- NANOG - lists.nanog.org

RE: Where are static bogon filters appropriate? was: 96.2.0.0/16 Bogons
by michael.dillon＠bt.com 02 Mar '07

02 Mar '07

> I think this really goes to the heart of the matter - the inability/ > unwillingness to prioritize and allocate resources to properly > implement 'good neighbor' policies which are not perceived as having > any financial benefit to the organization. > > So, can this sort of activity somehow be monetized by the SPs, > remedied by the vendors, or is it a matter for the standards bodies > (or some combination thereof)? Standards bodies do technology, not policy. This is more of an issue for regulators or industry associations. To start with, it makes sense to me that public Internet providers would form some sort of trade association to develop and publish industry best practices. And to evaluate member compliance with those practices. This still doesn't fix the problem, but it provides an opening for legislators to step in and regulate the ISPs who are not members of the trade association. No matter how much some on this list may dislike regulation for the industry, it is inevitable because it is the only way to solve policy issues like bogon filtering. Either self-regulation through a trade association or government regulation through an FCC-like body. As far as monetizing the activity, it will probably take a lawsuit against one of the incompetent ISPs before network operations management recognizes why this stuff needs to be MANAGED and not left to the whims of engineers. --Michael Dillon

1 0

BGP Update Report
by cidr-report＠potaroo.net 02 Mar '07

02 Mar '07

BGP Update Report Interval: 16-Feb-07 -to- 01-Mar-07 (14 days) Observation Point: BGP Peering with AS4637 TOP 20 Unstable Origin AS Rank ASN Upds % Upds/Pfx AS-Name 1 - AS9583 20259 1.8% 23.0 -- SIFY-AS-IN Sify Limited 2 - AS7015 15718 1.4% 4.0 -- CCCH-AS2 - Comcast Cable Communications Holdings, Inc 3 - AS702 12655 1.1% 17.7 -- AS702 MCI EMEA - Commercial IP service provider in Europe 4 - AS17974 10619 0.9% 30.3 -- TELKOMNET-AS2-AP PT TELEKOMUNIKASI INDONESIA 5 - AS20426 10001 0.9% 10001.0 -- PWC-AS - PriceWaterhouseCoopers, LLP 6 - AS24731 9822 0.9% 577.8 -- ASN-NESMA National Engineering Services and Marketing Company Ltd. (NESMA) 7 - AS18809 9561 0.8% 187.5 -- Cable Onda 8 - AS12654 7739 0.7% 203.7 -- RIPE-NCC-RIS-AS RIPE NCC RIS project 9 - AS306 7421 0.7% 40.8 -- DNIC - DoD Network Information Center 10 - AS14522 7025 0.6% 52.4 -- Satnet 11 - AS25145 6562 0.6% 234.4 -- TEKNOTEL-AS tr.teknotel AS-Number 12 - AS4788 6510 0.6% 39.2 -- TMNET-AS-AP TM Net, Internet Service Provider 13 - AS5786 6383 0.6% 40.1 -- UPRENET - University of Puerto Rico 14 - AS4621 6093 0.5% 43.2 -- UNSPECIFIED UNINET-TH 15 - AS8151 6001 0.5% 8.4 -- Uninet S.A. de C.V. 16 - AS5803 5703 0.5% 63.4 -- DDN-ASNBLK - DoD Network Information Center 17 - AS11139 5657 0.5% 14.8 -- CWRIN CW BARBADOS 18 - AS4765 5638 0.5% 33.6 -- WORLDNET-AS World Net & Services Co., Ltd. 19 - AS721 5330 0.5% 11.1 -- DISA-ASNBLK - DoD Network Information Center 20 - AS4775 5198 0.5% 39.1 -- GLOBE-TELECOM-AS Telecom Carrier / ISP Plus + TOP 20 Unstable Origin AS (Updates per announced prefix) Rank ASN Upds % Upds/Pfx AS-Name 1 - AS20426 10001 0.9% 10001.0 -- PWC-AS - PriceWaterhouseCoopers, LLP 2 - AS31594 3700 0.3% 3700.0 -- FORTESS-AS Fortess LLC Network 3 - AS25774 1509 0.1% 1509.0 -- CHAPMORTCORP - CHAPEL MORTGAGE 4 - AS19580 1376 0.1% 1376.0 -- ZONETEL - ZONE TELECOM, INC. 5 - AS33025 1041 0.1% 1041.0 -- QE-ASN-01 - Quinn Emanuel Urquhart Oliver & Hedges LLP 6 - AS7345 3811 0.3% 952.8 -- LUCENTTECH - Lucent Technologies Inc. 7 - AS34378 919 0.1% 919.0 -- RUG-AS Razguliay-UKRROS Group 8 - AS28746 853 0.1% 853.0 -- MSS-UK-AS Multimedia Strategic Solutions - UK 9 - AS4587 2542 0.2% 847.3 -- ONEWORLD2 - One World Internetworking, Inc 10 - AS39066 1580 0.1% 790.0 -- KREDYTBANKUA-AS Kredyt Bank (Ukraine) AS 11 - AS21391 1318 0.1% 659.0 -- TDA-AS 12 - AS9090 657 0.1% 657.0 -- OiT-AS 13 - AS3043 3161 0.3% 632.2 -- AMPHIB-AS - Amphibian Media Corporation 14 - AS22140 631 0.1% 631.0 -- T-MOBILE-AS22140 - T-Mobile USA 15 - AS31307 595 0.1% 595.0 -- YKYATIRIM YAPI KREDI YATIRIM 16 - AS24731 9822 0.9% 577.8 -- ASN-NESMA National Engineering Services and Marketing Company Ltd. (NESMA) 17 - AS30707 1673 0.1% 557.7 -- SICOR-US-CA-IRVINE - SICOR Pharmaceuticals, Inc. 18 - AS4271 1028 0.1% 514.0 -- WORX - Networx 19 - AS9648 498 0.0% 498.0 -- ASN-OZONLINE-AU # AS-OZONLINE-AU CONVERTED TO ASN-OZONLINE-AU FOR RPSL COMPLIANCE Australia On-Line Pty Ltd 20 - AS29098 491 0.0% 491.0 -- IPSO-AS S.C. IPSO S.A. TOP 20 Unstable Prefixes Rank Prefix Upds % Origin AS -- AS Name 1 - 155.201.48.0/21 10001 0.7% AS20426 -- PWC-AS - PriceWaterhouseCoopers, LLP 2 - 194.242.124.0/22 3700 0.3% AS31594 -- FORTESS-AS Fortess LLC Network 3 - 89.4.128.0/24 3235 0.2% AS24731 -- ASN-NESMA National Engineering Services and Marketing Company Ltd. (NESMA) 4 - 89.4.129.0/24 3228 0.2% AS24731 -- ASN-NESMA National Engineering Services and Marketing Company Ltd. (NESMA) 5 - 209.140.24.0/24 3134 0.2% AS3043 -- AMPHIB-AS - Amphibian Media Corporation 6 - 89.4.131.0/24 3115 0.2% AS24731 -- ASN-NESMA National Engineering Services and Marketing Company Ltd. (NESMA) 7 - 203.177.144.0/23 2917 0.2% AS4775 -- GLOBE-TELECOM-AS Telecom Carrier / ISP Plus + 8 - 62.89.226.0/24 1987 0.1% AS20663 -- INAR-VOLOGDA-AS Autonomous System of Vologda 9 - 135.109.224.0/19 1986 0.1% AS7345 -- LUCENTTECH - Lucent Technologies Inc. 10 - 135.109.0.0/19 1812 0.1% AS7345 -- LUCENTTECH - Lucent Technologies Inc. 11 - 64.95.193.0/24 1656 0.1% AS30707 -- SICOR-US-CA-IRVINE - SICOR Pharmaceuticals, Inc. 12 - 194.42.208.0/20 1643 0.1% AS705 -- UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 13 - 213.144.115.0/24 1626 0.1% AS25145 -- TEKNOTEL-AS tr.teknotel AS-Number 14 - 213.144.113.0/24 1623 0.1% AS25145 -- TEKNOTEL-AS tr.teknotel AS-Number 15 - 213.144.100.0/24 1597 0.1% AS25145 -- TEKNOTEL-AS tr.teknotel AS-Number 16 - 213.144.101.0/24 1595 0.1% AS25145 -- TEKNOTEL-AS tr.teknotel AS-Number 17 - 194.225.132.0/24 1583 0.1% AS6736 -- IRANET-IPM IRANET/IPM 18 - 207.106.204.0/24 1509 0.1% AS25774 -- CHAPMORTCORP - CHAPEL MORTGAGE 19 - 38.99.251.0/24 1376 0.1% AS19580 -- ZONETEL - ZONE TELECOM, INC. 20 - 216.85.83.0/24 1363 0.1% AS4323 -- TWTC - Time Warner Telecom, Inc. AS6467 -- ESPIRECOMM - Xspedius Communications Co. Details at http://bgpupdates.potaroo.net ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org ausnog(a)ausnog.net

1 0

The Cidr Report
by cidr-report＠potaroo.net 02 Mar '07

02 Mar '07

This report has been generated at Fri Mar 2 21:47:29 2007 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 23-02-07 209950 135967 24-02-07 209999 135960 25-02-07 210050 135897 26-02-07 209843 136231 27-02-07 210353 136500 28-02-07 210457 136950 01-03-07 211223 136851 02-03-07 210831 136505 AS Summary 24416 Number of ASes in routing system 10302 Number of ASes announcing only one prefix 1483 Largest number of prefixes announced by an AS AS7018 : ATT-INTERNET4 - AT&T WorldNet Services 90547200 Largest address span announced by an AS (/32s) AS721 : DISA-ASNBLK - DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 02Mar07 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 210843 136602 74241 35.2% All ASes AS4323 1325 357 968 73.1% TWTC - Time Warner Telecom, Inc. AS4134 1243 309 934 75.1% CHINANET-BACKBONE No.31,Jin-rong Street AS4755 1073 177 896 83.5% VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System AS9498 959 115 844 88.0% BBIL-AP BHARTI BT INTERNET LTD. AS6478 1123 387 736 65.5% ATT-INTERNET3 - AT&T WorldNet Services AS22773 728 48 680 93.4% CCINET-2 - Cox Communications Inc. AS11492 985 355 630 64.0% CABLEONE - CABLE ONE AS18566 993 397 596 60.0% COVAD - Covad Communications Co. AS8151 1047 456 591 56.4% Uninet S.A. de C.V. AS19262 713 180 533 74.8% VZGNI-TRANSIT - Verizon Internet Services Inc. AS6197 1020 509 511 50.1% BATI-ATL - BellSouth Network Solutions, Inc AS7018 1483 974 509 34.3% ATT-INTERNET4 - AT&T WorldNet Services AS18101 530 27 503 94.9% RIL-IDC Reliance Infocom Ltd Internet Data Centre, AS17488 607 125 482 79.4% HATHWAY-NET-AP Hathway IP Over Cable Internet AS19916 568 97 471 82.9% ASTRUM-0001 - OLM LLC AS17676 503 65 438 87.1% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS15270 506 74 432 85.4% AS-PAETEC-NET - PaeTec.net -a division of PaeTecCommunications, Inc. AS4766 731 314 417 57.0% KIXS-AS-KR Korea Telecom AS2386 1114 743 371 33.3% INS-AS - AT&T Data Communications Services AS4812 435 72 363 83.4% CHINANET-SH-AP China Telecom (Group) AS721 632 277 355 56.2% DISA-ASNBLK - DoD Network Information Center AS3602 518 184 334 64.5% AS3602-RTI - Rogers Telecom Inc. AS5668 567 235 332 58.6% AS-5668 - CenturyTel Internet Holdings, Inc. AS16852 397 72 325 81.9% BROADWING-FOCAL - Broadwing Communications Services, Inc. AS7011 795 474 321 40.4% FRONTIER-AND-CITIZENS - Frontier Communications, Inc. AS33588 432 127 305 70.6% BRESNAN-AS - Bresnan Communications, LLC. AS6198 563 268 295 52.4% BATI-MIA - BellSouth Network Solutions, Inc AS7029 514 225 289 56.2% WINDSTREAM - Windstream Communications Inc AS4668 290 7 283 97.6% LGNET-AS-KR LG CNS AS855 568 288 280 49.3% CANET-ASN-4 - Bell Aliant Total 22962 7938 15024 65.4% Top 30 total Possible Bogus Routes 24.246.0.0/17 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 24.246.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 60.253.0.0/18 AS27572 THEBOE-27572 - The Boeing Company 60.253.64.0/19 AS27572 THEBOE-27572 - The Boeing Company 61.4.64.0/20 AS9929 CNCNET-CN China Netcom Corp. 63.248.0.0/16 AS3356 LEVEL3 Level 3 Communications 63.248.0.0/17 AS3356 LEVEL3 Level 3 Communications 64.7.112.0/21 AS13511 ITXC - ITXC 64.7.120.0/21 AS13537 ITXC-2 - ITXC 64.17.32.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.33.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.37.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.46.96.0/20 AS13680 AS13680 Hostway Corporation Tampa, FL 64.46.112.0/20 AS30217 DESYNC Desync Corporation 64.79.64.0/19 AS10789 BIGNET-AS - The Bignet 64.79.86.0/24 AS10789 BIGNET-AS - The Bignet 64.79.87.0/24 AS10789 BIGNET-AS - The Bignet 64.79.88.0/24 AS10789 BIGNET-AS - The Bignet 64.79.89.0/24 AS10789 BIGNET-AS - The Bignet 64.79.90.0/24 AS10789 BIGNET-AS - The Bignet 64.79.96.0/20 AS10789 BIGNET-AS - The Bignet 64.89.224.0/24 AS15276 MAX-LV - Intuitive Logic 64.89.225.0/24 AS15276 MAX-LV - Intuitive Logic 64.89.226.0/24 AS15276 MAX-LV - Intuitive Logic 64.89.232.0/24 AS15276 MAX-LV - Intuitive Logic 64.89.239.0/24 AS15276 MAX-LV - Intuitive Logic 64.188.0.0/16 AS3356 LEVEL3 Level 3 Communications 64.250.128.0/18 AS10789 BIGNET-AS - The Bignet 65.60.45.0/24 AS32311 JKS-ASN - JKS Media, LLC 66.11.32.0/20 AS6261 VISINET - Visionary Systems, Inc. 66.37.96.0/20 AS3764 IA-HOU-AS - Internet America, Inc. 66.54.91.0/24 AS30506 BLACKSUN-1 - Blacksun Technologies LLC 66.55.160.0/19 AS29994 ISKIMARO - Iskimaro 66.64.96.0/20 AS3790 RADIGRAFICA COSTARRICENSE 66.97.32.0/20 AS11305 INTERLAND-NET1 - Interland Incorporated 66.163.96.0/20 AS25767 WAVEFORM - Waveform Technology, LLC 66.180.239.0/24 AS35888 VIGNETTE - VIGNETTE CORPORATION 66.235.158.0/23 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 66.241.96.0/21 AS10271 TCIX - Troy City Internet Exchange, Inc 69.36.192.0/20 AS29804 INTEGRATIX - Integratix Inc. 69.55.108.0/24 AS4977 NET1 - Pecos Technologies 69.71.192.0/20 AS13818 PHX-INTL-TELEPORT - Phoenix International Teleport 72.9.128.0/20 AS27572 THEBOE-27572 - The Boeing Company 77.239.32.0/19 AS15600 FINECOM Finecom Telecommunications AG 77.242.112.0/20 AS35332 DATAWEB DataWeb Internetdiensten B.V. - The Netherlands 78.32.0.0/15 AS8468 ENTANET ENTANET International Ltd 79.192.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 79.255.248.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 123.0.0.0/8 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 128.209.0.0/16 AS4017 BELLST - Bell Atlantic Science & Technology 131.64.0.0/12 AS721 DISA-ASNBLK - DoD Network Information Center 132.0.0.0/10 AS721 DISA-ASNBLK - DoD Network Information Center 137.0.0.0/13 AS721 DISA-ASNBLK - DoD Network Information Center 138.136.0.0/13 AS721 DISA-ASNBLK - DoD Network Information Center 139.56.0.0/19 AS14956 BROADVISION-ASN - Broadvision Inc. 139.56.72.0/23 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 151.135.0.0/16 AS4763 TELSTRANZ-AS TelstraClear Ltd 158.0.0.0/13 AS721 DISA-ASNBLK - DoD Network Information Center 159.3.211.0/24 AS2687 ASATTCA AT&T Global Network Services - AP 159.220.0.0/22 AS16050 REUTERS-DOCKLANDS-RES-AS Reuters Docklands resiliancy 159.220.4.0/22 AS16050 REUTERS-DOCKLANDS-RES-AS Reuters Docklands resiliancy 159.220.4.0/24 AS16050 REUTERS-DOCKLANDS-RES-AS Reuters Docklands resiliancy 159.220.8.0/22 AS35528 REUTERS-UK2-AS Reuters-UK2 159.220.40.0/24 AS1787 REUTERS-AMERICA-ISP-CELL-AS - Reuters America Inc. 159.220.41.0/24 AS1787 REUTERS-AMERICA-ISP-CELL-AS - Reuters America Inc. 159.220.42.0/24 AS1787 REUTERS-AMERICA-ISP-CELL-AS - Reuters America Inc. 159.220.43.0/24 AS1787 REUTERS-AMERICA-ISP-CELL-AS - Reuters America Inc. 159.220.64.0/23 AS24977 MONEYLINE-UK Moneyline Telerate 163.142.0.0/16 AS2500 JPNIC-ASBLOCK-AP JPNIC 180.190.0.0/16 AS24003 JUBL-MAIN-AS-IN JUBILANT ORGANOSYS LTD., INDIA, LEADING CHEMICAL MANUFACTURER 190.54.0.0/16 AS6429 Core Internet AT&T Chile 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.40.105.0/24 AS12582 TSF-DATANET-NGD-AS TSF MPLS VPN Services 192.69.107.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.69.108.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.69.177.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.70.164.0/24 AS25689 NRCNET-AS - National Research Council of Canada 192.81.160.0/24 AS719 ELISA-AS Elisa Oyj 192.81.182.0/24 AS719 ELISA-AS Elisa Oyj 192.81.183.0/24 AS719 ELISA-AS Elisa Oyj 192.81.184.0/24 AS719 ELISA-AS Elisa Oyj 192.88.99.0/24 AS559 SWITCH SWITCH, Swiss Education and Research Network 192.96.36.0/24 AS5713 SAIX-NET 192.96.37.0/24 AS10474 NETACTIVE 192.96.135.0/24 AS2018 TENET-1 192.96.136.0/23 AS2018 TENET-1 192.96.140.0/24 AS2018 TENET-1 192.96.143.0/24 AS2018 TENET-1 192.96.145.0/24 AS2018 TENET-1 192.96.177.0/24 AS6083 POSIX-AFRICA 192.96.250.0/24 AS2018 TENET-1 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS10282 EQUANT-CEEUR EQUANT AS for Central and Eastern Europe region 192.139.3.0/24 AS23184 PERSONA - PERSONA COMMUNICATIONS INC. 192.153.136.0/21 AS721 DISA-ASNBLK - DoD Network Information Center 192.153.144.0/21 AS721 DISA-ASNBLK - DoD Network Information Center 192.172.0.0/19 AS721 DISA-ASNBLK - DoD Network Information Center 192.188.208.0/20 AS721 DISA-ASNBLK - DoD Network Information Center 192.245.235.0/24 AS10913 INTERNAP-BLK - Internap Network Services 193.200.72.0/24 AS25394 MK-NETZDIENSTE-AS AS for MK Netzdienste GmbH & Co. KG 193.200.73.0/24 AS25394 MK-NETZDIENSTE-AS AS for MK Netzdienste GmbH & Co. KG 194.0.226.0/24 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 194.0.228.0/24 AS25394 MK-NETZDIENSTE-AS AS for MK Netzdienste GmbH & Co. KG 194.31.227.0/24 AS21461 TRANSFAIRNET Transfair-net GmbH Krefeld 194.59.176.0/20 AS1273 CW Cable & Wireless 194.153.107.0/24 AS8897 MISTRAL Mistral Internet Group Limited 194.246.72.0/23 AS8893 ARTFILES-AS Artfiles New Media GmbH 196.6.108.0/24 AS5713 SAIX-NET 196.6.175.0/24 AS3741 IS 196.6.176.0/23 AS3741 IS 196.6.183.0/24 AS3741 IS 196.6.196.0/24 AS3741 IS 196.6.199.0/24 AS3741 IS 196.6.204.0/22 AS3741 IS 196.6.208.0/24 AS3741 IS 196.6.211.0/24 AS3741 IS 196.6.212.0/23 AS3741 IS 196.6.212.0/24 AS3741 IS 196.6.222.0/23 AS3741 IS 196.6.237.0/24 AS3741 IS 196.10.119.0/24 AS2018 TENET-1 196.10.122.0/23 AS2018 TENET-1 196.10.136.0/22 AS3741 IS 196.10.140.0/22 AS3741 IS 196.10.231.0/24 AS3741 IS 196.10.251.0/24 AS2018 TENET-1 196.10.252.0/23 AS2018 TENET-1 196.10.254.0/24 AS2018 TENET-1 196.11.0.0/20 AS3741 IS 196.11.40.0/21 AS3741 IS 196.11.135.0/24 AS3741 IS 196.11.188.0/23 AS3741 IS 196.11.190.0/24 AS3741 IS 196.11.251.0/24 AS3741 IS 196.13.101.0/24 AS2018 TENET-1 196.13.102.0/23 AS2018 TENET-1 196.13.104.0/24 AS2018 TENET-1 196.13.108.0/24 AS3741 IS 196.13.116.0/22 AS2018 TENET-1 196.13.121.0/24 AS2018 TENET-1 196.13.125.0/24 AS2018 TENET-1 196.13.126.0/24 AS2018 TENET-1 196.13.128.0/22 AS3741 IS 196.13.144.0/22 AS2905 TICSA-ASN 196.13.152.0/21 AS2905 TICSA-ASN 196.13.160.0/24 AS2905 TICSA-ASN 196.13.169.0/24 AS2018 TENET-1 196.13.174.0/23 AS2018 TENET-1 196.13.176.0/21 AS2018 TENET-1 196.13.188.0/22 AS2018 TENET-1 196.13.192.0/22 AS2018 TENET-1 196.13.196.0/24 AS2018 TENET-1 196.13.214.0/23 AS3741 IS 196.13.216.0/23 AS3741 IS 198.23.26.0/24 AS4390 BELLATLANTIC-COM - Bell Atlantic, Inc. 198.54.82.0/24 AS2018 TENET-1 198.54.92.0/24 AS2018 TENET-1 198.54.222.0/24 AS2018 TENET-1 198.54.249.0/24 AS2018 TENET-1 198.54.250.0/24 AS2018 TENET-1 198.54.251.0/24 AS2018 TENET-1 198.97.72.0/21 AS721 DISA-ASNBLK - DoD Network Information Center 198.97.80.0/20 AS721 DISA-ASNBLK - DoD Network Information Center 198.97.96.0/19 AS721 DISA-ASNBLK - DoD Network Information Center 198.97.240.0/20 AS721 DISA-ASNBLK - DoD Network Information Center 198.161.87.0/24 AS6539 GT-BELL - Bell Canada 198.163.155.0/24 AS684 MTSAL-ASN - MTS Allstream Inc. 198.167.0.0/16 AS7456 INTERHOP - Interhop Network SERVICES Inc. 198.168.0.0/16 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 198.169.0.0/16 AS803 SASKTEL - SaskTel 199.9.128.0/17 AS668 ASN-ASNET-NET-AS - Defense Research and Engineering Network 199.10.0.0/16 AS721 DISA-ASNBLK - DoD Network Information Center 199.60.0.0/20 AS271 BCNET-AS - University of British Columbia 199.114.0.0/21 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.128.0/18 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.130.0/24 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.132.0/24 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.134.0/24 AS3541 ITSDN-U4 - DISA/UNRRA 199.114.136.0/24 AS27044 DDN-ASNBLK1 - DoD Network Information Center 199.114.138.0/24 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.114.140.0/24 AS3544 ITSDN-U7 - DISA/UNRRA 199.114.142.0/24 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.114.144.0/24 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.114.148.0/24 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.150.0/24 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.152.0/24 AS27033 DDN-ASNBLK1 - DoD Network Information Center 199.114.153.0/24 AS27034 DDN-ASNBLK1 - DoD Network Information Center 199.114.154.0/24 AS3542 ITSDN-U5 - DISA/UNRRA 199.114.156.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.114.160.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.121.0.0/16 AS721 DISA-ASNBLK - DoD Network Information Center 199.123.0.0/18 AS721 DISA-ASNBLK - DoD Network Information Center 199.123.16.0/20 AS721 DISA-ASNBLK - DoD Network Information Center 199.123.80.0/21 AS721 DISA-ASNBLK - DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST-AS - IQuest Internet 199.202.0.0/16 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 199.246.116.0/24 AS813 UUNET-CANADA - MCI Communications Services, Inc. d/b/a Verizon Business 202.4.160.0/24 AS9498 BBIL-AP BHARTI BT INTERNET LTD. 202.4.161.0/24 AS9498 BBIL-AP BHARTI BT INTERNET LTD. 202.4.162.0/24 AS9498 BBIL-AP BHARTI BT INTERNET LTD. 202.9.64.0/19 AS9290 TPN-AS-AP Smart Global Network (M) Sdn Bhd 202.45.132.0/22 AS24314 UPSI-AS-AP University Pendidikan Sultan Idris 202.58.113.0/24 AS19161 INNOCOM-TELECOM - INNOCOM TELECOM 202.58.224.0/19 AS17925 WAVENET WAVENET PHILIPPINES INC. 202.58.224.0/20 AS17925 WAVENET WAVENET PHILIPPINES INC. 202.58.240.0/20 AS17925 WAVENET WAVENET PHILIPPINES INC. 202.58.240.0/24 AS17925 WAVENET WAVENET PHILIPPINES INC. 202.58.244.0/24 AS17925 WAVENET WAVENET PHILIPPINES INC. 202.58.249.0/24 AS17925 WAVENET WAVENET PHILIPPINES INC. 202.58.250.0/24 AS17925 WAVENET WAVENET PHILIPPINES INC. 202.58.253.0/24 AS17925 WAVENET WAVENET PHILIPPINES INC. 202.59.8.0/21 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.86.252.0/22 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.253.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.254.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.255.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.90.33.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.40.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.41.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.42.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.43.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.44.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.94.70.0/24 AS9837 POWERTEL-AP Powertel Ltd 202.124.16.0/24 AS24485 SWIFTROUTE-AS-AP Swiftroute Pte. Ltd. 202.124.17.0/24 AS24485 SWIFTROUTE-AS-AP Swiftroute Pte. Ltd. 202.124.18.0/24 AS24485 SWIFTROUTE-AS-AP Swiftroute Pte. Ltd. 202.124.19.0/24 AS24485 SWIFTROUTE-AS-AP Swiftroute Pte. Ltd. 202.124.20.0/24 AS24485 SWIFTROUTE-AS-AP Swiftroute Pte. Ltd. 202.124.21.0/24 AS24485 SWIFTROUTE-AS-AP Swiftroute Pte. Ltd. 202.124.22.0/24 AS24485 SWIFTROUTE-AS-AP Swiftroute Pte. Ltd. 202.124.23.0/24 AS24485 SWIFTROUTE-AS-AP Swiftroute Pte. Ltd. 202.124.192.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.193.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.194.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.195.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.196.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.197.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.198.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.199.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.200.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.201.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.202.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.203.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.204.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.205.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.206.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.207.0/24 AS17911 BRAINPK-AS-AP Brain Telecommunication Ltd. 202.125.96.0/20 AS7693 COMNET-TH KSC Commercial Internet Co. Ltd. 202.136.254.0/24 AS4808 CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network 202.136.255.0/24 AS4808 CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network 202.148.32.0/20 AS17495 GATEWAY-AP BROADBAND WIRELESSS INTERNET SERVICE PROVIDER 202.164.100.0/24 AS18101 RIL-IDC Reliance Infocom Ltd Internet Data Centre, 202.174.70.0/24 AS21175 M-LINK M-Link Teleport s.a. 202.174.71.0/24 AS23924 SCNET-AS-AP Storage Continuity Pte Ltd 202.174.72.0/22 AS23924 SCNET-AS-AP Storage Continuity Pte Ltd 202.182.32.0/22 AS10223 UECOMM-AU Uecomm Ltd 203.13.171.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 203.62.0.0/17 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet) 203.78.48.0/20 AS9299 IPG-AS-AP Philippine Long Distance Telephone Company 203.80.32.0/20 AS4817 DESTRA-AU-AP Destra Corporation 203.89.139.0/24 AS17911 BRAINPK-AS-AP Brain Telecommunication Ltd. 203.111.192.0/20 AS7473 SINGTEL-AS-AP Singapore Telecom 203.128.128.0/19 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 203.152.136.0/23 AS23649 NEWSKIES-AS-AP New Skies Satellites, Hong Kong Teleport 203.152.138.0/23 AS23649 NEWSKIES-AS-AP New Skies Satellites, Hong Kong Teleport 203.152.142.0/24 AS23649 NEWSKIES-AS-AP New Skies Satellites, Hong Kong Teleport 203.152.143.0/24 AS23649 NEWSKIES-AS-AP New Skies Satellites, Hong Kong Teleport 203.160.104.0/22 AS23914 OCI-AS-VN One-Connection Internet Company 203.160.110.0/23 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 204.29.196.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 204.29.197.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 204.48.58.0/24 AS4323 TWTC - Time Warner Telecom, Inc. 204.48.60.0/24 AS4323 TWTC - Time Warner Telecom, Inc. 204.153.68.0/24 AS4017 BELLST - Bell Atlantic Science & Technology 204.153.71.0/24 AS4017 BELLST - Bell Atlantic Science & Technology 204.153.104.0/24 AS10913 INTERNAP-BLK - Internap Network Services 204.154.125.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 205.150.0.0/15 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 206.55.208.0/20 AS22180 CONPOINT - POWER POINT COMPUTER CENTERS, 206.128.104.0/21 AS11709 VIC - VIRTUAL INTERACTIVE CENTER 206.191.192.0/18 AS6287 SPACESTAR - Spacestar Communications 207.7.64.0/19 AS14093 ITRIBE - iTRiBE, Inc. 207.189.62.0/23 AS7132 SBIS-AS - SBC Internet Services 207.231.96.0/19 AS11194 NUNETPA - NuNet Inc 207.246.192.0/20 AS5656 ACCESSUS-DOM - accessU.S./BASENet 209.105.224.0/19 AS20074 KNOWLEDGENET - KNOWLEDGENET 209.159.128.0/19 AS209 ASN-QWEST - Qwest 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 210.5.128.0/20 AS4837 CHINA169-BACKBONE CNCGROUP China169 Backbone 216.21.1.0/24 AS11652 DATATONE - Datatone Communications Inc 216.21.6.0/24 AS11652 DATATONE - Datatone Communications Inc 216.21.7.0/24 AS11652 DATATONE - Datatone Communications Inc 216.21.15.0/24 AS11652 DATATONE - Datatone Communications Inc 216.21.17.0/24 AS11652 DATATONE - Datatone Communications Inc 216.59.0.0/17 AS3356 LEVEL3 Level 3 Communications 216.65.160.0/19 AS7770 TRITON - Triton Technologies, Inc. 216.75.228.0/24 AS32097 WII-KC - WholeSale Internet 216.116.56.0/24 AS9237 HUTCHCA-AS Corporate Access (HK) Ltd. 216.116.59.0/24 AS7132 SBIS-AS - SBC Internet Services 216.211.160.0/21 AS11584 IGEUNET Intergate Europe Inc. 216.224.64.0/19 AS6440 EMF-AS - emf.net 216.230.224.0/20 AS15270 AS-PAETEC-NET - PaeTec.net -a division of PaeTecCommunications, Inc. 216.235.96.0/19 AS13645 BROADBANDONE - BroadbandONE, Inc. 216.235.224.0/20 AS22136 NYCT - New York Connect Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org ausnog(a)ausnog.net

1 0

FCC on wifi at hotel
by Carl Karsten 02 Mar '07

02 Mar '07

me again. So wifi at pycon 07 was 'better than 06' witch I hear was a complete disaster. More on 07's coming soon. Now we are talking about wifi at pycon 08, which will be at a different hotel (Crown Plaza in Rosemont, IL) and the question came up: Can the hotel actively prevent us from using our own wifi? _maney: although - wasn't the hotel stuck on "our wifi or no wifi" at last report? CarlFK: only the FCC can restrict radio tpollari: it's their network and their power the FCC has no legal right to that. and no, you show me where they do. I'm not wasting my day with that tripe -- the caselaw you're likely thinking of has to do with an airline and an airport and the airline's lounge, in which case they're paying for the power and paying for their bandwidth from a provider that's not the airport. We're not. I know that there are all sorts of factors, and just cuz the FCC says boo isn't the end of the story, but i don't even know what the FCC's position on this is. google gave me many hits, and after looking at 10 or so I decided to look elsewhere. Carl K

11 14

comcast east noc
by Zak Thompson 01 Mar '07

01 Mar '07

Can someone from Comcast or their east noc contact me off list? Cheers, Zak Thompson

1 0

Msn.com
by Eric Ortega 01 Mar '07

01 Mar '07

Can someone from msn.com contact me offlist? Thanks! Eric Ortega Midcontinent Communications Network Engineer 605.357.5720 eric.ortega(a)midco.net

1 0

Re: FCC on wifi at hotel
by Robert Bonomi 28 Feb '07

28 Feb '07

> Date: Wed, 28 Feb 2007 17:38:10 -0500 > From: Jared Mauch <jared(a)puck.nether.net> > Subject: Re: FCC on wifi at hotel > [[.. munch ..]] > http://hraunfoss.fcc.gov/edocs_public/attachmatch/FCC-06-157A1.pdf > > I do suggest reading this. They can not legally bar you from > using the devices. They can charge you outrageous fees to get to/from > the MMR or telco demarc and make it prohibitively expensive. > > It may also be problematic to be held hostage showing up > and them saying that no, you can not install your equipment while you > hire a lawyer to explain to them that you are violating FCC fules > for the "OTARD rules". > > - Jared Note well that the 'OTARD rules' do *NOT* apply to an organization holding a meeting at a hotel, or other meeting/convention facility. I quote: For the OTARD rules to apply, the antenna must be installed "on property within the exclusive use or control of an antenna user where the user has a direct or indirect ownership or leasehold interest in the property" upon which the antenna is located. An orgaization contractig for the short-term use of a meeting facility has _no_ such 'ownership or leashold' interest in the property.

1 0

Is there a Hotmail contact around?
by William Schultz 28 Feb '07

28 Feb '07

Could you please contact me off list? Sorry for the clutter... -Wil

1 0

Cisco Security Advisory: Cisco Catalyst 6000, 6500 and Cisco 7600 Series MPLS Packet Vulnerability
by Cisco Systems Product Security Incident Response Team 28 Feb '07

28 Feb '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco Catalyst 6000, 6500 and Cisco 7600 Series MPLS Packet Vulnerability Advisory ID: cisco-sa-20070228-mpls Revision 1.0 For Public Release 2007 February 28 - --------------------------------------------------------------------- Summary ======= Cisco Catalyst 6500 series systems that are running certain versions of Cisco Internetwork Operating System (IOS) are vulnerable to an attack from a Multi Protocol Label Switching (MPLS) packet. Only the systems that are running in Hybrid Mode (Catalyst OS (CatOS) software on the Supervisor Engine and IOS Software on the Multilayer Switch Feature Card (MSFC)) or running with Cisco IOS Software Modularity are affected. MPLS packets can only be sent from the local network segment. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20070228-mpls.shtml Affected Products ================= Vulnerable Products +------------------ The following products are affected by this vulnerability: * Cisco Catalyst 6500 systems that run 12.2(18)SXF4 with Cisco IOS Software Modularity are affected. Images that support Cisco IOS Software Modularity have a "-vz" suffix in their image name. The following is a conclusive list of all image names that are running with Cisco IOS Software Modularity and are affected by this vulnerability. + s72033-adventerprisek9_wan-vz.122-18.SXF4.bin + s72033-advipservicesk9_wan-vz.122-18.SXF4.bin + s72033-entservicesk9_wan-vz.122-18.SXF4.bin + s72033-ipservices_wan-vz.122-18.SXF4.bin + s72033-ipservicesk9_wan-vz.122-18.SXF4.bin + s72033-ipservicesk9-vz.122-18.SXF4.bin * Cisco Catalyst 6000, 6500 and Cisco 7600 series systems with an MSFC2 or MSFC3 that run in Hybrid Mode are affected. In Hybrid Mode, Catalyst OS (CatOS) software runs on the Supervisor Engine and IOS runs on the MSFC. It is different from the Native Mode in which IOS runs both on the Supervisor Engine and MSFC. This vulnerability affects MSFC2, MSFC2a and MSFC3 that run certain images in Hybrid mode. In Hybrid Mode, IOS images that run on MSFC start with "c6msfc2", "c6msfc2a" or "c6msfc3". Several image names that run on MSFC in hybrid mode are provided below for reference: + c6msfc2a-adventerprisek9_wan-mz.122-18.SXF + c6msfc3-jsv-mz.122-14.SX2 Products Confirmed Not Vulnerable +-------------------------------- * Systems that are running in Native Mode without Cisco IOS Software Modularity are not affected. * Systems without an MSFC2, MSFC2a or MSFC3 are not affected. No other Cisco products are known to be affected by this vulnerability. Details ======= Cisco IOS Software Modularity combines subsystems into individual processes and enhances the Cisco IOS Software memory architecture to provide process-level fault isolation and subsystem "In Service Software Upgrade" (ISSU) capability. These enhancements are delivered in Cisco IOS Software for the Catalyst 6500 Series Supervisor Engine 720 and Supervisor Engine 32. Cisco IOS Software Modularity was first delivered as an option in a Cisco IOS Software Release 12.2(18)SXF4. More information on Modular IOS can be found at the following URL: http://www.cisco.com/en/US/products/hw/switches/ps708/prod_bulletin0900aecd… Not all 12.2(18)SXF4 images support Modular IOS. Only the images with a "-vz" in the image name support Modular IOS and are affected by this vulnerability. A conclusive list of all affected image names that support Cisco IOS Software Modularity is provided in the Affected Products section. In Hybrid Mode, a CatOS image is used as the system software to run the Supervisor Engine on the Catalyst systems. If an MSFC is installed, a separate IOS Software image is used in order to run the MSFC. CatOS provides the Layer 2 (L2) switching functionality. The Cisco IOS on the MSFC provides the Layer 3 (L3) routing functionality. It differs from the Native Mode, in which a single Cisco IOS Software image is used as the system software to run both the Supervisor Engine and MSFC on the Catalyst systems. IOS software that runs on MSFC in Hybrid Mode is also affected by this vulnerability. More information about the differences between Hybrid and Native Modes can be found at the following URL: http://www.cisco.com/en/US/products/hw/switches/ps708/products_white_paper0… MPLS packets received by a Route Processor (MSFC) Layer 3 interface can potentially trigger this vulnerability. The system in question does not need to be configured for MPLS to be vulnerable. MPLS packets can only be sent from the local network segment, limiting the scope of the exploitation. This issue is documented in bug IDs CSCsd37415 ( registered customers only) and CSCef90002 ( registered customers only) . Vulnerability Scoring Details +---------------------------- Cisco is providing scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). Cisco will provide a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco PSIRT will set the bias in all cases to normal. Customers are encouraged to apply the bias parameter when determining the environmental impact of a particular vulnerability. CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided an FAQ to answer additional questions regarding CVSS at http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html. Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at http://intellishield.cisco.com/security/alertmanager/cvss. CSCsd37415 - RP crashed on sending MPLS packet to a interface CVSS Base Score: 3.3 - - Access Vector: Remote - - Access Complexity: Low - - Authentication: Not Required - - Confidentiality Impact: None - - Integrity Impact: None - - Availability Impact: Complete - - Impact Bias: Normal CVSS Temporal Score: 2.7 - - Exploitability: Functional - - Remediation Level: Official Fix - - Report Confidence: Confirmed CSCef90002 - MSFC crashed due to corrupted program counter CVSS Base Score: 3.3 - - Access Vector: Remote - - Access Complexity: Low - - Authentication: Not Required - - Confidentiality Impact: None - - Integrity Impact: None - - Availability Impact: Complete - - Impact Bias: Normal CVSS Temporal Score: 2.7 - - Exploitability: Functional - - Remediation Level: Official Fix - - Report Confidence: Confirmed Impact ====== Successful exploitation of the vulnerability may result in the reload of the system on systems that are running with Cisco IOS Software Modularity and the reload of MSFC on systems that are running in Hybrid Mode. Repeated exploitation may lead to a denial of service condition. Software Version and Fixes ========================== When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain that the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center ("TAC") or your contracted maintenance provider for assistance. Each row of the Cisco IOS software table (below) describes a release train and the platforms or products for which it is intended. If a given release train is vulnerable, then the earliest possible releases that contain the fix (the "First Fixed Release") and the anticipated date of availability for each are listed in the "Rebuild" and "Maintenance" columns. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. The release should be upgraded at least to the indicated release or a later version (greater than or equal to the First Fixed Release label). For more information on the terms "Rebuild" and "Maintenance," consult the following URL: http://www.cisco.com/warp/public/620/1.html. +---------------------------------------+ | | Availability of Fixed | | Trains | Releases | | |-----------------------------| | | Rebuild | Maintenance | |---------+-----------------------------| | 12.1E | Not vulnerable | |---------+-----------------------------| | 12.2SXA | Vulnerable. Migrate to 12.2 | | | (17d)SXB5 or later | |---------+-----------------------------| | 12.2SXB | 12.2(17d)SXB5 | | |---------+---------------+-------------| | 12.2SXD | 12.2(18)SXD3 | | |---------+-----------------------------| | 12.2SXE | Not vulnerable | |---------+-----------------------------| | 12.2SXF | 12.2(18)SXF5 | | | (*) | | | +---------------------------------------+ * Only 12.2(18)SXF4 with IOS Software Modularity is affected. 12.2SXF releases that run in Hybrid Mode are not affected. Please see the Affected Products section for more information. A special patch for 12.2(18)SXF4 with Cisco IOS Software Modularity is also available. Patch Name: MA0045 Image Name: s72033-AMA0045-patch.122-18.SXF4 The above patch can be downloaded from the Cisco IOS Software Modularity Patch Navigator at http://tools.cisco.com/swdf/ionpn/jsp/main.jsp Workarounds =========== There are no workarounds for this vulnerability. Additional mitigations that can be deployed on Cisco devices within the network are available in the Cisco Applied Intelligence companion document for this advisory: http://www.cisco.com/warp/public/707/cisco-air-20070228-mpls.shtml Obtaining Fixed Software ======================== Cisco will make free software available to address this vulnerability for affected customers. This advisory will be updated as fixed software becomes available. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/public/sw-license-agreement.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml. Do not contact either "psirt(a)cisco.com" or "security-alert(a)cisco.com" for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third Party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com Have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including special localized telephone numbers and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. This vulnerability was reported by a customer. Status of this Notice:FINAL =========================== THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at: http://www.cisco.com/warp/public/707/cisco-sa-20070228-mpls.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce(a)cisco.com * first-teams(a)first.org * bugtraq(a)securityfocus.com * vulnwatch(a)vulnwatch.org * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * full-disclosure(a)lists.grok.org.uk * comp.dcom.sys.cisco(a)newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +----------------------------------------+ | Revision | | Initial | | 1.0 | 2007-February-28 | public | | | | release. | +----------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.…. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD4DBQFF5ao38NUAbBmDaxQRAteJAJ0V2Z5JKXq0q9cWFe+FQmt95sRURwCXQJJX 0qRnFtLmdKZUWuSa+b6kYQ== =nIdj -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Cisco Catalyst 6000, 6500 Series and Cisco 7600 Series NAM (Network Analysis Module) Vulnerability
by Cisco Systems Product Security Incident Response Team 28 Feb '07

28 Feb '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco Catalyst 6000, 6500 Series and Cisco 7600 Series NAM (Network Analysis Module) Vulnerability Advisory ID: cisco-sa-20070228-nam Revision 1.0 For Public Release 2007 February 28 - --------------------------------------------------------------------- Summary ======= Cisco Catalyst 6000, 6500 series and Cisco 7600 series that have a Network Analysis Module installed are vulnerable to an attack, which could allow an attacker to gain complete control of the system. Only Cisco Catalyst systems that have a NAM on them are affected. This vulnerability affects systems that run Internetwork Operating System (IOS) or Catalyst Operating System (CatOS). Cisco has made free software available to address this vulnerability for affected customers. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20070228-nam.shtml Affected Products ================= Vulnerable Products +------------------ Catalyst 6000, 6500 series and Cisco 7600 series that have a NAM installed in them are affected. A system that has a NAM can be identified by the show module command. A NAM will be seen as WS-SVC-NAM-1, WS-SVC-NAM-2 or WS-X6380-NAM in this output. This vulnerability affects systems that run IOS or CatOS. A sample output for a system that has a NAM-2 on it is provided below: Cat6k#show module Mod Ports Card Type Model Serial No. - --- ----- -------------------------------------- ------------------ ----------- 1 2 Catalyst 6000 supervisor 2 (Active) WS-X6K-SUP2-2GE SAL06417E23 3 48 48 port 10/100 mb RJ-45 ethernet WS-X6248-RJ-45 SAD050108R4 5 8 8 port 1000mb ethernet WS-X6408-GBIC SAD041300CL 6 8 Network Analysis Module WS-SVC-NAM-2 SAD093002AM Products Confirmed Not Vulnerable +-------------------------------- * Catalyst 6000, 6500 and Cisco 7600 series that do not have a NAM are not affected. * Network Analysis Modules for Cisco Branch Routers (NM-NAM) are not affected. No other Cisco products are known to be affected by this vulnerability. Details ======= NAMs are deployed in Catalyst 6000, 6500 series and Cisco 7600 series to monitor and analyze network traffic by using Remote Monitoring (RMON), RMON2, and other MIBs. More information about NAMs can be found at the following URL: http://www.cisco.com/en/US/products/hw/switches/ps708/products_module_confi… NAMs communicate with the Catalyst system by using the Simple Network Management Protocol (SNMP). By spoofing the SNMP communication between the Catalyst system and the NAM an attacker may obtain complete control of the Catalyst system. Devices running both Cisco IOS and Cisco CatOS are affected by this vulnerability. This vulnerability is introduced in CatOS at 7.6(15) and 8.5(1). Older CatOS images are not vulnerable. This issue is documented in bug IDs CSCsd75273 ( registered customers only) , CSCse52951 ( registered customers only) for IOS and CSCse39848 ( registered customers only) for CatOS. Vulnerability Scoring Details +---------------------------- Cisco is providing scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). Cisco will provide a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco PSIRT will set the bias in all cases to normal. Customers are encouraged to apply the bias parameter when determining the environmental impact of a particular vulnerability. CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided an FAQ to answer additional questions regarding CVSS at http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html. Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at http://intellishield.cisco.com/security/alertmanager/cvss CSCsd75273 - Cat6k NAM vulnerability CVSS Base Score: 10 - - Access Vector: Remote - - Access Complexity: Low - - Authentication: Not Required - - Confidentiality Impact: Complete - - Integrity Impact: Complete - - Availability Impact: Complete - - Impact Bias: Normal CVSS Temporal Score: 8.3 - - Exploitability: Functional - - Remediation Level: Official Fix - - Report Confidence: Confirmed CSCse52951 - Catk NAM vulnerability, additional protection CVSS Base Score: 10 - - Access Vector: Remote - - Access Complexity: Low - - Authentication: Not Required - - Confidentiality Impact: Complete - - Integrity Impact: Complete - - Availability Impact: Complete - - Impact Bias: Normal CVSS Temporal Score: 8.3 - - Exploitability: Functional - - Remediation Level: Official Fix - - Report Confidence: Confirmed CSCse39848 - Cat6k NAM vulnerability in CatOS CVSS Base Score: 10 - - Access Vector: Remote - - Access Complexity: Low - - Authentication: Not Required - - Confidentiality Impact: Complete - - Integrity Impact: Complete - - Availability Impact: Complete - - Impact Bias: Normal CVSS Temporal Score: 8.3 - - Exploitability: Functional - - Remediation Level: Official Fix - - Report Confidence: Confirmed Impact ====== By successfully exploiting this vulnerability, an attacker may gain complete control of the device. Software Version and Fixes ========================== When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center ("TAC") or your contracted maintenance provider for assistance. Each row of the Cisco IOS software table (below) describes a release train and the platforms or products for which it is intended. If a given release train is vulnerable, then the earliest possible releases that contain the fix (the "First Fixed Release") and the anticipated date of availability for each are listed in the "Rebuild" and "Maintenance" columns. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. The release should be upgraded at least to the indicated release or a later version (greater than or equal to the First Fixed Release label). For more information on the terms "Rebuild" and "Maintenance," consult the following URL: http://www.cisco.com/warp/public/620/1.html. +-----------------------------------------------------------------------------+ | Major Release | Availability of Repaired Releases | |------------------------------+----------------------------------------------| | Affected 12.1-Based Release | Rebuild | Maintenance | |------------------------------+---------------------+------------------------| | | 12.1(26)E8 | | |12.1E |---------------------+------------------------| | | 12.1(27b)E1 | | |------------------------------+---------------------+------------------------| | 12.1EX | 12.1(12c)EX | 12.1(13)EX | |------------------------------+---------------------+------------------------| | Affected 12.2-Based Release | Rebuild | Maintenance | |------------------------------+----------------------------------------------| | 12.2EU | Vulnerable; migrate to 12.2(25)EWA7 or later | |------------------------------+----------------------------------------------| | 12.2EW | Vulnerable; migrate to 12.2(25)EWA7 or later | |------------------------------+----------------------------------------------| | 12.2EWA | | 12.2(25)EWA7 | |------------------------------+----------------------------------------------| | 12.2IXA | Vulnerable; migrate to 12.2(18)IXB2 or later | |------------------------------+----------------------------------------------| | 12.2IXB | 12.2(18)IXB2 | | |------------------------------+---------------------+------------------------| | | 12.2(14)S3 | | |12.2S |---------------------+------------------------| | | 12.2(18)S5 | 12.2(20)S | |------------------------------+---------------------+------------------------| | 12.2SG | 12.2(25)SG1 | | |------------------------------+---------------------+------------------------| | 12.2SGA | 12.2(31)SGA1 | | |------------------------------+---------------------+------------------------| | 12.2SRA | 12.2(33)SRA2 | | |------------------------------+----------------------------------------------| | 12.2SX | Vulnerable; migrate to 12.2(18)SXD7a or | | | later | |------------------------------+----------------------------------------------| | 12.2SXA | Vulnerable; migrate to 12.2(18)SXD7a or | | | later | |------------------------------+----------------------------------------------| | 12.2SXB | Vulnerable; migrate to 12.2(18)SXD7a or | | | later | |------------------------------+----------------------------------------------| | 12.2SXD | 12.2(18)SXD7a | | |------------------------------+---------------------+------------------------| | 12.2SXE | 12.2(18)SXE6a | | |------------------------------+---------------------+------------------------| | 12.2SXF | 12.2(18)SXF5 | | |------------------------------+----------------------------------------------| | 12.2SY | Vulnerable; migrate to 12.2(18)SXD7a or | | | later | |------------------------------+----------------------------------------------| | 12.2ZA | Vulnerable; migrate to 12.2(18)SXD7a or | | | later | |------------------------------+----------------------------------------------| | 12.2ZU | 12.2(18)ZU1 | | +-----------------------------------------------------------------------------+ +---------------------------------------+ | | Availability of Fixed | | CatOS | Releases | | Release |-------------------------| | | Interim | Maintenance | |-------------+-------------------------| | 5.x | Not vulnerable | |-------------+-------------------------| | 6.x | Not vulnerable | |-------------+-------------------------| | 7.6(1) | | | through 7.6 | Not vulnerable | | (14) | | |-------------+-------------------------| | 7.6(15) | | 7.6(20) | | through |7.6(19.2)| Available | | 7.6(19) | | 2007-Mar-09 | |-------------+---------+---------------| | 8.5(1) | | | | through | 8.5(5.3)| 8.5(6) | | 8.5(5) | | | |-------------+-------------------------| | 8.6(x) | Not vulnerable | +---------------------------------------+ Workarounds =========== No workarounds exist for this vulnerability. This vulnerability requires an attacker to spoof SNMP packets from the IP address of the NAM. Filtering SNMP traffic to an affected device can be used as a mitigation. Filtering SNMP traffic needs to be done on systems that are deployed in front of an affected device, since it is ineffective to filter against such spoofed packets on the device itself. Anti-spoofing measures and infrastructure access-lists can also be deployed at your network edge as a potential mitigation technique. Refer to http://www.cisco.com/warp/public/707/iacl.html for examples on how to apply ACLs on Cisco routers for infrastructure protection. Additional mitigations that can be deployed on Cisco devices within the network are available in the Cisco Applied Intelligence companion document for this advisory: http://www.cisco.com/warp/public/707/cisco-air-20070228-nam.shtml Obtaining Fixed Software ======================== Cisco will make free software available to address this vulnerability for affected customers. This advisory will be updated as fixed software becomes available. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/public/sw-license-agreement.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml. Do not contact either "psirt(a)cisco.com" or "security-alert(a)cisco.com" for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third Party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com Have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including special localized telephone numbers and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. This vulnerability was found internally. Status of this Notice:FINAL =========================== THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at: http://www.cisco.com/warp/public/707/cisco-sa-20070228-nam.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce(a)cisco.com * first-teams(a)first.org * bugtraq(a)securityfocus.com * vulnwatch(a)vulnwatch.org * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * full-disclosure(a)lists.grok.org.uk * comp.dcom.sys.cisco(a)newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +----------------------------------------+ | Revision | | Initial | | 1.0 | 2007-February-28 | public | | | | release. | +----------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/ products_security_vulnerability_policy.html. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFF5aqN8NUAbBmDaxQRAvcNAJ9nzpHY+ASnfCKO0lzvHG90fTLSmQCfSfCt 0tlVaNPyb/2PmoCudiRws/E= =Uymr -----END PGP SIGNATURE-----

1 0