- NANOG - lists.nanog.org

Telia network degredation / POC
by Jeremy Chadwick 02 Jun '06

02 Jun '06

Does anyone have a contact number/POC of any sort for Telia that's within the United States? Jared's NOC list only contains a contact number in Sweden. It seems their network has been falling apart both within Sweden and the US since the raid on TPB (ThePirateBay.org) earlier today. Sure, it's probably kiddies as usual, but this is pretty major. Can anyone confirm/deny? Host Loss% Snt Rcv Last Avg Best Wrst StDev 1. gige-g6-0-19.gsr12012.fmt. 0.0% 119 119 0.3 0.3 0.2 0.6 0.1 2. pos1-0.gsr12416.fmt.he.net 0.0% 119 119 51.5 19.6 0.4 266.9 50.7 3. pos10-0.gsr12416.sjc2.he.n 0.8% 119 118 1.1 11.2 0.9 199.1 36.4 4. sjo-bb1-pos5-2-0.telia.net 19.3% 119 96 1.0 5.2 0.9 145.5 18.3 5. las-bb1-pos7-0-0-0.telia.n 36.4% 119 75 13.6 17.3 13.5 133.4 16.2 6. dsl-bb1-pos7-0-0.telia.net 56.4% 118 51 80.9 51.7 48.1 114.5 12.0 7. nyk-bb2-link.telia.net 82.1% 118 21 85.6 85.4 85.2 85.7 0.1 8. kbn-bb2-link.telia.net 53.8% 118 54 165.7 166.1 165.6 177.5 1.6 9. s-bb2-link.telia.net 52.1% 118 56 177.3 177.8 177.1 196.6 2.7 10. s-b4-pos5-0.telia.net 52.1% 118 56 177.3 184.2 177.2 318.2 26.1 11. hy-peer1-pos4-0.se.telia.n 52.1% 118 56 177.4 183.5 177.2 318.6 26.7 12. hy-c1-link.se.telia.net 52.1% 118 56 177.4 184.7 177.3 357.0 31.5 13. oes-b-c1-link.se.telia.net 53.0% 118 55 190.4 190.4 190.2 191.0 0.1 14. ll-d6-link.se.telia.net 52.1% 118 56 195.3 195.3 194.8 203.7 1.2 15. bd-a13-link.se.telia.net 53.0% 118 55 195.5 206.1 195.3 408.6 39.6 16. 213.65.248.233 52.1% 118 56 193.9 194.1 193.8 196.9 0.4 Thanks. -- | Jeremy Chadwick jdc at parodius.com | | Parodius Networking http://www.parodius.com/ | | UNIX Systems Administrator Mountain View, CA, USA | | Making life hard for others since 1977. PGP: 4BD6C0CB |

4 3

BGP Update Report
by cidr-report＠potaroo.net 02 Jun '06

02 Jun '06

BGP Update Report Interval: 19-May-06 -to- 01-Jun-06 (14 days) Observation Point: BGP Peering with AS4637 TOP 20 Unstable Origin AS Rank ASN Upds % Upds/Pfx AS-Name 1 - AS9121 23367 2.1% 48.3 -- TTNET TTnet Autonomous System 2 - AS17430 21873 2.0% 533.5 -- GWBN-CHENGDU Great Wall Broadband Network Service Co.,Ltd 3 - AS10139 18927 1.7% 61.3 -- MERIDIAN-PH-AP Meridian Telekoms 4 - AS2386 18290 1.7% 20.4 -- INS-AS - AT&T Data Communications Services 5 - AS17974 11228 1.0% 32.6 -- TELKOMNET-AS2-AP PT TELEKOMUNIKASI INDONESIA 6 - AS17557 10439 0.9% 26.4 -- PKTELECOM-AS-AP Pakistan Telecom 7 - AS4755 10414 0.9% 13.7 -- VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System 8 - AS855 10332 0.9% 18.7 -- CANET-ASN-4 - Aliant Telecom 9 - AS11492 9751 0.9% 19.8 -- CABLEONE - CABLE ONE 10 - AS18231 8453 0.8% 66.0 -- EXATT-AS-AP Exatt Technologies Private Ltd. 11 - AS8452 7056 0.6% 51.5 -- TEDATA TEDATA 12 - AS5803 6990 0.6% 81.3 -- DDN-ASNBLK - DoD Network Information Center 13 - AS23918 6655 0.6% 51.2 -- CBB-BGP-IBARAKI Connexion By Boeing Ibaraki AS 14 - AS9940 6572 0.6% 113.3 -- WOLCST-AS-AP World online AS, Cybersoft Technologies. 15 - AS3475 6485 0.6% 540.4 -- LANT-AFLOAT - NCTAMS LANT DET HAMPTON ROADS 16 - AS18207 6473 0.6% 30.2 -- BGBB-INDIA-AP Iqara Telecom India Pvt Ltd. 17 - AS33783 6370 0.6% 60.7 -- 18 - AS702 6197 0.6% 24.7 -- AS702 MCI EMEA - Commercial IP service provider in Europe 19 - AS12654 5821 0.5% 242.5 -- RIPE-NCC-RIS-AS RIPE NCC RIS Project. 20 - AS680 5692 0.5% 23.3 -- DFN-IP service G-WiN TOP 20 Unstable Origin AS (Updates per announced prefix) Rank ASN Upds % Upds/Pfx AS-Name 1 - AS4678 3341 0.3% 3341.0 -- FINE CANON NETWORK COMMUNICATIONS INC. 2 - AS21027 2860 0.3% 2860.0 -- ASN-PARADORES PARADORES Autonomous System 3 - AS36877 5133 0.5% 2566.5 -- 4 - AS19982 5350 0.5% 1337.5 -- TOWERSTREAM-PROV - Towerstream 5 - AS35379 2370 0.2% 1185.0 -- EASYNET EASYNET s.c. 6 - AS16705 1830 0.2% 915.0 -- STORAGEAPPS - Storage Apps Inc. 7 - AS34378 909 0.1% 909.0 -- RUG-AS Razguliay-UKRROS Group 8 - AS34974 821 0.1% 821.0 -- KAMCHATKA-AS OJSC 'Dalsvyaz' Kamchatka Branch 9 - AS34205 708 0.1% 708.0 -- MRBD-AS Far East Telecommunications Company 10 - AS36000 690 0.1% 690.0 -- NHA-ASN1 - Northern Health Authority 11 - AS36565 683 0.1% 683.0 -- COUNTY-OF-MONTGOMERY-PA - County of Montgomery 12 - AS14410 3352 0.3% 670.4 -- DALTON - MCM, Inc., DBA: Internet@Dalton 13 - AS35339 1336 0.1% 668.0 -- CZ-AS Clemens Zauner 14 - AS18173 602 0.1% 602.0 -- AKU-AS-PK Aga Khan University 15 - AS14548 583 0.1% 583.0 -- LISTEN-SF-1 - Listen.com 16 - AS3475 6485 0.6% 540.4 -- LANT-AFLOAT - NCTAMS LANT DET HAMPTON ROADS 17 - AS17430 21873 2.0% 533.5 -- GWBN-CHENGDU Great Wall Broadband Network Service Co.,Ltd 18 - AS21944 1598 0.1% 532.7 -- DTSI-1 - Data Technology Services Inc. 19 - AS23917 1065 0.1% 532.5 -- BRIBIE-NET-AS-AP Bribie Island Net Multihomed, Brisbane 20 - AS3043 3182 0.3% 530.3 -- AMPHIB-AS - Amphibian Media Corporation TOP 20 Unstable Prefixes Rank Prefix Upds % Origin AS -- AS Name 1 - 220.114.32.0/21 5739 0.4% AS17430 -- GWBN-CHENGDU Great Wall Broadband Network Service Co.,Ltd 2 - 211.162.88.0/21 5738 0.4% AS17430 -- GWBN-CHENGDU Great Wall Broadband Network Service Co.,Ltd 3 - 81.212.149.0/24 4045 0.3% AS9121 -- TTNET TTnet Autonomous System 4 - 81.212.141.0/24 3939 0.3% AS9121 -- TTNET TTnet Autonomous System 5 - 152.74.0.0/16 3897 0.3% AS11340 -- Red Universitaria Nacional 6 - 211.162.82.0/23 3361 0.3% AS17430 -- GWBN-CHENGDU Great Wall Broadband Network Service Co.,Ltd 7 - 211.162.84.0/22 3361 0.3% AS17430 -- GWBN-CHENGDU Great Wall Broadband Network Service Co.,Ltd 8 - 220.114.40.0/22 3361 0.3% AS17430 -- GWBN-CHENGDU Great Wall Broadband Network Service Co.,Ltd 9 - 61.0.0.0/8 3341 0.3% AS4678 -- FINE CANON NETWORK COMMUNICATIONS INC. 10 - 209.140.24.0/24 3157 0.2% AS3043 -- AMPHIB-AS - Amphibian Media Corporation 11 - 62.81.240.0/24 2860 0.2% AS21027 -- ASN-PARADORES PARADORES Autonomous System 12 - 195.175.82.0/23 2835 0.2% AS9121 -- TTNET TTnet Autonomous System 13 - 196.47.64.0/22 2629 0.2% AS36877 -- 14 - 196.47.68.0/22 2504 0.2% AS36877 -- 15 - 209.160.56.0/22 1991 0.1% AS14361 -- HOPONE-DCA - HopOne Internet Corporation 16 - 195.177.250.0/23 1660 0.1% AS1853 -- ACONET ACOnet Backbone AS35339 -- CZ-AS Clemens Zauner 17 - 206.251.163.0/24 1395 0.1% AS4314 -- I-55-INTERNET-SERVICES-INC - I-55 INTERNET SERVICES 18 - 81.212.197.0/24 1362 0.1% AS9121 -- TTNET TTnet Autonomous System 19 - 64.17.224.0/21 1341 0.1% AS19982 -- TOWERSTREAM-PROV - Towerstream 20 - 64.17.240.0/21 1339 0.1% AS19982 -- TOWERSTREAM-PROV - Towerstream Details at http://bgpupdates.potaroo.net ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org ausnog(a)ausnog.net

1 0

The Cidr Report
by cidr-report＠potaroo.net 02 Jun '06

02 Jun '06

This report has been generated at Fri Jun 2 21:49:05 2006 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 26-05-06 185408 122327 27-05-06 185664 122329 28-05-06 185822 122315 29-05-06 185797 122364 30-05-06 185865 122419 31-05-06 185897 122408 01-06-06 185849 122362 02-06-06 185948 122635 AS Summary 22257 Number of ASes in routing system 9324 Number of ASes announcing only one prefix 1478 Largest number of prefixes announced by an AS AS7018 : ATT-INTERNET4 - AT&T WorldNet Services 91481600 Largest address span announced by an AS (/32s) AS721 : DLA-ASNBLOCK-AS - DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 02Jun06 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 186160 122642 63518 34.1% All ASes AS4323 1299 267 1032 79.4% TWTC - Time Warner Telecom, Inc. AS4134 1190 285 905 76.1% CHINANET-BACKBONE No.31,Jin-rong Street AS18566 942 158 784 83.2% COVAD - Covad Communications Co. AS721 1011 312 699 69.1% DLA-ASNBLOCK-AS - DoD Network Information Center AS22773 658 47 611 92.9% CCINET-2 - Cox Communications Inc. AS6197 1010 482 528 52.3% BATI-ATL - BellSouth Network Solutions, Inc AS7018 1478 950 528 35.7% ATT-INTERNET4 - AT&T WorldNet Services AS19916 563 65 498 88.5% ASTRUM-0001 - OLM LLC AS855 553 64 489 88.4% CANET-ASN-4 - Aliant Telecom AS17488 514 46 468 91.1% HATHWAY-NET-AP Hathway IP Over Cable Internet AS3602 526 105 421 80.0% AS3602-RTI - Rogers Telecom Inc. AS9498 569 149 420 73.8% BBIL-AP BHARTI BT INTERNET LTD. AS18101 411 28 383 93.2% RIL-IDC Reliance Infocom Ltd Internet Data Centre, AS4755 866 487 379 43.8% VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System AS15270 427 50 377 88.3% AS-PAETEC-NET - PaeTec.net -a division of PaeTecCommunications, Inc. AS17676 486 110 376 77.4% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS11492 631 267 364 57.7% CABLEONE - CABLE ONE AS4766 657 307 350 53.3% KIXS-AS-KR Korea Telecom AS22047 418 78 340 81.3% VTR BANDA ANCHA S.A. AS812 368 29 339 92.1% ROGERS-CABLE - Rogers Cable Inc. AS6467 384 52 332 86.5% ESPIRECOMM - Xspedius Communications Co. AS19262 663 358 305 46.0% VZGNI-TRANSIT - Verizon Internet Services Inc. AS16852 352 50 302 85.8% FOCAL-CHICAGO - Focal Data Communications of Illinois AS8151 706 407 299 42.4% Uninet S.A. de C.V. AS16814 330 50 280 84.8% NSS S.A. AS3352 309 30 279 90.3% TELEFONICA-DATA-ESPANA Internet Access Network of TDE AS14654 292 15 277 94.9% WAYPORT - Wayport AS5668 529 253 276 52.2% AS-5668 - CenturyTel Internet Holdings, Inc. AS6198 509 242 267 52.5% BATI-MIA - BellSouth Network Solutions, Inc AS9583 894 631 263 29.4% SIFY-AS-IN Sify Limited Total 19545 6374 13171 67.4% Top 30 total Possible Bogus Routes 24.246.0.0/17 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 24.246.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 61.4.64.0/20 AS9929 CNCNET-CN China Netcom Corp. 64.17.32.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.33.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.37.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 66.11.32.0/20 AS6261 VISINET - Visionary Systems, Inc. 66.37.96.0/20 AS3764 IA-HOU-AS - Internet America, Inc. 66.51.134.0/24 AS29876 LNTC - Latency LLC 66.96.0.0/20 AS3770 WORLDPATH-AS - WorldPath Internet Services 66.117.8.0/24 AS174 COGENT Cogent/PSI 66.163.96.0/20 AS25767 WAVEFORM - Waveform Technology, LLC 66.187.96.0/24 AS10026 ANC Asia Netcom Corporation 66.187.108.0/24 AS10026 ANC Asia Netcom Corporation 66.187.109.0/24 AS10026 ANC Asia Netcom Corporation 66.235.158.0/23 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 69.31.151.0/24 AS26627 AS-PILOSOFT - Pilosoft, Inc. 69.39.193.0/24 AS25973 MZIMA - Mzima Networks, Inc. 69.39.195.0/24 AS25973 MZIMA - Mzima Networks, Inc. 69.39.196.0/24 AS25973 MZIMA - Mzima Networks, Inc. 91.192.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 91.255.248.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 125.213.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 131.64.0.0/12 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 132.0.0.0/10 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 137.0.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 138.136.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 151.135.0.0/16 AS4763 TELSTRANZ-AS TelstraClear Ltd 158.0.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 163.142.0.0/16 AS2500 JPNIC-ASBLOCK-AP JPNIC 183.206.196.0/24 AS2188 FR-RENATER-ASTER Reseau Regional ASTER 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.40.105.0/24 AS12582 TSF-DATANET-NGD-AS TSF MPLS VPN Services 192.69.107.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.69.108.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.69.177.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.70.164.0/24 AS25689 NRCNET-AS - National Research Council of Canada 192.81.183.0/24 AS719 ELISA-AS Elisa Oyj 192.81.184.0/24 AS719 ELISA-AS Elisa Oyj 192.88.99.0/24 AS16150 PORT80-GLOBALTRANSIT Port80 AB, Sweden 192.96.36.0/24 AS5713 AFRINIC African Network Information Center 192.96.37.0/24 AS10474 AFRINIC African Network Information Center 192.96.135.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.136.0/23 AS2018 TENET - 1 - The Uninet Project 192.96.140.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.143.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.145.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.177.0/24 AS6083 POSIX-AFRICA Posix Systems 192.96.250.0/24 AS2018 TENET - 1 - The Uninet Project 192.107.104.0/24 AS6458 GUATEL 192.122.212.0/24 AS209 ASN-QWEST - Qwest 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS10282 EQUANT-CEEUR EQUANT AS for Central and Eastern Europe region 192.153.144.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 192.168.255.255/32 AS4637 REACH Reach Network Border AS 192.172.0.0/19 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 192.188.208.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 193.36.1.0/24 AS8220 COLT COLT Telecommunications 193.37.69.0/24 AS2856 BT-UK-AS BTnet UK Regional network 193.110.77.0/24 AS3356 LEVEL3 Level 3 Communications 193.110.78.0/24 AS3356 LEVEL3 Level 3 Communications 193.110.79.0/24 AS3356 LEVEL3 Level 3 Communications 194.31.227.0/24 AS21461 TRANSFAIRNET Transfair-net GmbH Krefeld 194.59.176.0/20 AS1273 CW Cable & Wireless 194.153.156.0/24 AS24865 KMITCHELL-AS Keith Mitchell's Network 194.156.206.0/24 AS4589 EASYNET Easynet Group Plc 194.246.72.0/23 AS8893 ARTFILES-AS Artfiles New Media GmbH 195.246.216.0/22 AS15622 MEOCOM old meocom Autonomous System 198.23.26.0/24 AS4390 BELLATLANTIC-COM - Bell Atlantic, Inc. 198.54.82.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.92.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.222.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.249.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.250.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.251.0/24 AS2018 TENET - 1 - The Uninet Project 198.97.72.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.80.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.96.0/19 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.240.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.101.4.0/22 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.136.32.0/20 AS19329 MCNET - Martin County Board of County Commissioners 198.161.87.0/24 AS6539 GT-BELL - Bell Canada 198.163.155.0/24 AS684 MTSAL-ASN - MTS Allstream Inc. 198.167.0.0/16 AS7456 INTERHOP - Interhop Network SERVICES Inc. 198.168.0.0/16 AS701 ALTERNET-AS - UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASKTEL - SaskTel 198.199.198.0/24 AS13671 VRIS-AS-BLOCK-13661-13675 - Verizon Internet Services Inc. 198.232.133.0/24 AS23075 SKOTOS-AS - Skotos Tech, Inc 199.9.128.0/17 AS668 ASN-ASNET-NET-AS - Defense Research and Engineering Network 199.10.0.0/16 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.60.0.0/20 AS271 BCNET-AS - University of British Columbia 199.114.0.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.128.0/18 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.130.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.132.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.134.0/24 AS3541 ITSDN-U4 - DISA/UNRRA 199.114.136.0/24 AS27044 DDN-ASNBLK1 - DoD Network Information Center 199.114.138.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.140.0/24 AS3544 ITSDN-U7 - DISA/UNRRA 199.114.142.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.144.0/24 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.114.148.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.150.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.152.0/24 AS27033 DDN-ASNBLK1 - DoD Network Information Center 199.114.153.0/24 AS27034 DDN-ASNBLK1 - DoD Network Information Center 199.114.154.0/24 AS3542 ITSDN-U5 - DISA/UNRRA 199.114.160.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.121.0.0/16 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.0.0/18 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.16.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.80.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST-AS - IQuest Internet 199.202.0.0/16 AS701 ALTERNET-AS - UUNET Technologies, Inc. 199.246.116.0/24 AS813 UUNET-AS1 - UUNET Technologies, Inc. 202.9.64.0/19 AS9290 TPN-AS-AP Smart Global Network (M) Sdn Bhd 202.45.159.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.58.113.0/24 AS19161 INNOCOM-TELECOM - INNOCOM TELECOM 202.86.252.0/22 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.253.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.254.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.255.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.90.33.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.40.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.41.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.42.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.43.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.44.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.124.192.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.193.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.194.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.195.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.196.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.197.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.198.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.199.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.200.0/22 AS15412 FLAG-AS Flag Telecom Global Internet AS 202.124.204.0/24 AS15412 FLAG-AS Flag Telecom Global Internet AS 202.124.205.0/24 AS15412 FLAG-AS Flag Telecom Global Internet AS 202.124.206.0/24 AS15412 FLAG-AS Flag Telecom Global Internet AS 202.124.207.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.131.64.0/19 AS9381 NEWTT-IP-AP Wharf T&T Ltd. 202.148.32.0/20 AS17495 GATEWAY-AP BROADBAND WIRELESSS INTERNET SERVICE PROVIDER 202.164.100.0/24 AS18101 RIL-IDC Reliance Infocom Ltd Internet Data Centre, 203.13.171.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 203.62.0.0/17 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet) 203.78.48.0/20 AS9299 IPG-AS-AP Philippine Long Distance Telephone Company 203.89.134.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.139.0/24 AS17911 BRAINPK-AS-AP Brain Telecommunication Ltd. 203.89.143.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.144.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.147.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.148.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.149.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.150.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.151.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.153.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.158.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.159.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.99.142.0/24 AS9826 ILINK-HK-AP iLink.net Ltd 203.111.192.0/20 AS7473 SINGTEL-AS-AP Singapore Telecom 204.29.185.0/24 AS7268 ATHENET - Athenet Internet Services 204.48.118.0/23 AS29912 CITIZENS-PROPERTY-INSURANCE-CORPORATION - Citizens Property Insurance Corporation 204.48.119.0/24 AS29912 CITIZENS-PROPERTY-INSURANCE-CORPORATION - Citizens Property Insurance Corporation 204.153.104.0/24 AS10913 INTERNAP-BLK - Internap Network Services 204.153.106.0/24 AS10913 INTERNAP-BLK - Internap Network Services 204.153.107.0/24 AS10913 INTERNAP-BLK - Internap Network Services 204.154.125.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 205.150.0.0/15 AS701 ALTERNET-AS - UUNET Technologies, Inc. 206.128.104.0/21 AS11709 VIC - VIRTUAL INTERACTIVE CENTER 206.167.57.0/24 AS376 RISQ-AS - Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 206.191.96.0/19 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 207.231.96.0/19 AS11194 NUNETPA - NuNet Inc 208.67.172.0/22 AS10451 WARPDRIVE - Warpdrive Networks 209.40.192.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.200.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.208.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.216.0/21 AS6487 CyberNet de Guatemala S.A. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.234.0.0/18 AS3845 STATE-NET - CS&W, Inc. 216.37.110.0/23 AS4264 CERNET-ASN-BLOCK - California Education and Research Federation Network 216.71.224.0/20 AS23527 COTELLIGENCE - Cotelligence, Inc. 216.201.72.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.73.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.74.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.75.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.76.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.77.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.78.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.79.0/24 AS14709 Telefonica Moviles Panama S.A. 216.228.64.0/21 AS6295 WHIDBEY1 - Whidbey Internet Services 216.228.224.0/20 AS13674 VRIS-AS-BLOCK-13661-13675 - Verizon Internet Services Inc. 216.240.240.0/20 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.240.242.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org ausnog(a)ausnog.net

1 0

Cisco ACL question
by Jon R. Kibler 01 Jun '06

01 Jun '06

Greetings All, Sorry for the slightly off-topic question, but I suspect that this is an issue that others have faced or may soon face as ISP continue to push out more PPP-oriented networks. One of our customer's ISP is converting from static IP assignments to PPP IP assignments for all customers' Internet facing routers. This is creating a security problem that I do not know how to fix and for which the ISP is no help. Problem: how to ACL on a dynamic IP? Assume that we have the following (partial) configuration on a Cisco 2801 and are assigned the static netblock 1.2.3.0/29. This was what worked before the ISP made the change. ! Old config example interface serial0/2/0 ip address 1.2.3.1 255.255.255.248 ip nat outside ip access-group 110 in ... interface fastethernet0/0 ip address 172.17.100.254 255.255.255.0 ip nat inside ... ip nat pool localstatic 1.2.3.2 1.2.3.2 prefix 29 ip nat inside source list 1 pool localstatic overload ip nat inside source static tcp 172.17.100.22 22 1.2.3.5 12322 ip nat inside source static ... access-list 1 permit 172.17.100.0 0.0.0.255 access-list 1 deny any log access-list 110 permit tcp any 1.2.3.0 0.0.0.7 established access-list 110 permit tcp host a.b.c.d host 1.2.3.5 eq 12322 access-list 110 deny tcp any any log access-list 110 permit udp host d.n.s.1 eq 53 host 1.2.3.2 access-list 110 permit udp host d.n.s.1 host 1.2.3.2 eq 53 access-list 110 permit udp host n.t.p.1 eq 123 1.2.3.2 access-list 110 deny udp any any log access-list 110 permit icmp any host 1.2.3.2 echo-reply access-list 110 permit icmp any host 1.2.3.2 unreachable access-list 110 permit icmp any host 1.2.3.2 time-exceeded access-list 110 deny icmp any any log access-list 110 deny ip any any log In the new configuration, the serial0/2/0 interface now has a dynamic IP. How can I put ACLs on that IP that will permit NTP, DNS, and ICMP originating from within the router to work? Everything behind the router works, but anything generated by the router itself breaks (because the external IP is not permitted in an ACL). In the new configuration, this is the only change I made (other than PPP stuff): ! New config example interface serial0/2/0 ip address negotiated ip nat outside ip access-group 110 in ... Everything from behind the router continues to work fine. However, the router is unable to do NS lookups, set time, etc. Basically, all traffic to the dynamic IP is blocked. Is there a SIMPLE way to fix this problem AND keep the router secured? I have searched the Cisco site, and Google, and cannot seem to find an answer that I can fully comprehend. I thought that maybe 'ip nat outside' was my fix, but I could not get it to do what I expected. Thanks in advance for your help! Jon Kibler -- Jon R. Kibler Chief Technical Officer A.S.E.T., Inc. Charleston, SC USA (843) 849-8214 ================================================== Filtered by: TRUSTEM.COM's Email Filtering Service http://www.trustem.com/ No Spam. No Viruses. Just Good Clean Email.

2 1

Control Plane Policing
by hjan 01 Jun '06

01 Jun '06

Hello, I have read cisco's doc about cpp and i've also read the good documentation written by John Kristoff about cpp in wich are included some implementation example. I do some test in our lab environment, a GSR 12410 with IOS 12.0(32)S2 but i'm not satisfied with the result. Suppose this sample conf: access-list 168 permit icmp any loopback0 0.0.0.0 access-list 169 permit any class-map cp-icmp match access-group 168 class-map cp-default match access-group 169 policy-map cp-traffic class cp-icmp police 8000 conform-action transmit exceed-action drop class cp-default priority control-plane service-policy input cp-traffic Then i ping from a host or a router the loopback0 and i noticed that only if i set an MTU or packet size > 1500, in fact 1480 so with the standar ip header is always 1500, the policy take effect. In fact if i issue the sh policy-map control-plane with small packet size all traffic seems to be matched by the cp-default class: Service-policy input: cp-traffic (225) Class-map: cp-icmp (match-all) (4925921/1) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: access-group 168 (15210210) police: cir 8000 bps, bc 4470 bytes conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop conformed 0 bps, exceed 0 bps Class-map: cp-default (match-all) (14530241/2) 151 packets, 11967 bytes 5 minute offered rate 2000 bps, drop rate 0 bps Match: access-group 3 (1872818) Class-map: class-default (match-any) (9318433/0) 3149 packets, 333931 bytes 5 minute offered rate 1000 bps, drop rate 0 bps Match: any (4397474) Instead with a greater size: Class-map: cp-icmp (match-all) (4925921/1) 22 packets, 16896 bytes 5 minute offered rate 2000 bps, drop rate 0 bps Match: access-group 168 (15210210) police: cir 8000 bps, bc 4470 bytes conformed 20 packets, 13888 bytes; actions: transmit exceeded 2 packets, 3008 bytes; actions: drop conformed 2000 bps, exceed 0 bps Is there anyone with some idea or anyone that can share experience with me ? Thanks Gianluca Italy

2 1

Drone Armies C&C Report - 31 May 2006
by c2report＠isotf.org 31 May '06

31 May '06

This is a periodic public report from the ISOTF's affiliated group 'DA' (Drone Armies (botnets) research and mitigation mailing list / TISF DA) with the ISOTF affiliated ASreport project (TISF / RatOut). For this report it should be noted that we base our analysis on the data we have accumulated from various sources, which may be incomplete. Any responsible party that wishes to receive reports of botnet command and control servers on their network(s) regularly and directly, feel free to contact us. For purposes of this report we use the following terms open the host completed the TCP handshake closed No activity detected reset issued a RST This month's survey is of 3151 unique, domains (or IPs) with port suspect C&Cs. This list is extracted from the BBL which has a historical base of 10115 reported C&Cs. Of the suspect C&Cs surveyed, 649 reported as Open, 935 reported as closed, and 569 issued resets to the survey instrument. Of the C&Cs listed by domain name in the our C&C database, 4666 are mitigated. Top 20 ASNes by Total suspect domains mapping to a host in the ASN. These numbers are determined by counting the number of domains which resolve to a host in the ASN. We do not remove duplicates and some of the ASNs reported have many domains mapping to a single IP. Note the Percent_resolved figure is calculated using only the Total and Open counts and does not represent a mitigation effectiveness metric. Percent_ ASN Responsible Party Total Open Resolved 13301 UNITEDCOLO-AS Autonomous System of 54 27 50 19318 AIC-81 Albany International Corp. 49 14 71 4134 CHINANET-BACKBONE 37 16 57 23522 CIT-FOONET 35 20 43 8972 INTERGENIA-ASN intergenia autonomou 35 17 51 4766 KIXS-AS-KR 32 7 78 4314 IIS-64 I-55 INTERNET SERVICES 28 1 96 4837 CHINA169-Backbone 27 8 70 30315 Everyones Internet 25 11 56 33597 InfoRelay Online Systems, Inc. 24 0 100 7132 SBC Internet Services 24 5 79 9318 HANARO-AS 24 8 67 3561 Savvis 23 3 87 8560 SCHLUND-AS 22 5 77 13749 EVRY Everyones Internet 22 2 91 13213 UK2NET-AS UK-2 Ltd Autonomous Syste 20 0 100 29073 COLINKS-AS Colinks web and game hos 19 13 32 27595 ATRIV Atrivo 19 3 84 3462 HINET 19 7 63 21840 SAGONE Sago Networks 18 3 83 Top 20 ASNes by number of active suspect C&Cs. These counts are determined by the number of suspect domains or IPs located within the ASN completed a connection request. Percent_ ASN Responsible Party Total Open Resolved 13301 UNITEDCOLO-AS Autonomous System of 54 27 50 23522 CIT-FOONET 35 20 43 8972 INTERGENIA-ASN intergenia autonomou 35 17 51 4134 CHINANET-BACKBONE 37 16 57 13237 LAMBDANET-AS 18 14 22 19318 AIC-81 Albany International Corp. 49 14 71 29073 COLINKS-AS Colinks web and game hos 19 13 32 30315 Everyones Internet 25 11 56 174 Cogent Communications 16 10 38 9318 HANARO-AS 24 8 67 4837 CHINA169-Backbone 27 8 70 3269 TELECOM ITALIA 12 7 42 3462 HINET 19 7 63 4766 KIXS-AS-KR 32 7 78 19262 Verizon Internet Services 14 7 50 12322 PROXAD AS for Proxad ISP 6 6 0 28753 NETDIRECT AS NETDIRECT Frankfurt 8 6 25 16265 LEASEWEB AS 11 6 45 3786 ERX-DACOMNET 9 6 33 9600 SONY CORPORATION 7 6 14 Randal Vaughn Gadi Evron Professor ge at linuxbox.org Baylor University Waco, TX (254) 710 4756 randy_vaughn at baylor.edu

1 0

apops sep 4-8 kaohsiung, taiwan
by Randy Bush 31 May '06

31 May '06

apops and apnic will meet 2006.09.04-08 in kaohsiung, taiwan, see <http://www.apnic.net/meetings/22/index.html> the technical-but-not-policy content that used to be in the apnic sigs is being moved to the apops part of the meeting. this should make for a more ops/research-fun nanog-like event. any ops or research folk who are going, or might be, and would be willing to present, it would be much appreciated. randy

1 0

Re: Black Frog - the botnets keep coming
by Fergie 30 May '06

30 May '06

Sorry, this is not acceptable, regardless of national boundaries. And it will be fought against, regardless of where it originates, or resides. Always. I do not condone collateral damage strategies in this regard, but suggesting that a "wild, wild west" Internet is something that will be a contimuum -- it cannot be, and will not be. As such, I also do not condone such activities as Blue/Black Frog suggest, as it is completely contrary to established practices of mitigation (and removal). - ferg p.s. Now if we could only get the registries onboard... -- "Alexei Roudnev" <alex(a)relcom.net> wrote: Internet IS a wild west. You should live with it. It will never be _quet, dead american's residential area, where dogs do not bark and kids do not play themself on streets in age of 8 (normal dogs bark, and normal kids often play themself when they are 8)_. It is the whole WORLD, not one country. So, we must live with it, and do not hope, that it will have numerous _speed tickets_ and _police officers_ (as 90% of the people live every day, making their own decisions and protecting themselves. It is, in fact, a very effectiv way to stop spammers. But it definitely became a dangerous DDOS service. So - learn how to live with it, it's the only choice. (Make sure, that no single protocol or botnet can kill the whole network or deplete all resources, for example). [snip] -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

4 4

Fwd: 41/8 announcement
by Richard Mikisa 30 May '06

30 May '06

This came in from someone in Italy.. ---------- Forwarded message ---------- From: ***** Date: May 24, 2006 11:15 AM Subject: Re: 41/8 announcement To: rmikisa(a)gmail.com > >Turns out the folks at fastweb (Italy) NAT there adsl clients but > >instead of using the rfc1918 space like most people, they use > >unassigned > >global /8s. Well 41/8 is one of there NATted allocations for Turin. No > >amount of emails will get them to respond, calling isn't any better > >as I > >get only Italian speaking people at the other end. Any ideas out > >there? Yes: you lose, sorry. :-) Many of their networking people are less than clueful, and I fear that they are not going to renumber a whole city just to let their customers communicate with a few African networks... Let me know if you need more information. (Feel free to repost this if needed, but please remove my name.) -- ciao, ******* -- cheers Richard

11 13

Are botnets relevant to NANOG?
by Michael.Dillon＠btradianz.com 30 May '06

30 May '06

In recent discussions about botnets, some people maintained that botnets (and viruses and worms) are really not a relevant topic for NANOG discussion and are not something that we should be worried about. I think that the CSI and FBI would disagree with that. In a press release announcing the last CSI/FBI survey http://www.gocsi.com/press/20050714.jhtml the following statement appears: Highlights of the 2005 Computer Crime and Security Survey include: - The total dollar amount of financial losses resulting from security breaches is decreasing, with an average loss of $204,000 per respondent-down 61 percent from last year's average loss of $526,000. - Virus attacks continue as the source of the greatest financial losses, accounting for 32 percent of the overall losses reported. - Unauthorized access showed a dramatic increase and replaced denial of service as the second most significant contributor to computer crime losses, accounting for 24 percent of overall reported losses, and showing a significant increase in average dollar loss. So where do botnets come in? First of all, botnets are used to distribute viruses, the largest source of financial losses. Second, botnets are built on what the CSI calls "unauthorised access", the second largest source of loss. And denial of service, which used to be the 2nd largest, is also something that botnets do. Now NANOG members cannot change OS security, they can't change corporate security practices, but they can have an impact on botnets because this is where the nefarious activity meets the network. Therefore, I conclude that discussions of botnets do belong on the NANOG list as long as the NANOG list is not used as a primary venue for discussing them. One thing that surveys, such as the CSI/FBI Security Survey, cannot do well is to measure the impact of botnet researchers and the people who attempt to shut down botnets. It's similar to the fight against terrorism. I know that there have been 2 terrorist attacks on London since 9/11 but I don't know HOW MANY ATTACKS HAVE BEEN THWARTED. At least two have been publicised but there could be dozens more. Cleaning up botnets is rather like fighting terrorism. At the end, you have nothing to show for it. No news coverage, no big heaps of praise. Most people aren't sure there was ever a problem to begin with. That doesn't mean that the work should stop or that network providers should withold their support for cleaning up the botnet problem. ------------------------------------------------------- Michael Dillon Capacity Management, 66 Prescot St., London, E1 8HG, UK Mobile: +44 7900 823 672 Internet: michael.dillon(a)btradianz.com Phone: +44 20 7650 9493 Fax: +44 20 7650 9030 http://www.btradianz.com One Community One Connection One Focus

6 11