- NANOG - lists.nanog.org

Re: Are botnets relevant to NANOG?
by Fergie 30 May '06

30 May '06

Not effective against botnets. Think of it this way, thousands of compromised hosts (zombies), distributed to the four corners of the Internet, hundreds (if not thousands) of AS's -- all recieving their instructions via IRC from a C&C server somewhere, that probably also may change due to dynamic DNS, or pump-and-dump domain registrations, or any other various ways to continually move the C&C. Simply going after (what may _seem_to_be_) the last-hop router is like swinging a stick after a piñata that you can't actually reach when you are blind-folded. :-) - ferg -- Peter Dambier <peter(a)peter-dambier.de> wrote: Just an afterthought, traceroute and take the final router. I guess for aDSL home users you will find some 8 or 11 routers in germany. My final router never changes. Of course there can hide more than one bad guy behind that router. [snip] -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

6 7

in.dnsbl.org must not be used for mail filtering
by Mark Jeftovic 29 May '06

29 May '06

in.dnsbl.org was created several years ago for commercial DNS providers to share information about problem domains and to offer a mechanism to prevent abusers from hopping from DNS provider to provider. Under no circumstances should it be used by any MTA for mail filtering in any capacity whatsoever. Absolutely no vetting goes into in.dnsbl.org listing and domains can get listed for internal reasons which are purely meaningless in an email context. Over the years some big name domains have wound up in the in.dnsbl.org zone for reasons which have absolutely nothing to do with email and simply for inter-provider communications between the DNSBL.org members. In short, using in.dnsbl.org on any MTA is an act of mind-numbing recklessness. Don't do it. Thank you for your time. -mark -- Mark Jeftovic <markjr(a)easydns.com> Founder & President, easyDNS Technologies Inc. ph. +1-(416)-535-8672 ext 225 fx. +1-(866) 273-2892

1 0

PSTN Breakout/Breakin hosting service
by shashi.pkumar＠wipro.com 29 May '06

29 May '06

Hi, Service providers who host PSTN break-out/Break-in services i.e., service providers who accepts SIP traffic from another hosted/Private network and provide PSTN breakout functionality and visa versa, please contact me offline. Thanks Shashi The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

Re: Botnet List Discussed on NANOG
by Peter Dambier 29 May '06

29 May '06

Hi Sat, your mailer does not like me. If it is interesting for you, please forward. Kind regards Peter and Karin Dambier <Bianca.Miller(a)telecom.co.nz>: 146.171.13.195_does_not_like_recipient. /Remote_host_said:_554_Service_unavailable; _Client_host_[213.165.64.20]_blocked_using_dnsbl.sorbs.net; _Spam_Received_See: _http://www.sorbs.net/lookup.shtml?213.165.64.20/Giving_up_on_146.171.13.19… Sat Mandri wrote: > > > Hi Rick & Peter > > > > We at Telecom NZ/Xtra are quite keen to learn from you guys how the > following Statistical Data on “Botnet” was gathered and what’s the > initiative driving it. > > > > We look forward to hearing from you guys on this matter. > > > > Kind Regards > > Sat Mandri > > > > ---------- Forwarded message ---------- > > Date: Fri, 26 May 2006 10:21:10 -0700 > > From: Rick Wesson <wessorh(a)ar.com> > > To: peter(a)peter-dambier.de > > Cc: nanog(a)merit.edu > > Subject: Re: Are botnets relevant to NANOG? > > > > > > > >> Some people need whatever bandwidth they can get for ranting. > >> Of course routing reports, virus reports and botnet bgp statistics > >> take away a lot of valuable bandwidth that could otherwise be used > >> for nagging. On the other hand without Gadi's howling for the > >> wolves those wolves might be lost species and without the wolves > >> all the nagging and ranting would make less fun. > > > > lets see, should we be concerned? here are a few interesting tables, the > > cnt column is new IP addresses we have seen in the last 5 days. The > > first table is Tier-2 ASNs as classified by Fontas's ASN Taxonomy paper > > [1] The second table is Universities. The ASN concerned are just in the > > announced by orgs in USA as to imply that they should be on NANOG. > > > > Let me say it again the counts are NEW observations in the last 5 days. > > also note I'm not Gati, and I've got much more data on everyones networks. > > > > -rick > > > > > > New compromised unique IP addresses (last 5 days) Tier-2 ASN > > +-------+------------------------------------+-------+ > > | asnum | asname | cnt | > > +-------+------------------------------------+-------+ > > | 19262 | Verizon Internet Services | 35790 | > > | 20115 | Charter Communications | 4453 | > > | 8584 | Barak AS | 3930 | > > | 5668 | CenturyTel Internet Holdings, Inc. | 2633 | > > | 12271 | Road Runner | 2485 | > > | 22291 | Charter Communications | 2039 | > > | 8113 | VRIS Verizon Internet Services | 1664 | > > | 6197 | BellSouth Network Solutions, Inc | 1634 | > > | 6198 | BellSouth Network Solutions, Inc | 1531 | > > | *9325 | XTRA-AS Telecom XTRA, Auckland | 1415* | > > | 11351 | Road Runner | 1415 | > > | 6140 | ImpSat | 1051 | > > | 7021 | Verizon Internet Services | 961 | > > | 6350 | Verizon Internet Services | 945 | > > | 19444 | CHARTER COMMUNICATIONS | 845 | > > +-------+------------------------------------+-------+ > > > > Universities, new unique ip last 5 days > > +-------+--------------------------------+-----+ > > | asnum | left(asname,30) | cnt | > > +-------+--------------------------------+-----+ > > | 14 | Columbia University | 93 | > > | 3 | MIT-2 Massachusetts Institute | 45 | > > | 73 | University of Washington | 25 | > > | 7925 | West Virginia Network for Educ | 24 | > > | 4385 | RIT-3 Rochester Institute of T | 20 | > > | 23369 | SCOE-5 Sonoma County Office of | 19 | > > | 5078 | Oklahoma Network for Education | 18 | > > | 3388 | UNM University of New Mexico | 18 | > > | 55 | University of Pennsylvania | 13 | > > | 159 | The Ohio State University | 12 | > > | 104 | University of Colorado at Boul | 12 | > > | 4265 | CERFN California Education and | 11 | > > | 693 | University of Notre Dame | 10 | > > | 2900 | Arizona Tri University Network | 9 | > > | 2637 | Georgia Institute of Technolog | 9 | > > +-------+--------------------------------+-----+ > > > > > > > > [1] http://www.ece.gatech.edu/research/labs/MANIACS/as_taxonomy/ > > > > > > > -- Peter and Karin Dambier Cesidian Root - Radice Cesidiana Graeffstrasse 14 D-64646 Heppenheim +49(6252)671-788 (Telekom) +49(179)108-3978 (O2 Genion) +49(6252)750-308 (VoIP: sipgate.de) mail: peter(a)peter-dambier.de mail: peter(a)echnaton.serveftp.com http://iason.site.voila.fr/ https://sourceforge.net/projects/iason/

1 0

Re: Botnet List Discussed on NANOG
by Peter Dambier 29 May '06

29 May '06

Sat Mandri wrote: > > > Hi Rick & Peter > > > > We at Telecom NZ/Xtra are quite keen to learn from you guys how the > following Statistical Data on “Botnet” was gathered and what’s the > initiative driving it. > > > > We look forward to hearing from you guys on this matter. > > > > Kind Regards > > Sat Mandri Hi Sat, I built IASON to check and protect computer centres against attackers. The first thing IASON did was analyzing logs on routers, switches and everything. Next step might be tuning firewalls and switches, if need be, isolating devices from the net. http://iason.site.voila.fr/ http://www.kokoom.com/iason/ I still have a little trouble with https://sourceforge.net/projects/iason/ Taking parts of IASON you can adapt it to count anything, like: Whenever a firewall, an xinetd or or somebody else, sees activity on a port that is known to be notorious for a bot then count and remember that ip-address. That is a crude one but it gives you an overview. With tools like IASON, you could analyze your findings for repeating patterns. Now you can identify the bots even after they change ip-addresses. Why did I build IASON in the first place? Working for companies like GLC, Global Center and Exodus I got tired of watching people in the NOC doing the same thing again and again for hours. Their expertise was not knowledge but pure typing speed. IASON can type much faster and he even has time to read the logs. With the core of IASON programmed in prolog it might even get a clue :) Cheers Peter and Karin > > > > ---------- Forwarded message ---------- > > Date: Fri, 26 May 2006 10:21:10 -0700 > > From: Rick Wesson <wessorh(a)ar.com> > > To: peter(a)peter-dambier.de > > Cc: nanog(a)merit.edu > > Subject: Re: Are botnets relevant to NANOG? > > > > > > > >> Some people need whatever bandwidth they can get for ranting. > >> Of course routing reports, virus reports and botnet bgp statistics > >> take away a lot of valuable bandwidth that could otherwise be used > >> for nagging. On the other hand without Gadi's howling for the > >> wolves those wolves might be lost species and without the wolves > >> all the nagging and ranting would make less fun. > > > > lets see, should we be concerned? here are a few interesting tables, the > > cnt column is new IP addresses we have seen in the last 5 days. The > > first table is Tier-2 ASNs as classified by Fontas's ASN Taxonomy paper > > [1] The second table is Universities. The ASN concerned are just in the > > announced by orgs in USA as to imply that they should be on NANOG. > > > > Let me say it again the counts are NEW observations in the last 5 days. > > also note I'm not Gati, and I've got much more data on everyones networks. > > > > -rick > > > > > > New compromised unique IP addresses (last 5 days) Tier-2 ASN > > +-------+------------------------------------+-------+ > > | asnum | asname | cnt | > > +-------+------------------------------------+-------+ > > | 19262 | Verizon Internet Services | 35790 | > > | 20115 | Charter Communications | 4453 | > > | 8584 | Barak AS | 3930 | > > | 5668 | CenturyTel Internet Holdings, Inc. | 2633 | > > | 12271 | Road Runner | 2485 | > > | 22291 | Charter Communications | 2039 | > > | 8113 | VRIS Verizon Internet Services | 1664 | > > | 6197 | BellSouth Network Solutions, Inc | 1634 | > > | 6198 | BellSouth Network Solutions, Inc | 1531 | > > | *9325 | XTRA-AS Telecom XTRA, Auckland | 1415* | > > | 11351 | Road Runner | 1415 | > > | 6140 | ImpSat | 1051 | > > | 7021 | Verizon Internet Services | 961 | > > | 6350 | Verizon Internet Services | 945 | > > | 19444 | CHARTER COMMUNICATIONS | 845 | > > +-------+------------------------------------+-------+ > > > > Universities, new unique ip last 5 days > > +-------+--------------------------------+-----+ > > | asnum | left(asname,30) | cnt | > > +-------+--------------------------------+-----+ > > | 14 | Columbia University | 93 | > > | 3 | MIT-2 Massachusetts Institute | 45 | > > | 73 | University of Washington | 25 | > > | 7925 | West Virginia Network for Educ | 24 | > > | 4385 | RIT-3 Rochester Institute of T | 20 | > > | 23369 | SCOE-5 Sonoma County Office of | 19 | > > | 5078 | Oklahoma Network for Education | 18 | > > | 3388 | UNM University of New Mexico | 18 | > > | 55 | University of Pennsylvania | 13 | > > | 159 | The Ohio State University | 12 | > > | 104 | University of Colorado at Boul | 12 | > > | 4265 | CERFN California Education and | 11 | > > | 693 | University of Notre Dame | 10 | > > | 2900 | Arizona Tri University Network | 9 | > > | 2637 | Georgia Institute of Technolog | 9 | > > +-------+--------------------------------+-----+ > > > > > > > > [1] http://www.ece.gatech.edu/research/labs/MANIACS/as_taxonomy/ > > > > > > > -- Peter and Karin Dambier Cesidian Root - Radice Cesidiana Graeffstrasse 14 D-64646 Heppenheim +49(6252)671-788 (Telekom) +49(179)108-3978 (O2 Genion) +49(6252)750-308 (VoIP: sipgate.de) mail: peter(a)peter-dambier.de mail: peter(a)echnaton.serveftp.com http://iason.site.voila.fr/ https://sourceforge.net/projects/iason/

1 0

Re: Fwd: 41/8 announcement
by hjan＠libero.it 27 May '06

27 May '06

> How was that achieved if their users still are within 41/8 >locally? Route filter and PBR. hjan

2 1

Black Frog - the botnets keep coming
by Gadi Evron 27 May '06

27 May '06

http://news.google.com/news?q=black+frog How do we make this folly stop? Now that these kids showed up with the Blue Security bsuiness plan plus a non-working anti-ddos idea (P2P), how long until the other 10 kiddies thinking about it show up? Who decides who these botnets attack, regardless of the ddos's being harmful and regardless of them being useless against spammers? Gadi.

13 18

And Now.... Data Retention. Enjoy!
by Fergie 27 May '06

27 May '06

Just a heads-up. CALEA compliance ain't your only concern anymore. [snip] U.S. Attorney General Alberto Gonzales and FBI Director Robert Mueller on Friday urged telecommunications officials to record their customers' Internet activities, CNET News.com has learned. In a private meeting with industry representatives, Gonzales, Mueller and other senior members of the Justice Department said Internet service providers should retain subscriber information and network data for two years, according to two sources familiar with the discussion who spoke on condition of anonymity. [snip] More here: http://news.com.com/2100-1028_3-6077654.html Cheers, - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

3 2

Clueful Comcast person needed
by Jim Popovitch 27 May '06

27 May '06

Hi, sorry for the noise.. We need a clueful Comcast person to start checking out problems in their Atlanta headends. Over on the ALE (Atlanta Linux Enthusiasts) list there are a lot of highly educated engineers all seeing the same ongoing packet loss problems at multiple points. Calls to Comcast result in us hearing that there is no knowledge of a problem and that they are more than happy to roll a truck ($$) to our doors to "diagnosis". Comcast, please save yourself some money and send the right guys to the headend(s) to troubleshoot using the data in these threads: http://www.ale.org/pipermail/ale/2006-May/030809.html http://www.ale.org/pipermail/ale/2006-May/030774.html http://www.ale.org/pipermail/ale/2006-May/030837.html -Jim P.

1 0

Weekly Routing Table Report
by Routing Analysis Role Account 27 May '06

27 May '06

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 27 May, 2006 Analysis Summary ---------------- BGP routing table entries examined: 189144 Prefixes after maximum aggregation: 104309 Unique aggregates announced to Internet: 92654 Total ASes present in the Internet Routing Table: 22317 Origin-only ASes present in the Internet Routing Table: 19409 Origin ASes announcing only one prefix: 9291 Transit ASes present in the Internet Routing Table: 2908 Transit-only ASes present in the Internet Routing Table: 63 Average AS path length visible in the Internet Routing Table: 3.5 Max AS path length visible: 18 Max AS path prepend of ASN (32609) 16 Prefixes from unregistered ASNs in the Routing Table: 14 Unregistered ASNs in the Routing Table: 12 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 9 Number of addresses announced to Internet: 1539919976 Equivalent to 91 /8s, 201 /16s and 80 /24s Percentage of available address space announced: 41.5 Percentage of allocated address space announced: 60.1 Percentage of available address space allocated: 69.1 Total number of prefixes smaller than registry allocations: 93724 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 40065 Total APNIC prefixes after maximum aggregation: 16729 Prefixes being announced from the APNIC address blocks: 37758 Unique aggregates announced from the APNIC address blocks: 18447 APNIC Region origin ASes present in the Internet Routing Table: 2582 APNIC Region origin ASes announcing only one prefix: 744 APNIC Region transit ASes present in the Internet Routing Table: 394 Average APNIC Region AS path length visible: 3.5 Max APNIC Region AS path length visible: 15 Number of APNIC addresses announced to Internet: 226969056 Equivalent to 13 /8s, 135 /16s and 69 /24s Percentage of available APNIC address space announced: 71.0 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911 APNIC Address Blocks 58/7, 60/7, 121/8, 122/7, 124/7, 126/8, 202/7 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 97552 Total ARIN prefixes after maximum aggregation: 57717 Prefixes being announced from the ARIN address blocks: 71556 Unique aggregates announced from the ARIN address blocks: 26470 ARIN Region origin ASes present in the Internet Routing Table: 10740 ARIN Region origin ASes announcing only one prefix: 4041 ARIN Region transit ASes present in the Internet Routing Table: 994 Average ARIN Region AS path length visible: 3.3 Max ARIN Region AS path length visible: 18 Number of ARIN addresses announced to Internet: 292813056 Equivalent to 17 /8s, 115 /16s and 249 /24s Percentage of available ARIN address space announced: 75.9 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959 ARIN Address Blocks 24/8, 63/8, 64/5, 72/6, 76/8, 199/8, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 37960 Total RIPE prefixes after maximum aggregation: 25293 Prefixes being announced from the RIPE address blocks: 34974 Unique aggregates announced from the RIPE address blocks: 23530 RIPE Region origin ASes present in the Internet Routing Table: 8089 RIPE Region origin ASes announcing only one prefix: 4233 RIPE Region transit ASes present in the Internet Routing Table: 1328 Average RIPE Region AS path length visible: 4.0 Max RIPE Region AS path length visible: 18 Number of RIPE addresses announced to Internet: 250469508 Equivalent to 14 /8s, 237 /16s and 220 /24s Percentage of available RIPE address space announced: 78.6 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-41983 RIPE Address Blocks 62/8, 80/5, 88/6, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 11397 Total LACNIC prefixes after maximum aggregation: 3681 Prefixes being announced from the LACNIC address blocks: 9488 Unique aggregates announced from the LACNIC address blocks: 5540 LACNIC Region origin ASes present in the Internet Routing Table: 685 LACNIC Region origin ASes announcing only one prefix: 224 LACNIC Region transit ASes present in the Internet Routing Table: 134 Average LACNIC Region AS path length visible: 4.1 Max LACNIC Region AS path length visible: 16 Number of LACNIC addresses announced to Internet: 27176192 Equivalent to 1 /8s, 158 /16s and 173 /24s Percentage of available LACNIC address space announced: 40.5 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 189/8, 190/8, 200/7 AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 2166 Total AfriNIC prefixes after maximum aggregation: 889 Prefixes being announced from the AfriNIC address blocks: 1489 Unique aggregates announced from the AfriNIC address blocks: 953 AfriNIC Region origin ASes present in the Internet Routing Table: 158 AfriNIC Region origin ASes announcing only one prefix: 49 AfriNIC Region transit ASes present in the Internet Routing Table: 26 Average AfriNIC Region AS path length visible: 3.4 Max AfriNIC Region AS path length visible: 13 Number of AfriNIC addresses announced to Internet: 4070912 Equivalent to 0 /8s, 62 /16s and 30 /24s Percentage of available AfriNIC address space announced: 12.1 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 1192 7096 218 CHINANET-BACKBONE 9583 910 109 16 Sify Limited 4755 858 257 67 Videsh Sanchar Nigam Ltd. Aut 4766 688 4435 304 Korea Telecom (KIX) 1221 614 1668 472 Telstra Pty Ltd 9498 564 211 67 BHARTI BT INTERNET LTD. 7545 533 124 70 TPG Internet Pty Ltd 17488 514 32 9 Hathway IP Over Cable Interne 17676 486 7029 110 Softbank BB Corp. 9443 450 110 81 Primus Telecommunications 18101 411 85 24 Reliance Infocom Ltd Internet 4802 380 80 176 Wantree Development 17557 365 29 168 Pakistan Telecom 17849 352 22 114 Telecommunications Technology 17974 344 118 17 PT TELEKOMUNIKASI INDONESIA 2907 335 1733 312 SINET Japan 9929 325 221 57 China Netcom Corp. 7474 299 211 229 SingTel Optus Pty Ltd 9800 273 410 67 CHINA UNICOM 9837 267 78 160 Powertel Ltd ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1496 6217 961 AT&T WorldNet Services 4323 1293 736 254 Time Warner Telecom 6197 1008 623 474 BellSouth Network Solutions, 721 1001 21977 306 DLA Systems Automation Center 174 966 5788 901 Cogent Communications 19029 948 151 108 New Edge Networks 18566 940 272 8 Covad Communications 701 937 6765 773 UUNET Technologies, Inc. 2386 887 523 682 AT&T Data Communications Serv 1239 844 2805 598 Sprint 19262 706 2106 171 Verizon Global Networks 20115 704 614 379 Charter Communications 209 703 3685 548 Qwest 22773 660 1741 40 Cox Communications, Inc. 7011 636 218 414 Citizens Utilities 11492 611 87 21 Cable One 852 581 1084 382 Telus Advanced Communications 6478 578 1544 342 AT&T Worldnet Services 19916 563 49 54 OLM LLC 855 553 244 64 Canadian Research Network RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 576 1952 454 UUNET - Commercial IP service 3301 308 1072 294 TeliaNet Sweden 3352 308 1644 30 Ibernet, Internet Access Netw 8220 293 472 266 COLT Telecommunications 3320 287 3989 240 Deutsche Telekom AG 680 245 2025 242 DFN-IP service G-WiN 6746 237 89 211 Dynamic Network Technologies, 3246 235 504 225 Song Networks 8708 218 276 202 Romania Data Systems S.A. 24863 213 42 10 LINKdotNET AS number 8551 200 198 24 Bezeq International 3215 199 1664 94 France Telecom Transpac 3269 198 2134 72 TELECOM ITALIA 1257 193 740 168 SWIPnet Swedish IP Network 8764 192 65 32 LIETUVOS-TELEKOMAS Autonomous 30890 190 17 67 SC Kappa Invexim SRL 8866 181 37 16 Bulgarian Telecommunication C 5400 172 348 141 BT Ignite European Backbone 6830 172 781 36 UPC Distribution Services 786 170 1762 170 The JANET IP Service LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 702 1082 226 UniNet S.A. de C.V. 22047 417 158 11 VTR PUNTO NET S.A. 16814 330 20 8 NSS, S.A. 11172 325 110 86 Servicios Alestra S.A de C.V 6147 262 126 22 Telefonica Del Peru 14117 201 12 6 Telefonica del Sur S.A. 10481 181 72 8 Prima S.A. 7303 170 80 25 Telecom Argentina Stet-France 6503 134 150 81 AVANTEL, S.A. 21826 133 17 23 INTERCABLE 11556 132 80 4 Cable-Wireless Panama 19169 129 8 21 Telconet 14259 119 10 15 GTD Internet S.A. 23216 113 21 9 RAMtelecom Telecomunicaciones 6505 109 88 79 Global One Communicaoes Ltda 19429 107 59 45 E.T.B. 7910 105 7 10 ANDINET ON LINE 5639 103 12 9 Telecommunications Services o 14522 101 16 9 SatNet S.A. 18822 98 7 9 TELEFONICA MANQUEHUE AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 283 803 233 The Internet Solution 8452 167 60 7 TEDATA 6713 145 135 11 Itissalat Al-MAGHRIB 2018 131 314 105 Tertiary Education Network 5536 121 8 18 Internet Egypt Network 24835 117 50 7 RAYA Telecom - Egypt 33783 105 6 2 EEPAD TISP TELECOM & INTERNET 2905 73 155 66 The Internetworking Company o 20928 58 16 2 Noor Advanced Technologies AS 15475 54 84 4 Nile Online 15706 44 8 3 Sudatel Internet Exchange Aut 5713 39 294 35 Telkom SA Ltd 33774 30 7 20 AS Number for Telecom Algeria 12455 27 6 3 Jambonet Autonomous system 23889 26 8 11 MAURITIUS TELECOM 8524 24 1 4 AUCEGYPT Autonomous System 16637 24 14 22 Johnnic e-Ventures 10798 22 1 13 Standard Bank of South Africa 33766 20 2 1 Nyala Communications Pty Ltd 2561 19 6 2 Egyptian Universities Network Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 4323 1293 1039 Time Warner Telecom 4134 1192 974 CHINANET-BACKBONE 18566 940 932 Covad Communications 9583 910 894 Sify Limited 19029 948 840 New Edge Networks 4755 858 791 Videsh Sanchar Nigam Ltd. Aut 721 1001 695 DLA Systems Automation Center 22773 660 620 Cox Communications, Inc. 11492 611 590 Cable One 19262 706 535 Verizon Global Networks 6197 1008 534 BellSouth Network Solutions, 19916 563 509 OLM LLC 5668 530 507 CenturyTel Internet Holdings, 17488 514 505 Hathway IP Over Cable Interne 9498 564 497 BHARTI BT INTERNET LTD. 855 553 489 Canadian Research Network 8151 702 476 UniNet S.A. de C.V. 7545 533 463 TPG Internet Pty Ltd 3602 538 428 Sprint Canada, Inc. 22047 417 406 VTR PUNTO NET S.A. List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 36814 UNALLOCATED 65.69.244.0/22 22773 Cox Communications, 36817 UNALLOCATED 66.112.176.0/20 6539 GT Group Telecom Ser 36720 UNALLOCATED 66.242.112.0/20 15227 FiberNet of West Vir 36863 UNALLOCATED 67.98.233.0/24 6395 Broadwing Communicat 39943 UNALLOCATED 69.48.147.0/24 22691 ISPnet, Inc. 36814 UNALLOCATED 70.169.204.0/24 22773 Cox Communications, 36235 UNALLOCATED 71.40.60.0/24 7132 SBC Internet Service 65128 PRIVATE 193.110.50.0/24 24652 Juniper Networks, Eu 24481 UNALLOCATED 202.79.16.0/21 17494 Telecom Operator & I 24409 UNALLOCATED 203.119.29.0/24 9808 Guangdong Mobile Com 64515 PRIVATE 203.126.13.0/25 7610 SINGAPORE ADVANCE RE 64515 PRIVATE 203.126.13.128/26 7610 SINGAPORE ADVANCE RE 36835 UNALLOCATED 206.169.118.0/23 4323 Time Warner Telecom 36235 UNALLOCATED 209.30.100.0/24 7132 SBC Internet Service Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 183.206.196.0/24 2188 FR-RENATER-ASTER 192.44.0.0/24 5501 Fraunhofer Gesellschaft 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.84.205.0/24 719 LANLINK autonomous system 192.172.0.0/19 721 DLA Systems Automation Center Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:18 /9:9 /10:9 /11:28 /12:91 /13:200 /14:360 /15:706 /16:8825 /17:3232 /18:5337 /19:11653 /20:13159 /21:11464 /22:14649 /23:15823 /24:102528 /25:367 /26:271 /27:191 /28:65 /29:70 /30:49 /31:0 /32:40 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 923 940 Covad Communications 19029 879 948 New Edge Networks 6197 796 1008 BellSouth Network Solutions, 7018 788 1496 AT&T WorldNet Services 9583 739 910 Sify Limited 4323 636 1293 Time Warner Telecom 2386 610 887 AT&T Data Communications Serv 11492 602 611 Cable One 19916 557 563 OLM LLC 7011 545 636 Citizens Utilities 4766 498 688 Korea Telecom (KIX) 855 427 553 Canadian Research Network 5668 413 530 CenturyTel Internet Holdings, 15270 401 432 PaeTec.net -a division of Pae 1239 389 844 Sprint 6517 362 393 Yipes Communications, Inc. 702 358 576 UUNET - Commercial IP service 6198 356 509 BellSouth Network Solutions, 17849 352 352 Telecommunications Technology 33588 348 366 Bresnan Communications, LLC. Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:8 8:41 12:1625 13:1 15:14 16:3 17:3 18:4 20:43 24:731 25:1 30:2 32:58 38:221 40:54 41:3 44:3 47:6 52:4 55:1 56:3 57:25 58:176 59:201 60:163 61:855 62:762 63:1920 64:3186 65:2265 66:3023 67:611 68:668 69:1519 70:364 71:87 72:727 73:23 74:38 80:782 81:644 82:614 83:381 84:392 85:579 86:397 87:339 88:122 89:215 124:287 125:409 128:152 129:190 130:117 131:316 132:33 133:8 134:158 135:48 136:178 137:75 138:208 139:69 140:469 141:130 142:381 143:165 144:223 145:39 146:329 147:136 148:308 149:187 150:114 151:90 152:70 153:107 154:5 155:202 156:100 157:149 158:167 159:176 160:89 161:76 162:245 163:147 164:178 165:207 166:165 167:244 168:492 169:128 170:337 171:14 183:1 190:73 192:5765 193:3371 194:2631 195:1888 196:847 198:3907 199:3217 200:4445 201:946 202:6651 203:6915 204:3805 205:2065 206:2413 207:2888 208:2121 209:3780 210:1977 211:676 212:1244 213:1474 214:358 215:40 216:4131 217:1157 218:286 219:202 220:710 221:358 222:162 End of report

1 0