- NANOG - lists.nanog.org

Brace yourselves.. W32/Sobig-F about to mutate...
by Valdis.Kletnieks＠vt.edu 22 Aug '03

22 Aug '03

A quick heads up, if anybody hasn't heard: At 1900GMT today, ET phones home, and picks up the next payload of instructions. Nobody knows (yet) what they'll be, but SoBig-E erased itself, put in a password grabber, and then installed a mail proxy for spammer use. This one *may* just play the theme song from Bozo the Clown and erase itself, but I severely doubt it's gonna be that nice. http://www.f-secure.com/news/items/news_2003082200.shtml

6 5

RE: Sobig.f surprise attack today
by Vachon, Scott 22 Aug '03

22 Aug '03

>OK... Maybe I'm smoking crack here, but, if they have the list of 20 >machines,wouldn't it make more sense to replace them with honey-pots that download >code to remove SOBIG instead of just disabling them? Only if we make assumptions that what they state is 100% fact and the whole truth of the matter. They know of 20 but, who is to say a variant in the wild doesn't know of 20 more ? Or 100 more ? Too late anyway. My other list subscriptions show it active now ... ~S~ Disclaimer: my own 2 cents. Learn more about Paymentech's payment processing services at www.paymentech.com THIS MESSAGE IS CONFIDENTIAL. This e-mail message and any attachments are proprietary and confidential information intended only for the use of the recipient(s) named above. If you are not the intended recipient, you may not print, distribute, or copy this message or any attachments. If you have received this communication in error, please notify the sender by return e-mail and delete this message and any attachments from your computer.

2 1

RE: Sobig.f surprise attack today
by Irwin Lazar 22 Aug '03

22 Aug '03

FYI: ------------------------------------------------------------------------ -------- At 1500 GMT, Mikko Hypponen, director of anti-virus research at F-Secure, told New Scientist that 18 of the 20 internet addresses his company had identified in the virus had been blocked. "But if even one machine remains online at the deadline, anything could happen," he warned. Hypponen said F-secure had notified the FBI and internet service providers who run the addresses listed in the worm and said some of the companies have agreed to temporarily block access to those machines. The target machines are based in Canada, USA and South Korea. Unreachable address At 1750 GMT, New Scientist ascertained that all but one of the 20 addresses were inaccessible. The 19 unreachable addresses may have been blocked, or could always have been protected by a firewall. The last open address is in Toronto, and is provided by the internet service provider Sympatico. Its spokesperson told New Scientist: "We are aware of the virus and are working with local law enforcement to identify the person behind the virus." A possible reason for deliberately leaving an address open might be to act as a "honey pot" - an address controlled by the authorities to observe the worm in action. However, the latest analysis of SoBig.F has revealed that even if this attempt to block access to the 20 addresses is successful, more action may be needed. Infected machines are programmed to check twice a week at the same time for new list of servers to contact. This new list could be delivered via a new virus. The existing list of 20 appears to list Windows PCs belonging to home users and connected to the internet via always-on, ADSL broadband connections, says Hypponen. "It is most likely that the party behind SoBig.F has broken into these computers and they are now being misused to be part of this attack." The worm's previous variant, SoBig.E, downloaded a program that removed the virus itself to cover its tracks, and then tried to steal the user's network and web passwords. But the machines infected with SoBig.F will try to connect to port 8998 on one of the hijacked machines. They will transmit a secret 8-byte code, which will cause the hijacked machines to return a web link to a site from which the malicious code can be downloaded. Attempts to discover this target link have so far been foiled, as the worm's writer used a bogus URL. Experts believe that this link would be changed to the real one a few seconds before the deadline, too late for companies to block. David Cohen

1 0

RE: Sobig.f surprise attack today
by Todd Mitchell - lists 22 Aug '03

22 Aug '03

| From: Brian Kirby [mailto:bkirby@adsnetcurve.com] | Sent: Friday, August 22, 2003 2:50 PM | To: Omachonu Ogali; Todd Mitchell - lists | Cc: nanog(a)merit.edu | Subject: RE: Sobig.f surprise attack today | | Does anyone have the list of ips available to public?? http://xforce.iss.net/xforce/alerts/id/151 Scroll to the bottom. Todd -- | -----Original Message----- | From: Omachonu Ogali [mailto:nanog@missnglnk.com] | Sent: Friday, August 22, 2003 2:46 PM | To: Todd Mitchell - lists | Cc: nanog(a)merit.edu | Subject: Re: Sobig.f surprise attack today | | | If you're responsible for any of the IPs on the list, better | permanently remove them from your DHCP pools, IP assignments, | dial-up pools, or anything else that assigns IP addresses, | because these will be filtered and forgotten for the next | 200 years.

1 0

Re: Brace yourselves.. W32/Sobig-F about to mutate...
by Fergie 22 Aug '03

22 Aug '03

Let's not get too spooked -- this is yet another annoyance that exemplifies just how ludicrous the virus writer's "one-upmanship" really can get, something which has been around for quite some time. Thanks for the heads-up, which is (in my opinion) the appropriate response -- anything resembling panic, scare tactics, or a "Charlie Foxtrot", would only contribute to the problem. It seems like that has become the norm (charlie yada), and as engineering folk, we need to be more objective. :-) Let's make sure we put this into the proper perspective and not contribute to the hype. Does that sound fair? (This is merely a general statement/question and not directed to Valdis.) Cheers, - fergie Valdis wrote: A quick heads up, if anybody hasn't heard: At 1900GMT today, ET phones home, and picks up the next payload of instructions. Nobody knows (yet) what they'll be, but SoBig-E erased itself, put in a password grabber, and then installed a mail proxy for spammer use. This one *may* just play the theme song from Bozo the Clown and erase itself, but I severely doubt it's gonna be that nice. http://www.f-secure.com/news/items/news_2003082200.shtml

2 1

RE: Cisco filter question
by Lucas Iglesias 22 Aug '03

22 Aug '03

Geo, The problem is simple. If you put in a single route-map entry 2 matchs entries, it must match both of them to set the interface to Null0. If you'd like to match all ICMP packets and also 92 lenght packets, try to do this: route-map nachi-worm permit 10 match ip address 199 set interface Null0 ! route-map nachi-worm permit 10 match length 92 set interface Null0 ! Good luck, tell me how it works. Luckas.- -----Mensaje original----- De: Geo. [mailto:georger@getinfo.net] Enviado el: Viernes, 22 de Agosto de 2003 01:17 p.m. Para: nanog(a)merit.edu Asunto: Cisco filter question Perhaps one of you router experts can answer this question. When using the cisco specified filter access-list 199 permit icmp any any echo access-list 199 permit icmp any any echo-reply route-map nachi-worm permit 10 ! --- match ICMP echo requests and replies (type 0 & 8) match ip address 199 ! --- match 92 bytes sized packets match length 92 92 ! --- drop the packet set interface Null0 interface <incoming-interface> ! --- it is recommended to disable unreachables no ip unreachables ! --- if not using CEF, enabling ip route-cache flow is recommended ip route-cache policy ! --- apply Policy Based Routing to the interface ip policy route-map nachi-worm why would it not stop this packet

1 0

RE: Cisco filter question
by Michel Py 22 Aug '03

22 Aug '03

Instead of: > set interface Null0 Use: set ip next-hop 10.255.255.254 _and_ ip route 10.255.255.254 255.255.255.255 Null0 name BLACKHOLE Michel. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Geo. Sent: Friday, August 22, 2003 9:17 AM To: nanog(a)merit.edu Subject: Cisco filter question Perhaps one of you router experts can answer this question. When using the cisco specified filter access-list 199 permit icmp any any echo access-list 199 permit icmp any any echo-reply route-map nachi-worm permit 10 ! --- match ICMP echo requests and replies (type 0 & 8) match ip address 199 ! --- match 92 bytes sized packets match length 92 92 ! --- drop the packet set interface Null0 interface <incoming-interface> ! --- it is recommended to disable unreachables no ip unreachables ! --- if not using CEF, enabling ip route-cache flow is recommended ip route-cache policy ! --- apply Policy Based Routing to the interface ip policy route-map nachi-worm why would it not stop this packet 15 1203.125000 0003E3956600 AMERIC6625D4 ICMP Echo: From 216.144.20.69 To 216.144.00.27 216.144.20.69 216.144.0.27 IP FRAME: Base frame properties FRAME: Time of capture = 8/22/2003 11:54:16.859 FRAME: Time delta from previous physical frame: 0 microseconds FRAME: Frame number: 15 FRAME: Total frame length: 106 bytes FRAME: Capture frame length: 106 bytes FRAME: Frame data: Number of data bytes remaining = 106 (0x006A) ETHERNET: ETYPE = 0x0800 : Protocol = IP: DOD Internet Protocol ETHERNET: Destination address : 00C0B76625D4 ETHERNET: .......0 = Individual address ETHERNET: ......0. = Universally administered address ETHERNET: Source address : 0003E3956600 ETHERNET: .......0 = No routing information present ETHERNET: ......0. = Universally administered address ETHERNET: Frame Length : 106 (0x006A) ETHERNET: Ethernet Type : 0x0800 (IP: DOD Internet Protocol) ETHERNET: Ethernet Data: Number of data bytes remaining = 92 (0x005C) IP: ID = 0x848; Proto = ICMP; Len: 92 IP: Version = 4 (0x4) IP: Header Length = 20 (0x14) IP: Precedence = Routine IP: Type of Service = Normal Service IP: Total Length = 92 (0x5C) IP: Identification = 2120 (0x848) IP: Flags Summary = 0 (0x0) IP: .......0 = Last fragment in datagram IP: ......0. = May fragment datagram if necessary IP: Fragment Offset = 0 (0x0) bytes IP: Time to Live = 124 (0x7C) IP: Protocol = ICMP - Internet Control Message IP: Checksum = 0x70D8 IP: Source Address = 216.144.20.69 IP: Destination Address = 216.144.0.27 IP: Data: Number of data bytes remaining = 72 (0x0048) ICMP: Echo: From 216.144.20.69 To 216.144.00.27 ICMP: Packet Type = Echo ICMP: Echo Code = 0 (0x0) ICMP: Checksum = 0x82AA ICMP: Identifier = 512 (0x200) ICMP: Sequence Number = 7680 (0x1E00) ICMP: Data: Number of data bytes remaining = 64 (0x0040) 00000: 00 C0 B7 66 25 D4 00 03 E3 95 66 00 08 00 45 00 .À·f%Ô..ã*f...E. 00010: 00 5C 08 48 00 00 7C 01 70 D8 D8 90 14 45 D8 90 .\.H..|.pØØ.EØ 00020: 00 1B 08 00 82 AA 02 00 1E 00 AA AA AA AA AA AA ....'ª....ªªªªªª 00030: AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA ªªªªªªªªªªªªªªªª 00040: AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA ªªªªªªªªªªªªªªªª 00050: AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA ªªªªªªªªªªªªªªªª 00060: AA AA AA AA AA AA AA AA AA AA ªªªªªªªªªª

2 1

Sea sponge builds a better glass fiber
by Eric Kuhnke 22 Aug '03

22 Aug '03

http://www.msnbc.com/news/954985.asp?0dm=C12MT Associated Press Scientists say they have identified an ocean sponge living in the darkness of the deep sea that grows thin glass fibers capable of transmitting light at least as well as industrial fiber optic cables used for telecommunication. The natural glass fibers also are much more flexible than manufactured fiber optic cable that can crack if bent too far. "YOU CAN ACTUALLY tie a knot in these natural biological fibers and they will not break -- it's really quite amazing," said Joanna Aizenberg, who led the research at Bell Laboratories.

13 17

DDoS traffic
by Matthew Sullivan 22 Aug '03

22 Aug '03

Hi All, My appologies if this is against the group topic (and someone please let me know so I will not post again if I come to the same position)... Is there a member of Comcast Abuse here... For some time now a host has been attempting to DoS (as part of a larger DDoS) one of my machines. I have a reporting script that has now been running for at least 24 hours with no change in the traffic (even Kornet has clean up their reported hosts)... Sample from a few minutes ago: 21:02:42.538809 24.98.155.201.4002 > 203.15.51.44.3995: udp 1015 21:02:42.640085 24.98.155.201.4002 > 203.15.51.44.3995: udp 1022 21:02:42.777978 24.98.155.201.4002 > 203.15.51.44.8864: udp 1019 21:02:42.854118 24.98.155.201.4002 > 203.15.51.44.12814: udp 1018 21:02:42.971654 24.98.155.201.4002 > 203.15.51.44.12814: udp 1019 21:02:43.082695 24.98.155.201.4002 > 203.15.51.44.31305: udp 1017 21:02:43.215009 24.98.155.201.4002 > 203.15.51.44.31305: udp 1019 21:02:43.307266 24.98.155.201.4002 > 203.15.51.44.25940: udp 1023 21:02:43.419239 24.98.155.201.4002 > 203.15.51.44.13263: udp 1022 21:02:43.503134 24.98.155.201.4002 > 203.15.51.44.13263: udp 1017 21:02:43.650252 24.98.155.201.4002 > 203.15.51.44.26162: udp 1018 21:02:43.711223 24.98.155.201.4002 > 203.15.51.44.25159: udp 1015 21:02:43.843544 24.98.155.201.4002 > 203.15.51.44.25159: udp 1017 21:02:43.964055 24.98.155.201.4002 > 203.15.51.44.4333: udp 1023 21:02:44.049052 24.98.155.201.4002 > 203.15.51.44.4333: udp 1020 21:02:44.180422 24.98.155.201.4002 > 203.15.51.44.28683: udp 1023 Thank you.

1 1

The Cidr Report
by cidr-report＠potaroo.net 22 Aug '03

22 Aug '03

This report has been generated at Fri Aug 22 21:48:33 2003 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 15-08-03 123680 87339 16-08-03 122130 88277 17-08-03 123717 88366 18-08-03 123851 88406 19-08-03 123842 88293 20-08-03 123937 88310 21-08-03 124096 88451 22-08-03 124363 88483 AS Summary 15665 Number of ASes in routing system 6224 Number of ASes announcing only one prefix 1482 Largest number of prefixes announced by an AS AS701 : ALTERNET-AS UUNET Technologies, Inc. 73223168 Largest address span announced by an AS (/32s) AS568 : SUMNET-AS DISO-UNRRA Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 22Aug03 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 124496 88546 35950 28.9% All ASes AS4323 623 181 442 70.9% TW-COMM Time Warner Communications, Inc. AS701 1482 1042 440 29.7% ALTERNET-AS UUNET Technologies, Inc. AS7018 1392 983 409 29.4% ATT-INTERNET4 AT&T WorldNet Services AS3908 911 541 370 40.6% SUPERNETASBLK SuperNet, Inc. AS7843 565 209 356 63.0% ADELPHIA-AS Adelphia Corp. AS11305 358 38 320 89.4% INTERLAND-NET1 Interland Incorporated AS6197 569 257 312 54.8% BATI-ATL BellSouth Network Solutions, Inc AS6198 513 202 311 60.6% BATI-MIA BellSouth Network Solutions, Inc AS1221 1041 731 310 29.8% ASN-TELSTRA Telstra Pty Ltd AS4355 404 112 292 72.3% ERMS-EARTHLNK EARTHLINK, INC AS6347 357 91 266 74.5% DIAMOND SAVVIS Communications Corporation AS1239 904 647 257 28.4% SPRINTLINK Sprint AS27364 316 68 248 78.5% ACS-INTERNET Armstrong Cable Services AS25844 256 14 242 94.5% SKADDEN1 Skadden, Arps, Slate, Meagher & Flom LLP AS17676 251 25 226 90.0% GIGAINFRA Softbank BB Corp. AS22773 243 20 223 91.8% CCINET-2 Cox Communications Inc. Atlanta AS209 517 300 217 42.0% ASN-QWEST Qwest AS4134 318 123 195 61.3% CHINANET-BACKBONE No.31,Jin-rong Street AS705 483 302 181 37.5% ALTERNET-AS UUNET Technologies, Inc. AS6140 314 137 177 56.4% IMPSAT-USA ImpSat AS6327 200 26 174 87.0% SHAW Shaw Communications Inc. AS2386 375 203 172 45.9% INS-AS AT&T Data Communications Services AS7132 410 240 170 41.5% SBIS-AS SBC Internet Services - Southwest AS2048 256 87 169 66.0% LANET-1 State of Louisiana AS17557 303 136 167 55.1% PKTELECOM-AS-AP Pakistan Telecom AS14654 165 3 162 98.2% WAYPORT Wayport AS5786 165 5 160 97.0% UPRENET University of Puerto Rico AS3602 233 85 148 63.5% SPRINT-CA-AS Sprint Canada Inc. AS4538 168 21 147 87.5% ERX-CERNET-BKB China Education and Research Network Center AS20115 474 327 147 31.0% CHARTER-NET-HKY-NC Charter Communications Total 14566 7156 7410 50.9% Top 30 total Possible Bogus Routes 24.119.0.0/16 AS11492 CABLEONE CABLE ONE 61.12.32.0/24 AS7545 TPG-INTERNET-AP TPG Internet Pty Ltd 61.12.34.0/24 AS7545 TPG-INTERNET-AP TPG Internet Pty Ltd 64.30.64.0/19 AS14900 USLEC-CORP-1 USLEC Corp. 66.15.128.0/24 AS3356 LEVEL3 Level 3 Communications, LLC 66.41.192.0/18 AS13367 ATT-BBND-B AT&T Broadband 69.36.224.0/19 AS8121 TCH TCH Network Services 132.0.0.0/10 AS568 SUMNET-AS DISO-UNRRA 137.0.0.0/13 AS568 SUMNET-AS DISO-UNRRA 138.136.0.0/13 AS568 SUMNET-AS DISO-UNRRA 140.143.2.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 140.240.0.0/13 AS1 GNTY-1 Genuity 158.0.0.0/13 AS568 SUMNET-AS DISO-UNRRA 165.212.0.0/16 AS7424 USANET USA.Net 166.16.0.0/16 AS7132 SBIS-AS SBC Internet Services - Southwest 192.43.230.0/24 AS4738 SAARDNET-AS South Australian Academic Research and Development Network 192.44.0.0/19 AS702 ALTERNET-AS UUNET Technologies, Inc. 192.83.16.0/20 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.32.0/19 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.64.0/19 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.96.0/22 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.100.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.88.99.0/24 AS3246 SONGNETWORKS Song Networks 192.119.135.0/24 AS270 PSCNI-AS National Aeronautics and Space Administration 192.124.252.0/22 AS680 AS680 DFN-IP service G-WiN 192.135.50.0/24 AS7018 ATT-INTERNET4 AT&T WorldNet Services 192.136.71.0/24 AS719 AS719 LANLINK autonomous system 192.136.79.0/24 AS719 AS719 LANLINK autonomous system 192.153.136.0/21 AS568 SUMNET-AS DISO-UNRRA 192.153.144.0/21 AS568 SUMNET-AS DISO-UNRRA 192.172.0.0/19 AS568 SUMNET-AS DISO-UNRRA 192.188.208.0/20 AS568 SUMNET-AS DISO-UNRRA 192.243.32.0/23 AS2044 PALIN-AS Palin Aquisitions Inc. 198.23.26.0/24 AS4390 BELLATLANTIC-COM Bell Atlantic, Inc. 198.97.72.0/21 AS568 SUMNET-AS DISO-UNRRA 198.97.80.0/20 AS568 SUMNET-AS DISO-UNRRA 198.97.88.0/24 AS89 NUSC-CSTLNET-AS Naval Underwater Systems Center 198.97.192.0/20 AS568 SUMNET-AS DISO-UNRRA 198.97.240.0/20 AS568 SUMNET-AS DISO-UNRRA 198.98.8.0/21 AS3701 NERONET Oregon Joint Graduate Schools of Engineering 198.101.4.0/22 AS568 SUMNET-AS DISO-UNRRA 198.136.32.0/20 AS19329 MCNET Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY-NET CityNet, Inc. 198.161.87.0/24 AS6539 GROUPTLCOM GT Group Telecom Services Corp. 198.161.165.0/24 AS852 ASN852 Telus Advanced Communications 198.163.155.0/24 AS684 MBNET-AS Manitoba Regional Network 198.167.0.0/16 AS7456 INTERHOP Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ATTCA-15290 AT&T Canada Telecom Services Company 198.168.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASKTEL SaskTel 198.232.133.0/24 AS23075 SKOTOS-AS Skotos Tech, Inc 199.10.0.0/16 AS568 SUMNET-AS DISO-UNRRA 199.60.0.0/20 AS271 BCNET-AS University of British Columbia 199.79.32.0/20 AS3701 NERONET Oregon Joint Graduate Schools of Engineering 199.84.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 199.114.0.0/18 AS568 SUMNET-AS DISO-UNRRA 199.114.0.0/21 AS568 SUMNET-AS DISO-UNRRA 199.114.128.0/18 AS568 SUMNET-AS DISO-UNRRA 199.114.140.0/24 AS3544 ITSDN-U7 DISA/UNRRA 199.114.152.0/24 AS1913 DLA4 Defense Logistics Agency 199.120.32.0/19 AS16582 NEXTLEVELINTERNET NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS568 SUMNET-AS DISO-UNRRA 199.123.16.0/20 AS568 SUMNET-AS DISO-UNRRA 199.123.80.0/21 AS568 SUMNET-AS DISO-UNRRA 199.166.18.0/24 AS701 ALTERNET-AS UUNET Technologies, Inc. 199.202.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 202.0.180.0/24 AS4058 APNIC-4058 Asia Pacific Network Information Centre 202.3.144.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.145.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.146.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.147.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.148.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.149.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.150.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.151.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.152.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.153.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.154.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.155.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.156.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.157.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.158.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.3.159.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.4.252.0/22 AS4808 CHINA169-BJ CNCGROUP IP network¡ªChina169 Beijing Province Network 202.4.255.0/24 AS4799 UNSPECIFIED Ji Tong Communications Co., Ltd. 202.6.99.0/24 AS4761 INDOSAT1-AP INDOSATNET-ASN 202.10.72.0/21 AS9716 AUSTAR-AS-AP Austar Entertainement 202.44.112.0/20 AS17458 CWNETDG-IO-AP Cable and Wireless 202.89.200.0/24 AS7473 SINGTEL-AS-AP Singapore Telecom 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.93.64.0/19 AS9425 I-NEXT-AS-AP Inter.net Philippines border AS 202.122.76.0/24 AS17553 TIMELESS-AP System Integration provider 202.130.224.0/20 AS4808 CHINA169-BJ CNCGROUP IP network¡ªChina169 Beijing Province Network 202.130.240.0/21 AS4808 CHINA169-BJ CNCGROUP IP network¡ªChina169 Beijing Province Network 202.130.248.0/22 AS4812 CHINANET-SH-AP China Telecom (Group) 202.130.252.0/22 AS4812 CHINANET-SH-AP China Telecom (Group) 202.136.254.0/23 AS4808 CHINA169-BJ CNCGROUP IP network¡ªChina169 Beijing Province Network 202.136.254.0/24 AS4808 CHINA169-BJ CNCGROUP IP network¡ªChina169 Beijing Province Network 202.142.130.0/23 AS17820 DIL-AP DIRECT INTERNET LTD. 202.142.132.0/22 AS17820 DIL-AP DIRECT INTERNET LTD. 202.143.48.0/21 AS4795 INDOSAT2-ID-AP INDOSATNET-ASN 202.143.56.0/21 AS4795 INDOSAT2-ID-AP INDOSATNET-ASN 202.148.192.0/20 AS9942 COMINDICO-AP COMindico Australia 202.148.208.0/21 AS9942 COMINDICO-AP COMindico Australia 202.148.216.0/22 AS9942 COMINDICO-AP COMindico Australia 202.148.220.0/23 AS9942 COMINDICO-AP COMindico Australia 202.148.222.0/24 AS9942 COMINDICO-AP COMindico Australia 202.148.223.0/24 AS705 ALTERNET-AS UUNET Technologies, Inc. 202.161.0.0/19 AS10097 FLOWCOM flow communications level 2 541 kent st sydney nsw 2000 202.161.8.0/21 AS4634 -No Whois Entry- 202.164.192.0/19 AS7599 IPXC-AS-AP IP Exchange 202.165.0.0/19 AS9443 INTERNETPRIMUS-AS-AP Primus Telecommunications 202.189.234.0/23 AS9658 ETPI-IDS-AS-AP Eastern Telecoms Phils., Inc. 203.10.17.0/24 AS9266 VIPER-AU-AP Vipernet 203.10.18.0/24 AS9266 VIPER-AU-AP Vipernet 203.10.19.0/24 AS9266 VIPER-AU-AP Vipernet 203.10.20.0/24 AS9266 VIPER-AU-AP Vipernet 203.10.21.0/24 AS9266 VIPER-AU-AP Vipernet 203.10.22.0/24 AS9266 VIPER-AU-AP Vipernet 203.10.23.0/24 AS9266 VIPER-AU-AP Vipernet 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.76.128.0/24 AS9729 IS-AP iAdvantage Limited 203.76.224.0/24 AS9549 COMDEK-ISP-AS-AP Comdek ISP 203.86.2.0/23 AS4058 APNIC-4058 Asia Pacific Network Information Centre 203.90.192.0/20 AS9658 ETPI-IDS-AS-AP Eastern Telecoms Phils., Inc. 203.129.126.0/24 AS7473 SINGTEL-AS-AP Singapore Telecom 203.129.127.0/24 AS7473 SINGTEL-AS-AP Singapore Telecom 203.132.95.0/24 AS9787 CONCEPT-AU-AP Concept Networks 203.132.97.0/24 AS7652 VIANET-AS-AP Vianet Communications Pty Ltd 203.132.99.0/24 AS7657 TIG-US-PAS-AP The Internet Group Limited 203.132.102.0/24 AS9398 ARACHNET-AS-AP Arachnet 203.132.103.0/24 AS9663 KARRATHA-AS-AP Karratha Internet Support Services 203.132.104.0/24 AS9663 KARRATHA-AS-AP Karratha Internet Support Services 203.132.105.0/24 AS9663 KARRATHA-AS-AP Karratha Internet Support Services 203.132.106.0/24 AS9398 ARACHNET-AS-AP Arachnet 203.132.107.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.108.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.109.0/24 AS10141 CALOUNDRA-AS-AP Caloundra.net 203.132.110.0/24 AS7598 ALPHALINK-AS-AP Alphalink Pty Limited - Melbourne, Australia 203.132.111.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.112.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.118.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.122.0/24 AS4802 WANTREE-AS-AP Wantree Development 203.132.123.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.124.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.125.0/24 AS4817 TECHEX1-AS-AP Techex Primary Netblock 203.135.99.0/24 AS2687 IBM-MMD-AS IBM 203.135.224.0/19 AS4058 APNIC-4058 Asia Pacific Network Information Centre 203.171.96.0/19 AS703 ALTERNET-AS UUNET Technologies, Inc. 203.171.102.0/24 AS703 ALTERNET-AS UUNET Technologies, Inc. 204.19.224.0/19 AS816 UUNET-AS4 UUNET Technologies, Inc. 204.29.189.0/24 AS3956 TX-METRO Texas Metronet 204.52.232.0/24 AS7177 DFWNET DFW Internet Services, Inc. 204.89.225.0/24 AS2495 KANREN Kansas Research and Education Network 204.194.110.0/23 AS10588 ICSNET Intelligent Computer Solutions, Inc 205.150.0.0/15 AS701 ALTERNET-AS UUNET Technologies, Inc. 206.41.32.0/19 AS14824 NEWSOUTH NewSouth Communications Corp. 206.81.187.0/24 AS19194 JOVITA Sentris Network LLC 206.82.64.0/18 AS7029 ALLTELNET Alltel Information Services, Inc. 206.108.34.0/24 AS852 ASN852 Telus Advanced Communications 206.108.35.0/24 AS852 ASN852 Telus Advanced Communications 206.126.0.0/19 AS5750 FLEXNET-HAWAII FlexNet Inc. 206.167.57.0/24 AS376 RISQ-AS Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ATTCA-15290 AT&T Canada Telecom Services Company 206.251.69.0/24 AS27429 TIL Telesat International Ltd. 207.47.39.0/24 AS816 UUNET-AS4 UUNET Technologies, Inc. 207.92.0.0/14 AS2551 ICG ICG NetAhead, Inc. 207.162.192.0/19 AS4589 EASYNET Easynet Group Plc 207.231.96.0/19 AS11194 NUNETPA NuNet Inc 208.65.232.0/23 AS701 ALTERNET-AS UUNET Technologies, Inc. 208.81.187.0/24 AS19194 JOVITA Sentris Network LLC 208.104.103.0/24 AS1239 SPRINTLINK Sprint 209.104.252.0/22 AS12030 PACIFIC-ONLINE-PON Pacific Online Services 209.108.0.0/14 AS2551 ICG ICG NetAhead, Inc. 209.151.128.0/19 AS816 UUNET-AS4 UUNET Technologies, Inc. 209.160.73.0/24 AS13415 LUMIX Lumix Communications, Inc. 209.169.219.0/24 AS189 GENUITY-AS189 Genuity 209.169.223.0/24 AS189 GENUITY-AS189 Genuity 209.172.0.0/18 AS7770 TRITON Triton Technologies, Inc. 209.213.32.0/19 AS10629 INTERPAC Inter-Pacific Network Services 209.213.160.0/19 AS4355 ERMS-EARTHLNK EARTHLINK, INC 209.222.137.0/24 AS27429 TIL Telesat International Ltd. 209.240.96.0/19 AS10815 KCNET KCnet, Inc. 209.251.0.0/19 AS11036 SISCOM SISCOM, Inc 209.251.64.0/19 AS10266 NETWAY-AS MDC, Inc. 210.213.0.0/19 AS6453 TELEGLOBE-AS Teleglobe Inc 211.27.156.0/24 AS9768 PUBNET1-AS KT 216.18.224.0/21 AS11458 IMBRIS IMBRIS, INC. 216.18.224.0/22 AS11458 IMBRIS IMBRIS, INC. 216.18.228.0/22 AS11458 IMBRIS IMBRIS, INC. 216.47.32.0/19 AS11304 SPLUS Solutions Plus Inc. 216.96.128.0/18 AS7018 ATT-INTERNET4 AT&T WorldNet Services 216.153.0.0/17 AS6203 ISDN-NET ISDN-Net Inc. 216.226.108.0/22 AS3602 SPRINT-CA-AS Sprint Canada Inc. Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0