- NANOG - lists.nanog.org

Hulu Contact?
by Jason Lamb 13 Apr '22

13 Apr '22

Hi all, We are having some issues with customers logging into Hulu on some recent IPv4 ranges we have added to our network. I think it is likely an IPv4 geolocation issue since the issue only appears on our newer IPv4 ranges. If anyone from Hulu NetOps is monitoring this, or if anyone has a Hulu NetOps contact they would share, please reach out to me. Thanks! Jason [PRTC] <http://www.prtcnet.org> Jason Lamb, Software Engineering/IT Supervisor Peoples Rural Telephone Cooperative <http://www.prtcnet.org> 259 Main St. S. | P.O. Box 159 | McKee, KY 40447 Main: (606) 287-7101 | Direct: (606) 287-5488 | Email: jason.lamb(a)prtc.org<mailto:jason.lamb@prtc.org> CONFIDENTIALITY NOTICE: If you have received this e-mail in error, please notify the sender by return e-mail and delete it immediately. Do not print or disseminate its contents. The information in this message is intended for the listed recipients only. This message may contain information that is privileged, confidential or otherwise protected from disclosure to parties other than the listed recipients. If you are not one of the listed recipients, any disclosure, copying, distribution, or the taking of any action based on the contents of this message is prohibited.

2 1

Call for Participation -- ICANN DNSSEC and Security Workshop for ICANN74 Policy Forum
by Jacques Latour 13 Apr '22

13 Apr '22

Call for Participation -- ICANN DNSSEC and Security Workshop for ICANN74 Policy Forum In cooperation with the ICANN Security and Stability Advisory Committee (SSAC), we are planning a DNSSEC and Security Workshop for the ICANN74 Public Forum being held as a hybrid meeting from 13-16 June 2022 in the Central European Time Zone (UTC +1). This workshop date will be determined once ICANN creates a block schedule for us to follow; then we will be able to request a day and time. The DNSSEC and Security Workshop has been a part of ICANN meetings for several years and has provided a forum for both experienced and new people to meet, present and discuss current and future DNSSEC deployments. For reference, the most recent session was held at the ICANN73 Community Forum on Wednesday 09 March 2022. The presentations and transcripts are available at https://73.schedule.icann.org/meetings/qGWqRxCjbWHqdGLxN, https://73.schedule.icann.org/meetings/pm4Zz3yN3CgjoTXp2 and https://73.schedule.icann.org/meetings/qiGweLr2MS7zJwy8o. The DNSSEC Workshop Program Committee is developing a program for the upcoming meeting. Proposals will be considered for the following topic areas and included if space permits. In addition, we welcome suggestions for additional topics either for inclusion in the ICANN74 workshop, or for consideration for future workshops. 1. Global DNSSEC Activities Panel For this panel, we are seeking participation from those who have been involved in DNSSEC deployment as well as from those who have not deployed DNSSEC but who have a keen interest in the challenges and benefits of deployment, including Root Key Signing Key (KSK) Rollover activities and plans. 2. DNSSEC Best Practice Now that DNSSEC has become an operational norm for many registries, registrars, and ISPs, what have we learned about how we manage DNSSEC? * Do you still submit/accept DS records with Digest Type 1? * What is the best practice around key rollovers? * What about Algorithm rollovers? * Do you use and support DNSKEY Algorithms 13-16? * How often do you review your disaster recovery procedures? * Is there operational familiarity within your customer support teams? * What operational statistics have been gathered about DNSSEC? * Are there experiences being documented in the form of best practices, or something similar, for transfer of signed zones? Activities and issues related to DNSSEC in the DNS Root Zone are also desired. 3. DNSSEC Deployment Challenges The program committee is seeking input from those that are interested in implementation of DNSSEC but have general or particular concerns with DNSSEC. In particular, we are seeking input from individuals that would be willing to participate in a panel that would discuss questions of the following nature: * Are there any policies directly or indirectly impeding your DNSSEC deployment? (RRR model, CDS/CDNSKEY automation) * What are your most significant concerns with DNSSEC, e.g., complexity, training, implementation, operation or something else? * What do you expect DNSSEC to do for you and what doesn't it do? * What do you see as the most important trade-offs with respect to doing or not doing DNSSEC? 4. Security Panel The program committee is looking for presentations on DNS, DNSSEC, routing and other topics that could impact the security and/or stability of the Internet. We are looking for presentations that cover implementation issues, challenges, opportunities and best practices for: * Emerging threats that could impact the security and/or stability of the Internet * DoH and DoT * RPKI (Resource Public Key Infrastructure) * BGP routing & secure implementations * MANRS ( Mutually Agreed Norms for Routing Security) * Browser security – DNS, DNSSEC, DoH * EMAIL & DNS related security – DMARC, DKIM, TLSA, etc… If you are interested in participating, please send a brief (1-3 sentence) description of your proposed presentation to dnssec-security-workshop(a)icann.org<mailto:dnssec-security-workshop@icann.org> by COB Friday, 29 April 2022. Thank you, Kathy and Andrew On behalf of the DNSSEC Workshop Program Committee: Steve Crocker, Shinkuro Mark Elkins, DNS/ZACR Jacques Latour, .CA Russ Mundy, Parsons Ondrej Filip, CZ.NIC Yoshiro Yoneya, JPRS Fred Baker, ISC Dan York, Internet Society

1 0

Oahu HI undersea cable attack disrupted by federal agents
by Sean Donelan 13 Apr '22

13 Apr '22

https://www.hawaiinewsnow.com/2022/04/13/hsi-agents-honolulu-disrupted-cybe… Homeland Security Investigations says it was able to disrupt a cyberattack of a critical undersea cable, adding the hackers sought to target “infrastructure on Oahu.” The cable links Hawaii and Pacific to critical telecommunications, including internet and cell phones. HSI said its agents, based on a tip from their counterparts on the mainland, were able to disrupt last week a “significant breach involving a private company’s services” associated with the undersea cable.

1 0

IMPORTANT NOTICE - Retirement of ARIN Non-Authenticated IRR rescheduled for 4 April 2022
by John Curran 13 Apr '22

13 Apr '22

NANOGers - An important reminder – On 4 April 2022, ARIN's non-authenticated Internet Routing Registry (IRR) will be retired. Please review the attached notice for details, and do not hesitate to contact ARIN if you have any questions about this transition or need assistance. I ask that you do not hesitate to forward this notice to any others you know that are potentially unaware & impacted by this important transition. Thanks! /John John Curran President and CEO American Registry for Internet Numbers Begin forwarded message: From: ARIN <info(a)arin.net<mailto:info@arin.net>> Subject: [arin-announce] UPDATE: Retirement of ARIN Non-Authenticated IRR rescheduled for 4 April 2022 Date: 28 January 2022 at 9:01:07 PM GMT+4 To: "arin-announce(a)arin.net<mailto:arin-announce@arin.net>" <arin-announce(a)arin.net<mailto:arin-announce@arin.net>> This announcement is to inform you that the retirement of the ARIN non-authenticated Internet Routing Registry (IRR) has been rescheduled to 4 April 2022 at 12:00 PM EST. After this time, users will no longer be able to create, update, or delete records in the ARIN-NONAUTH database, and the ARIN-NONAUTH data stream will no longer be available in Near Real Time Mirroring (NRTM) or via FTP or Whois Port 43. This date change is being made in order to ensure that the first day after retirement does not fall on a Friday. The following information is from the initial announcement: ARIN has been engaged in a multi-year project to create and deploy a new and improved Internet Routing Registry (IRR). As a result of these efforts, ARIN now provides users with the ability to create, update, and delete objects in ARIN’s authenticated IRR database using ARIN Online or ARIN’s RESTful API. Unfortunately, use of ARIN’s previous non-authenticated email-based IRR service actually increased after ARIN released its authenticated IRR, in opposition to the outcome ARIN anticipated when improving its IRR. On 8 February 2021, ARIN held a consultation to solicit input on the retirement of ARIN’s non-authenticated email-based IRR service. This retirement was originally scheduled for 30 September 2021. Based on community input, the proposed date for the ARIN-NONAUTH retirement was delayed to 31 March 2022 to allow more transition time for users. We also notified by email Points of Contact (POCs) of organizations who have objects in the ARIN-NONAUTH database of the retirement date and offered them our assistance with the transition. If you have questions about this transition or need assistance, you can contact us by: • submitting an Ask ARIN ticket or chat with us using your ARIN Online account • emailing the Routing Security Team at routing.security(a)arin.net<mailto:routing.security@arin.net> • contacting the Registration Services Help Desk by phone Monday through Friday, 7:00 AM to 7:00 PM ET at +1.703.227.0660 Regards, Brad Gorman Senior Product Owner, Routing Security American Registry for Internet Numbers (ARIN)

21 62

Fwd: Fw: HOST IRR Retirement
by Ross Tajvar 12 Apr '22

12 Apr '22

I tried sending the below message from my work account, but it's not a nanog subscriber, so the email was rejected. If anyone doubts the authenticity, feel free to reach out to me at rtajvar(a)365datacenters.com. ------------------------------ *From:* Ross Tajvar *Sent:* Monday, April 11, 2022 3:53 PM *To:* nanog(a)nanog.org <nanog(a)nanog.org> *Subject:* HOST IRR Retirement Hi all, We (365 Datacenters) inherited the HOST IRR. We have removed all stale objects from it, and moved all valid objects to other IRRs. We will eventually (hopefully soon) turn it off altogether. Please, if you are mirroring it, stop doing that. If you maintain documentation that lists IRRs, please update it to reflect that HOST is no longer in use. Thanks! P.S. If anyone thinks I should also announce this somewhere else, please let me know. *Ross Tajvar* Network Engineer Office: (571)-341-8899 Support: (866)-365-6246

3 2

Something observed while doing IRR cleanup (generic name collisions)
by Dan Mahoney (Gushi) 11 Apr '22

11 Apr '22

All, The dayjob has a LOT of ASes (we peer with a unique AS per-site), so our IRR entries are kind of a lot. When "email templates" was the only way to do things, this was really annoying to update and maintain. I will say that having RPKI roas for the correct ASes for all of our entries has given my stale-object-deletion-requests more "authoritah" than those requests would have had a few years ago. Job's excellent IRRexplorer tool has been wonderful in helping figure this out and display it all at a glance, and also in finding cases where "we no longer peer with this group, but we're still in the as-set", and a few where "they peer with us, but not with this AS". I don't know how many people use irrd or rtconfig or whatever to generate your filter-lists. But even with all the work we (the operator community) is doing to widely deploy RPKI and authenicated IRRs, we still have stuff like this: $ whois -h whois.radb.net AS-PEERS | grep 'as-set\|descr\|source\|members\|^\s*$' as-set: AS-PEERS descr: autonomous systems that OpenDNS peers with members: [like 30 of them, one per line, snipped for brevity] source: RADB as-set: AS-PEERS descr: 4b42 Peering Autonomous System Numbers [no members: line!] source: RIPE as-set: AS-PEERS descr: Peer AS Numbers members: AS132251,AS132561,AS132516 source: APNIC as-set: AS-PEERS descr: swell.network Peers members: AS-HE,AS-NTT source: ARIN ..four separate organizations felt it would be clever to create a vaguely-named AS-PEERS object, each in a different IRR, because the various IRR's all allow this, and don't check for the existence of objects in another. No IRR's require any special names, nor do they block on any generic names. No IRR sends a member warnings when their objects exist in more than one registry with different data. I haven't tried to query the peeringdb API to see if any of these are used as advertised AS-Sets for public use, or if people just created public objects for their own internal tools. I'm sure this is not the only case of this. This might be why we can't have nice things. -Dan --

2 1

Puerto Rico (island-wide) power outage
by Sean Donelan 10 Apr '22

10 Apr '22

The island-wide electrical grid has failed on Puerto Rico. >From the utility company: Fault in the output breaker of Unit #5 of Costa Sur at 230kv caused the output of units 5 and 6 of the Central. The electrical system protection system took the rest of the units that were generating out of service.

1 7

People trying to sell "ARIN Leads"
by Jon Sands 09 Apr '22

09 Apr '22

Does anyone else get email offers like the below? I get them at least once a week from various companies I've never heard of, I'm sure they pop up under different names constantly for obvious reasons. Crap like this I imagine is why a few of my POC emails listed on my ARIN assets get constant spam, I can't imagine how many places there are like this scraping then selling ARIN data to marketing outlets. name and email in the below *not* scrubbed for anonymity because they need to cut this shit out -------- Forwarded Message -------- Subject: Re: American Registry for Internet Numbers (ARIN) Leads 2022 2 Date: Thu, 7 Apr 2022 12:16:02 +0000 From: Julie Levay <julie.levay(a)hoversamerica.com> To: jon(a)fohdeesha.com <jon(a)fohdeesha.com> Hi, Good Day! Would you be interested in acquiring contacts of *below?* *_Lists Contains:_**Operator/Carrier/Service Provider, VAR / Systems Integrator, Device Manufacturerr, Infrastructure Provider, Consultant, Software / Application Development, Telecom Software Provider, Gov't/ Utility / Enterprise, Telecom Equipment Manufacturer, Business and Technology Leaders, CTOs, Channel & Partner Managers, Business Development Managers, Analysts & Infrastructure Teams from Cloud Service Providers, Telecommunications, ISPs, ISVs and the IT Channel and Industry serving the cloud community *and more. *_We provide information like-_*Name, Email, Title, Phone Number and Company Details Please let me know you’re below requirements in detail so that I can provide Counts and test file for your review. *Target Industry: ____________________??* *Target Geography: ________________??* *Waiting for your response.* *Regards,* *Julie Levay* *Demand Generation Specialists.* * * -- Jon Sands MFI Labs https://fohdeesha.com/

8 10

Weekly Global IPv4 Routing Table Report
by Routing Table Analysis Role Account 08 Apr '22

08 Apr '22

This is an automated weekly mailing describing the state of the Global IPv4 Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net. For historical data, please see https://thyme.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. IPv4 Routing Table Report 04:00 +10GMT Sat 09 Apr, 2022 BGP Table (Global) as seen in Japan. Report Website: https://thyme.apnic.net Detailed Analysis: https://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 894824 Prefixes after maximum aggregation (per Origin AS): 337152 Deaggregation factor: 2.65 Unique aggregates announced (without unneeded subnets): 429719 Total ASes present in the Internet Routing Table: 72959 Prefixes per ASN: 12.26 Origin-only ASes present in the Internet Routing Table: 62615 Origin ASes announcing only one prefix: 25724 Transit ASes present in the Internet Routing Table: 10344 Transit-only ASes present in the Internet Routing Table: 368 Average AS path length visible in the Internet Routing Table: 4.4 Max AS path length visible: 65 Max AS path prepend of ASN (267602) 58 Prefixes from unregistered ASNs in the Routing Table: 818 Number of instances of unregistered ASNs: 823 Number of 32-bit ASNs allocated by the RIRs: 39036 Number of 32-bit ASNs visible in the Routing Table: 32430 Prefixes from 32-bit ASNs in the Routing Table: 152520 Number of bogon 32-bit ASNs visible in the Routing Table: 25 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 459 Number of addresses announced to Internet: 3067445760 Equivalent to 182 /8s, 213 /16s and 130 /24s Percentage of available address space announced: 82.9 Percentage of allocated address space announced: 82.9 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.5 Total number of prefixes smaller than registry allocations: 303742 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 234530 Total APNIC prefixes after maximum aggregation: 66511 APNIC Deaggregation factor: 3.53 Prefixes being announced from the APNIC address blocks: 229401 Unique aggregates announced from the APNIC address blocks: 94455 APNIC Region origin ASes present in the Internet Routing Table: 12538 APNIC Prefixes per ASN: 18.30 APNIC Region origin ASes announcing only one prefix: 3557 APNIC Region transit ASes present in the Internet Routing Table: 1724 Average APNIC Region AS path length visible: 4.7 Max APNIC Region AS path length visible: 27 Number of APNIC region 32-bit ASNs visible in the Routing Table: 7736 Number of APNIC addresses announced to Internet: 774015360 Equivalent to 46 /8s, 34 /16s and 137 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-151865 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 260506 Total ARIN prefixes after maximum aggregation: 119722 ARIN Deaggregation factor: 2.18 Prefixes being announced from the ARIN address blocks: 260466 Unique aggregates announced from the ARIN address blocks: 124224 ARIN Region origin ASes present in the Internet Routing Table: 18997 ARIN Prefixes per ASN: 13.71 ARIN Region origin ASes announcing only one prefix: 6893 ARIN Region transit ASes present in the Internet Routing Table: 1951 Average ARIN Region AS path length visible: 3.8 Max ARIN Region AS path length visible: 35 Number of ARIN region 32-bit ASNs visible in the Routing Table: 4427 Number of ARIN addresses announced to Internet: 1295152640 Equivalent to 77 /8s, 50 /16s and 118 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-401308 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 256731 Total RIPE prefixes after maximum aggregation: 117238 RIPE Deaggregation factor: 2.19 Prefixes being announced from the RIPE address blocks: 254134 Unique aggregates announced from the RIPE address blocks: 150682 RIPE Region origin ASes present in the Internet Routing Table: 28118 RIPE Prefixes per ASN: 9.04 RIPE Region origin ASes announcing only one prefix: 12060 RIPE Region transit ASes present in the Internet Routing Table: 3973 Average RIPE Region AS path length visible: 4.3 Max RIPE Region AS path length visible: 28 Number of RIPE region 32-bit ASNs visible in the Routing Table: 10674 Number of RIPE addresses announced to Internet: 713988480 Equivalent to 42 /8s, 142 /16s and 153 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-213403 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 114514 Total LACNIC prefixes after maximum aggregation: 27586 LACNIC Deaggregation factor: 4.15 Prefixes being announced from the LACNIC address blocks: 114425 Unique aggregates announced from the LACNIC address blocks: 48270 LACNIC Region origin ASes present in the Internet Routing Table: 10948 LACNIC Prefixes per ASN: 10.45 LACNIC Region origin ASes announcing only one prefix: 2649 LACNIC Region transit ASes present in the Internet Routing Table: 2203 Average LACNIC Region AS path length visible: 4.9 Max LACNIC Region AS path length visible: 65 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 8639 Number of LACNIC addresses announced to Internet: 176332544 Equivalent to 10 /8s, 130 /16s and 159 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-273820 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 27725 Total AfriNIC prefixes after maximum aggregation: 5450 AfriNIC Deaggregation factor: 5.09 Prefixes being announced from the AfriNIC address blocks: 35939 Unique aggregates announced from the AfriNIC address blocks: 11688 AfriNIC Region origin ASes present in the Internet Routing Table: 1622 AfriNIC Prefixes per ASN: 22.16 AfriNIC Region origin ASes announcing only one prefix: 565 AfriNIC Region transit ASes present in the Internet Routing Table: 331 Average AfriNIC Region AS path length visible: 5.1 Max AfriNIC Region AS path length visible: 34 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 954 Number of AfriNIC addresses announced to Internet: 107700224 Equivalent to 6 /8s, 107 /16s and 96 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 9157 8884 44 CHINAMOBILE-CN China Mobile Communicati 7545 5902 789 699 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4715 4192 75 ERX-CERNET-BKB China Education and Rese 7552 3590 1330 19 VIETEL-AS-AP Viettel Group, VN 7713 3500 1038 51 TELKOMNET-AS-AP PT Telekomunikasi Indon 45899 3434 1880 56 VNPT-AS-VN VNPT Corp, VN 4766 2497 11121 601 KIXS-AS-KR Korea Telecom, KR 9498 2392 491 238 BBIL-AP BHARTI Airtel Ltd., IN 45090 2161 1438 79 TENCENT-NET-AP Shenzhen Tencent Compute 4755 2115 429 197 TATACOMM-AS TATA Communications formerl Complete listing at https://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 6159 10260 2671 AMAZON-02, US 11492 4463 296 710 CABLEONE, US 22773 3932 3060 365 ASN-CXA-ALL-CCI-22773-RDC, US 7155 3900 264 31 VIASAT-SP-BACKBONE, US 16625 3636 1871 2560 AKAMAI-AS, US 6327 3431 1318 62 SHAW, CA 749 2882 50780 2138 DNIC-AS-00749, US 30036 2614 374 124 MEDIACOM-ENTERPRISE-BUSINESS, US 209 2519 4962 423 CENTURYLINK-US-LEGACY-QWEST, US 20115 2256 3042 495 CHARTER-20115, US Complete listing at https://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 6807 1730 149 UNI2-AS, ES 9121 6724 1692 17 TTNET, TR 8551 4003 374 39 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 20940 3933 3360 201 AKAMAI-ASN1, NL 39891 3819 220 34 ALJAWWALSTC-AS, SA 12389 2959 2274 909 ROSTELECOM-AS, RU 6849 2758 355 21 UKRTELNET, UA 9009 2474 247 1283 M247, GB 34984 2221 356 623 TELLCOM-AS, TR 47331 2085 328 1596 TTNET, TR Complete listing at https://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 10531 3391 558 Uninet S.A. de C.V., MX 10620 3461 517 764 Telmex Colombia S.A., CO 11830 2430 369 63 Instituto Costarricense de Electricidad 13999 1736 294 471 Mega Cable, S.A. de C.V., MX 6503 1446 354 523 Axtel, S.A.B. de C.V., MX 28573 1395 2333 253 CLARO S.A., BR 3816 1255 667 147 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 6147 1084 369 21 Telefonica del Peru S.A.A., PE 11664 1007 192 448 Techtel LMDS Comunicaciones Interactiva 11172 960 133 63 Alestra, S. de R.L. de C.V., MX Complete listing at https://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1629 393 21 LINKdotNET-AS, EG 24835 1473 523 33 RAYA-AS, EG 36992 1314 1519 263 ETISALAT-MISR, EG 36903 1199 545 114 MT-MPLS, MA 29571 902 65 58 ORANGE-COTE-IVOIRE, CI 36935 771 520 42 Vodafone-, EG 6713 612 1863 34 IAM-AS, MA 15399 518 51 34 WANANCHI-, KE 37342 469 32 1 MOVITEL, MZ 23889 424 232 16 MauritiusTelecom, MU Complete listing at https://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 10531 3391 558 Uninet S.A. de C.V., MX 9808 9157 8884 44 CHINAMOBILE-CN China Mobile Communicati 12479 6807 1730 149 UNI2-AS, ES 9121 6724 1692 17 TTNET, TR 16509 6159 10260 2671 AMAZON-02, US 7545 5902 789 699 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4715 4192 75 ERX-CERNET-BKB China Education and Rese 11492 4463 296 710 CABLEONE, US 8551 4003 374 39 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 20940 3933 3360 201 AKAMAI-ASN1, NL Complete listing at https://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 9808 9157 9113 CHINAMOBILE-CN China Mobile Communications Grou 9121 6724 6707 TTNET, TR 12479 6807 6658 UNI2-AS, ES 7545 5902 5203 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4715 4640 ERX-CERNET-BKB China Education and Research Net 8551 4003 3964 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 7155 3900 3869 VIASAT-SP-BACKBONE, US 39891 3819 3785 ALJAWWALSTC-AS, SA 11492 4463 3753 CABLEONE, US 20940 3933 3732 AKAMAI-ASN1, NL Complete listing at https://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 398083 UNALLOCATED 5.133.124.0/24 399587 UT, US 33123 UNALLOCATED 8.10.69.0/24 11168 SCC, US 62828 UNALLOCATED 8.21.130.0/24 3356 LEVEL3, US 393266 UNALLOCATED 8.23.52.0/24 46887 LIGHTOWER, US 18604 UNALLOCATED 8.25.204.0/24 3356 LEVEL3, US 394936 UNALLOCATED 8.33.224.0/24 22442 HOU-PHONOSCOPE, US 54338 UNALLOCATED 8.33.241.0/24 6461 ZAYO-6461, US 395438 UNALLOCATED 8.42.206.0/24 3356 LEVEL3, US 395056 UNALLOCATED 8.45.133.0/24 3356 LEVEL3, US 32306 UNALLOCATED 8.46.80.0/24 33652 CMCS, US Complete listing at https://thyme.apnic.net/current/data-badAS Prefixes from the Special Purpose Address Registry (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at https://thyme.apnic.net/current/data-spar Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 5.42.192.0/24 Origin: 50340 SELECTEL-MSK, RU 5.42.192.0/24 Transit: 20485 TRANSTELECOM Moscow, Russia, RU 5.42.197.0/24 Origin: 39605 IGUANESOLUTIONS, FR 5.42.197.0/24 Transit: 1299 TWELVE99 Arelion, fka Telia Carrier, SE 5.42.211.0/24 Origin: 49392 ASBAXETN, RU 5.42.211.0/24 Transit: 39238 OKBPROGRESS Moscow, Russia, RU 5.42.212.0/24 Origin: 49392 ASBAXETN, RU 5.42.212.0/24 Transit: 39238 OKBPROGRESS Moscow, Russia, RU 5.42.213.0/24 Origin: 49392 ASBAXETN, RU 5.42.213.0/24 Transit: 39238 OKBPROGRESS Moscow, Russia, RU Complete listing at https://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:13 /10:40 /11:102 /12:307 /13:588 /14:1205 /15:2054 /16:13531 /17:8255 /18:13880 /19:25188 /20:43365 /21:52257 /22:108366 /23:95757 /24:529086 /25:814 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 9121 5879 6724 TTNET, TR 12479 5790 6807 UNI2-AS, ES 8151 4189 10531 Uninet S.A. de C.V., MX 8551 3476 4003 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 11492 3371 4463 CABLEONE, US 6327 3243 3431 SHAW, CA 39891 3131 3819 ALJAWWALSTC-AS, SA 7155 2990 3900 VIASAT-SP-BACKBONE, US 22773 2932 3932 ASN-CXA-ALL-CCI-22773-RDC, US 6849 2620 2758 UKRTELNET, UA Complete listing at https://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1846 2:1037 3:154 4:7 5:3807 6:103 7:5 8:1563 9:1 11:172 12:1711 13:282 14:2387 15:191 16:44 17:381 18:148 20:194 21:4 22:188 23:5596 24:2289 25:4 27:2593 29:19 31:2442 32:96 34:1 35:73 36:1757 37:4423 38:2739 39:719 40:151 41:3923 42:1000 43:2165 44:293 45:16040 46:4136 47:339 49:1677 50:1920 51:100 52:1409 53:1 54:363 55:708 56:8 57:58 58:1804 59:1202 60:955 61:2269 62:2493 63:1950 64:5516 65:2302 66:4834 67:2975 68:1178 69:4157 70:1339 71:658 72:3062 74:2666 75:1388 76:588 77:2149 78:3904 79:3110 80:1982 81:1747 82:1481 83:1199 84:1364 85:3651 86:714 87:1961 88:2734 89:3287 90:524 91:7617 92:1989 93:2586 94:3456 95:4779 96:1310 97:348 98:988 99:739 100:74 101:1031 102:2024 103:28834 104:4368 105:466 106:854 107:2511 108:826 109:4221 110:2079 111:3297 112:2033 113:1522 114:1485 115:1952 116:1902 117:2520 118:2271 119:1866 120:1681 121:1064 122:2560 123:2120 124:1594 125:2116 128:1211 129:1220 130:922 131:2074 132:767 133:373 134:1930 135:289 136:838 137:875 138:2447 139:1493 140:858 141:1411 142:1288 143:1487 144:1240 145:342 146:1804 147:1497 148:2218 149:1701 150:855 151:1079 152:1834 153:459 154:3526 155:1432 156:1852 157:1234 158:1026 159:2081 160:2463 161:1325 162:3437 163:1246 164:1635 165:1611 166:703 167:1716 168:3751 169:711 170:4434 171:825 172:3108 173:3086 174:1017 175:1128 176:3455 177:4622 178:3454 179:2012 180:2278 181:2944 182:3243 183:1942 184:2388 185:19498 186:4368 187:3642 188:3877 189:3175 190:8907 191:1304 192:10990 193:8575 194:6950 195:4970 196:2966 197:2405 198:6030 199:6021 200:7495 201:5681 202:10504 203:10024 204:4546 205:3382 206:3767 207:3401 208:4048 209:4665 210:4263 211:2450 212:4013 213:3425 214:1155 215:67 216:6426 217:2660 218:1261 219:569 220:1947 221:980 222:844 223:2145 End of report

1 0

Spoofer Report for NANOG for Mar 2022
by CAIDA Spoofer Project 08 Apr '22

08 Apr '22

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Mar 2022: ASN Name Fixed-By 36289 VALORCHRISTIANHIGHSCHOOL-01 2022-03-11 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Mar 2022: ASN Name First-Spoofed Last-Spoofed 54825 PACKET 2016-04-15 2022-03-14 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2022-03-24 6128 CABLE-NET-1 2016-09-03 2022-03-14 20412 CLARITY-TELECOM 2016-09-30 2022-03-31 6181 FUSE-NET 2016-10-10 2022-03-25 1403 EBOX 2016-11-12 2022-03-17 22898 ATLINK 2016-12-16 2022-03-30 812 ROGERS-COMMUNICATIONS 2017-01-04 2022-03-15 701 UUNET 2017-06-14 2022-03-24 63296 AWBROADBAND 2017-09-01 2022-03-22 33452 RW 2018-09-19 2022-03-26 8047 GCI 2019-04-11 2022-03-10 5078 ONENET-AS-1 2020-04-06 2022-03-22 398836 NP-NETWORKS 2021-03-12 2022-03-25 56207 Converge 2021-03-26 2022-03-31 22191 WILKES-COMM 2021-06-25 2022-03-13 399318 2021-08-29 2022-03-15 63457 EMPIRE-CONNECT 2021-09-08 2022-03-31 212934 AS_POTVIN 2021-10-03 2022-03-22 22773 ASN-CXA-ALL-CCI-22773-RDC 2021-10-24 2022-03-31 394437 PSLIGHTWAVE 2021-12-02 2022-03-12 62887 WHITESKY-COMMUNICATIONS 2021-12-03 2022-03-17 54201 WEWORK-MANAGEMENT-LLC 2021-12-16 2022-03-23 7896 NU 2022-01-12 2022-03-11 31939 GM-ATL 2022-03-03 2022-03-03 36289 VALORCHRISTIANHIGHSCHOOL-01 2022-03-08 2022-03-10 399065 DEFASTLINK 2022-03-12 2022-03-27 19752 HYDROONETELECOM 2022-03-13 2022-03-13 398371 ORANGE-COUNTY-BROADBAND-AUTHOR 2022-03-13 2022-03-13 32035 CCDT 2022-03-14 2022-03-14 47027 SEASIDE-COMM 2022-03-22 2022-03-22 33696 NEXTARRAY-ASN-01 2022-03-30 2022-03-30 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0