- NANOG - lists.nanog.org

Misblock (via SNI) of obscura.net on various ISPs
by Carl Dong 29 May '25

29 May '25

Our (Obscura’s) users are reporting that obscura.net and subdomains are being blocked. See end of message for why we think it’s SNI-based. They’ve observed this on at least Spectrum, Comcast, and United Airlines (whatever their upstream is). We are losing users as I write this, which is why I’m asking (read: pleading) for NANOG’s help. On Spectrum, the user notes that they see from their Spectrum portal that “Secure Browsing” was the culprit. Specifically, they see that pkgs.obscura.net is blocked with the following detail: > Secure Browsing prevents you from visiting potentially harmful websites. These may include sites that spread malware or use phishing attacks to steal your data. When a website is blocked, you may see the Security Shield icon appear on your browser. We are a new VPN service, and definitely not a phishing site. More details: https://obscura.net/blog/bootstrapping-trust/ We’d love any help in any and all of the below: 1. If you operate an ISP, especially Spectrum or Comcast, please unblock us. 2. If you know how I can get into contact with Spectrum or Comcast and not have to wait for 5 business days, we’d love to know. 2. It seems like we were put on some kind of list, if you have suspicions for what list that could be, we'd love to know. 3. If you have any ideas for how we could resolve this ASAP, we’re open to any and all suggestions. We’re already looking into getting rid of SNI and using http3 for even our API calls, and will aim to deploy a hotfix soon. –Carl Dong On a technical level, this seems to be SNI-blocking, see the following curl outputs. DNS resolved correctly, but TLS problems: curl --verbose --insecure --location 'https://v1.api.prod.obscura.net/api/ping’ * Host v1.api.prod.obscura.net:443 was resolved. * IPv6: (none) * IPv4: 66.42.95.12 * Trying 66.42.95.12:443... * Connected to v1.api.prod.obscura.net (66.42.95.12) port 443 * ALPN: curl offers h2,http/1.1 * (304) (OUT), TLS handshake, Client hello (1): * LibreSSL/3.3.6: error:1404B42E:SSL routines:ST_CONNECT:tlsv1 alert protocol version * Closing connection curl: (35) LibreSSL/3.3.6: error:1404B42E:SSL routines:ST_CONNECT:tlsv1 alert protocol version This one is essentially doing an SNI spoof, and succeeds: curl --connect-to 'google.com::66.42.95.12:' -H "Host: v1.api.prod.obscura.net" --verbose --insecure --location 'https://google.com/api/ping’ * Connecting to hostname: 66.42.95.12 * Trying 66.42.95.12:443... * Connected to 66.42.95.12 (66.42.95.12) port 443 * ALPN: curl offers h2,http/1.1 * (304) (OUT), TLS handshake, Client hello (1): * (304) (IN), TLS handshake, Server hello (2): * (304) (IN), TLS handshake, Unknown (8): * (304) (IN), TLS handshake, Certificate (11): * (304) (IN), TLS handshake, CERT verify (15): * (304) (IN), TLS handshake, Finished (20): * (304) (OUT), TLS handshake, Finished (20): * SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256 / [blank] / UNDEF * ALPN: server accepted h2 * Server certificate: * subject: CN=v1.api.prod.obscura.net * start date: May 4 22:38:20 2025 GMT * expire date: Aug 2 22:38:19 2025 GMT * issuer: C=US; O=Let's Encrypt; CN=E6 * SSL certificate verify ok. * using HTTP/2 * [HTTP/2] [1] OPENED stream for https://google.com/api/ping * [HTTP/2] [1] [:method: GET] * [HTTP/2] [1] [:scheme: https] * [HTTP/2] [1] [:authority: v1.api.prod.obscura.net] * [HTTP/2] [1] [:path: /api/ping] * [HTTP/2] [1] [user-agent: curl/8.7.1] * [HTTP/2] [1] [accept: */*] > GET /api/ping HTTP/2 > Host: v1.api.prod.obscura.net > User-Agent: curl/8.7.1 > Accept: */* > * Request completely sent off < HTTP/2 200 < date: Wed, 28 May 2025 23:50:28 GMT < content-type: application/json < content-length: 67 < vary: origin, access-control-request-method, access-control-request-headers < access-control-allow-origin: * < strict-transport-security: max-age=63072000 < * Connection #0 to host 66.42.95.12 left intact {"env":"prod","version":"3a91af31b3b75b6fd8d8acfefb53d812e601749e"}

1 0

Sudden surge in CGNAT blacklisting
by Eric C. Miller 28 May '25

28 May '25

Has anyone else experienced a sudden increase in the past 2 weeks of blocks getting flagged as "VPN" or "Proxy?" We have some older leased space from HE and Cogent that got hammered seemingly all at once. We've started accelerating our migration to our ARIN space, but it's still odd why it's all of a sudden. Most of the addresses are between 32:1 and 256:1 CGNAT pool IPs, and there are other 256:1 IPs that remain unaffected. Each customer behind an IP is in the same subdivision. Eric

10 15

Spectrum Transport
by Travis Garrison 27 May '25

27 May '25

Could someone from Spectrum contact me on pricing for several transport circuit? Carrier sales has been going to voicemail for a week and the enterprise number just gives a busy signal. Thank you Travis Garrison Chief Technology Officer 417-851-1700 www.netviscom.com<http://www.netviscom.com/> [cid:image001.png@01DBCEF0.0B1D3CE0]

4 3

Massive change in Public Cert behaviour coming soon
by Colin Constable 24 May '25

24 May '25

Is anyone elae worried about this? We use public certs for client auth in a number of cases. https://letsencrypt.org/2025/05/14/ending-tls-client-authentication/ And here's the Chrome policy document that's forcing the change https://googlechrome.github.io/chromerootprogram/#321-applicant-pki-hierarc… The TLS world is not just Web Browsers, so let me know if this effects you too. Colin Constable

19 91

Survey on Filtering of TCP Options in the Internet
by Fahad Hilal 23 May '25

23 May '25

Hello NANOG, We at the Max Planck Institute for Informatik (Germany) and LIX, Ecole Polytechnique (France) have been performing measurements to understand how TCP options/features are processed by routers along the path (see our previous work [1]). We want to confront network operators' views with our observations. To this end, we propose this short survey [2] to operators and would really appreciate if you could complete it. Please note that you are free to answer only the questions you feel comfortable with. Your input will be used anonymously and will not be connected to your AS. We look forward to your input. [1] https://dl.acm.org/doi/10.1145/3595290 [2] https://nextcloud.mpi-inf.mpg.de/index.php/apps/forms/s/WS4cscFcASZabpm2bax… Best regards, Fahad Hilal MPI-INF

1 0

Weekly Global IPv4 Routing Table Report
by Routing Table Analysis Role Account 23 May '25

23 May '25

This is an automated weekly mailing describing the state of the Global IPv4 Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG UKNOF, TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net. For historical data, please see https://thyme.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. IPv4 Routing Table Report 04:00 +10GMT Sat 24 May, 2025 IPv4 BGP Table (Global) as seen at Japan. Report Website: https://thyme.apnic.net Detailed Analysis: https://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 984658 Prefixes after maximum aggregation (per Origin AS): 379912 Deaggregation factor: 2.59 Unique aggregates announced (without unneeded subnets): 481594 Number of IPv4 prefixes with a valid ROA: 541221 Number of IPv4 prefixes with an invalid ROA: 1357 Number of IPv4 prefixes with no ROA: 442080 Total ASes present in the Internet Routing Table: 76891 Prefixes per ASN: 12.81 Origin-only ASes present in the Internet Routing Table: 65843 Origin ASes announcing only one prefix: 26946 Transit ASes present in the Internet Routing Table: 11048 Transit-only ASes present in the Internet Routing Table: 547 Average AS path length visible in the Internet Routing Table: 5.2 Max AS path length visible: 106 Max AS path prepend of ASN ( 37447) 98 Prefixes from unregistered ASNs in the Routing Table: 1001 Number of instances of unregistered ASNs: 1012 Number of 32-bit ASNs allocated by the RIRs: 46510 Number of 32-bit ASNs visible in the Routing Table: 38282 Prefixes from 32-bit ASNs in the Routing Table: 203511 Number of bogon 32-bit ASNs visible in the Routing Table: 44 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 459 Number of addresses announced to Internet: 3110978432 Equivalent to 185 /8s, 109 /16s and 195 /24s Percentage of available address space announced: 84.0 Percentage of allocated address space announced: 84.0 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.6 Total number of prefixes smaller than registry allocations: 322033 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 258959 Total APNIC prefixes after maximum aggregation: 77876 APNIC Deaggregation factor: 3.33 Prefixes being announced from the APNIC address blocks: 250055 Unique aggregates announced from the APNIC address blocks: 104301 APNIC Region origin ASes present in the Internet Routing Table: 14641 APNIC Prefixes per ASN: 17.08 APNIC Region origin ASes announcing only one prefix: 4449 APNIC Region transit ASes present in the Internet Routing Table: 1954 Average APNIC Region AS path length visible: 5.4 Max APNIC Region AS path length visible: 36 Number of APNIC region 32-bit ASNs visible in the Routing Table: 10133 Number of APNIC addresses announced to Internet: 749529088 Equivalent to 44 /8s, 172 /16s and 232 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-155961 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 291134 Total ARIN prefixes after maximum aggregation: 131227 ARIN Deaggregation factor: 2.22 Prefixes being announced from the ARIN address blocks: 291550 Unique aggregates announced from the ARIN address blocks: 139469 ARIN Region origin ASes present in the Internet Routing Table: 19249 ARIN Prefixes per ASN: 15.15 ARIN Region origin ASes announcing only one prefix: 7046 ARIN Region transit ASes present in the Internet Routing Table: 2000 Average ARIN Region AS path length visible: 4.6 Max ARIN Region AS path length visible: 34 Number of ARIN region 32-bit ASNs visible in the Routing Table: 5222 Number of ARIN addresses announced to Internet: 1352897536 Equivalent to 80 /8s, 163 /16s and 148 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-402332 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 54/8, 55/8, 56/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 273644 Total RIPE prefixes after maximum aggregation: 134013 RIPE Deaggregation factor: 2.04 Prefixes being announced from the RIPE address blocks: 272001 Unique aggregates announced from the RIPE address blocks: 174832 RIPE Region origin ASes present in the Internet Routing Table: 28924 RIPE Prefixes per ASN: 9.40 RIPE Region origin ASes announcing only one prefix: 12070 RIPE Region transit ASes present in the Internet Routing Table: 3998 Average RIPE Region AS path length visible: 5.3 Max RIPE Region AS path length visible: 44 Number of RIPE region 32-bit ASNs visible in the Routing Table: 12450 Number of RIPE addresses announced to Internet: 731448704 Equivalent to 43 /8s, 153 /16s and 5 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-216475 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 53/8, 57/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 124447 Total LACNIC prefixes after maximum aggregation: 29485 LACNIC Deaggregation factor: 4.22 Prefixes being announced from the LACNIC address blocks: 120829 Unique aggregates announced from the LACNIC address blocks: 48855 LACNIC Region origin ASes present in the Internet Routing Table: 11251 LACNIC Prefixes per ASN: 10.74 LACNIC Region origin ASes announcing only one prefix: 2690 LACNIC Region transit ASes present in the Internet Routing Table: 2536 Average LACNIC Region AS path length visible: 5.9 Max LACNIC Region AS path length visible: 56 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 9201 Number of LACNIC addresses announced to Internet: 171817472 Equivalent to 10 /8s, 61 /16s and 186 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-274844 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 35473 Total AfriNIC prefixes after maximum aggregation: 6693 AfriNIC Deaggregation factor: 5.30 Prefixes being announced from the AfriNIC address blocks: 49764 Unique aggregates announced from the AfriNIC address blocks: 13724 AfriNIC Region origin ASes present in the Internet Routing Table: 1911 AfriNIC Prefixes per ASN: 26.04 AfriNIC Region origin ASes announcing only one prefix: 691 AfriNIC Region transit ASes present in the Internet Routing Table: 376 Average AfriNIC Region AS path length visible: 5.9 Max AfriNIC Region AS path length visible: 106 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 1276 Number of AfriNIC addresses announced to Internet: 105076480 Equivalent to 6 /8s, 67 /16s and 87 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 11094 8757 101 CHINAMOBILE-CN China Mobile Communication 7545 6176 844 648 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4784 4192 76 ERX-CERNET-BKB China Education and Resear 9498 4386 534 305 BBIL-AP BHARTI Airtel Ltd., IN 7552 3901 1332 26 VIETEL-AS-AP Viettel Group, VN 7713 3696 1044 66 TELKOMNET-AS-AP PT Telekomunikasi Indones 45899 3284 1869 102 VNPT-AS-VN VNPT Corp, VN 24560 2871 853 536 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd., 4766 2371 11522 628 KIXS-AS-KR Korea Telecom, KR 45090 2208 1439 86 TENCENT-NET-AP Shenzhen Tencent Computer Complete listing at https://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 13476 40825 5109 AMAZON-02, US 11492 4734 314 586 CABLEONE, US 7155 3864 286 85 VIASAT-SP-BACKBONE, US 6327 3623 1320 81 SHAW, CA 22773 3350 3032 168 ASN-CXA-ALL-CCI-22773-RDC, US 174 3334 8745 877 COGENT-174, US 749 3231 54784 2482 DNIC-AS-00749, US 396982 3169 3852 418 GOOGLE-CLOUD-PLATFORM, US 16625 3028 1263 2228 AKAMAI-AS, US 36352 2830 231 861 AS-COLOCROSSING, US Complete listing at https://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 7713 1714 148 UNI2-AS, ES 39891 4798 293 63 ALJAWWALSTC-AS, SA 20940 3961 3395 127 AKAMAI-ASN1, NL 9009 3818 333 2035 M247, RO 12389 3080 2305 889 ROSTELECOM-AS PJSC Rostelecom. Technical 34984 2391 360 581 TELLCOM-AS, TR 212238 2151 152 1582 CDNEXT, GB 8452 1611 1852 14 TE-AS TE-AS, EG 13188 1606 100 34 TRIOLAN, UA 62240 1423 94 738 CLOUVIDER Clouvider - Global ASN, GB Complete listing at https://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 12159 3253 581 UNINET, MX 10620 3500 480 1017 Telmex Colombia S.A., CO 13999 2512 540 365 Mega Cable, S.A. de C.V., MX 11830 1990 369 64 Instituto Costarricense de Electricidad y 28573 1358 2438 262 Claro NXT Telecomunicacoes Ltda, BR 3816 1338 785 210 COLOMBIA TELECOMUNICACIONES S.A. ESP BIC, 11664 1205 278 33 Techtel LMDS Comunicaciones Interactivas 6147 1198 371 22 Telefonica del Peru S.A.A., PE 22884 1059 67 376 TOTAL PLAY TELECOMUNICACIONES SA DE CV, M 6503 1042 374 163 Axtel, S.A.B. de C.V., MX Complete listing at https://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24835 1780 644 27 RAYA-AS, EG 24863 1652 389 16 LINKdotNET-AS, EG 29571 1608 102 33 ORANGE-COTE-IVOIRE, CI 36992 1432 1519 280 ETISALAT-MISR, EG 36903 1250 554 97 MT-MPLS, MA 37069 1107 1100 18 MOBINIL, EG 36935 1046 523 46 Vodafone-, EG 20011 980 185 285 INTERNET-SOLUTIONS, ZA 36914 554 82 3 KENET-AS, KE 15399 541 57 59 WANANCHI-, KE Complete listing at https://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 13476 40825 5109 AMAZON-02, US 8151 12159 3253 581 UNINET, MX 9808 11094 8757 101 CHINAMOBILE-CN China Mobile Communication 12479 7713 1714 148 UNI2-AS, ES 7545 6176 844 648 TPG-INTERNET-AP TPG Telecom Limited, AU 39891 4798 293 63 ALJAWWALSTC-AS, SA 4538 4784 4192 76 ERX-CERNET-BKB China Education and Resear 11492 4734 314 586 CABLEONE, US 9498 4386 534 305 BBIL-AP BHARTI Airtel Ltd., IN 20940 3961 3395 127 AKAMAI-ASN1, NL Complete listing at https://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 8151 12159 11578 UNINET, MX 9808 11094 10993 CHINAMOBILE-CN China Mobile Communications Grou 12479 7713 7565 UNI2-AS, ES 7545 6176 5528 TPG-INTERNET-AP TPG Telecom Limited, AU 39891 4798 4735 ALJAWWALSTC-AS, SA 4538 4784 4708 ERX-CERNET-BKB China Education and Research Net 11492 4734 4148 CABLEONE, US 9498 4386 4081 BBIL-AP BHARTI Airtel Ltd., IN 7552 3901 3875 VIETEL-AS-AP Viettel Group, VN 20940 3961 3834 AKAMAI-ASN1, NL Complete listing at https://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 22542 UNALLOCATED 8.7.205.0/24 3356 LEVEL3, US 33123 UNALLOCATED 8.10.69.0/24 174 COGENT-174, US 12169 UNALLOCATED 8.15.207.0/24 32787 PROLEXIC-TECHNOLOGIES-D 46639 UNALLOCATED 8.17.66.0/24 701 UUNET, US 53775 UNALLOCATED 8.20.88.0/24 7029 WINDSTREAM, US 393266 UNALLOCATED 8.23.52.0/24 46887 CROWNCASTLE-AS46887, US 396894 UNALLOCATED 8.28.201.0/24 46887 CROWNCASTLE-AS46887, US 394936 UNALLOCATED 8.33.224.0/24 22442 HOU-PHONOSCOPE, US 54338 UNALLOCATED 8.33.241.0/24 3356 LEVEL3, US 46639 UNALLOCATED 8.38.73.0/24 3356 LEVEL3, US Complete listing at https://thyme.apnic.net/current/data-badAS Prefixes from the Special Purpose Address Registry (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at https://thyme.apnic.net/current/data-spar Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 14.192.20.0/22 Origin: 26658 HENGTONG-IDC-LLC, US 14.192.20.0/22 Transit: 6939 HURRICANE, US 23.140.216.0/24 Origin: 27176 DATAWAGON, US 23.140.216.0/24 Transit: 20278 NEXEON, US 23.141.0.0/24 Origin: 395350 RESERVED, ZZ 23.141.0.0/24 Transit: 11426 TWC-11426-CAROLINAS, US 23.143.96.0/24 Origin: 15830 EQUINIX, NL 23.143.96.0/24 Transit: 3257 GTT-BACKBONE GTT, US 23.147.240.0/24 Origin: 32302 RESERVED, ZZ 23.147.240.0/24 Transit: 32787 PROLEXIC-TECHNOLOGIES-DDOS-MITIGATION-NE Complete listing at https://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:16 /10:41 /11:92 /12:299 /13:581 /14:1214 /15:2144 /16:13919 /17:8337 /18:13779 /19:24839 /20:44759 /21:52135 /22:112297 /23:102065 /24:607329 /25:796 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 6629 7713 UNI2-AS, ES 8151 6353 12159 UNINET, MX 11492 3531 4734 CABLEONE, US 39891 3489 4798 ALJAWWALSTC-AS, SA 6327 3418 3623 SHAW, CA 7155 2823 3864 VIASAT-SP-BACKBONE, US 22773 2499 3350 ASN-CXA-ALL-CCI-22773-RDC, US 16509 2329 13476 AMAZON-02, US 30036 2229 2570 MEDIACOM-ENTERPRISE-BUSINESS, US 10620 2186 3500 Telmex Colombia S.A., CO Complete listing at https://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1726 2:1506 3:781 4:9 5:4672 6:163 7:6 8:1603 9:1 11:172 12:1361 13:430 14:2559 15:353 16:285 17:377 18:921 20:528 21:4 22:188 23:7539 24:2748 25:2 27:2702 29:19 31:3265 32:39 33:1 34:83 35:208 36:2969 37:4632 38:9136 39:909 40:169 41:4240 42:956 43:2565 44:383 45:18602 46:5060 47:304 49:1933 50:1885 51:591 52:1562 54:317 55:1098 56:11 57:264 58:2146 59:1368 60:1168 61:2803 62:2921 63:1805 64:5440 65:2180 66:4637 67:3059 68:1128 69:3844 70:1083 71:627 72:2841 74:2789 75:1508 76:621 77:2705 78:1892 79:1501 80:2219 81:2072 82:3113 83:1439 84:1867 85:3419 86:1070 87:2384 88:1291 89:4384 90:775 91:8358 92:2700 93:2893 94:4065 95:4310 96:1419 97:316 98:978 99:686 100:71 101:1201 102:3856 103:32226 104:5051 105:764 106:1035 107:2650 108:1225 109:3996 110:2251 111:3348 112:2101 113:1540 114:1976 115:2110 116:2051 117:2527 118:2360 119:1932 120:1966 121:1434 122:2778 123:2183 124:1631 125:2889 126:91 128:1598 129:964 130:1310 131:1968 132:785 133:451 134:1532 135:333 136:1349 137:1170 138:2898 139:1585 140:1599 141:1505 142:1877 143:1769 144:1119 145:502 146:2189 147:2109 148:2704 149:2894 150:1214 151:1941 152:2090 153:498 154:8054 155:1978 156:3237 157:1907 158:1264 159:2452 160:3808 161:1870 162:3748 163:2164 164:1703 165:2208 166:1473 167:1889 168:4311 169:792 170:5093 171:1007 172:4368 173:3293 174:915 175:1294 176:3703 177:4801 178:3639 179:2324 180:2631 181:4071 182:3442 183:1864 184:2064 185:21574 186:5156 187:4521 188:4259 189:4344 190:9549 191:1506 192:11269 193:9475 194:7791 195:5537 196:3259 197:3671 198:6210 199:8519 200:8212 201:6355 202:10493 203:10541 204:4549 205:3651 206:4506 207:3579 208:4248 209:5219 210:4843 211:2650 212:4563 213:3729 214:1028 215:48 216:6726 217:3127 218:1402 219:544 220:2091 221:1095 222:854 223:2412 End of report

1 0

Re: BGP malformed update/attribute list
by Jakob Heitz (jheitz) 23 May '25

23 May '25

This is an IOS-XR message. You can use the CLI exec command "show bgp update in error" to display the update and analyze it further. Kind Regards, Jakob -----------------original message -------------------------- From: Randy Bush <randy(a)psg.com> just to aol, and other posts did not show full nlri May 20 07:01:51 r2.f00 16869308: RP/0/RSP0/CPU0:May 20 07:01:51.437 : bgp[1059]: %ROUTING-BGP-3-MALFORM_UPDATE : Malformed UPDATE message received from neighbor 123.45.67.89 (VRF: default) - message length 106 bytes, error flags 0x000c0000, action taken "DiscardAttr". Error details: "Error 0x00040000, Field "Attr-length", Attribute 40 (Flags 0xe0, Length 28), Data [e0281c]". NLRIs: [IPv4 Unicast] 45.198.25.0/24 randy

3 3

BGP malformed update/attribute list
by Simon Lockhart 23 May '25

23 May '25

Did anyone see BGP flaps this morning at about 07:01 UTC as a result of BGP malformed update? It flapped one of our iBGP sessions: May 20 08:01:51.150 BST: %BGP-3-NOTIFICATION: received from neighbor XXX.XXX.XXX.XXX 3/1 (update malformed) 31 bytes E0281C00 00000000 00000000 00000000 00 Another ISP saw the same thing... code 3 (Update Message Error) subcode 1 (invalid attribute list), Data: e0 28 1c 00 00 00 Is there a new BGP rogue update out there? Simon

15 22

Gain Real-World Experience at N94: Team Up w/ Meta engineers at N94 Hackathon! + Workshops + MORE!
by Nanog News 22 May '25

22 May '25

*Team Up w/ Meta engineers at N94 Hackathon!* *Attendees Must be Registered In-Person at N94 to Participate* Bring your laptop, your curiosity, and your inner troubleshooting ninja. - Code alongside engineers from Meta. - Build smarter networks. - Connect with a community that gets it. * LEARN MORE <https://nanog.org/events/nanog-94-hackathon/>* *Gain Real-World Experience at N94* *Join Us for the Return of our IPv6 Clinic* Hosted in-person on Wednesday, June 11 at the Sheraton Denver Downtown. Enrollment is free, but you must be registered for N94 to attend. Powered by AWS experts, this hands-on clinic is your backstage pass to the world of IPv6 in the cloud, complete with technical talks, interactive whiteboarding, and problem-solving IRL. *VIEW NOW <https://nanog.org/events/n94-ipv6-clinic/>* *Don't Forget to Check Out the Community Help Desk at N94!* *Our Community Help Desk is Offered at Every Conference* *Got a question? We have an answer.* Make sure to stop by and see the friendly folks at the NANOG Community Help Desk, located near registration at NANOG 94. *Tell Your Friends You Will Be at N94!* *Downloadable Social Graphics + Email Banners* Check out the Conference Kit and share the excitement! Download one of our logos and add it to your email signature line, post it on your socials, or add a banner to your website. *VIEW NOW <https://nanog.org/events/nanog-94/conference-kit/>* *Video of the Week—Hackathon Wrap-Up* *Hackers Assemble!* This week’s featured video takes you inside the NANOG 93 Hackathon, where innovation met collaboration in Atlanta. Catch the highlights from Akamai’s Aaron Atac, ft. real-world challenges, rapid problem-solving, and epic whiteboarding moments. *WATCH NOW <https://www.youtube.com/watch?v=Zj1N4MtoJ8s&list=PLO8DR5ZGla8jiR9Jcl6CfeCti…>*

1 0

RouteViews now has a looking glass
by Nina Bargisen 22 May '25

22 May '25

Dear colleagues Just to let you know, we at RouteViews AS6447 have launched a global looking glass so you no longer have to log into each collector using telnet to check global routing. You can read more in our blog at our website. You can find the looking glass here: https://lg.routeviews.org/lg/ Nina RouteViews

6 6