- NANOG - lists.nanog.org

Weekly Routing Table Report
by Routing Table Analysis 24 Feb '06

24 Feb '06

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 25 Feb, 2006 Analysis Summary ---------------- BGP routing table entries examined: 182808 Prefixes after maximum aggregation: 101672 Unique aggregates announced to Internet: 88890 Total ASes present in the Internet Routing Table: 21618 Origin-only ASes present in the Internet Routing Table: 18788 Origin ASes announcing only one prefix: 8927 Transit ASes present in the Internet Routing Table: 2830 Transit-only ASes present in the Internet Routing Table: 71 Average AS path length visible in the Internet Routing Table: 4.5 Max AS path length visible: 25 Prefixes from unregistered ASNs in the Routing Table: 102 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 12 Number of addresses announced to Internet: 1501408992 Equivalent to 89 /8s, 125 /16s and 174 /24s Percentage of available address space announced: 40.5 Percentage of allocated address space announced: 59.8 Percentage of available address space allocated: 67.8 Total number of prefixes smaller than registry allocations: 89337 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 38342 Total APNIC prefixes after maximum aggregation: 16265 Prefixes being announced from the APNIC address blocks: 36143 Unique aggregates announced from the APNIC address blocks: 17648 APNIC Region origin ASes present in the Internet Routing Table: 2481 APNIC Region origin ASes announcing only one prefix: 692 APNIC Region transit ASes present in the Internet Routing Table: 390 Average APNIC Region AS path length visible: 4.5 Max APNIC Region AS path length visible: 21 Number of APNIC addresses announced to Internet: 214731744 Equivalent to 12 /8s, 204 /16s and 139 /24s Percentage of available APNIC address space announced: 67.1 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911 APNIC Address Blocks 58/7, 60/7, 121/8, 122/7, 124/7, 126/8, 202/7 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 96046 Total ARIN prefixes after maximum aggregation: 56720 Prefixes being announced from the ARIN address blocks: 75330 Unique aggregates announced from the ARIN address blocks: 28575 ARIN Region origin ASes present in the Internet Routing Table: 10550 ARIN Region origin ASes announcing only one prefix: 3946 ARIN Region transit ASes present in the Internet Routing Table: 961 Average ARIN Region AS path length visible: 4.3 Max ARIN Region AS path length visible: 17 Number of ARIN addresses announced to Internet: 288791296 Equivalent to 17 /8s, 54 /16s and 155 /24s Percentage of available ARIN address space announced: 71.7 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863 ARIN Address Blocks 24/8, 63/8, 64/6, 68/7, 70/6, 74/7, 76/8, 198/7, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 36127 Total RIPE prefixes after maximum aggregation: 24294 Prefixes being announced from the RIPE address blocks: 33136 Unique aggregates announced from the RIPE address blocks: 22319 RIPE Region origin ASes present in the Internet Routing Table: 7697 RIPE Region origin ASes announcing only one prefix: 4026 RIPE Region transit ASes present in the Internet Routing Table: 1290 Average RIPE Region AS path length visible: 5.0 Max RIPE Region AS path length visible: 19 Number of RIPE addresses announced to Internet: 237818752 Equivalent to 14 /8s, 44 /16s and 211 /24s Percentage of available RIPE address space announced: 70.9 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 RIPE Address Blocks 62/8, 80/5, 88/6, 188/8, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 10258 Total LACNIC prefixes after maximum aggregation: 3505 Prefixes being announced from the LACNIC address blocks: 8410 Unique aggregates announced from the LACNIC address blocks: 5101 LACNIC Region origin ASes present in the Internet Routing Table: 677 LACNIC Region origin ASes announcing only one prefix: 222 LACNIC Region transit ASes present in the Internet Routing Table: 122 Average LACNIC Region AS path length visible: 5.1 Max LACNIC Region AS path length visible: 25 Number of LACNIC addresses announced to Internet: 25587712 Equivalent to 1 /8s, 134 /16s and 112 /24s Percentage of available LACNIC address space announced: 38.1 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 189/8, 190/8, 200/7 AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 1936 Total AfriNIC prefixes after maximum aggregation: 888 Prefixes being announced from the AfriNIC address blocks: 1305 Unique aggregates announced from the AfriNIC address blocks: 896 AfriNIC Region origin ASes present in the Internet Routing Table: 147 AfriNIC Region origin ASes announcing only one prefix: 41 AfriNIC Region transit ASes present in the Internet Routing Table: 24 Average AfriNIC Region AS path length visible: 4.4 Max AfriNIC Region AS path length visible: 14 Number of AfriNIC addresses announced to Internet: 3790848 Equivalent to 0 /8s, 57 /16s and 216 /24s Percentage of available AfriNIC address space announced: 11.3 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 988 6768 206 CHINANET-BACKBONE 9583 854 109 15 Sify Limited 4766 703 3927 300 Korea Telecom (KIX) 4755 669 256 62 Videsh Sanchar Nigam Ltd. Aut 1221 656 1428 471 Telstra Pty Ltd 9498 534 212 73 BHARTI BT INTERNET LTD. 7545 516 108 69 TPG Internet Pty Ltd 17488 514 31 7 Hathway IP Over Cable Interne 17676 482 6981 106 Softbank BB Corp. 9443 411 94 85 Primus Telecommunications 4802 368 75 159 Wantree Development 2907 340 1747 317 SINET Japan 9929 330 216 51 China Netcom Corp. 18101 329 68 23 Reliance Infocom Ltd Internet 17557 319 25 165 Pakistan Telecom 17974 318 76 36 PT TELEKOMUNIKASI INDONESIA 17849 298 19 119 Telecommunications Technology 7474 297 211 230 SingTel Optus Pty Ltd 4780 281 226 16 Digital United Inc. 9837 272 78 168 Powertel Ltd ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1466 6262 946 AT&T WorldNet Services 4323 1221 712 235 Time Warner Telecom 721 1023 21954 307 DLA Systems Automation Center 6197 997 626 459 BellSouth Network Solutions, 174 982 5787 928 Cogent Communications 701 958 8065 792 UUNET Technologies, Inc. 18566 912 272 8 Covad Communications 2386 901 506 674 AT&T Data Communications Serv 1239 848 2774 603 Sprint 19029 771 152 113 New Edge Networks 209 693 3608 541 Qwest 20115 667 584 359 Charter Communications 22773 636 1480 40 Cox Communications, Inc. 19262 635 1866 147 Verizon Global Networks 11492 624 84 14 Cable One 6198 583 471 241 BellSouth Network Solutions, 852 576 1088 383 Telus Advanced Communications 855 570 244 64 Canadian Research Network 19916 563 49 54 OLM LLC 7011 528 183 349 Citizens Utilities RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 583 1952 459 UUNET - Commercial IP service 3301 308 1071 293 TeliaNet Sweden 3352 304 1516 30 Ibernet, Internet Access Netw 3320 280 3477 234 Deutsche Telekom AG 8220 274 474 268 COLT Telecommunications 680 243 2025 240 DFN-IP service G-WiN 6746 230 89 201 Dynamic Network Technologies, 3246 229 487 219 Song Networks 8708 214 274 197 Romania Data Systems S.A. 8551 213 181 25 Bezeq International 1257 204 712 173 SWIPnet Swedish IP Network 3269 186 1925 70 TELECOM ITALIA 3215 177 1470 85 France Telecom Transpac 5515 177 839 124 Sonera Solution Autonomous Sy 786 173 1794 173 The JANET IP Service 8866 171 37 12 Bulgarian Telecommunication C 24863 169 38 9 LINKdotNET AS number 3300 166 171 94 AUCS Communications Services 5400 166 328 135 BT Ignite European Backbone 6830 166 765 35 UPC Distribution Services LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 576 1067 220 UniNet S.A. de C.V. 22047 383 142 10 VTR PUNTO NET S.A. 11172 312 111 81 Servicios Alestra S.A de C.V 16814 294 18 7 NSS, S.A. 14117 184 11 6 Telefonica del Sur S.A. 7303 160 75 20 Telecom Argentina Stet-France 6147 154 126 22 Telefonica Del Peru 11556 130 64 3 Cable-Wireless Panama 19169 123 8 30 Telconet 10481 121 48 8 Prima S.A. 6503 119 148 77 AVANTEL, S.A. 21826 116 15 19 INTERCABLE 5639 113 12 9 Telecommunications Services o 6505 108 88 80 Global One Communicaoes Ltda 23216 100 20 7 RAMtelecom Telecomunicaciones 18822 99 8 10 TELEFONICA MANQUEHUE 7315 96 6 3 Grupo Rey Moreno 14522 96 12 8 SatNet S.A. 25620 96 6 3 COTAS LTDA 11311 95 8 23 Sinectis S.A. AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 278 819 234 The Internet Solution 8452 164 60 7 TEDATA 2018 121 298 103 Tertiary Education Network 5536 121 8 18 Internet Egypt Network 6713 105 103 12 Itissalat Al-MAGHRIB 15475 103 84 4 Nile Online 2905 74 155 67 The Internetworking Company o 24835 62 50 7 RAYA Telecom - Egypt 20928 58 16 2 Noor Advanced Technologies AS 5713 39 294 35 Telkom SA Ltd 15706 31 8 3 Sudatel Internet Exchange Aut 33774 30 7 21 AS Number for Telecom Algeria 12455 27 6 3 Jambonet Autonomous system 23889 26 8 11 MAURITIUS TELECOM 8524 24 1 4 AUCEGYPT Autonomous System 16637 23 10 21 Johnnic e-Ventures 10798 22 1 13 Standard Bank of South Africa 8346 21 14 18 SONATEL-AS Autonomous System 2561 19 6 2 Egyptian Universities Network 21280 19 4 4 Swift Global Kenya Ltd.Is an Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 4323 1221 986 Time Warner Telecom 18566 912 904 Covad Communications 9583 854 839 Sify Limited 4134 988 782 CHINANET-BACKBONE 721 1023 716 DLA Systems Automation Center 19029 771 658 New Edge Networks 11492 624 610 Cable One 4755 669 607 Videsh Sanchar Nigam Ltd. Aut 22773 636 596 Cox Communications, Inc. 6197 997 538 BellSouth Network Solutions, 19916 563 509 OLM LLC 17488 514 507 Hathway IP Over Cable Interne 855 570 506 Canadian Research Network 5668 516 491 CenturyTel Internet Holdings, 19262 635 488 Verizon Global Networks 9498 534 461 BHARTI BT INTERNET LTD. 7545 516 447 TPG Internet Pty Ltd 7757 466 447 AT&T Broadband 3602 523 417 Sprint Canada, Inc. 812 438 410 Rogers WAVE List of Unregistered ASNs (Global) ---------------------------------- Bad AS Designation Network Transit AS Description 2000 UNALLOCATED 47.16.0.0/14 8153 Nortel 2000 UNALLOCATED 47.46.0.0/15 8153 Nortel 2000 UNALLOCATED 47.140.0.0/14 8153 Nortel 2000 UNALLOCATED 47.184.0.0/14 8153 Nortel 2000 UNALLOCATED 47.234.0.0/16 8153 Nortel 65211 PRIVATE 61.139.76.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 61.139.77.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 61.188.9.0/27 4134 CHINANET-BACKBONE 65211 PRIVATE 61.188.176.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 61.188.177.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 61.188.178.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 61.188.179.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.0.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.1.0/27 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.2.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.3.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.12.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.13.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.14.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.15.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.25.0/25 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.25.128/25 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.30.0/23 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.32.0/21 4134 CHINANET-BACKBONE 2000 UNALLOCATED 132.245.128.0/17 8153 Nortel 65005 PRIVATE 159.153.148.0/22 24989 IX Europe Frankfurt 65500 PRIVATE 160.254.3.0/24 11911 The Bank of New York 65500 PRIVATE 160.254.40.0/23 11911 The Bank of New York 65500 PRIVATE 160.254.42.0/23 11911 The Bank of New York 65500 PRIVATE 160.254.46.0/23 11911 The Bank of New York 65500 PRIVATE 160.254.48.0/23 11911 The Bank of New York 65500 PRIVATE 160.254.50.0/24 11911 The Bank of New York 65500 PRIVATE 160.254.69.0/24 11911 The Bank of New York 65500 PRIVATE 160.254.78.0/23 11911 The Bank of New York 65500 PRIVATE 160.254.90.0/24 11911 The Bank of New York 65500 PRIVATE 160.254.91.0/24 11911 The Bank of New York 65500 PRIVATE 160.254.92.0/23 11911 The Bank of New York 65500 PRIVATE 160.254.94.0/24 11911 The Bank of New York 65000 PRIVATE 160.254.131.0/24 11911 The Bank of New York 65000 PRIVATE 160.254.132.0/24 11911 The Bank of New York 65500 PRIVATE 160.254.135.0/24 11911 The Bank of New York 65000 PRIVATE 160.254.140.0/24 11911 The Bank of New York 65500 PRIVATE 160.254.154.0/24 11911 The Bank of New York 65500 PRIVATE 160.254.155.0/24 11911 The Bank of New York 65500 PRIVATE 160.254.200.0/24 11911 The Bank of New York 2000 UNALLOCATED 192.32.0.0/16 8153 Nortel 2000 UNALLOCATED 199.242.36.0/22 8153 Nortel 2000 UNALLOCATED 199.242.40.0/22 8153 Nortel 65211 PRIVATE 202.98.123.0/24 4134 CHINANET-BACKBONE 65505 PRIVATE 206.252.200.192/27 8002 Stealth Communicatio 65518 PRIVATE 211.144.192.0/19 24421 * 65211 PRIVATE 218.6.168.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.169.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.170.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.171.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.172.0/25 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.172.128/25 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.173.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.174.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.175.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.196.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.197.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.198.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.89.166.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.89.167.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.89.168.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.89.169.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.89.170.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.89.171.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.89.172.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.0.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.1.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.2.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.3.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.4.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.5.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.6.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.7.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.8.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.9.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.10.0/27 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.11.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.12.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.13.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.14.0/23 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.17.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.18.0/23 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.20.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.21.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.22.0/25 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.22.128/26 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.22.192/26 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.23.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.24.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.25.0/25 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.25.128/25 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.26.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.27.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.28.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.29.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 222.211.63.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 222.213.0.0/24 4134 CHINANET-BACKBONE Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 192.43.230.0/24 7575 Australian Academic and Rease 192.44.0.0/24 5501 Fraunhofer Gesellschaft 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.72.0.0/18 4780 Digital United Inc. 192.72.0.0/16 4780 Digital United Inc. 192.84.205.0/24 719 LANLINK autonomous system 192.119.135.0/24 270 NASA 192.172.0.0/19 721 DLA Systems Automation Center Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:18 /9:9 /10:8 /11:23 /12:87 /13:199 /14:352 /15:695 /16:8727 /17:3089 /18:5123 /19:11321 /20:12650 /21:10899 /22:13957 /23:15172 /24:99519 /25:360 /26:240 /27:208 /28:58 /29:25 /30:33 /31:0 /32:36 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 895 912 Covad Communications 6197 791 997 BellSouth Network Solutions, 7018 754 1466 AT&T WorldNet Services 19029 699 771 New Edge Networks 9583 674 854 Sify Limited 2386 626 901 AT&T Data Communications Serv 11492 615 624 Cable One 4323 589 1221 Time Warner Telecom 19916 557 563 OLM LLC 4766 507 703 Korea Telecom (KIX) 7011 452 528 Citizens Utilities 7757 448 466 AT&T Broadband 855 444 570 Canadian Research Network 6198 444 583 BellSouth Network Solutions, 5668 401 516 CenturyTel Internet Holdings, 1239 374 848 Sprint 702 368 583 UUNET - Commercial IP service 15270 349 379 PaeTec.net -a division of Pae 6517 342 371 Yipes Communications, Inc. 22773 332 636 Cox Communications, Inc. Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:3 8:43 12:1646 13:1 15:12 16:3 17:3 18:4 20:44 24:852 25:1 30:2 32:67 38:203 40:54 44:3 47:3 52:4 55:1 56:3 57:33 58:111 59:160 60:184 61:805 62:763 63:1894 64:3041 65:2211 66:3084 67:597 68:711 69:1494 70:304 71:61 72:619 73:25 74:8 80:745 81:582 82:511 83:372 84:349 85:455 86:331 87:185 88:30 89:36 124:126 125:257 128:147 129:174 130:107 131:314 132:33 133:7 134:146 135:47 136:169 137:64 138:191 139:69 140:482 141:134 142:415 143:145 144:226 145:39 146:307 147:134 148:334 149:184 150:112 151:76 152:61 153:102 154:6 155:185 156:93 157:123 158:159 159:178 160:100 161:70 162:221 163:144 164:173 165:185 166:147 167:237 168:469 169:139 170:323 171:12 172:1 190:30 192:5763 193:3382 194:2512 195:1793 196:772 198:3897 199:3270 200:4188 201:610 202:6451 203:6801 204:3887 205:2099 206:2423 207:2913 208:1996 209:3740 210:1976 211:825 212:1325 213:1473 214:335 215:41 216:4055 217:1171 218:257 219:149 220:641 221:369 222:155 End of report

1 0

USG posts RFI re: IANAI
by Martin Hannigan 24 Feb '06

24 Feb '06

This was interesting, operationally. I don't know why the USG does RFI's on stuff like IANA: http://www.fbo.gov/spg/DOC/OS/OAM/Reference-Number-DOCNTIARFI0001/SynopsisR… -M< -- Martin Hannigan (c) 617-388-2663 Renesys Corporation (w) 617-395-8574 Member of Technical Staff Network Operations hannigan(a)renesys.com

3 2

phishing reporting by AS
by Gadi Evron 24 Feb '06

24 Feb '06

Hi guys, as of today we expand our AS based reporting system to report phishing sites in real time. If you would like this in a mailbox different to what you already use to get our botnet C&C reports by, please let us know. Thanks, Gadi. -- http://blogs.securiteam.com/ "Out of the box is where I live". -- Cara "Starbuck" Thrace, Battlestar Galactica.

1 0

announcement: reporting and mitigating botnets
by Gadi Evron 24 Feb '06

24 Feb '06

Hi guys. There have been numerous queries about the subject of reporting and mitigating botnets in the last few mounths. I promised I would get back to all of you, here we go. We started a new PUBLIC and OPEN mailing list where anyone can join in and report a botnet command and control (C&C) server they see. The mailing list will serve as as place: *. Where you can discuss detection techniques. *. Where you can report the botnets. *. Where all relevant private groups will get your reports. *. Where the relevant ISP will be automatically notified. *. Where you can see action taken on your reports. To subscribe, go to the following page: http://www.whitestar.linuxbox.org/mailman/listinfo/botnets Otherwise, to report a botnet C&C PRIVATELY and reach all relevant groups, please send email to: c2report(a)isotf.org Thanks, Gadi. -- http://blogs.securiteam.com/ "Out of the box is where I live". -- Cara "Starbuck" Thrace, Battlestar Galactica.

1 0

The Cidr Report
by cidr-report＠potaroo.net 24 Feb '06

24 Feb '06

This report has been generated at Fri Feb 24 21:50:32 2006 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 17-02-06 178434 118031 18-02-06 178545 117983 19-02-06 178413 118022 20-02-06 178454 118153 21-02-06 178760 118090 22-02-06 178709 118201 23-02-06 178759 118367 24-02-06 179214 118296 AS Summary 21515 Number of ASes in routing system 8930 Number of ASes announcing only one prefix 1455 Largest number of prefixes announced by an AS AS7018 : ATT-INTERNET4 - AT&T WorldNet Services 91309568 Largest address span announced by an AS (/32s) AS721 : DLA-ASNBLOCK-AS - DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 24Feb06 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 179230 118306 60924 34.0% All ASes AS4323 1216 239 977 80.3% TWTC - Time Warner Telecom AS18566 912 9 903 99.0% COVAD - Covad Communications Co. AS4134 980 253 727 74.2% CHINANET-BACKBONE No.31,Jin-rong Street AS721 1023 311 712 69.6% DLA-ASNBLOCK-AS - DoD Network Information Center AS22773 632 48 584 92.4% CCINET-2 - Cox Communications Inc. AS6197 996 476 520 52.2% BATI-ATL - BellSouth Network Solutions, Inc AS7018 1455 946 509 35.0% ATT-INTERNET4 - AT&T WorldNet Services AS855 570 64 506 88.8% CANET-ASN-4 - Aliant Telecom AS19916 563 65 498 88.5% ASTRUM-0001 - OLM LLC AS7757 466 19 447 95.9% CCCH-AS4 - Comcast Cable Communications Holdings, Inc AS17488 516 85 431 83.5% HATHWAY-NET-AP Hathway IP Over Cable Internet AS3602 522 106 416 79.7% AS3602-RTI - Rogers Telecom Inc. AS812 438 28 410 93.6% ROGERS-CABLE - Rogers Cable Inc. AS9498 535 138 397 74.2% BBIL-AP BHARTI BT INTERNET LTD. AS17676 482 106 376 78.0% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS11492 636 269 367 57.7% CABLEONE - CABLE ONE AS4766 668 302 366 54.8% KIXS-AS-KR Korea Telecom AS6467 396 52 344 86.9% ESPIRECOMM - Xspedius Communications Co. AS15270 374 32 342 91.4% AS-PAETEC-NET - PaeTec.net -a division of PaeTecCommunications, Inc. AS6198 584 244 340 58.2% BATI-MIA - BellSouth Network Solutions, Inc AS4755 666 333 333 50.0% VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System AS22047 383 62 321 83.8% VTR BANDA ANCHA S.A. AS18101 329 35 294 89.4% RIL-IDC Reliance Infocom Ltd Internet Data Centre, AS14654 300 14 286 95.3% WAYPORT - Wayport AS3352 304 30 274 90.1% TELEFONICA-DATA-ESPANA Internet Access Network of TDE AS6167 341 68 273 80.1% CELLCO-PART - Cellco Partnership AS5668 515 245 270 52.4% AS-5668 - CenturyTel Internet Holdings, Inc. AS9583 854 591 263 30.8% SIFY-AS-IN Sify Limited AS9929 319 58 261 81.8% CNCNET-CN China Netcom Corp. AS1239 845 602 243 28.8% SPRINTLINK - Sprint Total 18820 5830 12990 69.0% Top 30 total Possible Bogus Routes 24.246.0.0/17 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 24.246.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 64.17.32.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.33.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.37.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.25.224.0/20 AS12180 INTERNAP-2BLK - Internap Network Services 64.25.224.0/22 AS15083 INFOLINK-MIA-US - Infolink Information Services Inc. 64.38.96.0/19 AS19654 HOSTING-NETWORK - HOSTING-NETWORK, INC. 64.127.128.0/17 AS19654 HOSTING-NETWORK - HOSTING-NETWORK, INC. 66.11.32.0/20 AS6261 VISINET - Visionary Systems, Inc. 66.37.96.0/20 AS3764 IA-HOU-AS - Internet America, Inc. 66.51.134.0/24 AS29876 LNTC - Latency LLC 66.63.0.0/18 AS16559 REALCONNECT-01 - RealConnect, Inc 66.96.0.0/20 AS3770 WORLDPATH-AS - WorldPath Internet Services 66.117.0.0/19 AS33104 FUZION-COLO - FUZION COLO 66.117.0.0/21 AS30033 NHI-NETWORKS - NHI Networks 66.117.8.0/24 AS174 COGENT Cogent/PSI 66.117.23.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.117.25.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.117.26.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.117.27.0/24 AS31972 EMGINECONCEPT-01 - Emagine Concept, Inc. 66.186.192.0/19 AS19654 HOSTING-NETWORK - HOSTING-NETWORK, INC. 66.187.96.0/24 AS10026 ANC Asia Netcom Corporation 66.187.108.0/24 AS10026 ANC Asia Netcom Corporation 66.187.109.0/24 AS10026 ANC Asia Netcom Corporation 66.216.0.0/18 AS19654 HOSTING-NETWORK - HOSTING-NETWORK, INC. 66.235.158.0/23 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 67.158.144.0/23 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 67.158.146.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 69.31.151.0/24 AS26627 AS-PILOSOFT - Pilosoft, Inc. 69.39.193.0/24 AS25973 MZIMA - Mzima Networks, Inc. 69.39.195.0/24 AS25973 MZIMA - Mzima Networks, Inc. 69.39.196.0/24 AS25973 MZIMA - Mzima Networks, Inc. 71.18.0.0/18 AS32392 HNIPASN - Hosting-Network GmbH 72.10.128.0/19 AS16532 ASB2B2C - B2B2C Inc 72.12.96.0/20 AS16532 ASB2B2C - B2B2C Inc 72.41.224.0/19 AS32392 HNIPASN - Hosting-Network GmbH 90.192.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 90.255.248.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 91.192.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 91.255.248.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 101.80.80.0/24 AS8764 TELECOMLT-AS LIETUVOS-TELEKOMAS Autonomous System 125.213.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 131.64.0.0/12 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 132.0.0.0/10 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 137.0.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 138.136.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 151.135.0.0/16 AS4763 TELSTRANZ-AS TelstraClear Ltd 158.0.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 163.142.0.0/16 AS2500 JPNIC-ASBLOCK-AP JPNIC 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.43.230.0/24 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet) 192.44.0.0/19 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 192.44.0.0/24 AS5501 FRAUNHOFER-CLUSTER-BW Fraunhofer Gesellschaft 192.70.164.0/24 AS25689 NRCNET-AS - National Research Council of Canada 192.72.0.0/16 AS4780 SEEDNET Digital United Inc. 192.72.0.0/18 AS4780 SEEDNET Digital United Inc. 192.72.192.0/18 AS4780 SEEDNET Digital United Inc. 192.81.183.0/24 AS719 ELISA-AS Elisa Oyj 192.81.184.0/24 AS719 ELISA-AS Elisa Oyj 192.88.99.0/24 AS559 SWITCH SWITCH, Swiss Education and Research Network 192.96.36.0/24 AS5713 AFRINIC African Network Information Center 192.96.37.0/24 AS10474 AFRINIC African Network Information Center 192.96.135.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.136.0/23 AS2018 TENET - 1 - The Uninet Project 192.96.140.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.143.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.145.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.177.0/24 AS6083 AFRINIC African Network Information Center 192.96.250.0/24 AS2018 TENET - 1 - The Uninet Project 192.107.104.0/24 AS6458 GUATEL 192.119.135.0/24 AS270 PSCNI-AS - National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP DFN-IP service X-WiN 192.133.6.0/24 AS10282 EQUANT-CEEUR EQUANT AS for Central and Eastern Europe region 192.136.53.0/24 AS8346 SONATEL-AS Autonomous System 192.153.144.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 192.168.255.255/32 AS4637 REACH Reach Network Border AS 192.172.0.0/19 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 192.188.208.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 193.0.246.0/24 AS3303 SWISSCOM Swisscom Solutions Ltd 193.32.19.0/24 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 193.32.20.0/23 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 193.36.1.0/24 AS8220 COLT COLT Telecommunications 193.37.69.0/24 AS2856 BT-UK-AS BTnet UK Regional network 193.37.236.0/24 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 193.110.77.0/24 AS3356 LEVEL3 Level 3 Communications 193.110.78.0/24 AS3356 LEVEL3 Level 3 Communications 193.110.79.0/24 AS3356 LEVEL3 Level 3 Communications 194.31.227.0/24 AS21461 TRANSFAIRNET Transfair-net GmbH Krefeld 194.59.176.0/20 AS1273 CW Cable & Wireless 194.153.156.0/24 AS24865 KMITCHELL-AS Keith Mitchell's Network 194.246.72.0/23 AS8893 ARTFILES-AS Artfiles New Media GmbH 198.23.26.0/24 AS4390 BELLATLANTIC-COM - Bell Atlantic, Inc. 198.54.82.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.92.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.222.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.249.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.250.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.251.0/24 AS2018 TENET - 1 - The Uninet Project 198.97.72.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.80.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.96.0/19 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.240.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.101.4.0/22 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.136.32.0/20 AS19329 MCNET - Martin County Board of County Commissioners 198.160.171.0/24 AS7046 UUNET-CUSTOMER - UUNET Technologies, Inc. 198.161.87.0/24 AS6539 GT-BELL - Bell Canada 198.163.155.0/24 AS684 MTSAL-ASN - MTS Allstream Inc. 198.167.0.0/16 AS7456 INTERHOP - Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 ALTERNET-AS - UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASKTEL - SaskTel 198.232.133.0/24 AS23075 SKOTOS-AS - Skotos Tech, Inc 199.9.128.0/17 AS668 ASN-ASNET-NET-AS - Defense Research and Engineering Network 199.10.0.0/16 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.60.0.0/20 AS271 BCNET-AS - University of British Columbia 199.114.0.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.128.0/18 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.130.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.132.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.134.0/24 AS3541 ITSDN-U4 - DISA/UNRRA 199.114.136.0/24 AS27044 DDN-ASNBLK1 - DoD Network Information Center 199.114.138.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.140.0/24 AS3544 ITSDN-U7 - DISA/UNRRA 199.114.142.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.144.0/24 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.114.148.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.150.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.152.0/24 AS27033 DDN-ASNBLK1 - DoD Network Information Center 199.114.153.0/24 AS27034 DDN-ASNBLK1 - DoD Network Information Center 199.114.154.0/24 AS3542 ITSDN-U5 - DISA/UNRRA 199.114.160.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.121.0.0/16 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.0.0/18 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.16.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.80.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST-AS - IQuest Internet 199.202.0.0/16 AS701 ALTERNET-AS - UUNET Technologies, Inc. 199.246.116.0/24 AS813 UUNET-AS1 - UUNET Technologies, Inc. 202.9.64.0/19 AS9290 TPN-AS-AP Smart Global Network (M) Sdn Bhd 202.58.113.0/24 AS19161 INNOCOM-TELECOM - INNOCOM TELECOM 202.74.32.0/19 AS9315 CWN-AS-AP Chomanan WorldNet Co., Ltd. 202.86.252.0/22 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.253.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.254.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.255.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.90.33.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.40.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.41.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.42.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.43.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.44.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.131.64.0/19 AS9381 NEWTT-IP-AP Wharf T&T Ltd. 202.148.32.0/20 AS17495 GATEWAY-AP BROADBAND WIRELESSS INTERNET SERVICE PROVIDER 203.13.171.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 203.62.0.0/17 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet) 203.78.48.0/20 AS9299 IPG-AS-AP Philippine Long Distance Telephone Company 203.89.134.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.139.0/24 AS17911 BRAINPK-AS-AP Brain Telecommunication Ltd. 203.89.143.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.144.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.147.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.148.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.149.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.150.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.151.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.153.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.154.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.158.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.159.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.99.0.0/19 AS17746 ORCONINTERNET-NZ-AP Orcon Internet 203.99.142.0/24 AS9826 ILINK-HK-AP iLink.net Ltd 203.111.192.0/20 AS7473 SINGTEL-AS-AP Singapore Telecom 203.210.69.0/24 AS17536 PRODIGY-AS-AP Prodidgy Telecommunications 204.48.118.0/23 AS29912 CITIZENS-PROPERTY-INSURANCE-CORPORATION - Citizens Property Insurance Corporation 204.48.119.0/24 AS29912 CITIZENS-PROPERTY-INSURANCE-CORPORATION - Citizens Property Insurance Corporation 204.154.125.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 205.150.0.0/15 AS701 ALTERNET-AS - UUNET Technologies, Inc. 206.128.104.0/21 AS11709 VIC - VIRTUAL INTERACTIVE CENTER 206.167.57.0/24 AS376 RISQ-AS - Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 206.191.96.0/19 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 207.231.96.0/19 AS11194 NUNETPA - NuNet Inc 209.33.192.0/18 AS11071 IW-ASN-11071 - InfoWest 209.40.192.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.200.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.208.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.216.0/21 AS6487 CyberNet de Guatemala S.A. 209.55.64.0/18 AS5726 INTERWORLD - InterWorld Communications, Inc. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.234.0.0/18 AS3845 STATE-NET - CS&W, Inc. 216.37.110.0/23 AS4264 CERNET-ASN-BLOCK - California Education and Research Federation Network 216.71.224.0/20 AS23527 COTELLIGENCE - Cotelligence, Inc. 216.82.160.0/20 AS20481 CALYX-NL Calyx Internet B.V. Netherlands 216.96.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.201.68.0/24 AS13564 BELLSOUTHINTERNATIONL - BellSouth International - Network Services 216.201.69.0/24 AS13564 BELLSOUTHINTERNATIONL - BellSouth International - Network Services 216.201.70.0/24 AS13564 BELLSOUTHINTERNATIONL - BellSouth International - Network Services 216.201.71.0/24 AS13564 BELLSOUTHINTERNATIONL - BellSouth International - Network Services 216.201.72.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.73.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.74.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.75.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.76.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.77.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.78.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.79.0/24 AS14709 Telefonica Moviles Panama S.A. 216.228.64.0/21 AS6295 WHIDBEY1 - Whidbey Internet Services 216.228.224.0/20 AS13674 VRIS-AS-BLOCK-13661-13675 - Verizon Internet Services Inc. 216.240.240.0/20 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.240.242.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

Re: Cisco 3550 replacement
by Jean-Francois Vaillancourt 24 Feb '06

24 Feb '06

Check out the Cisco 3560 with "IP Services" software: http://www.cisco.com/en/US/products/hw/switches/ps5528/index.html it's basically a less expensive version of the 3750, without the external 32 Gbps stack connection. Anything the 3550 did it does, faster. JF At 20/02/2006, Jacky Lam wrote: >Hi all, >I'm currently looking for a CPE that can replace the Cisco 3550 we currently >deploy in our network. Key features that I'm looking for are as follows: >Hierarchical QOS >Traffic shaping/policing >L3VPN functionality(VRF-lite) > > >BGP >OSPF >dot1q >some sort of spanning tree > >Any help would be really appreciated, > >Jacky

7 6

RE: protocols that don't meet the need...
by Tony Hain 23 Feb '06

23 Feb '06

I am not going to speak for the IETF, but why would they? Their meetings are already open, and to be globally fair the proposed coordinators would have to attend 3-5 extra meetings a year to cover all the ops groups. Tony > -----Original Message----- > From: Eastgard, Tom [mailto:tom.eastgard@boeing.com] > Sent: Tuesday, February 14, 2006 1:01 PM > To: Tony Hain; nanog(a)merit.edu > Subject: RE: protocols that don't meet the need... > > > -----Original Message----- > > From: Tony Hain [mailto:alh-ietf@tndh.net] > > Sent: Tuesday, February 14, 2006 12:35 PM > > To: nanog(a)merit.edu > > Subject: protocols that don't meet the need... > > > > > > A thought I had on the plane last night about the disconnect > > between the NANOG and IETF community which leaves protocol > > development to run open-loop. > > > > Rather than sit back and complain about the results, why not > > try to synchronize meeting times. Not necessarily hotels, but > > within a reasonable distance of each other so the issue about > > ROI for the trip can be mitigated. > > This will mean that people who regularly attend both will > > have overlap issues, but if one meeting every year or two is > > joint there is an opportunity for those who can't justify the > > extra trips to at least have some feedback to try and close > > the loop on protocol design. > > Would it make sense to ask IETF to provide a focal or coordinate(s?) to > NANOG who would host a BOF(s?) on IETF issues --- not to debate, explain > or > work them but to board the issues and concerns of the operating community? > Point being to provide a lightly structured and cost effective mechanism > for > operators to give feedback without having to attend three more meetings > per > year? > > T. Eastgard

28 64

The Domain Name Service as an IDS
by Gadi Evron 23 Feb '06

23 Feb '06

"How DNS can be used for detecting and monitoring badware in a network" http://staff.science.uva.nl/~delaat/snb-2005-2006/p12/report.pdf This is a very interesting although preliminary work by obviously skilled people. I haven't learned much but I am extremely happy others work on this than the people I already know! They also weren't too shy with credit, mentioning Florian Weimer and his Passive DNS project already at the abstract (quoted below). They even mention me for some reason. Great paper guys! Moving past Passive DNS Replication and blacklisting, they discuss what so far has been done for years using dnstop, and help us take it to the next level of DNS monitoring. Someone should introduce them to Duane Wessels' (from ISC OARC) follow-up dnstop project, DSC. :) http://dns.measurement-factory.com/tools/dsc/ https://oarc.isc.org/faq-dsc.html http://www.caida.org/tools/utilities/dsc/ [Duane's lecture on the tool at the 1st DNS-OARC Workshop] http://www.caida.org/projects/oarc/200507/slides/oarc0507-Wessels-dsc.pdf There has been some other interesting work done in this area by our very own David Dagon from Georgia Tech: [Presentation from the 1st DNS-OARC Workshop] Botnet Detection and Response - The Network is the Infection: http://www.caida.org/projects/oarc/200507/slides/oarc0507-Dagon.pdf [Paper] Modeling Botnet Propagation Using Time Zones: http://www.cs.ucf.edu/~czou/research/botnet_tzmodel_NDSS06.pdf ----- Abstract SURFnet is looking for technologies to expand the ways they can detect network traffic anomalies like botnets. Since bots started using domain names for connection with their controller, tracking and removing them has become a hard task. This research is a first glance at the usability of DNS traffic and logs for detection of this malicious network activity. Detection of bots is possible by DNS information gathered from the network by placing counters and triggers on specific events in the data analysis. In combination with NetFlow information and IP addresses of known infected systems, detection of bots of network anomalies can be made visible. Also the behavior of a bot can be documented and additional information can be gathering about the bot. Using DNS data as a supplement to the existing detection systems can give more insight in the suspicious network traffic. With some future research, this information can be used to compile a case against particular types of bot or spyware and help dismantling a remote controlled infrastructure as a whole. Note We started this research project with the question if the Passive DNS Software of Florian Weimer was useful for bot detection. We immediately found out that the sensor of the Passive DNS Software strips the source address from the collected data for privacy reasons, making this software not useful at all for our purpose. We deviated from the Research Plan (Plan van Aanpak) and took a more general approach to the question; ”Is gathered DNS traffic usable for badware detection”. ----- Gadi. -- http://blogs.securiteam.com/ "Out of the box is where I live". -- Cara "Starbuck" Thrace, Battlestar Galactica.

4 4

RE: How do you (not how do I) calculate 95th percentile?
by Russell, David 23 Feb '06

23 Feb '06

I think that we have two (partially) unrelated issues in this thread: 1) how often you should sample and 2) what do you do with the results. I personally think that 5 minute sampling is so last century because it is better suited for batch load types that do not change very quickly than for interactive web applications. If your users' web performance is being affected by a particular link, they are going to notice it in the 10 second range. Congestion events lasting 1-3 minutes can be a problem. After five minutes they have forgotten what they were doing:) How often you check the counter should be driven by how granular you want to measure the network. Pick the right counter so that it does not wrap on you during your sampling interval. The initial downside is that you have 10-30 times as much data. Network data has chaotic (aka self-similar) characteristics that make simple statistics such as max, min or average somewhat useless. My understanding of the reason to calculate a 95th percentile is to try to reduce the dataset size and to make some sense out of the random performance data. For example, I could take some range of data and figure out the 95% threshold and save that as a data point. (eg. 95% of the samples are less than X Mbps). Read the counter value, compute the rate for the interval, then compute the 95th % threshold for 20+ samples and save that as the value for that longer period. The basic assumption is that you can ignore or not bill the 5% of the time that you had higher values. Its 6 minutes during a 10 hour business window or 15 minutes over a 24 hour period. One could argue that 95 should be 98 or 92 or it matters if the 5% is a continuous. But its a reasonable starting point for making a decision about whether link utilization is too high. David Russell ________________________________ From: owner-nanog(a)merit.edu on behalf of Jo Rhett Sent: Wed 2/22/2006 1:12 PM To: nanog(a)merit.edu Subject: How do you (not how do I) calculate 95th percentile? I am wondering what other people are doing for 95th percentile calculations these days. Not how you gather the data, but how often you check the counter? Do you use averages or maximums over time periods to create the buckets used for the 95th percentile calculation? A lot of smaller folks check the counter every 5 min and use that same value for the 95th percentile. Most of us larger folks need to check more often to prevent 32bit counters from rolling over too often. Are you larger folks averaging the retrieved values over a larger period? Using the maximum within a larger period? Or just using your saved values? This is curiosity only. A few years ago we compared the same data and the answers varied wildly. It would appear from my latest check that it is becoming more standardized on 5-minute averages, so I'm asking here on Nanog as a reality check. Note: I have AboveNet, Savvis, Verio, etc calculations. I'm wondering if there are any other odd combinations out there. Reply to me offlist. If there is interest I'll summarize the results without identifying the source. -- Jo Rhett senior geek SVcolo : Silicon Valley Colocation Note: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you. ThruPoint, Inc.

2 1

The dissention grows towards AOL and pay per message
by Nicole 23 Feb '06

23 Feb '06

This was sent to me on another mailing list. I am on a number of smaller and or community mailing lists who feel very threatend by this. Nicole -- Hi, I just signed an important online petition because the very existence of online civic participation and the free Internet as we know it are under attack by America Online, and we need to fight back quickly. The petition's at: http://civic.moveon.org/emailtax/ AOL recently announced what amounts to an "email tax." Under this pay- to-send system, large emailers willing to pay an "email tax" can bypass spam filters and get guaranteed access to people's inboxes-- with their messages having a preferential high-priority designation. Charities, small businesses, civic organizing groups, and even families with mailing lists will inevitably be left with inferior Internet service unless they are willing to pay the "email tax" to AOL. The petition says: "AOL, don't auction off preferential access to people's inboxes to giant emailers, while leaving people's friends, families, and favorite causes wondering if their emails are being delivered at all. The Internet is a force for democracy and economic innovation only because it is open to all Internet users equally--we must not let it become an unlevel playing field." AOL's proposed pay-to-send system is the first step down the slippery slope toward dividing the Internet into two classes of users--those who get preferential treatment and those who are left behind. We must preserve the Internet for everybody. Can you sign this emergency petition to America Online? http://civic.moveon.org/emailtax/ Thanks! -- |\ __ /| (`\ | o_o |__ ) ) // \\ - nmh(a)daemontech.com - Powered by FreeBSD - ------------------------------------------------------ "The term "daemons" is a Judeo-Christian pejorative. Such processes will now be known as "spiritual guides" - Politicaly Correct UNIX Page

3 2