- Test - lists.nanog.org

AS3266: BitCanal hijack factory, courtesy of Cogent, GTT, and Level3
by Ronald F. Guilmette 10 Jul '18

10 Jul '18

Sometimes I see stuff that just makes me shake my head in disbelief. Here is a good example: https://bgp.he.net/AS3266#_prefixes I mean seriously, WTF? As should be blatantly self-evident to pretty much everyone who has ever looked at any of the Internet's innumeriable prior incidents of very deliberately engineered IP space hijackings, all of the routes currently being announced by AS3266 (Bitcanal, Portugal) except for the ones in 213/8 are bloody obvious hijacks. (And to their credit, even Spamhaus has a couple of the U.S. legacy /16 blocks explicitly listed as such.) That's 39 deliberately hijacked routes, at least going by the data visible on bgp.he.net. But even that data from bgp.he.net dramatically understates the case, I'm sorry to say. According to the more complete and up-to-the-minute data that I just now fetched from RIPEstat, the real number of hijacked routes is more on the order of 130 separate hijacked routes for a total of 224,512 IPv4 addresses: https://pastebin.com/raw/Jw1my9Bb In simpler terms, Bitcanal has made off with the rough equivalent of an entire /14 block of IPv4 addresses that never belonged to them. (And of course, they haven't paid a dime to anyone for any of that space.) Of couse we could all be shocked (Shocked!) at this turn of events if it were not for the fact that Bitcanal already has a rich, longstanding, and sordid history of involvement with IP space hijacks. All one has to do is google for "Bitcanal" and "hijack" to find that out. This isn't exactly a state secret. In fact if you lookup "IP space hijacking" in any modern Internet dictionary you'll find Mr. Joao Silveira's picture next to the definition: https://twitter.com/bitcanal :-) This guy Silveira has obviously decided that he is a law unto himself, and can grab whatever IP space happens to be lying around for his own purposes... and no need to fill out any tedious forms -or- pay any fees for using any of this space to any of those annoying Regional Internet Registries. As usual, and as I have said here previously, I generally don't mind too much when these kinds of greedy idiots decide to color outside the lines. As long as they just confine themselves to hijacking abandoned IP blocks belonging to banks and/or government agencies, well then it's no skin off my nose. But when they start reselling their stolen IP space to spammers, as Mr. Silveira is apparently in the habit of doing, then I get ticked off. And actually, Mr. Silveira must be *exceptionally* greedy in that he is apparently not satisfied to just sub-lease his own legitimate IP space to snowshoe spammers, as he is clearly doing: https://pastebin.com/raw/5P5rnQ2y Obviously, merely hosting snowshoe spammers in his own IP space isn't enough to keep Mr. Silveira in the style to which he has become accustomned, so he has to go out and rip off other people's IP space and then resell that to spammers also. The fact that there exists a jerk like this on the Internet isn't really all that surprising. What I personally -do- find rather surprising is that three companies that each outght to know better, namely Cogent, GTT, and Level3 are collectively supplying more than 3/4ths of this guy's IPv4 connectivity, at least according to the graph displayed here: https://bgp.he.net/AS197426 Without the generous support of Cogent, GTT, and Level3 this dumbass lowlife IP address space thief would be largely if not entirely toast. So what are they waiting for? Why don't their turf this jackass? Are they waiting for an engraved invitation or what? As I always ask, retorically, in cases like this: Where are the grownups? I would like everyone reading this who is a customer of Cogent, GTT, or Level3 to try to contact these companies and ask them why they are providing connectivity/peering to a hijacking jerk like this Silveira character. Ask them why -you- have to endure more spam in your inbox just so that -they- can make another one tenth of one percent profit by peering with this hijacking, spammer-loving miscreant. I would ask them myself, but I personally am not a direct customer of any of them, so they would all, most probably, just tell me to go pound sand. If you do manage to make contact, please be sure to mention all three of Mr. Silveira's ASNs, i.e. AS42229, AS197426, and AS3266. And don't let whoever you talk to try to weasel out of responsibility for this travesty, e.g. by claiming that they don't know anything about what's been going on with all those hijacks announced by AS3266, and/or that they only provide peering for AS197426. The hijacks may all be originating from Mr. Silveira's AS3266, but bgp.he.net makes clear that AS3266 has one, and only one peer, i.e. Mr. Silveira's AS197426: https://bgp.he.net/AS3266 So basically, Cogent, GTT, and Level3 are the prime enablers of this massive theft of IP space. (They might try to claim that BitCanal's historical propensity to engage in hijacks is sonmething "brand new" or at least that -they- may not have been aware of it until now, in which case you should ask them if they have anybody on staff who is paying attention. As noted above, it isn't as if Bitcanal just started pulling this crap yesterday. Far from it.) Oh! And you might also mention the fact that Spamhaus, and, I would guess, at least a few of the oether public blacklists already have most or all of Mr. Silveira's IP space... hijacked or otherwise... blacklisted, presumably for good and ample cause. As long as Cogent, GTT, and Level3 are willing to go along with this nonsense, i.e. by selling peering to this Silveira thief, crime on the Internet -does- pay, and the theft of other people's IP space will continue to be rewarded rather than punished, as it should be. If that becomes the new normal for Internet behavior, then god help us all. Regards, rfg

20 29

A.W.S. Product / Services Inquiry...
by Michael Bullut 10 Jul '18

10 Jul '18

Greetings Team, Anyone from the Amazon Web Services Team here? I have an inquiry regarding your virtual server offerings. Warm regards, Michael Bullut. --- *Cell:* *+254 723 393 114.**Skype Name:* *Michael Bullut.* *Twitter:* * @Kipsang <http://twitter.com/Kipsang/>* *Blog: http://www.kipsang.com/ <http://www.kipsang.com/>* *E-mail:* *main(a)kipsang.com <main(a)kipsang.com>* *---*

1 0

Re: Time to add 2002::/16 to bogon filters?
by Gary McArtor 09 Jul '18

09 Jul '18

Hi Youssef, My original reply wasn't sent to the Nanog list. Team Cymru considers 2002::/16 and 192.88.99.0/24 to be legitimate prefixes at this time, and will be not be adding them to our bogon filters. Our interpretation of the 6to4 anycast rfc is that while these are encouraged to be made obsolete, in practice they may still be in use, excluding them from being universally defined as a bogon in our feed. The RFC in question: https://tools.ietf.org/html/rfc7526 The rule, as it always should be, is to know your network, and know what is best for it. As noted in the RFC you are encouraged to review any current deployments and any existing filtering and adjust based on your own discretion. Regards, Gary McArtor Team Cymru On 6/28/18 2:32 PM, Rabbi Rob Thomas wrote: > FYI, the question has been raised. I'm not sure if this is wise or not. > Gary, what are your thoughts? > > > -------- Forwarded Message -------- > Subject: Re: Time to add 2002::/16 to bogon filters? > Date: Thu, 28 Jun 2018 21:11:22 +0200 > From: Youssef Bengelloun-Zahr <bengelly(a)gmail.com> > To: Job Snijders <job(a)ntt.net> > CC: NANOG [nanog(a)nanog.org] <nanog(a)nanog.org> > > Hello Job, > > Thank you for this feedback. I guess that NTT adopting this as a best > practice will ring some bells around. > > Do you know if Team Cymru has updated their filters accordingly ? > > Best regards. > > > >> Le 28 juin 2018 à 20:58, Job Snijders <job(a)ntt.net> a écrit : >> >> Dear alll, >> >> Thank you all for your input. Just a heads-up - we deployed a few days ago. >> >> NTT / AS 2914 now considers “2002::/16 le 128” and “192.88.99.0/24 le 32” >> to be bogon prefixes, and no longer accepts announcements for these >> destinations from any EBGP neighbor. >> >> Kind regards, >> >> Job >

4 4

NANOG 74 Call for Presentations is open
by Ryan Woolley 09 Jul '18

09 Jul '18

NANOG Community, The NANOG Program Committee is excited to announce that we are now accepting proposals for all sessions at NANOG 74 in Vancouver, BC, Canada, October 1-3, 2018. Below is a summary of key details and dates from the Call For Presentations on the NANOG website, which can be found at: http://www.cvent.com/d/qgqs03/6K The NANOG Program Committee seeks proposals for presentations, panels, tutorials, and track sessions for the NANOG 74 program. We welcome suggestions of speakers or topic ideas. Presentations may cover current technologies already deployed or soon-to-be deployed in the Internet. Vendors are welcome to submit talks which cover relevant technologies and capabilities, but presentations must not be promotional or discuss proprietary solutions. NANOG 74 submissions can be entered on the NANOG Program Committee Tool at https://pc.nanog.org The primary speaker, moderator, or author should submit a presentation proposal and an abstract in the Program Committee Tool. - Select “Propose Talk” from the Talks menu - Select NANOG 74 from the Meeting menu - Select the appropriate *Session* the talk will be presented in (General Session 30-45 minutes; Tutorial 90-120 minutes; Track 90-120 minutes) Timeline for submission and proposal review: - Submitter enters abstract (and draft slides if possible) in Program Committee Tool: any time following Call for Presentations and prior to CFP deadline for slide submission - PC performs initial review and assigns a “shepherd” to help develop the submission: within 2 weeks - Submitter develops draft slides of talk. Please submit initial draft slides early. Panel and Track submissions should provide topic list and intended/confirmed participants - PC reviews slides and continues to work with Submitter as needed to develop topic - Draft presentation slides should be submitted prior to published deadline for slides - PC accepts or declines submission - Agenda assembled and posted - Submitters notified If you think you have an interesting topic but want feedback or suggestions for developing an idea into a presentation, please email the Program Committee, and a representative of the Program Committee will respond. Otherwise, submit your talk, keynote, track, or panel proposal to the Program Committee Tool without delay! We look forward to reviewing your submission. Key Dates for NANOG 74: Monday, 07/09/18 Registration for NANOG 74 Opens Monday, 07/09/18 Agenda Outline for NANOG 74 Posted Tuesday, 09/04/18 CFP Deadline: Presentation Slides Due Tuesday, 09/04/18 CFP Topic List and NANOG Highlights Page Monday, 09/24/18 Speaker FINAL presentation Slides to PC Tool Sunday, 09/30/18 Lightning Talk Submissions Open (Abstracts Only) Sunday, 09/30/18 On-site Registration Final slides must be submitted by Monday, September 24, 2018, and no changes will be accepted between that date and the conference. Materials received after that date will be updated on the web site after the completion of the conference. We look forward to seeing you in October in Vancouver! Sincerely, Ryan Woolley NANOG PC

1 0

Re: [c-nsp] Leaked Video or Not (Linux and Cisco for internal Sales folks)
by Tails Pipes 09 Jul '18

09 Jul '18

No, things changed there as well. Lookup merchant sillicon, and revise this post every 6 months. have you heard of Barefoot networks? The days of ASICs from Cisco are gone and we are glad, we tested the P4 DSL (cisco never got that right with mantel) on Nexus and its wonderful. The asics you speak of are no longer important or valuable because people realized that in many networking planets and galaxies, the asic is reflects the network design, they are related, and specifically for the data center, the clos fabric design won, and that does not require fancy asics. I guess your knowledge is out dated a bit. Cisco itself is using those merchant sillicon ASICs happily. (lookup Chuck's comments on nexus9000, best selling cisco switch ever)...guess it is a good switch, because bright box pushed cisco to do that, and if any one on this list can disagree with me here, i'm up to that challenge. What i have discovered recently is that things happen in following way. Your boss or his boss picks a work culture (no one gets fired for buying IBM/Cisco), that culture (buying the shiny suits) impacts how you do work, it makes you select vendors (the ones that sends me to vegas every year) and not the right network design, you select cisco and you are stuck there for life, because once they tell you how things should work (aka : certificates), things are worse, now every time you make a new network purchase (afraid of new CLI ), you will not be able to look the other way because you just dont know any thing else (and loosing your certificate value). I wish the culture would change to, no one got fired for buying closed but didnt get promoted either. change requires boldness. https://toolr.io/2018/06/18/stop-abusing-the-word-open/ On Wed, Jun 27, 2018 at 9:41 AM, <adamv0025(a)netconsultings.com> wrote: > > Tails Pipes > > Sent: Friday, June 22, 2018 3:00 PM > > > > can you easily answer this question ? why packets are not pushed in > linux ? > > is it because of big switch, cumulus, pica8 ? > > > > can you push packets in linux without writing code to do that ? who is > writing > > that code ? > > > > this is supposedly a community effort, something that older generations > > dont understand. > > > If pure linux as NOS has some legs it'll fly regardless of cisco blessing, > don't worry no single company owns the whole industry. > Also we can argue that this is only about the OS but in reality it's also > the quality of apps running on top and the quality of the underlying HW > that plays a major role. > The quality of BGP app for instance, or the ability of the forwarding ASIC > to deliver the stated pps rate even if multiple features are enabled or > protect high priority traffic even if ASIC is overloaded. > > > Oh and with regards to: > < I am sick of having to learn all the cisco specific terms to all sorts > of different boxes and technologies > I'd recommend you read all the cisco books on networking to get yourself > educated on the topic and to get the difference between SW and HW > forwarding ( -on why packets are not routed in linux) > And while on that I suggest you read all Stanford university lectures on > how routers work too, it'll help you understand why Cisco and Juniper ASICs > are so much more expensive than white-box ASICs. > > adam > > netconsultings.com > ::carrier-class solutions for the telecommunications industry:: > > >

4 3

Spoofer Report for_NANOG for Jun 2018
by CAIDA Spoofer Project 08 Jul '18

08 Jul '18

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Jun 2018: ASN Name Fixed-By 40764 DNA-DKLB 2018-06-05 29384 Qatar-Foundation 2018-06-06 11796 AIRSTREAMCOMM-NET 2018-06-08 2828 XO-AS15 2018-06-11 11427 SCRR-11427 2018-06-12 5056 AUREON-5056 2018-06-14 20082 ABSNOC1 2018-06-17 6181 FUSE-NET 2018-06-22 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Jun 2018: ASN Name First-Spoofed Last-Spoofed 577 BACOM 2016-03-09 2018-06-24 20115 CHARTER-NET-HKY-NC 2016-06-09 2018-06-15 19230 NANOG 2016-06-13 2018-06-27 209 CENTURYLINK-US-LEGACY-QWEST 2016-08-16 2018-06-27 6128 CABLE-NET-1 2016-09-03 2018-06-27 20412 CLARITY-TELECOM 2016-09-30 2018-06-25 6181 FUSE-NET 2016-10-10 2018-06-29 25787 ROWE-NETWORKS 2016-10-21 2018-06-26 174 COGENT-174 2016-10-21 2018-06-27 271 BCNET 2016-10-24 2018-06-25 2828 XO-AS15 2016-10-25 2018-06-29 32440 LONI 2016-11-03 2018-06-29 33182 DimeNOC 2016-11-08 2018-06-27 12083 WOW-INTERNET 2016-11-09 2018-06-29 1403 EBOX 2016-11-12 2018-06-27 20105 URICHMOND 2016-11-15 2018-06-28 2152 CSUNET-NW 2017-02-02 2018-06-29 21832 KELLINCOM-1 2017-02-03 2018-06-27 7276 UNIVERSITY-OF-HOUSTON 2017-03-09 2018-06-26 133481 AIS-Fibre 2017-04-20 2018-06-06 6461 ZAYO-6461 2017-06-21 2018-06-29 26253 SCINTERNET 2017-06-30 2018-06-01 63296 AMARILLO-WIRELESS 2017-09-01 2018-06-27 7233 YAHOO-US 2017-09-07 2018-06-28 546 PARSONS-PGS-1 2017-11-20 2018-06-05 54540 INCERO 2018-01-15 2018-06-25 12222 AKAMAI 2018-02-14 2018-06-30 55236 CBC 2018-03-03 2018-06-25 3257 GTT-BACKBONE 2018-03-06 2018-06-25 29384 Qatar-Foundation 2018-03-08 2018-06-28 23148 TERRENAP 2018-03-15 2018-06-27 15176 AS-INOC 2018-04-09 2018-06-15 20009 WADSNET 2018-04-13 2018-06-27 11827 WSU 2018-04-19 2018-06-21 54412 RCC-GRANITE-1 2018-06-04 2018-06-04 393564 SPOKANE 2018-06-05 2018-06-20 35911 BNQ-1 2018-06-06 2018-06-28 4 ISI 2018-06-06 2018-06-06 17402 CENTURYLINK-LEGACY-EMBARQ-CHSK 2018-06-10 2018-06-10 12028 MMINTERNET 2018-06-14 2018-06-14 225 VIRGINIA 2018-06-18 2018-06-18 6576 SUMMITCOMM 2018-06-21 2018-06-21 16837 VABB 2018-06-22 2018-06-22 33509 CASCADE-ACCESS-LLC-CA-ESTOR1 2018-06-22 2018-06-22 394548 NETBLAZR-BOS 2018-06-23 2018-06-28 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

Weekly Routing Table Report
by cscora＠apnic.net 06 Jul '18

06 Jul '18

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG, IRNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 07 Jul, 2018 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 704783 Prefixes after maximum aggregation (per Origin AS): 270812 Deaggregation factor: 2.60 Unique aggregates announced (without unneeded subnets): 338899 Total ASes present in the Internet Routing Table: 61158 Prefixes per ASN: 11.52 Origin-only ASes present in the Internet Routing Table: 52832 Origin ASes announcing only one prefix: 23031 Transit ASes present in the Internet Routing Table: 8326 Transit-only ASes present in the Internet Routing Table: 275 Average AS path length visible in the Internet Routing Table: 4.0 Max AS path length visible: 38 Max AS path prepend of ASN ( 30873) 28 Prefixes from unregistered ASNs in the Routing Table: 58 Number of instances of unregistered ASNs: 62 Number of 32-bit ASNs allocated by the RIRs: 23201 Number of 32-bit ASNs visible in the Routing Table: 18695 Prefixes from 32-bit ASNs in the Routing Table: 78406 Number of bogon 32-bit ASNs visible in the Routing Table: 23 Special use prefixes present in the Routing Table: 2 Prefixes being announced from unallocated address space: 271 Number of addresses announced to Internet: 2859095363 Equivalent to 170 /8s, 106 /16s and 85 /24s Percentage of available address space announced: 77.2 Percentage of allocated address space announced: 77.2 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 98.9 Total number of prefixes smaller than registry allocations: 235229 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 192058 Total APNIC prefixes after maximum aggregation: 54723 APNIC Deaggregation factor: 3.51 Prefixes being announced from the APNIC address blocks: 190609 Unique aggregates announced from the APNIC address blocks: 78232 APNIC Region origin ASes present in the Internet Routing Table: 8931 APNIC Prefixes per ASN: 21.34 APNIC Region origin ASes announcing only one prefix: 2523 APNIC Region transit ASes present in the Internet Routing Table: 1338 Average APNIC Region AS path length visible: 4.1 Max APNIC Region AS path length visible: 29 Number of APNIC region 32-bit ASNs visible in the Routing Table: 3898 Number of APNIC addresses announced to Internet: 768180738 Equivalent to 45 /8s, 201 /16s and 130 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-137529 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 209516 Total ARIN prefixes after maximum aggregation: 99769 ARIN Deaggregation factor: 2.10 Prefixes being announced from the ARIN address blocks: 209831 Unique aggregates announced from the ARIN address blocks: 99691 ARIN Region origin ASes present in the Internet Routing Table: 18195 ARIN Prefixes per ASN: 11.53 ARIN Region origin ASes announcing only one prefix: 6728 ARIN Region transit ASes present in the Internet Routing Table: 1806 Average ARIN Region AS path length visible: 3.6 Max ARIN Region AS path length visible: 20 Number of ARIN region 32-bit ASNs visible in the Routing Table: 2374 Number of ARIN addresses announced to Internet: 1103021728 Equivalent to 65 /8s, 190 /16s and 198 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-397212 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 192989 Total RIPE prefixes after maximum aggregation: 92133 RIPE Deaggregation factor: 2.09 Prefixes being announced from the RIPE address blocks: 189192 Unique aggregates announced from the RIPE address blocks: 112187 RIPE Region origin ASes present in the Internet Routing Table: 25262 RIPE Prefixes per ASN: 7.49 RIPE Region origin ASes announcing only one prefix: 11379 RIPE Region transit ASes present in the Internet Routing Table: 3496 Average RIPE Region AS path length visible: 4.1 Max RIPE Region AS path length visible: 30 Number of RIPE region 32-bit ASNs visible in the Routing Table: 7146 Number of RIPE addresses announced to Internet: 716014976 Equivalent to 42 /8s, 173 /16s and 133 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-207259 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 91266 Total LACNIC prefixes after maximum aggregation: 20116 LACNIC Deaggregation factor: 4.54 Prefixes being announced from the LACNIC address blocks: 92679 Unique aggregates announced from the LACNIC address blocks: 40775 LACNIC Region origin ASes present in the Internet Routing Table: 7301 LACNIC Prefixes per ASN: 12.69 LACNIC Region origin ASes announcing only one prefix: 2012 LACNIC Region transit ASes present in the Internet Routing Table: 1355 Average LACNIC Region AS path length visible: 4.7 Max LACNIC Region AS path length visible: 38 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 4841 Number of LACNIC addresses announced to Internet: 172321824 Equivalent to 10 /8s, 69 /16s and 108 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-268700 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 18895 Total AfriNIC prefixes after maximum aggregation: 4021 AfriNIC Deaggregation factor: 4.70 Prefixes being announced from the AfriNIC address blocks: 22201 Unique aggregates announced from the AfriNIC address blocks: 7773 AfriNIC Region origin ASes present in the Internet Routing Table: 1165 AfriNIC Prefixes per ASN: 19.06 AfriNIC Region origin ASes announcing only one prefix: 389 AfriNIC Region transit ASes present in the Internet Routing Table: 232 Average AfriNIC Region AS path length visible: 4.5 Max AfriNIC Region AS path length visible: 23 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 436 Number of AfriNIC addresses announced to Internet: 99110400 Equivalent to 5 /8s, 232 /16s and 78 /24s AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 4692 4192 74 ERX-CERNET-BKB China Education and Rese 7545 4341 466 458 TPG-INTERNET-AP TPG Telecom Limited, AU 7552 2897 1153 77 VIETEL-AS-AP Viettel Group, VN 4766 2842 11134 759 KIXS-AS-KR Korea Telecom, KR 9829 2813 1497 543 BSNL-NIB National Internet Backbone, IN 45899 2639 1633 114 VNPT-AS-VN VNPT Corp, VN 9394 2542 4907 31 CTTNET China TieTong Telecommunications 17974 2259 930 70 TELKOMNET-AS2-AP PT Telekomunikasi Indo 9808 2241 8699 26 CMNET-GD Guangdong Mobile Communication 4755 2111 417 205 TATACOMM-AS TATA Communications formerl Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6327 3420 1324 84 SHAW - Shaw Communications Inc., CA 22773 3291 2968 148 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 11492 2391 241 473 CABLEONE - CABLE ONE, INC., US 16509 2222 4721 734 AMAZON-02 - Amazon.com, Inc., US 18566 2169 405 109 MEGAPATH5-US - MegaPath Corporation, US 20115 2110 2579 473 CHARTER-NET-HKY-NC - Charter Communicat 209 2037 5070 611 CENTURYLINK-US-LEGACY-QWEST - Qwest Com 30036 2000 343 161 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 16625 1951 978 1387 AKAMAI-AS - Akamai Technologies, Inc., 7018 1751 20203 1272 ATT-INTERNET4 - AT&T Services, Inc., US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 4458 1607 120 UNI2-AS, ES 39891 3778 203 20 ALJAWWALSTC-AS, SA 8551 2609 377 43 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 20940 2546 627 1875 AKAMAI-ASN1, US 12389 2014 1877 708 ROSTELECOM-AS, RU 34984 2014 335 497 TELLCOM-AS, TR 9121 1887 1692 19 TTNET, TR 13188 1601 100 43 TRIOLAN, UA 6849 1241 355 21 UKRTELNET, UA 8402 1226 544 14 CORBINA-AS OJSC "Vimpelcom", RU Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 4999 3307 583 Uninet S.A. de C.V., MX 10620 3565 542 251 Telmex Colombia S.A., CO 11830 2655 369 78 Instituto Costarricense de Electricidad 6503 1666 443 60 Axtel, S.A.B. de C.V., MX 7303 1506 1026 190 Telecom Argentina S.A., AR 28573 1036 2247 183 CLARO S.A., BR 3816 1008 505 129 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 6147 932 377 31 Telefonica del Peru S.A.A., PE 11172 927 126 85 Alestra, S. de R.L. de C.V., MX 18881 913 1078 30 TELEFÔNICA BRASIL S.A, BR Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1157 396 48 LINKdotNET-AS, EG 37611 881 107 9 Afrihost, ZA 36903 768 386 135 MT-MPLS, MA 36992 750 1411 39 ETISALAT-MISR, EG 8452 605 1730 18 TE-AS TE-AS, EG 24835 572 802 18 RAYA-AS, EG 37492 472 470 57 ORANGE-, TN 29571 454 68 11 ORANGE-COTE-IVOIRE, CI 37342 386 32 1 MOVITEL, MZ 15399 374 39 8 WANANCHI-, KE Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 4999 3307 583 Uninet S.A. de C.V., MX 4538 4692 4192 74 ERX-CERNET-BKB China Education and Rese 12479 4458 1607 120 UNI2-AS, ES 7545 4341 466 458 TPG-INTERNET-AP TPG Telecom Limited, AU 39891 3778 203 20 ALJAWWALSTC-AS, SA 10620 3565 542 251 Telmex Colombia S.A., CO 6327 3420 1324 84 SHAW - Shaw Communications Inc., CA 22773 3291 2968 148 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 7552 2897 1153 77 VIETEL-AS-AP Viettel Group, VN 4766 2842 11134 759 KIXS-AS-KR Korea Telecom, KR Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 4538 4692 4618 ERX-CERNET-BKB China Education and Research Net 12479 4458 4338 UNI2-AS, ES 7545 4341 3883 TPG-INTERNET-AP TPG Telecom Limited, AU 39891 3778 3758 ALJAWWALSTC-AS, SA 6327 3420 3336 SHAW - Shaw Communications Inc., CA 10620 3565 3314 Telmex Colombia S.A., CO 22773 3291 3143 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 7552 2897 2820 VIETEL-AS-AP Viettel Group, VN 11830 2655 2577 Instituto Costarricense de Electricidad y Telec 8551 2609 2566 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 230105 UNALLOCATED 38.110.79.0/24 23015 CMC180-TOR-AS - Cambridge Merc 65001 PRIVATE 46.237.40.0/21 13118 ASN-YARTELECOM PJSC Rostelecom 64513 PRIVATE 62.150.101.0/24 9155 QNET Kuwait, KW 65537 DOCUMENT 62.162.120.0/24 6821 MT-AS-OWN bul. Orce Nikolov bb 419333 UNALLOCATED 84.17.91.0/24 41933 IPRAGAZ-AS Istanbul/ TURKEY, T 64121 UNALLOCATED 98.159.9.0/24 19555 KMI-NETWORK - Kinder Morgan, I 64121 UNALLOCATED 98.159.12.0/24 19555 KMI-NETWORK - Kinder Morgan, I 64140 UNALLOCATED 98.159.14.0/24 64121 UNKNOWN 65544 DOCUMENT 103.197.121.0/24 65542 UNKNOWN 4259905537 PRIVATE 103.250.48.0/24 132917 YELLOWPAGESGROUP-AS-AP Yellow Complete listing at http://thyme.rand.apnic.net/current/data-badAS Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 100.66.224.0/19 209 CENTURYLINK-US-LEGACY-QWEST - Qwest Communicati 198.18.1.19/32 7497 CSTNET-AS-AP Computer Network Information Cente Complete listing at http://thyme.rand.apnic.net/current/data-dsua Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 27.100.7.0/24 56096 UNKNOWN 41.76.136.0/22 37500 -Reserved AS-, ZZ 41.76.136.0/24 37500 -Reserved AS-, ZZ 41.76.138.0/24 37500 -Reserved AS-, ZZ 41.76.139.0/24 37500 -Reserved AS-, ZZ 41.76.140.0/22 37500 -Reserved AS-, ZZ 41.78.92.0/22 14988 BTC-GATE1, BW 41.78.180.0/23 37265 -Reserved AS-, ZZ 43.251.20.0/22 9381 WTT-AS-AP WTT HK Limited, HK 43.251.84.0/22 133676 PNPL-AS Precious netcom pvt ltd, IN Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:14 /9:11 /10:37 /11:99 /12:290 /13:568 /14:1097 /15:1895 /16:13357 /17:7931 /18:13762 /19:25283 /20:39373 /21:45607 /22:87636 /23:71053 /24:394662 /25:794 /26:558 /27:627 /28:35 /29:20 /30:18 /31:4 /32:52 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 6327 3207 3420 SHAW - Shaw Communications Inc., CA 12479 3205 4458 UNI2-AS, ES 39891 2946 3778 ALJAWWALSTC-AS, SA 22773 2551 3291 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 8551 2071 2609 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 18566 2062 2169 MEGAPATH5-US - MegaPath Corporation, US 11830 2004 2655 Instituto Costarricense de Electricidad y Telec 11492 1914 2391 CABLEONE - CABLE ONE, INC., US 30036 1752 2000 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom Communi 10620 1612 3565 Telmex Colombia S.A., CO Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1608 2:844 4:18 5:2813 6:41 7:1 8:1121 12:1871 13:201 14:1756 15:30 16:3 17:188 18:54 20:49 23:2641 24:2217 25:2 27:2436 31:2028 32:92 35:27 36:501 37:2780 38:1461 39:253 40:121 41:3068 42:679 43:1917 44:120 45:4958 46:3049 47:202 49:1332 50:1048 51:316 52:1069 54:371 55:5 56:12 57:39 58:1600 59:988 60:403 61:2105 62:1859 63:1790 64:5032 65:2199 66:4659 67:2437 68:1167 69:3228 70:1159 71:572 72:2113 74:2707 75:422 76:457 77:1546 78:1716 79:1682 80:1521 81:1379 82:1079 83:792 84:1067 85:2011 86:565 87:1321 88:932 89:2346 90:212 91:6409 92:1241 93:2369 94:2392 95:2899 96:755 97:357 98:946 99:133 100:85 101:1223 102:130 103:18144 104:3555 105:211 106:671 107:1779 108:698 109:3379 110:1604 111:1772 112:1303 113:1281 114:1130 115:1662 116:1647 117:1757 118:2200 119:1660 120:993 121:1056 122:2468 123:1783 124:1446 125:1911 128:1086 129:673 130:458 131:1622 132:699 133:195 134:1015 135:225 136:501 137:564 138:1987 139:652 140:465 141:727 142:799 143:1003 144:803 145:482 146:1197 147:720 148:1638 149:754 150:737 151:1100 152:792 153:317 154:1265 155:771 156:1133 157:803 158:653 159:1742 160:1194 161:784 162:2589 163:593 164:1080 165:1507 166:450 167:1302 168:3099 169:816 170:3814 171:470 172:1080 173:1982 174:907 175:771 176:1987 177:4042 178:2535 179:1230 180:2175 181:2325 182:2367 183:1226 184:1032 185:13772 186:3634 187:2387 188:2848 189:2057 190:8137 191:1393 192:9822 193:5997 194:4866 195:3980 196:2595 197:1586 198:5529 199:5895 200:7325 201:4983 202:10241 203:10234 204:4583 205:2900 206:3097 207:3162 208:3986 209:3965 210:3883 211:1978 212:3015 213:2770 214:984 215:57 216:6029 217:2119 218:856 219:576 220:1778 221:984 222:970 223:1297 End of report

1 0

Time to add 2002::/16 to bogon filters?
by Job Snijders 06 Jul '18

06 Jul '18

Dear all, TL;DR: Perhaps it is time to add 2002::/16 to our EBGP bogon filters? It is kind of strange that in the default-free zone (where we don’t announce defaults to each other) - we will propagate what is effectively an IPv4 default-route, in the IPv6 DFZ. IETF has politely abandoned the prefix: https://tools.ietf.org/html/rfc7526 Wes George highlighted operational problems from accepting 2002::/16 on the data-plane slide 6: http://iepg.org/2018-03-18-ietf101/wes.pdf Is there still really any legit reason left to accept, or propagate, 2002::/16 on EBGP sessions in the DFZ? Kind regards, Job

6 7

BGP Communities
by Matthew Crocker 05 Jul '18

05 Jul '18

Hello, I’m just getting started setting up communities for my network. Is there any standard convention for community numbering (*:666 for RTBH for example)? I’ve looked at some examples from other carriers and it looks like everyone does their own thing. -Matt -- Matthew Crocker Crocker Communications, Inc. President

3 2

videos from NANOG73?
by Sandra Murphy 05 Jul '18

05 Jul '18

The agenda for NANOG73 is still on the cevent site. The links for slides all seem to be there, which is good. But only the sessions on Monday morning have links for the videos. I hope that’s not due to a taping failure. I looked in the archive, and the presentations from NANOG73 aren’t there. Understandable. It does look like they are available on youtube. Can you let me know when the videos will be available on the nanog site? I like to point people to the nanog site, so they can get everything, past, present and future, mail, videos, slides, etc, all together. —Sandy

1 1