- NANOG - lists.nanog.org

Akamai WAF
by Justin Wilson 19 May '18

19 May '18

I have a client with a /24 that has somehow been blocked by folks using the Akamai WAF. This is the response we received back from Akamai when we contacted them. >On checking the machine logs for ups.com <http://ups.com/>, we found that there is WAF (web application firewall) configured by ups.com <http://ups.com/>, this has to be fixed from the site owners end. This is happening with multiple sites, southwest.com is another. I find it odd multiple sites are doing this at the same time. If just one I would believe it was a manual configuration. It seems like something has triggered it. Can someone shed some light on how the WAF works? Justin Wilson j2sw(a)mtin.net www.mtin.net www.midwest-ix.com

4 3

Weekly Routing Table Report
by cscora＠apnic.net 18 May '18

18 May '18

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG, IRNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 19 May, 2018 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 700789 Prefixes after maximum aggregation (per Origin AS): 269276 Deaggregation factor: 2.60 Unique aggregates announced (without unneeded subnets): 336765 Total ASes present in the Internet Routing Table: 60726 Prefixes per ASN: 11.54 Origin-only ASes present in the Internet Routing Table: 52444 Origin ASes announcing only one prefix: 22914 Transit ASes present in the Internet Routing Table: 8282 Transit-only ASes present in the Internet Routing Table: 270 Average AS path length visible in the Internet Routing Table: 4.0 Max AS path length visible: 30 Max AS path prepend of ASN ( 30873) 28 Prefixes from unregistered ASNs in the Routing Table: 53 Number of instances of unregistered ASNs: 53 Number of 32-bit ASNs allocated by the RIRs: 22616 Number of 32-bit ASNs visible in the Routing Table: 18220 Prefixes from 32-bit ASNs in the Routing Table: 75897 Number of bogon 32-bit ASNs visible in the Routing Table: 15 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 304 Number of addresses announced to Internet: 2859596354 Equivalent to 170 /8s, 113 /16s and 250 /24s Percentage of available address space announced: 77.2 Percentage of allocated address space announced: 77.2 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 98.9 Total number of prefixes smaller than registry allocations: 233976 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 191663 Total APNIC prefixes after maximum aggregation: 54291 APNIC Deaggregation factor: 3.53 Prefixes being announced from the APNIC address blocks: 190476 Unique aggregates announced from the APNIC address blocks: 77546 APNIC Region origin ASes present in the Internet Routing Table: 8813 APNIC Prefixes per ASN: 21.61 APNIC Region origin ASes announcing only one prefix: 2460 APNIC Region transit ASes present in the Internet Routing Table: 1316 Average APNIC Region AS path length visible: 4.0 Max APNIC Region AS path length visible: 23 Number of APNIC region 32-bit ASNs visible in the Routing Table: 3775 Number of APNIC addresses announced to Internet: 767033858 Equivalent to 45 /8s, 184 /16s and 2 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-137529 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 208375 Total ARIN prefixes after maximum aggregation: 99076 ARIN Deaggregation factor: 2.10 Prefixes being announced from the ARIN address blocks: 209145 Unique aggregates announced from the ARIN address blocks: 98869 ARIN Region origin ASes present in the Internet Routing Table: 18163 ARIN Prefixes per ASN: 11.51 ARIN Region origin ASes announcing only one prefix: 6711 ARIN Region transit ASes present in the Internet Routing Table: 1793 Average ARIN Region AS path length visible: 3.6 Max ARIN Region AS path length visible: 20 Number of ARIN region 32-bit ASNs visible in the Routing Table: 2349 Number of ARIN addresses announced to Internet: 1105502240 Equivalent to 65 /8s, 228 /16s and 160 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-397212 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 191469 Total RIPE prefixes after maximum aggregation: 92029 RIPE Deaggregation factor: 2.08 Prefixes being announced from the RIPE address blocks: 187444 Unique aggregates announced from the RIPE address blocks: 111353 RIPE Region origin ASes present in the Internet Routing Table: 25153 RIPE Prefixes per ASN: 7.45 RIPE Region origin ASes announcing only one prefix: 11385 RIPE Region transit ASes present in the Internet Routing Table: 3505 Average RIPE Region AS path length visible: 4.1 Max RIPE Region AS path length visible: 30 Number of RIPE region 32-bit ASNs visible in the Routing Table: 6987 Number of RIPE addresses announced to Internet: 716083840 Equivalent to 42 /8s, 174 /16s and 146 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-207259 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 90587 Total LACNIC prefixes after maximum aggregation: 19869 LACNIC Deaggregation factor: 4.56 Prefixes being announced from the LACNIC address blocks: 92016 Unique aggregates announced from the LACNIC address blocks: 41067 LACNIC Region origin ASes present in the Internet Routing Table: 7156 LACNIC Prefixes per ASN: 12.86 LACNIC Region origin ASes announcing only one prefix: 1979 LACNIC Region transit ASes present in the Internet Routing Table: 1334 Average LACNIC Region AS path length visible: 4.7 Max LACNIC Region AS path length visible: 27 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 4692 Number of LACNIC addresses announced to Internet: 172671904 Equivalent to 10 /8s, 74 /16s and 195 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-268700 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 18640 Total AfriNIC prefixes after maximum aggregation: 3963 AfriNIC Deaggregation factor: 4.70 Prefixes being announced from the AfriNIC address blocks: 21404 Unique aggregates announced from the AfriNIC address blocks: 7662 AfriNIC Region origin ASes present in the Internet Routing Table: 1142 AfriNIC Prefixes per ASN: 18.74 AfriNIC Region origin ASes announcing only one prefix: 378 AfriNIC Region transit ASes present in the Internet Routing Table: 232 Average AfriNIC Region AS path length visible: 4.5 Max AfriNIC Region AS path length visible: 21 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 417 Number of AfriNIC addresses announced to Internet: 97854720 Equivalent to 5 /8s, 213 /16s and 37 /24s AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5415 4192 74 ERX-CERNET-BKB China Education and Rese 7545 4403 419 431 TPG-INTERNET-AP TPG Telecom Limited, AU 4766 2908 11137 790 KIXS-AS-KR Korea Telecom, KR 7552 2862 1155 74 VIETEL-AS-AP Viettel Group, VN 9829 2812 1498 543 BSNL-NIB National Internet Backbone, IN 9394 2537 4922 25 CTTNET China TieTong Telecommunications 45899 2526 1574 160 VNPT-AS-VN VNPT Corp, VN 17974 2216 928 79 TELKOMNET-AS2-AP PT Telekomunikasi Indo 9808 2195 8699 26 CMNET-GD Guangdong Mobile Communication 4755 2104 417 207 TATACOMM-AS TATA Communications formerl Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6327 3416 1323 84 SHAW - Shaw Communications Inc., CA 22773 3295 2968 147 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 18566 2167 405 109 MEGAPATH5-US - MegaPath Corporation, US 16509 2107 4687 661 AMAZON-02 - Amazon.com, Inc., US 11492 2102 243 436 CABLEONE - CABLE ONE, INC., US 20115 2102 2510 452 CHARTER-NET-HKY-NC - Charter Communicat 209 1987 5070 606 CENTURYLINK-US-LEGACY-QWEST - Qwest Com 30036 1982 342 166 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 16625 1803 891 1285 AKAMAI-AS - Akamai Technologies, Inc., 7018 1718 20215 1260 ATT-INTERNET4 - AT&T Services, Inc., US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 4151 1519 516 UNI2-AS, ES 39891 3778 203 20 ALJAWWALSTC-AS, SA 8551 2880 377 43 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 20940 2630 691 1932 AKAMAI-ASN1, US 12389 2047 1876 709 ROSTELECOM-AS, RU 34984 2015 334 487 TELLCOM-AS, TR 9121 1885 1692 19 TTNET, TR 13188 1609 100 43 TRIOLAN, UA 8402 1243 544 14 CORBINA-AS OJSC "Vimpelcom", RU 6849 1241 355 21 UKRTELNET, UA Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 4812 3358 591 Uninet S.A. de C.V., MX 10620 3594 542 244 Telmex Colombia S.A., CO 11830 2648 369 77 Instituto Costarricense de Electricidad 6503 1611 437 53 Axtel, S.A.B. de C.V., MX 7303 1514 1026 188 Telecom Argentina S.A., AR 28573 1026 2249 191 CLARO S.A., BR 3816 1008 505 123 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 6147 982 377 31 Telefonica del Peru S.A.A., PE 11172 929 126 85 Alestra, S. de R.L. de C.V., MX 18881 910 1076 29 TELEFÔNICA BRASIL S.A, BR Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1183 396 45 LINKdotNET-AS, EG 37611 851 107 9 Afrihost, ZA 36903 740 372 140 MT-MPLS, MA 36992 703 1412 42 ETISALAT-MISR, EG 8452 693 1730 18 TE-AS TE-AS, EG 24835 567 818 18 RAYA-AS, EG 37492 452 376 82 ORANGE-, TN 29571 439 68 10 ORANGE-COTE-IVOIRE, CI 15399 363 35 7 WANANCHI-, KE 23889 363 103 14 MauritiusTelecom, MU Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5415 4192 74 ERX-CERNET-BKB China Education and Rese 8151 4812 3358 591 Uninet S.A. de C.V., MX 7545 4403 419 431 TPG-INTERNET-AP TPG Telecom Limited, AU 12479 4151 1519 516 UNI2-AS, ES 39891 3778 203 20 ALJAWWALSTC-AS, SA 10620 3594 542 244 Telmex Colombia S.A., CO 6327 3416 1323 84 SHAW - Shaw Communications Inc., CA 22773 3295 2968 147 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 4766 2908 11137 790 KIXS-AS-KR Korea Telecom, KR 8551 2880 377 43 BEZEQ-INTERNATIONAL-AS Bezeqint Interne Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 8151 4812 4221 Uninet S.A. de C.V., MX 7545 4403 3972 TPG-INTERNET-AP TPG Telecom Limited, AU 39891 3778 3758 ALJAWWALSTC-AS, SA 12479 4151 3635 UNI2-AS, ES 10620 3594 3350 Telmex Colombia S.A., CO 6327 3416 3332 SHAW - Shaw Communications Inc., CA 22773 3295 3148 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 8551 2880 2837 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 7552 2862 2788 VIETEL-AS-AP Viettel Group, VN 11830 2648 2571 Instituto Costarricense de Electricidad y Telec Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 64514 PRIVATE 5.42.231.0/24 35753 ITC ITC AS number, SA 230105 UNALLOCATED 38.110.79.0/24 23015 CMC180-TOR-AS - Cambridge Merc 65001 PRIVATE 46.237.40.0/21 13118 ASN-YARTELECOM PJSC Rostelecom 64513 PRIVATE 62.150.101.0/24 9155 QNET Kuwait, KW 65537 DOCUMENT 62.162.120.0/24 6821 MT-AS-OWN bul. Orce Nikolov bb 419333 UNALLOCATED 84.17.91.0/24 41933 IPRAGAZ-AS Istanbul/ TURKEY, T 65024 PRIVATE 87.103.232.0/24 39407 CHITATELECOM-AS, RU 65024 PRIVATE 87.103.233.0/24 39407 CHITATELECOM-AS, RU 65024 PRIVATE 87.103.234.0/24 39407 CHITATELECOM-AS, RU 65024 PRIVATE 95.189.78.0/24 39407 CHITATELECOM-AS, RU Complete listing at http://thyme.rand.apnic.net/current/data-badAS Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 100.66.224.0/19 209 CENTURYLINK-US-LEGACY-QWEST - Qwest Communicati Complete listing at http://thyme.rand.apnic.net/current/data-dsua Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 27.100.7.0/24 56096 UNKNOWN 36.50.254.0/23 48964 ENTERRA-AS, UA 41.76.136.0/22 37500 -Reserved AS-, ZZ 41.76.136.0/24 37500 -Reserved AS-, ZZ 41.76.138.0/24 37500 -Reserved AS-, ZZ 41.76.139.0/24 37500 -Reserved AS-, ZZ 41.76.140.0/22 37500 -Reserved AS-, ZZ 41.76.140.0/24 37500 -Reserved AS-, ZZ 41.76.141.0/24 37500 -Reserved AS-, ZZ 41.76.142.0/24 37500 -Reserved AS-, ZZ Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:14 /9:11 /10:37 /11:100 /12:288 /13:566 /14:1093 /15:1908 /16:13390 /17:7879 /18:13632 /19:25180 /20:39356 /21:45390 /22:87183 /23:70455 /24:392031 /25:847 /26:651 /27:647 /28:36 /29:20 /30:18 /31:4 /32:53 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 6327 3204 3416 SHAW - Shaw Communications Inc., CA 39891 2946 3778 ALJAWWALSTC-AS, SA 12479 2931 4151 UNI2-AS, ES 22773 2551 3295 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 8551 2342 2880 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 18566 2060 2167 MEGAPATH5-US - MegaPath Corporation, US 11830 1996 2648 Instituto Costarricense de Electricidad y Telec 11492 1845 2102 CABLEONE - CABLE ONE, INC., US 30036 1733 1982 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom Communi 10620 1609 3594 Telmex Colombia S.A., CO Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1583 2:847 4:19 5:2844 6:65 7:1 8:1124 12:1860 13:185 14:1749 15:28 16:3 17:206 18:65 20:49 21:8 23:2664 24:2221 25:2 27:2368 31:1977 32:88 35:27 36:507 37:2797 38:1463 39:262 40:121 41:3159 42:592 43:1926 44:116 45:4570 46:3042 47:204 49:1318 50:1052 51:311 52:1032 54:369 55:3 56:12 57:42 58:1606 59:991 60:431 61:2160 62:1824 63:1800 64:5044 65:2214 66:4690 67:2436 68:1134 69:3197 70:1144 71:565 72:2112 74:2729 75:414 76:451 77:1544 78:1693 79:1851 80:1510 81:1394 82:1075 83:779 84:1044 85:2031 86:575 87:1317 88:929 89:2332 90:211 91:6350 92:1197 93:2372 94:2393 95:2813 96:668 97:357 98:946 99:133 100:81 101:1282 102:61 103:17730 104:3636 105:239 106:656 107:1889 108:699 109:3484 110:1625 111:1778 112:1274 113:1266 114:1118 115:1631 116:1643 117:1741 118:2202 119:1655 120:978 121:1051 122:2444 123:1820 124:1430 125:1901 128:1026 129:649 130:455 131:1592 132:666 133:195 134:1024 135:226 136:471 137:555 138:1927 139:584 140:396 141:704 142:825 143:990 144:791 145:461 146:1177 147:716 148:1633 149:699 150:725 151:1057 152:763 153:312 154:1088 155:759 156:957 157:788 158:650 159:1743 160:939 161:762 162:2576 163:565 164:1056 165:1592 166:453 167:1406 168:3074 169:802 170:3716 171:435 172:1068 173:1998 174:906 175:773 176:1886 177:4049 178:2451 179:1200 180:2230 181:2204 182:2423 183:1166 184:1010 185:13491 186:3568 187:2376 188:2822 189:2028 190:8076 191:1448 192:9840 193:5944 194:4756 195:3971 196:2543 197:1468 198:5542 199:5894 200:7380 201:5015 202:10467 203:10200 204:4564 205:2897 206:3107 207:3176 208:3976 209:3948 210:4036 211:2109 212:3039 213:2743 214:958 215:61 216:5915 217:2128 218:905 219:629 220:1750 221:986 222:1025 223:1255 End of report

1 0

PlayStation Network Contact
by Nathaniel Gerencser 18 May '18

18 May '18

Anybody have a contact that can help me with a prefix that is blocked from access to PlayStation Network? Nathan Gerencser, Network Engineer MetaLINK Technologies * 417 Wayne Ave * Defiance, OH 43512 office 419.990.0352 * cell 419.438.6356 ngerencser(a)team-meta.net<mailto:ngerencser@team-meta.net> | www.metalink.net<http://www.metalink.net/> [http://www.metalink.net/emailsigs/MetaLINK_Technologies_Logo.png]

1 0

EDGECAST / AlphaCDN
by Sam Norris 18 May '18

18 May '18

Anyone know EDGECAST / Verizon contact and can help with geolocation / anonymizer listings? We finally got off the Amazon / MaxMind lists but seems this one is stuck. Thx, Sam Norris San Diego Broadband

1 0

Equinix Fire Alarm - IBX was Evacuated
by Luke Guillory 17 May '18

17 May '18

Just got this. Dear Equinix Customer, IBX(s): DA6 IBX Address: 1950 North Stemmons Freeway Suites 2049 & 3050 Dallas, TX 75207 Ticket#: 5-152980676699 Date and Time of Occurrence: 17-MAY-2018 14:04 Site Local Time INCIDENT SUMMARY: Fire Alarm - IBX was Evacuated INCIDENT DESCRIPTION: Equinix IBX Site Staff reports that a fire alarm has been triggered and the IBX is being evacuated. IBX Engineers are currently investigating the issue. Next update will be when a significant change to the situation occurs. Sincerely, Equinix Service Desk Ns

2 1

internet - sparkle
by Aaron Gould 17 May '18

17 May '18

http://icaruswept.com/2016/06/28/who-owns-the-internet/ .written in 12/2015 - do y'all think this is accurate, and, in 2018, is it still accurate ? (asking since my next question is related to Sparkle, since they are listed in that previous article as a significant Internet presence) Also, please tell me your feelings/experiences of Sparkle as an Internet uplink provider. like for 10/100 gig. My coworker just got back from ITW/Chicago and he is considering Sparkle as an additional Internet provider for the ISP I work for in San Antonio, TX . we would need to uplink to Sparkle in the central Texas area somehow. He mentioned that Sparkle may be in McAllen / Dallas and could possibly, in the future be in Austin or San Antonio - Aaron

10 11

Re: BGP Optimizers (Was: Validating possible BGP MITM attack)
by Francois Devienne 17 May '18

17 May '18

Hi Job, I believe your disclaimer makes a lot of sense. From our perspective using more specifics is one of the options to make BGP follow the optimized path instead of the « natural » path. We used to be doing more specifics because with the same prefix being announced, we were simply not getting a best route announced back to the optimiser. Since the adoption of BGP ADD-PATH, our solution does not need to use more specifics to maintain a full collection of the routers BGP table. (In addition, it has actually never been a strong a requirement due to the use of other SNMP collection processes.) Therefore LOCAL_PREF is the option we advise and implement. The examples you mention confirm the issues are mainly due to poorly configured networks where routes are leaked out although they shouldn’t be. Adequate routers are able to filter out prefixes based on attributes like communities, which we set by default. We’ve had an instance of such an issue with one of our customers a few years ago; it turned out to be mistaken CLI commands that the engineer gave to the router. Our XCA software service and platform has hundreds of ASs running for years and none are making any noise. Another point of discussion is the fact that transit and large content providers actually accept thousands of routes coming from anywhere, there is a lot of room for optimization. And I know how much you personally try to contribute to enhance this. There actually is a reason for operating BGP optimizers. The BGP protocol, while robust and scalable, doesn't know anything about link capacity, doesn’t apply performance analytics and can easily drive links into saturation, introducing packet loss. Also, it is not aware of commercial agreements like CDR, generating costs that could be prevented. It also, of course, ignores the performance of available paths. All of the above actually impacts customer traffic and business performance. Since a few years we see our Customers take more care of quality and capacity management… and stop relying on BGP « blindly ». Most transit providers like to explain that their service are premium and that’s the reason why their prices are premium. But when you look at actual performance measurements, some premium providers are actually just behind the cheaper ones. I’m in RIPE 76 tomorrow, I’ll be more than happy to discuss this topic further with you. Kind regards, François (I’m a product engineer at Border 6 - Expereo, a BGP optimization software company.) François DEVIENNE Mobile: +33.651.937.927 E-mail: francois.devienne(a)expereo.com<mailto:francois.devienne@expereo.com> BORDER 6 S.A.S. - EXPEREO On Aug 31, 2017 (35), at 22:06, Job Snijders <job(a)ntt.net<mailto:job@ntt.net>> wrote: Dear all, disclaimer: [ The following is targetted at the context where a BGP optimizer generates BGP announcement that are ordinarily not seen in the Default-Free Zone. The OP indicated they announce a /23, and were unpleasantly surprised to see two unauthorized announcements for /24 more-specifics pop up in their alerting system. No permission was granted to create and announce these more-specifics. The AS_PATH for those /24 announcements was entirely fabricated. Original thread https://mailman.nanog.org/pipermail/nanog/2017-August/092124.html ] On Thu, Aug 31, 2017 at 11:13:18AM -0700, Andy Litzinger wrote: Presuming it was a route optimizer and the issue was ongoing, what would be the suggested course of action? I strongly recommend to turn off those BGP optimizers, glue the ports shut, burn the hardware, and salt the grounds on which the BGP optimizer sales people walked. It is extremely irresponsible behavior to use software that generates _fake_ BGP more-specifics for the purpose of traffic engineering. You simply cannot expect that those more-specifics will never escape into the global DFZ! Relying on NO_EXPORT is not sufficient: we regularly see software bugs related to NO_EXPORT, and community-squashing configuration mistakes happen all the time. Consider the following: if you leak your own internal more-specifics, at least you are the legitimate destination. (You may suffer from suboptimal routing, but it isn't guaranteed downtime.) However if you generate fake more-specifics for prefixes belonging to OTHER organisations, you essentially are complicit in BGP hijacking. If those fake more-specifics accidentally leak into the DFZ, you are bringing down the actual owner of such prefixes, and depriving people from access to the Internet. Example case: https://mailman.nanog.org/pipermail/nanog/2013-January/054846.html reach out to those 2 AS owners and see if they could stop it? Yes, absolutely! And if everyone of the affected parties of this localized hijack leak (or should we say 'victims') reaches out to the wrongdoers, they contribute peer pressure to rectify the situation. Just make sure you assign blame to the correct party. :) Or is it something I just have to live with as a traffic engineering solution they are using and mark the alerts as false positives? No, this is not something we should just accept. The Default-Free Zone is a shared resource. Anyone using "BGP optimizers" is not only risking their own online presence, but also everyone else's. Using a BGP optimizer is essentially trading a degree of risk to society for the purpose of saving a few bucks or milliseconds. It is basically saying: "The optimizer helps me, but may hurt others, and I am fine with that". An analogy: We don't want transporters of radioactive material to cut corners by using non-existant roads to bring the spent nuclear fuels from A to B faster, nor do we want them to rely on non-robust shielding that works "most of the time". We share the BGP DFZ environment, 'BGP optimizers' are downright pollution contributors. Kind regards, Job ps. If you want to do BGP optimization: don't have the BGP optimizer generate fake BGP announcements, but focus only on manipulating non-transitive attributes (like LOCAL_PREF) on real announcements you actually received from others. Or Perhaps BGP optimizers shouldn't even talk BGP but rather push freshly generated TE-optimized routing-policy to your edge boxes. Or perhaps the 'BGP optimizer' vendors should come to IETF to figure out a safe way (maybe a new AFI/SAFI to manipulate real announcements)... there are ways to do this, without risk to others! p.s. providing a publicly available BGP looking glasses will contribute to proving your innocence in cases like these. Since in many cases the AS_PATH is a complete fabrication, we need to manually check every AS in the AS_PATH to see whether the AS carries the fake more-specific. A public looking glass speeds up this fault-finding process. If you don't want to host a webinterface yourself, please consider sending a BGP feed to the Route Views Project or RIPE RIS, or for something queryable in a real-time fashion the NLNOG RING Looking Glass http://lg.ring.nlnog.net/

2 1

Email security: PGP/GPG & S/MIME vulnerability drop imminent
by George William Herbert 17 May '18

17 May '18

This is likely bad enough operators need to pay attention. @seecurity tweeted: "We'll publish critical vulnerabilities in PGP/GPG and S/MIME email encryption on 2018-05-15 07:00 UTC. They might reveal the plaintext of encrypted emails, including encrypted emails sent in the past. #efail 1/4" Thread starts here: https://twitter.com/seecurity/status/995906576170053633?s=21 I have no particular insight into what it is other than presuming from thread that decryption can be tricked to do bad things. They recommend temporary disabling downthread: "There are currently no reliable fixes for the vulnerability. If you use PGP/GPG or S/MIME for very sensitive communication, you should disable it in your email client for now. Also read @EFF’s blog post on this issue: eff.org/deeplinks/2018… #efail 2/4" -george Sent from my iPhone

21 24

Re: internet - sparkle
by Scott Weeks 16 May '18

16 May '18

--- aaron1(a)gvtc.com wrote: From: Aaron Gould <aaron1(a)gvtc.com> What's an eyeball network ? ----------------------------------------------- https://en.wikipedia.org/wiki/Eyeball_network scott

1 0

Verizon/UUNET AS701 blocking Tor "directory" server (IPv4 86.59.21.38)
by Neel Chauhan 16 May '18

16 May '18

Hi nanog mailing list, Keep in mind that I am not a practicing network engineer, although I do have interest and knowledge on networking topics. I do not work for Verizon. I subscribe to Verizon FiOS, but not Verizon Wireless or Verizon's enterprise services. The Tor "directory" server with the IPv4 address 86.59.21.38 has been blocked by Verizon's AS701 backbone for a few months now. AS701 provides Internet connectivity to Verizon FiOS and Wireless. The design of Tor is that even though anyone can set up a "relay", there are a few central directory servers which clients go to first to get a list of relay servers and build a circuit (which is a path of three relays to reach a destination). A more descriptive overview of Tor is available here: https://www.torproject.org/about/overview.html.en . While I can still access other Tor directory servers from Verizon FiOS as running Tor as a client or relay does not require every directory server be unblocked, blocking one of them could possibly mean breaking some part of the Internet for a Verizon customer. A traceroute to 86.59.21.38 from FiOS shows that I can get through verizon-gni.net which is Verizon's internal FiOS network, but not ALTER.NET, which is Verizon's UUNet backbone: neel@xb2:~ % traceroute 86.59.21.38 traceroute to 86.59.21.38 (86.59.21.38), 64 hops max, 40 byte packets 1 unknown (192.168.1.1) 1.128 ms 0.780 ms 0.613 ms 2 lo0-100.NYCMNY-VFTTP-401.verizon-gni.net (173.68.77.1) 1.001 ms 3.632 ms 0.900 ms 3 B3401.NYCMNY-LCR-22.verizon-gni.net (100.41.137.96) 2.291 ms B3401.NYCMNY-LCR-21.verizon-gni.net (100.41.137.94) 3.172 ms 4.046 ms 4 * * * 5 * * * 6 * * * 7 * * * 8 * * * 9 * * * ^C neel@xb2:~ % In a normal traceroute, I would see ALTER.NET on hop 5. Also, this filtering is not a subnet filtering. A traceroute to 86.59.21.1 works: neel@xb2:~ % traceroute 86.59.21.1 traceroute to 86.59.21.1 (86.59.21.1), 64 hops max, 40 byte packets 1 unknown (192.168.1.1) 0.863 ms 0.757 ms 0.579 ms 2 lo0-100.NYCMNY-VFTTP-401.verizon-gni.net (173.68.77.1) 1.010 ms 1.545 ms 1.034 ms 3 B3401.NYCMNY-LCR-22.verizon-gni.net (100.41.137.96) 3.616 ms B3401.NYCMNY-LCR-21.verizon-gni.net (100.41.137.94) 5.696 ms 10.062 ms 4 * * * 5 0.et-5-1-5.BR3.NYC4.ALTER.NET (140.222.2.127) 3.492 ms 3.506 ms 2.996 ms 6 204.255.168.118 (204.255.168.118) 8.462 ms 7.479 ms 7.252 ms 7 144.232.4.84 (144.232.4.84) 5.041 ms 4.688 ms sl-crs3-lon-0-6-3-0.sprintlink.net (144.232.9.165) 71.865 ms 8 sl-crs2-lon-0-0-3-0.sprintlink.net (213.206.128.181) 72.214 ms 73.579 ms 72.339 ms 9 213.206.129.142 (213.206.129.142) 81.390 ms sl-crs4-ams-0-7-0-3.sprintlink.net (213.206.129.139) 85.854 ms 93.238 ms 10 217.149.47.46 (217.149.47.46) 79.004 ms 85.669 ms 79.392 ms 11 ams5-core-1.bundle-ether1.tele2.net (130.244.82.54) 86.507 ms 78.374 ms 77.740 ms 12 ams-core-2.bundle-ether9.tele2.net (130.244.82.57) 79.642 ms 77.926 ms 81.515 ms 13 wen3-core-2.bundle-ether15.tele2.net (130.244.71.47) 105.400 ms 105.089 ms 109.751 ms 14 tele2at-bundle2-vie3.net.uta.at (212.152.189.65) 122.716 ms 110.820 ms 114.354 ms 15 86.59.21.1 (86.59.21.1) 106.389 ms * 105.379 ms neel@xb2:~ % I had posted this finding on Tor's mailing list (https://lists.torproject.org/pipermail/tor-relays/2018-May/015218.html) I am posting here as (I believe) Verizon NOC people are more likely to read NANOG mailing lists than Tor mailing lists, although this post is modified from the original because not all network engineers may know how Tor works. From Tor developer Roger Dingledine (at the Tor mailing list), the reason why Verizon blocked 86.59.21.38 in the first place is probably the WannaCry ransomware, and the VZ NOC didn't realize it was a Tor IP address (or how Tor works), and then whoever did this block forgot about it and moved on. I can understand that you all may not know how Tor works either, so I included an overview link above. It could also be possible that it's the NN repeal (but less likely since it is on the level of UUNET not FiOS). I also contacted the operator of 86.59.21.38 as well as Verizon FiOS support, and neither were of much help (the former is obvious as he's Austrian). Well, thank you for reading. Best, Neel Chauhan === https://www.neelc.org/

1 0