- NANOG - lists.nanog.org

Re: Very Strange - TCP SWEEP Alerts / Inconsistent with traffic onsystem
by khatfield＠socllc.net 28 Jun '10

28 Jun '10

Excellent! Thanks John. We have seen this sort of signature before but we couldn't find the reference source in our library. I don't believe this is one we had. Thanks! Kevin ------Original Message------ From: John Kristoff To: Kevin Hatfield Cc: nanog(a)nanog.org Subject: Re: Very Strange - TCP SWEEP Alerts / Inconsistent with traffic onsystem Sent: Jun 27, 2010 9:32 PM On Sun, 27 Jun 2010 17:22:51 -0400 (EDT) khatfield(a)socllc.net wrote: > Here is an example report we received from AT&T: > 04:29:27 x.x.x.x 0.0.0.0 [TCP-SWEEP] > (total=23,dp=1024,min=212.1.185.6,max=212.1.191.127,Jun27-04:21:01,Jun27-04:29:26) > (USI-amsxaid01) 04:29:27 x.x.x.x 0.0.0.0 [TCP-SWEEP] > (total=16,dp=3072,min=212.1.189.1,max=212.1.188.118,Jun27-04:21:15,Jun27-04:29:09) > (USI-amsxaid01) 04:36:44 x.x.x.x 0.0.0.0 [TCP-SWEEP] This looks like the trademark signature of back scatter as a result of someone using the juno.c or derivative code to SYN flood a host. You are most likely getting this traffic from a host that is getting attacked. In the junos.c code you'll see this: syn->sport = htons(1024 + (random() & 2048)); A random number is ANDed against 2048, the result is then added to 1024. What will be added is always either 0 or 2048, because 2048 has only one bit set. 1024 + 2048 = 3072. Therefore, syn-sport will only ever equal 1024 or 3072. Or in your case, it shows up as the dport on the way back. John

1 0

Very Strange - TCP SWEEP Alerts / Inconsistent with traffic on system
by khatfield＠socllc.net 28 Jun '10

28 Jun '10

Folks, We have a strange situation occurring lately where we are getting some reports of TCP Sweeps from some one of our IP's, yet the IP is one of many specifically configured for inbound traffic and do not emit outbound traffic unless for response. Specifically, these are ddos mitigation IP's so they are attacked fairly frequently. With this in mind, the last few days one of the IP's being reported has been under constant attack. Here is an example report we received from AT&T: 04:29:27 x.x.x.x 0.0.0.0 [TCP-SWEEP] (total=23,dp=1024,min=212.1.185.6,max=212.1.191.127,Jun27-04:21:01,Jun27-04:29:26) (USI-amsxaid01) 04:29:27 x.x.x.x 0.0.0.0 [TCP-SWEEP] (total=16,dp=3072,min=212.1.189.1,max=212.1.188.118,Jun27-04:21:15,Jun27-04:29:09) (USI-amsxaid01) 04:36:44 x.x.x.x 0.0.0.0 [TCP-SWEEP] (total=16,dp=1024,min=212.1.188.1,max=212.1.185.126,Jun27-04:29:51,Jun27-04:35:53) (USI-amsxaid01) 04:20:47 x.x.x.x 0.0.0.0 [TCP-SWEEP] (total=25,dp=1024,min=212.1.190.11,max=212.1.189.120,Jun27-04:12:37,Jun27-04:20:40) (USI-amsxaid01) 04:20:47 x.x.x.x 0.0.0.0 [TCP-SWEEP] (total=18,dp=3072,min=212.1.189.3,max=212.1.186.118,Jun27-04:13:15,Jun27-04:20:37) (USI-amsxaid01) 04:12:36 x.x.x.x 0.0.0.0 [TCP-SWEEP] (total=34,dp=1024,min=212.1.191.8,max=212.1.191.121,Jun27-03:56:28,Jun27-04:12:29) (USI-amsxaid01) 04:12:36 x.x.x.x 0.0.0.0 [TCP-SWEEP] (total=28,dp=3072,min=212.1.186.6,max=213.244.176.119,Jun27-03:56:48,Jun27-04:11:45) (USI-amsxaid01) ------------------------ Report from DK*CERT: If nothing else mentioned below, timezone is believed to be UTC+0200(CEST) Destination address(es): Adresser i nettene 130.225.16.0/22 og 130.225.2.128/25 Security logs: #Jun 27 18:13:40 2010 .. Jun 27 18:58:13 2010 # Scan from x.x.x.x affecting at least # 81 addresses targeting TCP:1024, TCP:3072. # ------------------------ I have removed our IP and replaced it with x.x.x.x. To be a bit more clear, this is a reverse-proxy IP address. This IP is in a NAT type configuration where it is sent back to filtering clusters. No outbound traffic is configured on these IP's except where requests / responses flow through it. I know a year or two ago there was a bug in Cisco IOS that would report a sweep when extreme packet load occurred or a burst hit. At the time of this report we saw an attack burst to around 310,000PPS on this IP (inbound). Is it simply likely the networks reporting have several IP's being used in the attack and that is what they are seeing? That's what we originally thought but the port scans throw that theory off... Our security team has gone through all PCAPs during the mentioned time frames and we are not showing any sort of outbound scan traffic. Any ideas why this would be showing as a sweep? Our IDS systems do not scan requesting IP's originating systems. Any help is appreciated, we're simply trying to get to the bottom of the reports. Kevin

3 3

Whois-RWS Release Update
by Mark Kosters 27 Jun '10

27 Jun '10

<Apologies for the duplicate email but want to keep you informed about changes occurring at ARIN. This particular upgrade may be of interest to those who are not subscribed to arin-announce.> ----- Forwarded message from Member Services <info(a)arin.net> ----- From: Member Services <info(a)arin.net> Date: Sun, 27 Jun 2010 07:11:54 -0400 To: "arin-announce(a)arin.net" <arin-announce(a)arin.net> Subject: [arin-announce] Whois-RWS Release Update On 26 June, ARIN rolled out Whois-RWS. Unfortunately, we experienced a very significant increase in traffic after rollout which exceeded our load capacity and caused the new service to degrade to an unacceptable level. To ensure customers could continue to access ARIN's Whois data, we have reverted to the old service which degrades more gracefully under load. We are examining the data gathered on the traffic patterns we experienced and are making the necessary changes to deploy Whois-RWS the near future. We thank you for your patience, and we look forward to making the Whois-RWS service available for community use very soon. Regards, Mark Kosters Chief Technical Officer American Registry for Internet Numbers (ARIN) ----- End forwarded message -----

1 0

Penetration Test Vendors
by George Bonser 26 Jun '10

26 Jun '10

Anyone have any suggestions for a decent vendor that provides network penetration testing? We have a customer requirement for a third party test for a certain facility. Have you used anyone that you thought did a great job? Anyone you would suggest avoiding? Replies can be sent off list and I will summarize any feedback I might get from the community if anyone is interested. George

11 10

BGP Update Report
by cidr-report＠potaroo.net 25 Jun '10

25 Jun '10

BGP Update Report Interval: 17-Jun-10 -to- 24-Jun-10 (7 days) Observation Point: BGP Peering with AS131072 TOP 20 Unstable Origin AS Rank ASN Upds % Upds/Pfx AS-Name 1 - AS24400 64871 4.5% 5405.9 -- CMNET-V4SHANGHAI-AS-AP Shanghai Mobile Communications Co.,Ltd. 2 - AS9808 62064 4.4% 827.5 -- CMNET-GD Guangdong Mobile Communication Co.Ltd. 3 - AS14420 54652 3.8% 117.3 -- CORPORACION NACIONAL DE TELECOMUNICACIONES CNT S.A. 4 - AS18910 29562 2.1% 1847.6 -- BIG-SANDY-BROADBAND-INC - Big Sandy Broadband Inc 5 - AS30890 26695 1.9% 61.4 -- EVOLVA Evolva Telecom s.r.l. 6 - AS35805 18262 1.3% 28.8 -- SILKNET-AS SILKNET AS 7 - AS5800 15672 1.1% 69.7 -- DNIC-ASBLK-05800-06055 - DoD Network Information Center 8 - AS12880 13091 0.9% 163.6 -- DCI-AS DCI Autonomous System 9 - AS32528 11954 0.8% 3984.7 -- ABBOTT Abbot Labs 10 - AS27065 10562 0.7% 87.3 -- DNIC-ASBLK-27032-27159 - DoD Network Information Center 11 - AS10474 10319 0.7% 2063.8 -- NETACTIVE 12 - AS47883 9945 0.7% 153.0 -- KKTCELL-AS KIBRIS MOBILE TELEKOMUNIKASYON LTD. 13 - AS9829 9794 0.7% 51.8 -- BSNL-NIB National Internet Backbone 14 - AS35931 9752 0.7% 3250.7 -- ARCHIPELAGO - ARCHIPELAGO HOLDINGS INC 15 - AS27968 9101 0.6% 97.9 -- CORPORACION NACIONAL DE TELECOMUNICACIONES CNT S.A. 16 - AS45464 9020 0.6% 209.8 -- NEXTWEB-AS-AP Room 201, TGU Bldg 17 - AS27757 8756 0.6% 76.1 -- CORPORACION NACIONAL DE TELECOMUNICACIONES CNT S.A. 18 - AS8452 8138 0.6% 7.8 -- TEDATA TEDATA 19 - AS15656 7846 0.6% 170.6 -- ANET Anet Iletisim A.S. 20 - AS14522 7623 0.5% 30.5 -- Satnet TOP 20 Unstable Origin AS (Updates per announced prefix) Rank ASN Upds % Upds/Pfx AS-Name 1 - AS24400 64871 4.5% 5405.9 -- CMNET-V4SHANGHAI-AS-AP Shanghai Mobile Communications Co.,Ltd. 2 - AS32528 11954 0.8% 3984.7 -- ABBOTT Abbot Labs 3 - AS35931 9752 0.7% 3250.7 -- ARCHIPELAGO - ARCHIPELAGO HOLDINGS INC 4 - AS27873 2315 0.2% 2315.0 -- Compañia Goly, S.A. 5 - AS10474 10319 0.7% 2063.8 -- NETACTIVE 6 - AS18910 29562 2.1% 1847.6 -- BIG-SANDY-BROADBAND-INC - Big Sandy Broadband Inc 7 - AS30372 2775 0.2% 1387.5 -- SBS-NEWARK-CA - SIEMENS BUSINESS SERVICES 8 - AS9808 62064 4.4% 827.5 -- CMNET-GD Guangdong Mobile Communication Co.Ltd. 9 - AS55482 783 0.1% 783.0 -- DIGITAL-WAVE-MY Level 12 Menara Sunway, Jalan Lagoon Timur, 10 - AS11613 683 0.1% 683.0 -- U-SAVE - U-Save Auto Rental of America, Inc. 11 - AS28052 635 0.0% 635.0 -- Arte Radiotelevisivo Argentino 12 - AS16552 1384 0.1% 461.3 -- TIGGEE - Tiggee LLC 13 - AS30402 796 0.1% 398.0 -- HARRIS - Harris Interactive Inc. 14 - AS10445 2358 0.2% 336.9 -- HTG - Huntleigh Telcom 15 - AS3 313 0.0% 120.0 -- SUEZ-AS Elektrownia Polaniec SA Grupa GDF SUEZ Energia Polska 16 - AS39780 303 0.0% 303.0 -- TECNOCOM-NET AS for Tecnocom T&E 17 - AS20293 595 0.0% 297.5 -- WU - WESTERN UNION COMPANY 18 - AS45647 587 0.0% 293.5 -- LBCBANK-AS-AP LBC Development Bank 19 - AS41864 1641 0.1% 273.5 -- MIBA-AS SC MIBA TELECOM 2002 SRL 20 - AS38596 265 0.0% 265.0 -- INNODATA-MDE-AS-PH Innodata-ISOGEN, Inc TOP 20 Unstable Prefixes Rank Prefix Upds % Origin AS -- AS Name 1 - 111.10.2.0/24 12326 0.8% AS9808 -- CMNET-GD Guangdong Mobile Communication Co.Ltd. 2 - 111.10.3.0/24 12324 0.8% AS9808 -- CMNET-GD Guangdong Mobile Communication Co.Ltd. 3 - 111.10.4.0/24 12316 0.8% AS9808 -- CMNET-GD Guangdong Mobile Communication Co.Ltd. 4 - 111.10.0.0/24 12316 0.8% AS9808 -- CMNET-GD Guangdong Mobile Communication Co.Ltd. 5 - 111.10.1.0/24 12315 0.8% AS9808 -- CMNET-GD Guangdong Mobile Communication Co.Ltd. 6 - 117.131.0.0/17 10820 0.7% AS24400 -- CMNET-V4SHANGHAI-AS-AP Shanghai Mobile Communications Co.,Ltd. 7 - 120.204.0.0/16 10674 0.7% AS24400 -- CMNET-V4SHANGHAI-AS-AP Shanghai Mobile Communications Co.,Ltd. 8 - 196.2.16.0/24 10277 0.7% AS10474 -- NETACTIVE 9 - 221.181.64.0/18 7639 0.5% AS24400 -- CMNET-V4SHANGHAI-AS-AP Shanghai Mobile Communications Co.,Ltd. 10 - 117.136.8.0/24 7426 0.5% AS24400 -- CMNET-V4SHANGHAI-AS-AP Shanghai Mobile Communications Co.,Ltd. 11 - 117.135.128.0/18 7103 0.5% AS24400 -- CMNET-V4SHANGHAI-AS-AP Shanghai Mobile Communications Co.,Ltd. 12 - 117.135.0.0/17 7101 0.5% AS24400 -- CMNET-V4SHANGHAI-AS-AP Shanghai Mobile Communications Co.,Ltd. 13 - 130.36.34.0/24 5974 0.4% AS32528 -- ABBOTT Abbot Labs 14 - 130.36.35.0/24 5972 0.4% AS32528 -- ABBOTT Abbot Labs 15 - 190.65.228.0/22 5796 0.4% AS3816 -- COLOMBIA TELECOMUNICACIONES S.A. ESP 16 - 198.140.43.0/24 5570 0.4% AS35931 -- ARCHIPELAGO - ARCHIPELAGO HOLDINGS INC 17 - 85.185.26.0/24 5157 0.3% AS12880 -- DCI-AS DCI Autonomous System 18 - 202.141.157.0/24 4907 0.3% AS2697 -- ERX-ERNET-AS Education and Research Network 19 - 143.138.107.0/24 4126 0.3% AS747 -- TAEGU-AS - Headquarters, USAISC 20 - 63.211.68.0/22 3982 0.3% AS35931 -- ARCHIPELAGO - ARCHIPELAGO HOLDINGS INC Details at http://bgpupdates.potaroo.net ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

The Cidr Report
by cidr-report＠potaroo.net 25 Jun '10

25 Jun '10

This report has been generated at Fri Jun 25 21:11:44 2010 AEST. The report analyses the BGP Routing Table of AS2.0 router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org for a current version of this report. Recent Table History Date Prefixes CIDR Agg 18-06-10 325632 201656 19-06-10 326044 201847 20-06-10 326275 201809 21-06-10 326227 202163 22-06-10 326263 201899 23-06-10 326578 202351 24-06-10 326853 202535 25-06-10 326998 202479 AS Summary 34702 Number of ASes in routing system 14744 Number of ASes announcing only one prefix 4468 Largest number of prefixes announced by an AS AS4323 : TWTC - tw telecom holdings, inc. 95976768 Largest address span announced by an AS (/32s) AS4134 : CHINANET-BACKBONE No.31,Jin-rong Street Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 25Jun10 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 327010 202472 124538 38.1% All ASes AS6389 3910 293 3617 92.5% BELLSOUTH-NET-BLK - BellSouth.net Inc. AS4323 4468 1746 2722 60.9% TWTC - tw telecom holdings, inc. AS4766 1847 496 1351 73.1% KIXS-AS-KR Korea Telecom AS22773 1165 70 1095 94.0% ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc. AS4755 1313 245 1068 81.3% TATACOMM-AS TATA Communications formerly VSNL is Leading ISP AS17488 1319 318 1001 75.9% HATHWAY-NET-AP Hathway IP Over Cable Internet AS6478 1283 325 958 74.7% ATT-INTERNET3 - AT&T WorldNet Services AS18566 1059 121 938 88.6% COVAD - Covad Communications Co. AS8151 1463 565 898 61.4% Uninet S.A. de C.V. AS19262 1130 274 856 75.8% VZGNI-TRANSIT - Verizon Internet Services Inc. AS10620 1057 234 823 77.9% Telmex Colombia S.A. AS7545 1346 570 776 57.7% TPG-INTERNET-AP TPG Internet Pty Ltd AS8452 1162 408 754 64.9% TEDATA TEDATA AS5668 872 131 741 85.0% AS-5668 - CenturyTel Internet Holdings, Inc. AS4808 829 234 595 71.8% CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network AS4804 678 84 594 87.6% MPX-AS Microplex PTY LTD AS7303 746 179 567 76.0% Telecom Argentina S.A. AS35805 644 92 552 85.7% SILKNET-AS SILKNET AS AS7018 1506 959 547 36.3% ATT-INTERNET4 - AT&T WorldNet Services AS3356 1183 662 521 44.0% LEVEL3 Level 3 Communications AS4780 684 163 521 76.2% SEEDNET Digital United Inc. AS1785 1795 1292 503 28.0% AS-PAETEC-NET - PaeTec Communications, Inc. AS28573 1003 504 499 49.8% NET Servicos de Comunicao S.A. AS17676 572 81 491 85.8% GIGAINFRA Softbank BB Corp. AS9443 559 75 484 86.6% INTERNETPRIMUS-AS-AP Primus Telecommunications AS7552 613 130 483 78.8% VIETEL-AS-AP Vietel Corporation AS7011 1135 654 481 42.4% FRONTIER-AND-CITIZENS - Frontier Communications of America, Inc. AS7738 477 30 447 93.7% Telecomunicacoes da Bahia S.A. AS24560 923 486 437 47.3% AIRTELBROADBAND-AS-AP Bharti Airtel Ltd., Telemedia Services AS36992 641 211 430 67.1% ETISALAT-MISR Total 37382 11632 25750 68.9% Top 30 total Possible Bogus Routes 31.0.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 31.1.0.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 31.1.24.0/24 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 41.222.79.0/24 AS36938 AMSCOTELECOMS Amsco Telecommunications Nigeria Limited 41.223.92.0/22 AS36936 CELTEL-GABON Celtel Gabon Internet Service 41.223.188.0/24 AS22351 INTELSAT Intelsat Global BGP Routing Policy 41.223.189.0/24 AS6453 GLOBEINTERNET TATA Communications 41.223.196.0/24 AS36990 41.223.197.0/24 AS36990 41.223.198.0/24 AS36990 41.223.199.0/24 AS36990 62.61.220.0/24 AS24974 TACHYON-EU Tachyon Europe BV 62.61.221.0/24 AS24974 TACHYON-EU Tachyon Europe BV 63.140.213.0/24 AS22555 UTC - Universal Talkware Corporation 63.143.251.0/24 AS22555 UTC - Universal Talkware Corporation 64.20.80.0/20 AS40028 SPD-NETWORK-1 - SPD NETWORK 64.21.192.0/20 AS11610 INETNEBR-1 - Internet Nebraska Corporation 64.21.212.0/22 AS11610 INETNEBR-1 - Internet Nebraska Corporation 64.21.216.0/21 AS11610 INETNEBR-1 - Internet Nebraska Corporation 64.82.128.0/19 AS16617 COMMUNITYISP - CISP 64.82.160.0/19 AS16617 COMMUNITYISP - CISP 66.128.38.0/24 AS15246 Telecomunicaciones Satelitales Telesat S.A. 66.180.239.0/24 AS35888 VIGNETTE - VIGNETTE CORPORATION 66.206.32.0/24 AS17787 PSEB-AS-PK Pakistan Software Export Board 66.206.33.0/24 AS17787 PSEB-AS-PK Pakistan Software Export Board 66.206.34.0/24 AS17787 PSEB-AS-PK Pakistan Software Export Board 66.206.35.0/24 AS17787 PSEB-AS-PK Pakistan Software Export Board 66.206.47.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited 66.207.32.0/20 AS23011 66.230.240.0/20 AS27286 66.241.112.0/20 AS21547 REVNETS - Revolution Networks 66.245.176.0/20 AS19318 NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC 69.6.80.0/24 AS13442 69.6.81.0/24 AS13442 69.80.224.0/19 AS19166 ACRONOC - ACRONOC INC 71.19.134.0/23 AS3313 INET-AS I.NET S.p.A. 71.19.160.0/23 AS4648 NZIX-2 Netgate 72.22.32.0/19 AS33150 72.22.61.0/24 AS33150 72.22.62.0/24 AS33150 76.77.32.0/19 AS2828 XO-AS15 - XO Communications 80.88.10.0/24 AS33774 DJAWEB 80.88.12.0/24 AS33779 wataniya-telecom-as 110.34.44.0/22 AS12653 COMTONET KB Impuls Hellas 110.173.64.0/19 AS37963 CNNIC-ALIBABA-CN-NET-AP Alibaba (China) Technology Co., Ltd. 117.120.56.0/21 AS4755 TATACOMM-AS TATA Communications formerly VSNL is Leading ISP 121.46.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 121.50.168.0/21 AS9931 CAT-AP The Communication Authoity of Thailand, CAT 158.222.70.0/23 AS6137 SISNA - SISNA, Inc. 158.222.72.0/23 AS6137 SISNA - SISNA, Inc. 158.222.224.0/20 AS19864 O1COMM - O1 COMMUNICATIONS 158.222.224.0/22 AS19864 O1COMM - O1 COMMUNICATIONS 158.222.229.0/24 AS19864 O1COMM - O1 COMMUNICATIONS 176.0.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 176.1.0.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 176.1.24.0/24 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 178.157.0.0/18 AS42163 IRANGATE Rasaneh Esfahan Net Autonomous System ( Irangate Internet Service Provider) 181.0.0.0/8 AS237 MERIT-AS-14 - Merit Network Inc. 190.102.32.0/20 AS30058 ACTIVO-SYSTEMS-AS30058 ACTIVO-SYSTEMS-AS30058 190.104.32.0/21 AS27882 Telefónica Celular de Bolivia S.A. 192.9.0.0/16 AS11479 BRM-SUN-AS - Sun Microsystems, Inc 192.64.85.0/24 AS1759 TSF-IP-CORE TeliaSonera Finland IP Network 192.69.108.0/24 AS1759 TSF-IP-CORE TeliaSonera Finland IP Network 192.70.164.0/24 AS25689 NRCNET-AS - National Research Council of Canada 192.101.45.0/24 AS2905 TICSA-ASN 192.101.46.0/24 AS6503 Axtel, S.A.B. de C. V. 192.101.64.0/21 AS702 AS702 Verizon Business EMEA - Commercial IP service provider in Europe 192.101.70.0/24 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 192.101.71.0/24 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 192.101.72.0/24 AS702 AS702 Verizon Business EMEA - Commercial IP service provider in Europe 192.101.74.0/24 AS1239 SPRINTLINK - Sprint 192.124.248.0/23 AS680 DFN-IP service X-WiN 192.124.252.0/22 AS680 DFN-IP service X-WiN 192.131.233.0/24 AS6389 BELLSOUTH-NET-BLK - BellSouth.net Inc. 192.139.3.0/24 AS23184 PERSONA - PERSONA COMMUNICATIONS INC. 192.154.32.0/19 AS81 NCREN - MCNC 192.154.64.0/19 AS81 NCREN - MCNC 192.188.208.0/20 AS27064 DNIC-ASBLK-27032-27159 - DoD Network Information Center 196.2.224.0/22 AS24863 LINKdotNET-AS 196.6.108.0/24 AS5713 SAIX-NET 196.13.201.0/24 AS2018 TENET-1 196.13.202.0/24 AS2018 TENET-1 196.13.203.0/24 AS2018 TENET-1 196.13.204.0/24 AS2018 TENET-1 196.110.105.0/24 AS8513 SKYVISION SkyVision Network Services 196.201.248.0/24 AS30991 SAHANNET Sahannet AS Network 196.201.249.0/24 AS30991 SAHANNET Sahannet AS Network 196.201.250.0/24 AS30991 SAHANNET Sahannet AS Network 196.201.251.0/24 AS30991 SAHANNET Sahannet AS Network 196.201.253.0/24 AS30991 SAHANNET Sahannet AS Network 196.201.255.0/24 AS30991 SAHANNET Sahannet AS Network 196.202.224.0/21 AS8818 TELE Greenland Autonomous System 198.1.2.0/24 AS4761 INDOSAT-INP-AP INDOSAT Internet Network Provider 198.23.26.0/24 AS33052 VZUNET - Verizon Data Services LLC 198.51.100.0/24 AS16953 ASCENT-MEDIA-GROUP-LLC - Ascent Media Group, LLC 198.73.210.0/24 AS21570 ACI-1 - Accelerated Connections Inc. 198.74.38.0/24 AS16966 SBCIDC-LSAN03 - AT&T Internet Services 198.74.39.0/24 AS16966 SBCIDC-LSAN03 - AT&T Internet Services 198.74.40.0/24 AS16966 SBCIDC-LSAN03 - AT&T Internet Services 198.97.72.0/21 AS27064 DNIC-ASBLK-27032-27159 - DoD Network Information Center 198.97.96.0/19 AS27064 DNIC-ASBLK-27032-27159 - DoD Network Information Center 198.97.240.0/20 AS27064 DNIC-ASBLK-27032-27159 - DoD Network Information Center 198.99.241.0/24 AS11797 AC-NIELSEN-AS AC NIELSEN 198.135.236.0/24 AS4358 XNET - XNet Information Systems, Inc. 198.161.87.0/24 AS6539 GT-BELL - Bell Canada 198.163.214.0/24 AS21804 ACCESS-SK - Access Communications Co-operative Limited 198.167.0.0/16 AS7456 INTERHOP - Interhop Network SERVICES Inc. 198.168.0.0/16 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 198.169.0.0/16 AS803 SASKTEL - Saskatchewan Telecommunications 198.180.198.0/24 AS23715 SEOUL-INTGW-GXS-AP Global Exchange Services 198.182.235.0/24 AS3356 LEVEL3 Level 3 Communications 199.16.32.0/19 AS6389 BELLSOUTH-NET-BLK - BellSouth.net Inc. 199.26.183.0/24 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 199.121.0.0/16 AS27064 DNIC-ASBLK-27032-27159 - DoD Network Information Center 199.123.16.0/20 AS27064 DNIC-ASBLK-27032-27159 - DoD Network Information Center 199.185.130.0/23 AS19662 UNISERVE-ONLINE - Uniserve On Line 199.202.0.0/16 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 199.202.216.0/21 AS577 BACOM - Bell Canada 199.233.92.0/24 AS26896 D102-ITC - Data 102, LLC 199.245.188.0/24 AS16582 NEXTLEVELINTERNET - NEXTLEVEL INTERNET, INC. 199.246.116.0/24 AS813 UUNET-CANADA - MCI Communications Services, Inc. d/b/a Verizon Business 199.248.230.0/24 AS16582 NEXTLEVELINTERNET - NEXTLEVEL INTERNET, INC. 200.1.112.0/24 AS29754 GO2TEL GO2TEL.COM INC. 202.9.55.0/24 AS2764 AAPT AAPT Limited 202.9.57.0/24 AS2764 AAPT AAPT Limited 202.38.63.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited 202.58.113.0/24 AS19161 202.61.75.0/24 AS9927 PHILCOMNET-PH A Multihomed ISP Company 202.66.128.0/18 AS9584 GENESIS-AP Diyixian.com Limited 202.66.160.0/19 AS9584 GENESIS-AP Diyixian.com Limited 202.66.160.0/20 AS9584 GENESIS-AP Diyixian.com Limited 202.66.176.0/20 AS9584 GENESIS-AP Diyixian.com Limited 202.66.184.0/24 AS9584 GENESIS-AP Diyixian.com Limited 202.66.186.0/24 AS9584 GENESIS-AP Diyixian.com Limited 202.66.188.0/24 AS9584 GENESIS-AP Diyixian.com Limited 202.66.189.0/24 AS9584 GENESIS-AP Diyixian.com Limited 202.66.190.0/24 AS9584 GENESIS-AP Diyixian.com Limited 202.73.144.0/20 AS4788 TMNET-AS-AP TM Net, Internet Service Provider 202.80.192.0/20 AS2706 PI-HK Pacnet Internet (Hong Kong) Limited 202.86.252.0/22 AS4748 RESOLINK-AS-AP Resources Link Network Limited 202.86.252.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.253.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.254.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.255.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.94.1.0/24 AS4808 CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network 202.133.37.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited 202.133.70.0/24 AS38616 WORLDCALL-AS-KHI Worldcall Telecom Limited 202.133.73.0/24 AS38616 WORLDCALL-AS-KHI Worldcall Telecom Limited 202.136.254.0/24 AS4808 CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network 202.136.255.0/24 AS4808 CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network 202.150.227.0/24 AS17727 NAPINFO-AS-AP PT. NAP Info Lintas Nusa 202.174.70.0/24 AS21175 WIS Wind International Services SA 202.174.125.0/24 AS9498 BBIL-AP BHARTI Airtel Ltd. 202.176.1.0/24 AS9942 COMINDICO-AP SOUL Converged Communications Australia 202.179.130.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited 202.179.131.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited 202.179.133.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited 202.179.134.0/24 AS23966 LDN-AS-PK LINKdotNET Telecom Limited 202.179.144.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited 202.179.149.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited 202.179.150.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited 202.181.32.0/24 AS4645 ASN-HKNET-AP HKNet Co. Ltd 203.12.45.0/24 AS4854 NETSPACE-AS-AP Netspace Online Systems 203.62.0.0/17 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet) 203.78.48.0/20 AS9299 IPG-AS-AP Philippine Long Distance Telephone Company 203.80.136.0/21 AS4759 EVOSERVE-AS-AP EvoServe is a content and online access Internet provider company 203.112.111.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.113.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.114.0/24 AS4802 ASN-IINET iiNet Limited 203.112.116.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.117.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.118.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.119.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.120.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.121.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.112.127.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd 203.128.128.0/24 AS23849 CNNIC-NET263-AP Beijing Capital-online science development Co.,Ltd. 203.142.219.0/24 AS45149 204.9.216.0/23 AS6389 BELLSOUTH-NET-BLK - BellSouth.net Inc. 204.9.218.0/23 AS6389 BELLSOUTH-NET-BLK - BellSouth.net Inc. 204.10.232.0/21 AS33150 204.19.14.0/23 AS577 BACOM - Bell Canada 204.28.104.0/21 AS25973 MZIMA - Mzima Networks, Inc. 204.89.214.0/24 AS4323 TWTC - tw telecom holdings, inc. 204.197.0.0/16 AS3356 LEVEL3 Level 3 Communications 204.209.114.0/24 AS13768 PEER1 - Peer 1 Network Inc. 205.150.0.0/15 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 205.189.134.0/24 AS11814 DISTRIBUTEL-AS11814 - DISTRIBUTEL COMMUNICATIONS LTD. 205.196.24.0/22 AS33724 BIZNESSHOSTING - VOLICO 205.210.145.0/24 AS11814 DISTRIBUTEL-AS11814 - DISTRIBUTEL COMMUNICATIONS LTD. 206.180.240.0/20 AS12083 KNOLOGY-NET - Knology Holdings 206.197.184.0/24 AS23304 DATOTEL-STL-AS - Datotel LLC, a NetLabs LLC Company 207.174.131.0/24 AS26116 INDRA - Indra's Net Inc. 207.174.132.0/23 AS26116 INDRA - Indra's Net Inc. 207.174.152.0/23 AS26116 INDRA - Indra's Net Inc. 207.174.154.0/24 AS26116 INDRA - Indra's Net Inc. 207.174.155.0/24 AS26116 INDRA - Indra's Net Inc. 207.174.188.0/24 AS26116 INDRA - Indra's Net Inc. 207.174.189.0/24 AS26116 INDRA - Indra's Net Inc. 207.174.190.0/24 AS26116 INDRA - Indra's Net Inc. 207.174.191.0/24 AS26116 INDRA - Indra's Net Inc. 207.174.200.0/24 AS22658 EARTHNET - Earthnet, Inc. 207.174.248.0/21 AS6653 PRIVATEI - privateI, LLC 207.231.96.0/19 AS11194 NUNETPA - NuNet Inc. 208.73.4.0/22 AS27630 PREMIER - Premier Innovations, LLC 208.78.164.0/24 AS16565 208.78.165.0/24 AS16565 208.78.167.0/24 AS16565 208.92.196.0/22 AS10929 NETELLIGENT - Netelligent Hosting Services Inc. 208.92.199.0/24 AS26198 3MENATWORK - 3Men@Work Integrated Networks, Inc. 209.54.123.0/24 AS6062 NETPLEX - NETPLEX 209.105.224.0/19 AS20074 209.165.239.0/24 AS209 ASN-QWEST - Qwest Communications Company, LLC 209.213.0.0/20 AS33005 ELTOPIA - Eltopia.com, LLC 209.213.1.0/24 AS7849 CROCKERCOM - CROCKER COMMUNICATIONS 209.213.4.0/24 AS7849 CROCKERCOM - CROCKER COMMUNICATIONS 210.5.128.0/20 AS4837 CHINA169-BACKBONE CNCGROUP China169 Backbone 210.56.150.0/23 AS38138 INTECH-TRANSIT-BD InTech Online Limited, INTERNET SERVICE LIMITED 210.247.224.0/19 AS7496 WEBCENTRAL-AS WebCentral 216.21.196.0/24 AS12251 INVISION - Invision.com, Inc. 216.21.201.0/24 AS12251 INVISION - Invision.com, Inc. 216.21.202.0/24 AS12251 INVISION - Invision.com, Inc. 216.21.206.0/23 AS12251 INVISION - Invision.com, Inc. 216.58.192.0/24 AS22702 X5SOLUTIONS - X5 Solutions, Inc. 216.58.197.0/24 AS22702 X5SOLUTIONS - X5 Solutions, Inc. 216.58.200.0/24 AS18530 ISOMEDIA-1 - Isomedia Inc. 216.172.198.0/24 AS22773 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc. 216.172.199.0/24 AS22773 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc. 216.250.112.0/20 AS7296 ALCHEMYNET - Alchemy Communications, Inc. 216.250.116.0/24 AS36066 UNI-MARKETING-ALLIANCE - Webhost4life.com Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

Weekly Routing Table Report
by Routing Analysis Role Account 25 Jun '10

25 Jun '10

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.apnic.net. If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 26 Jun, 2010 Report Website: http://thyme.apnic.net Detailed Analysis: http://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 323205 Prefixes after maximum aggregation: 149101 Deaggregation factor: 2.17 Unique aggregates announced to Internet: 158363 Total ASes present in the Internet Routing Table: 34231 Prefixes per ASN: 9.44 Origin-only ASes present in the Internet Routing Table: 29720 Origin ASes announcing only one prefix: 14411 Transit ASes present in the Internet Routing Table: 4511 Transit-only ASes present in the Internet Routing Table: 108 Average AS path length visible in the Internet Routing Table: 3.6 Max AS path length visible: 24 Max AS path prepend of ASN (41664) 21 Prefixes from unregistered ASNs in the Routing Table: 295 Unregistered ASNs in the Routing Table: 112 Number of 32-bit ASNs allocated by the RIRs: 642 Prefixes from 32-bit ASNs in the Routing Table: 757 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 159 Number of addresses announced to Internet: 2251743840 Equivalent to 134 /8s, 54 /16s and 226 /24s Percentage of available address space announced: 60.8 Percentage of allocated address space announced: 65.5 Percentage of available address space allocated: 92.8 Percentage of address space in use by end-sites: 83.4 Total number of prefixes smaller than registry allocations: 154204 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 78033 Total APNIC prefixes after maximum aggregation: 26885 APNIC Deaggregation factor: 2.90 Prefixes being announced from the APNIC address blocks: 74858 Unique aggregates announced from the APNIC address blocks: 33140 APNIC Region origin ASes present in the Internet Routing Table: 4081 APNIC Prefixes per ASN: 18.34 APNIC Region origin ASes announcing only one prefix: 1117 APNIC Region transit ASes present in the Internet Routing Table: 639 Average APNIC Region AS path length visible: 3.6 Max APNIC Region AS path length visible: 15 Number of APNIC addresses announced to Internet: 525628704 Equivalent to 31 /8s, 84 /16s and 117 /24s Percentage of available APNIC address space announced: 78.3 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079 55296-56319, 131072-132095 APNIC Address Blocks 1/8, 14/8, 27/8, 43/8, 58/8, 59/8, 60/8, 61/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 133710 Total ARIN prefixes after maximum aggregation: 69226 ARIN Deaggregation factor: 1.93 Prefixes being announced from the ARIN address blocks: 106681 Unique aggregates announced from the ARIN address blocks: 41819 ARIN Region origin ASes present in the Internet Routing Table: 13744 ARIN Prefixes per ASN: 7.76 ARIN Region origin ASes announcing only one prefix: 5271 ARIN Region transit ASes present in the Internet Routing Table: 1349 Average ARIN Region AS path length visible: 3.4 Max ARIN Region AS path length visible: 22 Number of ARIN addresses announced to Internet: 729671968 Equivalent to 43 /8s, 125 /16s and 233 /24s Percentage of available ARIN address space announced: 62.1 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 393216-394239 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 54/8, 55/8, 56/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 107/8, 108/8, 173/8, 174/8, 184/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 74437 Total RIPE prefixes after maximum aggregation: 43213 RIPE Deaggregation factor: 1.72 Prefixes being announced from the RIPE address blocks: 67581 Unique aggregates announced from the RIPE address blocks: 44362 RIPE Region origin ASes present in the Internet Routing Table: 14549 RIPE Prefixes per ASN: 4.65 RIPE Region origin ASes announcing only one prefix: 7512 RIPE Region transit ASes present in the Internet Routing Table: 2159 Average RIPE Region AS path length visible: 3.9 Max RIPE Region AS path length visible: 24 Number of RIPE addresses announced to Internet: 432412960 Equivalent to 25 /8s, 198 /16s and 25 /24s Percentage of available RIPE address space announced: 75.8 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 196608-197631 RIPE Address Blocks 2/8, 25/8, 31/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 176/8, 178/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 28719 Total LACNIC prefixes after maximum aggregation: 6891 LACNIC Deaggregation factor: 4.17 Prefixes being announced from the LACNIC address blocks: 27171 Unique aggregates announced from the LACNIC address blocks: 14182 LACNIC Region origin ASes present in the Internet Routing Table: 1304 LACNIC Prefixes per ASN: 20.84 LACNIC Region origin ASes announcing only one prefix: 400 LACNIC Region transit ASes present in the Internet Routing Table: 232 Average LACNIC Region AS path length visible: 3.9 Max LACNIC Region AS path length visible: 24 Number of LACNIC addresses announced to Internet: 75105792 Equivalent to 4 /8s, 122 /16s and 6 /24s Percentage of available LACNIC address space announced: 56.0 LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 262144-263167 plus ERX transfers LACNIC Address Blocks 177/8, 181/8, 186/8, 187/8, 189/8, 190/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 7302 Total AfriNIC prefixes after maximum aggregation: 1850 AfriNIC Deaggregation factor: 3.95 Prefixes being announced from the AfriNIC address blocks: 5623 Unique aggregates announced from the AfriNIC address blocks: 1730 AfriNIC Region origin ASes present in the Internet Routing Table: 374 AfriNIC Prefixes per ASN: 15.03 AfriNIC Region origin ASes announcing only one prefix: 111 AfriNIC Region transit ASes present in the Internet Routing Table: 84 Average AfriNIC Region AS path length visible: 3.7 Max AfriNIC Region AS path length visible: 14 Number of AfriNIC addresses announced to Internet: 19523328 Equivalent to 1 /8s, 41 /16s and 231 /24s Percentage of available AfriNIC address space announced: 58.2 AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4766 1847 8407 482 Korea Telecom (KIX) 7545 1335 232 107 TPG Internet Pty Ltd 17488 1319 140 127 Hathway IP Over Cable Interne 4755 1314 295 154 TATA Communications formerly 17974 1141 283 23 PT TELEKOMUNIKASI INDONESIA 9583 997 74 491 Sify Limited 24560 923 306 170 Bharti Airtel Ltd., Telemedia 4134 876 21292 408 CHINANET-BACKBONE 4808 829 1572 215 CNCGROUP IP network: China169 9829 794 681 34 BSNL National Internet Backbo Complete listing at http://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 3910 3733 288 bellsouth.net, inc. 4323 2711 1114 395 Time Warner Telecom 1785 1795 698 129 PaeTec Communications, Inc. 20115 1559 1520 653 Charter Communications 7018 1506 5736 957 AT&T WorldNet Services 2386 1285 568 908 AT&T Data Communications Serv 6478 1283 260 110 AT&T Worldnet Services 3356 1180 10889 405 Level 3 Communications, LLC 22773 1166 2861 66 Cox Communications, Inc. 11492 1154 207 71 Cable One Complete listing at http://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 35805 644 56 6 United Telecom of Georgia 3292 453 2027 393 TDC Tele Danmark 30890 444 111 206 Evolva Telecom 9198 411 202 13 Kazakhtelecom Data Network Ad 702 410 1869 326 UUNET - Commercial IP service 8551 400 353 46 Bezeq International 8866 400 117 18 Bulgarian Telecommunication C 3320 372 7329 323 Deutsche Telekom AG 3301 371 1414 326 TeliaNet Sweden 34984 360 89 185 BILISIM TELEKOM Complete listing at http://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 1462 3017 250 UniNet S.A. de C.V. 10620 1057 237 152 TVCABLE BOGOTA 28573 1003 784 97 NET Servicos de Comunicao S.A 7303 745 385 114 Telecom Argentina Stet-France 6503 677 175 216 AVANTEL, S.A. 22047 547 310 15 VTR PUNTO NET S.A. 3816 492 214 78 Empresa Nacional de Telecomun 7738 477 922 30 Telecomunicacoes da Bahia S.A 14420 468 32 69 ANDINATEL S.A. 11172 450 99 76 Servicios Alestra S.A de C.V Complete listing at http://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 8452 1162 445 10 TEDATA 24863 726 147 39 LINKdotNET AS number 36992 641 279 187 Etisalat MISR 3741 269 852 230 The Internet Solution 33776 219 12 11 Starcomms Nigeria Limited 2018 211 244 61 Tertiary Education Network 6713 195 186 16 Itissalat Al-MAGHRIB 24835 189 78 10 RAYA Telecom - Egypt 29571 175 17 10 Ci Telecom Autonomous system 29975 133 506 14 Vodacom Complete listing at http://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 6389 3910 3733 288 bellsouth.net, inc. 4323 2711 1114 395 Time Warner Telecom 4766 1847 8407 482 Korea Telecom (KIX) 1785 1795 698 129 PaeTec Communications, Inc. 20115 1559 1520 653 Charter Communications 7018 1506 5736 957 AT&T WorldNet Services 8151 1462 3017 250 UniNet S.A. de C.V. 7545 1335 232 107 TPG Internet Pty Ltd 17488 1319 140 127 Hathway IP Over Cable Interne 4755 1314 295 154 TATA Communications formerly Complete listing at http://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 4323 2711 2316 Time Warner Telecom 1785 1795 1666 PaeTec Communications, Inc. 4766 1847 1365 Korea Telecom (KIX) 7545 1335 1228 TPG Internet Pty Ltd 8151 1462 1212 UniNet S.A. de C.V. 17488 1319 1192 Hathway IP Over Cable Interne 6478 1283 1173 AT&T Worldnet Services 4755 1314 1160 TATA Communications formerly 8452 1162 1152 TEDATA 17974 1141 1118 PT TELEKOMUNIKASI INDONESIA Complete listing at http://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 16927 UNALLOCATED 12.0.252.0/23 7018 AT&T WorldNet Servic 15132 UNALLOCATED 12.9.150.0/24 7018 AT&T WorldNet Servic 32567 UNALLOCATED 12.14.170.0/24 7018 AT&T WorldNet Servic 13746 UNALLOCATED 12.24.56.0/24 7018 AT&T WorldNet Servic 32567 UNALLOCATED 12.25.107.0/24 7018 AT&T WorldNet Servic 26973 UNALLOCATED 12.39.152.0/24 7018 AT&T WorldNet Servic 26973 UNALLOCATED 12.39.154.0/23 7018 AT&T WorldNet Servic 26973 UNALLOCATED 12.39.155.0/24 7018 AT&T WorldNet Servic 26973 UNALLOCATED 12.39.159.0/24 7018 AT&T WorldNet Servic 25639 UNALLOCATED 12.41.169.0/24 7018 AT&T WorldNet Servic Complete listing at http://thyme.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 31.0.0.0/16 12654 RIPE NCC RIS Project 31.1.0.0/21 12654 RIPE NCC RIS Project 31.1.24.0/24 12654 RIPE NCC RIS Project 41.222.79.0/24 36938 >>UNKNOWN<< 41.223.92.0/22 36936 >>UNKNOWN<< 41.223.188.0/24 22351 Intelsat 41.223.189.0/24 6453 Teleglobe Inc. 41.223.196.0/24 36990 Alkan Telecom Ltd 41.223.197.0/24 36990 Alkan Telecom Ltd 41.223.198.0/24 36990 Alkan Telecom Ltd Complete listing at http://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:20 /9:10 /10:25 /11:68 /12:196 /13:406 /14:707 /15:1283 /16:11140 /17:5339 /18:9140 /19:18372 /20:22877 /21:22846 /22:29912 /23:29457 /24:168471 /25:971 /26:1252 /27:619 /28:31 /29:47 /30:9 /31:0 /32:7 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 6389 2505 3910 bellsouth.net, inc. 4766 1482 1847 Korea Telecom (KIX) 4323 1396 2711 Time Warner Telecom 1785 1258 1795 PaeTec Communications, Inc. 11492 1066 1154 Cable One 17488 1066 1319 Hathway IP Over Cable Interne 8452 1050 1162 TEDATA 18566 1040 1059 Covad Communications 10620 973 1057 TVCABLE BOGOTA 7018 911 1506 AT&T WorldNet Services Complete listing at http://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:2 2:2 4:13 8:288 12:2003 13:7 14:1 15:23 16:3 17:8 20:21 24:1434 27:121 31:1 32:49 33:12 38:679 40:98 41:2448 44:3 47:18 52:9 55:7 56:2 57:25 58:751 59:502 60:458 61:1074 62:1058 63:1976 64:3653 65:2356 66:4066 67:1822 68:1110 69:2878 70:694 71:237 72:1843 73:2 74:2105 75:250 76:308 77:930 78:615 79:421 80:972 81:793 82:490 83:436 84:703 85:1051 86:458 87:674 88:342 89:1566 90:93 91:2836 92:486 93:1067 94:1416 95:624 96:287 97:205 98:579 99:28 108:32 109:548 110:352 111:523 112:270 113:310 114:423 115:547 116:1069 117:660 118:482 119:938 120:143 121:739 122:1449 123:933 124:1116 125:1317 128:226 129:212 130:195 131:555 132:250 133:17 134:194 135:45 136:243 137:160 138:264 139:104 140:509 141:138 142:348 143:392 144:473 145:47 146:443 147:166 148:662 149:300 150:150 151:166 152:296 153:168 154:2 155:328 156:157 157:320 158:109 159:377 160:317 161:181 162:254 163:176 164:408 165:359 166:461 167:404 168:651 169:160 170:712 171:58 172:2 173:853 174:436 175:98 176:1 178:224 180:501 182:135 183:220 184:69 186:476 187:350 188:1087 189:782 190:3751 192:5746 193:4702 194:3364 195:2781 196:1169 198:3568 199:3449 200:5319 201:1556 202:7982 203:8250 204:4077 205:2319 206:2517 207:3103 208:3861 209:3449 210:2512 211:1261 212:1703 213:1680 214:657 215:69 216:4658 217:1516 218:491 219:378 220:1136 221:398 222:314 223:1 End of report

1 0

ATT BGP - Advertising my network on accident
by Eric Williams 25 Jun '10

25 Jun '10

AT&T is currently advertising my address space to the internet accidentally via BGP which they should not be. Since they are advertising my address space on accident, we are dead in the water. Does anybody out there work for ATT or know of the number I can call in order to have them stop advertising my /22 ASAP!!!!

2 1

ARIN's RESTful Whois Directory Service Available 26 June
by Mark Kosters 25 Jun '10

25 Jun '10

<Apologies for the duplicate email but want to keep you informed about changes occurring at ARIN. This particular upgrade may be of interest to those who are not subscribed to arin-announce.> ----- Forwarded message from Member Services <info(a)arin.net> ----- From: Member Services <info(a)arin.net> Date: Thu, 24 Jun 2010 13:00:42 -0400 To: "arin-announce(a)arin.net" <arin-announce(a)arin.net> Subject: [arin-announce] ARIN's RESTful Whois Directory Service Available 26 June ARIN is deploying an improved Whois service called Whois-RWS on 26 June 2010. Included in the deployment are the following services that provide the general public with access to ARIN's registration data. * a RESTful Web Service (RWS) * a NICNAME/WHOIS port 43 service * a user-friendly web site (http://whois.arin.net) When using Whois-RWS you will notice some differences in behavior for certain queries and corresponding result sets on the NICNAME/WHOIS TCP port 43 service. These minor differences are documented at: https://www.arin.net/resources/whoisrws/whois_diff.html ARIN's Directory Service for registration data has used the NICNAME/WHOIS protocol since its inception. The limitations of the NICNAME/WHOIS protocol are well known and documented in RFC3912. Whois-RWS was created as an alternative to the ARIN Whois and will provide much richer functionality and capability to the community. Whois-RWS can easily be integrated into command line scripts, or it can be used with a web browser, which makes it applicable for programmatic consumption and accessible for interactive use. ARIN will continue to maintain services for the NICNAME/WHOIS protocol on TCP/43. This is achieved by using a proxy service to translate traditional ARIN Whois queries into Whois-RWS queries. However, ARIN recommends use of the RESTful Web Service. Those who choose to use the Whois-RWS Proxy will find it has many features unavailable over the existing Whois service, including: * Support for new query types such as CIDR queries * Better feedback for ambiguous queries * More finely scoped record type queries * Options for NICNAME/WHOIS clients that re-interpret traditional parameters used by ARIN's service. * RESTful URL references, useful for embedding into documents and e-mail * Better grouping of record types and delineation of results Another major benefit is that data from ARIN's registration database is distributed to the Whois-RWS servers many times throughout the day, versus the once-a-day update of ARIN's previous Whois service. Changes will be reflected more quickly through Whois-RWS, so query results will be more current than the previous Whois service. ARIN continues to welcome community participation on the Whois-RWS mailing list, and we invite you to subscribe and provide feedback to: http://lists.arin.net/mailman/listinfo/arin-whoisrws Regards, Mark Kosters Chief Technical Officer American Registry for Internet Numbers (ARIN) ----- End forwarded message -----

1 0

FW: [ipv6-wg] 2010 IPv6 Deployment Monitoring Survey Now Underway
by Mark Kosters 24 Jun '10

24 Jun '10

<Apologies for duplicate emails. If you have already participated, thank you very much. And for you who have not, please consider doing so.> ARIN encourages its community to participate in the 2010 Global IPv6 Deployment Monitoring Survey being conducted by GNKS Consult and TNO and sponsored by the RIPE NCC. The survey is now available at: http://www.surveymonkey.com/s/IPv6deploymentmonitoring2010 The survey will close on 1 July 2010. All five Regional Internet Registries have committed to soliciting participation in this survey in order to compile the most complete global IPv6 deployment data possible. The survey results will provide a better understanding of current IPv6 deployment, and what still needs to be done to ensure the Internet community is ready for the widespread adoption of IPv6. ARIN/CAIDA performed a similar survey in 2008, and it was repeated in 2009 in the RIPE and APNIC regions. The 2010 survey will allow for some comparison of progress, which will be extremely valuable in determining the necessary next steps. The goal is to establish a comprehensive view of present IPv6 penetration and future plans for IPv6 deployment. The survey is composed of 23 questions and can be completed in about 15 minutes. For those without IPv6 allocations or assignments, or who have not yet deployed IPv6, the questions will be fewer in number. Results of the IPv6 Deployment Monitoring Survey will be made public in the fall. All participants that provide their name and contact information on the survey form will receive the draft survey analysis when available. Please also indicate if you are willing to share additional data with the TNO and GNKS Consult IPv6 Deployment Monitoring team. Any questions concerning the survey itself should be addressed to <info at gnksconsult.com>. Regards, Mark Kosters ARIN CTO

1 0