- Test - lists.nanog.org

Weekly Routing Table Report
by cscora＠apnic.net 30 Sep '16

30 Sep '16

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, SAFNOG, SdNOG, BJNOG, CaribNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 01 Oct, 2016 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 612615 Prefixes after maximum aggregation (per Origin AS): 220315 Deaggregation factor: 2.78 Unique aggregates announced (without unneeded subnets): 298785 Total ASes present in the Internet Routing Table: 54938 Prefixes per ASN: 11.15 Origin-only ASes present in the Internet Routing Table: 36401 Origin ASes announcing only one prefix: 15384 Transit ASes present in the Internet Routing Table: 6509 Transit-only ASes present in the Internet Routing Table: 168 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 54 Max AS path prepend of ASN ( 55644) 51 Prefixes from unregistered ASNs in the Routing Table: 62 Unregistered ASNs in the Routing Table: 16 Number of 32-bit ASNs allocated by the RIRs: 15608 Number of 32-bit ASNs visible in the Routing Table: 12028 Prefixes from 32-bit ASNs in the Routing Table: 48261 Number of bogon 32-bit ASNs visible in the Routing Table: 151 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 333 Number of addresses announced to Internet: 2829857764 Equivalent to 168 /8s, 172 /16s and 51 /24s Percentage of available address space announced: 76.4 Percentage of allocated address space announced: 76.4 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 98.3 Total number of prefixes smaller than registry allocations: 199109 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 156521 Total APNIC prefixes after maximum aggregation: 42983 APNIC Deaggregation factor: 3.64 Prefixes being announced from the APNIC address blocks: 170242 Unique aggregates announced from the APNIC address blocks: 69342 APNIC Region origin ASes present in the Internet Routing Table: 5193 APNIC Prefixes per ASN: 32.78 APNIC Region origin ASes announcing only one prefix: 1146 APNIC Region transit ASes present in the Internet Routing Table: 943 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 54 Number of APNIC region 32-bit ASNs visible in the Routing Table: 2395 Number of APNIC addresses announced to Internet: 760195012 Equivalent to 45 /8s, 79 /16s and 167 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-137529 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 184711 Total ARIN prefixes after maximum aggregation: 89553 ARIN Deaggregation factor: 2.06 Prefixes being announced from the ARIN address blocks: 190560 Unique aggregates announced from the ARIN address blocks: 88497 ARIN Region origin ASes present in the Internet Routing Table: 16181 ARIN Prefixes per ASN: 11.78 ARIN Region origin ASes announcing only one prefix: 5681 ARIN Region transit ASes present in the Internet Routing Table: 1703 Average ARIN Region AS path length visible: 3.8 Max ARIN Region AS path length visible: 23 Number of ARIN region 32-bit ASNs visible in the Routing Table: 1490 Number of ARIN addresses announced to Internet: 1107290592 Equivalent to 65 /8s, 255 /16s and 233 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-397212 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 146172 Total RIPE prefixes after maximum aggregation: 71917 RIPE Deaggregation factor: 2.03 Prefixes being announced from the RIPE address blocks: 156575 Unique aggregates announced from the RIPE address blocks: 96689 RIPE Region origin ASes present in the Internet Routing Table: 18139 RIPE Prefixes per ASN: 8.63 RIPE Region origin ASes announcing only one prefix: 7833 RIPE Region transit ASes present in the Internet Routing Table: 3037 Average RIPE Region AS path length visible: 4.3 Max RIPE Region AS path length visible: 27 Number of RIPE region 32-bit ASNs visible in the Routing Table: 5054 Number of RIPE addresses announced to Internet: 708935680 Equivalent to 42 /8s, 65 /16s and 128 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-207259 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 62128 Total LACNIC prefixes after maximum aggregation: 12548 LACNIC Deaggregation factor: 4.95 Prefixes being announced from the LACNIC address blocks: 78069 Unique aggregates announced from the LACNIC address blocks: 37582 LACNIC Region origin ASes present in the Internet Routing Table: 2486 LACNIC Prefixes per ASN: 31.40 LACNIC Region origin ASes announcing only one prefix: 550 LACNIC Region transit ASes present in the Internet Routing Table: 581 Average LACNIC Region AS path length visible: 4.8 Max LACNIC Region AS path length visible: 22 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 2825 Number of LACNIC addresses announced to Internet: 170784832 Equivalent to 10 /8s, 45 /16s and 248 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-266652 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 14759 Total AfriNIC prefixes after maximum aggregation: 3304 AfriNIC Deaggregation factor: 4.47 Prefixes being announced from the AfriNIC address blocks: 16836 Unique aggregates announced from the AfriNIC address blocks: 6370 AfriNIC Region origin ASes present in the Internet Routing Table: 736 AfriNIC Prefixes per ASN: 22.88 AfriNIC Region origin ASes announcing only one prefix: 174 AfriNIC Region transit ASes present in the Internet Routing Table: 179 Average AfriNIC Region AS path length visible: 4.7 Max AfriNIC Region AS path length visible: 18 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 264 Number of AfriNIC addresses announced to Internet: 82320128 Equivalent to 4 /8s, 232 /16s and 27 /24s AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5549 4190 74 ERX-CERNET-BKB China Education and Rese 7545 3540 382 249 TPG-INTERNET-AP TPG Telecom Limited, AU 4766 3002 11138 984 KIXS-AS-KR Korea Telecom, KR 17974 2947 904 78 TELKOMNET-AS2-AP PT Telekomunikasi Indo 9829 2696 1497 532 BSNL-NIB National Internet Backbone, IN 9808 2185 8781 42 CMNET-GD Guangdong Mobile Communication 4755 2055 429 218 TATACOMM-AS TATA Communications formerl 4808 1769 2289 522 CHINA169-BJ China Unicom Beijing Provin 45899 1588 1235 89 VNPT-AS-VN VNPT Corp, VN 24560 1549 516 220 AIRTELBROADBAND-AS-AP Bharti Airtel Ltd Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 22773 3527 2964 145 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 6389 2218 3671 41 BELLSOUTH-NET-BLK - BellSouth.net Inc., 18566 2196 405 110 MEGAPATH5-US - MegaPath Corporation, US 20115 1939 1982 405 CHARTER-NET-HKY-NC - Charter Communicat 30036 1760 340 272 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 209 1721 5071 657 CENTURYLINK-US-LEGACY-QWEST - Qwest Com 6983 1679 848 227 ITCDELTA - Earthlink, Inc., US 701 1618 10686 678 UUNET - MCI Communications Services, In 16509 1418 2537 470 AMAZON-02 - Amazon.com, Inc., US 7018 1368 20092 1008 ATT-INTERNET4 - AT&T Services, Inc., US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 39891 3329 169 15 ALJAWWALSTC-AS , SA 20940 2828 1073 2011 AKAMAI-ASN1 , US 34984 1972 326 356 TELLCOM-AS , TR 12479 1351 1018 46 UNI2-AS , ES 13188 1237 99 57 BANKINFORM-AS , UA 8551 1206 377 46 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 6849 1144 355 21 UKRTELNET , UA 8402 1093 544 15 CORBINA-AS Russia, RU 12389 927 1113 401 ROSTELECOM-AS , RU 6830 892 2755 467 LGI-UPC formerly known as UPC Broadband Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 10620 3494 541 177 Telmex Colombia S.A., CO 8151 2283 3397 555 Uninet S.A. de C.V., MX 7303 1546 957 245 Telecom Argentina S.A., AR 6503 1406 437 54 Axtel, S.A.B. de C.V., MX 11830 1324 367 57 Instituto Costarricense de Electricidad 6147 1203 377 27 Telefonica del Peru S.A.A., PE 28573 999 2213 196 CLARO S.A., BR 7738 994 1882 40 Telemar Norte Leste S.A., BR 3816 972 470 202 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 11172 906 125 76 Alestra, S. de R.L. de C.V., MX Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1184 402 50 LINKdotNET-AS, EG 36903 684 344 121 MT-MPLS, MA 37611 668 51 5 Afrihost, ZA 36992 565 1373 25 ETISALAT-MISR, EG 8452 522 1472 15 TE-AS TE-AS, EG 37492 385 252 70 ORANGE-TN, TN 24835 349 611 17 RAYA-AS, EG 29571 318 37 12 CITelecom-AS, CI 15399 298 35 7 WANANCHI-KE, KE 2018 269 327 74 TENET-1, ZA Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5549 4190 74 ERX-CERNET-BKB China Education and Rese 7545 3540 382 249 TPG-INTERNET-AP TPG Telecom Limited, AU 22773 3527 2964 145 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 10620 3494 541 177 Telmex Colombia S.A., CO 39891 3329 169 15 ALJAWWALSTC-AS , SA 4766 3002 11138 984 KIXS-AS-KR Korea Telecom, KR 17974 2947 904 78 TELKOMNET-AS2-AP PT Telekomunikasi Indo 20940 2828 1073 2011 AKAMAI-ASN1 , US 9829 2696 1497 532 BSNL-NIB National Internet Backbone, IN 8151 2283 3397 555 Uninet S.A. de C.V., MX Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 22773 3527 3382 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 10620 3494 3317 Telmex Colombia S.A., CO 39891 3329 3314 ALJAWWALSTC-AS , SA 7545 3540 3291 TPG-INTERNET-AP TPG Telecom Limited, AU 17974 2947 2869 TELKOMNET-AS2-AP PT Telekomunikasi Indo 6389 2218 2177 BELLSOUTH-NET-BLK - BellSouth.net Inc., 9829 2696 2164 BSNL-NIB National Internet Backbone, IN 9808 2185 2143 CMNET-GD Guangdong Mobile Communication 18566 2196 2086 MEGAPATH5-US - MegaPath Corporation, US 4766 3002 2018 KIXS-AS-KR Korea Telecom, KR Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 65001 PRIVATE 5.143.176.0/20 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.192.0/20 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.192.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.200.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.208.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.216.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65000 PRIVATE 31.219.177.0/25 8966 ETISALAT-AS P.O. Box 1150, Dub 65000 PRIVATE 31.219.177.128/25 8966 ETISALAT-AS P.O. Box 1150, Dub 65512 PRIVATE 45.252.244.0/24 45899 VNPT-AS-VN VNPT Corp, VN 65512 PRIVATE 45.252.245.0/24 45899 VNPT-AS-VN VNPT Corp, VN Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 23.249.144.0/20 40430 COLO4JAX-AS - colo4jax, LLC, US 27.100.7.0/24 56096 UNKNOWN 41.73.1.0/24 37004 -Reserved AS-, ZZ 41.73.2.0/24 37004 -Reserved AS-, ZZ 41.73.3.0/24 37004 -Reserved AS-, ZZ 41.73.4.0/24 37004 -Reserved AS-, ZZ 41.73.5.0/24 37004 -Reserved AS-, ZZ 41.73.6.0/24 37004 -Reserved AS-, ZZ 41.73.7.0/24 37004 -Reserved AS-, ZZ 41.73.8.0/24 37004 -Reserved AS-, ZZ Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:13 /10:36 /11:103 /12:273 /13:523 /14:1051 /15:1774 /16:13166 /17:7839 /18:13034 /19:25414 /20:38763 /21:40311 /22:68182 /23:59822 /24:340828 /25:510 /26:480 /27:339 /28:58 /29:32 /30:13 /31:1 /32:34 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 39891 2896 3329 ALJAWWALSTC-AS , SA 22773 2748 3527 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 18566 2088 2196 MEGAPATH5-US - MegaPath Corporation, US 30036 1574 1760 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 6389 1416 2218 BELLSOUTH-NET-BLK - BellSouth.net Inc., 10620 1416 3494 Telmex Colombia S.A., CO 6983 1328 1679 ITCDELTA - Earthlink, Inc., US 34984 1257 1972 TELLCOM-AS , TR 11492 1205 1297 CABLEONE - CABLE ONE, INC., US 13188 1012 1237 BANKINFORM-AS , UA Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1641 2:797 4:23 5:2179 6:31 8:987 12:1796 13:44 14:1742 15:46 16:2 17:98 18:122 20:50 22:1 23:1860 24:1803 27:2337 31:1789 32:83 33:4 35:5 36:329 37:2322 38:1258 39:36 40:103 41:2945 42:456 43:1854 44:46 45:2144 46:2554 47:99 49:1210 50:909 51:13 52:553 53:2 54:348 55:7 56:7 57:41 58:1571 59:1014 60:376 61:1840 62:1517 63:1920 64:4565 65:2174 66:4271 67:2207 68:1123 69:3257 70:1288 71:558 72:2071 74:2582 75:401 76:414 77:1386 78:1221 79:920 80:1301 81:1404 82:988 83:705 84:857 85:1567 86:479 87:1134 88:546 89:2081 90:225 91:6093 92:950 93:2361 94:2436 95:2503 96:577 97:344 98:958 99:89 100:148 101:1153 103:12422 104:2532 105:108 106:437 107:1437 108:779 109:2254 110:1280 111:1635 112:1069 113:1143 114:1081 115:1686 116:1675 117:1567 118:2043 119:1582 120:938 121:1118 122:2264 123:2034 124:1575 125:1822 128:685 129:439 130:418 131:1374 132:622 133:175 134:489 135:197 136:387 137:399 138:1888 139:434 140:600 141:452 142:663 143:962 144:732 145:164 146:956 147:649 148:1393 149:537 150:659 151:897 152:670 153:300 154:696 155:956 156:530 157:525 158:390 159:1241 160:505 161:735 162:2408 163:568 164:774 165:1115 166:336 167:1195 168:2224 169:673 170:1969 171:252 172:719 173:1743 174:768 175:673 176:1726 177:3994 178:2249 179:1172 180:2161 181:1888 182:2078 183:1004 184:830 185:7548 186:3161 187:2124 188:2207 189:1758 190:7771 191:1298 192:9030 193:5736 194:4449 195:3839 196:1778 197:1161 198:5590 199:5749 200:7157 201:3684 202:10122 203:9840 204:4527 205:2737 206:3000 207:3078 208:4059 209:3862 210:3881 211:2044 212:2719 213:2347 214:870 215:68 216:5743 217:1991 218:802 219:611 220:1635 221:880 222:698 223:1304 End of report

1 0

TicketMaster / Live Nation admin on list?
by mike.lyon＠gmail.com 30 Sep '16

30 Sep '16

If so, can you contact me offlist? I seem to have a subnet that you guys don't like. Thank You, Mike

1 0

GoDaddy abuse Contact
by J Crowe 29 Sep '16

29 Sep '16

Could someone from GoDaddy please contact me off list? Running into issues where customers on our network are not able to reach their sites due to blackhole because of phishing sites that are on the shared IP. Thanks Joe Crowe Comcast

1 0

bogon identified? how to track down bogus IPs/ASN's
by Ken Chase 29 Sep '16

29 Sep '16

My turn for the newb question: I've got a traceroute with this IP in it thats close to the end of the trace. 103.206.16.46 Chasing down this IP to see who the ISP a friend is using, figured out the diff between ARIN and APNIC whois for IPs (..bit of a learning curve, not sure why there's not just one whois interface syntax). whois -h whois.apnic.net -m 103.206.16.0/21 shows only the upper /22 being registered with APNIC (if you do -m on .16.0/22, there's no entry). So it seems to me these Ips arent registered properly with APNIC (could it be cross-registered with another RIR? Well it's not with ARIN who'd be the local.) But I do see this block in global bgp tables so it wasnt like someone decided to use 10.10.10/24 or 1.2.3/24 in their routing infrastructure. They're actually announcing; sh ip bg 103.206.16.0 ends in a path with 394786 135022 looking up 394786 I see avetria networks. looking up 135022 I see nothing at ARIN. At APNIC I get as-block: AS134557 - AS135580 descr: APNIC ASN block remarks: These AS numbers are further assigned by APNIC remarks: to APNIC members and end-users in the APNIC region but nothing more specific. However, this does show up in radb as avetria networks as well. (and various geolocate DBs put it in Melbourn.au though i know it's in use in Kitchener ontario). So what's not matching up here? /kc -- Ken Chase - math(a)sizone.org Guelph Ontario

3 2

PeeringDB Product Committee Charter Survey / NANOG
by Arnold Nipper 29 Sep '16

29 Sep '16

Hello PeeringDB users / hello NANOG, the PeeringDB Product Committee (PC, [0]) is charged with steering the future product development and running the market outreach efforts to continuously improve the value that PeeringDB delivers to the networks registered with PeeringDB, and the broader community. We're looking for feedback and input from the community on our charter proposal. Please take this short survey [1]. Your input and comments are appreciated! [0] http://docs.peeringdb.com/gov/ [1] https://www.surveymonkey.com/r/JN36DT2 Greetings Arnold -- Arnold Nipper email: arnold(a)nipper.de phone: +49 6224 5593407 2 mobile: +49 172 2650958 fax: +49 6224 5593407 9

1 0

Go Daddy contact
by Feldman, Mark 29 Sep '16

29 Sep '16

Can someone from Go Daddy contact me off-list about a shared customer issue? Mark Comcast DNS

1 0

Re: BCP38 adoption "incentives"?
by larrysheldon＠cox.net 29 Sep '16

29 Sep '16

---- Alain Hebert <ahebert(a)pubnix.net> wrote: > Do not forget the "NRA" ways. I do not understand the "NRA" reference.

1 0

contact @ detroit pistons IT/network org?
by david raistrick 28 Sep '16

28 Sep '16

by chance - anyone have a clueful contact at the detroit pistons who can help resolve an https MITM proxy problem? (likely a misconfigured watchguard.) trying to diagnose a proxy level certificate problem through a management level proxy is less than fun.....

1 0

CDN Overload?
by Mike Hammett 28 Sep '16

28 Sep '16

I participate on a few other mailing lists focused on eyeball networks. For a couple years I've been hearing complaints from this CDN or that CDN was behaving badly. It's been severely ramping up the past few months. There have been some wild allegations, but I would like to develop a bit more standardized evidence collection. Initially LimeLight was the only culprit, but recently it has been Microsoft as well. I'm not sure if there have been any others. The principal complaint is that upstream of whatever is doing the rate limiting for a given customer there is significantly more capacity being utilized than the customer has purchased. This could happen briefly as TCP adjusts to the capacity limitation, but in some situations this has persisted for days at a time. I'll list out a few situations as best as I can recall them. Some of these may even be merges of a couple situations. The point is to show the general issue and develop a better process for collecting what exactly is happening at the time and how to address it. One situation had approximately 45 megabit/s of capacity being used up by a customer that had a 1.5 megabit/s plan. All other traffic normally held itself within the 1.5 megabit/s, but this particular CDN sent excessively more for extended periods of time. An often occurrence has someone with a single digit megabit/s limitation consuming 2x - 3x more than their plan on the other side of the rate limiter. Last month on my own network I saw someone with 2x - 3x being consumed upstream and they had *190* connections downloading said data from Microsoft. The past week or two I've been hearing of people only having a single connection downloading at more than their plan rate. These situations effectively shut out all other Internet traffic to that customer or even portion of the network for low capacity NLOS areas. It's a DoS caused by downloads. What happened to the days of MS BITS and you didn't even notice the download happening? A lot of these guys think that the CDNs are just a pile of dicks looking to ruin everyone's day and I'm certain that there are at least a couple people at each CDN that aren't that way. ;-) Lots of rambling, sure. What do I need to have these guys collect as evidence of a problem and who should they send it to? ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP

12 24

Re: Krebs on Security booted off Akamai network after DDoS attack proves pricey
by Alexander Maassen 28 Sep '16

28 Sep '16

If those where in fact non-spoofed sources, then i am surely interested in getting that list in order to put it into my dnsbl (dronebl). So if someone has it, or can tell me who to contact. Feel free to provide me with it offlist. Especially if this botnet uses one of the many irc networks (like undernet) that is utilizing the dnsbl list and the cc is harbored there, it might help. Also, most 'admins' only start realizing something is wrong in their network once their precious bizmail won't arrive at clients because their infected ip is listed and the remote mx refuses the mail because of the listing. Kind regards, Alexander Maassen - Technical Maintenance Engineer Parkstad Support BV- Maintainer DroneBL- Peplink Certified Engineer -------- Oorspronkelijk bericht --------Van: Hugo Slabbert <hugo(a)slabnet.com> Datum: 26-09-16 05:54 (GMT+01:00) Aan: "John R. Levine" <johnl(a)iecc.com> Cc: nanog(a)nanog.org Onderwerp: Re: Krebs on Security booted off Akamai network after DDoS attack proves pricey On Sun 2016-Sep-25 17:01:55 -0400, John R. Levine <johnl(a)iecc.com> wrote: >>https://www.internetsociety.org/sites/default/files/01_5.pdf >> >>The attack is triggered by a few spoofs somewhere in the world. It is not >>feasible to stop this. > >That paper is about reflection attacks. From what I've read, this was >not a reflection attack. The IoT devices are infected with botware >which sends attack traffic directly. Address spoofing is not particularly >useful for controlling botnets. But that's not only remaining use of source address spoofing in direct attacks, no? Even if reflection and amplification are not used, spoofing can still be used for obfuscation. >For example, the Conficker botnet generated pseudo-random domain names >where the bots looked for control traffic. > >>Please see https://www.ietf.org/rfc/rfc6561.txt > >Uh, yes, we're familiar with that. We even know the people who wrote >it. It could use an update for IoT since I get the impression that in >many cases the only way for a nontechnical user to fix the infection >is to throw the device away. > >Regards, >John Levine, johnl(a)iecc.com, Primary Perpetrator of "The Internet for Dummies", >Please consider the environment before reading this e-mail. https://jl.ly -- Hugo Slabbert | email, xmpp/jabber: hugo(a)slabnet.com pgp key: B178313E | also on Signal

1 0