- NANOG - lists.nanog.org

Weekly Routing Table Report
by cscora＠apnic.net 09 Nov '18

09 Nov '18

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 10 Nov, 2018 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 724810 Prefixes after maximum aggregation (per Origin AS): 278850 Deaggregation factor: 2.60 Unique aggregates announced (without unneeded subnets): 347882 Total ASes present in the Internet Routing Table: 62367 Prefixes per ASN: 11.62 Origin-only ASes present in the Internet Routing Table: 53812 Origin ASes announcing only one prefix: 23367 Transit ASes present in the Internet Routing Table: 8555 Transit-only ASes present in the Internet Routing Table: 262 Average AS path length visible in the Internet Routing Table: 4.0 Max AS path length visible: 36 Max AS path prepend of ASN ( 30873) 34 Prefixes from unregistered ASNs in the Routing Table: 34 Number of instances of unregistered ASNs: 34 Number of 32-bit ASNs allocated by the RIRs: 24790 Number of 32-bit ASNs visible in the Routing Table: 20041 Prefixes from 32-bit ASNs in the Routing Table: 85558 Number of bogon 32-bit ASNs visible in the Routing Table: 18 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 269 Number of addresses announced to Internet: 2861029537 Equivalent to 170 /8s, 135 /16s and 216 /24s Percentage of available address space announced: 77.3 Percentage of allocated address space announced: 77.3 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.1 Total number of prefixes smaller than registry allocations: 241600 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 198132 Total APNIC prefixes after maximum aggregation: 56287 APNIC Deaggregation factor: 3.52 Prefixes being announced from the APNIC address blocks: 195616 Unique aggregates announced from the APNIC address blocks: 80344 APNIC Region origin ASes present in the Internet Routing Table: 9222 APNIC Prefixes per ASN: 21.21 APNIC Region origin ASes announcing only one prefix: 2585 APNIC Region transit ASes present in the Internet Routing Table: 1370 Average APNIC Region AS path length visible: 4.0 Max APNIC Region AS path length visible: 29 Number of APNIC region 32-bit ASNs visible in the Routing Table: 4202 Number of APNIC addresses announced to Internet: 768556928 Equivalent to 45 /8s, 207 /16s and 63 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-139577 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 215182 Total ARIN prefixes after maximum aggregation: 102100 ARIN Deaggregation factor: 2.11 Prefixes being announced from the ARIN address blocks: 214589 Unique aggregates announced from the ARIN address blocks: 102000 ARIN Region origin ASes present in the Internet Routing Table: 18281 ARIN Prefixes per ASN: 11.74 ARIN Region origin ASes announcing only one prefix: 6794 ARIN Region transit ASes present in the Internet Routing Table: 1839 Average ARIN Region AS path length visible: 3.7 Max ARIN Region AS path length visible: 23 Number of ARIN region 32-bit ASNs visible in the Routing Table: 2490 Number of ARIN addresses announced to Internet: 1101801632 Equivalent to 65 /8s, 172 /16s and 40 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-399260 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 197855 Total RIPE prefixes after maximum aggregation: 94547 RIPE Deaggregation factor: 2.09 Prefixes being announced from the RIPE address blocks: 194252 Unique aggregates announced from the RIPE address blocks: 115052 RIPE Region origin ASes present in the Internet Routing Table: 25619 RIPE Prefixes per ASN: 7.58 RIPE Region origin ASes announcing only one prefix: 11474 RIPE Region transit ASes present in the Internet Routing Table: 3530 Average RIPE Region AS path length visible: 4.1 Max RIPE Region AS path length visible: 36 Number of RIPE region 32-bit ASNs visible in the Routing Table: 7567 Number of RIPE addresses announced to Internet: 715381888 Equivalent to 42 /8s, 163 /16s and 220 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-210331 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 93832 Total LACNIC prefixes after maximum aggregation: 21694 LACNIC Deaggregation factor: 4.33 Prefixes being announced from the LACNIC address blocks: 95274 Unique aggregates announced from the LACNIC address blocks: 41681 LACNIC Region origin ASes present in the Internet Routing Table: 7748 LACNIC Prefixes per ASN: 12.30 LACNIC Region origin ASes announcing only one prefix: 2108 LACNIC Region transit ASes present in the Internet Routing Table: 1472 Average LACNIC Region AS path length visible: 4.8 Max LACNIC Region AS path length visible: 30 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 5294 Number of LACNIC addresses announced to Internet: 172547328 Equivalent to 10 /8s, 72 /16s and 221 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-268700 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 19774 Total AfriNIC prefixes after maximum aggregation: 4194 AfriNIC Deaggregation factor: 4.71 Prefixes being announced from the AfriNIC address blocks: 24810 Unique aggregates announced from the AfriNIC address blocks: 8562 AfriNIC Region origin ASes present in the Internet Routing Table: 1214 AfriNIC Prefixes per ASN: 20.44 AfriNIC Region origin ASes announcing only one prefix: 406 AfriNIC Region transit ASes present in the Internet Routing Table: 241 Average AfriNIC Region AS path length visible: 4.4 Max AfriNIC Region AS path length visible: 26 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 488 Number of AfriNIC addresses announced to Internet: 102215936 Equivalent to 6 /8s, 23 /16s and 177 /24s AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 4631 4192 74 ERX-CERNET-BKB China Education and Rese 7545 4610 518 515 TPG-INTERNET-AP TPG Telecom Limited, AU 7552 2999 1154 93 VIETEL-AS-AP Viettel Group, VN 45899 2951 1685 110 VNPT-AS-VN VNPT Corp, VN 4766 2799 11130 764 KIXS-AS-KR Korea Telecom, KR 9829 2703 1489 571 BSNL-NIB National Internet Backbone, IN 9808 2448 8699 26 CMNET-GD Guangdong Mobile Communication 9394 2412 4907 31 CTTNET China TieTong Telecommunications 17974 2270 968 51 TELKOMNET-AS2-AP PT Telekomunikasi Indo 4755 2123 421 171 TATACOMM-AS TATA Communications formerl Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6327 3463 1324 84 SHAW - Shaw Communications Inc., CA 11492 3463 223 625 CABLEONE - CABLE ONE, INC., US 22773 3273 2973 165 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 16509 2446 5082 902 AMAZON-02 - Amazon.com, Inc., US 18566 2154 405 109 MEGAPATH5-US - MegaPath Corporation, US 20115 2146 2739 545 CHARTER-NET-HKY-NC - Charter Communicat 16625 2120 1144 1574 AKAMAI-AS - Akamai Technologies, Inc., 5650 2085 3074 1461 FRONTIER-FRTR - Frontier Communications 30036 2060 346 142 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 209 2040 5079 594 CENTURYLINK-US-LEGACY-QWEST - CenturyLi Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 5054 1613 133 UNI2-AS, ES 39891 3778 203 20 ALJAWWALSTC-AS, SA 8551 3039 378 43 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 20940 2557 565 1908 AKAMAI-ASN1, US 12389 2181 2178 616 ROSTELECOM-AS, RU 34984 2014 334 536 TELLCOM-AS, TR 9121 1921 1691 17 TTNET, TR 13188 1605 100 42 TRIOLAN, UA 8402 1281 544 14 CORBINA-AS OJSC "Vimpelcom", RU 6849 1218 355 21 UKRTELNET, UA Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 5452 3311 603 Uninet S.A. de C.V., MX 10620 3118 475 885 Telmex Colombia S.A., CO 11830 2667 370 75 Instituto Costarricense de Electricidad 6503 1660 449 54 Axtel, S.A.B. de C.V., MX 7303 1440 963 213 Telecom Argentina S.A., AR 28573 1146 2240 183 CLARO S.A., BR 6147 1091 377 29 Telefonica del Peru S.A.A., PE 3816 1025 512 114 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 11172 938 145 72 Alestra, S. de R.L. de C.V., MX 13999 923 537 260 Mega Cable, S.A. de C.V., MX Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1166 394 29 LINKdotNET-AS, EG 37611 910 107 9 Afrihost, ZA 36903 795 399 144 MT-MPLS, MA 36992 762 1411 43 ETISALAT-MISR, EG 24835 653 742 20 RAYA-AS, EG 8452 613 1728 15 TE-AS TE-AS, EG 37492 467 470 57 ORANGE-, TN 29571 462 70 12 ORANGE-COTE-IVOIRE, CI 23889 400 231 15 MauritiusTelecom, MU 37342 394 32 1 MOVITEL, MZ Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 5452 3311 603 Uninet S.A. de C.V., MX 12479 5054 1613 133 UNI2-AS, ES 4538 4631 4192 74 ERX-CERNET-BKB China Education and Rese 7545 4610 518 515 TPG-INTERNET-AP TPG Telecom Limited, AU 39891 3778 203 20 ALJAWWALSTC-AS, SA 6327 3463 1324 84 SHAW - Shaw Communications Inc., CA 11492 3463 223 625 CABLEONE - CABLE ONE, INC., US 22773 3273 2973 165 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 10620 3118 475 885 Telmex Colombia S.A., CO 8551 3039 378 43 BEZEQ-INTERNATIONAL-AS Bezeqint Interne Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 12479 5054 4921 UNI2-AS, ES 4538 4631 4557 ERX-CERNET-BKB China Education and Research Net 7545 4610 4095 TPG-INTERNET-AP TPG Telecom Limited, AU 39891 3778 3758 ALJAWWALSTC-AS, SA 6327 3463 3379 SHAW - Shaw Communications Inc., CA 22773 3273 3108 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 8551 3039 2996 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 7552 2999 2906 VIETEL-AS-AP Viettel Group, VN 45899 2951 2841 VNPT-AS-VN VNPT Corp, VN 11492 3463 2838 CABLEONE - CABLE ONE, INC., US Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 230105 UNALLOCATED 38.110.79.0/24 23015 CMC180-TOR-AS - Cambridge Merc 266842 UNALLOCATED 45.238.156.0/22 265680 HNTELCO S.A, HN 65001 PRIVATE 46.237.40.0/21 13118 ASN-YARTELECOM PJSC Rostelecom 64121 UNALLOCATED 98.159.9.0/24 19555 KMI-NETWORK - Kinder Morgan, I 64121 UNALLOCATED 98.159.12.0/24 19555 KMI-NETWORK - Kinder Morgan, I 64140 UNALLOCATED 98.159.14.0/24 64121 UNKNOWN 65553 UNALLOCATED 103.218.190.0/24 58715 EARTHTELECOMMUNICATION-AS EART 65001 PRIVATE 109.161.56.0/24 13118 ASN-YARTELECOM PJSC Rostelecom 92937 UNALLOCATED 110.49.72.0/24 45458 SBN-AWN-AS-02-AP SBN-ISP/AWN-I 4230060012 PRIVATE 132.190.106.0/24 64673 -Private Use AS-, ZZ Complete listing at http://thyme.rand.apnic.net/current/data-badAS Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 198.18.1.19/32 7497 CSTNET-AS-AP Computer Network Information Cente Complete listing at http://thyme.rand.apnic.net/current/data-dsua Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 27.100.7.0/24 56096 UNKNOWN 41.76.140.0/22 37500 -Reserved AS-, ZZ 41.78.92.0/22 14988 BTC-GATE1, BW 41.78.180.0/23 37265 -Reserved AS-, ZZ 43.255.80.0/24 36351 SOFTLAYER - SoftLayer Technologies Inc., US 43.255.82.0/24 36351 SOFTLAYER - SoftLayer Technologies Inc., US 43.255.83.0/24 36351 SOFTLAYER - SoftLayer Technologies Inc., US 45.121.32.0/22 134356 UNKNOWN 45.124.164.0/22 38803 GTELECOM-AUSTRALIA Gtelecom-AUSTRALIA, AU 45.252.236.0/22 38803 GTELECOM-AUSTRALIA Gtelecom-AUSTRALIA, AU Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:14 /9:11 /10:36 /11:99 /12:290 /13:566 /14:1112 /15:1897 /16:13325 /17:7874 /18:13816 /19:25421 /20:39496 /21:46094 /22:90126 /23:74077 /24:408286 /25:827 /26:651 /27:653 /28:37 /29:20 /30:24 /31:4 /32:54 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 3878 5054 UNI2-AS, ES 6327 3248 3463 SHAW - Shaw Communications Inc., CA 39891 2946 3778 ALJAWWALSTC-AS, SA 11492 2749 3463 CABLEONE - CABLE ONE, INC., US 22773 2528 3273 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 8551 2495 3039 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 18566 2048 2154 MEGAPATH5-US - MegaPath Corporation, US 11830 2012 2667 Instituto Costarricense de Electricidad y Telec 30036 1809 2060 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom Communi 5650 1761 2085 FRONTIER-FRTR - Frontier Communications of Amer Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1623 2:890 4:18 5:2695 6:43 7:1 8:1138 12:1876 13:241 14:1875 15:33 16:3 17:197 18:58 20:50 23:2514 24:2414 25:2 27:2517 31:1999 32:85 35:28 36:558 37:2930 38:1558 39:265 40:121 41:3139 42:716 43:1980 44:127 45:6020 46:3084 47:234 49:1312 50:1068 51:318 52:1109 54:362 55:1 56:6 57:38 58:1694 59:1024 60:462 61:2088 62:1960 63:1790 64:5058 65:2181 66:4805 67:2635 68:1159 69:3365 70:1179 71:602 72:2235 74:2729 75:413 76:480 77:1669 78:1749 79:2221 80:1570 81:1415 82:1053 83:804 84:1065 85:2094 86:559 87:1485 88:960 89:2387 90:210 91:6482 92:1268 93:2386 94:2435 95:3039 96:912 97:349 98:938 99:154 100:87 101:1165 102:278 103:19135 104:3595 105:240 106:877 107:1847 108:709 109:3396 110:1642 111:1825 112:1396 113:1327 114:1147 115:1701 116:1664 117:1889 118:2203 119:1675 120:1115 121:1038 122:2331 123:1698 124:1439 125:1945 128:1213 129:690 130:510 131:1624 132:714 133:190 134:1041 135:228 136:532 137:659 138:1967 139:739 140:557 141:754 142:805 143:997 144:839 145:498 146:1244 147:762 148:1682 149:791 150:774 151:996 152:878 153:325 154:1955 155:951 156:1568 157:847 158:648 159:1865 160:1481 161:850 162:2641 163:760 164:1116 165:1581 166:460 167:1343 168:3144 169:868 170:3977 171:496 172:1063 173:2093 174:988 175:833 176:2145 177:4021 178:2513 179:1297 180:2154 181:2388 182:2594 183:1473 184:1130 185:14319 186:3565 187:2448 188:2903 189:2028 190:8308 191:1384 192:9920 193:6404 194:5231 195:4029 196:2969 197:1634 198:5667 199:5985 200:7358 201:4997 202:10199 203:10162 204:4608 205:3004 206:3251 207:3212 208:3943 209:4162 210:3868 211:2011 212:3003 213:2825 214:1056 215:55 216:6024 217:2178 218:877 219:576 220:1827 221:1007 222:970 223:1394 End of report

1 0

Technical Contact at Yahoo
by Brock Tice 09 Nov '18

09 Nov '18

Yahoo have done a very good job of locking down their contact info. We have an issue where they seem to be blocking one of our CGN public addresses. Does anyone know how I can get in touch with an appropriate person there?

2 1

Technical Contact at Yahoo
by Brock Tice 09 Nov '18

09 Nov '18

Yahoo have done a very good job of locking down their contact info. We have an issue where they seem to be blocking one of our CGN public addresses. Does anyone know how I can get in touch with an appropriate person there?

1 0

Re: Amazon network engineering contact? re: DDoS traffic
by John 09 Nov '18

09 Nov '18

Zach, As mentioned before, I am open to peering (where possible) but have not received a response. My goal is to connect with someone at Amazon and work with them on a technical solution, which is why I posted asking for that here. Various factors mean that we can't just upgrade our way out of this one, and manual whac-a-mole on the sources has shown to have limited use. These attacks also impact Amazon and the networks in between the sources and targets, and they take time to handle by the abuse teams, so there are good reasons to investigate them further and find better ways to mitigate or prevent them. -John On 11/8/2018 1:12 PM, Zach Puls wrote: > Makes sense, that's understandable. Do you peer with AWS? If not, maybe opening up a peering agreement will give you a better contact, and a bit more pull when attacks occur? I know someone with a peering agreement with AWS, and they have been able to get resolutions fairly quickly when issues arise. > > Other than that, I'm not sure of a solution other than more IP transit. > > Thanks, > > Zach Puls > Network Engineer | MEF-CECP > KsFiberNet > > -----Original Message----- > From: John Weekes <jw(a)nuclearfallout.net> > Sent: Thursday, November 08, 2018 15:03 > To: Zach Puls <zpuls(a)ksfiber.net> > Cc: nanog(a)nanog.org > Subject: Re: Amazon network engineering contact? re: DDoS traffic > > Zach, > > Yes, RTBH is used to distribute the null-routes that I mentioned. > > Unfortunately, even brief saturation events lasting just 5-10 seconds (a typical amount of time to detect the loss, issue the null-route, and see the traffic start to fall off as it is distributed upstream) can cause real damage to those customers who are sensitive to latency and packet loss. So while null-routes limit the duration of the impact, they can't eliminate it entirely. And, of course, the actual target of the attack > -- the now-null-routed IP address -- becomes unreachable, which was presumably the goal of the attacker. > > -John > > On 11/8/2018 12:54 PM, Zach Puls wrote: >> No idea about an Amazon abuse contact, but do you have RTBH communities enabled with your upstream provider(s)? As a general practice, when you detect a (D)DoS attack in progress, it would help to automatically advertise that prefix to your upstream(s) with the black-hole community. This would at least help mitigate the effects of the attacks when they do occur, even if they come from a different source than AWS. >> >> Thanks, >> >> Zach Puls >> Network Engineer | MEF-CECP >> KsFiberNet >> >> -----Original Message----- >> From: NANOG <nanog-bounces(a)nanog.org> On Behalf Of John Weekes >> Sent: Thursday, November 08, 2018 14:44 >> To: nanog(a)nanog.org >> Subject: Amazon network engineering contact? re: DDoS traffic >> >> We've been seeing significant attack activity from Amazon over the last two months, involving apparently compromised instances that commonly send 1-10G of traffic per source and together generate Nx10G of total traffic. Even when our overall upstream capacity exceeds an attack's overall size, the nature of load-balancing over multiple 10G upstream links means that an individual link can be saturated by multiple large flows, forcing our systems to null-route the target to limit impact. >> >> We've sent an abuse notification about every traffic source to Amazon, and specific sources seem to stop their involvement over time (suggesting that abuse teams are following up on them), but there is an endless parade of new attackers, and each source participates in many damaging attacks before it is shut down. >> >> Is there anyone at Amazon who can help with an engineering solution in terms of programmatically detecting and rate-limiting attack traffic sources, to our networks or overall? Or applying the kludge of a rate-limit for all Amazon traffic to our networks? Or working with us on some other option? >> >> At least one other large cloud provider has an automatic rate-limiting system in place that is effective in reducing the damage from repeat high-volume attacks. >> >> Emails to the Amazon NOC, peering contacts (since that would be another possible solution), and abuse department have not connected me with anyone. >> >> Thanks, >> John >> >

3 2

FCC Launches Re-Examination of Wireless Resiliency Cooperative Framework In Light of Recent Hurricanes
by Sean Donelan 08 Nov '18

08 Nov '18

The public, first responders and other service providers can also submit comments to the FCC. https://www.fcc.gov/document/fcc-seeks-industry-input-review-wireless-resil… To that end, Chief Fowlkes’ letters ask wireless companies participating in the framework to summarize how it was used for all disaster events to which the framework applied. The letters request detailed lists of mutual aid and roaming agreements carriers have established with each other, as well as any instances where such agreements were modified, impeded, or even declined outright. The agency also asks for information as to each company’s implementation of industry best practices.

1 0

Re: Amazon network engineering contact? re: DDoS traffic
by John Weekes 08 Nov '18

08 Nov '18

Zach, Yes, RTBH is used to distribute the null-routes that I mentioned. Unfortunately, even brief saturation events lasting just 5-10 seconds (a typical amount of time to detect the loss, issue the null-route, and see the traffic start to fall off as it is distributed upstream) can cause real damage to those customers who are sensitive to latency and packet loss. So while null-routes limit the duration of the impact, they can't eliminate it entirely. And, of course, the actual target of the attack -- the now-null-routed IP address -- becomes unreachable, which was presumably the goal of the attacker. -John On 11/8/2018 12:54 PM, Zach Puls wrote: > No idea about an Amazon abuse contact, but do you have RTBH communities enabled with your upstream provider(s)? As a general practice, when you detect a (D)DoS attack in progress, it would help to automatically advertise that prefix to your upstream(s) with the black-hole community. This would at least help mitigate the effects of the attacks when they do occur, even if they come from a different source than AWS. > > Thanks, > > Zach Puls > Network Engineer | MEF-CECP > KsFiberNet > > -----Original Message----- > From: NANOG <nanog-bounces(a)nanog.org> On Behalf Of John Weekes > Sent: Thursday, November 08, 2018 14:44 > To: nanog(a)nanog.org > Subject: Amazon network engineering contact? re: DDoS traffic > > We've been seeing significant attack activity from Amazon over the last two months, involving apparently compromised instances that commonly send 1-10G of traffic per source and together generate Nx10G of total traffic. Even when our overall upstream capacity exceeds an attack's overall size, the nature of load-balancing over multiple 10G upstream links means that an individual link can be saturated by multiple large flows, forcing our systems to null-route the target to limit impact. > > We've sent an abuse notification about every traffic source to Amazon, and specific sources seem to stop their involvement over time (suggesting that abuse teams are following up on them), but there is an endless parade of new attackers, and each source participates in many damaging attacks before it is shut down. > > Is there anyone at Amazon who can help with an engineering solution in terms of programmatically detecting and rate-limiting attack traffic sources, to our networks or overall? Or applying the kludge of a rate-limit for all Amazon traffic to our networks? Or working with us on some other option? > > At least one other large cloud provider has an automatic rate-limiting system in place that is effective in reducing the damage from repeat high-volume attacks. > > Emails to the Amazon NOC, peering contacts (since that would be another possible solution), and abuse department have not connected me with anyone. > > Thanks, > John >

1 0

Amazon network engineering contact? re: DDoS traffic
by John Weekes 08 Nov '18

08 Nov '18

We've been seeing significant attack activity from Amazon over the last two months, involving apparently compromised instances that commonly send 1-10G of traffic per source and together generate Nx10G of total traffic. Even when our overall upstream capacity exceeds an attack's overall size, the nature of load-balancing over multiple 10G upstream links means that an individual link can be saturated by multiple large flows, forcing our systems to null-route the target to limit impact. We've sent an abuse notification about every traffic source to Amazon, and specific sources seem to stop their involvement over time (suggesting that abuse teams are following up on them), but there is an endless parade of new attackers, and each source participates in many damaging attacks before it is shut down. Is there anyone at Amazon who can help with an engineering solution in terms of programmatically detecting and rate-limiting attack traffic sources, to our networks or overall? Or applying the kludge of a rate-limit for all Amazon traffic to our networks? Or working with us on some other option? At least one other large cloud provider has an automatic rate-limiting system in place that is effective in reducing the damage from repeat high-volume attacks. Emails to the Amazon NOC, peering contacts (since that would be another possible solution), and abuse department have not connected me with anyone. Thanks, John

1 0

Spoofer Report for NANOG for Oct 2018
by CAIDA Spoofer Project 08 Nov '18

08 Nov '18

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Oct 2018: ASN Name Fixed-By 14361 HOPONE-GLOBAL 2018-10-03 7233 YAHOO-US 2018-10-04 237 MERIT-AS-14 2018-10-05 4 ISI 2018-10-10 15176 AS-INOC 2018-10-17 3356 LEVEL3 2018-10-24 10326 WORCESTER-1 2018-10-29 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Oct 2018: ASN Name First-Spoofed Last-Spoofed 5650 FRONTIER-FRTR 2016-02-22 2018-10-04 577 BACOM 2016-03-09 2018-10-27 18978 ENZUINC-US 2016-04-15 2018-10-26 54825 PACKET 2016-04-15 2018-10-11 7922 COMCAST-7922 2016-06-04 2018-10-09 19230 NANOG 2016-06-13 2018-10-04 7029 WINDSTREAM 2016-06-21 2018-10-30 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2018-10-28 6128 CABLE-NET-1 2016-09-03 2018-10-31 20412 CLARITY-TELECOM 2016-09-30 2018-10-31 6181 FUSE-NET 2016-10-10 2018-10-30 15305 SYRINGANETWORKS 2016-10-21 2018-10-27 25787 ROWE-NETWORKS 2016-10-21 2018-10-26 174 COGENT-174 2016-10-21 2018-10-31 2828 XO-AS15 2016-10-25 2018-10-06 31857 PRIORITY-TERABIT 2016-10-25 2018-10-19 30341 SCTA-ASN 2016-10-31 2018-10-14 32440 LONI 2016-11-03 2018-10-29 33182 DimeNOC 2016-11-08 2018-10-25 12083 WOW-INTERNET 2016-11-09 2018-10-27 3549 LVLT-3549 2016-11-16 2018-10-03 21832 KELLINCOM-1 2017-02-03 2018-10-26 7122 MTS-ASN 2017-05-16 2018-10-25 6461 ZAYO-6461 2017-06-21 2018-10-31 63296 AMARILLO-WIRELESS 2017-09-01 2018-10-30 7233 YAHOO-US 2017-09-07 2018-10-31 33523 ROWANUNIVERSITY 2017-10-29 2018-10-31 2152 CSUNET-NW 2017-11-08 2018-10-10 546 PARSONS-PGS-1 2017-11-20 2018-10-10 12222 AKAMAI 2018-02-14 2018-10-27 29384 Qatar-Foundation 2018-03-08 2018-10-25 23148 TERRENAP 2018-03-15 2018-10-30 20009 WADSNET 2018-04-13 2018-10-19 4201 ORST 2018-04-19 2018-10-29 11827 WSU 2018-04-19 2018-10-31 393564 SPOKANE 2018-06-05 2018-10-03 35911 BNQ-1 2018-06-06 2018-10-21 225 VIRGINIA 2018-06-18 2018-10-30 53646 HARRIS-BROADBAND 2018-08-10 2018-10-02 40911 L2NC 2018-08-31 2018-10-15 2381 WISCNET1 2018-09-04 2018-10-31 54804 CSMIII-BUNKIELA 2018-09-15 2018-10-16 33452 RW 2018-09-19 2018-10-14 20448 VPNTRANET-LLC 2018-09-20 2018-10-12 11996 LOBOIS 2018-09-24 2018-10-16 10326 WORCESTER-1 2018-09-30 2018-10-05 10929 NETELLIGENT 2018-10-02 2018-10-03 36210 SFCF 2018-10-13 2018-10-13 36327 VINAKOM 2018-10-16 2018-10-16 14031 SCXY 2018-10-18 2018-10-26 19919 VSW 2018-10-23 2018-10-30 22462 NOLA-BROADBAND-INC 2018-10-30 2018-10-30 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

Routinator 3000 and the RPKI project
by Alex Band 07 Nov '18

07 Nov '18

Hello all! Several months ago NLnet Labs committed to building a free open source RPKI toolset to help making BGP routing more secure. This project includes a Certificate Authority, allowing you to run a Delegated CA on your own systems as a child of one or more RIRs, a Publication Server that lets you publish RPKI material or let a third party do it on your behalf and lastly Relying Party software, in order to validate RPKI data and feed it to your routers. I want to give you a little update on where we are now. Since kicking off this project, RIPE NCC and NIC.br have graciously committed to funding these efforts, ensuring we can dedicate full time resources on this in the coming years. In the mean time, we’ve released (and then fixed :cough:) the first version of our Relying Party software. It’s designed to be super lean (as in, runs fine on a Pi Zero) and implements the basic set of functionality: fetching and validating RPKI data and exposing route origin attestations both as output (CSV, JSON, RPSL) and to routers via the RPKI-RTR protocol. We’re very much looking forward to your operational feedback, to ensure this package runs well in a wide variety of environments. Going forward, we’ll be focussing on monitoring for the next release. You can find the source code and further details on Github: https://github.com/NLnetLabs/routinator Cheers, Alex Band NLnet Labs

1 0

Switch with high ACL capacity
by Mike Hammett 06 Nov '18

06 Nov '18

I am looking for recommendations as to a 10G or 40G switch that has the ability to hold a large number of entries in ACLs. Preferred if I can get them there via the BGP flow spec, but some sort of API or even just brute force on the console would be good enough. Used or even end of life is fine. -----Mike HammettIntelligent Computing SolutionsMidwest Internet ExchangeThe Brothers WISP

4 7