- NANOG - lists.nanog.org

WhatsApp's New Policy Has...
by Mark Tinka 09 Jan '21

09 Jan '21

... finally been the final push all my friends needed to dump it and move to Signal. Several of the WhatsApp groups I'm on have, as of this morning, been disbanded and re-launched on Signal. Facebook say the new policy applies to business accounts, but heck, the cat's out the bag and gone. What's most amazing to me is that a lot more people seem to be a tad more concerned about their privacy, when they ordinarily wouldn't have. Mark.

10 17

ROV++: Improved Deployable Defense against BGP Hijacking
by Amir Herzberg 09 Jan '21

09 Jan '21

Hi, the paper: ROV++: Improved Deployable Defense against BGP Hijacking will be presented in the NDSS'21 conference. The paper is available in: https://www.researchgate.net/publication/346777643_ROV_Improved_Deployable_… Feedback, by discussion here or by direct email to me, is welcome, thanks. btw, I keep most publications there (researchgate), incl. the drafts of `foundations of cybersecurity' ; the 1st part (mostly applied crypto) is in pretty advanced stage, feedback is also very welcome. URL in sig. -- Amir Herzberg Comcast professor of Security Innovations, University of Connecticut Homepage: https://sites.google.com/site/amirherzberg/home Foundations of Cyber-Security (part I: applied crypto, part II: network-security): https://www.researchgate.net/project/Foundations-of-Cyber-Security

2 3

Show NOCs: OIG report: Should you charge extra for NOC tours?
by Sean Donelan 08 Jan '21

08 Jan '21

Department of Commerce OIG review of FirstNet request to tour AT&T GNOC https://www.oversight.gov/sites/default/files/oig-reports/DOC/OIG-21-016-I.… Continued FirstNet Authority Management Attention is Needed to Address Control Environment Weaknesses [...] FirstNet Authority disagreed that the request for a GNOC tour “constituted a request for ‘additional contract services outside the scope of the contract.’” In its response, FirstNet Authority stated, “GNOC tours are not governed or limited by the [NPSBN] contract as these kinds of tours are commonplace for AT&T to provide to outside parties.” However, we found that the contractor only offers a multi-media presentation regarding the GNOC at its Corporate Briefing Center. FirstNet Authority requested a visit and tour of the GNOC, which is neither included in the contract nor offered widely to the public. We reaffirm that the tour was not in the contract and could be viewed as exerting indirect pressure for the contractor to perform unreimbursed services outside the contract. [...]

11 13

Weekly Routing Table Report
by cscora＠apnic.net 08 Jan '21

08 Jan '21

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 09 Jan, 2021 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 835914 Prefixes after maximum aggregation (per Origin AS): 320620 Deaggregation factor: 2.61 Unique aggregates announced (without unneeded subnets): 400305 Total ASes present in the Internet Routing Table: 70275 Prefixes per ASN: 11.89 Origin-only ASes present in the Internet Routing Table: 60448 Origin ASes announcing only one prefix: 25023 Transit ASes present in the Internet Routing Table: 9827 Transit-only ASes present in the Internet Routing Table: 296 Average AS path length visible in the Internet Routing Table: 4.4 Max AS path length visible: 203 Max AS path prepend of ASN (396896) 200 Prefixes from unregistered ASNs in the Routing Table: 1015 Number of instances of unregistered ASNs: 1018 Number of 32-bit ASNs allocated by the RIRs: 34613 Number of 32-bit ASNs visible in the Routing Table: 28766 Prefixes from 32-bit ASNs in the Routing Table: 132847 Number of bogon 32-bit ASNs visible in the Routing Table: 15 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 501 Number of addresses announced to Internet: 2864181632 Equivalent to 170 /8s, 183 /16s and 241 /24s Percentage of available address space announced: 77.4 Percentage of allocated address space announced: 77.4 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.5 Total number of prefixes smaller than registry allocations: 284376 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 218915 Total APNIC prefixes after maximum aggregation: 64842 APNIC Deaggregation factor: 3.38 Prefixes being announced from the APNIC address blocks: 214864 Unique aggregates announced from the APNIC address blocks: 87855 APNIC Region origin ASes present in the Internet Routing Table: 11192 APNIC Prefixes per ASN: 19.20 APNIC Region origin ASes announcing only one prefix: 3195 APNIC Region transit ASes present in the Internet Routing Table: 1604 Average APNIC Region AS path length visible: 4.5 Max APNIC Region AS path length visible: 31 Number of APNIC region 32-bit ASNs visible in the Routing Table: 6324 Number of APNIC addresses announced to Internet: 778374912 Equivalent to 46 /8s, 101 /16s and 15 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-143673 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 241300 Total ARIN prefixes after maximum aggregation: 111690 ARIN Deaggregation factor: 2.16 Prefixes being announced from the ARIN address blocks: 241836 Unique aggregates announced from the ARIN address blocks: 115697 ARIN Region origin ASes present in the Internet Routing Table: 18696 ARIN Prefixes per ASN: 12.94 ARIN Region origin ASes announcing only one prefix: 6814 ARIN Region transit ASes present in the Internet Routing Table: 1921 Average ARIN Region AS path length visible: 3.9 Max ARIN Region AS path length visible: 203 Number of ARIN region 32-bit ASNs visible in the Routing Table: 3649 Number of ARIN addresses announced to Internet: 1093157376 Equivalent to 65 /8s, 40 /16s and 66 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-401308 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 238117 Total RIPE prefixes after maximum aggregation: 112203 RIPE Deaggregation factor: 2.12 Prefixes being announced from the RIPE address blocks: 234004 Unique aggregates announced from the RIPE address blocks: 137985 RIPE Region origin ASes present in the Internet Routing Table: 27618 RIPE Prefixes per ASN: 8.47 RIPE Region origin ASes announcing only one prefix: 11875 RIPE Region transit ASes present in the Internet Routing Table: 3878 Average RIPE Region AS path length visible: 4.4 Max RIPE Region AS path length visible: 30 Number of RIPE region 32-bit ASNs visible in the Routing Table: 9804 Number of RIPE addresses announced to Internet: 709883008 Equivalent to 42 /8s, 79 /16s and 244 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-213403 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 111846 Total LACNIC prefixes after maximum aggregation: 26287 LACNIC Deaggregation factor: 4.25 Prefixes being announced from the LACNIC address blocks: 112942 Unique aggregates announced from the LACNIC address blocks: 48012 LACNIC Region origin ASes present in the Internet Routing Table: 10633 LACNIC Prefixes per ASN: 10.62 LACNIC Region origin ASes announcing only one prefix: 2652 LACNIC Region transit ASes present in the Internet Routing Table: 1983 Average LACNIC Region AS path length visible: 4.9 Max LACNIC Region AS path length visible: 33 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 8234 Number of LACNIC addresses announced to Internet: 174092288 Equivalent to 10 /8s, 96 /16s and 112 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-272796 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 24719 Total AfriNIC prefixes after maximum aggregation: 4838 AfriNIC Deaggregation factor: 5.11 Prefixes being announced from the AfriNIC address blocks: 31767 Unique aggregates announced from the AfriNIC address blocks: 10337 AfriNIC Region origin ASes present in the Internet Routing Table: 1427 AfriNIC Prefixes per ASN: 22.26 AfriNIC Region origin ASes announcing only one prefix: 486 AfriNIC Region transit ASes present in the Internet Routing Table: 289 Average AfriNIC Region AS path length visible: 5.2 Max AfriNIC Region AS path length visible: 28 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 755 Number of AfriNIC addresses announced to Internet: 108230400 Equivalent to 6 /8s, 115 /16s and 119 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7545 5687 777 661 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4743 4192 74 ERX-CERNET-BKB China Education and Rese 7552 3536 1330 21 VIETEL-AS-AP Viettel Group, VN 7713 3234 952 519 TELKOMNET-AS-AP PT Telekomunikasi Indon 45899 2864 1896 55 VNPT-AS-VN VNPT Corp, VN 9808 2778 9044 57 CMNET-GD Guangdong Mobile Communication 4766 2462 11104 567 KIXS-AS-KR Korea Telecom, KR 9498 2305 482 233 BBIL-AP BHARTI Airtel Ltd., IN 4755 2131 441 189 TATACOMM-AS TATA Communications formerl 45090 2069 1045 64 CNNIC-TENCENT-NET-AP Shenzhen Tencent C Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 11492 4735 314 723 CABLEONE, US 16509 4618 9077 2134 AMAZON-02, US 7155 4037 264 32 VIASAT-SP-BACKBONE, US 22773 3819 3020 228 ASN-CXA-ALL-CCI-22773-RDC, US 6327 3348 1319 83 SHAW, CA 16625 3188 1669 2286 AKAMAI-AS, US 209 2521 5058 507 CENTURYLINK-US-LEGACY-QWEST, US 30036 2499 370 85 MEDIACOM-ENTERPRISE-BUSINESS, US 5650 2350 3000 1640 FRONTIER-FRTR, US 20115 2165 2902 510 CHARTER-20115, US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 47331 6312 859 3615 TTNET, TR 12479 6215 1667 141 UNI2-AS, ES 39891 3459 195 22 ALJAWWALSTC-AS, SA 20940 3372 3359 186 AKAMAI-ASN1, NL 8551 3116 379 45 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 12389 2874 2280 886 ROSTELECOM-AS, RU 9009 2307 231 1246 M247, GB 34984 2175 354 578 TELLCOM-AS, TR 13188 1611 100 23 TRIOLAN, UA 58224 1491 860 546 TCI, IR Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 8101 3400 588 Uninet S.A. de C.V., MX 10620 3385 526 606 Telmex Colombia S.A., CO 11830 2564 369 63 Instituto Costarricense de Electricidad 13999 1608 432 412 Mega Cable, S.A. de C.V., MX 6503 1438 311 475 Axtel, S.A.B. de C.V., MX 7303 1435 910 262 Telecom Argentina S.A., AR 28573 1380 2260 221 CLARO S.A., BR 6147 1146 379 39 Telefonica del Peru S.A.A., PE 3816 1118 540 149 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 11664 1008 213 417 Techtel LMDS Comunicaciones Interactiva Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1570 393 21 LINKdotNET-AS, EG 24835 1253 466 28 RAYA-AS, EG 36992 1158 1521 163 ETISALAT-MISR, EG 36903 979 511 102 MT-MPLS, MA 29571 703 68 12 ORANGE-COTE-IVOIRE, CI 6713 533 1863 34 IAM-AS, MA 37342 479 32 1 MOVITEL, MZ 23889 454 232 16 MauritiusTelecom, MU 36935 443 522 39 Vodafone-, EG 15399 440 46 16 WANANCHI-, KE Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 8101 3400 588 Uninet S.A. de C.V., MX 47331 6312 859 3615 TTNET, TR 12479 6215 1667 141 UNI2-AS, ES 7545 5687 777 661 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4743 4192 74 ERX-CERNET-BKB China Education and Rese 11492 4735 314 723 CABLEONE, US 16509 4618 9077 2134 AMAZON-02, US 7155 4037 264 32 VIASAT-SP-BACKBONE, US 22773 3819 3020 228 ASN-CXA-ALL-CCI-22773-RDC, US 7552 3536 1330 21 VIETEL-AS-AP Viettel Group, VN Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 12479 6215 6074 UNI2-AS, ES 7545 5687 5026 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4743 4669 ERX-CERNET-BKB China Education and Research Net 11492 4735 4012 CABLEONE, US 7155 4037 4005 VIASAT-SP-BACKBONE, US 22773 3819 3591 ASN-CXA-ALL-CCI-22773-RDC, US 7552 3536 3515 VIETEL-AS-AP Viettel Group, VN 39891 3459 3437 ALJAWWALSTC-AS, SA 6327 3348 3265 SHAW, CA 20940 3372 3186 AKAMAI-ASN1, NL Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 16589 UNALLOCATED 8.20.247.0/24 23393 NUCDN, US 62828 UNALLOCATED 8.21.130.0/24 3356 LEVEL3, US 393266 UNALLOCATED 8.23.52.0/24 174 COGENT-174, US 18604 UNALLOCATED 8.25.204.0/24 3356 LEVEL3, US 16589 UNALLOCATED 8.26.56.0/24 23393 NUCDN, US 32985 UNALLOCATED 8.28.31.0/24 3356 LEVEL3, US 394936 UNALLOCATED 8.33.224.0/24 174 COGENT-174, US 393579 UNALLOCATED 8.38.98.0/24 3356 LEVEL3, US 23061 UNALLOCATED 8.39.119.0/24 3356 LEVEL3, US 395438 UNALLOCATED 8.42.206.0/24 3356 LEVEL3, US Complete listing at http://thyme.rand.apnic.net/current/data-badAS Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at http://thyme.rand.apnic.net/current/data-dsua Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.133.192.0/24 Origin: 16734 UNASSIGNED Transit: 266201 RNV CORP EIRELI, BR 23.141.0.0/24 Origin: 395350 UNASSIGNED Transit: 11426 TWC-11426-CAROLINAS, US 23.142.80.0/24 Origin: 397881 STINGERS, US Transit: 398481 REDMERCURY, US 27.100.7.0/24 Origin: 56096 UNASSIGNED Transit: 45455 TH-2S1N-AP Two S One N Co Ltd, Internet 27.126.156.0/22 Origin: 55827 UNASSIGNED Transit: 9930 TTNET-MY TIME dotCom Berhad No. 14, Jala Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:8 /9:13 /10:40 /11:101 /12:292 /13:579 /14:1176 /15:1924 /16:13459 /17:8247 /18:13689 /19:25636 /20:41507 /21:50600 /22:103774 /23:88216 /24:485346 /25:1307 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 47331 5594 6312 TTNET, TR 12479 5194 6215 UNI2-AS, ES 11492 3809 4735 CABLEONE, US 6327 3143 3348 SHAW, CA 7155 3125 4037 VIASAT-SP-BACKBONE, US 22773 2895 3819 ASN-CXA-ALL-CCI-22773-RDC, US 39891 2801 3459 ALJAWWALSTC-AS, SA 8151 2721 8101 Uninet S.A. de C.V., MX 8551 2577 3116 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 30036 2229 2499 MEDIACOM-ENTERPRISE-BUSINESS, US Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1883 2:1185 3:70 4:18 5:3581 6:53 8:1500 9:1 11:1 12:1753 13:350 14:2423 15:75 16:14 17:309 18:93 20:113 23:4192 24:2369 25:3 27:2334 31:2181 32:114 34:1 35:36 36:1140 37:3555 38:2011 39:471 40:150 41:3848 42:880 43:2099 44:233 45:14644 46:3581 47:317 49:1603 50:1680 51:89 52:1108 54:217 55:771 56:6 57:57 58:1691 59:1150 60:818 61:2326 62:2211 63:1992 64:5227 65:2391 66:5128 67:2949 68:1165 69:4094 70:1402 71:685 72:3104 74:2567 75:1468 76:690 77:1989 78:3249 79:2511 80:1915 81:1627 82:1314 83:1100 84:1258 85:3096 86:617 87:1799 88:2418 89:2881 90:397 91:7203 92:1583 93:2558 94:2918 95:4159 96:1230 97:344 98:964 99:979 100:90 101:1051 102:1250 103:25156 104:3630 105:400 106:716 107:2179 108:693 109:3651 110:1995 111:2349 112:1696 113:1585 114:1419 115:1853 116:1867 117:2130 118:2299 119:1869 120:952 121:1052 122:2300 123:2164 124:1610 125:2144 128:1324 129:1269 130:775 131:2009 132:757 133:312 134:1384 135:328 136:686 137:902 138:2297 139:1172 140:733 141:1167 142:1049 143:1221 144:1208 145:340 146:1385 147:1216 148:2164 149:1256 150:760 151:1199 152:1548 153:446 154:2147 155:1252 156:1357 157:1150 158:901 159:2051 160:2034 161:1080 162:3244 163:942 164:1433 165:1308 166:600 167:1750 168:3598 169:638 170:4354 171:751 172:2042 173:2919 174:960 175:1062 176:2944 177:4377 178:2800 179:1855 180:2273 181:2589 182:3180 183:1565 184:2446 185:17634 186:4049 187:2964 188:3262 189:2702 190:9077 191:1349 192:10610 193:7864 194:6449 195:4586 196:3104 197:2269 198:6019 199:5950 200:7312 201:5291 202:10490 203:10084 204:4662 205:3102 206:3371 207:3324 208:3993 209:4624 210:4225 211:2139 212:3616 213:3211 214:1186 215:60 216:6144 217:2473 218:916 219:642 220:2095 221:928 222:974 223:1708 End of report

1 0

Spoofer Report for NANOG for Dec 2020
by CAIDA Spoofer Project 08 Jan '21

08 Jan '21

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Dec 2020: ASN Name Fixed-By 7859 PAIR-NETWORKS 2020-12-13 20473 AS-CHOOPA 2020-12-16 25787 ROWE-NETWORKS 2020-12-23 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Dec 2020: ASN Name First-Spoofed Last-Spoofed 54825 PACKET 2016-04-15 2020-12-09 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2020-12-21 6128 CABLE-NET-1 2016-09-03 2020-12-06 20412 CLARITY-TELECOM 2016-09-30 2020-12-31 6181 FUSE-NET 2016-10-10 2020-12-31 14971 PINETEL 2016-10-21 2020-12-19 11427 TWC-11427-TEXAS 2016-10-21 2020-12-23 32440 LONI 2016-11-03 2020-12-21 12083 WOW-INTERNET 2016-11-09 2020-12-30 30036 MEDIACOM-ENTERPRISE-BUSINESS 2016-11-16 2020-12-21 63296 AWBROADBAND 2017-09-01 2020-12-29 12222 AKAMAI 2018-02-14 2020-12-23 393564 SPOKANE 2018-06-05 2020-12-15 33452 RW 2018-09-19 2020-12-29 20448 VPNTRANET-LLC 2018-09-20 2020-12-15 8047 GCI 2019-04-11 2020-12-18 7859 PAIR-NETWORKS 2020-04-03 2020-12-20 6391 URBAN-15 2020-05-29 2020-12-23 11814 DISTRIBUTEL-AS11814 2020-11-22 2020-12-18 208188 PUGET-SOUND-NETWORKS 2020-12-04 2020-12-19 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Source Address Validation issues inferred during Dec 2020 using open resolver tests: ASN Name Last-Detected 16524 METTEL 2020-12-05 19257 SUBRIGO 2020-12-05 53274 3DB-WIRELESS 2020-12-04 395262 CENTRE-OF-EXCELLENCE-IN-NEXT-G 2020-12-04 11260 EASTLINK-HSI 2020-12-04 397081 AUWIRELESS-01 2020-12-04 53338 ITCI 2020-12-04 47023 NOR-NET-COMM 2020-12-04 40651 MONSTERGOVSOL 2020-12-04 32233 PERSONA 2020-12-03 394232 TELKEL-MTL 2020-12-03 46375 AS-SONICTELECOM 2020-12-03 9009 M247 2020-12-03 46328 FOUR-U 2020-12-03 15081 ASN-CROS-1 2020-12-02 16922 OUHSC-EDU 2020-12-02 29953 MORNCOMM 2020-12-02 396236 MIMOKC 2020-12-02 53456 WESTRUX 2020-12-01 11287 AS-MSEA 2020-12-01 4565 MEGAPATH2-US 2020-12-01 55175 CLOUDBURST 2020-12-01 395261 AS-HCCL-7 2020-12-01 25636 ONTL-2002 2020-12-01 30600 AS-CMN 2020-12-01 Further information for these tests is available at: https://spoofer.caida.org/ornog.php?country_include=usa,can Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

Video Conferencing options to Beijing
by Spencer Coplin 08 Jan '21

08 Jan '21

I know this is a bit outside of North America, so if this isn't relevant, please let me know. I have a client that is asking for video conferencing options back to Beijing for their users. What has everyone's experience been with setting up a solution like this? We have to assume the Chinese users will be on non-VPN connections and under the filters of the Great Firewall of China. We are looking for software that can be installed on Windows, so apps that rely on Android or iOS are at bottom of our list, but not fully out of consideration. Teams was my first thought, but per Microsoft, Teams isn't available in China: https://docs.microsoft.com/en-us/microsoft-365/admin/services-in-china/serv… Thank you, Spencer

2 2

handling DDoS to hosted CDN cache
by Yang Yu 08 Jan '21

08 Jan '21

How often does your hosted CDN cache get DDoS'ed? I am curious how these get handled (especially when it would cause upstream/backbone congestion). Is this treated differently than DDoS to customers? Any experience to share on working with CDNs to solve these issues? Any CDN that provides good information/resources for mitigation (e.g. drop A traffic, ratelimit B traffic to x pps)? If the cache provides flowspec feed, how useful would it be? Yang

2 1

nike.com->nike.com/ca
by Kain, Becki (.) 07 Jan '21

07 Jan '21

At home, using 8.8.8.8, if I goto www.nike.com<http://www.nike.com>, I get rerouted to nike.com/ca. I cleared the dns cache (I'm running Catalina macos) and rebooted just because. Anyone else seen a weirdism on this? thanks Becki in Detroit

8 10

Gasline Telecom DE Contact
by Rod Beck 07 Jan '21

07 Jan '21

Please provide your details. I need a good sales rep. Regards, Roderick. Roderick Beck VP of Business Development United Cable Company www.unitedcablecompany.com<http://www.unitedcablecompany.com> New York City & Budapest rod.beck(a)unitedcablecompany.com Budapest: 36-70-605-5144 NJ: 908-452-8183 [1467221477350_image005.png]

1 0

RE: nike.com->nike.com/ca
by Kain, Becki (.) 06 Jan '21

06 Jan '21

Yet I could goto the site, via Ford's network (ssssh, shopping at home) and I'm in the same city as Ford. Go fig -----Original Message----- From: William Herrin <bill(a)herrin.us> Sent: Wednesday, January 06, 2021 4:48 PM To: Kain, Becki (.) <bkain1(a)ford.com> Subject: Re: nike.com->nike.com/ca On Wed, Jan 6, 2021 at 1:42 PM Kain, Becki (.) <bkain1(a)ford.com> wrote: > At home, using 8.8.8.8, if I goto > https://clicktime.symantec.com/3R152eRtwvwtDYyinkDfVJ87Vc?u=www.nike.c > om, I get rerouted to nike.com/ca. I cleared the dns cache (I’m > running Catalina macos) and rebooted just because. Anyone else seen a > weirdism on this? thanks Welcome to Why You Shouldn't Make Customer-Visible Decisions Based On DNS Resolver Geolocation or DNS Load Balancing Sucks 101. Nike.com is geolocating the server IP address which requests the web site address. This isn't yours or 8.8.8.8 but instead some unicast IP address to which your 8.8.8.8 packet was routed. Possibly in Canada. Nike appears to think so. Regards, Bill Herrin -- Hire me! https://clicktime.symantec.com/3XJHfJTMqdU2jpHEptZsUfR7Vc?u=https%3A%2F%2Fb…

2 1