- NANOG - lists.nanog.org

Spoofer Report for NANOG for Jul 2023
by CAIDA Spoofer Project 08 Aug '23

08 Aug '23

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Jul 2023: ASN Name Fixed-By 54825 PACKET 2023-07-02 6128 CABLE-NET-1 2023-07-03 6124 MARIST 2023-07-06 14576 HOSTING-SOLUTIONS 2023-07-16 394233 CLOUDWIFI 2023-07-21 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Jul 2023: ASN Name First-Spoofed Last-Spoofed 3356 LEVEL3 2016-03-06 2023-07-14 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2023-07-27 20412 CLARITY-TELECOM 2016-09-30 2023-07-31 25787 ROWE-NETWORKS 2016-10-21 2023-07-28 11427 TWC-11427-TEXAS 2016-10-21 2023-07-25 10796 TWC-10796-MIDWEST 2016-10-24 2023-07-30 271 BCNET 2016-10-24 2023-07-29 852 ASN852 2017-04-16 2023-07-31 53274 3DB-WIRELESS 2019-01-18 2023-07-05 46997 2021-12-22 2023-07-27 394414 E2WS 2022-05-08 2023-07-26 397086 GLOBAL-FRAG-NETWORKS-HOUSTON 2022-06-16 2023-07-25 400517 2022-10-03 2023-07-10 12183 TALKIE-COMMUNICATIONS 2022-12-10 2023-07-21 964 GONET-ASN-17 2023-03-15 2023-07-07 41378 KirinoNET 2023-03-23 2023-07-28 3701 NERONET 2023-04-18 2023-07-26 400282 2023-04-27 2023-07-28 13693 NTS-ONLINE 2023-05-05 2023-07-29 46690 SNET-FCC 2023-05-20 2023-07-29 200063 CAMINI-IMPEX 2023-06-16 2023-07-21 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

Fwd: NTP Sync Issue Across Tata (Europe)
by Mel Beckman 06 Aug '23

06 Aug '23

Or one can read recent research papers that thoroughly document the incredible fragility of the existing NTP hierarchy and soberly consider their recommendations for remediation: https://www.ndss-symposium.org/wp-content/uploads/ndss2021_1A-2_24302_paper… Or simply use non-Internet NTP servers based on a Stratum-0 GPS source for mission-critical network timing. Until then, we may all wake up one morning and discover massive data breaches traced to an unfounded reliance on insecure public NTP servers. Then the game truly will be over, but not in our favor. -mel On Aug 6, 2023, at 2:35 PM, Rubens Kuhl <rubensk(a)gmail.com> wrote: Or one can select NTS-capable NTP servers, like those 5: a.st1.ntp.br b.st1.ntp.br c.st1.ntp.br d.st1.ntp.br gps.ntp.br Or any other NTP server that has NTS deployed. Game-over for NTP impersonation. Rubens On Sun, Aug 6, 2023 at 4:41 PM Mel Beckman <mel(a)beckman.org> wrote: In a nutshell, no. Refer to my prior cites for detailed explanations. For a list of real-world attack incidents, see https://en.m.wikipedia.org/wiki/NTP_server_misuse_and_abuse# -mel On Aug 6, 2023, at 12:03 PM, Royce Williams <royce(a)techsolvency.com> wrote: Naively, instead of abstaining ;) ... isn't robust diversity of NTP peering a reasonable mitigation for this, as designed? Royce On Sun, Aug 6, 2023 at 10:21 AM Mel Beckman <mel(a)beckman.org> wrote: William, Due to flaws in the NTP protocol, a simple UDP filter is not enough. These flaws make it trivial to spoof NTP packets, and many firewalls have no specific protection against this. in one attack the malefactor simply fires a continuous stream of NTP packets with invalid time at your firewall. When your NTP client queries the spoofed server, the malicious packet is the one you likely receive. That’s just one attack vector. There are several others, and all have complex remediation. Why should people bother being exposed to the risk at all? Simply avoid Internet-routed NTP. there are many solutions, as I’ve already described. Having suffered through such attacks more than once, I can say from personal experience that you don’t want to risk it.

1 0

Re: NTP Sync Issue Across Tata (Europe)
by Rubens Kuhl 06 Aug '23

06 Aug '23

The paper suggests the compromise of critical infrastructure. So, besides not using NTP, why not stop using DNS ? Just populate a hosts file with all you need. BTW, the stratum-0 source you suggested is known to have been manipulated in the past (https://www.gps.gov/systems/gps/modernization/sa/) so you need to bet on that specific state actor not returning to old habits. OTOH, 4 of the 5 servers I suggested have their own atomic clock, and you can keep using GPS as well. If GPS goes bananas on timing, that source will just be disregarded (one of the features of the NTP architecture that has been pointed out over and over in this thread and you keep ignoring it). Rubens Rubens On Sun, Aug 6, 2023 at 8:20 PM Mel Beckman <mel(a)beckman.org> wrote: > Or one can read recent research papers that thoroughly document the > incredible fragility of the existing NTP hierarchy and soberly consider > their recommendations for remediation: > > [image: preview.png] > > ndss2021_1A-2_24302_paper > <https://www.ndss-symposium.org/wp-content/uploads/ndss2021_1A-2_24302_paper…> > PDF Document · 1.7 MB > <https://www.ndss-symposium.org/wp-content/uploads/ndss2021_1A-2_24302_paper…> > > <https://www.ndss-symposium.org/wp-content/uploads/ndss2021_1A-2_24302_paper…> > > Or simply use non-Internet NTP servers based on a Stratum-0 GPS source for > mission-critical network timing. > > Until then, we may all wake up one morning and discover massive data > breaches traced to an unfounded reliance on insecure public NTP servers. > Then the game truly will be over, but not in our favor. > > -mel > > On Aug 6, 2023, at 2:35 PM, Rubens Kuhl <rubensk(a)gmail.com> wrote: > > Or one can select NTS-capable NTP servers, like those 5: > a.st1.ntp.br > b.st1.ntp.br > c.st1.ntp.br > d.st1.ntp.br > gps.ntp.br > > Or any other NTP server that has NTS deployed. Game-over for NTP > impersonation. > > > Rubens > > On Sun, Aug 6, 2023 at 4:41 PM Mel Beckman <mel(a)beckman.org> wrote: > > > In a nutshell, no. Refer to my prior cites for detailed explanations. For > a list of real-world attack incidents, see > > > https://en.m.wikipedia.org/wiki/NTP_server_misuse_and_abuse# > > > > -mel > > > On Aug 6, 2023, at 12:03 PM, Royce Williams <royce(a)techsolvency.com> > wrote: > > > > > Naively, instead of abstaining ;) ... isn't robust diversity of NTP > peering a reasonable mitigation for this, as designed? > > > Royce > > > On Sun, Aug 6, 2023 at 10:21 AM Mel Beckman <mel(a)beckman.org> wrote: > > > William, > > > Due to flaws in the NTP protocol, a simple UDP filter is not enough. These > flaws make it trivial to spoof NTP packets, and many firewalls have no > specific protection against this. in one attack the malefactor simply fires > a continuous stream of NTP packets with invalid time at your firewall. When > your NTP client queries the spoofed server, the malicious packet is the one > you likely receive. > > > That’s just one attack vector. There are several others, and all have > complex remediation. Why should people bother being exposed to the risk at > all? Simply avoid Internet-routed NTP. there are many solutions, as I’ve > already described. Having suffered through such attacks more than once, I > can say from personal experience that you don’t want to risk it. > > >

1 0

SMS Email Gateway - sms.myboostmobile.com discontinued
by Matthew McGehrin 06 Aug '23

06 Aug '23

Hello. For the past few weeks I have been noticing that various emails were bouncing when sending to sms.myboostmobile.com, which has been a reliable SMS gateway for 10+ years. I contacted "Advanced Support" on Saturday who said that Boost Mobile has discontinued their SMS Email Gateway after the DISH merger. Just a heads up if you have any SMS email gateways being used that you should also periodically test them, to ensure they are still active. Matthew

2 1

Re: NTP Sync Issue Across Tata (Europe)
by Mel Beckman 06 Aug '23

06 Aug '23

Niels, You’re the first person to mention neutral collocation facilities as a requirement. The OP only talked about servers generally. Obviously, building your own GPS-based NTP network requires you have visibility to the sky. However, that need not be rooftop access. We routinely locate GPS antennae for time synch at CLEC colos in an available window, behind the glass. Nobody has yet charged us anything more than a one-time cabling fee for that. But most carrier-neutral colos already have their own GPS-derived, non-Internet time source to which you can subscribe. There is thus no reason to build your own airgapped network, as one is already available from the facility. If you don’t need PTP 50-μs-precise timing for SONET and whatnot, ordinary NTP is very cost effective. For example: <https://docs.equinix.com/en-us/Content/Edge-Services/EPT/EPT.htm> About Equinix Precision Time<https://docs.equinix.com/en-us/Content/Edge-Services/EPT/EPT.htm> docs.equinix.com<https://docs.equinix.com/en-us/Content/Edge-Services/EPT/EPT.htm> [favicon-16x16.png]<https://docs.equinix.com/en-us/Content/Edge-Services/EPT/EPT.htm> Most colos also offer their own Stratum-1 public NTP servers for free. For example, Hurricane Electric (https://www.he.net/adm/ntp.html) Being you’re already on-net in the colo, that would still give you NTP that doesn’t transit the Internet. Still way better than pool.ntp.org! -mel On Aug 6, 2023, at 4:53 AM, Niels Bakker <niels=nanog(a)bakker.net> wrote: * mel(a)beckman.org (Mel Beckman) [Sun 06 Aug 2023, 04:26 CEST]: if you can eliminate such security problems for $400, I say it’s cheap at twice the price. You must be unfamiliar with the prices neutral colocation facilities charge for roof access. -- Niels.

1 0

Call for Presentations EPF 2023, Prage, Czech Republic // NANOG
by Arnold Nipper 04 Aug '23

04 Aug '23

Dear all, this is the Call for Presentations for the European Peering Forum 2023. AMS-IX, DE-CIX, LINX, NETNOD and guest IXP NIX.CZ, are happy to host the European Peering Forum (EPF) 2023 from Sunday the 10th to Wednesday 13th September 2023 in Prague, Czech Republic. The event will welcome peering managers and coordinators from networks connected to the host and guest Internet exchanges. Besides some interesting topical agenda, the three-day event accommodates room for attendees to meet on a one-to-one basis to discuss bilateral peering business opportunities. The programme committee will be looking for presentations and related to peering and technical topics of interconnection. Your presentation should address: * Interconnection Automation * Regional Peering * Interconnection / Peering Internet Governance and Regulatory Topics * Economic and Product Trends * Peering / Interconnection strategies * Interesting findings about Peering / Interconnection * 400GE and beyond * Any other hot topic related to Interconnection / Peering Submissions =========== Presentations must be of a non-commercial nature. Product or marketing heavy talks are strongly discouraged. Submissions of presentations should be made to the programme committee <epf-pc(a)peering-forum.eu>. Please include: * Author's name and e-mail address * Presentation title * Abstract * Slides (if available) * Time requested (max. 30 minutes incl. Q&A) Deadlines ========= Please send in your presentation asap. We decide on a first come first serve basis. The latest date for submission is July 30th, 2023. More information about the event and other activities around EPF16 may be found at * https://peering-forum.eu/2023/ * https://www.facebook.com/groups/1486607564933665/ On behalf of EPF, Best regards, AMS-IX, DE-CIX, LINX and NETNOD -- Keep calm, keep distance, keep connected! Arnold Nipper email: arnold(a)nipper.de mobile: +49 172 2650958

1 1

Weekly Global IPv4 Routing Table Report
by Routing Table Analysis Role Account 04 Aug '23

04 Aug '23

This is an automated weekly mailing describing the state of the Global IPv4 Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net. For historical data, please see https://thyme.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. IPv4 Routing Table Report 04:00 +10GMT Sat 05 Aug, 2023 BGP Table (Global) as seen in Japan. Report Website: https://thyme.apnic.net Detailed Analysis: https://thyme.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 927714 Prefixes after maximum aggregation (per Origin AS): 351711 Deaggregation factor: 2.64 Unique aggregates announced (without unneeded subnets): 452501 Total ASes present in the Internet Routing Table: 74648 Prefixes per ASN: 12.43 Origin-only ASes present in the Internet Routing Table: 64103 Origin ASes announcing only one prefix: 26307 Transit ASes present in the Internet Routing Table: 10545 Transit-only ASes present in the Internet Routing Table: 461 Average AS path length visible in the Internet Routing Table: 4.2 Max AS path length visible: 68 Max AS path prepend of ASN (263725) 64 Prefixes from unregistered ASNs in the Routing Table: 1058 Number of instances of unregistered ASNs: 1060 Number of 32-bit ASNs allocated by the RIRs: 42376 Number of 32-bit ASNs visible in the Routing Table: 34895 Prefixes from 32-bit ASNs in the Routing Table: 174016 Number of bogon 32-bit ASNs visible in the Routing Table: 33 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 580 Number of addresses announced to Internet: 3053861632 Equivalent to 182 /8s, 6 /16s and 59 /24s Percentage of available address space announced: 82.5 Percentage of allocated address space announced: 82.5 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.6 Total number of prefixes smaller than registry allocations: 309205 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 246446 Total APNIC prefixes after maximum aggregation: 70242 APNIC Deaggregation factor: 3.51 Prefixes being announced from the APNIC address blocks: 240196 Unique aggregates announced from the APNIC address blocks: 98808 APNIC Region origin ASes present in the Internet Routing Table: 13548 APNIC Prefixes per ASN: 17.73 APNIC Region origin ASes announcing only one prefix: 4001 APNIC Region transit ASes present in the Internet Routing Table: 1779 Average APNIC Region AS path length visible: 4.5 Max APNIC Region AS path length visible: 27 Number of APNIC region 32-bit ASNs visible in the Routing Table: 8864 Number of APNIC addresses announced to Internet: 773502848 Equivalent to 46 /8s, 26 /16s and 183 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-153913 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 271941 Total ARIN prefixes after maximum aggregation: 123823 ARIN Deaggregation factor: 2.20 Prefixes being announced from the ARIN address blocks: 274002 Unique aggregates announced from the ARIN address blocks: 130924 ARIN Region origin ASes present in the Internet Routing Table: 19093 ARIN Prefixes per ASN: 14.35 ARIN Region origin ASes announcing only one prefix: 6963 ARIN Region transit ASes present in the Internet Routing Table: 1958 Average ARIN Region AS path length visible: 3.7 Max ARIN Region AS path length visible: 24 Number of ARIN region 32-bit ASNs visible in the Routing Table: 4818 Number of ARIN addresses announced to Internet: 1277299200 Equivalent to 76 /8s, 34 /16s and 10 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-401308 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 259952 Total RIPE prefixes after maximum aggregation: 122501 RIPE Deaggregation factor: 2.12 Prefixes being announced from the RIPE address blocks: 256839 Unique aggregates announced from the RIPE address blocks: 159899 RIPE Region origin ASes present in the Internet Routing Table: 28387 RIPE Prefixes per ASN: 9.05 RIPE Region origin ASes announcing only one prefix: 12061 RIPE Region transit ASes present in the Internet Routing Table: 3943 Average RIPE Region AS path length visible: 4.3 Max RIPE Region AS path length visible: 34 Number of RIPE region 32-bit ASNs visible in the Routing Table: 11290 Number of RIPE addresses announced to Internet: 716523648 Equivalent to 42 /8s, 181 /16s and 72 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-213403 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 118592 Total LACNIC prefixes after maximum aggregation: 28503 LACNIC Deaggregation factor: 4.16 Prefixes being announced from the LACNIC address blocks: 117714 Unique aggregates announced from the LACNIC address blocks: 49677 LACNIC Region origin ASes present in the Internet Routing Table: 10999 LACNIC Prefixes per ASN: 10.70 LACNIC Region origin ASes announcing only one prefix: 2663 LACNIC Region transit ASes present in the Internet Routing Table: 2330 Average LACNIC Region AS path length visible: 4.9 Max LACNIC Region AS path length visible: 68 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 8809 Number of LACNIC addresses announced to Internet: 178518272 Equivalent to 10 /8s, 163 /16s and 249 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-273820 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 29725 Total AfriNIC prefixes after maximum aggregation: 5923 AfriNIC Deaggregation factor: 5.02 Prefixes being announced from the AfriNIC address blocks: 38383 Unique aggregates announced from the AfriNIC address blocks: 12707 AfriNIC Region origin ASes present in the Internet Routing Table: 1768 AfriNIC Prefixes per ASN: 21.71 AfriNIC Region origin ASes announcing only one prefix: 619 AfriNIC Region transit ASes present in the Internet Routing Table: 330 Average AfriNIC Region AS path length visible: 4.9 Max AfriNIC Region AS path length visible: 40 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 1114 Number of AfriNIC addresses announced to Internet: 107623168 Equivalent to 6 /8s, 106 /16s and 51 /24s AfriNIC AS Blocks 36864-37887, 327680-329727 & ERX transfers AfriNIC Address Blocks 41/8, 45/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 9808 9529 8706 40 CHINAMOBILE-CN China Mobile Communicati 7545 5692 784 689 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4852 4192 75 ERX-CERNET-BKB China Education and Rese 18403 4247 347 25 FPT-AS-AP FPT Telecom Company, VN 7713 3588 1043 63 TELKOMNET-AS-AP PT Telekomunikasi Indon 45899 3354 1840 97 VNPT-AS-VN VNPT Corp, VN 7552 3337 1331 21 VIETEL-AS-AP Viettel Group, VN 9498 3059 498 247 BBIL-AP BHARTI Airtel Ltd., IN 4766 2559 11271 592 KIXS-AS-KR Korea Telecom, KR 24560 2472 839 427 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd Complete listing at https://thyme.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 16509 8863 10943 3166 AMAZON-02, US 11492 4522 300 622 CABLEONE, US 7155 4194 288 101 VIASAT-SP-BACKBONE, US 22773 3534 3051 269 ASN-CXA-ALL-CCI-22773-RDC, US 6327 3527 1319 66 SHAW, CA 749 3150 54961 2402 DNIC-AS-00749, US 16625 3076 1510 2322 AKAMAI-AS, US 367 2967 3825 1397 DNIC-ASBLK-00306-00371, US 396982 2684 3596 388 GOOGLE-CLOUD-PLATFORM, US 30036 2510 359 371 MEDIACOM-ENTERPRISE-BUSINESS, US Complete listing at https://thyme.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 7323 1707 142 UNI2-AS, ES 39891 4897 290 61 ALJAWWALSTC-AS, SA 20940 4078 3398 158 AKAMAI-ASN1, NL 8551 3452 368 33 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 12389 2973 2294 914 ROSTELECOM-AS, RU 9009 2658 246 1389 M247, RO 34984 2317 362 602 TELLCOM-AS, TR 58224 1815 944 536 TCI, IR 13188 1606 100 27 TRIOLAN, UA 6849 1604 307 17 UKRTELNET, UA Complete listing at https://thyme.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 11599 3371 601 UNINET, MX 10620 3535 507 828 Telmex Colombia S.A., CO 13999 2423 362 635 Mega Cable, S.A. de C.V., MX 11830 1997 369 64 Instituto Costarricense de Electricidad 28573 1316 2324 234 Claro NXT Telecomunicacoes Ltda, BR 3816 1301 767 167 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 6503 1299 344 510 Axtel, S.A.B. de C.V., MX 6147 1123 370 22 Telefonica del Peru S.A.A., PE 11664 1113 181 435 Techtel LMDS Comunicaciones Interactiva 26615 1037 2500 48 TIM SA, BR Complete listing at https://thyme.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1587 393 19 LINKdotNET-AS, EG 24835 1517 533 27 RAYA-AS, EG 36992 1356 1518 282 ETISALAT-MISR, EG 36903 1242 550 99 MT-MPLS, MA 29571 1051 67 45 ORANGE-COTE-IVOIRE, CI 36935 922 521 43 Vodafone-, EG 6713 550 1861 34 IAM-AS, MA 37342 498 32 1 MOVITEL, MZ 15399 459 55 50 WANANCHI-, KE 24757 440 73 5 EthioNet-AS, ET Complete listing at https://thyme.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 11599 3371 601 UNINET, MX 9808 9529 8706 40 CHINAMOBILE-CN China Mobile Communicati 16509 8863 10943 3166 AMAZON-02, US 12479 7323 1707 142 UNI2-AS, ES 7545 5692 784 689 TPG-INTERNET-AP TPG Telecom Limited, AU 39891 4897 290 61 ALJAWWALSTC-AS, SA 4538 4852 4192 75 ERX-CERNET-BKB China Education and Rese 11492 4522 300 622 CABLEONE, US 18403 4247 347 25 FPT-AS-AP FPT Telecom Company, VN 7155 4194 288 101 VIASAT-SP-BACKBONE, US Complete listing at https://thyme.apnic.net/current/data-ASnet Global Per AS Maximum Aggregation summary ----------------------------------------- ASN No of nets Net Savings Description 9808 9529 9489 CHINAMOBILE-CN China Mobile Communications Grou 12479 7323 7181 UNI2-AS, ES 16509 8863 5697 AMAZON-02, US 7545 5692 5003 TPG-INTERNET-AP TPG Telecom Limited, AU 39891 4897 4836 ALJAWWALSTC-AS, SA 4538 4852 4777 ERX-CERNET-BKB China Education and Research Net 18403 4247 4222 FPT-AS-AP FPT Telecom Company, VN 7155 4194 4093 VIASAT-SP-BACKBONE, US 20940 4078 3920 AKAMAI-ASN1, NL 11492 4522 3900 CABLEONE, US Complete listing at https://thyme.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Net Originated Transit AS Transit AS Name 33492 UNALLOCATED 8.6.184.0/23 33650 COMCAST-33650, US 33123 UNALLOCATED 8.10.69.0/24 11168 SCC, US 12169 UNALLOCATED 8.15.207.0/24 32787 PROLEXIC-TECHNOLOGIES-DDOS-M 53775 UNALLOCATED 8.20.88.0/24 7029 WINDSTREAM, US 19695 UNALLOCATED 8.20.161.0/24 7015 COMCAST-7015, US 62828 UNALLOCATED 8.21.130.0/24 3356 LEVEL3, US 393266 UNALLOCATED 8.23.52.0/24 46887 LIGHTOWER, US 396894 UNALLOCATED 8.28.201.0/24 46887 LIGHTOWER, US 394936 UNALLOCATED 8.33.224.0/24 22442 HOU-PHONOSCOPE, US 54338 UNALLOCATED 8.33.241.0/24 6461 ZAYO-6461, US Complete listing at https://thyme.apnic.net/current/data-badAS Prefixes from the Special Purpose Address Registry (Global) ----------------------------------------------------------- Prefix Origin AS Description 192.88.99.0/24 6939 HURRICANE, US Complete listing at https://thyme.apnic.net/current/data-spar Advertised Unallocated Addresses -------------------------------- Unassigned Network ASN Information AS Name 23.140.216.0/24 Origin: 27176 DATAWAGON, US 23.140.216.0/24 Transit: 20278 NEXEON, US 23.141.0.0/24 Origin: 395350 UNASSIGNED 23.141.0.0/24 Transit: 11426 TWC-11426-CAROLINAS, US 23.176.160.0/24 Origin: 397327 UNASSIGNED 23.176.160.0/24 Transit: 19108 SUDDENLINK-COMMUNICATIONS, US 27.100.7.0/24 Origin: 56096 UNASSIGNED 27.100.7.0/24 Transit: 45455 TH-2S1N-AP Two S One N Co Ltd, Internet 41.57.124.0/22 Origin: 37442 UNASSIGNED 41.57.124.0/22 Transit: 37204 TELONE, ZW Complete listing at https://thyme.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:14 /10:39 /11:102 /12:296 /13:575 /14:1197 /15:2071 /16:13487 /17:8274 /18:13868 /19:25172 /20:44383 /21:51499 /22:110131 /23:98935 /24:556908 /25:747 /26:0 /27:0 /28:0 /29:0 /30:0 /31:0 /32:0 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 6412 7323 UNI2-AS, ES 8151 5608 11599 UNINET, MX 39891 3632 4897 ALJAWWALSTC-AS, SA 11492 3432 4522 CABLEONE, US 6327 3337 3527 SHAW, CA 7155 3139 4194 VIASAT-SP-BACKBONE, US 8551 2921 3452 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 22773 2602 3534 ASN-CXA-ALL-CCI-22773-RDC, US 30036 2167 2510 MEDIACOM-ENTERPRISE-BUSINESS, US 10620 2094 3535 Telmex Colombia S.A., CO Complete listing at https://thyme.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:2214 2:1340 3:247 4:5 5:4508 6:133 7:6 8:1553 9:1 11:172 12:1520 13:384 14:2307 15:302 16:198 17:375 18:553 20:273 21:4 22:188 23:6379 24:2486 25:6 27:2488 29:19 31:2521 32:81 34:25 35:114 36:1992 37:4672 38:5127 39:835 40:147 41:3922 42:2038 43:2333 44:312 45:16610 46:4328 47:384 49:1787 50:1862 51:585 52:1594 54:391 55:950 56:8 57:120 58:1893 59:1172 60:992 61:2483 62:2689 63:1917 64:5574 65:2292 66:4955 67:3052 68:1321 69:4093 70:1207 71:680 72:2980 74:2615 75:1580 76:620 77:2452 78:1828 79:2973 80:2114 81:1809 82:1494 83:1277 84:1535 85:2972 86:765 87:2000 88:1173 89:3860 90:616 91:7816 92:2060 93:2588 94:3570 95:4035 96:1297 97:318 98:1147 99:735 100:95 101:1076 102:2827 103:31895 104:4572 105:565 106:888 107:2551 108:1098 109:4262 110:2118 111:3191 112:2063 113:1811 114:1656 115:1987 116:1917 117:2529 118:2667 119:1976 120:1813 121:1146 122:2585 123:2186 124:1620 125:2509 128:1459 129:1054 130:1026 131:1967 132:816 133:422 134:1794 135:306 136:898 137:961 138:2606 139:1589 140:1242 141:1293 142:1476 143:1497 144:1010 145:342 146:1960 147:1609 148:2430 149:2183 150:879 151:1168 152:1848 153:510 154:4681 155:1382 156:1877 157:1322 158:1079 159:2228 160:2593 161:1568 162:3515 163:1584 164:1717 165:1851 166:998 167:1732 168:3880 169:931 170:4600 171:881 172:3633 173:2989 174:1051 175:1192 176:3748 177:4552 178:3606 179:2163 180:2429 181:3489 182:3446 183:1993 184:2301 185:20500 186:4746 187:4108 188:4141 189:3762 190:9221 191:1396 192:10943 193:8943 194:7294 195:5176 196:3103 197:2461 198:6015 199:6096 200:7998 201:5986 202:10576 203:10059 204:4562 205:3664 206:4320 207:3447 208:4155 209:4932 210:4476 211:2534 212:4247 213:3593 214:1087 215:60 216:6734 217:2765 218:1287 219:584 220:2031 221:967 222:839 223:2193 End of report

1 0

rfc5837 in the wild?
by Saku Ytti 04 Aug '23

04 Aug '23

Does anyone have a traceroute path example where transit responds with RFC5837 EO? https://github.com/8enet/traceroute/blob/master/traceroute/extension.c#L101 Output should be '2/x: <hex>' At least JNPR seems to support this: https://www.juniper.net/documentation/us/en/software/junos/transport-ip/top… - although support may be just QFX5100, documentation is ambiguous. There is also a patch ( https://lore.kernel.org/all/6a7f33a5-13ca-e009-24ac-fde59fb1c080@gmail.com/… ) for linux, but it's not included in the kernel. -- ++ytti

1 0

Fun Facts About Your Next Meeting Destination + Call for Presentations Deadline Approaching + More
by Nanog News 03 Aug '23

03 Aug '23

*NANOG 89 to Take Place in Historic + Iconic Coronado* *Fun Facts About Your Next NANOG Meeting Destination* *NANOG's 89th community-wide meeting will occur at the "secluded waterfront oasis" of Loews Coronado Bay Resort, located off the coast of San Diego, CA, on 16 - 18 Oct.* The conference venue sits on a 15-acre peninsula, surrounding one of "the top ten beaches" in the U.S. and the magnificent San Diego skyline. *READ MORE* <https://nanog.org/stories/articles/nanog-89-to-take-place-in-historic-iconi…> *NANOG 89: Call For Presentations* *Don't Wait to Submit - Deadline Approaching Soon!* Please submit your presentation proposal, including draft slides no later than Monday, 28 Aug. *Specific talk topics include:* - Network Automation - practical uses, how to get started - Network Future - forecast for changes in technology, design, applications - Research & Education - what research is happening now in network operations - Security - developments in, problems/solutions, various protocols of - Tutorials - all levels, IPv6, BGP, Segment Routing, DNS *MORE INFO * <https://nanog.org/program/call-presentations/> *Video of the Week* *Design Driven Network Assurance w/ Jeremy Schulman - NANOG 88* *Why it's worth your time:* In this talk, Jeremy will present MLB's approach to network automation and Infrastructure as Code. This system is used to design, deploy, and validate complex multi-vendor networks with ongoing design changes. The "prime directive" focuses on validating the expected operational state. Jeremy will discuss the architectural elements and the benefits of this methodology. He will also offer a comparative analysis of traditional configuration-management IaC approaches. *WATCH NOW * <https://www.youtube.com/watch?v=lIn_Cu5vYEw> *Call For Expert Guest Blog Contributors * *Share Your Expertise With The NANOG Community * *Have something to say (in your own words)? * NANOG is looking for expert guest contributors to write in a blog-style format. We are looking for 500 to 1000 words in an area of your choice of expertise. If interested, please contact us at news(a)nanog.org.

1 0

Flapping Transport
by Mike Hammett 01 Aug '23

01 Aug '23

I have a wave transport vendor that suffered issues twice about ten days apart, causing my link to flap a bunch. I put in a ticket on the second set of occurrences. I was told that there was a card issue identified and would be notified when the replacement happened. Ticket closed. Three weeks later, I opened a new ticket asking for the status. The new card arrived the next day, but since no more flaps were happening, the card would not be replaced. Ticket closed. A) It doesn't seem like they actually did anything to fix the circuit. B) They admitted a problem and sent a new card. C) They later decided to not do anything. Is that normal? Is that acceptable? To avoid issues flapping causes, I disabled that circuit until repaired, but it seems like they're not going to do anything and I only know that because I asked. ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP

5 9