- NANOG - lists.nanog.org

Re: Counting tells you if you are making progress
by Sean Donelan 24 Feb '07

24 Feb '07

On Wed, 21 Feb 2007, Todd Vierling wrote: > I'd say it's severely biased in the overestimation direction -- but > that's not to say it isn't a problem, because zombies Suck. People with access to the ppp, dhcp or nat logs for a network can de-dup the counts based on IP addresses to come up with better surveys of infected computers. They can further correlate the reports with contact with the computer owners of how many computers were found with known or unknown malware. But we rarely hear data from them. Although I disagree with some of the survey counts, finding zombies isn't a problem. Figuring out if a computer is actually fixed and stays fixed is still the problem. Sometimes it feels like an episode of "House." Except House wraps up the case in 60 minutes.

2 1

Possible Level3 Fibre Cut
by Rob Baxter 24 Feb '07

24 Feb '07

** Cogent Network Status Report Last Updated Wed Feb 21 16:35:00 2007 ** Cogent Network Status/DNS Server Status Description: We currently have a possible fiber cut between Stamford, CT and New York City, NY. This may cause some latency for some of our customers between Boston and New York. We are working to correct the situation and currently do not have an ETA. Thank you. Rob Baxter

4 5

broadband routers security issues
by Gadi Evron 23 Feb '07

23 Feb '07

Hi guys. A guy named Sid recently wrote on securiteam (where I write as well) on an accidental discovery he made on the security of his home broadband router with its default settings. Apparently, he started by discovering he had port 23 open (which was telnet for the router rather than for him - we have all been there before). He researched it a bit further and came up with a disturbing analysis on how these routers can be easily compromised and a rough number on how many of these exist at his ISP. The subject of broadband routers/modems security has been bothering some of us for a while, as they'd make scary botnets, not to mention in some cases, as had been noted also here before, open recursive name servers. Public discussion of this has been limited up to now, but with the recent releases of exploits for such home routers and several public advisories on the issue, I figure it is time for us to see if we can start working to a change in how we do things in coming years (at least with new devices we give out). Here is his text. You can also find it and the discussion on it at: http://blogs.securiteam.com/index.php/archives/826 Accidental backdoor by ISP February 22nd, 2007 by Sid, Filed under: Privacy, Full Disclosure, Corporate Security I.ve been a happy customer of my ISP BeThere for a few months now. Overall they.re great, they are quick to sort you out with your connection, their emails and other communications are very humerous and actually make good reading (I remember the routers documentation CD has a warning label reading something like .warning: geeky content inside.). When I signed up I managed to get the username root, this pleased me no end and I thought I.d finally found an ISP I want to stay with forever. Finding the hole Recently though a friend of mine was extremely bored and decided to nmap my IP address. He found, and told me, that I seemed to be listening on port 23, telnet. I was extremely puzzled by this, I haven.t port forwarded port 23, I would never use a telnet daemon for anything. It occured to me that it must be the router itself running the daemon. I telnetted to 192.168.1.254 and lo and behold it asked me to log in. I log in with default credentials (yes, I had never gotten around to changing those), which are Administrator:null I get welcomed by some neat looking ASCII art and command line access to my router. I didn.t even know my router had telnet access but I quickly log out and set a password via the web interface. Now I should be secure. Wondering if others could telnet to my router from a remote location I ssh to a remote machine I have access to then telnet back to my router from there and try logging in. I.m reassuringly told that this account can not log in through the WAN interface (so thankfully I can only log in from within my LAN). I log back in to the telnet daemon from my LAN to see what.s there, I find this: {Administrator}[user]=>list User Flags Role .- .. .- Administrator U Administrator tech R TechnicalSupport BeTech TechnicalSupport bebox root Keep in mind that according to the web interface only the Administrator account even exists. What the hell are all these other accounts? Thinking back to the error I got when trying to log in from a remote location I wonder if any of these accounts are capable of logging in from remote locations. I try logging in as BeTech from the remote connection (guessing it to have a blank password), it gives me an incorrect password error. How can I find the password to these 3 anomalous accounts? Time to look through the configuration. Like most routers it.s possible to back up the settings file, in the case of this router you ftp to the router, browse to /dl/ and download user.ini. This file has all the settings in it. I copy that file to my home directory and search for the word BeTech of it. Here.s the output: [ mlpuser.ini ] add name=Administrator password=_CYP_removed role=Administrator hash2=removed defuser=enabled add name=tech password=_CYP_bde1d7887b5852ff5c3c853c0ffbc413 role=TechnicalSupport hash2=bb80a4cf4f721b0fe42f24581479bebe defremadmin=enabled add name=BeTech password=_CYP_d8b5399c8b961eca15a56b659c2ee622 role=TechnicalSupport hash2=cd4f202f8e92f7c11f40bc86fe66443a add name=bebox password=_CYP_0fbd2e7e6dc947c44def9053fb79e8c8 role=root hash2=90960596e9eec3d017b31f6efb8892ea A short time later I had the password of the BeTech account to be RemAcc (for some reason I didn.t bother looking at the other accounts). I don.t know what the hash2 value stands for, wasn.t interested. I try logging in with BeTech:RemAcc from my remote connection and lo and behold it works. I figuratively crap myself. First things first; I look for ways to change this. Sure I could change the password but there.s got to be a way to stop the telnet daemon from listening on the WAN. Sure enough, I find the line ifadd name=TELNET group=wan I simply remove the line. Slightly below I see ifadd name=FTP group=wan I remove that too. I upload the user.ini file replacing the existing one and reboot the router. I.m safe. Exploiting others Time to see if I can log in to others. routers using this. I run nmap -p T:23 87.194.204.0/24. This gives me a list of people who are probably running the same router. I FTP to those IPs and grab /dl/user.ini. Most of these people have changed their Administrator password, but my money says none of them knew about the other accounts. Now I have full access to FTP in to their routers even if they have changed their passwords, I have full read and write access to things from DNS details to DMZ settings, from Wifi passwords to VPN keys. I can then upload the new file back to their router, log into it.s telnet daemon and load the new settings file. >From the account name I.m going to guess that it was made as a technical support account by my ISP so if I call them up saying I have connectivity problems and all the normal stuff is ruled out they can connect straight to my router themselves and peek around. In a way it makes sense for them not to use SSH as that of course requries more stuff, and it may just be that stuff which is broken. There are better ways to do this though, one would be to have an ID printed on the router which I would give to their tech support which they use to calculate the BeTech account.s password. Alternatively let us easily turn off this setting and if we need tech support and we can.t enable it we.d just hit the reset to factory settings button. Pretty much all the customers of my ISP are now vulnerable to this. The only ones who aren.t are people who.ve fixed this, people who have port forwarded port 23 and 21 (as port forwarded ports take priority over daemons) and of course people who don.t use the router the ISP supplies. Kuza55 of sla.ckers.org scanned a much larger number of users; nmap -oG bewhole.txt -vv -sS -p23 -P0 87.194.0.0/16 He got 14716 potentially vulnerable routers but he couldn.t reliably check which were actually vulnerable and so dropped his research. Feel free to try to finish what he started. Securing yourself Incase you are running the router BeThere supplied, here.s how to fix it. FTP to 192.168.1.254/dl/ and download user.ini. That is the default IP, I assume you know how to find the IP if that.s not what it is. If user.ini isn.t there, telnet to the router (same IP). Type: config save It.ll ask for the username, type user.ini and hit return FTP to the router as I said earlier and grab the file. Back up your user.ini file just incase, then open it. Find the heading [ servmgr.ini ] which is around line 771 (though it won.t be exactly there for you). Scroll down another few lines and you.ll find four lines: ifadd name=FTP group=lan ifadd name=FTP group=wan ifadd name=TELNET group=lan ifadd name=TELNET group=wan Remove the two ending in wan. Connect again with your FTP client and upload this new user.ini file replacing the old one. Either reboot your router through it.s web interface or log back into the telnet daemon and type: config load The telnet connection will die, that.s fine, in 30 seconds or so you.ll be online again with a safe router. Check with nmap-online that you.re still not listening on FTP or Telnet.

3 2

Weekly Routing Table Report
by Routing Analysis Role Account 23 Feb '07

23 Feb '07

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.apnic.net. If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 24 Feb, 2007 Analysis Summary ---------------- BGP routing table entries examined: 213209 Prefixes after maximum aggregation: 114369 Deaggregation factor: 1.86 Unique aggregates announced to Internet: 103733 Total ASes present in the Internet Routing Table: 24455 Origin-only ASes present in the Internet Routing Table: 21287 Origin ASes announcing only one prefix: 10288 Transit ASes present in the Internet Routing Table: 3168 Transit-only ASes present in the Internet Routing Table: 79 Average AS path length visible in the Internet Routing Table: 3.6 Max AS path length visible: 32 Max AS path prepend of ASN (20858) 18 Prefixes from unregistered ASNs in the Routing Table: 4 Unregistered ASNs in the Routing Table: 6 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 12 Number of addresses announced to Internet: 1686392460 Equivalent to 100 /8s, 132 /16s and 78 /24s Percentage of available address space announced: 45.5 Percentage of allocated address space announced: 62.5 Percentage of available address space allocated: 72.8 Total number of prefixes smaller than registry allocations: 110162 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 48367 Total APNIC prefixes after maximum aggregation: 19418 APNIC Deaggregation factor: 2.49 Prefixes being announced from the APNIC address blocks: 45460 Unique aggregates announced from the APNIC address blocks: 20397 APNIC Region origin ASes present in the Internet Routing Table: 2879 APNIC Region origin ASes announcing only one prefix: 786 APNIC Region transit ASes present in the Internet Routing Table: 426 Average APNIC Region AS path length visible: 3.6 Max APNIC Region AS path length visible: 16 Number of APNIC addresses announced to Internet: 290428416 Equivalent to 17 /8s, 79 /16s and 150 /24s Percentage of available APNIC address space announced: 71.9 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911 APNIC Address Blocks 58/7, 60/7, 116/6, 120/6, 124/7, 126/8, 202/7 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 104152 Total ARIN prefixes after maximum aggregation: 61221 ARIN Deaggregation factor: 1.70 Prefixes being announced from the ARIN address blocks: 76195 Unique aggregates announced from the ARIN address blocks: 29518 ARIN Region origin ASes present in the Internet Routing Table: 11365 ARIN Region origin ASes announcing only one prefix: 4368 ARIN Region transit ASes present in the Internet Routing Table: 1052 Average ARIN Region AS path length visible: 3.4 Max ARIN Region AS path length visible: 21 Number of ARIN addresses announced to Internet: 318945408 Equivalent to 19 /8s, 2 /16s and 184 /24s Percentage of available ARIN address space announced: 70.4 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959 ARIN Address Blocks 24/8, 63/8, 64/5, 72/6, 76/8, 96/6, 199/8, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 44023 Total RIPE prefixes after maximum aggregation: 28723 RIPE Deaggregation factor: 1.53 Prefixes being announced from the RIPE address blocks: 40698 Unique aggregates announced from the RIPE address blocks: 27121 RIPE Region origin ASes present in the Internet Routing Table: 9190 RIPE Region origin ASes announcing only one prefix: 4827 RIPE Region transit ASes present in the Internet Routing Table: 1492 Average RIPE Region AS path length visible: 4.0 Max RIPE Region AS path length visible: 32 Number of RIPE addresses announced to Internet: 291725572 Equivalent to 17 /8s, 99 /16s and 97 /24s Percentage of available RIPE address space announced: 79.0 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-43007 RIPE Address Blocks 62/8, 77/8, 78/7, 80/5, 88/6, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 14093 Total LACNIC prefixes after maximum aggregation: 4042 LACNIC Deaggregation factor: 3.49 Prefixes being announced from the LACNIC address blocks: 12154 Unique aggregates announced from the LACNIC address blocks: 7009 LACNIC Region origin ASes present in the Internet Routing Table: 761 LACNIC Region origin ASes announcing only one prefix: 247 LACNIC Region transit ASes present in the Internet Routing Table: 133 Average LACNIC Region AS path length visible: 4.2 Max LACNIC Region AS path length visible: 20 Number of LACNIC addresses announced to Internet: 37685504 Equivalent to 2 /8s, 63 /16s and 9 /24s Percentage of available LACNIC address space announced: 56.2 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 189/8, 190/8, 200/7 AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 2571 Total AfriNIC prefixes after maximum aggregation: 963 AfriNIC Deaggregation factor: 2.67 Prefixes being announced from the AfriNIC address blocks: 1891 Unique aggregates announced from the AfriNIC address blocks: 1182 AfriNIC Region origin ASes present in the Internet Routing Table: 180 AfriNIC Region origin ASes announcing only one prefix: 59 AfriNIC Region transit ASes present in the Internet Routing Table: 37 Average AfriNIC Region AS path length visible: 3.6 Max AfriNIC Region AS path length visible: 15 Number of AfriNIC addresses announced to Internet: 5415424 Equivalent to 0 /8s, 82 /16s and 162 /24s Percentage of available AfriNIC address space announced: 16.1 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 1275 8720 276 CHINANET-BACKBONE 4755 1123 383 77 Videsh Sanchar Nigam Ltd. Aut 9583 1077 77 369 Sify Limited 9498 964 468 66 BHARTI BT INTERNET LTD. 23577 777 35 705 Korea Telecom (ATM-MPLS) 4766 768 4942 309 Korea Telecom (KIX) 17488 598 39 24 Hathway IP Over Cable Interne 7545 586 142 76 TPG Internet Pty Ltd 1221 580 1686 442 Telstra Pty Ltd 18101 522 103 23 Reliance Infocom Ltd Internet 17676 503 10935 65 Softbank BB Corp. 4812 498 763 72 China Telecom (Shanghai) 4668 461 68 10 LG-EDS Systems Inc. 9443 444 111 75 Primus Telecommunications 7474 381 216 259 SingTel Optus Pty Ltd 17849 370 35 94 Telecommunications Technology 4802 360 86 149 Wantree Development 17974 358 129 14 PT TELEKOMUNIKASI INDONESIA 17557 353 34 169 Pakistan Telecom 2907 336 1749 309 SINET Japan ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1498 6125 985 AT&T WorldNet Services 4323 1331 1005 351 Time Warner Telecom 6478 1125 443 193 AT&T Worldnet Services 2386 1113 570 738 AT&T Data Communications Serv 6197 1024 667 499 BellSouth Network Solutions, 18566 992 288 9 Covad Communications 11492 978 101 15 Cable One 174 944 6792 868 Cogent Communications 701 941 6695 748 UUNET Technologies, Inc. 1239 814 2713 572 Sprint 20115 801 706 421 Charter Communications 7011 798 229 476 Citizens Utilities 19262 757 2591 178 Verizon Global Networks 22773 732 1872 41 Cox Communications, Inc. 209 712 3743 569 Qwest 721 633 21787 274 DLA Systems Automation Center 852 595 1088 381 Telus Advanced Communications 5668 571 160 16 CenturyTel Internet Holdings, 19916 568 49 54 OLM LLC 855 566 250 70 Canadian Research Network RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 541 1895 419 UUNET - Commercial IP service 24863 328 45 22 LINKdotNET AS number 3301 311 1199 290 TeliaNet Sweden 3320 298 4993 249 Deutsche Telekom AG 8220 271 469 262 COLT Telecommunications 6746 270 95 248 Dynamic Network Technologies, 680 257 2044 251 DFN-IP service G-WiN 8708 242 284 228 Romania Data Systems S.A. 3215 239 2224 92 France Telecom Transpac 1257 223 1116 172 SWIPnet Swedish IP Network 5416 219 14 15 BATELCO-BH 3269 213 2423 71 TELECOM ITALIA 3246 207 354 196 Song Networks 30890 206 17 96 SC Kappa Invexim SRL 8551 204 196 28 Bezeq International 3352 201 1783 33 Ibernet, Internet Access Netw 20858 197 34 3 EgyNet 3300 182 171 89 AUCS Communications Services 12479 177 578 6 Uni2 Autonomous System 786 173 1779 173 The JANET IP Service LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 1043 2038 211 UniNet S.A. de C.V. 11830 482 299 19 Instituto Costarricense de El 11172 348 109 85 Servicios Alestra S.A de C.V 16814 329 20 8 NSS, S.A. 22047 307 206 11 VTR PUNTO NET S.A. 6471 253 74 30 ENTEL CHILE S.A. 7303 251 142 30 Telecom Argentina Stet-France 14117 239 16 13 Telefonica del Sur S.A. 11556 237 128 4 Cable-Wireless Panama 6147 229 182 20 Telefonica Del Peru 6503 200 172 83 AVANTEL, S.A. 10481 181 72 8 Prima S.A. 20299 175 25 26 NEWCOM AMERICAS 21826 153 27 57 INTERCABLE 23216 153 19 42 RAMtelecom Telecomunicaciones 7910 152 11 32 ANDINET ON LINE 19429 146 91 37 E.T.B. 18822 145 9 10 TELEFONICA MANQUEHUE 19169 143 9 25 Telconet 14522 140 22 9 SatNet S.A. AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 290 868 232 The Internet Solution 8452 244 60 6 TEDATA 15475 155 84 4 Nile Online 6713 144 135 11 Itissalat Al-MAGHRIB 2018 138 309 113 Tertiary Education Network 5536 123 8 15 Internet Egypt Network 2905 121 178 94 The Internetworking Company o 33783 111 6 5 EEPAD TISP TELECOM & INTERNET 24835 86 48 6 RAYA Telecom - Egypt 2561 64 6 2 Egyptian Universities Network 15706 55 12 4 Sudatel Internet Exchange Aut 23889 50 16 13 MAURITIUS TELECOM 5713 44 294 34 Telkom SA Ltd 33774 42 12 22 AS Number for Telecom Algeria 16637 33 21 25 Johnnic e-Ventures 33766 33 2 1 Nyala Communications Pty Ltd 8524 30 2 6 AUCEGYPT Autonomous System 12455 27 6 3 Jambonet Autonomous system 21280 27 4 4 Swift Global Kenya Ltd.Is an 33776 27 2 5 Starcomms Nigeria Limited Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 4755 1123 1046 Videsh Sanchar Nigam Ltd. Aut 4134 1275 999 CHINANET-BACKBONE 18566 992 983 Covad Communications 4323 1331 980 Time Warner Telecom 11492 978 963 Cable One 6478 1125 932 AT&T Worldnet Services 9498 964 898 BHARTI BT INTERNET LTD. 8151 1043 832 UniNet S.A. de C.V. 9583 1077 708 Sify Limited 22773 732 691 Cox Communications, Inc. 19262 757 579 Verizon Global Networks 17488 598 574 Hathway IP Over Cable Interne 5668 571 555 CenturyTel Internet Holdings, 6197 1024 525 BellSouth Network Solutions, 19916 568 514 OLM LLC 7545 586 510 TPG Internet Pty Ltd 18101 522 499 Reliance Infocom Ltd Internet 855 566 496 Canadian Research Network 15270 507 473 PaeTec.net -a division of Pae 11830 482 463 Instituto Costarricense de El List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 65332 PRIVATE 63.166.106.192/27 1803 SPRINT 24410 UNALLOCATED 203.119.28.0/24 4134 CHINANET-BACKBONE 24409 UNALLOCATED 203.119.29.0/24 9808 Guangdong Mobile Com 22895 UNALLOCATED 216.174.38.0/24 19094 Adelphia Business So Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 7.1.1.0/24 1239 Sprint 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 172.33.1.0/24 7018 AT&T WorldNet Services 180.190.0.0/16 24003 JUBILANT ORGANOSYS LTD., INDI 192.0.10.0/24 9498 BHARTI BT INTERNET LTD. 192.44.0.0/24 5501 Fraunhofer Gesellschaft 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.153.136.0/21 721 DLA Systems Automation Center 192.172.0.0/19 721 DLA Systems Automation Center Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:20 /9:9 /10:12 /11:33 /12:117 /13:226 /14:426 /15:822 /16:9253 /17:3748 /18:6173 /19:13193 /20:14894 /21:13424 /22:17227 /23:18503 /24:113186 /25:718 /26:537 /27:438 /28:68 /29:42 /30:104 /31:0 /32:36 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 6478 1077 1125 AT&T Worldnet Services 18566 974 992 Covad Communications 11492 964 978 Cable One 9583 913 1077 Sify Limited 2386 837 1113 AT&T Data Communications Serv 7018 810 1498 AT&T WorldNet Services 6197 795 1024 BellSouth Network Solutions, 23577 763 777 Korea Telecom (ATM-MPLS) 7011 697 798 Citizens Utilities 9498 617 964 BHARTI BT INTERNET LTD. 4766 577 768 Korea Telecom (KIX) 19916 563 568 OLM LLC 4755 529 1123 Videsh Sanchar Nigam Ltd. Aut 4323 527 1331 Time Warner Telecom 15270 475 507 PaeTec.net -a division of Pae 855 465 566 Canadian Research Network 18101 453 522 Reliance Infocom Ltd Internet 4668 452 461 LG-EDS Systems Inc. 5668 441 571 CenturyTel Internet Holdings, 17488 420 598 Hathway IP Over Cable Interne Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:9 7:1 8:62 9:1 12:1797 13:1 15:16 16:3 17:3 18:5 20:36 24:901 25:1 32:53 38:282 40:57 41:92 44:2 47:7 52:4 55:1 56:3 57:25 58:306 59:391 60:211 61:943 62:1028 63:1920 64:3153 65:2320 66:3149 67:733 68:652 69:1729 70:455 71:98 72:1222 73:1 74:174 75:80 76:5 77:35 80:828 81:782 82:656 83:363 84:509 85:731 86:442 87:492 88:247 89:804 90:3 91:175 97:1 116:1 117:1 118:1 119:1 120:1 121:141 122:301 123:49 124:596 125:843 128:313 129:218 130:131 131:347 132:49 133:9 134:188 135:38 136:181 137:92 138:195 139:52 140:502 141:142 142:371 143:210 144:269 145:43 146:314 147:147 148:376 149:187 150:114 151:116 152:94 153:118 154:5 155:246 156:151 157:176 158:168 159:151 160:99 161:88 162:231 163:163 164:446 165:383 166:245 167:281 168:512 169:119 170:380 171:15 172:1 189:197 190:425 192:5747 193:3729 194:2992 195:2198 196:958 198:3740 199:3284 200:4608 201:985 202:7196 203:7370 204:3971 205:2057 206:2412 207:2848 208:2483 209:3591 210:2384 211:928 212:1296 213:1422 214:407 215:39 216:4033 217:1166 218:349 219:271 220:851 221:374 222:264 End of report Report Website: http://thyme.apnic.net

1 0

BGP Update Report
by cidr-report＠potaroo.net 23 Feb '07

23 Feb '07

BGP Update Report Interval: 09-Feb-07 -to- 22-Feb-07 (14 days) Observation Point: BGP Peering with AS4637 TOP 20 Unstable Origin AS Rank ASN Upds % Upds/Pfx AS-Name 1 - AS4134 15109 1.2% 27.3 -- CHINANET-BACKBONE No.31,Jin-rong Street 2 - AS9583 14028 1.1% 14.5 -- SIFY-AS-IN Sify Limited 3 - AS9394 13035 1.1% 4.6 -- CRNET CHINA RAILWAY Internet(CRNET) 4 - AS702 11929 1.0% 16.7 -- AS702 MCI EMEA - Commercial IP service provider in Europe 5 - AS24731 10268 0.8% 446.4 -- ASN-NESMA National Engineering Services and Marketing Company Ltd. (NESMA) 6 - AS20426 9956 0.8% 2489.0 -- PWC-AS - PriceWaterhouseCoopers, LLP 7 - AS17974 8969 0.7% 25.8 -- TELKOMNET-AS2-AP PT TELEKOMUNIKASI INDONESIA 8 - AS15611 8426 0.7% 94.7 -- Iranian Research Organisation 9 - AS4249 8354 0.7% 62.3 -- LILLY-AS - Eli Lilly and Company 10 - AS4775 7998 0.7% 35.1 -- GLOBE-TELECOM-AS Telecom Carrier / ISP Plus + 11 - AS12654 7746 0.6% 188.9 -- RIPE-NCC-RIS-AS RIPE NCC RIS project 12 - AS4621 7567 0.6% 53.7 -- UNSPECIFIED UNINET-TH 13 - AS306 7354 0.6% 40.4 -- DNIC - DoD Network Information Center 14 - AS18809 6969 0.6% 101.0 -- Cable Onda 15 - AS4795 6921 0.6% 30.6 -- INDOSAT2-ID INDOSATM2 ASN 16 - AS8151 6831 0.6% 6.6 -- Uninet S.A. de C.V. 17 - AS33783 6063 0.5% 53.2 -- EEPAD 18 - AS5486 5872 0.5% 4.1 -- SMILE-ASN Euronet Digital Communications, (1992) LTD, Israel 19 - AS9051 5428 0.5% 36.9 -- IDM Autonomous System 20 - AS9737 5281 0.4% 44.4 -- TOTNET-TH-AS-AP Telephone Organization of Thailand TOP 20 Unstable Origin AS (Updates per announced prefix) Rank ASN Upds % Upds/Pfx AS-Name 1 - AS31594 4490 0.4% 4490.0 -- FORTESS-AS Fortess LLC Network 2 - AS20426 9956 0.8% 2489.0 -- PWC-AS - PriceWaterhouseCoopers, LLP 3 - AS25774 1961 0.2% 1961.0 -- CHAPMORTCORP - CHAPEL MORTGAGE 4 - AS9502 2690 0.2% 1345.0 -- OOCL-HKG-AP Hong Kong Headquarters 5 - AS4587 3779 0.3% 1259.7 -- ONEWORLD2 - One World Internetworking, Inc 6 - AS34378 914 0.1% 914.0 -- RUG-AS Razguliay-UKRROS Group 7 - AS3944 890 0.1% 890.0 -- PARTAN-LAB - Partan & Partan 8 - AS31307 830 0.1% 830.0 -- YKYATIRIM YAPI KREDI YATIRIM 9 - AS19580 805 0.1% 805.0 -- ZONETEL - ZONE TELECOM, INC. 10 - AS14548 742 0.1% 742.0 -- LISTEN-SF-1 - Listen.com 11 - AS12408 678 0.1% 678.0 -- BIKENT-AS Bikent Ltd. Autonomous system 12 - AS30707 2024 0.2% 674.7 -- SICOR-US-CA-IRVINE - SICOR Pharmaceuticals, Inc. 13 - AS3043 3132 0.3% 626.4 -- AMPHIB-AS - Amphibian Media Corporation 14 - AS7345 2461 0.2% 615.2 -- LUCENTTECH - Lucent Technologies Inc. 15 - AS28650 608 0.1% 608.0 -- Dilmar Antonio Simonetti 16 - AS21391 1519 0.1% 506.3 -- TDA-AS 17 - AS15774 503 0.0% 503.0 -- MEDIANAT LLC "MEDIANAT", ISP primarily for educational institution 18 - AS29098 498 0.0% 498.0 -- IPSO-AS S.C. IPSO S.A. 19 - AS33188 976 0.1% 488.0 -- SCS-NETWORK-1 - Sono Corporate Suites 20 - AS4963 1373 0.1% 457.7 -- TEXOMA - Internet Texoma TOP 20 Unstable Prefixes Rank Prefix Upds % Origin AS -- AS Name 1 - 155.201.48.0/21 9951 0.7% AS20426 -- PWC-AS - PriceWaterhouseCoopers, LLP 2 - 194.242.124.0/22 4490 0.3% AS31594 -- FORTESS-AS Fortess LLC Network 3 - 203.177.144.0/23 3973 0.3% AS4775 -- GLOBE-TELECOM-AS Telecom Carrier / ISP Plus + 4 - 89.4.131.0/24 3341 0.2% AS24731 -- ASN-NESMA National Engineering Services and Marketing Company Ltd. (NESMA) 5 - 89.4.128.0/24 3335 0.2% AS24731 -- ASN-NESMA National Engineering Services and Marketing Company Ltd. (NESMA) 6 - 89.4.129.0/24 3309 0.2% AS24731 -- ASN-NESMA National Engineering Services and Marketing Company Ltd. (NESMA) 7 - 209.140.24.0/24 3096 0.2% AS3043 -- AMPHIB-AS - Amphibian Media Corporation 8 - 146.222.76.0/24 2673 0.2% AS9502 -- OOCL-HKG-AP Hong Kong Headquarters 9 - 62.89.226.0/24 2077 0.1% AS20663 -- INAR-VOLOGDA-AS Autonomous System of Vologda 10 - 64.95.193.0/24 2018 0.1% AS30707 -- SICOR-US-CA-IRVINE - SICOR Pharmaceuticals, Inc. 11 - 207.106.204.0/24 1961 0.1% AS25774 -- CHAPMORTCORP - CHAPEL MORTGAGE 12 - 203.199.128.0/19 1877 0.1% AS4755 -- VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System 13 - 194.42.208.0/20 1836 0.1% AS705 -- UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 14 - 135.109.224.0/19 1292 0.1% AS7345 -- LUCENTTECH - Lucent Technologies Inc. 15 - 143.227.48.0/20 1267 0.1% AS4587 -- ONEWORLD2 - One World Internetworking, Inc 16 - 143.227.0.0/16 1265 0.1% AS4587 -- ONEWORLD2 - One World Internetworking, Inc 17 - 204.87.185.0/24 1250 0.1% AS4587 -- ONEWORLD2 - One World Internetworking, Inc 18 - 135.109.0.0/19 1168 0.1% AS7345 -- LUCENTTECH - Lucent Technologies Inc. 19 - 216.85.83.0/24 1143 0.1% AS4323 -- TWTC - Time Warner Telecom, Inc. AS6467 -- ESPIRECOMM - Xspedius Communications Co. 20 - 194.225.132.0/24 1016 0.1% AS6736 -- IRANET-IPM IRANET/IPM Details at http://bgpupdates.potaroo.net ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org ausnog(a)ausnog.net

1 0

The Cidr Report
by cidr-report＠potaroo.net 23 Feb '07

23 Feb '07

This report has been generated at Fri Feb 23 21:45:34 2007 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 16-02-07 208954 135684 17-02-07 209138 135744 18-02-07 209288 135739 19-02-07 209438 135908 20-02-07 209575 135968 21-02-07 209757 135766 22-02-07 209998 135856 23-02-07 209950 135789 AS Summary 24353 Number of ASes in routing system 10282 Number of ASes announcing only one prefix 1483 Largest number of prefixes announced by an AS AS7018 : ATT-INTERNET4 - AT&T WorldNet Services 90543360 Largest address span announced by an AS (/32s) AS721 : DISA-ASNBLK - DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 23Feb07 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 209972 135774 74198 35.3% All ASes AS4323 1326 354 972 73.3% TWTC - Time Warner Telecom, Inc. AS18566 992 30 962 97.0% COVAD - Covad Communications Co. AS4134 1242 308 934 75.2% CHINANET-BACKBONE No.31,Jin-rong Street AS4755 1047 169 878 83.9% VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System AS9498 960 117 843 87.8% BBIL-AP BHARTI BT INTERNET LTD. AS6478 1124 388 736 65.5% ATT-INTERNET3 - AT&T WorldNet Services AS22773 729 47 682 93.6% CCINET-2 - Cox Communications Inc. AS11492 978 344 634 64.8% CABLEONE - CABLE ONE AS8151 1041 462 579 55.6% Uninet S.A. de C.V. AS17488 598 54 544 91.0% HATHWAY-NET-AP Hathway IP Over Cable Internet AS19262 713 180 533 74.8% VZGNI-TRANSIT - Verizon Internet Services Inc. AS6197 1024 507 517 50.5% BATI-ATL - BellSouth Network Solutions, Inc AS7018 1483 978 505 34.1% ATT-INTERNET4 - AT&T WorldNet Services AS19916 568 71 497 87.5% ASTRUM-0001 - OLM LLC AS18101 522 32 490 93.9% RIL-IDC Reliance Infocom Ltd Internet Data Centre, AS17676 503 65 438 87.1% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS4812 490 72 418 85.3% CHINANET-SH-AP China Telecom (Group) AS15270 504 88 416 82.5% AS-PAETEC-NET - PaeTec.net -a division of PaeTecCommunications, Inc. AS4766 727 315 412 56.7% KIXS-AS-KR Korea Telecom AS2386 1114 742 372 33.4% INS-AS - AT&T Data Communications Services AS721 633 278 355 56.1% DISA-ASNBLK - DoD Network Information Center AS3602 520 181 339 65.2% AS3602-RTI - Rogers Telecom Inc. AS16852 395 72 323 81.8% BROADWING-FOCAL - Broadwing Communications Services, Inc. AS7011 798 476 322 40.4% FRONTIER-AND-CITIZENS - Frontier Communications, Inc. AS33588 432 127 305 70.6% BRESNAN-AS - Bresnan Communications, LLC. AS6198 562 268 294 52.3% BATI-MIA - BellSouth Network Solutions, Inc AS7029 511 224 287 56.2% WINDSTREAM - Windstream Communications Inc AS4668 293 7 286 97.6% LGNET-AS-KR LG CNS AS6517 406 122 284 70.0% YIPESCOM - Yipes Communications, Inc. AS855 566 287 279 49.3% CANET-ASN-4 - Bell Aliant Total 22801 7365 15436 67.7% Top 30 total Possible Bogus Routes 24.246.0.0/17 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 24.246.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 60.253.0.0/18 AS27572 THEBOE-27572 - The Boeing Company 60.253.64.0/19 AS27572 THEBOE-27572 - The Boeing Company 61.4.64.0/20 AS9929 CNCNET-CN China Netcom Corp. 63.248.0.0/16 AS3356 LEVEL3 Level 3 Communications 63.248.0.0/17 AS3356 LEVEL3 Level 3 Communications 64.7.112.0/21 AS13511 ITXC - ITXC 64.7.120.0/21 AS13537 ITXC-2 - ITXC 64.17.32.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.33.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.37.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.46.96.0/20 AS13680 AS13680 Hostway Corporation Tampa, FL 64.46.112.0/20 AS30217 DESYNC Desync Corporation 64.79.64.0/19 AS10789 BIGNET-AS - The Bignet 64.79.86.0/24 AS10789 BIGNET-AS - The Bignet 64.79.87.0/24 AS10789 BIGNET-AS - The Bignet 64.79.88.0/24 AS10789 BIGNET-AS - The Bignet 64.79.89.0/24 AS10789 BIGNET-AS - The Bignet 64.79.90.0/24 AS10789 BIGNET-AS - The Bignet 64.79.96.0/20 AS10789 BIGNET-AS - The Bignet 64.89.224.0/24 AS15276 MAX-LV - Intuitive Logic 64.89.225.0/24 AS15276 MAX-LV - Intuitive Logic 64.89.226.0/24 AS15276 MAX-LV - Intuitive Logic 64.89.232.0/24 AS15276 MAX-LV - Intuitive Logic 64.89.239.0/24 AS15276 MAX-LV - Intuitive Logic 64.188.0.0/16 AS3356 LEVEL3 Level 3 Communications 64.250.128.0/18 AS10789 BIGNET-AS - The Bignet 65.60.45.0/24 AS32311 JKS-ASN - JKS Media, LLC 66.11.32.0/20 AS6261 VISINET - Visionary Systems, Inc. 66.37.96.0/20 AS3764 IA-HOU-AS - Internet America, Inc. 66.54.91.0/24 AS30506 BLACKSUN-1 - Blacksun Technologies LLC 66.55.160.0/19 AS29994 ISKIMARO - Iskimaro 66.55.160.0/24 AS29994 ISKIMARO - Iskimaro 66.55.176.0/24 AS29994 ISKIMARO - Iskimaro 66.64.96.0/20 AS3790 RADIGRAFICA COSTARRICENSE 66.97.32.0/20 AS11305 INTERLAND-NET1 - Interland Incorporated 66.163.96.0/20 AS25767 WAVEFORM - Waveform Technology, LLC 66.180.239.0/24 AS35888 VIGNETTE - VIGNETTE CORPORATION 66.235.158.0/23 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 66.241.96.0/21 AS10271 TCIX - Troy City Internet Exchange, Inc 69.36.192.0/20 AS29804 INTEGRATIX - Integratix Inc. 69.55.108.0/24 AS4977 NET1 - Pecos Technologies 72.9.128.0/20 AS27572 THEBOE-27572 - The Boeing Company 77.242.16.0/20 AS35047 ABISSNET Abiss Net Tirana Albania 79.192.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 79.255.248.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project 123.0.0.0/8 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 128.209.0.0/16 AS4017 BELLST - Bell Atlantic Science & Technology 131.64.0.0/12 AS721 DISA-ASNBLK - DoD Network Information Center 132.0.0.0/10 AS721 DISA-ASNBLK - DoD Network Information Center 137.0.0.0/13 AS721 DISA-ASNBLK - DoD Network Information Center 138.136.0.0/13 AS721 DISA-ASNBLK - DoD Network Information Center 139.56.0.0/19 AS14956 BROADVISION-ASN - Broadvision Inc. 139.56.72.0/23 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 151.135.0.0/16 AS4763 TELSTRANZ-AS TelstraClear Ltd 158.0.0.0/13 AS721 DISA-ASNBLK - DoD Network Information Center 159.3.211.0/24 AS2687 ASATTCA AT&T Global Network Services - AP 159.220.0.0/22 AS16050 REUTERS-DOCKLANDS-RES-AS Reuters Docklands resiliancy 159.220.4.0/22 AS16050 REUTERS-DOCKLANDS-RES-AS Reuters Docklands resiliancy 159.220.4.0/24 AS16050 REUTERS-DOCKLANDS-RES-AS Reuters Docklands resiliancy 159.220.8.0/22 AS35528 REUTERS-UK2-AS Reuters-UK2 159.220.40.0/24 AS1787 REUTERS-AMERICA-ISP-CELL-AS - Reuters America Inc. 159.220.41.0/24 AS1787 REUTERS-AMERICA-ISP-CELL-AS - Reuters America Inc. 159.220.42.0/24 AS1787 REUTERS-AMERICA-ISP-CELL-AS - Reuters America Inc. 159.220.43.0/24 AS1787 REUTERS-AMERICA-ISP-CELL-AS - Reuters America Inc. 159.220.64.0/23 AS24977 MONEYLINE-UK Moneyline Telerate 163.142.0.0/16 AS2500 JPNIC-ASBLOCK-AP JPNIC 180.190.0.0/16 AS24003 JUBL-MAIN-AS-IN JUBILANT ORGANOSYS LTD., INDIA, LEADING CHEMICAL MANUFACTURER 190.54.0.0/16 AS6429 Core Internet AT&T Chile 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.40.105.0/24 AS12582 TSF-DATANET-NGD-AS TSF MPLS VPN Services 192.69.107.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.69.108.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.69.177.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.70.164.0/24 AS25689 NRCNET-AS - National Research Council of Canada 192.81.160.0/24 AS719 ELISA-AS Elisa Oyj 192.81.182.0/24 AS719 ELISA-AS Elisa Oyj 192.81.183.0/24 AS719 ELISA-AS Elisa Oyj 192.81.184.0/24 AS719 ELISA-AS Elisa Oyj 192.88.99.0/24 AS559 SWITCH SWITCH, Swiss Education and Research Network 192.96.36.0/24 AS5713 SAIX-NET 192.96.37.0/24 AS10474 NETACTIVE 192.96.135.0/24 AS2018 TENET-1 192.96.136.0/23 AS2018 TENET-1 192.96.140.0/24 AS2018 TENET-1 192.96.143.0/24 AS2018 TENET-1 192.96.145.0/24 AS2018 TENET-1 192.96.177.0/24 AS6083 POSIX-AFRICA 192.96.250.0/24 AS2018 TENET-1 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS10282 EQUANT-CEEUR EQUANT AS for Central and Eastern Europe region 192.139.3.0/24 AS23184 PERSONA - PERSONA COMMUNICATIONS INC. 192.153.136.0/21 AS721 DISA-ASNBLK - DoD Network Information Center 192.153.144.0/21 AS721 DISA-ASNBLK - DoD Network Information Center 192.172.0.0/19 AS721 DISA-ASNBLK - DoD Network Information Center 192.188.208.0/20 AS721 DISA-ASNBLK - DoD Network Information Center 192.245.235.0/24 AS29748 CARPATHIA-HOSTING - Carpathia Hosting 194.31.227.0/24 AS21461 TRANSFAIRNET Transfair-net GmbH Krefeld 194.59.176.0/20 AS1273 CW Cable & Wireless 194.153.107.0/24 AS8897 MISTRAL Mistral Internet Group Limited 194.246.72.0/23 AS8893 ARTFILES-AS Artfiles New Media GmbH 196.6.108.0/24 AS5713 SAIX-NET 196.6.175.0/24 AS3741 IS 196.6.176.0/23 AS3741 IS 196.6.183.0/24 AS3741 IS 196.6.196.0/24 AS3741 IS 196.6.199.0/24 AS3741 IS 196.6.204.0/22 AS3741 IS 196.6.208.0/24 AS3741 IS 196.6.211.0/24 AS3741 IS 196.6.212.0/23 AS3741 IS 196.6.212.0/24 AS3741 IS 196.6.222.0/23 AS3741 IS 196.6.237.0/24 AS3741 IS 196.10.119.0/24 AS2018 TENET-1 196.10.122.0/23 AS2018 TENET-1 196.10.136.0/22 AS3741 IS 196.10.140.0/22 AS3741 IS 196.10.231.0/24 AS3741 IS 196.10.251.0/24 AS2018 TENET-1 196.10.252.0/23 AS2018 TENET-1 196.10.254.0/24 AS2018 TENET-1 196.11.0.0/20 AS3741 IS 196.11.40.0/21 AS3741 IS 196.11.135.0/24 AS3741 IS 196.11.188.0/23 AS3741 IS 196.11.190.0/24 AS3741 IS 196.11.251.0/24 AS3741 IS 196.13.101.0/24 AS2018 TENET-1 196.13.102.0/23 AS2018 TENET-1 196.13.104.0/24 AS2018 TENET-1 196.13.108.0/24 AS3741 IS 196.13.116.0/22 AS2018 TENET-1 196.13.121.0/24 AS2018 TENET-1 196.13.125.0/24 AS2018 TENET-1 196.13.126.0/24 AS2018 TENET-1 196.13.128.0/22 AS3741 IS 196.13.144.0/22 AS2905 TICSA-ASN 196.13.152.0/21 AS2905 TICSA-ASN 196.13.160.0/24 AS2905 TICSA-ASN 196.13.169.0/24 AS2018 TENET-1 196.13.174.0/23 AS2018 TENET-1 196.13.176.0/21 AS2018 TENET-1 196.13.188.0/22 AS2018 TENET-1 196.13.192.0/22 AS2018 TENET-1 196.13.196.0/24 AS2018 TENET-1 196.13.214.0/23 AS3741 IS 196.13.216.0/23 AS3741 IS 198.23.26.0/24 AS4390 BELLATLANTIC-COM - Bell Atlantic, Inc. 198.54.82.0/24 AS2018 TENET-1 198.54.92.0/24 AS2018 TENET-1 198.54.222.0/24 AS2018 TENET-1 198.54.249.0/24 AS2018 TENET-1 198.54.250.0/24 AS2018 TENET-1 198.54.251.0/24 AS2018 TENET-1 198.97.72.0/21 AS721 DISA-ASNBLK - DoD Network Information Center 198.97.80.0/20 AS721 DISA-ASNBLK - DoD Network Information Center 198.97.96.0/19 AS721 DISA-ASNBLK - DoD Network Information Center 198.97.240.0/20 AS721 DISA-ASNBLK - DoD Network Information Center 198.161.87.0/24 AS6539 GT-BELL - Bell Canada 198.163.155.0/24 AS684 MTSAL-ASN - MTS Allstream Inc. 198.167.0.0/16 AS7456 INTERHOP - Interhop Network SERVICES Inc. 198.168.0.0/16 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 198.169.0.0/16 AS803 SASKTEL - SaskTel 199.9.128.0/17 AS668 ASN-ASNET-NET-AS - Defense Research and Engineering Network 199.10.0.0/16 AS721 DISA-ASNBLK - DoD Network Information Center 199.60.0.0/20 AS271 BCNET-AS - University of British Columbia 199.114.0.0/21 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.128.0/18 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.130.0/24 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.132.0/24 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.134.0/24 AS3541 ITSDN-U4 - DISA/UNRRA 199.114.136.0/24 AS27044 DDN-ASNBLK1 - DoD Network Information Center 199.114.138.0/24 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.114.140.0/24 AS3544 ITSDN-U7 - DISA/UNRRA 199.114.142.0/24 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.114.144.0/24 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.114.148.0/24 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.150.0/24 AS721 DISA-ASNBLK - DoD Network Information Center 199.114.152.0/24 AS27033 DDN-ASNBLK1 - DoD Network Information Center 199.114.153.0/24 AS27034 DDN-ASNBLK1 - DoD Network Information Center 199.114.154.0/24 AS3542 ITSDN-U5 - DISA/UNRRA 199.114.156.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.114.160.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.121.0.0/16 AS721 DISA-ASNBLK - DoD Network Information Center 199.123.0.0/18 AS721 DISA-ASNBLK - DoD Network Information Center 199.123.16.0/20 AS721 DISA-ASNBLK - DoD Network Information Center 199.123.80.0/21 AS721 DISA-ASNBLK - DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST-AS - IQuest Internet 199.202.0.0/16 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 199.246.116.0/24 AS813 UUNET-CANADA - MCI Communications Services, Inc. d/b/a Verizon Business 202.4.160.0/24 AS9498 BBIL-AP BHARTI BT INTERNET LTD. 202.4.161.0/24 AS9498 BBIL-AP BHARTI BT INTERNET LTD. 202.4.162.0/24 AS9498 BBIL-AP BHARTI BT INTERNET LTD. 202.9.64.0/19 AS9290 TPN-AS-AP Smart Global Network (M) Sdn Bhd 202.45.132.0/22 AS24314 UPSI-AS-AP University Pendidikan Sultan Idris 202.58.113.0/24 AS19161 INNOCOM-TELECOM - INNOCOM TELECOM 202.58.224.0/19 AS17925 WAVENET WAVENET PHILIPPINES INC. 202.58.224.0/20 AS17925 WAVENET WAVENET PHILIPPINES INC. 202.58.240.0/20 AS17925 WAVENET WAVENET PHILIPPINES INC. 202.58.240.0/24 AS17925 WAVENET WAVENET PHILIPPINES INC. 202.58.244.0/24 AS17925 WAVENET WAVENET PHILIPPINES INC. 202.58.249.0/24 AS17925 WAVENET WAVENET PHILIPPINES INC. 202.58.250.0/24 AS17925 WAVENET WAVENET PHILIPPINES INC. 202.58.253.0/24 AS17925 WAVENET WAVENET PHILIPPINES INC. 202.59.8.0/21 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.86.252.0/22 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.253.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.254.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.255.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.90.33.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.40.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.41.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.42.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.43.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.44.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.94.70.0/24 AS9837 POWERTEL-AP Powertel Ltd 202.124.192.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.193.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.194.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.195.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.196.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.197.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.198.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.199.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.200.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.201.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.202.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.203.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.204.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.205.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.206.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.207.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.125.96.0/20 AS7693 COMNET-TH KSC Commercial Internet Co. Ltd. 202.136.254.0/24 AS4808 CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network 202.136.255.0/24 AS4808 CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network 202.148.32.0/20 AS17495 GATEWAY-AP BROADBAND WIRELESSS INTERNET SERVICE PROVIDER 202.164.100.0/24 AS18101 RIL-IDC Reliance Infocom Ltd Internet Data Centre, 202.174.70.0/24 AS21175 M-LINK M-Link Teleport s.a. 202.174.71.0/24 AS23924 SCNET-AS-AP Storage Continuity Pte Ltd 202.174.72.0/22 AS23924 SCNET-AS-AP Storage Continuity Pte Ltd 202.179.64.0/24 AS24392 ANKHNET-AS-AP Ankhnet Informations Pvt. Ltd., Internet Service 202.179.67.0/24 AS24392 ANKHNET-AS-AP Ankhnet Informations Pvt. Ltd., Internet Service 202.179.68.0/24 AS24392 ANKHNET-AS-AP Ankhnet Informations Pvt. Ltd., Internet Service 202.182.32.0/22 AS10223 UECOMM-AU Uecomm Ltd 203.13.171.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 203.62.0.0/17 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet) 203.78.48.0/20 AS9299 IPG-AS-AP Philippine Long Distance Telephone Company 203.80.32.0/20 AS4817 DESTRA-AU-AP Destra Corporation 203.89.139.0/24 AS17911 BRAINPK-AS-AP Brain Telecommunication Ltd. 203.111.192.0/20 AS7473 SINGTEL-AS-AP Singapore Telecom 203.128.128.0/19 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 203.152.136.0/23 AS23649 NEWSKIES-AS-AP New Skies Satellites, Hong Kong Teleport 203.152.138.0/23 AS23649 NEWSKIES-AS-AP New Skies Satellites, Hong Kong Teleport 203.152.142.0/24 AS23649 NEWSKIES-AS-AP New Skies Satellites, Hong Kong Teleport 203.152.143.0/24 AS23649 NEWSKIES-AS-AP New Skies Satellites, Hong Kong Teleport 203.160.104.0/22 AS23914 OCI-AS-VN One-Connection Internet Company 203.160.110.0/23 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 204.29.196.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 204.29.197.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 204.48.58.0/24 AS4323 TWTC - Time Warner Telecom, Inc. 204.48.60.0/24 AS4323 TWTC - Time Warner Telecom, Inc. 204.153.68.0/24 AS4017 BELLST - Bell Atlantic Science & Technology 204.153.71.0/24 AS4017 BELLST - Bell Atlantic Science & Technology 204.153.104.0/24 AS10913 INTERNAP-BLK - Internap Network Services 204.154.125.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 205.150.0.0/15 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 206.55.208.0/20 AS22180 CONPOINT - POWER POINT COMPUTER CENTERS, 206.128.104.0/21 AS11709 VIC - VIRTUAL INTERACTIVE CENTER 206.191.192.0/18 AS6287 SPACESTAR - Spacestar Communications 207.7.64.0/19 AS14093 ITRIBE - iTRiBE, Inc. 207.189.62.0/23 AS7132 SBIS-AS - SBC Internet Services 207.231.96.0/19 AS11194 NUNETPA - NuNet Inc 207.246.192.0/20 AS5656 ACCESSUS-DOM - accessU.S./BASENet 208.69.192.0/22 AS40219 ARACTEL-NETWORKS-LLC - ARACTEL NETWORKS LLC 208.69.193.0/24 AS20161 TRGO - TeraGo Networks Inc. 209.105.224.0/19 AS20074 KNOWLEDGENET - KNOWLEDGENET 209.159.128.0/19 AS209 ASN-QWEST - Qwest 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 210.5.128.0/20 AS4837 CHINA169-BACKBONE CNCGROUP China169 Backbone 216.21.1.0/24 AS11652 DATATONE - Datatone Communications Inc 216.21.6.0/24 AS11652 DATATONE - Datatone Communications Inc 216.21.7.0/24 AS11652 DATATONE - Datatone Communications Inc 216.21.15.0/24 AS11652 DATATONE - Datatone Communications Inc 216.21.17.0/24 AS11652 DATATONE - Datatone Communications Inc 216.59.0.0/17 AS3356 LEVEL3 Level 3 Communications 216.65.160.0/19 AS7770 TRITON - Triton Technologies, Inc. 216.75.228.0/24 AS32097 WII-KC - WholeSale Internet 216.75.229.0/24 AS6939 HURRICANE - Hurricane Electric 216.116.56.0/24 AS9237 HUTCHCA-AS Corporate Access (HK) Ltd. 216.116.59.0/24 AS7132 SBIS-AS - SBC Internet Services 216.224.64.0/19 AS6440 EMF-AS - emf.net 216.230.224.0/20 AS15270 AS-PAETEC-NET - PaeTec.net -a division of PaeTecCommunications, Inc. 216.235.96.0/19 AS13645 BROADBANDONE - BroadbandONE, Inc. 216.235.224.0/20 AS22136 NYCT - New York Connect Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org ausnog(a)ausnog.net

1 0

How to protect a network (that's already running spt) from a customer's layer2 loop?
by Gunther Stammwitz 22 Feb '07

22 Feb '07

Hello colleagues, I'm using (rapid)spanning tree in order to protect my network from layer2 loops and in order to provide redundancy in my ring-structure. This is fine so far but a big PROBLEM can occur if a customer is having a layer2-loop within his part of the network. Although the customer does only have one single uplink to my backbone and is in his own vlan isolated from the other vlans on the network/ring the cpu on my switches dramatically increases to 99% when the customer is having a layer2-loop on his switch (and does not run spanning tree). The same thing happens if spanning tree gets disabled on one of my switches. What can I do against this situation? I know that many big network outages can be traced back to layer2-problems but I had thought that spanning tree would help in such a situation. How can I protect my network from such kind of a situation? Broadcast-storm-limits, mac-limits and so on won't help here, right. What's next?!? Thanks, Gunther

1 0

Re: botnets: web servers, end-systems and Vint Cerf [LONG, sorry]
by Fergie 21 Feb '07

21 Feb '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Gadi Evron <ge(a)linuxbox.org> wrote: >And this is before we get into the academic off-topic discussion of what a >bot actually is, which after almost 11 years of dealing with these I find >difficult to define. Is it an IP address? A computer? Perhaps an instance >of a bot (and every machine could have even hundreds). > >Welcome to the realm of Internet security operations and the different >groups and folks involved (and now industry). It is about Internet >security rather than this or that network security or this and that sample >detection. Interestingly enough, I discovered during my trip to Tokyo this week that the Japanese government is _mandating_ that the national ISPs address the botnet problem, specifically. I'm still gathering details on the framework -- which is still being defined, if I'm not mistaken -- but I applaud them for taking the lead in this regard. If they are even marginally successful, I hope it will be an example for others around the world to stop making excuses and begin addressing the problem. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.5.3 (Build 5003) wj8DBQFF2+dhq1pz9mNUZTMRAhd9AJ9FqULfYzAXzwlhSRdrU2a5Xd5frwCcDedO XAQipmVgJwGfqq34fANSy7w= =mAC6 -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Interland dead?
by Michael Loftis 21 Feb '07

21 Feb '07

Anyone know what's going on? -- "Genius might be described as a supreme capacity for getting its possessors into trouble of all kinds." -- Samuel Butler

3 2

RE: botnets: web servers, end-systems and Vint Cerf
by michael.dillon＠bt.com 20 Feb '07

20 Feb '07

> I've concluded three things (by doing experiements like > that). (a) Where > there are Windows boxes, there are zombies. "Securing > Microsoft operating > systems adequately for use on the Internet" is not a solved problem in > computing. I disagree. Since 1994 I have been in the habit of setting up MS Windows boxes with Win98 and up, by installing from CD, connecting to the net and installing various patches and updates from the Windows Update service. I've never had a virus infection, a bot, a root kit or whatever. The secret is simple. These machines never connected directly to the Internet but went through a NAT box. Way back when it was a FreeBSD machine running TIS Firewalls Toolkit. These days it is an off-the-shelf Ethernet switch with DSL modem and NAT built-in. Therefore, I assert that securing systems adequately for use on the Internet is indeed a SOLVED PROBLEM in computing. However, it isn't yet solved in a social or business sense. On the business side, I wonder why PC's don't come with a built-in firewall/NAT device. It is cheap enough to do these days. This means that a computer would have no Ethernet ports on it. Instead, an internal Ethernet port would be directly connected to a NAT/firewall device on the same circuit board (or via PCI/PCMCIA/etc.). The external Ethernet port would belong to the firewall/NAT device. On the social side, people don't realize that such a solution is possible and therefore they aren't demanding computer vendors to build it in. The box vendors only build what the OS vendors want and the OS vendors are not interested in a piece of hardware that runs its own OS, most likely FreeBSD or Linux. In the UK, companies who sell TV services (cable and satellite) give there customers a box to connect with. Why can't ISPs also sell their services with a proper box included? By proper, I mean a NAT/firewall, not a USB-connected DSL modem. > (c) Amusingly, it's possible > to detect new end-user allocations and service rollouts by noting when > spam starts to arrive from them. (e.g. the Verizon FIOS > deployment, if I > may use hostnames of the form *.fios.verizon.net as a guide, is going > well in NYC, Dallas, DC, Tampa, Philly, LA, Boston and > Newark, but lags > behind in Seattle, Pittsburgh, Buffalo and Syracuse.) I wonder if Verizon is violating any SEC rules by not reporting this information publicly? This is a good example of something that would not be revealed if they provided a NAT/firewall box to every customer who didn't already have one. Has anyone implemented a tool that ISPs could use to detect whether or not a NAT/firewall device is present? Perhaps based on OS fingerprinting? Or even based on an agent that must be installed by the customer? If such tools are available then an ISP could offer customers a discount for being compliant with a NAT/firewall rule in their contract. --Michael Dillon

5 4