- NANOG - lists.nanog.org

FW: Pittock Building in Portland Oregon
by Josh L. Richesin 16 Oct '06

16 Oct '06

Does anyone know what happened at the Pittock building in Portland last night? I herd they lost power on the 3rd floor. Josh

1 0

SANOG 9 CALL For Papers
by Haris Shamsi 16 Oct '06

16 Oct '06

FYI - On behalf of SANOG Program Committee SANOG IX 14- 24 January, 2007 Colombo, Sri Lanka Call for Papers http://www.sanog.org/sanog9/cfp.htm Deadline for proposals: 1 December 2006 Acceptance Notification: 15 December 2006 Paper Confirmation : 1 January 2007 Please submit Online at https://submission.sanog.org/paper/ The following is an open call for papers/presentations for the two- day conference at the 9th South Asian Network Operators Group (SANOG) Meeting. Marketing and sales content in presentations is against the spirit of the SANOG and is strictly prohibited. Please respond to this call for papers/presentations by making submissions online at https://submission.sanog.org/paper/ Tutorial Proposals Tutorial proposals are invited in the following general areas. Please feel free to propose additional ideas and topics. Tutorials generally are either half or full days. IP Core, BGP, MPLS, IPv6 Data Center and Switching Technologies Voice Protocols, IP Contact Centers Security, IDS, DoS mitigation SAN & Virtualization Internet Exchange Point, transit & peering Conference Presentation The conference will be comprised of 6 session in two days, including the plenary. The tracks are for general ideas, and feel free to propose talks that you think are relevant to the operational and Internet research community. The topics given below are not exclusive. Presentations are expected to be 20-25 minutes long with technical content. Track 1: Network operations In this session we invite papers, reports and presentations from network operators, equipment vendors and academic institutions conducting network research on operational issues. Possible topics for this track are: Prevention and mitigation of Denial of Service attacks including intrusion Routing policies and architecture for scalable IP and broadband networks Data Center Management and Operations MPLS and QoS implementation experiences Traffic management and measurement Network migration issues (IPv4 to v6, Layer 2 to IP etc.) Track 2: Applications and Services This track will discuss various services that can be enabled on packet networks. Papers and presentations are invited from developers, operators, equipment vendors and research organizations on the following and related topics Voice and Multimedia over IP Managed network services including Security and VPNs Mail servers, SPAM prevention, Wireless Technology and Applications Track 3: Peering and IXP This is relatively a new track at SANOG. This is to cater to the growing demand on the newly established Internet Exchange Points in the region. As local ISPs are going international, we would like to invite both regional and international experts to share their ideas and experience on these topics. Internet Exchange Points Operations Peering Techniques and Policies BGP Multihoming Techniques Track 4: Regional updates This track is fairly broad, and will include updates from ISPs, regional Internet exchanges, APNIC, routing table updates and such information that would be useful to the SANOG community. You are also welcome to submit proposals for BoFs, tutorials and other tracks. Please submit Online at https://submission.sanog.org/paper/ /Haris Shamsi

1 0

selection of new NANOG programme committee
by Joe Abley 15 Oct '06

15 Oct '06

The SC plans to select a new Programme Committee during their meeting on Thursday 19 October. The complete list of PC candidates is here: http://www.nanog.org/pccandidates06.html If you have any opinions or comments you would like to share with the SC about any of the PC candidates please feel free to send them to steering(a)nanog.org. [Comments received will be archived in a private mailing list archive accessible to the SC, will be used only as an aid to the PC selection process, and will not be forwarded outside the SC.]

1 0

time.nist.gov
by Roy 15 Oct '06

15 Oct '06

time.nist.gov (192.43.244.18) seems to be down. I tired it via several different paths. I can't find any notice that this is a planned event. Does anyone have any further info? Roy

2 1

Addresses of the Route Views (Oregon) collectors are changing
by David Meyer 15 Oct '06

15 Oct '06

Over the next few weeks the addresses of the four Route Views collectors in Oregon are changing: Collector Old Address New Address route-views.routeviews.org 128.223.60.103 128.223.51.103 route-views2.routeviews.org 128.223.60.102 128.223.51.102 route-views3.routeviews.org 128.223.60.108 128.223.51.108 route-views6.routeviews.org 128.223.60.194 128.223.51.194 If you currently peer with one of these collectors, we'll be emailing you further information on the specific timing and details of the changes. If you access the collectors via telnet, be aware that at some point in the next few weeks the new address will become active. There will be a period of time when both addresses can be used, and then the old address will be decommissioned. See http://www.routeviews.org/renumber.html for any updates to this plan, and to find out current status. Please send any questions to help(a)routeviews.org Thanks, The Route Views Team

1 0

Weekly Routing Table Report
by Routing Analysis Role Account 14 Oct '06

14 Oct '06

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.apnic.net. If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 14 Oct, 2006 Analysis Summary ---------------- BGP routing table entries examined: 200339 Prefixes after maximum aggregation: 108814 Unique aggregates announced to Internet: 97044 Total ASes present in the Internet Routing Table: 23359 Origin-only ASes present in the Internet Routing Table: 20346 Origin ASes announcing only one prefix: 9795 Transit ASes present in the Internet Routing Table: 3013 Transit-only ASes present in the Internet Routing Table: 71 Average AS path length visible in the Internet Routing Table: 3.6 Max AS path length visible: 29 Max AS path prepend of ASN (36728) 27 Prefixes from unregistered ASNs in the Routing Table: 2 Unregistered ASNs in the Routing Table: 4 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 10 Number of addresses announced to Internet: 1615440908 Equivalent to 96 /8s, 73 /16s and 172 /24s Percentage of available address space announced: 43.6 Percentage of allocated address space announced: 60.3 Percentage of available address space allocated: 72.3 Total number of prefixes smaller than registry allocations: 100498 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 43873 Total APNIC prefixes after maximum aggregation: 17556 Prefixes being announced from the APNIC address blocks: 41522 Unique aggregates announced from the APNIC address blocks: 18483 APNIC Region origin ASes present in the Internet Routing Table: 2716 APNIC Region origin ASes announcing only one prefix: 762 APNIC Region transit ASes present in the Internet Routing Table: 405 Average APNIC Region AS path length visible: 3.5 Max APNIC Region AS path length visible: 19 Number of APNIC addresses announced to Internet: 263733600 Equivalent to 15 /8s, 184 /16s and 65 /24s Percentage of available APNIC address space announced: 82.5 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911 APNIC Address Blocks 58/7, 60/7, 121/8, 122/7, 124/7, 126/8, 202/7 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 100779 Total ARIN prefixes after maximum aggregation: 59537 Prefixes being announced from the ARIN address blocks: 73957 Unique aggregates announced from the ARIN address blocks: 27939 ARIN Region origin ASes present in the Internet Routing Table: 11051 ARIN Region origin ASes announcing only one prefix: 4204 ARIN Region transit ASes present in the Internet Routing Table: 1030 Average ARIN Region AS path length visible: 3.3 Max ARIN Region AS path length visible: 29 Number of ARIN addresses announced to Internet: 304717696 Equivalent to 18 /8s, 41 /16s and 159 /24s Percentage of available ARIN address space announced: 67.3 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959 ARIN Address Blocks 24/8, 63/8, 64/5, 72/6, 76/8, 96/6, 199/8, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 40787 Total RIPE prefixes after maximum aggregation: 26935 Prefixes being announced from the RIPE address blocks: 37718 Unique aggregates announced from the RIPE address blocks: 25160 RIPE Region origin ASes present in the Internet Routing Table: 8625 RIPE Region origin ASes announcing only one prefix: 4537 RIPE Region transit ASes present in the Internet Routing Table: 1399 Average RIPE Region AS path length visible: 3.9 Max RIPE Region AS path length visible: 18 Number of RIPE addresses announced to Internet: 267544356 Equivalent to 15 /8s, 242 /16s and 103 /24s Percentage of available RIPE address space announced: 72.5 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-41983 RIPE Address Blocks 62/8, 77/8, 78/7, 80/5, 88/6, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 12550 Total LACNIC prefixes after maximum aggregation: 3857 Prefixes being announced from the LACNIC address blocks: 10575 Unique aggregates announced from the LACNIC address blocks: 6257 LACNIC Region origin ASes present in the Internet Routing Table: 733 LACNIC Region origin ASes announcing only one prefix: 245 LACNIC Region transit ASes present in the Internet Routing Table: 126 Average LACNIC Region AS path length visible: 4.1 Max LACNIC Region AS path length visible: 19 Number of LACNIC addresses announced to Internet: 33027072 Equivalent to 1 /8s, 247 /16s and 244 /24s Percentage of available LACNIC address space announced: 49.2 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 189/8, 190/8, 200/7 AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 2348 Total AfriNIC prefixes after maximum aggregation: 929 Prefixes being announced from the AfriNIC address blocks: 1660 Unique aggregates announced from the AfriNIC address blocks: 1031 AfriNIC Region origin ASes present in the Internet Routing Table: 163 AfriNIC Region origin ASes announcing only one prefix: 47 AfriNIC Region transit ASes present in the Internet Routing Table: 27 Average AfriNIC Region AS path length visible: 3.6 Max AfriNIC Region AS path length visible: 14 Number of AfriNIC addresses announced to Internet: 4304384 Equivalent to 0 /8s, 65 /16s and 174 /24s Percentage of available AfriNIC address space announced: 12.8 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 1245 8270 238 CHINANET-BACKBONE 4755 1009 255 67 Videsh Sanchar Nigam Ltd. Aut 9583 957 109 15 Sify Limited 9498 866 212 70 BHARTI BT INTERNET LTD. 4766 741 4436 307 Korea Telecom (KIX) 1221 609 1780 468 Telstra Pty Ltd 7545 542 124 74 TPG Internet Pty Ltd 17488 534 33 12 Hathway IP Over Cable Interne 17676 499 10933 63 Softbank BB Corp. 18101 462 85 20 Reliance Infocom Ltd Internet 9443 454 111 74 Primus Telecommunications 17849 430 36 126 Telecommunications Technology 9942 428 77 127 COMindico Australia 4802 413 86 150 Wantree Development 4812 411 741 63 China Telecom (Shanghai) 17974 364 129 12 PT TELEKOMUNIKASI INDONESIA 17557 363 30 177 Pakistan Telecom 2907 335 1734 312 SINET Japan 4837 324 3556 140 chinanet IDC center beijing n 10139 307 23 6 Meridian Telekoms ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1523 6209 983 AT&T WorldNet Services 2386 1167 614 743 AT&T Data Communications Serv 4323 1030 784 294 Time Warner Telecom 6197 1017 608 498 BellSouth Network Solutions, 18566 967 272 8 Covad Communications 701 965 6742 783 UUNET Technologies, Inc. 721 961 21925 306 DLA Systems Automation Center 174 958 6823 884 Cogent Communications 1239 834 2763 588 Sprint 11492 754 90 13 Cable One 20115 749 673 392 Charter Communications 19262 739 2391 179 Verizon Global Networks 22773 718 1744 46 Cox Communications, Inc. 209 709 3633 557 Qwest 7011 684 210 429 Citizens Utilities 852 592 1071 388 Telus Advanced Communications 19916 565 49 54 OLM LLC 855 547 250 74 Canadian Research Network 5668 538 145 18 CenturyTel Internet Holdings, 6478 530 1280 335 AT&T Worldnet Services RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 544 1928 423 UUNET - Commercial IP service 24863 367 42 14 LINKdotNET AS number 3301 311 1200 295 TeliaNet Sweden 3320 300 5013 245 Deutsche Telekom AG 8220 279 455 265 COLT Telecommunications 680 251 2041 247 DFN-IP service G-WiN 6746 246 91 224 Dynamic Network Technologies, 3246 228 469 218 Song Networks 8708 222 279 209 Romania Data Systems S.A. 9116 220 134 23 Goldenlines main autonomous s 3215 214 1872 93 France Telecom Transpac 1257 212 740 168 SWIPnet Swedish IP Network 3269 204 2277 74 TELECOM ITALIA 30890 203 18 78 SC Kappa Invexim SRL 8551 200 182 27 Bezeq International 6830 198 879 43 UPC Distribution Services 5416 186 12 11 BATELCO-BH 8866 185 37 15 Bulgarian Telecommunication C 3300 174 171 95 AUCS Communications Services 786 171 1779 171 The JANET IP Service LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 633 1810 223 UniNet S.A. de C.V. 11172 387 100 91 Servicios Alestra S.A de C.V 16814 329 20 8 NSS, S.A. 22047 303 206 11 VTR PUNTO NET S.A. 11830 285 299 9 Instituto Costarricense de El 6147 263 140 23 Telefonica Del Peru 6471 255 74 30 ENTEL CHILE S.A. 14117 235 15 8 Telefonica del Sur S.A. 7303 208 92 27 Telecom Argentina Stet-France 10481 181 72 8 Prima S.A. 6503 179 168 85 AVANTEL, S.A. 21826 144 19 31 INTERCABLE 23216 144 19 46 RAMtelecom Telecomunicaciones 7910 139 9 17 ANDINET ON LINE 19169 136 9 21 Telconet 19429 136 84 40 E.T.B. 11556 132 96 4 Cable-Wireless Panama 18822 129 8 10 TELEFONICA MANQUEHUE 14522 118 18 9 SatNet S.A. 7738 115 410 20 Telecomunicacoes da Bahia S.A AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 295 804 234 The Internet Solution 8452 173 60 7 TEDATA 6713 145 139 12 Itissalat Al-MAGHRIB 2018 132 297 111 Tertiary Education Network 15475 132 84 4 Nile Online 5536 122 8 17 Internet Egypt Network 24835 116 48 6 RAYA Telecom - Egypt 33783 108 6 3 EEPAD TISP TELECOM & INTERNET 2905 75 157 68 The Internetworking Company o 2561 55 6 2 Egyptian Universities Network 15706 55 12 4 Sudatel Internet Exchange Aut 12455 38 6 3 Jambonet Autonomous system 5713 36 293 32 Telkom SA Ltd 33774 34 7 21 AS Number for Telecom Algeria 8524 30 2 6 AUCEGYPT Autonomous System 23889 28 9 13 MAURITIUS TELECOM 21280 26 4 4 Swift Global Kenya Ltd.Is an 16637 24 19 23 Johnnic e-Ventures 10798 23 1 14 Standard Bank of South Africa 21491 23 17 2 UTL On-line is RF broadband I Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 4134 1245 1007 CHINANET-BACKBONE 18566 967 959 Covad Communications 4755 1009 942 Videsh Sanchar Nigam Ltd. Aut 9583 957 942 Sify Limited 9498 866 796 BHARTI BT INTERNET LTD. 11492 754 741 Cable One 4323 1030 736 Time Warner Telecom 22773 718 672 Cox Communications, Inc. 721 961 655 DLA Systems Automation Center 19262 739 560 Verizon Global Networks 17488 534 522 Hathway IP Over Cable Interne 5668 538 520 CenturyTel Internet Holdings, 6197 1017 519 BellSouth Network Solutions, 19916 565 511 OLM LLC 855 547 473 Canadian Research Network 7545 542 468 TPG Internet Pty Ltd 18101 462 442 Reliance Infocom Ltd Internet 17676 499 436 Softbank BB Corp. 15270 470 435 PaeTec.net -a division of Pae 4766 741 434 Korea Telecom (KIX) List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 65534 PRIVATE 193.138.171.0/24 34238 SC OMNITECH NET SRL 24409 UNALLOCATED 203.119.29.0/24 9808 Guangdong Mobile Com Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 198.18.0.0/15 8895 KACST/ISU Riyadh Autonomous S Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 172.33.1.0/24 7018 AT&T WorldNet Services 192.44.0.0/24 5501 Fraunhofer Gesellschaft 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.84.205.0/24 719 LANLINK autonomous system 192.172.0.0/19 721 DLA Systems Automation Center 192.249.0.0/20 3450 University of Tennessee, Knox Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:9 /10:13 /11:29 /12:106 /13:214 /14:386 /15:774 /16:9045 /17:3503 /18:5721 /19:12380 /20:14008 /21:12350 /22:15648 /23:17065 /24:107765 /25:459 /26:406 /27:195 /28:70 /29:43 /30:94 /31:0 /32:37 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 950 967 Covad Communications 2386 884 1167 AT&T Data Communications Serv 7018 806 1523 AT&T WorldNet Services 6197 800 1017 BellSouth Network Solutions, 9583 788 957 Sify Limited 11492 742 754 Cable One 7011 591 684 Citizens Utilities 19916 559 565 OLM LLC 4766 550 741 Korea Telecom (KIX) 9498 517 866 BHARTI BT INTERNET LTD. 4755 439 1009 Videsh Sanchar Nigam Ltd. Aut 15270 439 470 PaeTec.net -a division of Pae 855 427 547 Canadian Research Network 5668 420 538 CenturyTel Internet Holdings, 17849 416 430 Telecommunications Technology 1239 408 834 Sprint 18101 396 462 Reliance Infocom Ltd Internet 22773 377 718 Cox Communications, Inc. 33588 371 392 Bresnan Communications, LLC. 17488 354 534 Hathway IP Over Cable Interne Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:8 6:1 8:54 12:1643 13:1 15:16 16:3 17:3 18:4 20:41 24:819 25:1 32:57 38:258 40:57 41:22 44:3 47:7 52:4 53:1 55:1 56:3 57:25 58:224 59:289 60:220 61:899 62:1046 63:1904 64:3136 65:2236 66:3032 67:646 68:648 69:1655 70:405 71:92 72:960 74:88 75:9 80:831 81:701 82:631 83:398 84:399 85:688 86:412 87:459 88:235 89:513 91:27 121:55 122:18 124:418 125:649 128:281 129:227 130:123 131:313 132:35 133:9 134:166 135:50 136:177 137:106 138:184 139:47 140:528 141:130 142:343 143:193 144:239 145:43 146:319 147:137 148:362 149:177 150:115 151:121 152:76 153:121 154:5 155:255 156:160 157:167 158:155 159:171 160:97 161:84 162:216 163:161 164:226 165:218 166:239 167:250 168:487 169:128 170:384 171:11 172:1 189:2 190:239 192:5761 193:3518 194:2737 195:2098 196:911 198:3891 199:3312 200:4490 201:969 202:6946 203:7146 204:3925 205:2125 206:2428 207:2960 208:2291 209:3507 210:2189 211:845 212:1343 213:1506 214:377 215:39 216:4058 217:1146 218:344 219:258 220:796 221:383 222:233 End of report Report Website: http://thyme.apnic.net

9 14

ISOI II - a DA Workshop (announcement and CFP)
by Gadi Evron 14 Oct '06

14 Oct '06

[Apologies to those who receive this message multiple times] The second Internet Security Operations and Intelligence (ISOI) DA workshop will take place on the 25th and 26th of January, 2007. It will be hosted by the Microsoft Corporation, in Redmond WA. An after-party dinner will be hosted by Trendmicro. This workshop's main topic is BotMaster Operational Tactics - the use of vulnerabilities and 0day exploits in the wild. (by spyware, phishing and botnets for their businesses). Secondary subjects include DDoS, phishing and general botnet subjects. The workshop's purpose is to bring together members of the Internet security operations community at large and DA and MWP specifically, and share information, as well as plan our future operations. It is open only to the following vetted communities: DA, MWP (and sister communities such as routesec), OARC, NSP-SEC, FIRST. MAAWG, anti virus vetted groups and the honey net project. Among the attendees are: Professionals from Internet Service Providers (ISPs), Anti Virus vendors, Anti Spam vendors and projects, CERT teams, Law Enforcement, Academia, etc. coming together to work on the most recent technology, intelligence and operations being done online today for the security of the Internet. No reporters are allowed. CFP: The call for papers is now open to the public. The main subject of interest is vulnerabilities and 0day exploits used in the wild. Secondary subjects are DDoS, phishing and general botnet subjects. Submission is simple, email us directly with your topic and some data to back it up by December 10th, to contact(a)isotf.org. For more information please visit: http://isotf.org/isoi2.html For the agenda of our previous workshop hosted by Cisco Systems, Inc., please visit: http://isotf.org/isoi.html Gadi Evron, ISOI/DA coordinator and organizer.

1 1

RE: 200K prefixes - Weekly Routing Table Report
by Fergie 14 Oct '06

14 Oct '06

I'll bet you nickels to doughnuts that it won't make much of a difference -- in the fact that too may end-ASs originate specifics to attempt to "engineer" their traffic.... - ferg -- "Alex Rubenstein" <alex(a)corp.nac.net> wrote: > > Maybe reboot all our routers at once or something? > > Who wants to go first...? Then again, maybe better not... > > philip > -- > I suspect if we do this, when things 'come back up', we'll be under 200k. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

3 2

RE: 200K prefixes - Weekly Routing Table Report
by Alex Rubenstein 14 Oct '06

14 Oct '06

> > Maybe reboot all our routers at once or something? > > Who wants to go first...? Then again, maybe better not... > > philip > -- > I suspect if we do this, when things 'come back up', we'll be under 200k. -- Alex Rubenstein, AR97, K2AHR, alex(a)nac.net, latency, Al Reuben Net Access Corporation, 800-NET-ME-36, http://www.nac.net

1 0

Drone Armies C&C Report - 13 Oct 2006
by c2report＠isotf.org 13 Oct '06

13 Oct '06

This is a periodic public report from the ISOTF's affiliated group 'DA' (Drone Armies (botnets) research and mitigation mailing list / TISF DA) with the ISOTF affiliated ASreport project (TISF / RatOut). For this report it should be noted that we base our analysis on the data we have accumulated from various sources, which may be incomplete. Any responsible party that wishes to receive reports of botnet command and control servers on their network(s) regularly and directly, feel free to contact us. For purposes of this report we use the following terms open the host completed the TCP handshake closed No activity detected reset issued a RST This month's survey is of 5387 unique, domains (or IPs) with port suspect C&Cs. This list is extracted from the BBL which has a historical base of 13113 reported C&Cs. Of the suspect C&Cs surveyed, 872 reported as Open, 1841 reported as closed, and 862 issued resets to the survey instrument. Of the C&Cs listed by domain name in the our C&C database, 4943 are mitigated. Top 20 ASNes by Total suspect domains mapping to a host in the ASN. These numbers are determined by counting the number of domains which resolve to a host in the ASN. We do not remove duplicates and some of the ASNs reported have many domains mapping to a single IP. Note the Percent_resolved figure is calculated using only the Total and Open counts and does not represent a mitigation effectiveness metric. Percent_ ASN Responsible Party Total Open Resolved 19318 NJIIX-AS-1 - NEW JERSEY INTERN 123 20 84 13301 UNITEDCOLO-AS Autonomous System of 115 41 64 4766 KIXS-AS-KR 65 22 66 30058 FDCSE FDCservers.net LLC 64 21 67 16265 LEASEWEB AS 58 40 31 23522 CIT-FOONET 49 29 41 174 Cogent Communications 40 30 25 12832 Lycos Europe 40 6 85 8560 SCHLUND-AS 37 18 51 15083 IIS-129 Infolink Information Servic 37 2 95 7132 SBC Internet Services 36 7 81 3269 TELECOM ITALIA 32 9 72 9318 HANARO-AS 31 6 81 33597 InfoRelay Online Systems, Inc. 29 0 100 25761 STAMIN-2 Staminus Communications 29 15 48 4134 CHINANET-BACKBONE 29 3 90 13749 EVRY Everyones Internet 28 2 93 8972 INTERGENIA-ASN intergenia autonomou 28 4 86 3786 ERX-DACOMNET 27 10 63 13213 UK2NET-AS UK-2 Ltd Autonomous Syste 26 3 88 Top 20 ASNes by number of active suspect C&Cs. These counts are determined by the number of suspect domains or IPs located within the ASN completed a connection request. Percent_ ASN Responsible Party Total Open Resolved 13301 UNITEDCOLO-AS Autonomous System of 115 41 64 16265 LEASEWEB AS 58 40 31 174 Cogent Communications 40 30 25 23522 CIT-FOONET 49 29 41 30407 Velcom.com 25 24 4 4766 KIXS-AS-KR 65 22 66 30058 FDCSE FDCservers.net LLC 64 21 67 19318 NJIIX-AS-1 - NEW JERSEY INTERN 123 20 84 8560 SCHLUND-AS 37 18 51 19166 Alpha Red, INC 20 17 15 9121 TTNet 24 17 29 25761 STAMIN-2 Staminus Communications 29 15 48 3786 ERX-DACOMNET 27 10 63 3269 TELECOM ITALIA 32 9 72 28753 NETDIRECT AS NETDIRECT Frankfurt 16 9 44 7479 KDDHK-AS-AP KDD HONG KONG LIMITED 9 9 0 18942 WEBHO-3 WebHostPlus Inc 13 9 31 6140 ImpSat 9 8 11 7132 SBC Internet Services 36 7 81 9911 CONNECTPLUS-AP Singapore Telecom 9 7 22 Randal Vaughn Gadi Evron Professor ge at linuxbox.org Baylor University Waco, TX (254) 710 4756 randy_vaughn at baylor.edu

1 0