- NANOG - lists.nanog.org

Weekly Routing Table Report
by cscora＠apnic.net 28 Oct '16

28 Oct '16

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, SAFNOG, SdNOG, BJNOG, CaribNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 29 Oct, 2016 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 619119 Prefixes after maximum aggregation (per Origin AS): 220712 Deaggregation factor: 2.81 Unique aggregates announced (without unneeded subnets): 300943 Total ASes present in the Internet Routing Table: 55082 Prefixes per ASN: 11.24 Origin-only ASes present in the Internet Routing Table: 36320 Origin ASes announcing only one prefix: 15327 Transit ASes present in the Internet Routing Table: 6532 Transit-only ASes present in the Internet Routing Table: 167 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 37 Max AS path prepend of ASN ( 55644) 31 Prefixes from unregistered ASNs in the Routing Table: 52 Unregistered ASNs in the Routing Table: 16 Number of 32-bit ASNs allocated by the RIRs: 15924 Number of 32-bit ASNs visible in the Routing Table: 12230 Prefixes from 32-bit ASNs in the Routing Table: 49420 Number of bogon 32-bit ASNs visible in the Routing Table: 281 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 352 Number of addresses announced to Internet: 2828482468 Equivalent to 168 /8s, 151 /16s and 55 /24s Percentage of available address space announced: 76.4 Percentage of allocated address space announced: 76.4 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 98.3 Total number of prefixes smaller than registry allocations: 203450 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 156739 Total APNIC prefixes after maximum aggregation: 42750 APNIC Deaggregation factor: 3.67 Prefixes being announced from the APNIC address blocks: 170488 Unique aggregates announced from the APNIC address blocks: 69969 APNIC Region origin ASes present in the Internet Routing Table: 5173 APNIC Prefixes per ASN: 32.96 APNIC Region origin ASes announcing only one prefix: 1140 APNIC Region transit ASes present in the Internet Routing Table: 947 Average APNIC Region AS path length visible: 4.3 Max APNIC Region AS path length visible: 35 Number of APNIC region 32-bit ASNs visible in the Routing Table: 2444 Number of APNIC addresses announced to Internet: 758852036 Equivalent to 45 /8s, 59 /16s and 41 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-137529 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 187849 Total ARIN prefixes after maximum aggregation: 89675 ARIN Deaggregation factor: 2.09 Prefixes being announced from the ARIN address blocks: 193888 Unique aggregates announced from the ARIN address blocks: 89398 ARIN Region origin ASes present in the Internet Routing Table: 16158 ARIN Prefixes per ASN: 12.00 ARIN Region origin ASes announcing only one prefix: 5667 ARIN Region transit ASes present in the Internet Routing Table: 1712 Average ARIN Region AS path length visible: 3.8 Max ARIN Region AS path length visible: 23 Number of ARIN region 32-bit ASNs visible in the Routing Table: 1549 Number of ARIN addresses announced to Internet: 1105484960 Equivalent to 65 /8s, 228 /16s and 92 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-397212 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 147174 Total RIPE prefixes after maximum aggregation: 72269 RIPE Deaggregation factor: 2.04 Prefixes being announced from the RIPE address blocks: 157973 Unique aggregates announced from the RIPE address blocks: 97288 RIPE Region origin ASes present in the Internet Routing Table: 18133 RIPE Prefixes per ASN: 8.71 RIPE Region origin ASes announcing only one prefix: 7797 RIPE Region transit ASes present in the Internet Routing Table: 3036 Average RIPE Region AS path length visible: 4.3 Max RIPE Region AS path length visible: 27 Number of RIPE region 32-bit ASNs visible in the Routing Table: 5080 Number of RIPE addresses announced to Internet: 708894976 Equivalent to 42 /8s, 64 /16s and 225 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-207259 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 62909 Total LACNIC prefixes after maximum aggregation: 12672 LACNIC Deaggregation factor: 4.96 Prefixes being announced from the LACNIC address blocks: 79235 Unique aggregates announced from the LACNIC address blocks: 37500 LACNIC Region origin ASes present in the Internet Routing Table: 2479 LACNIC Prefixes per ASN: 31.96 LACNIC Region origin ASes announcing only one prefix: 553 LACNIC Region transit ASes present in the Internet Routing Table: 593 Average LACNIC Region AS path length visible: 4.9 Max LACNIC Region AS path length visible: 22 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 2886 Number of LACNIC addresses announced to Internet: 170733632 Equivalent to 10 /8s, 45 /16s and 48 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-266652 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 14975 Total AfriNIC prefixes after maximum aggregation: 3338 AfriNIC Deaggregation factor: 4.49 Prefixes being announced from the AfriNIC address blocks: 17183 Unique aggregates announced from the AfriNIC address blocks: 6467 AfriNIC Region origin ASes present in the Internet Routing Table: 736 AfriNIC Prefixes per ASN: 23.35 AfriNIC Region origin ASes announcing only one prefix: 170 AfriNIC Region transit ASes present in the Internet Routing Table: 180 Average AfriNIC Region AS path length visible: 4.7 Max AfriNIC Region AS path length visible: 18 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 271 Number of AfriNIC addresses announced to Internet: 84162560 Equivalent to 5 /8s, 4 /16s and 56 /24s AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5540 4190 74 ERX-CERNET-BKB China Education and Rese 7545 3584 382 248 TPG-INTERNET-AP TPG Telecom Limited, AU 17974 2958 905 71 TELKOMNET-AS2-AP PT Telekomunikasi Indo 9829 2694 1497 530 BSNL-NIB National Internet Backbone, IN 4766 2692 11132 739 KIXS-AS-KR Korea Telecom, KR 9808 2231 8781 42 CMNET-GD Guangdong Mobile Communication 4755 2050 429 215 TATACOMM-AS TATA Communications formerl 4808 1768 2291 520 CHINA169-BJ China Unicom Beijing Provin 45899 1603 1239 93 VNPT-AS-VN VNPT Corp, VN 24560 1558 520 227 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 22773 3550 2965 146 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 6327 2986 1333 83 SHAW - Shaw Communications Inc., CA 18566 2197 405 110 MEGAPATH5-US - MegaPath Corporation, US 6389 2095 3671 39 BELLSOUTH-NET-BLK - BellSouth.net Inc., 20115 1946 1999 405 CHARTER-NET-HKY-NC - Charter Communicat 30036 1767 338 328 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 209 1725 5067 658 CENTURYLINK-US-LEGACY-QWEST - Qwest Com 6983 1679 848 227 ITCDELTA - Earthlink, Inc., US 701 1610 10658 670 UUNET - MCI Communications Services, In 7018 1483 20476 1048 ATT-INTERNET4 - AT&T Services, Inc., US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 39891 3329 169 15 ALJAWWALSTC-AS , SA 20940 2871 1079 2043 AKAMAI-ASN1 , US 34984 1987 326 358 TELLCOM-AS , TR 13188 1623 99 59 TRIOLAN , UA 12479 1376 1018 49 UNI2-AS , ES 8551 1204 377 46 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 6849 1142 355 21 UKRTELNET , UA 8402 1113 544 15 CORBINA-AS Russia, RU 12389 950 1135 422 ROSTELECOM-AS , RU 6830 862 2755 463 LGI-UPC formerly known as UPC Broadband Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 10620 3506 541 191 Telmex Colombia S.A., CO 8151 2286 3358 553 Uninet S.A. de C.V., MX 7303 1541 964 248 Telecom Argentina S.A., AR 6503 1444 437 54 Axtel, S.A.B. de C.V., MX 11830 1325 367 58 Instituto Costarricense de Electricidad 6147 1235 377 28 Telefonica del Peru S.A.A., PE 7738 1018 1882 40 Telemar Norte Leste S.A., BR 28573 1007 2264 166 CLARO S.A., BR 3816 978 473 195 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 11172 906 126 76 Alestra, S. de R.L. de C.V., MX Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1185 402 50 LINKdotNET-AS, EG 36903 680 342 128 MT-MPLS, MA 37611 672 67 6 Afrihost, ZA 36992 566 1373 25 ETISALAT-MISR, EG 8452 513 1472 15 TE-AS TE-AS, EG 37492 386 250 69 ORANGE-TN, TN 29571 364 37 12 CITelecom-AS, CI 24835 313 560 19 RAYA-AS, EG 15399 307 35 6 WANANCHI-KE, KE 2018 269 327 74 TENET-1, ZA Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5540 4190 74 ERX-CERNET-BKB China Education and Rese 7545 3584 382 248 TPG-INTERNET-AP TPG Telecom Limited, AU 22773 3550 2965 146 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 10620 3506 541 191 Telmex Colombia S.A., CO 39891 3329 169 15 ALJAWWALSTC-AS , SA 6327 2986 1333 83 SHAW - Shaw Communications Inc., CA 17974 2958 905 71 TELKOMNET-AS2-AP PT Telekomunikasi Indo 20940 2871 1079 2043 AKAMAI-ASN1 , US 9829 2694 1497 530 BSNL-NIB National Internet Backbone, IN 4766 2692 11132 739 KIXS-AS-KR Korea Telecom, KR Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 22773 3550 3404 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 7545 3584 3336 TPG-INTERNET-AP TPG Telecom Limited, AU 10620 3506 3315 Telmex Colombia S.A., CO 39891 3329 3314 ALJAWWALSTC-AS , SA 6327 2986 2903 SHAW - Shaw Communications Inc., CA 17974 2958 2887 TELKOMNET-AS2-AP PT Telekomunikasi Indo 9808 2231 2189 CMNET-GD Guangdong Mobile Communication 9829 2694 2164 BSNL-NIB National Internet Backbone, IN 18566 2197 2087 MEGAPATH5-US - MegaPath Corporation, US 6389 2095 2056 BELLSOUTH-NET-BLK - BellSouth.net Inc., Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 65001 PRIVATE 5.143.176.0/20 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.192.0/20 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.192.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.200.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.208.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.216.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65000 PRIVATE 31.219.177.0/25 8966 ETISALAT-AS P.O. Box 1150, Dub 65000 PRIVATE 31.219.177.128/25 8966 ETISALAT-AS P.O. Box 1150, Dub 64855 PRIVATE 41.220.200.0/21 36945 mcelISP, MZ 65001 PRIVATE 46.237.32.0/20 13118 ASN-YARTELECOM PJSC Rostelecom Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 27.100.7.0/24 56096 UNKNOWN 41.73.1.0/24 37004 -Reserved AS-, ZZ 41.73.2.0/24 37004 -Reserved AS-, ZZ 41.73.3.0/24 37004 -Reserved AS-, ZZ 41.73.4.0/24 37004 -Reserved AS-, ZZ 41.73.5.0/24 37004 -Reserved AS-, ZZ 41.73.6.0/24 37004 -Reserved AS-, ZZ 41.73.7.0/24 37004 -Reserved AS-, ZZ 41.73.8.0/24 37004 -Reserved AS-, ZZ 41.73.9.0/24 37004 -Reserved AS-, ZZ Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:13 /10:36 /11:102 /12:273 /13:522 /14:1048 /15:1781 /16:13144 /17:7835 /18:12976 /19:25476 /20:38773 /21:40443 /22:71412 /23:60071 /24:343970 /25:451 /26:345 /27:293 /28:58 /29:34 /30:14 /31:1 /32:32 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 39891 2896 3329 ALJAWWALSTC-AS , SA 6327 2782 2986 SHAW - Shaw Communications Inc., CA 22773 2770 3550 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 18566 2089 2197 MEGAPATH5-US - MegaPath Corporation, US 30036 1582 1767 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 10620 1433 3506 Telmex Colombia S.A., CO 6389 1393 2095 BELLSOUTH-NET-BLK - BellSouth.net Inc., 13188 1362 1623 TRIOLAN , UA 6983 1325 1679 ITCDELTA - Earthlink, Inc., US 34984 1272 1987 TELLCOM-AS , TR Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1541 2:800 4:23 5:2239 6:32 8:992 12:1805 13:50 14:1743 15:46 16:2 17:100 18:126 20:48 23:1876 24:1807 27:2355 31:1795 32:83 33:4 35:3 36:330 37:2388 38:1280 39:34 40:101 41:2985 42:463 43:1881 44:48 45:2212 46:2624 47:104 49:1214 50:928 51:14 52:557 53:2 54:351 55:7 56:4 57:40 58:1578 59:995 60:378 61:1837 62:1525 63:1936 64:4580 65:2175 66:4329 67:2255 68:1145 69:3303 70:1292 71:563 72:2078 74:2592 75:404 76:416 77:1428 78:1301 79:909 80:1309 81:1405 82:985 83:706 84:893 85:1590 86:479 87:1125 88:560 89:2053 90:222 91:6121 92:934 93:2360 94:2401 95:2487 96:555 97:345 98:945 99:89 100:147 101:1171 103:12713 104:2545 105:129 106:450 107:1432 108:777 109:2505 110:1277 111:1644 112:1128 113:1142 114:1091 115:1688 116:1672 117:1550 118:2070 119:1568 120:953 121:1075 122:2264 123:2030 124:1576 125:1822 128:693 129:451 130:415 131:1371 132:610 133:175 134:512 135:200 136:400 137:395 138:1799 139:435 140:598 141:453 142:676 143:928 144:734 145:166 146:949 147:660 148:1379 149:535 150:655 151:885 152:685 153:302 154:693 155:937 156:534 157:536 158:410 159:1273 160:555 161:721 162:2416 163:588 164:775 165:1129 166:348 167:1199 168:2317 169:671 170:2224 171:252 172:778 173:1810 174:768 175:667 176:1728 177:4145 178:2354 179:1197 180:2158 181:1929 182:2097 183:1006 184:826 185:7755 186:3251 187:2168 188:2226 189:1763 190:7859 191:1325 192:9100 193:5749 194:4479 195:3840 196:1811 197:1263 198:5604 199:5833 200:7168 201:3740 202:10155 203:9848 204:4504 205:2757 206:2997 207:3097 208:3993 209:3885 210:3873 211:2042 212:2749 213:2359 214:878 215:68 216:5738 217:1974 218:820 219:598 220:1643 221:878 222:708 223:1331 End of report

1 0

Should abuse mailboxes have quotas?
by Stephen Satchell 28 Oct '16

28 Oct '16

For the last couple of weeks, every single abuse mail I've tried to send to networks in a very short list of countries has bounced back with "mailbox exceeds quota". I take this to mean that there isn't someone actively reading, acting on, and deleting e-mail from abuse@<whomever>. So my new rule is this: bounce an abuse e-mail message, sent to an abuse address announced for the netrange, and the ENTIRE NETRANGE gets put in my "reject forever" firewall. I've ask all my customers about this action, and all agree that it's reasonable, because an administration with an active abuse desk shouldn't ever have their abuse mailbox overflow. (Especially in this day of terabyte disks.) Or they need more people on their abuse desk. Or they need to eliminate the problem that generates so many abuse e-mails that it fills up their should-be-enormous mail queue. I'm tired of blatantly uncaring administrations.

11 16

How to find all of an ISP's ASNs
by Gary Baribault 27 Oct '16

27 Oct '16

Hi folks, how to I find all ASNs that belong to an ISP? I want to block access to my IoT cameras from the world other than the two local major ISPs (keeping last Friday in mind!) Gary B

8 8

CenturyLink in Advanced Talks to Merge With Level 3 Communications - Interweb is doomed
by Nevin Gonsalves 27 Oct '16

27 Oct '16

:-) http://www.wsj.com/articles/centurylink-in-advanced-talks-to-merge-with-lev… thanks,-nevin

1 0

Re: Death of the Internet, Film at 11
by Larry Sheldon 26 Oct '16

26 Oct '16

On 10/25/2016 08:26, Rich Kulawiec wrote: > On Fri, Oct 21, 2016 at 10:53:42PM -0700, Ronald F. Guilmette wrote: >> Recent events, like the Krebs DDoS and the even bigger OVH DDoS, and >> today's events make it perfectly clear to even the most blithering of >> blithering idiots that network operators, en mass, have to start scanning >> their own networks for insecurities. > > And start monitoring their own networks for *outbound* attacks. Too many > people focus exclusively on inbound attacks, never realizing that every > attack inbound to them is outbound from somewhere else. What is it? 20 years? since the first time I was banned from NANOG for saying that the world would be a nicer place if EVERY true router refused to forward a packet whose SOURCE could not be reached from the port question. (May not be stated clearly, but idea seems simple enough: If the proposed ICMP message would not be routed to the port the packet came from, the best plan is probably to log the event and drop the ICMP and the rogue packet on the floor.) -- "Everybody is a genius. But if you judge a fish by its ability to climb a tree, it will live its whole life believing that it is stupid." --Albert Einstein From Larry's Cox account.

2 1

Other name resolution impacts, as by-products of the Dyn event (e.g. recursive queries limit reached)
by Stefan 25 Oct '16

25 Oct '16

Have not seen any mentions yet, so thought of asking here: has anybody paid attention to other name resolution issues, even outside the Dyn hosted services directly sourced ones? I am talking about what we observed, as result of: https://community.infoblox.com/t5/Support-Central/Support-Central-KB-118-Wh… i.e. "active queue" filled with the Dyn caused event, but leaving thusly no "room", at times, for valid recursive queries, inclusive of internal name resolution, where the SOA sits in another tier (e.g. GSLBs). One possible mitigation for such scenarios is: https://community.infoblox.com/t5/Support-Central/Support-Central-KB-3451-C… Any other related events, on other platforms or configurations? ***Stefan

1 0

Dyn DDoS this AM?
by Chris Grundemann 25 Oct '16

25 Oct '16

Does anyone have any additional details? Seems to be over now, but I'm very curious about the specifics of such a highly impactful attack (and it's timing following NANOG 68)... https://krebsonsecurity.com/2016/10/ddos-on-dyn-impacts-twitter-spotify-red… -- @ChrisGrundemann http://chrisgrundemann.com

41 55

Internal vulnerability hosts scan to prevent DDOS
by marcel.duregards＠yahoo.fr 25 Oct '16

25 Oct '16

Dear members, We are a small tier-2 isp and we would like to monitor any potentials risks at our customers ip (we do not want that our AS could be used as a source for DDOS). One of many measures is to scan, on a regular basis, all our IP (PI and PA) to detect any misconfigured customers hosts which could be used for DDOS. The scan should be able to detect misconfigured ddns resolver, ntp server, ssdp host, etc...and any future cool reflection protocol. If any misconfigured hosts is detected, an alarm should raise on an dashboard, and an email send to the customers contact (RIR info), and to our noc. Radar from qrator provide a similar service via email, but we need our own server/VM, with customizables features (like email in differents languages, recall management, acknowledgement request, history (some customers do not take any actions when we inform them, so we would like to have history to put pressure on them)). Does anybody have a solution for that ? Thank in advance for your input. Best regards, -- Marcel

1 0

Fwd: [apops] APRICOT 2017 Call for Presentations
by Mark Tinka 25 Oct '16

25 Oct '16

FYI. Mark. -------- Forwarded Message -------- Subject: [apops] APRICOT 2017 Call for Presentations Date: Mon, 17 Oct 2016 17:34:19 +0600 From: Philip Smith <pfsinoz(a)gmail.com> To: apops(a)apops.net Hi everyone, Asia Pacific Regional Internet Conference on Operational Technologies (APRICOT) 27th February - 2nd March 2017, Ho Chi Minh City, Vietnam https://2017.apricot.net CALL FOR PAPERS =============== The APRICOT 2017 Programme Committee is now seeking contributions for Presentations and Tutorials for the APRICOT 2017 Conference. We are looking for presenters who would: - Offer a technical tutorial on an appropriate topic; - Participate in the technical conference sessions as a speaker; - Convene and chair panel sessions of relevant topics. Please submit on-line at: http://papers.apricot.net/user/login.php?event=48 CONFERENCE MILESTONES --------------------- Call for Papers Opens: Now Draft Program Published: As Papers Confirmed Final Deadline for Submissions: 30 January 2016 Final Program Published: 6 February 2017 Final Slides Received: 13 February 2017 *NOTE THAT REGARDLESS OF DEADLINES SLOTS ARE FILLED ON A FIRST COME, FIRST SERVED BASIS* PROGRAMME MATERIAL ------------------ The APRICOT Conference Programme consists of three parts, these being the Peering Forum, Tutorials, and Conference Tracks. Topics proposed must be relevant to Internet Operations and Technologies: - IPv4 / IPv6 Routing and operations - IPv6 deployment and transition technologies - Internet backbone operations - ISP and Carrier services - IXPs and Peering - Research on Internet Operations and Deployment - Software Defined Networking / Network Function Virtualisaton - Network security issues (NSP-SEC, DDoS, Anti-Spam, Anti-Malware) - DNS / DNSSEC - Internet policy (Security, Regulation, Content Management, Addressing, etc) - Access and Transport Technologies, including Cable/DSL, 3G/LTE, wireless, metro ethernet, fibre, MPLS - Content & Service Delivery (Multicast, Voice, Video, "telepresence", Gaming) and Cloud Computing CfP SUBMISSION -------------- Draft slides for both tutorials and conference sessions MUST be provided with CfP submissions otherwise the Programme Committee will be unable to review the submission. For avoidance of doubt this means that submissions which do not include slides will be rejected immediately. For work in progress, the most current information available at time of submission is acceptable. All draft and complete slides must be submitted in PDF format only. Final slides are to be provided by the specified deadline for publication on the APRICOT website. Prospective presenters should note that the majority of speaking slots will be filled well before the final submission deadline. The PC may, at their discretion, retain a limited number of slots up to the final submission deadline for presentations that are exceptionally timely, important, or of critical operational importance. Every year we turn away submissions, due to filling up all available programme slots before the deadline. Presenters should endeavour to get material into the PC sooner rather than later. Any questions or concerns should be addressed to the Programme Committee by e-mail at: pc-chairs at apricot.net We look forward to receiving your presentation proposals. Mark Tinka & Philip Smith Co-Chairs, APRICOT 2017 Programme Committee -- _______________________________________________ apops mailing list apops(a)apops.net https://mailman.apnic.net/mailman/listinfo/apops Website: www.apops.net .

1 0

Any Google Cloud people on the list?
by Eric Dugas 24 Oct '16

24 Oct '16

Any Google Cloud people or people really used to work with GC/GCI on the list? Please contact me off-list Thanks Eric ![](https://link.nylas.com/open/4sk3yzfka4ymj01d79p0ldahw/local- f01e8d07-1e4e?r=bmFub2dAbmFub2cub3Jn)

1 0