- NANOG - lists.nanog.org

Re: IPv6, IPSEC and DoS
by J. Oquendo 03 Jan '05

03 Jan '05

Re: IPv6, IPSEC and DoS On Mon, 3 Jan 2005, Mohacsi Janos wrote: > > To prevent ARP or ND spoofing attack you should have L2 switch support to > it! Or you can use static ARP or ND entries, which is rather difficult to > maintain. > > Regards, > Janos Mohacsi Funny you should mention this I thought about this but figure the following, regardless of VLAN/PVLAN/ settings, switches still need to build an ARP table so I would think that one can still inject bogus ARP information but it would likely but delegated to that particular segment where the MAC's are being spoofed from. There was an instance last year where I saw a student using some form of LAN generator for him to be able to spoof a network in order to play some XBOX game. Packeteers saw multiple MAC addresses coming from the ports in his room. When we investigated the situation he told us what it was the program was doing and we advised him to limit it via pseudo threat of disconnecting his port. So what happens when an ARP generating programs collides with the address of your L2 switch or a database. VLAN/PVLAN even static ARP entries won't help much. At least I don't think there is much that can be done when someone is determined. I could be wrong I am almost 99.999% of the times. Even an exhaustion attack could do some major damage. http://www.infiltrated.net/cisco/vlan-insecurities.html http://www.infiltrated.net/cisco/vlan-tagging-101.html http://www.infiltrated.net/cisco/layer2-security.pdf Aside from this, I've noticed there are quite a few OS' that still have issues regarding IPv6 // http://seclists.org/lists/fulldisclosure/2004/Mar/1412.html III. Impact It may be possible for a local attacker to read portions of kernel memory, resulting in disclosure of sensitive information. A local attacker can cause a system panic. // Not to single out this one instance, there was also an issue with OpenBSD, I'm sure I could find others for Windows, NetBSD as well. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net "How a man plays the game shows something of his character - how he loses shows all" - Mr. Luckey

7 7

minimum requirements for a full bgp feed
by Mark Bojara 03 Jan '05

03 Jan '05

Hello All, If I wish to purchase a Cisco router that handles a full internet BGP feed what are the minimum specs I should be looking at? Regards Mark Bojara

3 2

Re: BGP 011: multiple sessions with upstreams
by Steve Gibbard 03 Jan '05

03 Jan '05

On Sun, 2 Jan 2005, Edward B. Dreger wrote: > CLM> From: Christopher L. Morrow > CLM> as a start, dropping HSRP and just managing 2 BGP peers from both > CLM> ends one with metric 0 and one with metric 10 toward his ISP should > CLM> satisfy all parties requirements. It should be a 'standard' config > CLM> for the ISP and should be very simple for his customer to manage as > CLM> well. > > Correct. I'd actually prefer RFC1998-style communities to select > LOCAL_PREF, but I'm waiting to suggest that. Yes, it's standard, but > being standard hasn't helped me so far. :-/ Their ASN was registered Q4 > 2003, so it's possible they're new to BGP. I hate to speculate about > experience and clue level based on ASN number, but there's probably some > empirical, macroscopic statistical validity. What apears to be missing here is a reflection on the various meanings of standard. I can think of at least two in this context: - Commonly done in the industry. An experienced engineer hired away from another ISP would be able to support it. - Commonly done at a particular ISP. That ISP's support people would have no trouble with it. It appears to me that you're working from the first definition. That's fine if your goal is to get the ISP to "productize" your request and sell it to lots of customers, or if their support staff all has lots of experience supporting such a product elsewhere. If, on the other hand, your ISP is hring their graveyard shift support staff from the local restaurants and grocery stores, the second definintion is a lot more useful. The support staff will quickly end up well-versed in the things they get lots of calls about, but will likely be completely mystified when confronted with your one-off. Since having an outage and being told that the one person who knows how to fix it is on vacation and unreachable is rarely a good thing, I suspect you'll be much happier in the long run if you either find a way to work within your ISP's well supported products, or find an ISP that's already in the habit of doing what you're asking for. Otherwise, you'll end up in conversations like one I had several years ago, with the support department of what's now a well-respected international backbone: Me: Hi. We have a connection to you that appears to be down right now. Support guy: Is this a T1 or a T3? Me: We're in the cage next to you in the colo facility. It's an ethernet cable running across the floor. Support guy: Hmm... I'm not familiar with... ethernet? -Steve

1 0

RE: IPv6, ARPs, CGMP/IGMP DoS
by J. Oquendo 03 Jan '05

03 Jan '05

On 3-jan-05, at 10:55:49, Iljitsch van Beijnum wrote: > If you can then enforce the port->MAC->IP mappings you're pretty much > bullet proof. I know there are switches that can handle the port->MAC > part. An alternative for the MAC->IP part would be the TCP MD5 option or > IPsec. And what if an attacker sends memberships queries with bogus MAC addresses to a router via CGMP or IGMP messages to a switch... Would normal filtering catch this problem (MAC spoofing/exhaustion) Wouldn't the switch or router say "WTF?" // EXAMPLE // x:x:x:x:x:x who has 10.10.1.2 Router "no one... you do loser" x:x:x:x:x:x "I am now 10.10.1.2 ... I am the king of the world" Attacker via CGMP/IGMP --> Membership Query: "Hello I am x:x:x:x:x:x at 10.10.2.2 I want to join this group" Router "checks MAC tables scratching its RAM" OTHER SCENARIOS: http://www.cs.ucsb.edu/~krishna/igmp_dos/ // END // Maybe I should lay off the caffeine. Aside from your bulletproof situation, if the case held true, 1) Why haven't many implemented this, my guess would be ANEL (Apparent Network Engineer Laziness not pronounced similar to ANAL) 2) why hasn't someone made mention via RFC/Standard/^ETC ... =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net "How a man plays the game shows something of his character - how he loses shows all" - Mr. Luckey

1 0

Re: Agenda so far for NANOG33
by Susan Harris 03 Jan '05

03 Jan '05

> Looking at the current agenda, there's a "Special Community > Meeting" Sunday evening after the tutorials, but with no > details posted. Should we expected any so that attendees > flying in can determine if they should skip dinner to make it? Thanks for the nudge, Joe. There are details here: http://www.nanog.org/mtg-0501/coordination.html And what it says is: ------------------- Coordinating NANOG: Input From the Community All Las Vegas meeting attendees are invited to attend this special meeting, where we'll discuss NANOG coordination issues recently raised by the community. Our agenda will include: 1. Merit's role in coordinating NANOG 2. How the Program Committee reviews proposals and selects presentations 3. Community concerns about the NANOG email list. ----------------- Hope everyone can join us!

1 0

Re: minimum requirements for a full bgp feed
by Tomas Lund 03 Jan '05

03 Jan '05

On Mon, 3 Jan 2005, Mark Bojara wrote: > Well it must also be able to do QoS aswell Oh, you want it to forward packets also? How many PPS/How much bandwith? > but I take it thats pretty much standard in most 12.x IOS's.. Well, if you plan to run anything other than 12.0 you can forget about the full table. :) //tlund

1 0

Weekly Routing Table Report
by Routing Table Analysis 24 Dec '04

24 Dec '04

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 25 Dec, 2004 Analysis Summary ---------------- BGP routing table entries examined: 153434 Prefixes after maximum aggregation: 89843 Unique aggregates announced to Internet: 73421 Total ASes present in the Internet Routing Table: 18694 Origin-only ASes present in the Internet Routing Table: 16228 Origin ASes announcing only one prefix: 7603 Transit ASes present in the Internet Routing Table: 2466 Transit-only ASes present in the Internet Routing Table: 79 Average AS path length visible in the Internet Routing Table: 4.5 Max AS path length visible: 19 Prefixes from unregistered ASNs in the Routing Table: 8 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 16 Number of addresses announced to Internet: 1361259876 Equivalent to 81 /8s, 35 /16s and 45 /24s Percentage of available address space announced: 36.7 Percentage of allocated address space announced: 59.4 Percentage of available address space allocated: 61.9 Total number of prefixes smaller than registry allocations: 71183 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 30059 Total APNIC prefixes after maximum aggregation: 14724 Prefixes being announced from the APNIC address blocks: 28109 Unique aggregates announced from the APNIC address blocks: 14507 APNIC Region origin ASes present in the Internet Routing Table: 2176 APNIC Region origin ASes announcing only one prefix: 647 APNIC Region transit ASes present in the Internet Routing Table: 328 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 16 Number of APNIC addresses announced to Internet: 169704704 Equivalent to 10 /8s, 29 /16s and 125 /24s Percentage of available APNIC address space announced: 77.4 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 23552-24575 APNIC Address Blocks 58/7, 60/7, 202/7, 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 86430 Total ARIN prefixes after maximum aggregation: 52101 Prefixes being announced from the ARIN address blocks: 66161 Unique aggregates announced from the ARIN address blocks: 23807 ARIN Region origin ASes present in the Internet Routing Table: 9785 ARIN Region origin ASes announcing only one prefix: 3524 ARIN Region transit ASes present in the Internet Routing Table: 963 Average ARIN Region AS path length visible: 4.3 Max ARIN Region AS path length visible: 16 Number of ARIN addresses announced to Internet: 237111552 Equivalent to 14 /8s, 34 /16s and 9 /24s Percentage of available ARIN address space announced: 70.7 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647,29695-30719, 31744-33791 ARIN Address Blocks 24/8, 63/8, 64/6, 68/7, 70/7, 72/8, 198/7, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 28859 Total RIPE prefixes after maximum aggregation: 19924 Prefixes being announced from the RIPE address blocks: 25774 Unique aggregates announced from the RIPE address blocks: 16904 RIPE Region origin ASes present in the Internet Routing Table: 6151 RIPE Region origin ASes announcing only one prefix: 3290 RIPE Region transit ASes present in the Internet Routing Table: 1055 Average RIPE Region AS path length visible: 5.1 Max RIPE Region AS path length visible: 19 Number of RIPE addresses announced to Internet: 183483136 Equivalent to 10 /8s, 239 /16s and 187 /24s Percentage of available RIPE address space announced: 64.3 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-34815 RIPE Address Blocks 62/8, 80/5, 88/8, 188/8, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 6796 Total LACNIC prefixes after maximum aggregation: 2390 Prefixes being announced from the LACNIC address blocks: 6654 Unique aggregates announced from the LACNIC address blocks: 4088 LACNIC Region origin ASes present in the Internet Routing Table: 410 LACNIC Region origin ASes announcing only one prefix: 120 LACNIC Region transit ASes present in the Internet Routing Table: 76 Average LACNIC Region AS path length visible: 5.0 Max LACNIC Region AS path length visible: 15 Number of LACNIC addresses announced to Internet: 16985344 Equivalent to 1 /8s, 3 /16s and 45 /24s Percentage of available LACNIC address space announced: 50.6 LACNIC AS Blocks 26592-26623, 27648-28671 LACNIC Address Blocks 200/7 Emerging AfriNIC Region Analysis Summary ---------------------------------------- Prefixes being announced by AfriNIC Region ASes: 1283 Total AfriNIC prefixes after maximum aggregation: 704 Prefixes being announced from the AfriNIC address blocks: 860 Unique aggregates announced from the AfriNIC address blocks: 682 AfriNIC Region origin ASes present in the Internet Routing Table: 95 AfriNIC Region origin ASes announcing only one prefix: 22 AfriNIC Region transit ASes present in the Internet Routing Table: 12 Average AfriNIC Region AS path length visible: 4.5 Max AfriNIC Region AS path length visible: 12 Number of AfriNIC addresses announced to Internet: 2100224 Equivalent to 0 /8s, 32 /16s and 12 /24s Percentage of available AfriNIC address space announced: 12.5 AfriNIC AS Blocks <none> AfriNIC Address Blocks 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 869 4433 168 Data Communications Bureau 1221 791 1184 565 Telstra Pty Ltd 9583 580 47 37 Satyam Infoway Ltd., 4766 552 3409 270 Korea Internet Exchange for " 4755 437 176 91 Videsh Sanchar Nigam Ltd. Aut 17676 390 5852 60 XTAGE CORPORATION 9443 362 71 77 Primus Telecommunications 2907 355 1856 328 SINET Japan 9929 354 164 40 China Netcom Corp. 703 319 344 248 UUNET 17557 307 22 150 Pakistan Telecom 10036 290 26 266 C&M Communication Co. Ltd. 2764 285 272 228 connect.com.au pty ltd 7474 274 267 203 Optus Communications Pty Ltd 9800 234 381 73 CHINA UNICOM 9498 232 81 54 BHARTI BT INTERNET LTD. 4802 231 28 140 Wantree Development 7563 225 48 164 Korea Internet Infrastructure 4814 223 232 6 China Telecom (Group) 17974 220 63 14 PT TELEKOMUNIKASI INDONESIA ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1425 6571 984 AT&T WorldNet Services 701 1099 8357 896 UUNET Technologies, Inc. 721 1074 21840 299 DLA Systems Automation Center 1239 939 2883 628 Sprint 2386 858 528 611 AT&T Data Communications Serv 6197 823 384 354 BellSouth Network Solutions, 4323 821 670 223 Time Warner Telecom 18566 756 208 6 Covad Communications 209 655 3405 502 Qwest 3356 615 10889 450 Level 3 Communications, LLC 20115 574 467 301 Charter Communications 3561 549 2369 416 Cable & Wireless USA 852 528 1126 401 Telus Advanced Communications 7843 482 729 100 Adelphia Corp. 6478 467 814 97 AT&T Worldnet Services 6198 450 388 200 BellSouth Network Solutions, 7132 449 8290 382 SBC Internet Services 27364 442 44 20 Armstrong Cable Services 5668 424 87 18 Century Telephone 22909 419 907 65 Comcast Cable Corporation RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 627 2023 518 UUNET - Commercial IP service 3320 296 2992 233 Deutsche Telekom AG 3301 286 1112 274 TeliaNet Sweden 8220 277 464 265 COLT Internet - International 680 251 2025 239 DFN-IP service G-WiN 21502 235 40 3 NUMERICABLE is a cabled netwo 3246 224 483 220 Song Networks 9121 217 211 16 TTnet Autonomous System 13083 217 51 8 Mannesmann Datenverarbeitung 8708 207 118 191 Romania Data Systems S.A. 1257 203 708 169 SWIPnet Swedish IP Network 5515 193 842 140 Sonera Solution Autonomous Sy 786 176 1794 176 The JANET IP Service 3215 176 998 76 France Telecom Transpac 6746 168 47 136 Dynamic Network Technologies, 8866 162 18 21 Bulgarian Telecommunication C 719 159 322 104 LANLINK autonomous system 3269 159 1362 70 TELECOM ITALIA 3300 153 165 77 AUCS Communications Services 25186 144 138 100 France Telecom Transpac's Tra LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6140 351 140 68 ImpSat 8151 320 473 141 UniNet S.A. de C.V. 16814 234 14 6 NSS, S.A. 11172 217 99 55 Servicios Alestra S.A de C.V 6147 184 94 20 Telefonica Del Peru 11664 171 14 24 Keytech SA 7303 157 68 18 Telecom Argentina Stet-France 6505 140 90 96 Global One Communicaoes Ltda 6503 128 148 85 AVANTEL, S.A. 11992 102 9 31 Integrated Systems 14117 98 6 4 Telefonica del Sur S.A. 11556 97 48 3 Cable-Wireless Panama 14420 87 6 42 ANDINATEL S.A. 11311 86 8 22 Sinectis S.A. 6535 84 7 25 Chilesat Servicios Empresari 10481 82 32 7 Prima S.A. 13999 81 52 9 Mega Cable S.A. de C.V. 4270 79 18 9 Red de Interconexion Universi 15311 78 25 37 Telefonica Empresas 5639 77 8 8 Telecommunications Services o AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 269 636 226 The Internet Solution 5536 113 16 4 Internet Egypt Network 2018 102 297 98 Tertiary Education Network 2905 76 271 69 The Internetworking Company o 20928 55 16 2 Noor Advanced Technologies AS 24835 44 34 7 RAYA Telecom - Egypt 6713 34 38 9 Itissalat Al-MAGHRIB 8452 34 20 5 TEDATA 9129 33 3 2 UUNET Kenya 5713 27 141 24 Telkom SA Ltd 12455 27 7 4 Jambonet Autonomous system 8524 25 1 4 AUCEGYPT Autonomous System 16637 22 10 19 Johnnic e-Ventures 10798 18 1 12 Standard Bank of South Africa 12258 18 3 12 Vodacom Internet Company 11845 17 9 16 Data Pro Business Online 21280 17 2 3 Swift Global Kenya Ltd.Is an 8346 15 7 14 SONATEL-AS Autonomous System 15706 15 4 2 Sudatel Internet Exchange Aut 21491 14 1 3 UTL On-line is RF broadband I Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 721 1074 775 DLA Systems Automation Center 18566 756 750 Covad Communications 4134 869 701 Data Communications Bureau 4323 821 598 Time Warner Telecom 9583 580 543 Satyam Infoway Ltd., 6197 823 469 BellSouth Network Solutions, 27364 442 422 Armstrong Cable Services 5668 424 406 Century Telephone 22773 416 393 Cox Communications, Inc. Atla 7843 482 382 Adelphia Corp. 6478 467 370 AT&T Worldnet Services 22909 419 354 Comcast Cable Corporation 4755 437 346 Videsh Sanchar Nigam Ltd. Aut 6467 376 345 E.Spire Communications, Inc. 17676 390 330 XTAGE CORPORATION 9929 354 314 China Netcom Corp. 1239 939 311 Sprint 13609 328 294 Choice One Communications Inc 4355 393 292 EarthLink, Inc. 9443 362 285 Primus Telecommunications List of Unregistered ASNs (Global) ---------------------------------- Bad AS Designation Network Transit AS Description 1877 UNALLOCATED 192.108.199.0/24 1876 Southern Methodist U 26422 UNALLOCATED 196.46.184.0/22 3741 The Internet Solutio 64512 PRIVATE 199.213.17.0/25 15296 Netera Alliance Inc. 64512 PRIVATE 199.213.17.128/25 15296 Netera Alliance Inc. 64512 PRIVATE 199.216.97.0/28 15296 Netera Alliance Inc. 65002 PRIVATE 208.179.184.0/24 11509 The Pajo Group 65529 PRIVATE 216.21.199.0/24 14697 VDot.Net 65529 PRIVATE 216.152.237.0/24 14697 VDot.Net Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.83.16.0/20 5515 Sonera Solution Autonomous Sy 192.83.32.0/19 5515 Sonera Solution Autonomous Sy 192.83.96.0/22 5515 Sonera Solution Autonomous Sy 192.83.100.0/24 5515 Sonera Solution Autonomous Sy 192.84.205.0/24 719 LANLINK autonomous system 192.119.135.0/24 270 NASA 192.135.50.0/24 7018 AT&T WorldNet Services 192.136.79.0/24 719 LANLINK autonomous system 192.172.0.0/19 721 DLA Systems Automation Center 192.172.11.0/24 721 DLA Systems Automation Center 192.200.100.0/24 7018 AT&T WorldNet Services Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:3 /10:7 /11:15 /12:59 /13:139 /14:315 /15:563 /16:8226 /17:2340 /18:4021 /19:10024 /20:10605 /21:8199 /22:11381 /23:13017 /24:83580 /25:281 /26:239 /27:127 /28:60 /29:35 /30:130 /31:0 /32:49 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 741 756 Covad Communications 6197 669 823 BellSouth Network Solutions, 2386 628 858 AT&T Data Communications Serv 7018 584 1425 AT&T WorldNet Services 27364 427 442 Armstrong Cable Services 9583 410 580 Satyam Infoway Ltd., 702 382 627 UUNET - Commercial IP service 1239 373 939 Sprint 4766 372 552 Korea Internet Exchange for " 5668 367 424 Century Telephone 6198 327 450 BellSouth Network Solutions, 6517 290 313 Yipes Communications, Inc. 10036 290 290 C&M Communication Co. Ltd. 13609 286 328 Choice One Communications Inc 6467 285 376 E.Spire Communications, Inc. 9929 283 354 China Netcom Corp. 701 282 1099 UUNET Technologies, Inc. 4323 267 821 Time Warner Telecom 11456 258 303 Carolina Online, Inc. 20115 250 574 Charter Communications Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:4 8:10 12:1462 13:1 15:5 16:2 17:3 18:3 20:4 24:700 32:67 33:3 38:87 40:55 44:3 47:2 52:3 55:2 56:3 57:23 59:1 60:12 61:702 62:523 63:1853 64:2519 65:2082 66:2535 67:478 68:517 69:856 70:48 71:1 72:21 80:525 81:585 82:355 83:217 84:73 85:70 128:106 129:164 130:89 131:193 132:36 134:187 135:30 136:186 137:70 138:193 139:34 140:230 141:108 142:135 143:124 144:166 145:41 146:283 147:87 148:262 149:129 150:91 151:62 152:118 153:70 154:2 155:132 156:62 157:72 158:146 159:162 160:63 161:60 162:383 163:83 164:189 165:170 166:125 167:222 168:365 169:131 170:312 171:8 192:5658 193:3022 194:2221 195:1546 196:595 198:3890 199:3309 200:3979 201:34 202:5035 203:5826 204:3590 205:2105 206:2306 207:2540 208:2111 209:3054 210:1572 211:709 212:1167 213:1254 214:231 215:31 216:3742 217:1067 218:178 219:89 220:301 221:89 222:33 End of report

1 0

Route analysis from today's AS9121 incident - preso in Seattle?
by ren 24 Dec '04

24 Dec '04

Dear NANOG Program Committee, Request: May we please have a presentation by Renesys on today's AS9121 incident at the Seattle NANOG 15-17 May 2005? Reason: This morning, 24-Dec-04, I gather AS9121 originations were spread throughout the prefix space. We, the peering community, noticed substantial instability throughout our peers as more specifics were accepted via peers without filtering. Given holiday staffing it took several hours longer to restore from max prefix states than it should have, and this is a problem hundreds of NOCs dealt with not just a handful. It would be of use to discuss what happened, the prevention methods available and how to help feed the data collection for real time analysis. The Las Vegas NANOG is perhaps too soon so I am asking that this presentation be considered for the NANOG to follow in Seattle. I'm requesting this in the open with the understanding past requests for Renesys data presentations have been turned down by the program committee. The 'can't prefix filter peers' problem has to be solved. NANOG is the right forum for this topic. Sincerely, -ren

2 1

New Computer? Six Steps to Safer Surfing
by Sean Donelan 24 Dec '04

24 Dec '04

A better than average news article helping people keep their new computers secure. It is much easier to prevent your computer getting infected, than it is curing your computer afterwards. http://www.washingtonpost.com/wp-dyn/articles/A9658-2004Dec18.html I wouldn't rely on software firewalls. At the same store you buy your computer, also buy a hardware firewall. Hopefully soon the motherboard and NIC manufacturers will start including built-in hardware firewalls. But sometimes, such as dialup modems, software firewalls are the only alternative.

22 37

The Cidr Report
by cidr-report＠potaroo.net 24 Dec '04

24 Dec '04

This report has been generated at Fri Dec 24 21:44:23 2004 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 17-12-04 149025 102505 18-12-04 149174 102508 19-12-04 149122 102507 20-12-04 149153 102620 21-12-04 149262 102676 22-12-04 149326 102669 23-12-04 149426 102720 24-12-04 149588 102702 AS Summary 18576 Number of ASes in routing system 7585 Number of ASes announcing only one prefix 1412 Largest number of prefixes announced by an AS AS7018 : ATTW AT&T WorldNet Services 90548992 Largest address span announced by an AS (/32s) AS721 : DNIC DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 24Dec04 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 149103 102680 46423 31.1% All ASes AS18566 756 7 749 99.1% CVAD Covad Communications AS4134 821 197 624 76.0% CHINANET-BACKBONE No.31,Jin-rong Street AS4323 819 230 589 71.9% TWTC Time Warner Telecom AS721 1074 653 421 39.2% DNIC DoD Network Information Center AS27364 442 34 408 92.3% ARMC Armstrong Cable Services AS22773 417 24 393 94.2% CXA Cox Communications Inc. AS7843 482 100 382 79.3% ADELPH-13 Adelphia Corp. AS7018 1412 1045 367 26.0% ATTW AT&T WorldNet Services AS6197 819 457 362 44.2% BNS-14 BellSouth Network Solutions, Inc AS17676 388 69 319 82.2% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS1239 934 625 309 33.1% SPRN Sprint AS6478 467 163 304 65.1% ATTW AT&T WorldNet Services AS9929 341 40 301 88.3% CNCNET-CN China Netcom Corp. AS22909 419 120 299 71.4% CMCS Comcast Cable Communications, Inc. AS4355 383 99 284 74.2% ERSD EARTHLINK, INC AS4766 536 270 266 49.6% KIXS-AS-KR Korea Telecom AS14654 264 7 257 97.3% WAYPOR-3 Wayport AS9443 366 121 245 66.9% INTERNETPRIMUS-AS-AP Primus Telecommunications AS21502 235 3 232 98.7% ASN-NUMERICABLE NUMERICABLE is a cabled network in France, AS2386 857 627 230 26.8% ADCS-1 AT&T Data Communications Services AS6140 372 142 230 61.8% IMPSA ImpSat AS25844 244 17 227 93.0% SASMFL-2 Skadden, Arps, Slate, Meagher & Flom LLP AS6198 446 224 222 49.8% BNS-14 BellSouth Network Solutions, Inc AS4814 223 6 217 97.3% CHINA169-BBN CNCGROUP IP network¡ªChina169 Beijing Broadband Network AS3602 318 113 205 64.5% SPCA Sprint Canada Inc. AS22291 290 85 205 70.7% CC04 Charter Communications AS9583 580 377 203 35.0% SIFY-AS-IN Sify Limited AS15270 239 42 197 82.4% PDP-14 PaeTec.net -a division of PaeTecCommunications, Inc. AS701 1083 889 194 17.9% UU UUNET Technologies, Inc. AS5668 424 231 193 45.5% CIH-12 CenturyTel Internet Holdings, Inc. Total 16451 7017 9434 57.3% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 AHSICHCL Andara High Speed Internet c/o Halifax Cable Ltd. 24.246.0.0/17 AS7018 ATTW AT&T WorldNet Services 24.246.38.0/24 AS25994 NPGCAB NPG Cable, INC 24.246.128.0/18 AS7018 ATTW AT&T WorldNet Services 64.17.32.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.17.33.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.17.37.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.46.27.0/24 AS8674 NETNOD-IX Netnod Internet Exchange Sverige AB 64.57.160.0/19 AS3561 SAVVI-3 Savvis 64.92.128.0/19 AS3561 SAVVI-3 Savvis 64.127.0.0/18 AS7018 ATTW AT&T WorldNet Services 64.209.192.0/18 AS3561 SAVVI-3 Savvis 69.26.32.0/19 AS17307 VIRTEL-15 Virtela Communications 132.0.0.0/10 AS721 DNIC DoD Network Information Center 137.0.0.0/13 AS721 DNIC DoD Network Information Center 138.136.0.0/13 AS721 DNIC DoD Network Information Center 158.0.0.0/13 AS721 DNIC DoD Network Information Center 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.30.127.0/24 AS719 ELISA-AS Elisa Oyj 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.44.0.0/19 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 192.70.164.0/24 AS25689 NRCC-2 National Research Council of Canada 192.81.182.0/24 AS719 ELISA-AS Elisa Oyj 192.81.183.0/24 AS719 ELISA-AS Elisa Oyj 192.81.184.0/24 AS719 ELISA-AS Elisa Oyj 192.119.135.0/24 AS270 NASA National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS4004 GLOBALONE-EQUANT-UK Equant UK & Greece Autonomous System 192.135.50.0/24 AS7018 ATTW AT&T WorldNet Services 192.153.144.0/21 AS721 DNIC DoD Network Information Center 192.172.0.0/19 AS721 DNIC DoD Network Information Center 192.188.208.0/20 AS721 DNIC DoD Network Information Center 192.200.100.0/24 AS7018 ATTW AT&T WorldNet Services 192.243.32.0/23 AS2044 PALINA Palin Aquisitions Inc. 196.2.95.0/24 AS8668 TELONE-AS TelOne Zimbabwe P/L 198.23.26.0/24 AS4390 BELLAT-7 Bell Atlantic, Inc. 198.97.72.0/21 AS721 DNIC DoD Network Information Center 198.97.80.0/20 AS721 DNIC DoD Network Information Center 198.97.88.0/24 AS89 NUSC-1 Naval Underwater Systems Center 198.97.240.0/20 AS721 DNIC DoD Network Information Center 198.97.247.0/24 AS3475 DEPART-52 Department of the Navy 198.101.4.0/22 AS721 DNIC DoD Network Information Center 198.136.32.0/20 AS19329 MCBCC Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY CityNet, Inc. 198.161.87.0/24 AS6539 GTGR GT Group Telecom Services Corp. 198.163.155.0/24 AS684 MRN Manitoba Regional Network 198.167.0.0/16 AS7456 INS-51 Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 UU UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASK SaskTel 198.206.52.0/22 AS701 UU UUNET Technologies, Inc. 198.232.133.0/24 AS23075 SKOTOS Skotos Tech, Inc 199.10.0.0/16 AS721 DNIC DoD Network Information Center 199.60.0.0/20 AS271 UBC-3 University of British Columbia 199.96.44.0/23 AS19092 360NE-1 360Networks (USA) Inc. 199.96.46.0/24 AS19092 360NE-1 360Networks (USA) Inc. 199.114.0.0/18 AS568 DISOUN DISO-UNRRA 199.114.0.0/21 AS721 DNIC DoD Network Information Center 199.114.128.0/18 AS721 DNIC DoD Network Information Center 199.114.130.0/24 AS721 DNIC DoD Network Information Center 199.114.132.0/24 AS721 DNIC DoD Network Information Center 199.114.134.0/24 AS3541 DISAUN DISA/UNRRA 199.114.136.0/24 AS27044 DNIC DoD Network Information Center 199.114.138.0/24 AS721 DNIC DoD Network Information Center 199.114.140.0/24 AS3544 DISAUN DISA/UNRRA 199.114.142.0/24 AS721 DNIC DoD Network Information Center 199.114.144.0/24 AS721 DNIC DoD Network Information Center 199.114.148.0/24 AS721 DNIC DoD Network Information Center 199.114.150.0/24 AS721 DNIC DoD Network Information Center 199.114.152.0/24 AS27033 DNIC DoD Network Information Center 199.114.154.0/24 AS1733 ADP-41 AF DDN PMO 199.114.156.0/24 AS27034 DNIC DoD Network Information Center 199.114.160.0/24 AS1733 ADP-41 AF DDN PMO 199.120.32.0/19 AS16582 NXLI NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS721 DNIC DoD Network Information Center 199.123.0.0/18 AS721 DNIC DoD Network Information Center 199.123.16.0/20 AS721 DNIC DoD Network Information Center 199.123.80.0/21 AS721 DNIC DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST IQuest Internet 199.197.8.0/22 AS21814 PARSON-18 Parsons Corp. 199.202.0.0/16 AS701 UU UUNET Technologies, Inc. 202.70.28.0/24 AS4515 ERX-STAR Star Internet Services Ltd. 202.72.240.0/20 AS24320 202.73.128.0/22 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.148.32.0/20 AS17495 GATEWAY-AP BROADBAND WIRELESSS INTERNET SERVICE PROVIDER 202.164.224.0/19 AS7599 IPXC-AS-AP IP Exchange 203.32.4.0/23 AS7617 TELEONE-HK TeleTeleOne (HK) Limited 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.99.0.0/19 AS17746 ORCONINTERNET-NZ-AP Orcon Internet 203.170.14.0/23 AS6648 ASN-SKYINTERNET Autonomous System Number peering of Sky Internet - BAYANTEL Inc. - Philppines 203.210.69.0/24 AS17536 PRODIGY-AS-AP Prodidgy Telecommunications 204.154.125.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBI Exobit Networks Inc. 205.150.0.0/15 AS701 UU UUNET Technologies, Inc. 206.29.168.0/21 AS10248 IPI Internet Partners, Inc. 206.128.104.0/21 AS11709 VIIN VIRTUAL INTERACTIVE CENTER 206.167.57.0/24 AS376 RISQR-3 Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 206.253.190.0/23 AS19942 RTL-16 A Reality Technologies, LLC 207.231.96.0/19 AS11194 NUNETI NuNet Inc 208.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 208.138.48.0/20 AS7955 SOURCE-48 SourceNet Corporation 209.17.80.0/24 AS32272 CLEAR-17 ClearSkye Communications Inc 209.27.51.0/24 AS14132 INTERN-582 Internet Gateway Inc. 209.172.0.0/18 AS7770 TRTI Triton Technologies, Inc. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.213.32.0/19 AS10629 INS-52 Inter-Pacific Network Services 209.213.48.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.49.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.251.0.0/19 AS11036 SISCOM-1 SISCOM, Inc 216.37.110.0/23 AS4264 CERFN California Education and Research Federation Network 216.96.128.0/18 AS7018 ATTW AT&T WorldNet Services 216.145.156.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.158.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.176.0/21 AS20304 JIS-32 JVLNET Internet Services 216.145.177.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.178.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.184.0/21 AS10758 INWAVE INWave Internet, Inc 216.145.184.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.185.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.186.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.187.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.188.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.189.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.190.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.191.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.200.0/21 AS20304 JIS-32 JVLNET Internet Services 216.171.96.0/20 AS3356 LEVEL3 Level 3 Communications 216.186.151.0/24 AS3356 LEVEL3 Level 3 Communications 216.186.152.0/21 AS3356 LEVEL3 Level 3 Communications 216.186.160.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.164.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.192.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.198.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.248.0/23 AS3356 LEVEL3 Level 3 Communications Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org swinog(a)swinog.ch

1 0