AfriNIC addresses announced to Internet: 104633856 Equivalent to 6 /8s, 60 /16s and 150 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 13332 8759 113 CHINAMOBILE-CN China Mobile Communication 7545 6139 838 616 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4951 4193 77 ERX-CERNET-BKB China Education and Resear 9498 4468 536 312 BBIL-AP BHARTI Airtel Ltd., IN 7552 3939 1332 27 VIETEL-AS-AP Viettel Group, VN 7713 3661 1044 66 TELKOMNET-AS-AP PT Telekomunikasi Indones 45899 3309 1869 100 VNPT-AS-VN VNPT Corp, VN 56046 3013 811 180 CMNET-JIANGSU-AP China Mobile communicati 24560 2920 863 509 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd., 4766 2333 11522 632 KIXS-AS-KR Korea Telecom, KR Complete listing at https://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 14348 40863 5377 AMAZON-02, US 11492 4734 314 823 CABLEONE, US 22773 3966 3063 315 ASN-CXA-ALL-CCI-22773-RDC, US 7155 3859 286 85 VIASAT-SP-BACKBONE, US 6327 3668 1320 81 SHAW, CA 174 3377 8766 830 COGENT-174, US 396982 3226 3858 442 GOOGLE-CLOUD-PLATFORM, US 749 3219 54766 2470 DNIC-AS-00749, US 4155 3006 234 1741 USDA-1, US 16625 2904 1227 2155 AKAMAI-AS, US Complete listing at https://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 7484 1711 149 UNI2-AS, ES 39891 4798 293 63 ALJAWWALSTC-AS, SA 20940 3911 3395 127 AKAMAI-ASN1, NL 9009 3904 366 2193 M247, RO 12389 3132 2316 868 ROSTELECOM-AS PJSC Rostelecom. Technical 212238 2418 172 1751 CDNEXT, GB 34984 2415 363 574 TELLCOM-AS, TR 203020 1896 226 876 HOSTROYALE, IN 8452 1611 1852 14 TE-AS TE-AS, EG 13188 1607 100 27 TRIOLAN, UA Complete listing at https://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 12370 3280 573 UNINET, MX 10620 3492 473 1046 Telmex Colombia S.A., CO 13999 2543 511 348 Mega Cable, S.A. de C.V., MX 11830 1989 369 64 Instituto Costarricense de Electricidad y 28573 1375 2433 261 Claro NXT Telecomunicacoes Ltda, BR 3816 1352 789 205 COLOMBIA TELECOMUNICACIONES S.A. ESP BIC, 11664 1221 278 33 Techtel LMDS Comunicaciones Interactivas 6147 1179 371 22 Telefonica del Peru S.A.A., PE 22884 1059 67 359 TOTAL PLAY TELECOMUNICACIONES SA DE CV, M 26615 1009 2487 55 TIM SA, BR Complete listing at https://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24835 1823 652 28 RAYA-AS, EG 36992 1504 1498 379 ETISALAT-MISR, EG 36903 1250 554 97 MT-MPLS, MA 24863 1246 389 20 LINKdotNET-AS, EG 29571 1241 102 50 ORANGE-COTE-IVOIRE, CI 37069 1085 1096 13 MOBINIL, EG 36935 1066 523 46 Vodafone-, EG 20011 576 154 212 NTT-DATA-Inc, ZA 36914 575 82 3 KENET-AS, KE 15399 547 56 56 WANANCHI-, KE Complete listing at https://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 14348 40863 5377 AMAZON-02, US 9808 13332 8759 113 CHINAMOBILE-CN China Mobile Communication 8151 12370 3280 573 UNINET, MX 12479 7484 1711 149 UNI2-AS, ES 7545 6139 838 616 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4951 4193 77 ERX-CERNET-BKB China Education and Resear 39891 4798 293 63 ALJAWWALSTC-AS, SA 11492 4734 314 823 CABLEONE, US 9498 4468 536 312 BBIL-AP BHARTI Airtel Ltd., IN 22773 3966 3063 315 ASN-CXA-ALL-CCI-22773-RDC, US Complete listing at https://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 9808 13332 13219 CHINAMOBILE-CN China Mobile Communications Grou 8151 12370 11797 UNINET, MX 12479 7484 7335 UNI2-AS, ES 7545 6139 5523 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4951 4874 ERX-CERNET-BKB China Education and Research Net 39891 4798 4735 ALJAWWALSTC-AS, SA 9498 4468 4156 BBIL-AP BHARTI Airtel Ltd., IN 7552 3939 3912 VIETEL-AS-AP Viettel Group, VN 11492 4734 3911 CABLEONE, US 20940 3911 3784 AKAMAI-ASN1, NL Complete listing at https://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 46639 UNALLOCATED 8.17.66.0/24 701 UUNET, US 53775 UNALLOCATED 8.20.88.0/24 7029 WINDSTREAM, US 396146 UNALLOCATED 8.21.227.0/24 3356 LEVEL3, US 393266 UNALLOCATED 8.23.52.0/24 46887 CROWNCASTLE-AS46887, US 396894 UNALLOCATED 8.28.201.0/24 3356 LEVEL3, US 394936 UNALLOCATED 8.33.224.0/24 22442 HOU-PHONOSCOPE, US 54338 UNALLOCATED 8.33.241.0/24 3356 LEVEL3, US 46639 UNALLOCATED 8.38.73.0/24 3356 LEVEL3, US 395195 UNALLOCATED 8.38.115.0/24 3356 LEVEL3, US 1782 UNALLOCATED 8.42.19.0/24 3356 LEVEL3, US Complete listing at https://thyme.apnic.net/current/data-badAS Prefixes from the Special Purpose Address Registry (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at https://thyme.apnic.net/current/data-spar Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 14.192.20.0/22 Origin: 26658 HENGTONG-IDC-LLC, US 14.192.20.0/22 Transit: 21859 ZEN-ECN, US 23.135.216.0/24 Origin: 400565 RESERVED, ZZ 23.135.216.0/24 Transit: 3356 LEVEL3, US 23.140.216.0/24 Origin: 27176 DATAWAGON, US 23.140.216.0/24 Transit: 20278 NEXEON, US 23.141.0.0/24 Origin: 395350 RESERVED, ZZ 23.141.0.0/24 Transit: 11426 TWC-11426-CAROLINAS, US 23.142.24.0/24 Origin: 62164 HEYMMAN-2, CA 23.142.24.0/24 Transit: 64236 UNREAL-SERVERS, US Complete listing at https://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:14 /10:41 /11:92 /12:298 /13:578 /14:1200 /15:2126 /16:13784 /17:8279 /18:13526 /19:24798 /20:45109 /21:52468 /22:112890 /23:103553 /24:622085 /25:788 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 8151 6569 12370 UNINET, MX 12479 6445 7484 UNI2-AS, ES 11492 3550 4734 CABLEONE, US 39891 3489 4798 ALJAWWALSTC-AS, SA 6327 3465 3668 SHAW, CA 7155 2818 3859 VIASAT-SP-BACKBONE, US 22773 2506 3966 ASN-CXA-ALL-CCI-22773-RDC, US 16509 2439 14348 AMAZON-02, US 30036 2308 2650 MEDIACOM-ENTERPRISE-BUSINESS, US 10620 2210 3492 Telmex Colombia S.A., CO Complete listing at https://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1777 2:1521 3:926 4:10 5:4769 6:157 7:6 8:1566 9:4 11:172 12:1249 13:561 14:2657 15:399 16:303 17:389 18:903 20:570 21:4 22:188 23:7841 24:2659 25:2 27:2746 29:19 31:3364 32:33 33:1 34:81 35:274 36:4323 37:4542 38:9398 39:1032 40:282 41:4338 42:944 43:2689 44:372 45:18976 46:5117 47:346 49:2006 50:2054 51:592 52:1606 54:369 55:1111 56:11 57:287 58:2163 59:1353 60:1183 61:2888 62:3052 63:1772 64:5617 65:2135 66:4848 67:3092 68:1079 69:3911 70:1039 71:631 72:2884 74:2819 75:1503 76:604 77:2782 78:1902 79:1766 80:2249 81:2088 82:3309 83:1458 84:1973 85:3494 86:1101 87:2373 88:1324 89:4499 90:804 91:8395 92:2785 93:2978 94:4165 95:4434 96:1450 97:312 98:947 99:750 100:71 101:1223 102:4048 103:32265 104:5293 105:773 106:878 107:2656 108:1231 109:4200 110:2241 111:3732 112:2538 113:1565 114:1997 115:2167 116:2075 117:2806 118:2534 119:1962 120:2235 121:1404 122:2810 123:2244 124:1738 125:2910 126:91 128:1572 129:967 130:1291 131:2139 132:786 133:461 134:1599 135:365 136:1485 137:1193 138:2831 139:1596 140:1629 141:1539 142:1910 143:2047 144:1247 145:608 146:2185 147:2108 148:2682 149:2902 150:1269 151:2415 152:2121 153:563 154:7484 155:2035 156:3603 157:1976 158:1422 159:2562 160:3588 161:1951 162:3915 163:2295 164:1921 165:2581 166:1565 167:2080 168:3830 169:778 170:5355 171:1007 172:4230 173:3408 174:904 175:1338 176:3802 177:4777 178:4112 179:2305 180:2603 181:4207 182:3704 183:2201 184:2060 185:21642 186:5410 187:4651 188:4269 189:4377 190:9665 191:1558 192:11400 193:9477 194:7803 195:5570 196:3308 197:3243 198:6248 199:8677 200:8257 201:6341 202:10619 203:10594 204:4593 205:3677 206:4548 207:3662 208:4282 209:5244 210:4940 211:2756 212:4695 213:3858 214:1042 215:52 216:6863 217:3309 218:1515 219:567 220:2149 221:1218 222:883 223:2870 End of report

1 0

** Secure Your Spot at NANOG 95 Before Prices Rise + More
by Nanog News 12 Sep '25

12 Sep '25

*** Secure Your Spot at NANOG 95 Before Prices Rise* ------------------------------------------------------------ *Lock in Your Spot at N95 Before Monday, Sept. 15* 🎟️ Ready to join your NANOG crew in Arlington? *Standard pricing wraps Monday, Sept. 15 *— so don’t miss your chance to lock in. From hallway conversations to inspiring peering collabs, NANOG 95 (Oct. 27–29) is where our community comes together to share ideas, sharpen skills, and shape the future of the network. 💡🌐 👉 See who’s speaking, what’s on the agenda, and all things NANOG 95 below. REGISTER NOW (https://nanog.org/events/nanog-95/register/) *** Sign Up for N95 Peering Coordination Forum* ------------------------------------------------------------ *N95 Peering Applications are Open until Oct 6 or until 15 Applications are Received!* MORE INFO (https://nanog.org/events/nanog-95/peering/) *** Reminder - NANOG Board Nominations are Open!* ------------------------------------------------------------ *Your Voice. Your Vote!* Don't wait! Play a role in shaping NANOG's future TODAY. VIEW MORE (https://nanog.org/members/elections/elections-nominations/) *** NANOG Showcase Still Available!* ------------------------------------------------------------ *Going, Going… Almost Gone! Limited Booths Still Available * NANOG's booth experience is located in the highly trafficked open seating area. We provide a table with a branded table top banner. Attendees visit showcase booths to learn more about product offerings and build new relationships. *Email sponsorship(a)nanog.org <sponsorship(a)nanog.org> for more info!* *** Stay Connected* ------------------------------------------------------------ http://www.facebook.com http://www.instagram.com/nanog_org/ http://www.linkedin.com/company/nanog/ https://www.twitter.com/nanog/ http://nanog.org

1 0

RE: MD5 is too fast
by nanog＠immibis.com 12 Sep '25

12 Sep '25

[seems to have accidentally moved off list] Passwords for TCP-MD5 and TCP-AO do not have to be remembered, and they are configured by experts who know they should be random. On 12 September 2025 13:31:03 CEST, Vasilenko Eduard <vasilenko.eduard(a)huawei.com> wrote: > * You will see that the number of random letters is very very important. >For sure, very important, every letter is 75x. >But nobody would be capable of remembering even 8 random letters. People would continue to choose not very strong passwords. >It is possible to fight with people or help them with technology that would not need such strong passwords. >The IT world has chosen the latter. Many smart people have participated in this – I do not believe that they have forgotten to account for something. > >And do not forget that for the process of brute force, the password “7Jon%Brain&Letter” (17 letters) is weaker than “n4H*h!s$” (8 letters). >I mean: there is a way to downgrade too, even for long passwords. > >Only full automation when passwords are not appointed manually permits raising the bar of password complexity. >Eduard >From: nanog(a)immibis.com <nanog(a)immibis.com> >Sent: Friday, September 12, 2025 13:33 >To: Vasilenko Eduard <vasilenko.eduard(a)huawei.com> >Subject: RE: MD5 is too fast > >You did 10 random letters with 8 5090s and you calculated 19 days. > >Have you calculated 12 random letters? 16 random letters? 24 random letters? 40 random letters? > >You will see that the number of random letters is very very important. > >On 12 September 2025 09:53:36 CEST, Vasilenko Eduard <vasilenko.eduard(a)huawei.com<mailto:vasilenko.eduard@huawei.com>> wrote: > >I hope I have answered in the thread. >If not, ping me. >Ed/ >-----Original Message----- >From: nanog--- via NANOG <nanog(a)lists.nanog.org<mailto:nanog@lists.nanog.org>> >Sent: Thursday, September 11, 2025 18:17 >To: North American Network Operators Group <nanog(a)lists.nanog.org<mailto:nanog@lists.nanog.org>> >Cc: nanog(a)immibis.com<mailto:nanog@immibis.com> >Subject: RE: MD5 is too fast > >Have you calculated how long it should take to test all 80-bit passwords? 200-bit passwords? 2000-bit passwords? > >Suppose that a good server can try about a billion passwords per second. How long do you think it takes to try all the passwords? > > >On 11 September 2025 12:18:00 CEST, Vasilenko Eduard via NANOG <nanog(a)lists.nanog.org<mailto:nanog@lists.nanog.org>> wrote: > >The simple integer division on the processor takes something like 40 cycles (fast). Hence, the factorization challenge should have thousands of bits. Then it is going to take millions of years for one processor to try all possibilities. > >If the password is just 12 letters (80 bits?), then the time to test the password should be longer. Or else the good processor would try all combinations for a limited time. >Of course, a longer password would help a lot, but even 200 bits is not 2000. The check should be proportionally slower. >It is especially a problem when we are dealing with predictable passwords based on human language words. > >Maybe SHA-2/3 have not been developed with "slowness" as a goal. It may be that only randomness was the target. Hence, so many assembler instructions for one round. >But only the slowness permits its use for HMAC or the password fingerprint that you have discussed before. >I could not believe that slowness is just a byproduct of randomness. It is so evident why it is needed by itself (for some applications). >Ed/ >-----Original Message----- >From: Thomas Bellman via NANOG <nanog(a)lists.nanog.org<mailto:nanog@lists.nanog.org>> >Sent: Thursday, September 11, 2025 12:03 >To: North American Network Operators Group <nanog(a)lists.nanog.org<mailto:nanog@lists.nanog.org>> >Cc: Thomas Bellman <bellman(a)nsc.liu.se<mailto:bellman@nsc.liu.se>> >Subject: Re: MD5 is slow > >On 2025-09-11 09:23, Vasilenko Eduard via NANOG wrote: > >SHA-2 and SHA-3 are used not only for networking, they are general. >Hence, they were developed to be slow enough to prevent brute force >for some other applications. > >Since you are asserting that the hash functions must be "slow" in order to resist brute force attacks, could you perhaps give us an estimate of *how* slow they must be? And how you arrive at that (e.g. how much resources does the attacker deploy, and how long walltime do you give the attacker)? > > > /Bellman > >________________________________ > >NANOG mailing list >https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/SZV >2BS2WTBZIF5TOK43UQ4GYGNSB4QVX/ > >________________________________ > >NANOG mailing list >https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/S3YL6WS…

1 0

KEA DHCPv6 HA - help with failover
by Aaron Gould 11 Sep '25

11 Sep '25

Anybody doing KEA DHCPv6 HA dual servers? We tested an outage scenario of bringing down KEA service on one of the servers, but the other server didn't seem to be able to service new DHCPv6 requests (or handle the existing ones, that were previously given out by the now-downed server). -- -Aaron

3 4

So am I just excitable?
by michael brooks - ESC 09 Sep '25

09 Sep '25

I have been watching the "Weekly Global IPv4 Routing Table Report" for a while now, and have been itching to see the *BGP routing table entries examined line* hit 1M. Now, perhaps I am naive, I am assuming that line correlates to the actual number of routing table entries, true? Am I the only one a bit excited to see this? Is this a non-event? michael brooks Network/Systems Administrator IV Adams 12 Five Star Schools michael.brooks(a)adams12.org :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: "flying is learning how to throw yourself at the ground and miss" -- <http://www.adams12.org> -- This is a staff email account managed by Adams 12 Five Star Schools. This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender.

10 14

control characters in BGP shutdown communication(RFC 9003) messages and NETCONF
by Martin Tonusoo 08 Sep '25

08 Sep '25

Hi. Meta(AS 32934) recently sent a cease NOTIFICATION message to its neighbors on AMS-IX and Piter-IX which had a "<0b>maintenance" string on the RFC 9003 "Shutdown Communication" field. In other words, the "Shutdown Communication" field contained "0b 6d 61 69 6e 74 65 6e 61 6e 63 65". At least on Junos(tested with versions 21.4R3-S3.4, 23.2R2-S4.5 and 25.2R1.9), calling the "get-bgp-summary-information" or "get-bgp-neighbor-information" RPCs using NETCONF returns the string containing the control character and this in turn means that libraries parsing the XML fail as 0x0b(vertical tab) is not in the allowed character range of XML 1.0: https://www.w3.org/TR/xml/#charsets Who is to blame here? Junos, for returning invalid characters in its NETCONF response? Martin

6 8

Canada mandates for Telecom outage reporting Nov. 4
by Sean Donelan 08 Sep '25

08 Sep '25

Canada's telecommunications regulator is mandating service providers to notify it and other government authorities within two hours when they experience a major network outage. The requirements take effect permanently on Nov. 4, 2025 Providers must give a comprehensive post-outage report to the CRTC within 30 days of restoring services after a major service outage. These reports must explain the reasons for the outage and the steps taken to prevent similar outages in the future. https://www.cbc.ca/news/business/telecom-outages-crtc-rules-1.7625283 https://www.canada.ca/en/radio-television-telecommunications/news/2025/09/b…

1 0