- NANOG - lists.nanog.org

RE: FAA - ASDI servers
by Ryan Finnesey 08 Jan '11

08 Jan '11

Is anyone on the list from the FAA? I am trying to find out if we can connect to the ASDI servers via IPv6. Cheers Ryan

12 18

Re: asymmetric routes/security concerns/Fortinet
by Greg Whynott 08 Jan '11

08 Jan '11

Randy your assumptions are correct, all outbounds get that slapped on them, automagically. good thing you have read the same magic book and can counter! 8) I don't or ever did expect anything from you, not sure why you thought i might. do you think I should quit this organization because we do this, and not consider the good work and intentions they have? (finding a cure for cancer) I don't think the legal's deparments intention was to force anything onto the world. sounds like you have a lot of anger issues to work out. 8) take care and have a great weekend, greg On Jan 7, 2011, at 4:59 PM, Randy Bush wrote: > you have sent a message to me which seems to contain a legal > warning on who can read it, or how it may be distributed, or > whether it may be archived, etc. > > i do not accept such email. my mail user agent detected a legal > notice when i was opening your mail, and automatically deleted it. > so do not expect further response. > > yes, i know your mail environment automatically added the legal > notice. well, my mail environment automatically detected it, > deleted it, and sent this message to you. so don't expect a lot > of sympathy. > > and if you choose to work for some enterprise clueless enough to > think that they can force this silliness on the world, use gmail, > hotmail, ... > > randy -- This message and any attachments may contain confidential and/or privileged information for the sole use of the intended recipient. Any review or distribution by anyone other than the person for whom it was originally intended is strictly prohibited. If you have received this message in error, please contact the sender and delete all copies. Opinions, conclusions or other information contained in this message may not be that of the organization.

2 1

Gmail Contact
by Mikeal Clark 07 Jan '11

07 Jan '11

I'm having some issues with personal domains that forward to gmail being blacklist. If anyone from gmail would be available to talk through it with me offlist I would greatly appreciate it. Thanks, Mikeal

1 0

BGP Update Report
by cidr-report＠potaroo.net 07 Jan '11

07 Jan '11

BGP Update Report Interval: 30-Dec-10 -to- 06-Jan-11 (7 days) Observation Point: BGP Peering with AS131072 TOP 20 Unstable Origin AS Rank ASN Upds % Upds/Pfx AS-Name 1 - AS18025 31461 3.2% 873.9 -- ACE-1-WIFI-AS-AP Ace-1 Wifi Network 2 - AS17974 20942 2.1% 17.7 -- TELKOMNET-AS2-AP PT Telekomunikasi Indonesia 3 - AS8103 20677 2.1% 55.0 -- STATE-OF-FLA - Florida Department of Management Services - Technology Program 4 - AS32528 19431 2.0% 4857.8 -- ABBOTT Abbot Labs 5 - AS33475 18464 1.9% 129.1 -- RSN-1 - RockSolid Network, Inc. 6 - AS24627 17517 1.8% 486.6 -- SHOWNET-KW-AS GULFSATCOMMUNICATIONS COMPANY K.S.C. 7 - AS35931 15601 1.6% 5200.3 -- ARCHIPELAGO - ARCHIPELAGO HOLDINGS INC 8 - AS7462 13969 1.4% 297.2 -- ONEWEST - SRVnet, Inc. 9 - AS24554 12398 1.3% 108.8 -- FIVE-NET-AS-IN Fivenetwork Solution India Pvt Ltd Internet 10 - AS9498 12353 1.2% 17.5 -- BBIL-AP BHARTI Airtel Ltd. 11 - AS24923 12123 1.2% 12123.0 -- SETTC South-East Transtelecom Joint Stock Co. 12 - AS23700 11034 1.1% 30.1 -- BM-AS-ID PT. Broadband Multimedia, Tbk 13 - AS45474 10393 1.1% 692.9 -- NEXUSGUARD-AS-AP Tower 1 Millennium City 1 14 - AS10113 10157 1.0% 597.5 -- DATAFAST-AP DATAFAST TELECOMMUNICATIONS LTD 15 - AS24560 9145 0.9% 8.7 -- AIRTELBROADBAND-AS-AP Bharti Airtel Ltd., Telemedia Services 16 - AS9829 9012 0.9% 23.9 -- BSNL-NIB National Internet Backbone 17 - AS25620 8759 0.9% 62.1 -- COTAS LTDA. 18 - AS5800 8266 0.8% 37.9 -- DNIC-ASBLK-05800-06055 - DoD Network Information Center 19 - AS8151 6941 0.7% 21.6 -- Uninet S.A. de C.V. 20 - AS45595 6611 0.7% 13.8 -- PKTELECOM-AS-PK Pakistan Telecom Company Limited TOP 20 Unstable Origin AS (Updates per announced prefix) Rank ASN Upds % Upds/Pfx AS-Name 1 - AS24923 12123 1.2% 12123.0 -- SETTC South-East Transtelecom Joint Stock Co. 2 - AS35931 15601 1.6% 5200.3 -- ARCHIPELAGO - ARCHIPELAGO HOLDINGS INC 3 - AS32528 19431 2.0% 4857.8 -- ABBOTT Abbot Labs 4 - AS17408 3041 0.3% 3041.0 -- ABOVE-AS-AP AboveNet Communications Taiwan 5 - AS4454 2979 0.3% 2979.0 -- TNET-AS - State of Tennessee 6 - AS49776 1870 0.2% 1870.0 -- GORSET-AS Gorodskaya Set Ltd. 7 - AS49600 1745 0.2% 1745.0 -- LASEDA La Seda de Barcelona, S.A 8 - AS8510 1441 0.1% 1441.0 -- Tomsk town Educational and Scientific network 9 - AS2828 5679 0.6% 1419.8 -- XO-AS15 - XO Communications 10 - AS34239 1335 0.1% 1335.0 -- INTERAMERICAN General Insurance Company 11 - AS43534 2597 0.3% 1298.5 -- CREDITCALL CreditCall Ltd 12 - AS45550 1221 0.1% 1221.0 -- NGT-AS-VN New Generations Telecommunications Corporation 13 - AS2685 1955 0.2% 977.5 -- ASATTCA AT&T Global Network Services - CA 14 - AS28666 4805 0.5% 961.0 -- HOSTLOCATION LTDA 15 - AS21324 926 0.1% 926.0 -- OSW Osrodek Studiow Wschodnich im Marka Karpia 16 - AS1959 2755 0.3% 918.3 -- DMSLABNET - DoD Network Information Center 17 - AS18025 31461 3.2% 873.9 -- ACE-1-WIFI-AS-AP Ace-1 Wifi Network 18 - AS47722 861 0.1% 861.0 -- CONCORDE-AS Concorde Capital Ltd. 19 - AS27666 814 0.1% 814.0 -- INSTITUTO TECNOLOGICO DE TELEFONOS DE MEXICO 20 - AS21271 798 0.1% 798.0 -- SOTELMABGP TOP 20 Unstable Prefixes Rank Prefix Upds % Origin AS -- AS Name 1 - 194.126.34.0/24 17142 1.6% AS24627 -- SHOWNET-KW-AS GULFSATCOMMUNICATIONS COMPANY K.S.C. 2 - 213.129.96.0/19 12123 1.1% AS24923 -- SETTC South-East Transtelecom Joint Stock Co. 3 - 180.233.173.0/24 10181 1.0% AS45474 -- NEXUSGUARD-AS-AP Tower 1 Millennium City 1 4 - 202.182.78.0/23 10125 1.0% AS10113 -- DATAFAST-AP DATAFAST TELECOMMUNICATIONS LTD 5 - 63.211.68.0/22 10064 0.9% AS35931 -- ARCHIPELAGO - ARCHIPELAGO HOLDINGS INC 6 - 130.36.35.0/24 9716 0.9% AS32528 -- ABBOTT Abbot Labs 7 - 130.36.34.0/24 9711 0.9% AS32528 -- ABBOTT Abbot Labs 8 - 202.92.235.0/24 7094 0.7% AS9498 -- BBIL-AP BHARTI Airtel Ltd. 9 - 27.123.248.0/22 6288 0.6% AS18025 -- ACE-1-WIFI-AS-AP Ace-1 Wifi Network 10 - 182.54.140.0/22 6279 0.6% AS18025 -- ACE-1-WIFI-AS-AP Ace-1 Wifi Network 11 - 182.54.148.0/22 6279 0.6% AS18025 -- ACE-1-WIFI-AS-AP Ace-1 Wifi Network 12 - 101.78.24.0/22 6129 0.6% AS18025 -- ACE-1-WIFI-AS-AP Ace-1 Wifi Network 13 - 101.78.20.0/22 6128 0.6% AS18025 -- ACE-1-WIFI-AS-AP Ace-1 Wifi Network 14 - 198.140.43.0/24 5446 0.5% AS35931 -- ARCHIPELAGO - ARCHIPELAGO HOLDINGS INC 15 - 189.1.173.0/24 4739 0.5% AS28666 -- HOSTLOCATION LTDA 16 - 216.126.136.0/22 4559 0.4% AS6316 -- AS-PAETEC-NET - PaeTec Communications, Inc. 17 - 189.85.51.0/24 3683 0.3% AS28175 -- 18 - 206.184.16.0/24 3553 0.3% AS174 -- COGENT Cogent/PSI 19 - 68.65.152.0/22 3358 0.3% AS11915 -- TELWEST-NETWORK-SVCS-STATIC - TEL WEST COMMUNICATIONS LLC 20 - 202.153.174.0/24 3041 0.3% AS17408 -- ABOVE-AS-AP AboveNet Communications Taiwan Details at http://bgpupdates.potaroo.net ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

The Cidr Report
by cidr-report＠potaroo.net 07 Jan '11

07 Jan '11

This report has been generated at Fri Jan 7 21:11:48 2011 AEST. The report analyses the BGP Routing Table of AS2.0 router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org for a current version of this report. Recent Table History Date Prefixes CIDR Agg 31-12-10 341294 200729 01-01-11 341509 200882 02-01-11 341492 200810 03-01-11 341470 200862 04-01-11 341512 200876 05-01-11 341666 200899 06-01-11 341989 200893 07-01-11 342117 201012 AS Summary 36422 Number of ASes in routing system 15485 Number of ASes announcing only one prefix 3717 Largest number of prefixes announced by an AS AS6389 : BELLSOUTH-NET-BLK - BellSouth.net Inc. 118804736 Largest address span announced by an AS (/32s) AS237 : MERIT-ASN Merit Network Inc. Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 07Jan11 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 342320 201017 141303 41.3% All ASes AS6389 3717 271 3446 92.7% BELLSOUTH-NET-BLK - BellSouth.net Inc. AS4323 2633 405 2228 84.6% TWTC - tw telecom holdings, inc. AS19262 1841 286 1555 84.5% VZGNI-TRANSIT - Verizon Online LLC AS4766 1898 540 1358 71.5% KIXS-AS-KR Korea Telecom AS22773 1263 83 1180 93.4% ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc. AS6478 1441 272 1169 81.1% ATT-INTERNET3 - AT&T Services, Inc. AS4755 1394 337 1057 75.8% TATACOMM-AS TATA Communications formerly VSNL is Leading ISP AS1785 1788 769 1019 57.0% AS-PAETEC-NET - PaeTec Communications, Inc. AS28573 1226 313 913 74.5% NET Servicos de Comunicao S.A. AS7545 1559 714 845 54.2% TPG-INTERNET-AP TPG Internet Pty Ltd AS6503 1198 362 836 69.8% Axtel, S.A.B. de C.V. AS10620 1344 545 799 59.4% Telmex Colombia S.A. AS18101 913 150 763 83.6% RELIANCE-COMMUNICATIONS-IN Reliance Communications Ltd.DAKC MUMBAI AS8151 1409 663 746 52.9% Uninet S.A. de C.V. AS7303 840 122 718 85.5% Telecom Argentina S.A. AS4808 1022 316 706 69.1% CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network AS3356 1189 489 700 58.9% LEVEL3 Level 3 Communications AS24560 1060 371 689 65.0% AIRTELBROADBAND-AS-AP Bharti Airtel Ltd., Telemedia Services AS17488 943 269 674 71.5% HATHWAY-NET-AP Hathway IP Over Cable Internet AS9498 736 108 628 85.3% BBIL-AP BHARTI Airtel Ltd. AS18566 1095 475 620 56.6% COVAD - Covad Communications Co. AS11492 1283 680 603 47.0% CABLEONE - CABLE ONE, INC. AS17676 645 68 577 89.5% GIGAINFRA Softbank BB Corp. AS855 630 55 575 91.3% CANET-ASN-4 - Bell Aliant Regional Communications, Inc. AS4780 749 211 538 71.8% SEEDNET Digital United Inc. AS22047 565 31 534 94.5% VTR BANDA ANCHA S.A. AS14420 593 89 504 85.0% CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP AS7552 632 132 500 79.1% VIETEL-AS-AP Vietel Corporation AS3549 856 358 498 58.2% GBLX Global Crossing Ltd. AS9443 571 75 496 86.9% INTERNETPRIMUS-AS-AP Primus Telecommunications Total 37033 9559 27474 74.2% Top 30 total Possible Bogus Routes 5.0.0.0/8 AS237 MERIT-ASN Merit Network Inc. 5.0.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 5.1.0.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 5.1.24.0/24 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 23.0.0.0/8 AS237 MERIT-ASN Merit Network Inc. 24.129.192.0/19 AS7922 COMCAST-7922 - Comcast Cable Communications, Inc. 37.0.0.0/8 AS237 MERIT-ASN Merit Network Inc. 37.0.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 37.1.0.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 37.1.24.0/24 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 41.222.79.0/24 AS36938 AMSCOTELECOMS Amsco Telecommunications Nigeria Limited 41.223.92.0/22 AS36936 CELTEL-GABON Celtel Gabon Internet Service 62.61.220.0/24 AS24974 TACHYON-EU Tachyon Europe BV 62.61.221.0/24 AS24974 TACHYON-EU Tachyon Europe BV 64.21.192.0/20 AS11610 INETNEBR-1 - Internet Nebraska Corporation 64.21.212.0/22 AS11610 INETNEBR-1 - Internet Nebraska Corporation 64.21.216.0/21 AS11610 INETNEBR-1 - Internet Nebraska Corporation 66.180.239.0/24 AS35888 VIGNETTE - VIGNETTE CORPORATION 66.206.32.0/24 AS17787 PSEB-AS-PK Pakistan Software Export Board 66.206.33.0/24 AS17787 PSEB-AS-PK Pakistan Software Export Board 66.206.34.0/24 AS17787 PSEB-AS-PK Pakistan Software Export Board 66.206.35.0/24 AS17787 PSEB-AS-PK Pakistan Software Export Board 66.206.47.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited 66.207.32.0/20 AS23011 66.245.176.0/20 AS19318 NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC 69.6.80.0/24 AS13442 69.6.81.0/24 AS13442 71.19.134.0/23 AS3313 INET-AS I.NET S.p.A. 72.22.32.0/19 AS33150 72.22.61.0/24 AS33150 72.22.62.0/24 AS33150 76.77.32.0/19 AS2828 XO-AS15 - XO Communications 80.88.10.0/24 AS33774 DJAWEB 80.88.12.0/24 AS33779 wataniya-telecom-as 96.45.161.0/24 AS3257 TINET-BACKBONE Tinet SpA 96.45.162.0/24 AS3257 TINET-BACKBONE Tinet SpA 96.45.163.0/24 AS3257 TINET-BACKBONE Tinet SpA 96.45.164.0/24 AS3257 TINET-BACKBONE Tinet SpA 96.45.165.0/24 AS3257 TINET-BACKBONE Tinet SpA 96.45.166.0/24 AS3257 TINET-BACKBONE Tinet SpA 96.45.167.0/24 AS3257 TINET-BACKBONE Tinet SpA 96.45.168.0/21 AS3257 TINET-BACKBONE Tinet SpA 100.0.0.0/8 AS237 MERIT-ASN Merit Network Inc. 100.100.100.0/24 AS3549 GBLX Global Crossing Ltd. 105.0.0.0/8 AS237 MERIT-ASN Merit Network Inc. 110.34.44.0/22 AS12653 COMTONET KB Impuls Hellas 110.173.64.0/19 AS37963 CNNIC-ALIBABA-CN-NET-AP Alibaba (China) Technology Co., Ltd. 113.29.0.0/17 AS3549 GBLX Global Crossing Ltd. 113.29.0.0/20 AS3549 GBLX Global Crossing Ltd. 113.29.16.0/20 AS3549 GBLX Global Crossing Ltd. 113.29.32.0/20 AS3549 GBLX Global Crossing Ltd. 113.29.64.0/20 AS3549 GBLX Global Crossing Ltd. 115.42.28.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 115.42.30.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 115.42.31.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 115.42.40.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 115.42.42.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 115.42.43.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 115.42.44.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 115.42.47.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 115.42.48.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 115.42.49.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 115.42.50.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 115.42.51.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 115.42.52.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 115.42.53.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 115.42.54.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 115.42.55.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 115.42.56.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 115.42.57.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 115.42.58.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 115.42.59.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 115.42.61.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 115.42.62.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 115.42.63.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 116.68.136.0/21 AS28045 Pantel Communications 117.120.56.0/21 AS4755 TATACOMM-AS TATA Communications formerly VSNL is Leading ISP 121.46.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 121.54.160.0/24 AS38890 121.54.161.0/24 AS38890 121.54.162.0/24 AS38890 121.54.163.0/24 AS38890 121.54.164.0/24 AS38890 121.54.166.0/24 AS38890 121.54.167.0/24 AS38890 121.200.192.0/24 AS17767 122.200.32.0/20 AS7018 ATT-INTERNET4 - AT&T Services, Inc. 122.200.40.0/21 AS38272 142.54.0.0/19 AS23498 CDSI - Cogeco Data Services Inc. 158.222.70.0/23 AS6137 SISNA - SISNA, Inc. 158.222.72.0/23 AS6137 SISNA - SISNA, Inc. 158.222.224.0/20 AS19864 O1COMM - O1 COMMUNICATIONS 158.222.224.0/22 AS19864 O1COMM - O1 COMMUNICATIONS 158.222.229.0/24 AS19864 O1COMM - O1 COMMUNICATIONS 172.12.0.0/18 AS28665 PredialNet Provedor de Internet Ltda. 176.0.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 176.1.0.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 176.1.24.0/24 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 180.210.220.0/22 AS17494 BTTB-AS-AP Telecom Operator & Internet Service Provider as well 190.102.32.0/20 AS30058 FDCSERVERS - FDCservers.net 192.9.0.0/16 AS11479 BRM-SUN-AS - Sun Microsystems, Inc 192.64.85.0/24 AS1759 TSF-IP-CORE TeliaSonera Finland IP Network 192.69.108.0/24 AS1759 TSF-IP-CORE TeliaSonera Finland IP Network 192.101.46.0/24 AS6503 Axtel, S.A.B. de C.V. 192.101.64.0/21 AS702 AS702 Verizon Business EMEA - Commercial IP service provider in Europe 192.101.70.0/24 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 192.101.71.0/24 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 192.101.72.0/24 AS702 AS702 Verizon Business EMEA - Commercial IP service provider in Europe 192.101.74.0/24 AS1239 SPRINTLINK - Sprint 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.131.233.0/24 AS6389 BELLSOUTH-NET-BLK - BellSouth.net Inc. 192.154.32.0/19 AS81 NCREN - MCNC 192.154.64.0/19 AS81 NCREN - MCNC 192.188.208.0/20 AS721 DNIC-ASBLK-00721-00726 - DoD Network Information Center 196.2.224.0/22 AS24863 LINKdotNET-AS 196.6.108.0/24 AS5713 SAIX-NET 196.13.201.0/24 AS2018 TENET-1 196.13.202.0/24 AS2018 TENET-1 196.13.203.0/24 AS2018 TENET-1 196.13.204.0/24 AS2018 TENET-1 196.110.105.0/24 AS8513 SKYVISION SkyVision Network Services 196.202.224.0/21 AS8818 TELE Greenland Autonomous System 198.1.2.0/24 AS4761 INDOSAT-INP-AP INDOSAT Internet Network Provider 198.15.4.0/24 AS4323 TWTC - tw telecom holdings, inc. 198.15.5.0/24 AS4323 TWTC - tw telecom holdings, inc. 198.23.26.0/24 AS4390 BELLATLANTIC-COM - Bell Atlantic, Inc. 198.73.210.0/24 AS21570 ACI-1 - Accelerated Connections Inc. 198.74.38.0/24 AS16966 SBCIDC-LSAN03 - AT&T Internet Services 198.74.39.0/24 AS16966 SBCIDC-LSAN03 - AT&T Internet Services 198.74.40.0/24 AS16966 SBCIDC-LSAN03 - AT&T Internet Services 198.97.72.0/21 AS721 DNIC-ASBLK-00721-00726 - DoD Network Information Center 198.97.96.0/19 AS721 DNIC-ASBLK-00721-00726 - DoD Network Information Center 198.97.240.0/20 AS721 DNIC-ASBLK-00721-00726 - DoD Network Information Center 198.99.241.0/24 AS11797 AC-NIELSEN-AS AC NIELSEN 198.161.87.0/24 AS6539 GT-BELL - Bell Canada 198.163.214.0/24 AS21804 ACCESS-SK - Access Communications Co-operative Limited 198.167.0.0/16 AS7456 INTERHOP - Interhop Network SERVICES Inc. 198.168.0.0/16 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 198.169.0.0/16 AS803 SASKTEL - Saskatchewan Telecommunications 198.180.198.0/24 AS23715 SEOUL-INTGW-GXS-AP Global Exchange Services 198.182.235.0/24 AS3356 LEVEL3 Level 3 Communications 199.16.32.0/19 AS6389 BELLSOUTH-NET-BLK - BellSouth.net Inc. 199.121.0.0/16 AS721 DNIC-ASBLK-00721-00726 - DoD Network Information Center 199.123.16.0/20 AS721 DNIC-ASBLK-00721-00726 - DoD Network Information Center 199.185.130.0/23 AS19662 UNISERVE-ONLINE - Uniserve On Line 199.202.0.0/16 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 199.202.216.0/21 AS577 BACOM - Bell Canada 199.233.92.0/24 AS26896 D102-ITC - Data 102, LLC 199.246.116.0/24 AS813 UUNET-CANADA - MCI Communications Services, Inc. d/b/a Verizon Business 200.1.112.0/24 AS29754 GO2TEL GO2TEL.COM INC. 200.24.73.0/24 AS26061 Equant Colombia 200.24.78.0/26 AS3549 GBLX Global Crossing Ltd. 200.24.78.64/26 AS3549 GBLX Global Crossing Ltd. 202.1.224.0/24 AS10097 FLOWCOM Flow Communications 2/541 Kent St Sydney NSW 2000 202.9.55.0/24 AS2764 AAPT AAPT Limited 202.9.57.0/24 AS2764 AAPT AAPT Limited 202.38.63.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited 202.58.113.0/24 AS19161 202.61.75.0/24 AS9927 PHILCOMNET-PH A Multihomed ISP Company 202.66.128.0/18 AS9584 GENESIS-AP Diyixian.com Limited 202.66.160.0/19 AS9584 GENESIS-AP Diyixian.com Limited 202.66.160.0/20 AS9584 GENESIS-AP Diyixian.com Limited 202.66.176.0/20 AS9584 GENESIS-AP Diyixian.com Limited 202.66.184.0/24 AS9584 GENESIS-AP Diyixian.com Limited 202.66.186.0/24 AS9584 GENESIS-AP Diyixian.com Limited 202.66.188.0/24 AS9584 GENESIS-AP Diyixian.com Limited 202.66.189.0/24 AS9584 GENESIS-AP Diyixian.com Limited 202.66.190.0/24 AS9584 GENESIS-AP Diyixian.com Limited 202.73.144.0/20 AS4788 TMNET-AS-AP TM Net, Internet Service Provider 202.86.252.0/22 AS4748 RESOLINK-AS-AP Resources Link Network Limited 202.86.252.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.253.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.254.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.255.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.94.1.0/24 AS4808 CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network 202.133.37.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited 202.133.70.0/24 AS38616 WORLDCALL-AS-KHI Worldcall Telecom Limited 202.133.73.0/24 AS38616 WORLDCALL-AS-KHI Worldcall Telecom Limited 202.136.254.0/24 AS4808 CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network 202.136.255.0/24 AS4808 CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network 202.146.186.0/24 AS23655 SNAP-NZ-AS Snap Internet Limited 202.150.227.0/24 AS17727 NAPINFO-AS-AP PT. NAP Info Lintas Nusa 202.174.125.0/24 AS9498 BBIL-AP BHARTI Airtel Ltd. 202.176.1.0/24 AS9942 COMINDICO-AP SOUL Converged Communications Australia 202.179.130.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited 202.179.131.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited 202.179.133.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited 202.179.134.0/24 AS23966 LDN-AS-PK LINKdotNET Telecom Limited 202.179.144.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited 202.179.149.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited 202.179.150.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited 202.181.32.0/24 AS4645 ASN-HKNET-AP HKNet Co. Ltd 203.18.156.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 203.22.78.0/24 AS18117 HARBOURMSP-AU-AP Harbour MSP Pty. Ltd 203.23.1.0/24 AS18111 NETSPEED-AS-AP Netspeed Internet Communications 203.24.38.0/24 AS18111 NETSPEED-AS-AP Netspeed Internet Communications 203.27.123.0/24 AS4739 CIX-ADELAIDE-AS Internode Systems Pty Ltd 203.30.127.0/24 AS18111 NETSPEED-AS-AP Netspeed Internet Communications 203.32.86.0/23 AS18111 NETSPEED-AS-AP Netspeed Internet Communications 203.32.86.0/24 AS18111 NETSPEED-AS-AP Netspeed Internet Communications 203.32.87.0/24 AS18111 NETSPEED-AS-AP Netspeed Internet Communications 203.32.188.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 203.62.0.0/17 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet) 203.78.48.0/20 AS9299 IPG-AS-AP Philippine Long Distance Telephone Company 203.112.111.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.113.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.114.0/24 AS4802 ASN-IINET iiNet Limited 203.112.116.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.117.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.118.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.119.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.120.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.121.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.127.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.128.128.0/24 AS23849 CNNIC-NET263-AP Beijing Capital-online science development Co.,Ltd. 203.142.219.0/24 AS45149 203.175.107.0/24 AS45595 PKTELECOM-AS-PK Pakistan Telecom Company Limited 204.9.216.0/23 AS6389 BELLSOUTH-NET-BLK - BellSouth.net Inc. 204.10.232.0/21 AS33150 204.19.14.0/23 AS577 BACOM - Bell Canada 204.209.114.0/24 AS13768 PEER1 - Peer 1 Network Inc. 205.150.0.0/15 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 205.189.134.0/24 AS11814 DISTRIBUTEL-AS11814 - DISTRIBUTEL COMMUNICATIONS LTD. 205.207.148.0/23 AS812 ROGERS-CABLE - Rogers Cable Communications Inc. 205.210.145.0/24 AS11814 DISTRIBUTEL-AS11814 - DISTRIBUTEL COMMUNICATIONS LTD. 206.72.192.0/23 AS16526 BIRCH-TELECOM - Birch Telecom, Inc. 206.72.194.0/23 AS16526 BIRCH-TELECOM - Birch Telecom, Inc. 206.123.129.0/24 AS10790 INREACH-AS - InReach Internet 206.180.240.0/20 AS12083 KNOLOGY-NET - Knology Holdings 206.197.184.0/24 AS23304 DATOTEL-STL-AS - Datotel LLC, a NetLabs LLC Company 207.174.131.0/24 AS26116 INDRA - Indra's Net Inc. 207.174.132.0/23 AS26116 INDRA - Indra's Net Inc. 207.174.152.0/23 AS26116 INDRA - Indra's Net Inc. 207.174.154.0/24 AS26116 INDRA - Indra's Net Inc. 207.174.155.0/24 AS26116 INDRA - Indra's Net Inc. 207.174.188.0/24 AS26116 INDRA - Indra's Net Inc. 207.174.189.0/24 AS26116 INDRA - Indra's Net Inc. 207.174.190.0/24 AS26116 INDRA - Indra's Net Inc. 207.174.191.0/24 AS26116 INDRA - Indra's Net Inc. 207.174.200.0/24 AS22658 EARTHNET - Earthnet, Inc. 207.174.248.0/21 AS6653 PRIVATEI - privateI, LLC 207.231.96.0/19 AS11194 NUNETPA - NuNet Inc. 208.64.200.0/22 AS11730 CIL-ASN - Circle Internet LTD 208.64.240.0/21 AS13871 TELEBYTE-NW - Telebyte NW 208.73.160.0/24 AS32767 208.78.165.0/24 AS16565 208.83.53.0/24 AS40569 YGOMI-AS - Ygomi LLC 208.83.54.0/24 AS23485 SEI-LLC-AS-NUM - SEI LLC 208.92.196.0/22 AS10929 NETELLIGENT - Netelligent Hosting Services Inc. 208.92.199.0/24 AS26198 3MENATWORK - 3Men@Work Integrated Networks, Inc. 209.54.123.0/24 AS6062 NETPLEX - NETPLEX 209.165.239.0/24 AS209 ASN-QWEST - Qwest Communications Company, LLC 209.177.64.0/20 AS6461 MFNX MFN - Metromedia Fiber Network 209.213.0.0/20 AS33005 ELTOPIA - Eltopia.com, LLC 209.213.1.0/24 AS7849 CROCKERCOM - CROCKER COMMUNICATIONS 209.213.4.0/24 AS7849 CROCKERCOM - CROCKER COMMUNICATIONS 210.5.128.0/20 AS4837 CHINA169-BACKBONE CNCGROUP China169 Backbone 210.56.150.0/23 AS38138 INTECH-TRANSIT-BD InTech Online Limited, INTERNET SERVICE LIMITED 216.10.235.0/24 AS13780 NTNCOMMUNICATIONS - NTN 216.10.236.0/24 AS13780 NTNCOMMUNICATIONS - NTN 216.21.196.0/24 AS12251 INVISION - Invision.com, Inc. 216.21.201.0/24 AS12251 INVISION - Invision.com, Inc. 216.21.202.0/24 AS12251 INVISION - Invision.com, Inc. 216.21.206.0/23 AS12251 INVISION - Invision.com, Inc. 216.58.192.0/24 AS22702 X5SOLUTIONS - X5 Solutions, Inc. 216.58.197.0/24 AS22702 X5SOLUTIONS - X5 Solutions, Inc. 216.58.200.0/24 AS18530 ISOMEDIA-1 - Isomedia Inc. 216.172.198.0/24 AS22773 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc. 216.172.199.0/24 AS22773 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc. 216.250.112.0/20 AS7296 ALCHEMYNET - Alchemy Communications, Inc. Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

Starbucks network admins
by Harvey, Chris 07 Jan '11

07 Jan '11

Does anyone have any good contacts for Starbucks network admins? -- Chris Harvey Distinguished Engineer o: 703-939-8479 m: 703-967-4229

1 0

Re: NIST IPv6 document
by Jeff Wheeler 07 Jan '11

07 Jan '11

On Thu, Jan 6, 2011 at 9:31 PM, Owen DeLong <owen(a)delong.com> wrote: >> You must understand that policing will not stop the NDCache from >> becoming full almost instantly under an attack. Since the largest >> existing routers have about 100k entries at most, an attack can fill >> that up in *one second.* >> > If the policing rate is set to ~100 requests per second, or, even > 1000 requests per second, then, I'm not sure why you think this. With a 100pps policer, it is trivial for an attack to make its NS requests far more likely to make it through the policer than legitimate NS requests that would result in discovering a valid layer-2 mapping. If you are hitting the policer, the subnet is broken. If you don't have a policer, the table is full and ... the subnet is broken. See how it's a problem that isn't solvable with a simple policer? Note that the Cisco "solution" is indeed a configurable per-interface policer, which is better than nothing, but does not fully solve the problem. Policing isn't a new idea. I'm not sure it's a step in the right direction, or just prolonging an inevitable change towards a real fix. -- Jeff S Wheeler <jsw(a)inconcepts.biz> Sr Network Operator / Innovative Network Concepts

1 0

ARIN and the RPKI (was Re: AltDB?)
by Christopher Morrow 07 Jan '11

07 Jan '11

Sorry for the subject change, it seems now we're talking about something perhaps more relevant to me (security and routing stuff) On Wed, Jan 5, 2011 at 5:32 PM, Randy Bush <randy(a)psg.com> wrote: > i have a rumor that arin is delaying and possibly not doing rpki that > seems to have been announced on the ppml list (to which i do not I have heard this as well ... the message in the archive is: (arin-announce actually, not ppml) <http://lists.arin.net/pipermail/arin-announce/2010-December/001107.html> Essentially the note says that Kosters & crew are delaying until Q2-2011 the deployment of RPKI services (nebulous 'other features need to be implemented due to security concerns' is the stated reason) > subscribe). as it has impact on routing, not address policy, across > north america and, in fact the globe, one would think it would be > announced and discussed a bit more openly and widely. I agree... so, what is the RPKI for and why should ops/security folks care? (and should we care enough to poke our local ARIN constabulary in the eye with a sharp stick?) I'm of the belief that if we (ops/security folks) feel the need to have a more secure routing infrastructure so we can hope to avoid incidents like: (quick examples, there are many others like these) o AS7007 full-table re-announce + re-originate o ConEdison "hijack" + re-originate o Pakistan/YT hijack + re-originate o "Pilosov/Kapela" hijacks/manipulations o Christmas TurkTelecom leak/hijack o PRC network leakages/hijacks/etc of April 2010 (Note: let's not debate if the above incidents are one/the-other hijack/mistake/etc, the simple fact is traffic was diverted and some better filtering/control would have avoided these failures in our system) We need at least these things to exist: o an accurate mapping of resource (netblock/asn) to authorized-entity (RIR/NIR/LIR/Customer/...) o a system to manage this data for our routing equipment o protocol enhancements that can be used to help propagate the mapping information or at the least help a router programmaticly understand if a resource is being used by the authorized entity o routing software that can digest the enhanced data o routing hardware that won't crumple under the weight of (what seems like) heavier weight routing protocol requirements I believe the lynch-pin in this is the accurate mapping of resources to authorized users, I believe that is supposed to be the RPKI system. I believe that the RPKI will tell me, an end-operator, that 63.0.0.0/9 was handed from IANA to ARIN to UUNET/VerizonBusiness and that this is being properly announced with an Origin-AS of 701. Having the service run by these organizations seems reasonable to me... IANA signs down to the RIR (ARIN in my example) and ARIN signs to VZB who can choose to sign down to their customers if necessary. Today there is a very loose, in all regions not just ARIN's, association with lots of cruft and inaccuracies. The RPKI, operated by RIR's, would provide some solid linkage and authority between resources and owners, it should help to enforce cruft management as well as provide mechanical (and relatively simple) management of the data and associated filtering/etc on devices. There is, of course, some risk with this model and we should take the time to accept/discuss that as well. Danny has had lots of good input on this topic, I'd hope that other folks who've been through longer term ops battles with filtering (jared, shane, charles gucker, rs, ras, ...) and the like can take some time to think about this problem. I'd love it if we could have some reasoned discussion here as well. Finally, everyone should go poke their ARIN corporate representative(s) (or email the BoT or AC folks directly even?) with their thoughts on whether or not the RPKI system and Routing Security are important items for ARIN (as one RIR) to pursue for the health of the Internet and Ops Sanity. The BoT folks are listed at: <https://www.arin.net/about_us/bot.html> (with email addresses even!) The AC folks are listed at: <https://www.arin.net/about_us/ac.html> -Chris

4 9

NIST IPv6 document
by Jeff Wheeler 07 Jan '11

07 Jan '11

On Thu, Jan 6, 2011 at 12:17 AM, Joe Greco <jgreco(a)ns.sol.net> wrote: > However, that's not the only potential use! A client that initiates > each new outbound connection from a different IP address is doing > something Really Good. No, Joe, it is not doing anything Good. This would require the software being written to make such random address selection, add more entries to the router's NDP table, and it would DoS the box's own router if an outbound scan were initiated from the host machine. Again, you totally fail to understand the problem. I should just attach a "facepalm" graphic to my reply and stop bothering with your idiocy, but it is important that as many people as possible understand these issues. Every additional person who is expressing concern to their vendors brings us closer to a solution. In addition, if the machine can choose another random IPv6 address in the /64 for each new outgoing connection, it could just as easily source all its outgoing connections from ... a single IPv6 address that does not accept any incoming connections. I will grant that this does not prevent "magic packet" attacks against bugs in the machine in kernel space, and that the machine could be the recipient of a DoS attack; but your proposed solution has no advantage in the case of, say, SQL Slammer 6, or other attacks exploiting vulnerabilities in user-space. On Thu, Jan 6, 2011 at 12:25 AM, Owen DeLong <owen(a)delong.com> wrote: > Is there any reason we really need to care what size other people use for their Point to Point > links? > > Personally, I think /64 works just fine. > > I won't criticize anyone for using it. It's what I choose to use. You should care what size you choose, Owen. I would if I was your customer. There are several reasons why. If you configure a /64 on a point-to-point interface e.g. SONET, some current platforms will bounce any "scan" packets back and forth between the two hosts until the TTL expires, which means an attacker can saturate the point-to-point link with two orders of magnitude less attack traffic than the link capacity. This is very bad. Also, if the link is a LAN, you are vulnerable to the ARP/NDP problem. This may be a per-interface issue on your box, or it may be a global one. In the per-interface case, most likely, the failure mode will be okay; but some vendors (including Juniper?) will eventually expire the ARP/NDP entry even though there is active traffic, and may be unable to re-learn it when needed due to the attack, which would break the link between routers. On the other hand, if it's a global issue, it will break NDP on the entire router, affecting all interfaces by whatever the platform's failure mode is. Obviously, that is worse. This is why "RFC compliant" is wrong, Owen. That a learned, experienced person such as yourself has no clue what the underlying problem is exemplifies my point: much, much more noise needs to be made about this issue. A lot of smart people have known about it for years but nothing is being done. Anyone can choose not to use /64 on their point-to-point links with no consequence to their business. Customers aren't going to choose another vendor because they are likely never even aware of it. The operational problem is that customers will want it on the PE/CE LANs, hosting center LANs, and so on; and right now, if you tell them "we can't do that," they have trouble believing you because the standard says otherwise, and a lot of other networks are currently doing it (because they think they don't have a choice other than to lose potential customers.) However, if you are running /64 instead of something like /124 on your VLANs or SONET circuits between routers, you should change this practice as soon as practical. Not doing so once you have been educated about this problem because it is "the standard" is very stupid. Pretty much every major transit network has figured this out and are doing it on their interfaces to BGP customers, too, either optionally, by default, or as the only choice. The industry standard must change to be non-hostile toward choosing a smaller subnet size than /64 to give coverage to those of us who do understand what we are doing as we roll out IPv6 to customers. -- Jeff S Wheeler <jsw(a)inconcepts.biz> Sr Network Operator / Innovative Network Concepts

10 12

The FCC on IPv6
by Steven Bellovin 06 Jan '11

06 Jan '11

http://hraunfoss.fcc.gov/edocs_public/attachmatch/DOC-303870A1.pdf --Steve Bellovin, http://www.cs.columbia.edu/~smb

1 0