August 2004 - Test - lists.nanog.org

RE: BGP-based blackholing/hijacking patented in Australia?
by Michel Py 14 Aug '04

14 Aug '04

> Niels Bakker wrote: > Do you propose blocking goatse/tubgirl as well? The > same reasoning can apply to those sites. No, and you are comparing apples to oranges. As far as I know, neither goatse nor tubgirl tried to phish my password, SSN, or PIN (or I am missing something?) OTOH, I have received phish in my inbox asking me to update my paypal info. <me puts the devil's advocate suit on one more time> If more people had seen goatse and tubgirl, there would be more laws and legislation making it illegal. Especially in the Hypocritical Puritanical States of America. </me puts the devil's advocate suit on one more time> > Christopher L. Morrow wrote: > in general, it's my belief, that folks using the web should > make that censorship decision for themselves, gov'ts or ISP's > shouldn't make that call. Unfortunately, gov'ts often like to > impose their will's on their citizens. I agree. Although I personally find some stuff disgusting, I prefer freedom of speech to censorship. That being said, phishing is not about freedom of speech. I would oppose blocking goatse/tubgirl but I do not oppose blocking phishing. However, the issue I see with this redirection stuff is that what it does is to redirect surfers from goatse to tubgirl (or the other way around, depending on which way you voted, perverts). The wrong part is the redirection, not the content. Michel.

2 1

Re: great networks
by Valdis.Kletnieks＠vt.edu 13 Aug '04

13 Aug '04

On Fri, 13 Aug 2004 05:38:02 -0000, bmanning(a)vacation.karoshi.com said: > > I have the responsibility of buidling a great network team for > > international /domestic projects and I am looking for quality networking guys > > to work for me. If you are based out of India or in the US, please do get in > > touch with me offline > touch w/ whom? In touch with the guy trying to build a "great" networking team when currently they're outsourcing their e-mail to Yahoo.. ;)

1 0

Re: isn't "...isn't perfect, but it's something now"
by Dave Crocker 13 Aug '04

13 Aug '04

Folks, >>There is a proposal that should interest you. It is called Bounce Tag >>Address Validation By Dave Crocker. >>http://www.brandenburg.com/specifications/draft-crocker-marid-batv-00-06dc.… >>This proposal is now in the IETF MASS WG. TH> There was a BoF called MASS held at the recent IETF meetings in San Diego; TH> it has not yet been approved as a working group and no charter has been TH> reviewed by the IESG. While I believe the work on BATV is interesting, TH> I am not sure gating it on the approval of MASS is a good idea. and boy oh boy do i agree with you! however, the description of BATV as a "proposal" is a non-trivial point. The document outlines ideas but there is not yet a serious, detailed specification. (it is almost complete, of course, but that never counts until it is released.) At any rate, it will be entirely possible to use the 'private' mode of BATV privately, without requiring or expecting broad implementation. d/ ps. my original posting was not an indirect attempt to promote any specification i am working on. it was merely a direct attempt to encourage folks to consider the strategic issues more. -- Dave Crocker <dcrocker-at-brandenburg-dot-com> Brandenburg InternetWorking <www.brandenburg.com> Sunnyvale, CA USA <tel:+1.408.246.8253>

1 0

Re: That MIT paper
by Paul Vixie 13 Aug '04

13 Aug '04

what i meant by "act globally, think locally" in connection with That MIT Paper is that the caching effects seen at mit are at best representative of that part of mit's campus for that week, and that even a variance of 1% in caching effectiveness at MIT that's due to generally high or low TTL's (on A, or MX, or any other kind of data) becomes a huge factor in f-root's load, since MIT's load is only one drop in a larger ocean. see duane's paper, which is more of a "think globally, act locally" kind of thing. how much of the measured traffic was due to bad logic in caching/forwarding servers, or in clients? how will high and low ttl's affect bad logic that's known to be in wide deployment? what if 20,000 enterprise networks the size of MIT all saw a 1% decrease in caching effectiveness due to generally low TTL's? (what if a general decline in TTL's resulted from publication of That MIT Paper?) here's a snapshot of f-root's life. That MIT Paper not only fails to address it, and fails to take it into account, it fails to identify the global characteristic of the variables under study. caching performance is not simply a local issue. everyone connected to the internet acts globally. it is wildly foolish to think locally. 16:44:35.118922 208.139.64.98.12978 > 192.5.5.241.53: 16218 AAAA? H.ROOT-SERVERS.NET. (36) 16:44:35.121171 208.139.64.98.12978 > 192.5.5.241.53: 10080 A6? H.ROOT-SERVERS.NET. (36) 16:44:35.124668 208.139.64.98.12978 > 192.5.5.241.53: 1902 AAAA? C.ROOT-SERVERS.NET. (36) 16:44:35.127544 208.139.64.98.12978 > 192.5.5.241.53: 10098 AAAA? G.ROOT-SERVERS.NET. (36) 16:44:35.130185 208.139.64.98.12978 > 192.5.5.241.53: 6010 A6? C.ROOT-SERVERS.NET. (36) 16:44:35.133828 208.139.64.98.12978 > 192.5.5.241.53: 1920 A6? G.ROOT-SERVERS.NET. (36) 16:44:35.136286 208.139.64.98.12978 > 192.5.5.241.53: 12169 AAAA? F.ROOT-SERVERS.NET. (36) 16:44:35.139433 208.139.64.98.12978 > 192.5.5.241.53: 3988 A6? F.ROOT-SERVERS.NET. (36) 16:44:35.142324 208.139.64.98.12978 > 192.5.5.241.53: 10140 A6? B.ROOT-SERVERS.NET. (36) 16:44:35.145453 208.139.64.98.12978 > 192.5.5.241.53: 14244 AAAA? B.ROOT-SERVERS.NET. (36) 16:44:35.149344 208.139.64.98.12978 > 192.5.5.241.53: 16297 A6? J.ROOT-SERVERS.NET. (36) 16:44:35.151674 208.139.64.98.12978 > 192.5.5.241.53: 1968 AAAA? J.ROOT-SERVERS.NET. (36)

9 16

Weekly Routing Table Report
by Routing Table Analysis 13 Aug '04

13 Aug '04

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 14 Aug, 2004 Analysis Summary ---------------- BGP routing table entries examined: 143639 Prefixes after maximum aggregation: 85667 Unique aggregates announced to Internet: 69197 Total ASes present in the Internet Routing Table: 17769 Origin-only ASes present in the Internet Routing Table: 15409 Origin ASes announcing only one prefix: 7231 Transit ASes present in the Internet Routing Table: 2360 Transit-only ASes present in the Internet Routing Table: 75 Average AS path length visible in the Internet Routing Table: 4.7 Max AS path length visible: 26 Prefixes from unregistered ASNs in the Routing Table: 7 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 16 Number of addresses announced to Internet: 1327112864 Equivalent to 79 /8s, 26 /16s and 34 /24s Percentage of available address space announced: 35.8 Percentage of allocated address space announced: 57.9 Percentage of available address space allocated: 61.9 Total number of prefixes smaller than registry allocations: 66014 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 27629 Total APNIC prefixes after maximum aggregation: 13984 Prefixes being announced from the APNIC address blocks: 25856 Unique aggregates announced from the APNIC address blocks: 14097 APNIC Region origin ASes present in the Internet Routing Table: 2100 APNIC Region origin ASes announcing only one prefix: 625 APNIC Region transit ASes present in the Internet Routing Table: 330 Average APNIC Region AS path length visible: 4.8 Max APNIC Region AS path length visible: 16 Number of APNIC addresses announced to Internet: 156113664 Equivalent to 9 /8s, 78 /16s and 27 /24s Percentage of available APNIC address space announced: 71.2 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 23552-24575 APNIC Address Blocks 58/7, 60/7, 202/7, 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 82019 Total ARIN prefixes after maximum aggregation: 49941 Prefixes being announced from the ARIN address blocks: 63508 Unique aggregates announced from the ARIN address blocks: 22172 ARIN Region origin ASes present in the Internet Routing Table: 9384 ARIN Region origin ASes announcing only one prefix: 3374 ARIN Region transit ASes present in the Internet Routing Table: 927 Average ARIN Region AS path length visible: 4.5 Max ARIN Region AS path length visible: 16 Number of ARIN addresses announced to Internet: 229403296 Equivalent to 13 /8s, 172 /16s and 106 /24s Percentage of available ARIN address space announced: 68.4 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647,29695-30719, 31744-33791 ARIN Address Blocks 24/8, 63/8, 64/6, 68/7, 70/7, 72/8, 198/7, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 26550 Total RIPE prefixes after maximum aggregation: 18807 Prefixes being announced from the RIPE address blocks: 23326 Unique aggregates announced from the RIPE address blocks: 15585 RIPE Region origin ASes present in the Internet Routing Table: 5734 RIPE Region origin ASes announcing only one prefix: 3097 RIPE Region transit ASes present in the Internet Routing Table: 985 Average RIPE Region AS path length visible: 5.3 Max RIPE Region AS path length visible: 26 Number of RIPE addresses announced to Internet: 168878656 Equivalent to 10 /8s, 16 /16s and 226 /24s Percentage of available RIPE address space announced: 59.2 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-34815 RIPE Address Blocks 62/8, 80/5, 88/8, 188/8, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 6257 Total LACNIC prefixes after maximum aggregation: 2257 Prefixes being announced from the LACNIC address blocks: 6026 Unique aggregates announced from the LACNIC address blocks: 3608 LACNIC Region origin ASes present in the Internet Routing Table: 387 LACNIC Region origin ASes announcing only one prefix: 114 LACNIC Region transit ASes present in the Internet Routing Table: 75 Average LACNIC Region AS path length visible: 5.1 Max LACNIC Region AS path length visible: 17 Number of LACNIC addresses announced to Internet: 15517440 Equivalent to 0 /8s, 236 /16s and 199 /24s Percentage of available LACNIC address space announced: 46.2 LACNIC AS Blocks 26592-26623, 27648-28671 LACNIC Address Blocks 200/7 Emerging AfriNIC Region Analysis Summary ---------------------------------------- Prefixes being announced by AfriNIC Region ASes: 1177 Total AfriNIC prefixes after maximum aggregation: 678 Prefixes being announced from the AfriNIC address blocks: 824 Unique aggregates announced from the AfriNIC address blocks: 653 AfriNIC Region origin ASes present in the Internet Routing Table: 91 AfriNIC Region origin ASes announcing only one prefix: 21 AfriNIC Region transit ASes present in the Internet Routing Table: 12 Average AfriNIC Region AS path length visible: 4.9 Max AfriNIC Region AS path length visible: 15 Number of AfriNIC addresses announced to Internet: 1987328 Equivalent to 0 /8s, 30 /16s and 83 /24s Percentage of available AfriNIC address space announced: 11.8 AfriNIC AS Blocks <none> AfriNIC Address Blocks 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 828 4161 155 Data Communications Bureau 1221 813 1184 586 Telstra Pty Ltd 4766 549 2897 264 Korea Internet Exchange for " 9583 520 40 106 Satyam Infoway Ltd., 4755 365 133 49 Videsh Sanchar Nigam Ltd. Aut 9929 360 161 32 China Netcom Corp. 9443 354 69 80 Primus Telecommunications 2907 352 1840 326 SINET Japan 17676 342 5100 34 XTAGE CORPORATION 17557 327 23 164 Pakistan Telecom 703 317 342 244 UUNET 2764 287 275 234 connect.com.au pty ltd 7474 264 268 202 Optus Communications Pty Ltd 17633 241 56 6 ASN for Shandong Provincial N 9942 236 71 129 COMindico Australia 4802 229 25 138 Wantree Development 9800 226 370 64 CHINA UNICOM 9498 220 49 49 BHARTI BT INTERNET LTD. 10036 202 18 183 C&M Communication Co. Ltd. 4837 196 2023 106 chinanet IDC center beijing n ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1390 6802 964 AT&T WorldNet Services 701 1285 8408 927 UUNET Technologies, Inc. 6347 947 390 100 SAVVIS Communications Corpora 1239 934 2872 624 Sprint 6197 777 524 298 BellSouth Network Solutions, 4323 775 614 213 Time Warner Telecom 18566 740 193 8 Covad Communications 209 613 3430 496 Qwest 721 588 20712 272 DLA Systems Automation Center 20115 569 378 294 Charter Communications 3356 558 10946 430 Level 3 Communications, LLC 852 510 1142 398 Telus Advanced Communications 7843 498 681 115 Adelphia Corp. 6198 452 429 204 BellSouth Network Solutions, 705 430 163 272 UUNET Technologies, Inc. 7132 430 8045 372 SBC Internet Services 2386 410 534 231 AT&T Data Communications Serv 22773 401 796 66 Cox Communications, Inc. Atla 4355 388 323 99 EarthLink, Inc. 376 385 363 113 Reseau Interordinateurs Scien RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 650 2020 541 UUNET - Commercial IP service 3320 301 2469 238 Deutsche Telekom AG 3301 282 1098 271 TeliaNet Sweden 8220 277 448 264 COLT Internet - International 680 244 2025 239 DFN-IP service G-WiN 3246 216 484 213 Song Networks 13083 216 51 8 Mannesmann Datenverarbeitung 1257 215 747 184 SWIPnet Swedish IP Network 5515 199 842 145 Sonera Solution Autonomous Sy 8708 196 113 176 Romania Data Systems S.A. 3215 182 892 77 France Telecom Transpac 786 177 1794 177 The JANET IP Service 25186 165 155 113 France Telecom Transpac's Tra 5400 152 208 123 BT Ignite European Backbone 6746 152 29 129 Dynamic Network Technologies, 719 150 288 102 LANLINK autonomous system 3269 143 1195 65 TELECOM ITALIA 8866 134 15 14 Bulgarian Telecommunication C 3303 130 609 129 Swisscom Ltd 12302 127 18 33 MobiFon S.A. LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 11172 357 100 54 Servicios Alestra S.A de C.V 6140 334 137 64 ImpSat 8151 285 391 131 UniNet S.A. de C.V. 16814 206 13 7 NSS, S.A. 6147 188 86 20 Telefonica Del Peru 11664 143 11 22 Keytech SA 6505 137 90 94 Global One Communicaoes Ltda 6503 128 203 86 AVANTEL, S.A. 7303 121 55 19 Telecom Argentina Stet-France 11992 91 9 29 Integrated Systems 11556 89 51 11 Cable-Wireless Panama 14420 82 6 32 ANDINATEL S.A. 6535 81 5 16 Chilesat Servicios Empresari 11311 79 7 19 Sinectis S.A. 15311 76 21 36 Telefonica Empresas 5639 71 8 8 Telecommunications Services o 4270 70 18 9 Red de Interconexion Universi 14117 69 5 4 Telefonica del Sur S.A. 10292 67 6 26 TELECOMMUNICATIONS OF JAMAICA 11340 67 5 36 Red Universitaria Nacional AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 253 632 220 The Internet Solution 5536 113 16 4 Internet Egypt Network 2018 94 297 92 Tertiary Education Network 2905 92 276 81 The Internetworking Company o 11845 40 9 11 Data Pro Business Online 9129 32 3 4 UUNET Kenya 24835 32 18 5 RAYA Telecom - Egypt 6713 26 38 9 Itissalat Al-MAGHRIB 8524 26 2 4 AUCEGYPT Autonomous System 5713 25 125 23 Telkom SA Ltd 14988 25 16 1 Botswana Telecommunications C 16637 24 9 19 Johnnic e-Ventures 12455 22 4 2 Jambonet Autonomous system 10798 18 1 12 Standard Bank of South Africa 8346 15 7 14 SONATEL-AS Autonomous System 12258 15 3 10 Vodacom Internet Company 15706 15 4 2 Sudatel Internet Exchange Aut 21491 14 1 3 UTL On-line is RF broadband I 15808 13 1 2 Communication Solutions Ltd i 17148 13 1 7 First National Bank Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 6347 947 847 SAVVIS Communications Corpora 18566 740 732 Covad Communications 4134 828 673 Data Communications Bureau 4323 775 562 Time Warner Telecom 6197 777 479 BellSouth Network Solutions, 9583 520 414 Satyam Infoway Ltd., 7843 498 383 Adelphia Corp. 5668 383 365 Century Telephone 701 1285 358 UUNET Technologies, Inc. 22773 401 335 Cox Communications, Inc. Atla 27364 350 331 Armstrong Cable Services 22909 360 330 Comcast Cable Corporation 9929 360 328 China Netcom Corp. 6467 354 322 E.Spire Communications, Inc. 721 588 316 DLA Systems Automation Center 4755 365 316 Videsh Sanchar Nigam Ltd. Aut 1239 934 310 Sprint 17676 342 308 XTAGE CORPORATION 11172 357 303 Servicios Alestra S.A de C.V 4355 388 289 EarthLink, Inc. List of Unregistered ASNs (Global) ---------------------------------- Bad AS Designation Network Transit AS Description 64606 PRIVATE 80.255.192.0/21 2529 Demon Internet 64606 PRIVATE 80.255.192.0/20 2529 Demon Internet 64606 PRIVATE 80.255.200.0/21 2529 Demon Internet 65217 PRIVATE 128.101.58.0/28 217 University of Minnes 1877 UNALLOCATED 192.108.199.0/24 1876 Southern Methodist U 63330 RESERVED 213.8.224.0/23 5486 Euronet Digital Comm 63330 RESERVED 213.8.226.0/23 5486 Euronet Digital Comm Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 192.43.230.0/24 4738 South Australian Academic Res 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.83.16.0/20 5515 Sonera Solution Autonomous Sy 192.83.32.0/19 5515 Sonera Solution Autonomous Sy 192.83.96.0/22 5515 Sonera Solution Autonomous Sy 192.83.100.0/24 5515 Sonera Solution Autonomous Sy 192.84.205.0/24 719 LANLINK autonomous system 192.119.135.0/24 270 NASA 192.135.50.0/24 7018 AT&T WorldNet Services 192.136.79.0/24 719 LANLINK autonomous system 192.172.0.0/19 721 DLA Systems Automation Center 192.172.11.0/24 721 DLA Systems Automation Center Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:3 /10:6 /11:15 /12:62 /13:129 /14:303 /15:536 /16:7953 /17:2140 /18:3729 /19:9679 /20:10147 /21:7512 /22:10420 /23:12048 /24:78245 /25:227 /26:193 /27:99 /28:43 /29:18 /30:76 /31:0 /32:37 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 6347 729 947 SAVVIS Communications Corpora 18566 723 740 Covad Communications 6197 595 777 BellSouth Network Solutions, 7018 532 1390 AT&T WorldNet Services 702 406 650 UUNET - Commercial IP service 701 365 1285 UUNET Technologies, Inc. 9583 365 520 Satyam Infoway Ltd., 1239 364 934 Sprint 4766 357 549 Korea Internet Exchange for " 27364 336 350 Armstrong Cable Services 5668 335 383 Century Telephone 6198 331 452 BellSouth Network Solutions, 20115 301 569 Charter Communications 9929 288 360 China Netcom Corp. 6467 259 354 E.Spire Communications, Inc. 6517 259 286 Yipes Communications, Inc. 13609 258 301 Choice One Communications Inc 3320 248 301 Deutsche Telekom AG 25844 245 245 Skadden, Arps, Slate, Meagher 690 241 277 Merit Network Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:3 8:2 12:841 13:1 15:5 16:2 17:3 20:9 24:717 32:66 33:2 38:79 40:54 44:4 55:1 56:3 57:16 60:6 61:455 62:513 63:1852 64:2294 65:2037 66:2446 67:352 68:544 69:692 70:64 80:534 81:360 82:194 83:122 84:17 128:88 129:172 130:86 131:178 132:23 134:187 135:17 136:177 137:51 138:169 139:35 140:156 141:104 142:120 143:58 144:99 145:42 146:289 147:95 148:419 149:109 150:86 151:70 152:163 153:67 154:2 155:129 156:57 157:69 158:139 159:151 160:54 161:75 162:390 163:79 164:179 165:161 166:113 167:219 168:262 169:114 170:279 171:9 192:5570 193:2857 194:2082 195:1455 196:583 198:3649 199:3245 200:3690 201:9 202:4779 203:5644 204:3124 205:2044 206:2260 207:2487 208:2153 209:3033 210:1439 211:575 212:988 213:1188 214:85 215:30 216:3776 217:949 218:182 219:127 220:245 221:31 222:135 End of report

1 0

RE: BGP-based blackholing/hijacking patented in Australia?
by Michel Py 13 Aug '04

13 Aug '04

> william(at)elan.net wrote: > The only imlementation change to do this would be to provide > a link from the webpage where user might have been redirected > to the original website they wanted to access But the user never wanted to access the site in the first place; lots of these phishing scams either promise a free something or say that the account will be de-activated, none of which exist. The reason to visit a web site never existed in reality. As far as the HTTP 1.1 issue for legit web sites hosted on the same IP, although I do agree that a link to the original page would be nice, it still is an un-acceptable disruption IMHO. Besides, it might prove difficult to provide, as the HTML content would need to be dynamic based on the domain, we're talking decapsulating the traffic to extract the domain name and embed it into the HTML code to provide the link. > Stephen J. Wilcox > Transparent caching has done this for a long time, the difference > is it only works on traffic passing through the adjacent router, > with this you can pull traffic from all over your network back > to a single cache But this is not caching: the content is not the same as the original. Michel.

3 2

The Cidr Report
by cidr-report＠potaroo.net 13 Aug '04

13 Aug '04

This report has been generated at Fri Aug 13 21:44:11 2004 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 06-08-04 140324 96514 07-08-04 140408 96388 08-08-04 140507 96488 09-08-04 140589 96531 10-08-04 140606 96703 11-08-04 140821 96371 12-08-04 140438 96322 13-08-04 140492 96442 AS Summary 17689 Number of ASes in routing system 7224 Number of ASes announcing only one prefix 1363 Largest number of prefixes announced by an AS AS7018 : ATTW AT&T WorldNet Services 85426944 Largest address span announced by an AS (/32s) AS721 : DNIC DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 13Aug04 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 140567 96410 44157 31.4% All ASes AS6347 943 103 840 89.1% SAVV SAVVIS Communications Corporation AS18566 701 9 692 98.7% CVAD Covad Communications AS4134 777 173 604 77.7% CHINANET-BACKBONE No.31,Jin-rong Street AS4323 775 214 561 72.4% TWTC Time Warner Telecom AS7018 1363 945 418 30.7% ATTW AT&T WorldNet Services AS7843 498 115 383 76.9% ADELPH-13 Adelphia Corp. AS6197 774 396 378 48.8% BNS-14 BellSouth Network Solutions, Inc AS701 1267 918 349 27.5% UU UUNET Technologies, Inc. AS9583 520 181 339 65.2% SATYAMNET-AS Satyam Infoway Ltd., AS22773 401 71 330 82.3% CXAB Cox Communications Inc. Atlanta AS6467 353 31 322 91.2% ACSI e.spire Communications, Inc. AS22909 360 38 322 89.4% CMCS Comcast Cable Communications, Inc. AS9929 350 32 318 90.9% CNCNET-CN China Netcom Corp. AS27364 350 36 314 89.7% ARMC Armstrong Cable Services AS1239 947 635 312 32.9% SPRN Sprint AS11172 354 52 302 85.3% Alestra AS17676 340 38 302 88.8% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS4355 380 99 281 73.9% ERSD EARTHLINK, INC AS6478 333 58 275 82.6% ATTW AT&T WorldNet Services AS4766 537 265 272 50.7% KIXS-AS-KR Korea Telecom AS9443 358 109 249 69.6% INTERNETPRIMUS-AS-AP Primus Telecommunications AS14654 253 10 243 96.0% WAYPOR-3 Wayport AS17633 241 6 235 97.5% CHINATELECOM-SD-AS-AP ASN for Shandong Provincial Net of CT AS6198 448 217 231 51.6% BNS-14 BellSouth Network Solutions, Inc AS25844 244 15 229 93.9% SASMFL-2 Skadden, Arps, Slate, Meagher & Flom LLP AS6140 369 154 215 58.3% IMPSA ImpSat AS22291 264 66 198 75.0% CC04 Charter Communications AS6327 223 28 195 87.4% SHAWC-2 Shaw Communications Inc. AS5668 384 194 190 49.5% CIH-12 CenturyTel Internet Holdings, Inc. AS721 598 424 174 29.1% DNIC DoD Network Information Center Total 15705 5632 10073 64.1% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 AHSICHCL Andara High Speed Internet c/o Halifax Cable Ltd. 24.246.0.0/17 AS7018 ATTW AT&T WorldNet Services 24.246.38.0/24 AS25994 NPGCAB NPG Cable, INC 24.246.128.0/18 AS7018 ATTW AT&T WorldNet Services 64.46.4.0/22 AS11711 TULARO TULAROSA COMMUNICATIONS 64.46.12.0/24 AS7850 IHIGHW iHighway.net, Inc. 64.46.27.0/24 AS8674 NETNOD-IX Netnod Internet Exchange Sverige AB 64.46.34.0/24 AS3408 64.46.63.0/24 AS7850 IHIGHW iHighway.net, Inc. 64.83.96.0/19 AS22934 EBNI E Broadband Now Inc. 66.114.0.0/19 AS16526 BIRCHT Birch Telecom, Inc. 69.26.32.0/19 AS17307 VIRTEL-15 Virtela Communications 132.0.0.0/10 AS721 DNIC DoD Network Information Center 137.0.0.0/13 AS721 DNIC DoD Network Information Center 138.136.0.0/13 AS721 DNIC DoD Network Information Center 158.0.0.0/13 AS721 DNIC DoD Network Information Center 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.30.127.0/24 AS719 LANLINK Elisa Oyj 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.43.230.0/24 AS4738 SAARDNET-AS South Australian Academic Research and Development Network 192.44.0.0/19 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 192.80.64.0/19 AS1 LVLT Level 3 Communications, Inc. 192.81.182.0/24 AS719 LANLINK Elisa Oyj 192.81.183.0/24 AS719 LANLINK Elisa Oyj 192.81.184.0/24 AS719 LANLINK Elisa Oyj 192.119.135.0/24 AS270 NASA National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS4004 GLOBALONE-EQUANT-UK Equant UK & Greece Autonomous System 192.135.50.0/24 AS7018 ATTW AT&T WorldNet Services 192.136.71.0/24 AS719 LANLINK Elisa Oyj 192.136.79.0/24 AS719 LANLINK Elisa Oyj 192.138.208.0/20 AS1 LVLT Level 3 Communications, Inc. 192.153.144.0/21 AS721 DNIC DoD Network Information Center 192.172.0.0/19 AS721 DNIC DoD Network Information Center 192.188.208.0/20 AS721 DNIC DoD Network Information Center 192.190.16.0/21 AS1 LVLT Level 3 Communications, Inc. 192.243.32.0/23 AS2044 PALINA Palin Aquisitions Inc. 198.23.26.0/24 AS4390 BELLAT-7 Bell Atlantic, Inc. 198.97.72.0/21 AS721 DNIC DoD Network Information Center 198.97.80.0/20 AS721 DNIC DoD Network Information Center 198.97.88.0/24 AS89 NUSC-1 Naval Underwater Systems Center 198.97.240.0/20 AS721 DNIC DoD Network Information Center 198.97.247.0/24 AS3475 DEPART-52 Department of the Navy 198.101.4.0/22 AS721 DNIC DoD Network Information Center 198.136.32.0/20 AS19329 MCBCC Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY CityNet, Inc. 198.161.87.0/24 AS6539 GTGR GT Group Telecom Services Corp. 198.161.165.0/24 AS852 AGTA Telus Advanced Communications 198.163.155.0/24 AS684 MRN Manitoba Regional Network 198.167.0.0/16 AS7456 INS-51 Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 UU UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASK SaskTel 198.232.133.0/24 AS23075 SKOTOS Skotos Tech, Inc 199.10.0.0/16 AS721 DNIC DoD Network Information Center 199.60.0.0/20 AS271 UBC-3 University of British Columbia 199.96.44.0/23 AS19092 360NE-1 360Networks (USA) Inc. 199.96.46.0/24 AS19092 360NE-1 360Networks (USA) Inc. 199.114.0.0/18 AS568 DISOUN DISO-UNRRA 199.114.0.0/21 AS721 DNIC DoD Network Information Center 199.114.128.0/18 AS721 DNIC DoD Network Information Center 199.114.130.0/24 AS721 DNIC DoD Network Information Center 199.114.132.0/24 AS721 DNIC DoD Network Information Center 199.114.134.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.136.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.138.0/24 AS721 DNIC DoD Network Information Center 199.114.140.0/24 AS3544 DISAUN DISA/UNRRA 199.114.142.0/24 AS721 DNIC DoD Network Information Center 199.114.144.0/24 AS721 DNIC DoD Network Information Center 199.114.148.0/24 AS721 DNIC DoD Network Information Center 199.114.150.0/24 AS721 DNIC DoD Network Information Center 199.114.152.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.154.0/24 AS1733 ADP-41 AF DDN PMO 199.114.156.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.160.0/24 AS1733 ADP-41 AF DDN PMO 199.120.32.0/19 AS16582 NXLI NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS721 DNIC DoD Network Information Center 199.123.0.0/18 AS721 DNIC DoD Network Information Center 199.123.16.0/20 AS721 DNIC DoD Network Information Center 199.123.80.0/21 AS721 DNIC DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST IQuest Internet 199.197.8.0/22 AS21814 PARSON-18 Parsons Corp. 199.202.0.0/16 AS701 UU UUNET Technologies, Inc. 202.47.1.0/24 AS7491 PI-PH-AS-AP PI-PHILIPINES 202.70.28.0/24 AS4515 ERX-STAR Star Internet Services Ltd. 202.73.128.0/22 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.81.96.0/19 AS10113 DATAFAST-AP DATAFAST TELECOMMUNICATIONS LTD 202.81.109.0/24 AS7657 TIG-US-PAS-AP The Internet Group Limited 202.81.121.0/24 AS10113 DATAFAST-AP DATAFAST TELECOMMUNICATIONS LTD 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.133.3.0/24 AS9335 CIP-JAPAN-AS-AP ATT IPlus 202.164.224.0/19 AS7599 IPXC-AS-AP IP Exchange 203.32.4.0/23 AS7617 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.84.145.0/24 AS4637 REACH Reach Network Border AS 203.84.146.0/24 AS4637 REACH Reach Network Border AS 203.84.192.0/19 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 203.84.192.0/20 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 203.84.208.0/20 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 203.210.69.0/24 AS17536 PRODIGY-AS-AP Prodidgy Telecommunications 204.154.125.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBI Exobit Networks Inc. 204.196.0.0/14 AS1 LVLT Level 3 Communications, Inc. 205.150.0.0/15 AS701 UU UUNET Technologies, Inc. 205.159.72.0/24 AS1660 ANSCOM-5 ANS Communications 206.167.57.0/24 AS376 RISQR-3 Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 206.251.69.0/24 AS27429 TIL-33 Telesat International Ltd. 206.253.190.0/23 AS8123 POLYBA Polybase 207.231.96.0/19 AS11194 NUNETI NuNet Inc 208.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 209.172.0.0/18 AS7770 TRTI Triton Technologies, Inc. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.213.32.0/19 AS10629 INS-52 Inter-Pacific Network Services 209.213.50.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.51.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.55.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.56.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.251.0.0/19 AS11036 SISCOM-1 SISCOM, Inc 216.37.110.0/23 AS4264 CERFN California Education and Research Federation Network 216.96.128.0/18 AS7018 ATTW AT&T WorldNet Services 216.145.130.0/24 AS11937 TRXI TRX Inc. 216.145.132.0/24 AS11937 TRXI TRX Inc. 216.145.133.0/24 AS11937 TRXI TRX Inc. 216.145.134.0/24 AS11937 TRXI TRX Inc. 216.145.135.0/24 AS11937 TRXI TRX Inc. 216.145.156.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.158.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.176.0/21 AS20304 JIS-32 JVLNET Internet Services 216.145.177.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.178.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.184.0/21 AS10758 INWAVE INWave Internet, Inc 216.145.200.0/21 AS20304 JIS-32 JVLNET Internet Services 216.186.151.0/24 AS3356 LEVEL3 Level 3 Communications 216.186.152.0/21 AS3356 LEVEL3 Level 3 Communications 216.186.160.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.164.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.192.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.198.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.248.0/23 AS3356 LEVEL3 Level 3 Communications Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org swinog(a)swinog.ch

1 0

RE: BGP-based blackholing/hijacking patented in Australia?
by Michel Py 13 Aug '04

13 Aug '04

> Bevan Slattery wrote: > Just to ease peoples concerns, the patent has nothing > to do with blackholing. A brief description of the > way it works can be found here: I believe that I am not the only one that is concerned precisely because it is _not_ blackholing, it is hijacking, no matter how legitimate the reason. <me puts the devil's advocate suit on> To say it bluntly, it smells a lot like the illegitimate offspring of an RBL and Verisign's wildcard deal. The phishing con artists redirect the unsuspecting mark to a third-party site, and this stuff also redirects the unsuspecting mark to another page: > Where is the user re-routed to? If an end user is a victim of a scam > and is redirected via the ScamSlam system, then the page they are > redirected to is specified by the agency entering the scam data. Déjà vu: redirect the user's mistakes/stupidity to one's own business. What tells me that the agency is not the back office of the phishing scheme in the first place? Same as spyware: there is anti-spyware out there that deletes all the spyware installed by their competitors and conveniently "forgets" to detect or fix their own. And I also do see good opportunity for joe-jobs here: get some el-cheapo hosting on the hosting server that you want to take down, setup a fake phishing web page, then send phishing email and/or report the dummy phishing to the agency. The IP gets blacklisted and takes down thousands of web sites along with the one that bozo paid $10 one-time for. Gee, it costs less than a movie and popcorn. </me puts the devil's advocate suit on> Oh BTW, good luck trying to blacklist a large zombie pool that collectively hosts the phishing page and individually send their own address and listening port in the phishing email. Why phish on a single IP when one can phish distributed? Anyway, what's the difference with blackholing? The route-map sets the next-hop to a NAT box that dynamically binds the IP addresses contained in the BGP feed (instead of setting the next-hop to a blackhole)? BFD. Trying to patent the wheel is not good for credibility, nor is using the very same stinky methods as the scam artists. Michel.

2 1

Re: BGP-based blackholing/hijacking patented in Australia?
by Hank Nussbacher 13 Aug '04

13 Aug '04

At 01:41 PM 12-08-04 +0100, Stephen J. Wilcox wrote: >On Thu, 12 Aug 2004, Petri Helenius wrote: > > > We have had running code for this since early this year, so depending > on the > > date they filed, prior art exists well documented. (blueprints obviously > > predate running code) > >everyone has gone patent crazy, every time a new concept is developed some >company applies for patent. is this the future or rfcs then? No. This should be the future for patent hijacks: http://freepatentsonline.com/6293874.html -Hank >Steve

2 1

RE: BGP-based blackholing/hijacking patented in Australia?
by Michel Py 13 Aug '04

13 Aug '04

> Stephen J. Wilcox wrote: > This is not IP hijacking by any means, Mmmm. What tells you that these routes won't be announced to peers or won't leak? We are not supposed to see announcements for bogons nor for RFC1918 space, but we do. Thinking about it, I agree that "hijacking" is not the proper term though as it is generally understood as announcing/using a netblock that belongs to an entity long gone (preferably from the swamp, so one can try to modify everything possible in whois info and claim ownership) or is un-allocated. Would this be "kidnapping"? This is to blacklisting what wildcarding is to NXDOMAIN. If the domain does not exist, you get an error not the web page you get when it's wilcarded. If the IP is blackholed, you get an error not the web page you get when it's kidnapped. Michel.

2 1