- NANOG - lists.nanog.org

BCM5341x
by Mike Hammett 26 Dec '16

26 Dec '16

I've asked Broadcom directly, but being as though I don't have an intent to buy tens of thousands of chips (or any at all), I don't expect I'll hear back. I was hoping someone here would have some insight. Do any of you know what functionality is available on those chips? That's the chip that powers the Ubiquiti 10G switches and I figured I would limit my most aggressive feature requests to things they can actually deliver with the platform as is. Other than things you just assume a managed switch has like 802.1p and 802.1q, it mentions an advanced ContentAware™ Engine (which means?), IEEE1588 (sync over Ethernet), 802.1ag (OAM stuff), "Enhanced DoS attack statistics gathering" (which means?), "IPv4/IPv6 L3 packet classification" (which means?), etc. I'm sure there's an array of things to ask about, but MLAG and S-Flow are at the top of my list at the moment. https://www.broadcom.com/products/ethernet-connectivity/switch-fabric/bcm53… ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP

4 3

Re: Recent NTP pool traffic increase (update)
by Denys Fedoryshchenko 25 Dec '16

25 Dec '16

Hello, I'm not sure i should continue to CC nanog, if someone interested to be in CC for further updates this story please let me know. TP-Link not related, it was misunderstanding or wrong customer report. Tenda routers i believe most of cheap models are affected by this problem. On ISPs i have access i see too many of them sending requests to 133.100.9.2 (if it is unreachable, repeating each 10 seconds), this particular ip seems hardcoded there. I am sure as soon as your server is down, way they coded - it will make all this routers to ddos this particular ip, repeating NTP queries very often without any backoff/protection mechanism. Particular model i tested - W308R / Wireless N300 Home Router, but i believe many models are affected. Firmware: System Version: 5.0.7.53_en hw version : v1.0 Another possible vendor is LB-Link, but i dont have yet any info from customers who own them. On 2016-12-21 11:00, FUJIMURA Sho wrote: > Hello. > > I'm Sho FUJIMURA. > Thank you for your information. > I operate the public NTP Services as 133.100.9.2 and 133.100.11.8. > I'd like to reduce the traffic because I have trouble with too much > traffic recently. > So, I'm interested in the root of the the problem. > If possible, would you please tell me the model numbers of Tenda and > TP-Link?? > > -- > Sho FUJIMURA > Information Technology Center, Fukuoka University. > 8-19-1, Nanakuma, Jyonan-ku, Fukuoka, 8140180, Japan > > fujimura(a)fukuoka-u.ac.jp > > 2016-12-20 5:33 GMT+09:00 Denys Fedoryshchenko <denys(a)visp.net.lb>: > >> I'm not sure if this issue relevant to discussed topic, Tenda >> routers here for a while on market, and i think i noticed this issue >> just now, >> because NTP servers they are using supposedly for healthcheck went >> down (or NTP owners blocked ISP's i support, due such routers). >> >> At least after checking numerous users, i believe Tenda hardcoded >> those NTP IPs. What worsen issue, that in Lebanon several times per >> day, for example at 18pm - short electricity cutoff, >> and majority of users routers will reboot and surely reconnect, so >> it will look like a countrywide spike in NTP traffic. >> >> I checked for a 10min also this NTP ips in dns responses, none of >> thousands of users tried to resolve any name with them over any DNS >> server, so i conclude they are hardcoded somewhere in firmware. >> >> Here is traffic of Tenda router after reconnecting (but not full >> powercycle, i dont have it in my hands). But as you can see, no DNS >> resolution attempts: >> >> 20:15:59.305739 PPPoE [ses 0x1483] CHAP, Success (0x03), id 1, Msg >> S=XXXXXX M=Authentication succeeded >> 20:15:59.306100 PPPoE [ses 0x1483] IPCP, Conf-Request (0x01), id 1, >> length 12 >> 20:15:59.317840 PPPoE [ses 0x1483] IPCP, Conf-Request (0x01), id 1, >> length 24 >> 20:15:59.317841 PPPoE [ses 0x1483] IPCP, Conf-Ack (0x02), id 1, >> length 12 >> 20:15:59.317867 PPPoE [ses 0x1483] IPCP, Conf-Nack (0x03), id 1, >> length 18 >> 20:15:59.325253 PPPoE [ses 0x1483] IPCP, Conf-Request (0x01), id 2, >> length 24 >> 20:15:59.325273 PPPoE [ses 0x1483] IPCP, Conf-Ack (0x02), id 2, >> length 24 >> 20:15:59.335589 PPPoE [ses 0x1483] IP 172.17.49.245.123 > >> 133.100.9.2.123: NTPv3, Client, length 48 >> 20:15:59.335588 PPPoE [ses 0x1483] IP 172.17.49.245.123 > >> 192.5.41.41.123: NTPv3, Client, length 48 >> 20:15:59.335588 PPPoE [ses 0x1483] IP 172.17.49.245.123 > >> 192.5.41.40.123: NTPv3, Client, length 48 >> >> Here is example of Tenda traffic if it is unable to reach >> destination, it repeats request each 10 seconds endlessly, my guess >> they are using ntp to show >> status of internet connection. >> So, now that NTP servers getting quite significant DDoS such way. >> >> 19:57:52.162863 IP (tos 0x0, ttl 64, id 38515, offset 0, flags >> [none], proto UDP (17), length 76) >> 172.16.31.67.123 > 192.5.41.40.123: [udp sum ok] NTPv3, length >> 48 >> Client, Leap indicator: (0), Stratum 0 (unspecified), poll >> 0 (1s), precision 0 >> Root Delay: 0.000000, Root dispersion: 0.000000, >> Reference-ID: (unspec) >> Reference Timestamp: 0.000000000 >> Originator Timestamp: 0.000000000 >> Receive Timestamp: 0.000000000 >> Transmit Timestamp: 3691177063.000000000 (2016/12/19 >> 22:57:43) >> Originator - Receive Timestamp: 0.000000000 >> Originator - Transmit Timestamp: 3691177063.000000000 >> (2016/12/19 22:57:43) >> 19:57:52.163277 IP (tos 0x0, ttl 64, id 38516, offset 0, flags >> [none], proto UDP (17), length 76) >> 172.16.31.67.123 > 192.5.41.41.123: [udp sum ok] NTPv3, length >> 48 >> Client, Leap indicator: (0), Stratum 0 (unspecified), poll >> 0 (1s), precision 0 >> Root Delay: 0.000000, Root dispersion: 0.000000, >> Reference-ID: (unspec) >> Reference Timestamp: 0.000000000 >> Originator Timestamp: 0.000000000 >> Receive Timestamp: 0.000000000 >> Transmit Timestamp: 3691177063.000000000 (2016/12/19 >> 22:57:43) >> Originator - Receive Timestamp: 0.000000000 >> Originator - Transmit Timestamp: 3691177063.000000000 >> (2016/12/19 22:57:43) >> 19:57:52.164435 IP (tos 0x0, ttl 64, id 38517, offset 0, flags >> [none], proto UDP (17), length 76) >> 172.16.31.67.123 > 133.100.9.2.123: [udp sum ok] NTPv3, length >> 48 >> Client, Leap indicator: (0), Stratum 0 (unspecified), poll >> 0 (1s), precision 0 >> Root Delay: 0.000000, Root dispersion: 0.000000, >> Reference-ID: (unspec) >> Reference Timestamp: 0.000000000 >> Originator Timestamp: 0.000000000 >> Receive Timestamp: 0.000000000 >> Transmit Timestamp: 3691177063.000000000 (2016/12/19 >> 22:57:43) >> Originator - Receive Timestamp: 0.000000000 >> Originator - Transmit Timestamp: 3691177063.000000000 >> (2016/12/19 22:57:43) >> 19:58:02.164781 IP (tos 0x0, ttl 64, id 38518, offset 0, flags >> [none], proto UDP (17), length 76) >> 172.16.31.67.123 > 192.5.41.40.123: [udp sum ok] NTPv3, length >> 48 >> Client, Leap indicator: (0), Stratum 0 (unspecified), poll >> 0 (1s), precision 0 >> Root Delay: 0.000000, Root dispersion: 0.000000, >> Reference-ID: (unspec) >> Reference Timestamp: 0.000000000 >> Originator Timestamp: 0.000000000 >> Receive Timestamp: 0.000000000 >> Transmit Timestamp: 3691177073.000000000 (2016/12/19 >> 22:57:53) >> Originator - Receive Timestamp: 0.000000000 >> Originator - Transmit Timestamp: 3691177073.000000000 >> (2016/12/19 22:57:53) >> 19:58:02.164884 IP (tos 0x0, ttl 64, id 38519, offset 0, flags >> [none], proto UDP (17), length 76) >> 172.16.31.67.123 > 192.5.41.41.123: [udp sum ok] NTPv3, length >> 48 >> Client, Leap indicator: (0), Stratum 0 (unspecified), poll >> 0 (1s), precision 0 >> Root Delay: 0.000000, Root dispersion: 0.000000, >> Reference-ID: (unspec) >> Reference Timestamp: 0.000000000 >> Originator Timestamp: 0.000000000 >> Receive Timestamp: 0.000000000 >> Transmit Timestamp: 3691177073.000000000 (2016/12/19 >> 22:57:53) >> Originator - Receive Timestamp: 0.000000000 >> Originator - Transmit Timestamp: 3691177073.000000000 >> (2016/12/19 22:57:53) >> 19:58:02.165061 IP (tos 0x0, ttl 64, id 38520, offset 0, flags >> [none], proto UDP (17), length 76) >> 172.16.31.67.123 > 133.100.9.2.123: [udp sum ok] NTPv3, length >> 48 >> Client, Leap indicator: (0), Stratum 0 (unspecified), poll >> 0 (1s), precision 0 >> Root Delay: 0.000000, Root dispersion: 0.000000, >> Reference-ID: (unspec) >> Reference Timestamp: 0.000000000 >> Originator Timestamp: 0.000000000 >> Receive Timestamp: 0.000000000 >> Transmit Timestamp: 3691177073.000000000 (2016/12/19 >> 22:57:53) >> Originator - Receive Timestamp: 0.000000000 >> Originator - Transmit Timestamp: 3691177073.000000000 >> (2016/12/19 22:57:53) >> >> On 2016-12-19 21:40, Roland Dobbins wrote: >> On 20 Dec 2016, at 2:22, Denys Fedoryshchenko wrote: >> >> If it is necessary i can investigate further. >> >> Yes, please! >> >> ----------------------------------- >> Roland Dobbins <rdobbins(a)arbor.net>

4 4

Canada joins the 21st century !
by Jean-Francois Mezei 24 Dec '16

24 Dec '16

This is more of an FYI. Yesterday, the CRTC released a big decision on broadband. In 2011, the same process resulted in CRTC to not declare the Internet as "basic service" and to set speed goals to 1990s 5/1. Yesterday, the CRTC declared the Internet to be a basic service (which enables additional regulatory powers) and set speed goals to 50/10. Note that this is not a definition of broadband as the FCC had done, it one of many criteria that will be weighted when proposal to get funding is received. But hopefully, it means the end of deployment of DSL. Also, as a result of declaring it a basic service, the CRTC enables powers to force ISPs to contrtibute to a fund that will be used to subsidize deplooyment in rural areas. It plans to collect $100 million/year, increasing by $25m each year to top at $200m which will then be distributed to companies who deploy internet to unserved areas. By setting the speed standard to 50/10, it basically marks any territory not served by cableco as underserved since telco's copper can't reliably deliver those speeds. Nothing happens for now because a "follow up" process is needed to decide how the funding mechanism will work (what portions of a companies revenues are counted to calculated its mandated contribution to fund) and how the process of bidding for subsidies will work. That could take 1 to 2 years. Also in the decision is the phasing out of the equivalent programme for POTS which saw telephone deployed everywhere. The difference is that the POTS program had an "obligation to serve" whereas the internet doesn't.

10 13

Wanted: volunteers with bandwidth/storage to help save climate data
by Rich Kulawiec 23 Dec '16

23 Dec '16

This is a short-term (about one month) project being thrown together in a hurry...and it could use some help. I know that some of you have lots of resources to throw at this, so if you have an interest in preserving a lot of scientific research data, I've set up a mailing list to coordinate IT efforts to help out. Signup via climatedata-request(a)firemountain.net or, if you prefer Mailman's web interface, http://www.firemountain.net/mailman/listinfo/climatedata should work. Thanks, ---rsk

16 27

Weekly Routing Table Report
by cscora＠apnic.net 23 Dec '16

23 Dec '16

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, SAFNOG, SdNOG, BJNOG, CaribNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 24 Dec, 2016 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 626295 Prefixes after maximum aggregation (per Origin AS): 221402 Deaggregation factor: 2.83 Unique aggregates announced (without unneeded subnets): 303816 Total ASes present in the Internet Routing Table: 55496 Prefixes per ASN: 11.29 Origin-only ASes present in the Internet Routing Table: 36274 Origin ASes announcing only one prefix: 15209 Transit ASes present in the Internet Routing Table: 6547 Transit-only ASes present in the Internet Routing Table: 170 Average AS path length visible in the Internet Routing Table: 4.4 Max AS path length visible: 38 Max AS path prepend of ASN ( 55644) 36 Prefixes from unregistered ASNs in the Routing Table: 58 Unregistered ASNs in the Routing Table: 19 Number of 32-bit ASNs allocated by the RIRs: 16676 Number of 32-bit ASNs visible in the Routing Table: 12675 Prefixes from 32-bit ASNs in the Routing Table: 51879 Number of bogon 32-bit ASNs visible in the Routing Table: 627 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 385 Number of addresses announced to Internet: 2833553892 Equivalent to 168 /8s, 228 /16s and 153 /24s Percentage of available address space announced: 76.5 Percentage of allocated address space announced: 76.5 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 98.4 Total number of prefixes smaller than registry allocations: 207587 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 156526 Total APNIC prefixes after maximum aggregation: 43103 APNIC Deaggregation factor: 3.63 Prefixes being announced from the APNIC address blocks: 170977 Unique aggregates announced from the APNIC address blocks: 70544 APNIC Region origin ASes present in the Internet Routing Table: 5182 APNIC Prefixes per ASN: 32.99 APNIC Region origin ASes announcing only one prefix: 1131 APNIC Region transit ASes present in the Internet Routing Table: 937 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 38 Number of APNIC region 32-bit ASNs visible in the Routing Table: 2568 Number of APNIC addresses announced to Internet: 761387652 Equivalent to 45 /8s, 97 /16s and 218 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-137529 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 188266 Total ARIN prefixes after maximum aggregation: 89328 ARIN Deaggregation factor: 2.11 Prefixes being announced from the ARIN address blocks: 195158 Unique aggregates announced from the ARIN address blocks: 89565 ARIN Region origin ASes present in the Internet Routing Table: 16087 ARIN Prefixes per ASN: 12.13 ARIN Region origin ASes announcing only one prefix: 5609 ARIN Region transit ASes present in the Internet Routing Table: 1712 Average ARIN Region AS path length visible: 3.8 Max ARIN Region AS path length visible: 23 Number of ARIN region 32-bit ASNs visible in the Routing Table: 1670 Number of ARIN addresses announced to Internet: 1105876640 Equivalent to 65 /8s, 234 /16s and 86 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-397212 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 150514 Total RIPE prefixes after maximum aggregation: 73101 RIPE Deaggregation factor: 2.06 Prefixes being announced from the RIPE address blocks: 161898 Unique aggregates announced from the RIPE address blocks: 98885 RIPE Region origin ASes present in the Internet Routing Table: 18153 RIPE Prefixes per ASN: 8.92 RIPE Region origin ASes announcing only one prefix: 7757 RIPE Region transit ASes present in the Internet Routing Table: 3054 Average RIPE Region AS path length visible: 4.4 Max RIPE Region AS path length visible: 28 Number of RIPE region 32-bit ASNs visible in the Routing Table: 5106 Number of RIPE addresses announced to Internet: 709572480 Equivalent to 42 /8s, 75 /16s and 55 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-207259 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 63659 Total LACNIC prefixes after maximum aggregation: 12583 LACNIC Deaggregation factor: 5.06 Prefixes being announced from the LACNIC address blocks: 80194 Unique aggregates announced from the LACNIC address blocks: 37813 LACNIC Region origin ASes present in the Internet Routing Table: 2487 LACNIC Prefixes per ASN: 32.25 LACNIC Region origin ASes announcing only one prefix: 543 LACNIC Region transit ASes present in the Internet Routing Table: 595 Average LACNIC Region AS path length visible: 5.1 Max LACNIC Region AS path length visible: 30 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 3047 Number of LACNIC addresses announced to Internet: 170723904 Equivalent to 10 /8s, 45 /16s and 10 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-266652 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 15392 Total AfriNIC prefixes after maximum aggregation: 3279 AfriNIC Deaggregation factor: 4.69 Prefixes being announced from the AfriNIC address blocks: 17683 Unique aggregates announced from the AfriNIC address blocks: 6662 AfriNIC Region origin ASes present in the Internet Routing Table: 736 AfriNIC Prefixes per ASN: 24.03 AfriNIC Region origin ASes announcing only one prefix: 169 AfriNIC Region transit ASes present in the Internet Routing Table: 180 Average AfriNIC Region AS path length visible: 4.8 Max AfriNIC Region AS path length visible: 18 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 284 Number of AfriNIC addresses announced to Internet: 85533184 Equivalent to 5 /8s, 25 /16s and 34 /24s AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5550 4190 74 ERX-CERNET-BKB China Education and Rese 7545 3710 390 250 TPG-INTERNET-AP TPG Telecom Limited, AU 17974 2986 905 71 TELKOMNET-AS2-AP PT Telekomunikasi Indo 4766 2718 11133 740 KIXS-AS-KR Korea Telecom, KR 9829 2693 1498 534 BSNL-NIB National Internet Backbone, IN 9808 2252 8698 33 CMNET-GD Guangdong Mobile Communication 4755 2042 428 217 TATACOMM-AS TATA Communications formerl 45899 1742 1261 98 VNPT-AS-VN VNPT Corp, VN 4808 1648 2165 468 CHINA169-BJ China Unicom Beijing Provin 24560 1580 559 238 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 22773 3610 2968 152 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 6327 3251 1333 82 SHAW - Shaw Communications Inc., CA 18566 2195 405 109 MEGAPATH5-US - MegaPath Corporation, US 6389 2095 3671 39 BELLSOUTH-NET-BLK - BellSouth.net Inc., 20115 1956 2021 402 CHARTER-NET-HKY-NC - Charter Communicat 30036 1744 328 401 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 209 1730 5066 639 CENTURYLINK-US-LEGACY-QWEST - Qwest Com 6983 1676 848 227 ITCDELTA - Earthlink, Inc., US 701 1598 10629 661 UUNET - MCI Communications Services, In 16509 1522 2837 519 AMAZON-02 - Amazon.com, Inc., US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 39891 3141 163 17 ALJAWWALSTC-AS , SA 20940 2964 1117 2103 AKAMAI-ASN1 , US 9121 2323 1708 96 TTNET , TR 34984 1985 327 373 TELLCOM-AS , TR 13188 1605 99 58 TRIOLAN , UA 12479 1414 1033 51 UNI2-AS , ES 6849 1289 355 22 UKRTELNET , UA 8551 1198 377 46 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 8402 1148 544 15 CORBINA-AS OJSC "Vimpelcom", RU 12389 999 1156 446 ROSTELECOM-AS , RU Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 10620 3527 543 179 Telmex Colombia S.A., CO 8151 2293 3373 556 Uninet S.A. de C.V., MX 11830 1799 368 66 Instituto Costarricense de Electricidad 6503 1543 437 54 Axtel, S.A.B. de C.V., MX 7303 1524 970 251 Telecom Argentina S.A., AR 6147 1347 377 27 Telefonica del Peru S.A.A., PE 28573 1055 2271 173 CLARO S.A., BR 3816 1028 480 191 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 11172 914 126 78 Alestra, S. de R.L. de C.V., MX 18881 879 1036 22 TELEFÔNICA BRASIL S.A, BR Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1295 402 42 LINKdotNET-AS, EG 36903 687 345 122 MT-MPLS, MA 37611 676 67 6 Afrihost, ZA 36992 579 1373 25 ETISALAT-MISR, EG 8452 488 1472 15 TE-AS TE-AS, EG 24835 487 658 16 RAYA-AS, EG 29571 368 36 10 CITelecom-AS, CI 37492 355 280 71 ORANGE-TN, TN 15399 314 35 6 WANANCHI-KE, KE 2018 272 327 74 TENET-1, ZA Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5550 4190 74 ERX-CERNET-BKB China Education and Rese 7545 3710 390 250 TPG-INTERNET-AP TPG Telecom Limited, AU 22773 3610 2968 152 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 10620 3527 543 179 Telmex Colombia S.A., CO 6327 3251 1333 82 SHAW - Shaw Communications Inc., CA 39891 3141 163 17 ALJAWWALSTC-AS , SA 17974 2986 905 71 TELKOMNET-AS2-AP PT Telekomunikasi Indo 20940 2964 1117 2103 AKAMAI-ASN1 , US 4766 2718 11133 740 KIXS-AS-KR Korea Telecom, KR 9829 2693 1498 534 BSNL-NIB National Internet Backbone, IN Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 7545 3710 3460 TPG-INTERNET-AP TPG Telecom Limited, AU 22773 3610 3458 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 10620 3527 3348 Telmex Colombia S.A., CO 6327 3251 3169 SHAW - Shaw Communications Inc., CA 39891 3141 3124 ALJAWWALSTC-AS , SA 17974 2986 2915 TELKOMNET-AS2-AP PT Telekomunikasi Indo 9121 2323 2227 TTNET , TR 9808 2252 2219 CMNET-GD Guangdong Mobile Communication 9829 2693 2159 BSNL-NIB National Internet Backbone, IN 18566 2195 2086 MEGAPATH5-US - MegaPath Corporation, US Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 65001 PRIVATE 5.143.176.0/20 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.192.0/20 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.192.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.200.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.208.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.216.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65000 PRIVATE 31.219.177.0/25 8966 ETISALAT-AS P.O. Box 1150, Dub 65000 PRIVATE 31.219.177.128/25 8966 ETISALAT-AS P.O. Box 1150, Dub 65001 PRIVATE 46.237.32.0/20 13118 ASN-YARTELECOM PJSC Rostelecom 65220 PRIVATE 61.128.136.0/21 23456 -Reserved AS-, ZZ Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 14.128.12.0/22 55763 UNKNOWN 14.128.12.0/24 55763 UNKNOWN 14.128.13.0/24 55763 UNKNOWN 14.128.15.0/24 55763 UNKNOWN 27.100.7.0/24 56096 UNKNOWN 41.73.16.0/24 37004 Suburban-Broadband-AS, NG 41.73.17.0/24 37004 Suburban-Broadband-AS, NG 41.73.18.0/24 37004 Suburban-Broadband-AS, NG 41.73.19.0/24 37004 Suburban-Broadband-AS, NG 41.73.20.0/24 37004 Suburban-Broadband-AS, NG Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:13 /10:36 /11:103 /12:276 /13:529 /14:1046 /15:1796 /16:13154 /17:7794 /18:13020 /19:25268 /20:38075 /21:40639 /22:73119 /23:61353 /24:348686 /25:546 /26:413 /27:311 /28:33 /29:19 /30:23 /31:0 /32:27 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 6327 3047 3251 SHAW - Shaw Communications Inc., CA 39891 2896 3141 ALJAWWALSTC-AS , SA 22773 2811 3610 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 18566 2088 2195 MEGAPATH5-US - MegaPath Corporation, US 9121 1632 2323 TTNET , TR 30036 1556 1744 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 10620 1446 3527 Telmex Colombia S.A., CO 6389 1393 2095 BELLSOUTH-NET-BLK - BellSouth.net Inc., 13188 1350 1605 TRIOLAN , UA 6983 1323 1676 ITCDELTA - Earthlink, Inc., US Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1588 2:816 4:23 5:2407 6:32 8:1022 12:1812 13:65 14:1780 15:24 16:2 17:104 18:128 19:1 20:51 23:2031 24:1800 27:2400 31:1831 32:83 33:11 34:1 35:3 36:376 37:2486 38:1298 39:42 40:99 41:3037 42:454 43:1903 44:52 45:2301 46:2516 47:106 49:1195 50:948 51:15 52:609 54:356 55:8 56:4 57:40 58:1567 59:978 60:389 61:1867 62:1499 63:1927 64:4540 65:2177 66:4398 67:2213 68:1168 69:3308 70:1302 71:560 72:2055 74:2595 75:404 76:413 77:1414 78:1603 79:907 80:1358 81:1420 82:968 83:717 84:857 85:1685 86:486 87:1132 88:781 89:2041 90:195 91:6096 92:976 93:2370 94:2343 95:2795 96:595 97:359 98:944 99:93 100:148 101:1200 103:13037 104:2631 105:138 106:473 107:1491 108:779 109:2530 110:1274 111:1661 112:1131 113:1170 114:1001 115:1626 116:1680 117:1577 118:2111 119:1588 120:942 121:1075 122:2281 123:1999 124:1593 125:1839 128:727 129:481 130:432 131:1357 132:613 133:187 134:528 135:209 136:385 137:395 138:1820 139:455 140:621 141:475 142:720 143:893 144:748 145:168 146:960 147:641 148:1355 149:555 150:683 151:797 152:703 153:313 154:715 155:949 156:544 157:562 158:428 159:1339 160:564 161:732 162:2451 163:537 164:779 165:1135 166:361 167:1225 168:2440 169:687 170:2518 171:262 172:848 173:1819 174:782 175:711 176:1748 177:4083 178:2411 179:1125 180:2192 181:1923 182:2127 183:1012 184:849 185:8330 186:3247 187:2242 188:2316 189:1777 190:7972 191:1292 192:9287 193:5768 194:4551 195:3856 196:1849 197:1257 198:5597 199:5819 200:7207 201:4012 202:10152 203:9831 204:4454 205:2772 206:2970 207:3166 208:4019 209:3867 210:3886 211:2077 212:2796 213:2446 214:849 215:66 216:5767 217:1973 218:825 219:595 220:1666 221:894 222:726 223:1101 End of report

1 0

Trouble connecting to wechat.com
by David S. 23 Dec '16

23 Dec '16

Hi, Is anyone having trouble connecting to wechat? Our network can't reach wechat.com and seems was blocked by firewall. I tried to contact their hostmaster and not replied yet. Here is the traceroute from our network: Tracing route to wechat.com [203.205.147.173] over a maximum of 30 hops: 1 <1 ms <1 ms <1 ms 103.58.160.25 2 <1 ms <1 ms <1 ms 103.58.160.6 3 <1 ms <1 ms <1 ms 10.20.0.1 4 <1 ms <1 ms <1 ms 10.58.160.1 5 16 ms 15 ms 15 ms 124.195.38.8 6 55 ms 54 ms 54 ms 119.27.63.70 7 55 ms 55 ms 55 ms 10.200.174.114 8 55 ms 55 ms 55 ms 10.228.119.38 9 * * * Request timed out. 10 * * * Request timed out. 11 * * * Request timed out. 12 * * * Request timed out. 13 * * * Request timed out. 14 * * * Request timed out. 15 * * * Request timed out. 16 * * * Request timed out. 17 * * * Request timed out. 18 * * * Request timed out. 19 * * * Request timed out. 20 * * * Request timed out. 21 * * * Request timed out. 22 * * * Request timed out. 23 * * * Request timed out. 24 * * * Request timed out. 25 * * * Request timed out. 26 * * * Request timed out. 27 * * * Request timed out. 28 * * * Request timed out. 29 * * * Request timed out. 30 * * * Request timed out. Trace complete. Best regards, David S. ------------------------------------------------ e. david(a)zeromail.us w. pnyet.web.id p. 087881216110

1 0

[Tier1 ISP]: Vulnerable to a new DDoS amplification attack
by Jean | ddostest.me 22 Dec '16

22 Dec '16

Hello all, I'm a first time poster here and hope to follow all rules. I found a new way to amplify traffic that would generate really high volume of traffic.+10Tbps ** There is no need for spoofing ** so any device in the world could initiate a really big attack or be part of an attack. We talk about an amplification factor x100+. This mean that a single computer with 1 Gbps outgoing bandwidth would generate a 100 Gbps DDoS. Imagine what a botnet could do? The list of affected business is huge and I would like to privately disclose the details to the Tier1 ISP as they are highly vulnerable. XO Comm PSINET Level 3 Qwest Windstream Comm Eearthlink MCI Comm/Verizon Buss Comcast Cable Comm AT&T Sprint I know it's Christmas time and there is no rush in disclosing this but, it could be a nice opportunity to meditate and shed some lights on this new DDoS threat. We could start the real work in January. If you are curious and you operate/manage one of the network mentioned above, please write to me at tornaddos(a)ddostest.me from your job email to confirm the identity. I will then forward you the DDoS details. Best regards Jean St-Laurent ddostest.me 365 boul. Sir-Wilfrid-Laurier #202 Beloeil, QC J3G 4T2

9 21

Any WAVE Business clue on the list?
by Mike Lyon 22 Dec '16

22 Dec '16

If so, can you hit me up offlist? Thank You, Mike -- Mike Lyon 408-621-4826 mike.lyon(a)gmail.com http://www.linkedin.com/in/mlyon

1 0

replacing EPP?
by Ryan Finnesey 22 Dec '16

22 Dec '16

Has there been an discussion about replacing EPP with something more modern? Cheers Ryan

2 1

Re: Recent NTP pool traffic increase (update)
by Denys Fedoryshchenko 21 Dec '16

21 Dec '16

I'm not sure if this issue relevant to discussed topic, Tenda routers here for a while on market, and i think i noticed this issue just now, because NTP servers they are using supposedly for healthcheck went down (or NTP owners blocked ISP's i support, due such routers). At least after checking numerous users, i believe Tenda hardcoded those NTP IPs. What worsen issue, that in Lebanon several times per day, for example at 18pm - short electricity cutoff, and majority of users routers will reboot and surely reconnect, so it will look like a countrywide spike in NTP traffic. I checked for a 10min also this NTP ips in dns responses, none of thousands of users tried to resolve any name with them over any DNS server, so i conclude they are hardcoded somewhere in firmware. Here is traffic of Tenda router after reconnecting (but not full powercycle, i dont have it in my hands). But as you can see, no DNS resolution attempts: 20:15:59.305739 PPPoE [ses 0x1483] CHAP, Success (0x03), id 1, Msg S=XXXXXX M=Authentication succeeded 20:15:59.306100 PPPoE [ses 0x1483] IPCP, Conf-Request (0x01), id 1, length 12 20:15:59.317840 PPPoE [ses 0x1483] IPCP, Conf-Request (0x01), id 1, length 24 20:15:59.317841 PPPoE [ses 0x1483] IPCP, Conf-Ack (0x02), id 1, length 12 20:15:59.317867 PPPoE [ses 0x1483] IPCP, Conf-Nack (0x03), id 1, length 18 20:15:59.325253 PPPoE [ses 0x1483] IPCP, Conf-Request (0x01), id 2, length 24 20:15:59.325273 PPPoE [ses 0x1483] IPCP, Conf-Ack (0x02), id 2, length 24 20:15:59.335589 PPPoE [ses 0x1483] IP 172.17.49.245.123 > 133.100.9.2.123: NTPv3, Client, length 48 20:15:59.335588 PPPoE [ses 0x1483] IP 172.17.49.245.123 > 192.5.41.41.123: NTPv3, Client, length 48 20:15:59.335588 PPPoE [ses 0x1483] IP 172.17.49.245.123 > 192.5.41.40.123: NTPv3, Client, length 48 Here is example of Tenda traffic if it is unable to reach destination, it repeats request each 10 seconds endlessly, my guess they are using ntp to show status of internet connection. So, now that NTP servers getting quite significant DDoS such way. 19:57:52.162863 IP (tos 0x0, ttl 64, id 38515, offset 0, flags [none], proto UDP (17), length 76) 172.16.31.67.123 > 192.5.41.40.123: [udp sum ok] NTPv3, length 48 Client, Leap indicator: (0), Stratum 0 (unspecified), poll 0 (1s), precision 0 Root Delay: 0.000000, Root dispersion: 0.000000, Reference-ID: (unspec) Reference Timestamp: 0.000000000 Originator Timestamp: 0.000000000 Receive Timestamp: 0.000000000 Transmit Timestamp: 3691177063.000000000 (2016/12/19 22:57:43) Originator - Receive Timestamp: 0.000000000 Originator - Transmit Timestamp: 3691177063.000000000 (2016/12/19 22:57:43) 19:57:52.163277 IP (tos 0x0, ttl 64, id 38516, offset 0, flags [none], proto UDP (17), length 76) 172.16.31.67.123 > 192.5.41.41.123: [udp sum ok] NTPv3, length 48 Client, Leap indicator: (0), Stratum 0 (unspecified), poll 0 (1s), precision 0 Root Delay: 0.000000, Root dispersion: 0.000000, Reference-ID: (unspec) Reference Timestamp: 0.000000000 Originator Timestamp: 0.000000000 Receive Timestamp: 0.000000000 Transmit Timestamp: 3691177063.000000000 (2016/12/19 22:57:43) Originator - Receive Timestamp: 0.000000000 Originator - Transmit Timestamp: 3691177063.000000000 (2016/12/19 22:57:43) 19:57:52.164435 IP (tos 0x0, ttl 64, id 38517, offset 0, flags [none], proto UDP (17), length 76) 172.16.31.67.123 > 133.100.9.2.123: [udp sum ok] NTPv3, length 48 Client, Leap indicator: (0), Stratum 0 (unspecified), poll 0 (1s), precision 0 Root Delay: 0.000000, Root dispersion: 0.000000, Reference-ID: (unspec) Reference Timestamp: 0.000000000 Originator Timestamp: 0.000000000 Receive Timestamp: 0.000000000 Transmit Timestamp: 3691177063.000000000 (2016/12/19 22:57:43) Originator - Receive Timestamp: 0.000000000 Originator - Transmit Timestamp: 3691177063.000000000 (2016/12/19 22:57:43) 19:58:02.164781 IP (tos 0x0, ttl 64, id 38518, offset 0, flags [none], proto UDP (17), length 76) 172.16.31.67.123 > 192.5.41.40.123: [udp sum ok] NTPv3, length 48 Client, Leap indicator: (0), Stratum 0 (unspecified), poll 0 (1s), precision 0 Root Delay: 0.000000, Root dispersion: 0.000000, Reference-ID: (unspec) Reference Timestamp: 0.000000000 Originator Timestamp: 0.000000000 Receive Timestamp: 0.000000000 Transmit Timestamp: 3691177073.000000000 (2016/12/19 22:57:53) Originator - Receive Timestamp: 0.000000000 Originator - Transmit Timestamp: 3691177073.000000000 (2016/12/19 22:57:53) 19:58:02.164884 IP (tos 0x0, ttl 64, id 38519, offset 0, flags [none], proto UDP (17), length 76) 172.16.31.67.123 > 192.5.41.41.123: [udp sum ok] NTPv3, length 48 Client, Leap indicator: (0), Stratum 0 (unspecified), poll 0 (1s), precision 0 Root Delay: 0.000000, Root dispersion: 0.000000, Reference-ID: (unspec) Reference Timestamp: 0.000000000 Originator Timestamp: 0.000000000 Receive Timestamp: 0.000000000 Transmit Timestamp: 3691177073.000000000 (2016/12/19 22:57:53) Originator - Receive Timestamp: 0.000000000 Originator - Transmit Timestamp: 3691177073.000000000 (2016/12/19 22:57:53) 19:58:02.165061 IP (tos 0x0, ttl 64, id 38520, offset 0, flags [none], proto UDP (17), length 76) 172.16.31.67.123 > 133.100.9.2.123: [udp sum ok] NTPv3, length 48 Client, Leap indicator: (0), Stratum 0 (unspecified), poll 0 (1s), precision 0 Root Delay: 0.000000, Root dispersion: 0.000000, Reference-ID: (unspec) Reference Timestamp: 0.000000000 Originator Timestamp: 0.000000000 Receive Timestamp: 0.000000000 Transmit Timestamp: 3691177073.000000000 (2016/12/19 22:57:53) Originator - Receive Timestamp: 0.000000000 Originator - Transmit Timestamp: 3691177073.000000000 (2016/12/19 22:57:53) On 2016-12-19 21:40, Roland Dobbins wrote: > On 20 Dec 2016, at 2:22, Denys Fedoryshchenko wrote: > >> If it is necessary i can investigate further. > > Yes, please! > > ----------------------------------- > Roland Dobbins <rdobbins(a)arbor.net>

2 1