- NANOG - lists.nanog.org

Seeking Assistance with Microsoft IP Blocklist removal of large IP space (AS53755 / IOFlood)
by John Boucher 01 Jun '25

01 Jun '25

Hello, I’m reaching out on behalf of IOFlood (AS53755) and we are currently experiencing an issue where Microsoft appears to be blocking our entire IP space from delivering mail to Hotmail, Outlook, and MSN addresses. This has become a significant inconvenience and hassle for all of our customers who rely on email delivery to Microsoft domains. Unfortunately, Microsoft’s standard IP removal form is not a feasible solution given the size of our overall IP allocations. They only allow a /24 per request and while we have been working using this method, it would be near impossible to cover all of our IP space in any reasonable amount of time. We’re looking for anyone who may be able to assist directly, or who can point us to a contact or escalation path within Microsoft. If you have any guidance or contacts to share, I’d greatly appreciate it. Best regards, -- John Boucher Senior Technician - Input Output Flood, LLC *We Love Servers* web: www.ioflood.com email: support(a)ioflood.com twitter: @ioflood

1 0

Weekly Global IPv4 Routing Table Report
by Routing Table Analysis Role Account 30 May '25

30 May '25

This is an automated weekly mailing describing the state of the Global IPv4 Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG UKNOF, TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net. For historical data, please see https://thyme.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. IPv4 Routing Table Report 04:00 +10GMT Sat 31 May, 2025 IPv4 BGP Table (Global) as seen at Japan. Report Website: https://thyme.apnic.net Detailed Analysis: https://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 985921 Prefixes after maximum aggregation (per Origin AS): 380656 Deaggregation factor: 2.59 Unique aggregates announced (without unneeded subnets): 482972 Number of IPv4 prefixes with a valid ROA: 543024 Number of IPv4 prefixes with an invalid ROA: 1315 Number of IPv4 prefixes with no ROA: 441582 Total ASes present in the Internet Routing Table: 76950 Prefixes per ASN: 12.81 Origin-only ASes present in the Internet Routing Table: 65862 Origin ASes announcing only one prefix: 26966 Transit ASes present in the Internet Routing Table: 11088 Transit-only ASes present in the Internet Routing Table: 557 Average AS path length visible in the Internet Routing Table: 5.2 Max AS path length visible: 152 Max AS path prepend of ASN (150261) 150 Prefixes from unregistered ASNs in the Routing Table: 1016 Number of instances of unregistered ASNs: 1029 Number of 32-bit ASNs allocated by the RIRs: 46546 Number of 32-bit ASNs visible in the Routing Table: 38337 Prefixes from 32-bit ASNs in the Routing Table: 204194 Number of bogon 32-bit ASNs visible in the Routing Table: 46 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 443 Number of addresses announced to Internet: 3111182720 Equivalent to 185 /8s, 112 /16s and 225 /24s Percentage of available address space announced: 84.0 Percentage of allocated address space announced: 84.0 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.6 Total number of prefixes smaller than registry allocations: 322389 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 259242 Total APNIC prefixes after maximum aggregation: 77989 APNIC Deaggregation factor: 3.32 Prefixes being announced from the APNIC address blocks: 250277 Unique aggregates announced from the APNIC address blocks: 104342 APNIC Region origin ASes present in the Internet Routing Table: 14645 APNIC Prefixes per ASN: 17.09 APNIC Region origin ASes announcing only one prefix: 4455 APNIC Region transit ASes present in the Internet Routing Table: 1955 Average APNIC Region AS path length visible: 5.4 Max APNIC Region AS path length visible: 152 Number of APNIC region 32-bit ASNs visible in the Routing Table: 10140 Number of APNIC addresses announced to Internet: 749584384 Equivalent to 44 /8s, 173 /16s and 192 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-155961 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 291365 Total ARIN prefixes after maximum aggregation: 131338 ARIN Deaggregation factor: 2.22 Prefixes being announced from the ARIN address blocks: 291962 Unique aggregates announced from the ARIN address blocks: 139565 ARIN Region origin ASes present in the Internet Routing Table: 19248 ARIN Prefixes per ASN: 15.17 ARIN Region origin ASes announcing only one prefix: 7042 ARIN Region transit ASes present in the Internet Routing Table: 1999 Average ARIN Region AS path length visible: 4.6 Max ARIN Region AS path length visible: 34 Number of ARIN region 32-bit ASNs visible in the Routing Table: 5227 Number of ARIN addresses announced to Internet: 1352670464 Equivalent to 80 /8s, 160 /16s and 29 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-402332 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 54/8, 55/8, 56/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 274531 Total RIPE prefixes after maximum aggregation: 134444 RIPE Deaggregation factor: 2.04 Prefixes being announced from the RIPE address blocks: 272807 Unique aggregates announced from the RIPE address blocks: 175202 RIPE Region origin ASes present in the Internet Routing Table: 28956 RIPE Prefixes per ASN: 9.42 RIPE Region origin ASes announcing only one prefix: 12096 RIPE Region transit ASes present in the Internet Routing Table: 4017 Average RIPE Region AS path length visible: 5.3 Max RIPE Region AS path length visible: 69 Number of RIPE region 32-bit ASNs visible in the Routing Table: 12469 Number of RIPE addresses announced to Internet: 731677312 Equivalent to 43 /8s, 156 /16s and 130 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-216475 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 53/8, 57/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 124239 Total LACNIC prefixes after maximum aggregation: 29552 LACNIC Deaggregation factor: 4.20 Prefixes being announced from the LACNIC address blocks: 120623 Unique aggregates announced from the LACNIC address blocks: 48961 LACNIC Region origin ASes present in the Internet Routing Table: 11264 LACNIC Prefixes per ASN: 10.71 LACNIC Region origin ASes announcing only one prefix: 2682 LACNIC Region transit ASes present in the Internet Routing Table: 2540 Average LACNIC Region AS path length visible: 5.9 Max LACNIC Region AS path length visible: 75 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 9223 Number of LACNIC addresses announced to Internet: 171972608 Equivalent to 10 /8s, 64 /16s and 24 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-274844 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 35528 Total AfriNIC prefixes after maximum aggregation: 6700 AfriNIC Deaggregation factor: 5.30 Prefixes being announced from the AfriNIC address blocks: 49809 Unique aggregates announced from the AfriNIC address blocks: 14496 AfriNIC Region origin ASes present in the Internet Routing Table: 1914 AfriNIC Prefixes per ASN: 26.02 AfriNIC Region origin ASes announcing only one prefix: 691 AfriNIC Region transit ASes present in the Internet Routing Table: 377 Average AfriNIC Region AS path length visible: 5.9 Max AfriNIC Region AS path length visible: 80 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 1278 Number of AfriNIC addresses announced to Internet: 105083392 Equivalent to 6 /8s, 67 /16s and 114 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 11131 8757 102 CHINAMOBILE-CN China Mobile Communication 7545 6177 844 649 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4778 4192 76 ERX-CERNET-BKB China Education and Resear 9498 4390 534 305 BBIL-AP BHARTI Airtel Ltd., IN 7552 3921 1332 26 VIETEL-AS-AP Viettel Group, VN 7713 3696 1044 66 TELKOMNET-AS-AP PT Telekomunikasi Indones 45899 3287 1869 103 VNPT-AS-VN VNPT Corp, VN 24560 2879 854 531 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd., 4766 2371 11522 627 KIXS-AS-KR Korea Telecom, KR 45090 2208 1439 86 TENCENT-NET-AP Shenzhen Tencent Computer Complete listing at https://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 13569 40828 5196 AMAZON-02, US 11492 4735 314 586 CABLEONE, US 7155 3864 286 85 VIASAT-SP-BACKBONE, US 6327 3631 1320 81 SHAW, CA 174 3365 8746 890 COGENT-174, US 22773 3348 3033 170 ASN-CXA-ALL-CCI-22773-RDC, US 749 3230 54783 2481 DNIC-AS-00749, US 396982 3175 3853 420 GOOGLE-CLOUD-PLATFORM, US 16625 3022 1258 2229 AKAMAI-AS, US 36352 2817 230 853 AS-COLOCROSSING, US Complete listing at https://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 7720 1714 148 UNI2-AS, ES 39891 4798 293 63 ALJAWWALSTC-AS, SA 20940 3963 3395 127 AKAMAI-ASN1, NL 9009 3898 356 2071 M247, RO 12389 3082 2306 890 ROSTELECOM-AS PJSC Rostelecom. Technical 34984 2391 360 580 TELLCOM-AS, TR 212238 2221 161 1635 CDNEXT, GB 8452 1611 1852 14 TE-AS TE-AS, EG 13188 1606 100 34 TRIOLAN, UA 62240 1425 95 740 CLOUVIDER Clouvider - Global ASN, GB Complete listing at https://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 12169 3253 582 UNINET, MX 10620 3499 480 1017 Telmex Colombia S.A., CO 13999 2512 540 362 Mega Cable, S.A. de C.V., MX 11830 1990 369 64 Instituto Costarricense de Electricidad y 28573 1361 2438 262 Claro NXT Telecomunicacoes Ltda, BR 3816 1338 785 210 COLOMBIA TELECOMUNICACIONES S.A. ESP BIC, 6147 1198 371 22 Telefonica del Peru S.A.A., PE 11664 1190 278 33 Techtel LMDS Comunicaciones Interactivas 22884 1060 67 377 TOTAL PLAY TELECOMUNICACIONES SA DE CV, M 26615 1035 2503 52 TIM SA, BR Complete listing at https://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24835 1780 644 27 RAYA-AS, EG 24863 1652 389 16 LINKdotNET-AS, EG 29571 1610 102 33 ORANGE-COTE-IVOIRE, CI 36992 1431 1519 280 ETISALAT-MISR, EG 36903 1250 554 97 MT-MPLS, MA 37069 1107 1100 18 MOBINIL, EG 36935 1054 523 47 Vodafone-, EG 20011 980 185 285 INTERNET-SOLUTIONS, ZA 36914 558 82 3 KENET-AS, KE 15399 541 57 59 WANANCHI-, KE Complete listing at https://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 13569 40828 5196 AMAZON-02, US 8151 12169 3253 582 UNINET, MX 9808 11131 8757 102 CHINAMOBILE-CN China Mobile Communication 12479 7720 1714 148 UNI2-AS, ES 7545 6177 844 649 TPG-INTERNET-AP TPG Telecom Limited, AU 39891 4798 293 63 ALJAWWALSTC-AS, SA 4538 4778 4192 76 ERX-CERNET-BKB China Education and Resear 11492 4735 314 586 CABLEONE, US 9498 4390 534 305 BBIL-AP BHARTI Airtel Ltd., IN 20940 3963 3395 127 AKAMAI-ASN1, NL Complete listing at https://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 8151 12169 11587 UNINET, MX 9808 11131 11029 CHINAMOBILE-CN China Mobile Communications Grou 12479 7720 7572 UNI2-AS, ES 7545 6177 5528 TPG-INTERNET-AP TPG Telecom Limited, AU 39891 4798 4735 ALJAWWALSTC-AS, SA 4538 4778 4702 ERX-CERNET-BKB China Education and Research Net 11492 4735 4149 CABLEONE, US 9498 4390 4085 BBIL-AP BHARTI Airtel Ltd., IN 7552 3921 3895 VIETEL-AS-AP Viettel Group, VN 20940 3963 3836 AKAMAI-ASN1, NL Complete listing at https://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 22542 UNALLOCATED 8.7.205.0/24 3356 LEVEL3, US 33123 UNALLOCATED 8.10.69.0/24 174 COGENT-174, US 12169 UNALLOCATED 8.15.207.0/24 32787 PROLEXIC-TECHNOLOGIES-D 46639 UNALLOCATED 8.17.66.0/24 701 UUNET, US 53775 UNALLOCATED 8.20.88.0/24 7029 WINDSTREAM, US 393266 UNALLOCATED 8.23.52.0/24 46887 CROWNCASTLE-AS46887, US 396894 UNALLOCATED 8.28.201.0/24 46887 CROWNCASTLE-AS46887, US 394936 UNALLOCATED 8.33.224.0/24 22442 HOU-PHONOSCOPE, US 54338 UNALLOCATED 8.33.241.0/24 3356 LEVEL3, US 46639 UNALLOCATED 8.38.73.0/24 3356 LEVEL3, US Complete listing at https://thyme.apnic.net/current/data-badAS Prefixes from the Special Purpose Address Registry (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at https://thyme.apnic.net/current/data-spar Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 14.192.20.0/22 Origin: 26658 HENGTONG-IDC-LLC, US 14.192.20.0/22 Transit: 6939 HURRICANE, US 23.140.216.0/24 Origin: 27176 DATAWAGON, US 23.140.216.0/24 Transit: 20278 NEXEON, US 23.141.0.0/24 Origin: 395350 RESERVED, ZZ 23.141.0.0/24 Transit: 11426 TWC-11426-CAROLINAS, US 23.147.240.0/24 Origin: 32302 RESERVED, ZZ 23.147.240.0/24 Transit: 32787 PROLEXIC-TECHNOLOGIES-DDOS-MITIGATION-NE 23.152.48.0/24 Origin: 46167 RESERVED, ZZ 23.152.48.0/24 Transit: 7018 ATT-INTERNET4, US Complete listing at https://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:16 /10:41 /11:92 /12:299 /13:581 /14:1212 /15:2144 /16:13918 /17:8330 /18:13775 /19:24844 /20:44780 /21:52151 /22:112309 /23:102364 /24:608251 /25:798 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 6635 7720 UNI2-AS, ES 8151 6362 12169 UNINET, MX 11492 3532 4735 CABLEONE, US 39891 3489 4798 ALJAWWALSTC-AS, SA 6327 3426 3631 SHAW, CA 7155 2823 3864 VIASAT-SP-BACKBONE, US 22773 2496 3348 ASN-CXA-ALL-CCI-22773-RDC, US 16509 2389 13569 AMAZON-02, US 30036 2237 2578 MEDIACOM-ENTERPRISE-BUSINESS, US 10620 2186 3499 Telmex Colombia S.A., CO Complete listing at https://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1716 2:1504 3:797 4:9 5:4659 6:162 7:6 8:1599 9:1 11:172 12:1361 13:429 14:2559 15:358 16:285 17:377 18:918 20:542 21:4 22:188 23:7548 24:2750 25:2 27:2707 29:19 31:3283 32:39 33:1 34:83 35:214 36:3032 37:4632 38:9194 39:910 40:170 41:4225 42:955 43:2578 44:378 45:18590 46:5081 47:320 49:1938 50:1886 51:592 52:1568 54:321 55:1098 56:11 57:265 58:2146 59:1370 60:1168 61:2805 62:2931 63:1805 64:5445 65:2175 66:4628 67:3045 68:1129 69:3853 70:1078 71:631 72:2844 74:2784 75:1508 76:621 77:2700 78:1892 79:1692 80:2220 81:2063 82:3099 83:1453 84:1865 85:3428 86:1067 87:2383 88:1290 89:4398 90:776 91:8376 92:2714 93:2911 94:4061 95:4335 96:1418 97:316 98:978 99:689 100:72 101:1221 102:3862 103:32235 104:5056 105:764 106:1036 107:2650 108:1258 109:4059 110:2247 111:3342 112:2117 113:1532 114:1978 115:2119 116:2052 117:2535 118:2368 119:1934 120:1988 121:1432 122:2777 123:2181 124:1632 125:2889 126:91 128:1598 129:968 130:1316 131:1978 132:785 133:449 134:1535 135:333 136:1350 137:1176 138:2885 139:1583 140:1606 141:1505 142:1907 143:1788 144:1150 145:509 146:2191 147:2109 148:2702 149:2888 150:1245 151:1938 152:2090 153:503 154:8008 155:1986 156:3302 157:1907 158:1329 159:2482 160:3821 161:1844 162:3774 163:2180 164:1720 165:2221 166:1494 167:1927 168:4320 169:794 170:5082 171:1010 172:4432 173:3307 174:916 175:1294 176:3700 177:4715 178:3647 179:2315 180:2630 181:4088 182:3442 183:1855 184:2069 185:21589 186:5148 187:4502 188:4235 189:4288 190:9555 191:1471 192:11307 193:9467 194:7794 195:5550 196:3264 197:3661 198:6207 199:8534 200:8217 201:6342 202:10459 203:10572 204:4567 205:3636 206:4508 207:3579 208:4230 209:5174 210:4840 211:2638 212:4571 213:3734 214:1029 215:48 216:6735 217:3118 218:1406 219:545 220:2092 221:1105 222:855 223:2428 End of report

1 0

Who is generating an edgesuite.net error message
by jmiller＠boselaw.com 30 May '25

30 May '25

Three of our locations with Cogent Internet service are unable to access a web site. Three of our non-Cogent locations are able to access the site just fine. We get the error message below, and I don't know enough about this to tell if the issue is with Cogent, with a CDN, or with the web server. Can anyone offer insight? Here is the error we get: You don't have permission to access "http://waf-failover.macys.com/prod/WAF_Failover/WAF_error_page.html?" on this server. Reference #18.5ebc7768.1747925785.aafdbd3 https://errors.edgesuite.net/18.5ebc7768.1747925785.aafdbd3

9 9

routenator and krill log filter
by Randy Bush 29 May '25

29 May '25

i get nightly log reportd from rpki servers of various flavors. two, see $ubject, seem to be popular enough that others may have tooling to help. for each, i want log filters/analysers which tell me about bad things i can do something about. i do not care about the 42,000 sick servers out there as i do not have time to fix the world. i do not care about things not needing action on *my* part. i expect/hope for a null report most days. i do not want a fully featured blob, a gooey, a large wad of dependencies, ... just something stupid i can pipe the logs through old fashioned unix style. randy

1 0

11 More Days Until N94! Have You Registered Yet? + More
by Nanog News 29 May '25

29 May '25

*** 11 More Days Until N94!* ------------------------------------------------------------ *Still Time to Register In-Person or Virtually* Join us in person (June 9–11) or from anywhere in the world. *Don't Miss:* + Monday's Keynote: "Data Center Futures: Scaling the Backbone of Tomorrow’s Digital World" w/ US Signal's John White + Ground-breaking Panels + Collaborative Workshops + Conversations that are Building the Internet + Much, Much More! *REGISTER NOW* (https://nanog.org/events/nanog-94/register/) *** Have You Registered for the Upcoming N94 Workshops?* ------------------------------------------------------------ *Attendees Must be Registered In-Person at N94 to Participate* *Offered Workshops (additional sign-up required):* + The Easy Way to IPv6: IPv6 Migration for Enterprises + RPKI Nuts and Bolts + IPv6 Clinic w/ AWS ****Click on talk in agenda to see more info.* *SEE AGENDA *(https://nanog.org/events/nanog-94/agenda/) *** Still Time to Register for Hackathon!* ------------------------------------------------------------ *Attendees Must be Registered In-Person at N94 to Participate* *Grab your laptop, your questions, and your problem-solving superpowers.* 👨‍💻 *Collaborate with engineers from Meta.* 🧠 Design intelligent, adaptive networks. 🤝 Join a community that speaks your language. *LEARN MORE *(https://nanog.org/events/nanog-94-hackathon/) *** Women in Tech Mixer will take place on June 8!* ------------------------------------------------------------ *Build Authentic Connections via Games, Crafts + Nostalgic Fun at Camp NANOGWIT* *Date:* Sunday, June 8, BEFORE N94 *Time: *5:00 pm - 6:30 pm *Location:* Governors Square 15 *SEE ALL SOCIALS *(https://nanog.org/events/nanog-94/socials/) *** Prevent Altitude Sickness at N94* ------------------------------------------------------------ *Stay Healthy at our Higher Altitude Conference Location* *Attendees of N94 may notice a difference in the air upon arriving in Denver. *Located at a notable 5280 ft. (mile-high) above sea level, the air is much thinner than average U.S. cities, increasing the chance of getting altitude sickness. *No need to worry. *With a few smart habits and some preparation, you'll stay sharp and energized throughout the event. *READ MORE* ( https://nanog.org/stories/articles/prevent-altitude-sickness-at-n94/) *** Stay Connected* ------------------------------------------------------------ http://www.facebook.com http://www.instagram.com/nanog_org/ http://www.linkedin.com/company/nanog/ https://www.twitter.com/nanog/ http://nanog.org

1 0

Misblock (via SNI) of obscura.net on various ISPs
by Carl Dong 29 May '25

29 May '25

Our (Obscura’s) users are reporting that obscura.net and subdomains are being blocked. See end of message for why we think it’s SNI-based. They’ve observed this on at least Spectrum, Comcast, and United Airlines (whatever their upstream is). We are losing users as I write this, which is why I’m asking (read: pleading) for NANOG’s help. On Spectrum, the user notes that they see from their Spectrum portal that “Secure Browsing” was the culprit. Specifically, they see that pkgs.obscura.net is blocked with the following detail: > Secure Browsing prevents you from visiting potentially harmful websites. These may include sites that spread malware or use phishing attacks to steal your data. When a website is blocked, you may see the Security Shield icon appear on your browser. We are a new VPN service, and definitely not a phishing site. More details: https://obscura.net/blog/bootstrapping-trust/ We’d love any help in any and all of the below: 1. If you operate an ISP, especially Spectrum or Comcast, please unblock us. 2. If you know how I can get into contact with Spectrum or Comcast and not have to wait for 5 business days, we’d love to know. 2. It seems like we were put on some kind of list, if you have suspicions for what list that could be, we'd love to know. 3. If you have any ideas for how we could resolve this ASAP, we’re open to any and all suggestions. We’re already looking into getting rid of SNI and using http3 for even our API calls, and will aim to deploy a hotfix soon. –Carl Dong On a technical level, this seems to be SNI-blocking, see the following curl outputs. DNS resolved correctly, but TLS problems: curl --verbose --insecure --location 'https://v1.api.prod.obscura.net/api/ping’ * Host v1.api.prod.obscura.net:443 was resolved. * IPv6: (none) * IPv4: 66.42.95.12 * Trying 66.42.95.12:443... * Connected to v1.api.prod.obscura.net (66.42.95.12) port 443 * ALPN: curl offers h2,http/1.1 * (304) (OUT), TLS handshake, Client hello (1): * LibreSSL/3.3.6: error:1404B42E:SSL routines:ST_CONNECT:tlsv1 alert protocol version * Closing connection curl: (35) LibreSSL/3.3.6: error:1404B42E:SSL routines:ST_CONNECT:tlsv1 alert protocol version This one is essentially doing an SNI spoof, and succeeds: curl --connect-to 'google.com::66.42.95.12:' -H "Host: v1.api.prod.obscura.net" --verbose --insecure --location 'https://google.com/api/ping’ * Connecting to hostname: 66.42.95.12 * Trying 66.42.95.12:443... * Connected to 66.42.95.12 (66.42.95.12) port 443 * ALPN: curl offers h2,http/1.1 * (304) (OUT), TLS handshake, Client hello (1): * (304) (IN), TLS handshake, Server hello (2): * (304) (IN), TLS handshake, Unknown (8): * (304) (IN), TLS handshake, Certificate (11): * (304) (IN), TLS handshake, CERT verify (15): * (304) (IN), TLS handshake, Finished (20): * (304) (OUT), TLS handshake, Finished (20): * SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256 / [blank] / UNDEF * ALPN: server accepted h2 * Server certificate: * subject: CN=v1.api.prod.obscura.net * start date: May 4 22:38:20 2025 GMT * expire date: Aug 2 22:38:19 2025 GMT * issuer: C=US; O=Let's Encrypt; CN=E6 * SSL certificate verify ok. * using HTTP/2 * [HTTP/2] [1] OPENED stream for https://google.com/api/ping * [HTTP/2] [1] [:method: GET] * [HTTP/2] [1] [:scheme: https] * [HTTP/2] [1] [:authority: v1.api.prod.obscura.net] * [HTTP/2] [1] [:path: /api/ping] * [HTTP/2] [1] [user-agent: curl/8.7.1] * [HTTP/2] [1] [accept: */*] > GET /api/ping HTTP/2 > Host: v1.api.prod.obscura.net > User-Agent: curl/8.7.1 > Accept: */* > * Request completely sent off < HTTP/2 200 < date: Wed, 28 May 2025 23:50:28 GMT < content-type: application/json < content-length: 67 < vary: origin, access-control-request-method, access-control-request-headers < access-control-allow-origin: * < strict-transport-security: max-age=63072000 < * Connection #0 to host 66.42.95.12 left intact {"env":"prod","version":"3a91af31b3b75b6fd8d8acfefb53d812e601749e"}

1 0

Sudden surge in CGNAT blacklisting
by Eric C. Miller 28 May '25

28 May '25

Has anyone else experienced a sudden increase in the past 2 weeks of blocks getting flagged as "VPN" or "Proxy?" We have some older leased space from HE and Cogent that got hammered seemingly all at once. We've started accelerating our migration to our ARIN space, but it's still odd why it's all of a sudden. Most of the addresses are between 32:1 and 256:1 CGNAT pool IPs, and there are other 256:1 IPs that remain unaffected. Each customer behind an IP is in the same subdivision. Eric

10 15

Spectrum Transport
by Travis Garrison 27 May '25

27 May '25

Could someone from Spectrum contact me on pricing for several transport circuit? Carrier sales has been going to voicemail for a week and the enterprise number just gives a busy signal. Thank you Travis Garrison Chief Technology Officer 417-851-1700 www.netviscom.com<http://www.netviscom.com/> [cid:image001.png@01DBCEF0.0B1D3CE0]

4 3

Massive change in Public Cert behaviour coming soon
by Colin Constable 24 May '25

24 May '25

Is anyone elae worried about this? We use public certs for client auth in a number of cases. https://letsencrypt.org/2025/05/14/ending-tls-client-authentication/ And here's the Chrome policy document that's forcing the change https://googlechrome.github.io/chromerootprogram/#321-applicant-pki-hierarc… The TLS world is not just Web Browsers, so let me know if this effects you too. Colin Constable

19 91

Survey on Filtering of TCP Options in the Internet
by Fahad Hilal 23 May '25

23 May '25

Hello NANOG, We at the Max Planck Institute for Informatik (Germany) and LIX, Ecole Polytechnique (France) have been performing measurements to understand how TCP options/features are processed by routers along the path (see our previous work [1]). We want to confront network operators' views with our observations. To this end, we propose this short survey [2] to operators and would really appreciate if you could complete it. Please note that you are free to answer only the questions you feel comfortable with. Your input will be used anonymously and will not be connected to your AS. We look forward to your input. [1] https://dl.acm.org/doi/10.1145/3595290 [2] https://nextcloud.mpi-inf.mpg.de/index.php/apps/forms/s/WS4cscFcASZabpm2bax… Best regards, Fahad Hilal MPI-INF

1 0