- NANOG - lists.nanog.org

Weekly Routing Table Report
by cscora＠apnic.net 01 Sep '17

01 Sep '17

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG MENOG, BJNOG, SDNOG, CMNOG, IRNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 02 Sep, 2017 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 659343 Prefixes after maximum aggregation (per Origin AS): 257157 Deaggregation factor: 2.56 Unique aggregates announced (without unneeded subnets): 319791 Total ASes present in the Internet Routing Table: 58257 Prefixes per ASN: 11.32 Origin-only ASes present in the Internet Routing Table: 50359 Origin ASes announcing only one prefix: 22214 Transit ASes present in the Internet Routing Table: 7898 Transit-only ASes present in the Internet Routing Table: 227 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 56 Max AS path prepend of ASN ( 55644) 51 Prefixes from unregistered ASNs in the Routing Table: 60 Number of instances of unregistered ASNs: 63 Number of 32-bit ASNs allocated by the RIRs: 19864 Number of 32-bit ASNs visible in the Routing Table: 15650 Prefixes from 32-bit ASNs in the Routing Table: 63952 Number of bogon 32-bit ASNs visible in the Routing Table: 25 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 372 Number of addresses announced to Internet: 2853141856 Equivalent to 170 /8s, 15 /16s and 125 /24s Percentage of available address space announced: 77.1 Percentage of allocated address space announced: 77.1 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 98.7 Total number of prefixes smaller than registry allocations: 219558 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 179400 Total APNIC prefixes after maximum aggregation: 51947 APNIC Deaggregation factor: 3.45 Prefixes being announced from the APNIC address blocks: 178284 Unique aggregates announced from the APNIC address blocks: 74914 APNIC Region origin ASes present in the Internet Routing Table: 8310 APNIC Prefixes per ASN: 21.45 APNIC Region origin ASes announcing only one prefix: 2314 APNIC Region transit ASes present in the Internet Routing Table: 1181 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 56 Number of APNIC region 32-bit ASNs visible in the Routing Table: 3170 Number of APNIC addresses announced to Internet: 764936416 Equivalent to 45 /8s, 152 /16s and 0 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-137529 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 201333 Total ARIN prefixes after maximum aggregation: 95798 ARIN Deaggregation factor: 2.10 Prefixes being announced from the ARIN address blocks: 203102 Unique aggregates announced from the ARIN address blocks: 93704 ARIN Region origin ASes present in the Internet Routing Table: 17971 ARIN Prefixes per ASN: 11.30 ARIN Region origin ASes announcing only one prefix: 6641 ARIN Region transit ASes present in the Internet Routing Table: 1772 Average ARIN Region AS path length visible: 3.8 Max ARIN Region AS path length visible: 23 Number of ARIN region 32-bit ASNs visible in the Routing Table: 2166 Number of ARIN addresses announced to Internet: 1110269216 Equivalent to 66 /8s, 45 /16s and 93 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-397212 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 176865 Total RIPE prefixes after maximum aggregation: 86656 RIPE Deaggregation factor: 2.04 Prefixes being announced from the RIPE address blocks: 172744 Unique aggregates announced from the RIPE address blocks: 104339 RIPE Region origin ASes present in the Internet Routing Table: 24342 RIPE Prefixes per ASN: 7.10 RIPE Region origin ASes announcing only one prefix: 11172 RIPE Region transit ASes present in the Internet Routing Table: 3459 Average RIPE Region AS path length visible: 4.3 Max RIPE Region AS path length visible: 32 Number of RIPE region 32-bit ASNs visible in the Routing Table: 6142 Number of RIPE addresses announced to Internet: 713157760 Equivalent to 42 /8s, 129 /16s and 236 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-207259 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 84795 Total LACNIC prefixes after maximum aggregation: 18896 LACNIC Deaggregation factor: 4.49 Prefixes being announced from the LACNIC address blocks: 86057 Unique aggregates announced from the LACNIC address blocks: 39541 LACNIC Region origin ASes present in the Internet Routing Table: 6328 LACNIC Prefixes per ASN: 13.60 LACNIC Region origin ASes announcing only one prefix: 1755 LACNIC Region transit ASes present in the Internet Routing Table: 1176 Average LACNIC Region AS path length visible: 5.3 Max LACNIC Region AS path length visible: 36 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 3839 Number of LACNIC addresses announced to Internet: 171204576 Equivalent to 10 /8s, 52 /16s and 95 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-268700 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 16888 Total AfriNIC prefixes after maximum aggregation: 3807 AfriNIC Deaggregation factor: 4.44 Prefixes being announced from the AfriNIC address blocks: 18784 Unique aggregates announced from the AfriNIC address blocks: 7013 AfriNIC Region origin ASes present in the Internet Routing Table: 1049 AfriNIC Prefixes per ASN: 17.91 AfriNIC Region origin ASes announcing only one prefix: 331 AfriNIC Region transit ASes present in the Internet Routing Table: 202 Average AfriNIC Region AS path length visible: 4.8 Max AfriNIC Region AS path length visible: 22 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 333 Number of AfriNIC addresses announced to Internet: 93091584 Equivalent to 5 /8s, 140 /16s and 119 /24s AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5408 4194 88 ERX-CERNET-BKB China Education and Rese 7545 3901 406 384 TPG-INTERNET-AP TPG Telecom Limited, AU 17974 2961 902 73 TELKOMNET-AS2-AP PT Telekomunikasi Indo 4766 2839 11126 752 KIXS-AS-KR Korea Telecom, KR 9829 2757 1499 541 BSNL-NIB National Internet Backbone, IN 9808 2351 8699 32 CMNET-GD Guangdong Mobile Communication 4755 2101 423 221 TATACOMM-AS TATA Communications formerl 45899 2101 1468 116 VNPT-AS-VN VNPT Corp, VN 7552 1659 1105 70 VIETEL-AS-AP Viettel Corporation, VN 9498 1623 361 143 BBIL-AP BHARTI Airtel Ltd., IN Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 22773 3643 2952 158 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 6327 3463 1341 87 SHAW - Shaw Communications Inc., CA 18566 2204 405 109 MEGAPATH5-US - MegaPath Corporation, US 6389 2047 3671 39 BELLSOUTH-NET-BLK - BellSouth.net Inc., 20115 2032 2237 434 CHARTER-NET-HKY-NC - Charter Communicat 209 1898 5066 641 CENTURYLINK-US-LEGACY-QWEST - Qwest Com 30036 1826 329 285 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 16509 1823 3960 527 AMAZON-02 - Amazon.com, Inc., US 6983 1695 854 229 ITCDELTA - Earthlink, Inc., US 701 1673 10557 629 UUNET - MCI Communications Services, In Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 39891 3387 186 23 ALJAWWALSTC-AS, SA 20940 2977 958 2132 AKAMAI-ASN1, US 8551 2496 377 41 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 34984 2060 333 425 TELLCOM-AS, TR 9121 1801 1691 17 TTNET, TR 12389 1704 1614 669 ROSTELECOM-AS, RU 12479 1676 1052 60 UNI2-AS, ES 13188 1602 100 55 TRIOLAN, UA 6849 1225 355 21 UKRTELNET, UA 8402 1192 544 15 CORBINA-AS OJSC "Vimpelcom", RU Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 10620 3557 542 210 Telmex Colombia S.A., CO 8151 2980 3416 579 Uninet S.A. de C.V., MX 11830 2108 370 65 Instituto Costarricense de Electricidad 6503 1609 437 53 Axtel, S.A.B. de C.V., MX 7303 1564 1021 247 Telecom Argentina S.A., AR 6147 1252 377 27 Telefonica del Peru S.A.A., PE 3816 1025 504 94 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 28573 960 2284 185 CLARO S.A., BR 11172 918 126 86 Alestra, S. de R.L. de C.V., MX 18881 898 1052 23 TELEFÔNICA BRASIL S.A, BR Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1173 398 48 LINKdotNET-AS, EG 37611 755 91 8 Afrihost, ZA 36903 711 357 130 MT-MPLS, MA 36992 655 1383 29 ETISALAT-MISR, EG 24835 451 850 15 RAYA-AS, EG 29571 421 36 10 CITelecom-AS, CI 37492 410 354 77 ORANGE-, TN 15399 361 35 7 WANANCHI-, KE 2018 300 327 74 TENET-1, ZA 23889 293 103 14 MauritiusTelecom, MU Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5408 4194 88 ERX-CERNET-BKB China Education and Rese 7545 3901 406 384 TPG-INTERNET-AP TPG Telecom Limited, AU 22773 3643 2952 158 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 10620 3557 542 210 Telmex Colombia S.A., CO 6327 3463 1341 87 SHAW - Shaw Communications Inc., CA 39891 3387 186 23 ALJAWWALSTC-AS, SA 8151 2980 3416 579 Uninet S.A. de C.V., MX 20940 2977 958 2132 AKAMAI-ASN1, US 17974 2961 902 73 TELKOMNET-AS2-AP PT Telekomunikasi Indo 4766 2839 11126 752 KIXS-AS-KR Korea Telecom, KR Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 7545 3901 3517 TPG-INTERNET-AP TPG Telecom Limited, AU 22773 3643 3485 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 6327 3463 3376 SHAW - Shaw Communications Inc., CA 39891 3387 3364 ALJAWWALSTC-AS, SA 10620 3557 3347 Telmex Colombia S.A., CO 17974 2961 2888 TELKOMNET-AS2-AP PT Telekomunikasi Indonesia, I 8551 2496 2455 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 8151 2980 2401 Uninet S.A. de C.V., MX 9808 2351 2319 CMNET-GD Guangdong Mobile Communication Co.Ltd. 9829 2757 2216 BSNL-NIB National Internet Backbone, IN Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 65602 UNALLOCATED 8.225.192.0/24 30372 SUNESYS2 - Sunesys, LLC, US 64525 PRIVATE 45.119.143.0/24 133275 GIGANTIC-AS Gigantic Infotel P 64525 PRIVATE 45.125.62.0/24 133275 GIGANTIC-AS Gigantic Infotel P 65530 PRIVATE 45.249.40.0/24 133720 SOFTCALLCOC-AS SOFT CALL CUST- 65001 PRIVATE 46.237.40.0/21 13118 ASN-YARTELECOM PJSC Rostelecom 65534 PRIVATE 58.68.109.0/24 10201 DWL-AS-IN Dishnet Wireless Lim 64513 PRIVATE 62.150.101.0/24 9155 QNET Kuwait, KW 290012147 UNALLOCATED 63.65.43.0/24 7046 RFC2270-UUNET-CUSTOMER - MCI C 65538 DOCUMENT 64.27.253.0/24 1273 CW Vodafone Group PLC, GB 65346 PRIVATE 94.50.36.0/22 31094 TTKNET Tyumen, Russia, RU Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 14.192.48.0/24 134833 LIHGL-HK LANLIAN INTERNATIONAL HOLDING GROUP LIMITE 14.192.49.0/24 134833 LIHGL-HK LANLIAN INTERNATIONAL HOLDING GROUP LIMITE 14.192.50.0/24 134833 LIHGL-HK LANLIAN INTERNATIONAL HOLDING GROUP LIMITE 14.192.51.0/24 134833 LIHGL-HK LANLIAN INTERNATIONAL HOLDING GROUP LIMITE 23.226.112.0/20 62788 UNKNOWN 27.100.7.0/24 56096 UNKNOWN 41.76.232.0/21 62878 XLITT - Xlitt, US 41.77.248.0/21 62878 XLITT - Xlitt, US 41.78.180.0/23 37265 -Reserved AS-, ZZ 41.79.12.0/22 37306 -Reserved AS-, ZZ Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:15 /9:13 /10:36 /11:104 /12:284 /13:552 /14:1046 /15:1862 /16:13418 /17:7658 /18:13439 /19:24735 /20:38788 /21:41733 /22:78989 /23:65026 /24:369192 /25:853 /26:632 /27:647 /28:39 /29:39 /30:214 /31:2 /32:27 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 6327 3260 3463 SHAW - Shaw Communications Inc., CA 39891 2946 3387 ALJAWWALSTC-AS, SA 22773 2841 3643 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 18566 2088 2204 MEGAPATH5-US - MegaPath Corporation, US 8551 1961 2496 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 30036 1608 1826 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom Communi 10620 1501 3557 Telmex Colombia S.A., CO 11830 1498 2108 Instituto Costarricense de Electricidad y Telec 11492 1415 1593 CABLEONE - CABLE ONE, INC., US 6389 1358 2047 BELLSOUTH-NET-BLK - BellSouth.net Inc., US Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1561 2:830 4:18 5:2466 6:31 7:1 8:1052 12:1851 13:144 14:1713 15:28 16:2 17:195 18:90 20:60 23:2444 24:1938 25:2 27:2361 29:1 31:1927 32:84 33:20 35:21 36:416 37:2351 38:1363 39:69 40:98 41:2869 42:462 43:1965 44:79 45:3006 46:2798 47:165 49:1253 50:994 51:19 52:817 54:365 55:4 56:4 57:43 58:1592 59:1007 60:311 61:1923 62:1698 63:1911 64:4681 65:2207 66:4575 67:2284 68:1227 69:3391 70:1169 71:604 72:2169 74:2715 75:398 76:427 77:1504 78:1464 79:1907 80:1401 81:1392 82:1004 83:730 84:966 85:1826 86:466 87:1194 88:762 89:2185 90:165 91:6212 92:1009 93:2400 94:2331 95:2673 96:641 97:355 98:1005 99:98 100:153 101:1446 102:1 103:15771 104:3033 105:185 106:552 107:1770 108:823 109:2908 110:1459 111:1745 112:1244 113:1272 114:1074 115:1587 116:1653 117:1761 118:2156 119:1654 120:736 121:1059 122:2347 123:1833 124:1484 125:1783 128:862 129:672 130:442 131:1472 132:578 133:194 134:686 135:225 136:452 137:489 138:1906 139:517 140:380 141:645 142:753 143:878 144:807 145:184 146:1090 147:698 148:1499 149:584 150:713 151:985 152:734 153:296 154:844 155:757 156:673 157:670 158:481 159:1558 160:748 161:746 162:2513 163:511 164:959 165:1425 166:383 167:1296 168:3008 169:841 170:3503 171:366 172:996 173:2000 174:782 175:759 176:1893 177:3944 178:2577 179:1115 180:2197 181:1987 182:2435 183:768 184:864 185:10659 186:3274 187:2192 188:2580 189:1809 190:8341 191:1318 192:9610 193:5805 194:4723 195:3917 196:2135 197:1306 198:5533 199:5894 200:7602 201:4365 202:10342 203:9941 204:4545 205:2853 206:3076 207:3159 208:4026 209:4006 210:3971 211:2059 212:2862 213:2527 214:847 215:66 216:5898 217:2116 218:903 219:601 220:1678 221:917 222:742 223:1206 End of report

1 0

NYC Metro Fiber Cut
by Lewis,Mitchell T. 01 Sep '17

01 Sep '17

Anyone hear about any fiber cuts in the NYC Metro that happened yesterday ? I had a service outage yesterday (that was area wide) with a carrier who I will not name that was blamed on a fiber cut. Any further information that could be offered would be appreciated. Regards, Mitchell T. Lewis MLewis(a)TechCompute.Net |203-816-0371 PGP Fingerprint: 79F2A12BAC77827581C734212AFA805732A1394E Public PGP Key

1 0

Join RIPE NCC Hackathon Version 6, 4-5 November, Copenhagen, Denmark
by Mirjam Kuehne 01 Sep '17

01 Sep '17

Dear colleagues, The sixth RIPE NCC hackathon will take place on Saturday and Sunday, 4-5 November 2017 in Copenhagen, Denmark. The topic is: IPv6! We're looking for creative thinkers: front-end developers, UI designers, network operators, researchers, hackers and other enthusiastic coders, to help us develop new tools that would enable deployment of IPv6 and visualizations based on IPv6 measurements data. All source code developed during the hackathon will be publicly licensed and available on GitHub, and will be free for the entire community to use. -------------------- How to Apply -------------------- Interested? Learn more and apply online today! https://atlas.ripe.net/hackathon/version6/#!application-form *The application deadline is 9 September.* We look forward to seeing you there! Find out more in this RIPE Labs article: https://labs.ripe.net/Members/becha/join-the-ripe-ncc-hackathon-version-6 Regards, Vesna Manojlovic & Mirjam Kuhne Community Building RIPE NCC

1 0

BGP Optimizers (Was: Validating possible BGP MITM attack)
by Job Snijders 01 Sep '17

01 Sep '17

Dear all, disclaimer: [ The following is targetted at the context where a BGP optimizer generates BGP announcement that are ordinarily not seen in the Default-Free Zone. The OP indicated they announce a /23, and were unpleasantly surprised to see two unauthorized announcements for /24 more-specifics pop up in their alerting system. No permission was granted to create and announce these more-specifics. The AS_PATH for those /24 announcements was entirely fabricated. Original thread https://mailman.nanog.org/pipermail/nanog/2017-August/092124.html ] On Thu, Aug 31, 2017 at 11:13:18AM -0700, Andy Litzinger wrote: > Presuming it was a route optimizer and the issue was ongoing, what > would be the suggested course of action? I strongly recommend to turn off those BGP optimizers, glue the ports shut, burn the hardware, and salt the grounds on which the BGP optimizer sales people walked. It is extremely irresponsible behavior to use software that generates _fake_ BGP more-specifics for the purpose of traffic engineering. You simply cannot expect that those more-specifics will never escape into the global DFZ! Relying on NO_EXPORT is not sufficient: we regularly see software bugs related to NO_EXPORT, and community-squashing configuration mistakes happen all the time. Consider the following: if you leak your own internal more-specifics, at least you are the legitimate destination. (You may suffer from suboptimal routing, but it isn't guaranteed downtime.) However if you generate fake more-specifics for prefixes belonging to OTHER organisations, you essentially are complicit in BGP hijacking. If those fake more-specifics accidentally leak into the DFZ, you are bringing down the actual owner of such prefixes, and depriving people from access to the Internet. Example case: https://mailman.nanog.org/pipermail/nanog/2013-January/054846.html > reach out to those 2 AS owners and see if they could stop it? Yes, absolutely! And if everyone of the affected parties of this localized hijack leak (or should we say 'victims') reaches out to the wrongdoers, they contribute peer pressure to rectify the situation. Just make sure you assign blame to the correct party. :) > Or is it something I just have to live with as a traffic engineering > solution they are using and mark the alerts as false positives? No, this is not something we should just accept. The Default-Free Zone is a shared resource. Anyone using "BGP optimizers" is not only risking their own online presence, but also everyone else's. Using a BGP optimizer is essentially trading a degree of risk to society for the purpose of saving a few bucks or milliseconds. It is basically saying: "The optimizer helps me, but may hurt others, and I am fine with that". An analogy: We don't want transporters of radioactive material to cut corners by using non-existant roads to bring the spent nuclear fuels from A to B faster, nor do we want them to rely on non-robust shielding that works "most of the time". We share the BGP DFZ environment, 'BGP optimizers' are downright pollution contributors. Kind regards, Job ps. If you want to do BGP optimization: don't have the BGP optimizer generate fake BGP announcements, but focus only on manipulating non-transitive attributes (like LOCAL_PREF) on real announcements you actually received from others. Or Perhaps BGP optimizers shouldn't even talk BGP but rather push freshly generated TE-optimized routing-policy to your edge boxes. Or perhaps the 'BGP optimizer' vendors should come to IETF to figure out a safe way (maybe a new AFI/SAFI to manipulate real announcements)... there are ways to do this, without risk to others! p.s. providing a publicly available BGP looking glasses will contribute to proving your innocence in cases like these. Since in many cases the AS_PATH is a complete fabrication, we need to manually check every AS in the AS_PATH to see whether the AS carries the fake more-specific. A public looking glass speeds up this fault-finding process. If you don't want to host a webinterface yourself, please consider sending a BGP feed to the Route Views Project or RIPE RIS, or for something queryable in a real-time fashion the NLNOG RING Looking Glass http://lg.ring.nlnog.net/

6 7

Hijacks: AS12506, AS327814, AS44582, AS62135
by Ronald F. Guilmette 31 Aug '17

31 Aug '17

The following set of interrelated networks appear to be engaged in hijacking various IPv4 address blocks at the present time: AS12506 Inspiring Networks, B.V. (Netherlands) AS44582 Inspiring Networks, B.V. (Netherlands) AS62135 Inspiring Networks, B.V. (Netherlands) AS327814 Echoband, Ltd. (Ghana) The specific routes that are unambiguously being hijacked by each of these networks are as follows: AS12506: 152.108.0.0/16 155.159.0.0/16 196.15.64.0/18 AS327814: 163.198.0.0/18 164.88.0.0/16 168.80.0.0/17 168.80.128.0/17 AS44582: 175.53.0.0/17 175.53.128.0/17 175.54.0.0/17 175.54.128.0/17 AS62135: 160.116.32.0/20 160.116.128.0/20 160.116.240.0/20 160.122.144.0/20 Screenshots of the bgp.he.net prefixes reports for the above networks are archived here: http://i.imgur.com/5HuDRYX.png (AS12506) http://i.imgur.com/YishDCK.png (AS44582) http://i.imgur.com/lgiAKWz.png (AS62135) http://i.imgur.com/IM9Wf5h.png (AS327814) (Note that the set of routes announced by the four networks in question has changed slightly since the last bgp.he.net update -- 30 Aug 2017 14:48 PST. The route for 163.198.0.0/18 has been dropped and the routes for 160.116.128.0/20 and 160.122.144.0/20 have been added.) As seen in previous hijackings, and as is consistant with the general nature of such hijackings, no individual IP addresses within any of the above listed routes have any functioning reverse DNS delegation. Note that AS44582 (Inspiring Networks) and AS62135 (Inspiring Networks) really only have a single upstream connection to the Internet, at least as far as public BGP is concerned, and that is AS12506 (Inspiring Networks). Meanwhile, AS12506 (Inspiring Networks) has only a single BGP upstream, which is AS49544 i3D.net B.V (Netherlands). Therefore, the majority of this hijacking activity is only made possible via the generous help and assistance of AS49544, i3D.net B.V. Inspiring Networks is apparently run by one Maikel Jozef Gerardus Uerlings, <maikel(a)uerlings.nl>: https://labs.ripe.net/Members/maikel_uerlings https://nl.linkedin.com/in/maikel-uerlings-072aaa65 https://twitter.com/maikeluerlings (recently disappeared) https://www.facebook.com/maikel.uerlings http://uerlings.nl/ On February 24, 2013, over four years ago, Mr. Uerlings apparently promised his Facebook friends and fans that his new corporate web site would be "launched soon". As of today however, Mr. Uerlings' corporate web site for Inspiring Networks stil contains only generic/boilerplate "Lorem ipsum" type filler text: https://inspiringnetworks.com/ It would thus appear that Mr. Uerlings has other ways of attracting customers, other than his minimalist placeholder corporate web site. In any case, Mr. Uerlings has apparently gotten some bad press on a couple of occasions, for example the following blog post by some anonymous spammer who felt that Mr. Uerlings didn't actually deliver on his promises of "fresh IPs for mailing": http://maikel-uerlings-inspiring-networks.blogspot.com/ Mr. Uerlings' name also came up in the context of a 2013 attempt by Microsoft to take down a certain botnet: Microsoft v. Botnet United States Court for the Western District of Texas Case: A-13-CV-1014SS http://botnetlegalnotice.com/zeroaccess/files/Summons_Does_1-8.pdf (... Care of: Maikel Uerlings, cust597(a)serverius.com ...) Other folks also have, or had, a rather unfavorable opinion of Mr. Uerlings also, it would seem: https://www.mywot.com/en/scorecard/uerlings.nl https://www.scamwarners.com/forum/viewtopic.php?p=123180 https://unapprovedpharmacy.com/category/counterfeit-drugs-alert/page/12/ As usual, I wouldn't even mind about any of this hijacking activity if it were not for the fact that at least some porgtion of the hijacked IPv4 space appears to have been populated with snowshoe spammer domains: https://pastebin.com/raw/As9nVCMV I cannot help but wonder if there is something in the water supply in the Netherlands that may be causing so much hijacking activity to originate from that country. I do understand that Netherlands has what I gather is the best connectivity in all of Europe, but even that does not fully explain, I think, the Netherland's disproportionate share of these sorts of events and incidents, in this case involving Inspiring Networks, B.V. and clearly supported by AS49544, i3D.net B.V, also of the Netherlands. Regards, rfg P.s. Don't be fooled by hijackings of IP blocks that were historically allocated by AFRINIC to various corporate entities in the Seychelles Islands. Many of those corporate entities have long since died, and their associated IPv4 blocks have thus been abandoned. Unfortunately, due to the unique and very strict corporate secrecy laws in the Seychelles, it is not possible for any outsider to find out even if these entiries still exist or not, let alone who their corporate officers are or might have been. Thus, literally anybody can come along, after the fact (even lawyers) and claim to be representing the rightful owers of these blocks. And there is apparently no way, either verify or to disprove any such claims. Thus, hijacking the IP blocks of any defunct Seychelles Islands company is very nearly "The Perfect Crime". The only catch is that AFRINIC has, in its archives, the names of the actual corporate officers who originally requested (and were granted) the IP block allocations originally. And thus, they at least cannot be so easily fooled by any usurpers who are mearly pretending to be the rightful owners of these blocks. So it is actually pretty easy to tell which IPv4 blocks registered to Seychelles Islands companies have been hijacked. If they are hijacked by persons who are not actually acting on behalf of the true rightful owners of these blocks, then the thieves in question will not have been able to snooker AFRINIC into delegating reverse DNS authority for the blocks to them. So this is the simple acid test. If a given IP address block is allocated, from AFRINIC, to some corporate entity in the Seychelles Islands, and if that block has no working reverse DNS, then there's probably a very good reason for that, i.e. it's hijacked. And the hijacking has taken place without any knowledge of this event whatssoever on the part of AFRINIC.

2 1

Validating possible BGP MITM attack
by Andy Litzinger 31 Aug '17

31 Aug '17

Hello, we use BGPMon.net to monitor our BGP announcements. This morning we received two possible BGP MITM alerts for two of our prefixes detected by a single BGPMon probe located in China. I've reached out to BGPMon to see how much credence I should give to an alert from a single probe location, but I'm interested in community feedback as well. The alert detailed that one of our /23 prefixes has been broken into /24 specifics and the AS Path shows a peering relationship with us that does not exist: 131477(Shanghai Huajan) 38478(Sunny Vision LTD) 3491(PCCW Global) 14042 (me) We do not peer directly with PCCW Global. I'm going to reach out to them directly to see if they may have done anything by accident, but presuming they haven't and the path is spoofed, can I prove that? How can I detect if traffic is indeed swinging through that hijacked path? How worried should I be and what are my options for resolving the situation? thanks! -andy

4 5

BGP AS# migration from IOS to IOS-XR
by marcel.duregards＠yahoo.fr 31 Aug '17

31 Aug '17

Dear All, Does anybody had to migrate a entire BGP transit AS# from Cisco IOS to IOS-XR ? Our main concern is BGP, especially conversion from route-map, communities, conditional advertisement, template, peer-group up to RPL. Cisco offer a doc how to migrate from IOS to XR of about 40pages, but it's quite old (XR 3.2) and not so interesting. There are also a lot of documentation about XR/RPL, but I was not able to find a good doc about RPL, and how to translate complex IOS config to XR. Any experience on BGP best pratice with XR, af-group, session-group, neighbor-group, communities implementation from existing IOS config ? And how to you manage RPL editing? I mean with IOS you have some completion on TAB keystroke, but as RPL has to be edited within a text editor, you loose this kind of 'help'. Maybe we have to re-think our config from scrash :-). Thank in advance, Best regards, Marcel

3 2

SAFNOG-3: Agenda Finalized
by Mark Tinka 31 Aug '17

31 Aug '17

Hello all. Pleased to inform you that the SAFNOG-3 agenda is now full! You can view the agenda here: http://safnog.org/ We have a very detailed and exciting line-up, sure to appeal to different parts of our community, such as: - Data Centres. - Peering. - IPv4 Address exhaustion. - SDN/NFV. - FTTH. - Cloud Computing. - IPv6. - Internet Security. - DNS. - BGP. - e.t.c. We also have two very powerful keynote speakers delivering critical and vital information at this year's meeting: - Our opening keynote will be presented by Mr. Pascal Hoba, CEO of UbuntuNet Alliance. - Our closing keynote will be presented by Mr. Alan Barrett, CEO of AFRINIC. Bio information about all of this year's speakers will be available in the coming days. Please check the web site regularly for these updates. Please register your attendance for SAFNOG-3, if you have not yet done so. We look forward to seeing you all in Durban, next week! Cheers, Mark Tinka On Behalf of the SAFNOG Management Committee

1 0

I-65 Alabama
by Mike Hammett 31 Aug '17

31 Aug '17

Is anyone aware of any non-AT&T, non-Charter fiber routes going up I-65 in Alabama? Most that even go close to there seem to be over on 231. ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com

1 0

B-Root to be renumbered in October
by Wes Hardaker 30 Aug '17

30 Aug '17

FYI, To help support anycast with more resilient routing, the IPv4 address for b.root-servers.net will be renumbered to 199.9.14.201, effective 2017-10-24. The old IPv4 address (192.228.79.201) will continue to answer queries for at least 6 months. -- Wes Hardaker B-Root Operations USC/ISI

1 0