- NANOG - lists.nanog.org

Re: backtracking forged packets?
by konrad＠zemek.io 16 Mar '20

16 Mar '20

On 2020-03-14 23:50, Damian Menscher <damian at google.com> wrote: > I don't recommend filtering the SYN-ACK packets. That's what Octolus did, > and the result was leaving half-open SYN_RECV connections on all the nodes > used for reflection. That has two downsides: > > - the reflectors will retry the SYN-ACK (several times), which increases > your PPS load (amplifying the attack) > - the providers may notice the large number of SYN_RECV connections from > your network and put you on a blacklist I work at Path Network; we're providing DDoS mitigation services for Octolus. I wanted to follow up your message with a couple of points from our POV. The filter we have running for Octolus is a more generic stateful TCP filter, designed primarily to curb spoofed TCP floods. The bigger attacks we see are on the magnitude of 100s of Gbps/Mpps, and a simple fact is that outright dropping an out-of-state packet is multiple times less expensive for us than creating and responding with a RST. We see spoofed TCP attacks much more frequently than a SYN-ACK reflection, and in fact from our automation's point of view this looks exactly like a SYN-ACK flood from randomized source addresses. Aside from the resources cost, sending back RSTs for non-reflected attacks of respectable volume might also not be appreciated by some networks. Knowing the specifics of this long-running reflection attacks, we're considering how to reply with RSTs so to not leave lingering SYN_RECVs on reflectors' side. On 2020-03-15 16:36, Jean | ddostest.me <jean at ddostest.me> wrote: > I believe that Oculus blocked the RST and not the SYN/ACK. The SYN-ACKs are dropped; letting them reach the end servers and dropping outgoing RSTs instead would make for poor mitigation. :) On 2020-03-14 23:50, Damian Menscher <damian at google.com> wrote (cont.): > I don't want to leave you with the impression that it's hopeless... these > attacks aren't impossible to stop --- it just requires convincing the > transit providers to care. > > Damian > > On Sat, Mar 14, 2020 at 1:31 PM Jean | ddostest.me via NANOG < > nanog at nanog.org> wrote: > > Hi Bill, > > thanks for sharing the data. Indeed, I can't offer you a way to backtrack > the spoofed packets. > > Anyway, I'm not sure what could you do legally as there is a very high > chance that these people are not in the USA and the CFAA won't apply to > them. > > Here is what I would do if I was in your situation. > > Since these packets are spoof and malformed, I would block all SYN/ACK > based on the length. > > Depending on your hardware, it's very easy to inspect *only the SYN/ACK > by length* if you have modern hardware. On linux/unix, it's also very > straightforward. I'm not sure for windows though. > > Here is the details of the analysis: > > Today, all the SYN and SYN/ACK includes a minimum of options like MSS, WS, > SACK, NOP (Only a spacer, sometimes 2) and extended TS. There might be > others, but let's use the basic one. > > In your case, there are none. There is only MSS and the SYN length is 44 > bytes. These are spoof packets maybe generated by either TCP-AMP like > reported earlier. > > I would try to block all SYN/ACK coming toward your network with a length > of 44 bytes or lower. But, this is weird because it should be 54 bytes. > Maybe there is some offloading of some sort in your gear. > > Now depending on your hardware, it could work or it could kill your router > as it will punt the cpu. I guess you have some modern gear. > > What I do when I am not sure about the length, I start to accept and log > at 60 bytes, then 58, 56, 54... 44 until I catch the gremlins. > > Once you found the sweet spot, you drop all SYN/ACK toward your /23 lower > than X bytes. It won't kill or block anything legitimate if you do it > properly. :) > > What will happen is that you will not reply to these spoof SYN/ACK with a > RST and still allowing RST for legit SYN and SYN/ACK. Akamai and your > service providers will be happy and should not penalize you. > > I'm pretty sure that it will help you as it did for me in the past. > > Let me know if it's not clear and/or which part is foggy and I'll try to > give more details and better explanation. > > Regards, > > Jean St-Laurent > On 2020-03-14 11:46, William Herrin wrote: > > On Sat, Mar 14, 2020 at 4:02 AM Jean | ddostest.me via NANOG<nanog at nanog.org> <nanog at nanog.org> wrote: > > can you post some forged packets please? You can send them offlist if > you prefer. > > Hi Jean, > > Here are a couple examples (PDT this morning): > > 08:22:43.413250 IP (tos 0x0, ttl 55, id 10108, offset 0, flags [none], > proto ICMP (1), length 56) > 45.89.93.26 > 199.33.225.218: ICMP host 45.89.93.26 unreachable - > admin prohibited filter, length 36 > IP (tos 0x0, ttl 69, id 10108, offset 0, flags [DF], proto TCP > (6), length 40) > 199.33.225.218.9851 > 45.89.93.26.443: [|tcp] > 0x0000: 4500 0038 277c 0000 3701 28da 2d59 5d1a > 0x0010: c721 e1da 030d 4b61 0000 0000 4500 0028 > 0x0020: 277c 4000 4506 dae4 c721 e1da 2d59 5d1a > 0x0030: 267b 01bb a057 e903 > > 08:25:47.787326 IP (tos 0x0, ttl 54, id 0, offset 0, flags [DF], proto > TCP (6), length 44) > 104.87.78.95.80 > 199.33.225.143.8667: Flags [S.], cksum 0xc97a > (correct), seq 1216155085, ack 11765035, win 29200, options [mss > 1156], length 0 > 0x0000: 4500 002c 0000 4000 3606 e564 6857 4e5f > 0x0010: c721 e18f 0050 21db 487d 0dcd 00b3 852b > 0x0020: 6012 7210 c97a 0000 0204 0484 > > I have observed no consistency in the remote IP addresses. I receive > no more than a few of each and they don't line up with particular > networks. Remote ports are heavily 80, 443, 22, 25, etc. but a > smattering of less common ports too. I'm not seeing any RSTs at all > nor any port-unreachables. Lots of syn/acks and a few time exceeded > and host unreachables. I don't know what to make of that. > > > On Sat, Mar 14, 2020 at 1:46 AM Andrew Smith<andrew.william.smith at gmail.com> <andrew.william.smith at gmail.com> wrote: > > Look inside the ICMP Unreachable backscatter at the truncated original packet that caused the unreachable message. > > Clever! I wouldn't have thought of that. Unfortunately as in the > example above, the TTLs in the packets encapsulated in ICMP are not > especially close to one of the common boundaries. > > Regards, > Bill Herrin > > -- > William Herrinbill at herrin.ushttps://bill.herrin.us/ > >

1 0

COVID-19 vs. our Networks
by g＠1337.io 16 Mar '20

16 Mar '20

With talk of there being an involuntary statewide (WA) and then national quarantines (house arrest) for multiple weeks, has anyone put thought into the impacts of this on your networks if/when this comes to fruition? We're already pushing the limits with telecommuters / those that are WFH, but I can only imagine what things will look like with everyone stuck at home for any duration of time.

27 33

WFH: Measuring and fixing latency congestion and slow problems
by Sean Donelan 14 Mar '20

14 Mar '20

Trying to put together a one-pager to help I.T. people at organizations with a surge of work from home users. First, I get that ISPs customer care centers and network operation centers are trying their best. And may be having their own staffing issues. Snow days and hurricanes aren't nationwide (at least for the USA). No specific ISPs, but generally these users are connected to the major corporate and residential ISPs. Looking for construction suggestions, besides complaining to the ISP customer care centers. Hearing about Work From Home experiences the last couple of days from a few dozen large organizations. The most common complaint is the dreaded indeterminate "Its slow." Heard complaints about both cloud applications and classic corporate VPN access. Most of the users are non-technical professionals, e.g. lawyers, business people, etc. with better than average residential broadband services (50Mbps to 150Mbps coax, vdsl, fios, etc). But not extreme broadband (not 1Gbps fiber). What suggestions for diagnosing "slow" complaints with Classic corporate VPN Online business apps (brand names as examples) Google Docs and Sheets Office365 Outlook and Word What things can users and I.T. people check first? How to figure out which provider to complain too? And rule out providers that aren't the problem.

1 0

Fwd: WARNING!!! WARNING!!! WARNING!!!
by nanog08＠mulligan.org 14 Mar '20

14 Mar '20

Well - this is new. I have gotten plenty of the "we have broken into your computer (or account)", but a Death threat? And where is the bitcoin address to send my $100K. Maybe I should start a gofundme to get the money. Geoff PS - I did send this to aol abuse (not that it will do ANY good) -------- Forwarded Message -------- Subject: WARNING!!! WARNING!!! WARNING!!! Date: Sat, 14 Mar 2020 05:28:26 -0700 From: DRAGON BLADE <luffy(a)emailtool-seller100.xyz> Reply-To: dragon000blade.org(a)aol.com To: geoff(a)proto6.com I have to warn you someone has paid me to kill you..I've being monitoring you for 4days now...i think you almost noticed me 2days ago...LISTEN...You have less than, 48hours to pay $100,000USD...!! i see you as a nice person if not for the people you keep around... that is why i am doing this! I'm giving you a chance to escape or else I finish my job but I can move and run away!! If you think $100,000USD is too much for your life, very well then!!! I assure you,after taking this risk by telling you my assignment and having compassion on you at first because of GOD, if you act like you are smart?? I will cut you all piece by piece to make you die very painfully...I assure you****** Good-luck! NOTE: I'm Russian,if you like you can inform the police or anybody, death is promised and this time your precious family members will be involved i assure you!! There' s already a chip and your calls and all is being monitored i have to let you know!! You must have to send me $100,000USD as soon as possible before 48hours or else I cannot be sorry for you!! I await your reply {if you like} for payment information!!! But you can try to dare me (us)!!! GOODLUCK!!! E-MAIL:: dragon000blade.org(a)aol.com

2 1

Re: WIKI documentation Software?
by Craig 14 Mar '20

14 Mar '20

Lol, Sharepoint,,,. Arggg, yea NOT going to happen , We’ve managed to avoid using that. On Sat, Mar 14, 2020 at 10:50 AM Nicholas Oas <nicholas.oas(a)gmail.com> wrote: > Seconding Confluence. Stay away from Sharepoint. > > On Sat, Mar 14, 2020 at 8:09 AM Craig <cvuljanic(a)gmail.com> wrote: > >> Wanted to ask what WIKI software teams are using to save documentation to >> / how to's for staff, etc. >> >> pro's >> con's >> >> We have an older wiki bare-metal wiki server, that I want to get replaced >> before it kicks the bucket and was looking into various ones. >> >> thanks; >> >> CPV >> >> >>

3 2

Work from Home and other dynamics
by Jared Mauch 14 Mar '20

14 Mar '20

I’m wondering what general trends people have seen with the recent reduction in travel and increased work from home activities. I’m expecting that a number of networks are seeing increased traffic demand. Enterprises are likely adding VPN licenses for staff that are now remote, etc.. I would expect increase (and decreases) similar to weekend traffic patterns. I’m expecting there will be more IPv6 traffic similar to what is seen during the Christmas/New Years holiday on this traffic as well: https://www.google.com/intl/en/ipv6/statistics.html What interesting dynamics are you seeing? - Jared

6 5

oinky attribute
by Randy Bush 13 Mar '20

13 Mar '20

Prefix Send failed ! 103.199.169.0/24 bgp_rt_trace_too_big_message:1209 path attribute too big. Cannot build update. lovely randy

1 0

Weekly Routing Table Report
by cscora＠apnic.net 13 Mar '20

13 Mar '20

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 14 Mar, 2020 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 799559 Prefixes after maximum aggregation (per Origin AS): 304239 Deaggregation factor: 2.63 Unique aggregates announced (without unneeded subnets): 391217 Total ASes present in the Internet Routing Table: 67362 Prefixes per ASN: 11.87 Origin-only ASes present in the Internet Routing Table: 57867 Origin ASes announcing only one prefix: 24249 Transit ASes present in the Internet Routing Table: 9495 Transit-only ASes present in the Internet Routing Table: 283 Average AS path length visible in the Internet Routing Table: 4.4 Max AS path length visible: 36 Max AS path prepend of ASN (206156) 26 Prefixes from unregistered ASNs in the Routing Table: 1197 Number of instances of unregistered ASNs: 1197 Number of 32-bit ASNs allocated by the RIRs: 30923 Number of 32-bit ASNs visible in the Routing Table: 25477 Prefixes from 32-bit ASNs in the Routing Table: 117614 Number of bogon 32-bit ASNs visible in the Routing Table: 14 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 1126 Number of addresses announced to Internet: 2852326016 Equivalent to 170 /8s, 3 /16s and 10 /24s Percentage of available address space announced: 77.0 Percentage of allocated address space announced: 77.0 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.5 Total number of prefixes smaller than registry allocations: 268671 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 211457 Total APNIC prefixes after maximum aggregation: 61605 APNIC Deaggregation factor: 3.43 Prefixes being announced from the APNIC address blocks: 204378 Unique aggregates announced from the APNIC address blocks: 85284 APNIC Region origin ASes present in the Internet Routing Table: 10426 APNIC Prefixes per ASN: 19.60 APNIC Region origin ASes announcing only one prefix: 2878 APNIC Region transit ASes present in the Internet Routing Table: 1547 Average APNIC Region AS path length visible: 4.6 Max APNIC Region AS path length visible: 35 Number of APNIC region 32-bit ASNs visible in the Routing Table: 5486 Number of APNIC addresses announced to Internet: 766440960 Equivalent to 45 /8s, 174 /16s and 246 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-141625 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 234015 Total ARIN prefixes after maximum aggregation: 107865 ARIN Deaggregation factor: 2.17 Prefixes being announced from the ARIN address blocks: 231510 Unique aggregates announced from the ARIN address blocks: 117717 ARIN Region origin ASes present in the Internet Routing Table: 18394 ARIN Prefixes per ASN: 12.59 ARIN Region origin ASes announcing only one prefix: 6737 ARIN Region transit ASes present in the Internet Routing Table: 1914 Average ARIN Region AS path length visible: 3.9 Max ARIN Region AS path length visible: 22 Number of ARIN region 32-bit ASNs visible in the Routing Table: 3184 Number of ARIN addresses announced to Internet: 1078766848 Equivalent to 64 /8s, 76 /16s and 173 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-399260 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 226768 Total RIPE prefixes after maximum aggregation: 105105 RIPE Deaggregation factor: 2.16 Prefixes being announced from the RIPE address blocks: 223676 Unique aggregates announced from the RIPE address blocks: 131070 RIPE Region origin ASes present in the Internet Routing Table: 26932 RIPE Prefixes per ASN: 8.31 RIPE Region origin ASes announcing only one prefix: 11733 RIPE Region transit ASes present in the Internet Routing Table: 3820 Average RIPE Region AS path length visible: 4.4 Max RIPE Region AS path length visible: 29 Number of RIPE region 32-bit ASNs visible in the Routing Table: 9000 Number of RIPE addresses announced to Internet: 724305024 Equivalent to 43 /8s, 44 /16s and 4 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-210331 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 104200 Total LACNIC prefixes after maximum aggregation: 24246 LACNIC Deaggregation factor: 4.30 Prefixes being announced from the LACNIC address blocks: 105492 Unique aggregates announced from the LACNIC address blocks: 45844 LACNIC Region origin ASes present in the Internet Routing Table: 9575 LACNIC Prefixes per ASN: 11.02 LACNIC Region origin ASes announcing only one prefix: 2420 LACNIC Region transit ASes present in the Internet Routing Table: 1794 Average LACNIC Region AS path length visible: 5.3 Max LACNIC Region AS path length visible: 36 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 7142 Number of LACNIC addresses announced to Internet: 174101760 Equivalent to 10 /8s, 96 /16s and 149 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-270748 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 21921 Total AfriNIC prefixes after maximum aggregation: 4673 AfriNIC Deaggregation factor: 4.69 Prefixes being announced from the AfriNIC address blocks: 33377 Unique aggregates announced from the AfriNIC address blocks: 10314 AfriNIC Region origin ASes present in the Internet Routing Table: 1375 AfriNIC Prefixes per ASN: 24.27 AfriNIC Region origin ASes announcing only one prefix: 481 AfriNIC Region transit ASes present in the Internet Routing Table: 272 Average AfriNIC Region AS path length visible: 5.1 Max AfriNIC Region AS path length visible: 26 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 665 Number of AfriNIC addresses announced to Internet: 108112128 Equivalent to 6 /8s, 113 /16s and 169 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7545 5365 671 627 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4624 4192 73 ERX-CERNET-BKB China Education and Rese 7552 3351 1331 24 VIETEL-AS-AP Viettel Group, VN 45899 3138 1798 106 VNPT-AS-VN VNPT Corp, VN 7713 2703 831 507 TELKOMNET-AS-AP PT Telekomunikasi Indon 9808 2572 9043 62 CMNET-GD Guangdong Mobile Communication 4766 2290 11102 562 KIXS-AS-KR Korea Telecom, KR 9498 2252 434 222 BBIL-AP BHARTI Airtel Ltd., IN 4755 2138 441 193 TATACOMM-AS TATA Communications formerl 9394 2063 4898 24 CTTNET China TieTong Telecommunications Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 11492 4042 270 659 CABLEONE, US 7155 4034 280 28 VIASAT-SP-BACKBONE, US 16509 3901 7820 1722 AMAZON-02, US 22773 3528 2969 146 ASN-CXA-ALL-CCI-22773-RDC, US 6327 3373 1324 92 SHAW, CA 16625 2995 1571 2146 AKAMAI-AS, US 209 2391 5076 533 CENTURYLINK-US-LEGACY-QWEST, US 30036 2311 358 164 MEDIACOM-ENTERPRISE-BUSINESS, US 5650 2292 2941 1632 FRONTIER-FRTR, US 26484 2181 136 177 IKGUL-26484, US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 5951 1599 131 UNI2-AS, ES 31334 4086 484 13 KABELDEUTSCHLAND-AS, DE 39891 3776 203 20 ALJAWWALSTC-AS, SA 8551 3295 379 45 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 20940 2917 464 2002 AKAMAI-ASN1, US 12389 2485 2250 727 ROSTELECOM-AS, RU 34984 2071 349 560 TELLCOM-AS, TR 9009 2069 217 1115 M247, GB 9121 1918 1691 18 TTNET, TR 13188 1604 100 47 TRIOLAN, UA Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 6315 3307 597 Uninet S.A. de C.V., MX 10620 3361 531 474 Telmex Colombia S.A., CO 11830 2669 369 63 Instituto Costarricense de Electricidad 6503 1675 327 390 Axtel, S.A.B. de C.V., MX 7303 1553 1031 265 Telecom Argentina S.A., AR 28573 1370 2243 192 CLARO S.A., BR 13999 1238 477 297 Mega Cable, S.A. de C.V., MX 6147 1114 378 52 Telefonica del Peru S.A.A., PE 3816 1088 565 142 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 11172 955 112 69 Alestra, S. de R.L. de C.V., MX Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1505 393 22 LINKdotNET-AS, EG 24835 1102 570 24 RAYA-AS, EG 36992 1077 1535 75 ETISALAT-MISR, EG 36903 875 452 97 MT-MPLS, MA 6713 599 1863 34 IAM-AS, MA 29571 590 68 11 ORANGE-COTE-IVOIRE, CI 37342 482 32 1 MOVITEL, MZ 36935 380 522 40 Vodafone-, EG 15399 372 45 10 WANANCHI-, KE 23889 371 231 15 MauritiusTelecom, MU Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 6315 3307 597 Uninet S.A. de C.V., MX 12479 5951 1599 131 UNI2-AS, ES 7545 5365 671 627 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4624 4192 73 ERX-CERNET-BKB China Education and Rese 31334 4086 484 13 KABELDEUTSCHLAND-AS, DE 11492 4042 270 659 CABLEONE, US 7155 4034 280 28 VIASAT-SP-BACKBONE, US 16509 3901 7820 1722 AMAZON-02, US 39891 3776 203 20 ALJAWWALSTC-AS, SA 22773 3528 2969 146 ASN-CXA-ALL-CCI-22773-RDC, US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 12479 5951 5820 UNI2-AS, ES 7545 5365 4738 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4624 4551 ERX-CERNET-BKB China Education and Research Net 31334 4086 4073 KABELDEUTSCHLAND-AS, DE 7155 4034 4006 VIASAT-SP-BACKBONE, US 39891 3776 3756 ALJAWWALSTC-AS, SA 11492 4042 3383 CABLEONE, US 22773 3528 3382 ASN-CXA-ALL-CCI-22773-RDC, US 7552 3351 3327 VIETEL-AS-AP Viettel Group, VN 6327 3373 3281 SHAW, CA Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 62828 UNALLOCATED 8.21.130.0/24 3356 LEVEL3, US 393266 UNALLOCATED 8.23.52.0/24 174 COGENT-174, US 62485 UNALLOCATED 8.23.229.0/24 3356 LEVEL3, US 32985 UNALLOCATED 8.28.31.0/24 3356 LEVEL3, US 394936 UNALLOCATED 8.33.224.0/24 174 COGENT-174, US 27205 UNALLOCATED 8.38.16.0/21 6461 ZAYO-6461, US 27205 UNALLOCATED 8.38.16.0/22 32787 PROLEXIC-TECHNOLOGIES-DDOS-M 27205 UNALLOCATED 8.38.20.0/22 32787 PROLEXIC-TECHNOLOGIES-DDOS-M 14109 UNALLOCATED 8.38.252.0/24 3356 LEVEL3, US 23061 UNALLOCATED 8.39.119.0/24 3356 LEVEL3, US Complete listing at http://thyme.rand.apnic.net/current/data-badAS Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at http://thyme.rand.apnic.net/current/data-dsua Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.136.224.0/24 Origin: 15206 UNASSIGNED Transit: 174 COGENT-174, US 23.137.192.0/24 Origin: 31798 CANAD-86-31798, CA Transit: 174 COGENT-174, US 27.100.7.0/24 Origin: 56096 UNASSIGNED Transit: 45455 TH-2S1N-AP Two S One N Co Ltd, Internet 27.126.156.0/22 Origin: 55827 UNASSIGNED Transit: 9930 TTNET-MY TIME dotCom Berhad, MY 27.126.156.0/23 Origin: 55827 UNASSIGNED Transit: 9930 TTNET-MY TIME dotCom Berhad, MY Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:10 /9:11 /10:38 /11:98 /12:285 /13:579 /14:1157 /15:1908 /16:13363 /17:8110 /18:13832 /19:25759 /20:40337 /21:47666 /22:98794 /23:81751 /24:464573 /25:1288 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 4940 5951 UNI2-AS, ES 31334 3931 4086 KABELDEUTSCHLAND-AS, DE 11492 3165 4042 CABLEONE, US 6327 3162 3373 SHAW, CA 7155 3125 4034 VIASAT-SP-BACKBONE, US 39891 2946 3776 ALJAWWALSTC-AS, SA 8551 2754 3295 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 22773 2748 3528 ASN-CXA-ALL-CCI-22773-RDC, US 8151 2120 6315 Uninet S.A. de C.V., MX 30036 2058 2311 MEDIACOM-ENTERPRISE-BUSINESS, US Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1565 2:1142 3:30 4:19 5:3305 6:51 8:1385 9:1 12:1784 13:497 14:2261 15:72 16:9 17:293 18:79 20:61 23:3388 24:2299 25:4 27:2512 30:1 31:3033 32:104 35:38 36:934 37:3303 38:1931 39:331 40:136 41:3405 42:703 43:2099 44:195 45:13811 46:3679 47:278 49:1433 50:1212 51:87 52:1136 54:272 55:594 56:6 57:48 58:1859 59:1140 60:704 61:2222 62:2229 63:1942 64:5065 65:2318 66:4853 67:2875 68:1218 69:3797 70:1435 71:675 72:2767 74:2592 75:1436 76:662 77:2595 78:1962 79:2405 80:1887 81:1587 82:1276 83:1127 84:1217 85:2511 86:551 87:1725 88:1090 89:2703 90:313 91:7560 92:1486 93:2453 94:2619 95:3766 96:1007 97:339 98:968 99:960 100:85 101:1093 102:842 103:23324 104:3403 105:391 106:844 107:1958 108:706 109:3779 110:1792 111:1988 112:1570 113:1392 114:1537 115:1843 116:1783 117:2061 118:2130 119:1701 120:846 121:1041 122:2414 123:1901 124:1559 125:2038 128:1347 129:916 130:624 131:1812 132:763 133:299 134:1240 135:275 136:604 137:843 138:2177 139:992 140:599 141:917 142:889 143:1202 144:970 145:325 146:1471 147:1021 148:2065 149:1151 150:821 151:1283 152:1482 153:373 154:4831 155:901 156:3404 157:1080 158:785 159:1952 160:1869 161:1017 162:3037 163:783 164:1448 165:1247 166:546 167:1621 168:3670 169:495 170:4282 171:762 172:1888 173:2387 174:1030 175:1013 176:2664 177:4239 178:2997 179:1508 180:2161 181:2460 182:3086 183:1117 184:2402 185:16209 186:3715 187:2645 188:4085 189:2155 190:8386 191:1413 192:10246 193:7366 194:6022 195:4290 196:3488 197:1904 198:6134 199:5904 200:7171 201:5169 202:10490 203:10093 204:4550 205:3095 206:3230 207:3282 208:4027 209:4375 210:4033 211:1988 212:3203 213:3022 214:1178 215:54 216:5870 217:2331 218:876 219:604 220:1994 221:915 222:1000 223:1475 End of report

1 0

FCC: ISPs pledge to keep connectivity during Coronavirus Pandemic
by Sean Donelan 13 Mar '20

13 Mar '20

Lots of press releases. Dozens of ISPs have agreed to FCC Chairman Pai's "pledge" to keep connectivity for customers impacted by disruptions caused by the coronavirus pandemic. https://docs.fcc.gov/public/attachments/DOC-363033A1.pdf The Keep Americans Connected Pledge reads as follows: Given the coronavirus pandemic and its impact on American society, [[Company Name]] pledges for the next 60 days to: (1) not terminate service to any residential or small business customers because of their inability to pay their bills due to the disruptions caused by the coronavirus pandemic; (2) waive any late fees that any residential or small business customers incur because of their economic circumstances related to the coronavirus pandemic; and (3) open its Wi-Fi hotspots to any American who needs them. ACIRA – Powered by Farmers Mutual Telephone Company & Federated Telephone, Allstream Business US, AlticeUSA, Antietam Broadband, Atlantic Broadband, AT&T, BBT, BOYCOM Vision, Burlington Telecom, Cable One, Central Arkansas Telephone Cooperative, CenturyLink, Charter, Cincinnati Bell, Citizens Connected, Comcast, Consolidated Communications, Cox Communications, Digital West, East Ascension Telephone Company, Education Networks of America, Emery Telecom, Farmers Telecommunications Cooperative, FirstLight, Frontier, Google Fiber, Grande Communications, Granite Telecommunications, Great Plains Communications, GWI, Hiawatha Broadband, Hill Country, IdeaTek Telcom, Inteliquent, Lafourche Telephone Company, Lakeland Communications, Long Lines Broadband, Mammoth Networks/Visionary Broadband, Mediacom, MetTel, Nex-Tech, Ninestar Connect, Northwest Fiber, Orbitel Communications, Pioneer Communications, Premier Communications, Range Telephone Cooperative, RCN, Reserve Telephone Company, Sacred Wind Communications, Shawnee Communications, Socket Telecom, Sonic, Sprint, Starry, TDS Telecom, TelNet Worldwide, TMobile, TracFone Wireless, Uniti Fiber, US Cellular, Vast Broadband, Verizon, Vyve Broadband Investments, Waitsfield and Champlain Valley Telecom, Wave Broadband, West Telecom Services, Windstream, and ZenFi Networks. And the trade associations ACA Connects, Competitive Carriers of America, CTIA, INCOMPAS, NCTA—The Internet and Television Association, NTCA—The Rural Broadband Association, USTelecom, and WISPA

1 0

Anyone here from Amazon AS16509 - LINX Exchange Prefixes
by S L 13 Mar '20

13 Mar '20

Hey all, Is there anyone on here from Amazon, they appear to have stopped advertising all of their prefixes on the LINX exchange since Sunday. Emailing their peeringdb contacts yields no response, they only ever seem to respond when they want something from you. Them withdrawing their prefixes seems to be becoming a regular thing on LINX. Thanks, Scott

2 1