January 2005 - Test - lists.nanog.org

Multicast and unicast delivery at NANOG 33
by Joel Jaeggli 30 Jan '05

30 Jan '05

Just an update. Coverage is planned for Sunday Jan 30 19:30 - 21:30 (PST) "Coordinating NANOG: Input From the Community." Merit will provide Real Netoworks streaming media for the NANOG meeting proper, see: http://www.nanog.org/mtg-0501/network.html#real >From the UO, NANOG will be multicast live using an ISMA MPEG-4 standard multicast stream using the mp3 audio codec at 250Kb/s. The stream should be of similar visual quality to the 1Mb/s MPEG-1 stream! Recommended free clients are Quicktime for Windows or Macintosh and MPlayer on Linux or *BSD. The VideoLAN client is able to play back the video and audio on all platforms. We will also be providing a unicast http based mp3 audio stream, playable in itunes and any http/icecast/shoutcast capable client. The multicast sources are: MPEG-4 (ISMA MPEG-4 250kb/s) (SDP FILE) http://videolab.uoregon.edu/events/nanog/nanog33-mpg4.sdp * Video IP Address: 224.2.174.81 * Video UDP Port: 51314 * Audio IP Address: 224.2.174.82 * Audio UDP Port: 28256 The unicast mp3 audio source is: http://tinder.uoregon.edu:8000/nanog33.mp3 for updated information see: http://videolab.uoregon.edu/events/nanog/nanog_33.html -- -------------------------------------------------------------------------- Joel Jaeggli Unix Consulting joelja(a)darkwing.uoregon.edu GPG Key Fingerprint: 5C6E 0104 BAF0 40B0 5BD3 C38B F000 35AB B67F 56B2

4 4

RE: Sunday Night NANOG Community Input Agenda (update)
by Malayter, Christopher 30 Jan '05

30 Jan '05

Good Evening, The conference will be IRC cast on EFNet #nanog-reform. Joe Provo will be the man at the keyboard. We will do our best to pass remote questions to the mic. -Chris -----Original Message----- From: Jared Mauch [mailto:jared@puck.nether.net] Sent: Monday, January 31, 2005 2:20 AM To: Joel Jaeggli Cc: Dave Crocker; Hannigan, Martin; 'nanog(a)merit.edu'; 'vixie(a)vix.com' Subject: Re: Sunday Night NANOG Community Input Agenda (update) On Sun, Jan 30, 2005 at 07:11:32PM -0500, Jared Mauch wrote: > > I'll post info on the bridge once we test it. > > there will be inoc-dba and pstn accessible information posted. > > codecs are limited to g711ulaw and g711alaw as i've not > got 729 licenses. > > we'll be testing in ~1 hr once the room is free i think. Ok, here's the info: INOC-DBA: 2914*0 PSTN: +1 214 413 1115 +1 408 263 1066 Once you call in, enter extension 4500 This is just a copy of the mp3 stream as we weren't able to connect directly in to the audio infra. - jared -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

1 0

Sunday Night NANOG Community Input Agenda (update)
by Hannigan, Martin 30 Jan '05

30 Jan '05

Here's a quick update: 1. Q&A has been moved to the end. 2. Introduction: Paul Vixie with Martin Hannigan, 5 min. 3. Overview, History, & Structure of NANOG: Betty Burke, 15 min. 4. Program Committee Review: Steve Feldman, 20 min. 5. Reform Proposal: Dan Golding et. al., 15 min. See the proposal at http://www.nanog-reform.org/ 6. Open Microphone: Attendees and possible remotes, 65 min. 7. Adjournment, Paul Vixie with Martin Hannigan The meeting will be web cast and a one-way conference bridge will be tentatively in operation. There will be an IRC channel with note takers for possible Q&A participation. Post Meeting Discussions Location: The Tilted Kilt http://www.harrahs.com/our_casinos/rlv/groups_mtgs/microsite/d4.htm (Space #45) - The dress code is NANOG casual If there's anything else, questions, etc., please reply off list and let us know. -M< -- Martin Hannigan (c) 617-388-2663 VeriSign, Inc. (w) 703-948-7018 Network Engineer IV Operations & Infrastructure hannigan(a)verisign.com

4 4

Re: Multicast and unicast delivery at NANOG 33
by Fergie (Paul Ferguson) 30 Jan '05

30 Jan '05

Well, I wanted to tune-in, but alas, see no link for the Real stream. - ferg -- Joel Jaeggli <joelja(a)darkwing.uoregon.edu> wrote: Just an update. Coverage is planned for Sunday Jan 30 19:30 - 21:30 (PST) "Coordinating NANOG: Input From the Community." Merit will provide Real Netoworks streaming media for the NANOG meeting proper, see: http://www.nanog.org/mtg-0501/network.html#real -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

2 1

drone armies C&C report - Jan/2005
by Gadi Evron 30 Jan '05

30 Jan '05

Below is a periodic public report from the drone armies / botnets research and mitigation mailing list. For this report it should be noted that we base our analysis on the data we have accumulated from various sources. According to our incomplete analysis of information we have thus far, we now publish two reports. The ISP's that are most often plagued with botnet C&C's (command & control) are, by the order listed: ---------------------------------- 1. AS21844 THEPL-1 THE PLANET 2. AS6517 YIPS Yipes Communications Inc 3. AS21840 SAGONE Sago Networks 4. AS4766 KIXS-AS-KR Korea Telecom 5. AS5731 ATTW AT&T WorldNet Services 6. AS25761 STAMIN-2 Staminus Communicatio 7. AS30083 SERVE-6 Server4You Inc. * We would gladly like to establish a trusted relationship with these and any organizations to help them in the future. The Trojan horses most used in botnets: --------------------------------------- 1. Korgobot. 2. SpyBot. 3. Optix Pro. 4. rBot. 5. Other SpyBot variants and strains (AgoBot, PhatBot, actual SDbots, etc.). Contact information: Hank Nussbacher <hank(a)mail.iucc.ac.il> Gadi Evron (as specified below) -- Gadi Evron, Information Security Manager, Project Tehila - Israeli Government Internet Security. Ministry of Finance, Israel. gadi(a)tehila.gov.il gadi(a)CERT.gov.il Office: +972-2-5317890 Fax: +972-2-5317801 http://www.tehila.gov.il The opinions, views, facts or anything else expressed in this email message are not necessarily those of the Israeli Government.

1 0

RE: Resilience: faults, causes, statistics, open issues
by András Császár (IJ/ETH) 28 Jan '05

28 Jan '05

Hi David, this is going to be very useful, I really appretiate it, thank you very much. Just some comments about the root causes of BGP related problems, maybe you find something useful from the research perspective, although probably this is not going to be new for you. I found a few author groups with very related and useful papers: - Tim Griffin and co. - Nick Feamster and co. - Jennifer Rexford and co. - Lixin Gao and co. These people often have joint publications but sometimes separate as well. Also, Craig Labovitz and co have some very useful papers in the area of routing convergence time. The IRTF also has some interesting, futuristic and somewhat visionary drafts about "Future Domain Routing". As I see things now, in case of BGP, routing divergence, configuration and policies have a very strong correlation. A high level conclusion (what you probably can expect from half year paper- and presentation-reading research) is that the first root cause of BGP problems is the absence of a >>widely deployed and practical<< formal language for policies. Since there is no formal language, there is no compiler, and so you have unwanted anomalies resulting from your config. My conclusion was that BGP has an analogy to software development: SW: Specification=>High-level formal language (e.g. C++)=>Low-level formal language (assembly, binary, etc.) Both steps can be called implementation or compiliation. The good thing here is that you have automated compilers for the second step, which is harder. BGP: Business relation=>Policies=>Router configuration First you implement your business relations, when you think out policies, but in the end you will have to implement/compile your policies as router configuration. The problem is, there is no automated compiler for the second step, since there is no formal policy language, and so verifcation is also very hard. As a result you may have configuration bugs or your config is not doing what you originally wanted to do, or you have inconsistency among your routers, etc. Of course, it is clear why such a formal language and compiler is not used in practice (different router vendors, different features, different capabilities, no standard interface, etc.), although there is, e.g., RPSL and the tools built upon RPSL. Lately, Griffin and co have begun thinking about a completely new policy language. The second root cause that I think can be somewhat separated is that there is no practically used central database about policies. You do not necessary know what your neighbour operators are doing (their configs and policies). As a result you may have external inconsistency (that may lead to divergence, "wedgies", etc.). Of course, here it is also clear why, e.g., IRRs are not used or not updated frequently (information hiding principle , which is actually the basis of the hierarchical domain structure of the internet). So, in the end, although we can possibly identify the root causes behind BGP problems, I'm not sure they can ever be fully ceased. OK, I can imagine a formal language and config compiler, and one can find verification tools as well, but I can hardly imagine e.g. the sharing of policies (although some papers write about methods how to infer the necessary knowledge from measurements). Thanks again for you help, András p.s. Sorry for the long mail :) :) ----Original Message---- From: David Andersen [mailto:dga@lcs.mit.edu] Sent: 2005. január 27. 17:38 To: András Császár (IJ/ETH) Cc: nanog(a)merit.edu Subject: Re: Resilience: faults, causes, statistics, open issues > On Jan 27, 2005, at 6:39 AM, András Császár (IJ/ETH) wrote: > >> >> Hi people! >> >> I've begun research on (carrier-grade, aka telecom-grade) resiliency >> in IP transport networks. The first step would be to collect possible >> failure events, their causes and consequences, statistics about >> downtimes (mean time to repair) and mean times between failures, and >> I would like to identify which of the problems are most typical (HW >> bug, SW bug, cable cut through, plugged out (link going down), >> severe misconfiguration). >> >> I think this is the perfect forum to get some feedback from real >> network-operational experience. >> >> Is anyone out there who has some statistics/documents that would help >> me in any way? > > This is self-serving, but see the intro and related work sections of > my thesis (we'll have a conference paper version of it done soon for > NSDI, but we're still revising it. Apologies for not having a shorter > reference to give you): > > http://nms.lcs.mit.edu/papers/index.php?detail=113 > > It doesn't focus specifically on carrier failures, but it has a batch > of references that might get you started on what the academic side > knows. I've also got some refs in there to some of the earlier teleco > studies, which I recommend taking a peek at. Again, relation to year > 2005 ISP failures isn't totally clear, but it's a starting point. > > Unfortunately, the reality is that we don't actually know all that > much as far as what's _really_ happening! Nick Feamster and I took a > look at some of the BGP routing failures (but didn't get back to root > causes): > > http://nms.lcs.mit.edu/papers/index.php?detail=23 > > Nick's also done some work on configuration management and building a > better routing protocol that's somewhat related to your question. > > Ratul Mahajan examined BGP configuration errors - but it's not clear > exactly what fraction of failures or downtime are really due to those > errors: > > http://www.cs.washington.edu/homes/ratul/bgp/index.html > > David Oppenheimer studied failures at a few edge companies (app. > service providers, hosting providers, etc.). Has a nice breakdown of > failure causes and durations, but it's not clear if those numbers > directly translate to the carrier realm: > > http://roc.cs.berkeley.edu/papers/usits03.pdf > > Finally, google back for some of Sean Donelan's NANOG posts. You'll > get some good individual cases from those, though the last time I > looked, I didn't find a big overall analysis. > > >> Also, do you have any suggestions on open research issues to be >> solved in the area? > > Most of it. :) I (and probably others on this lis) would be > interested in what you find. > > -Dave

2 1

Weekly Routing Table Report
by Routing Table Analysis 28 Jan '05

28 Jan '05

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 29 Jan, 2005 Analysis Summary ---------------- BGP routing table entries examined: 154984 Prefixes after maximum aggregation: 90381 Unique aggregates announced to Internet: 74096 Total ASes present in the Internet Routing Table: 18880 Origin-only ASes present in the Internet Routing Table: 16393 Origin ASes announcing only one prefix: 7690 Transit ASes present in the Internet Routing Table: 2487 Transit-only ASes present in the Internet Routing Table: 80 Average AS path length visible in the Internet Routing Table: 4.5 Max AS path length visible: 22 Prefixes from unregistered ASNs in the Routing Table: 6 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 19 Number of addresses announced to Internet: 1370739756 Equivalent to 81 /8s, 179 /16s and 212 /24s Percentage of available address space announced: 37.0 Percentage of allocated address space announced: 58.5 Percentage of available address space allocated: 63.2 Total number of prefixes smaller than registry allocations: 72278 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 30715 Total APNIC prefixes after maximum aggregation: 14875 Prefixes being announced from the APNIC address blocks: 28751 Unique aggregates announced from the APNIC address blocks: 14553 APNIC Region origin ASes present in the Internet Routing Table: 2194 APNIC Region origin ASes announcing only one prefix: 649 APNIC Region transit ASes present in the Internet Routing Table: 326 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 15 Number of APNIC addresses announced to Internet: 172218240 Equivalent to 10 /8s, 67 /16s and 215 /24s Percentage of available APNIC address space announced: 63.9 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 23552-24575 APNIC Address Blocks 58/7, 60/7, 124/7, 126/8, 202/7, 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 86924 Total ARIN prefixes after maximum aggregation: 52224 Prefixes being announced from the ARIN address blocks: 66269 Unique aggregates announced from the ARIN address blocks: 23997 ARIN Region origin ASes present in the Internet Routing Table: 9828 ARIN Region origin ASes announcing only one prefix: 3564 ARIN Region transit ASes present in the Internet Routing Table: 964 Average ARIN Region AS path length visible: 4.3 Max ARIN Region AS path length visible: 16 Number of ARIN addresses announced to Internet: 240024576 Equivalent to 14 /8s, 78 /16s and 124 /24s Percentage of available ARIN address space announced: 71.5 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647,29695-30719, 31744-33791 ARIN Address Blocks 24/8, 63/8, 64/6, 68/7, 70/7, 72/8, 198/7, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 29197 Total RIPE prefixes after maximum aggregation: 20200 Prefixes being announced from the RIPE address blocks: 26172 Unique aggregates announced from the RIPE address blocks: 17218 RIPE Region origin ASes present in the Internet Routing Table: 6269 RIPE Region origin ASes announcing only one prefix: 3332 RIPE Region transit ASes present in the Internet Routing Table: 1067 Average RIPE Region AS path length visible: 5.1 Max RIPE Region AS path length visible: 22 Number of RIPE addresses announced to Internet: 187084864 Equivalent to 11 /8s, 38 /16s and 176 /24s Percentage of available RIPE address space announced: 65.6 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-34815 RIPE Address Blocks 62/8, 80/5, 88/8, 188/8, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 6812 Total LACNIC prefixes after maximum aggregation: 2382 Prefixes being announced from the LACNIC address blocks: 6691 Unique aggregates announced from the LACNIC address blocks: 4033 LACNIC Region origin ASes present in the Internet Routing Table: 416 LACNIC Region origin ASes announcing only one prefix: 121 LACNIC Region transit ASes present in the Internet Routing Table: 83 Average LACNIC Region AS path length visible: 5.0 Max LACNIC Region AS path length visible: 16 Number of LACNIC addresses announced to Internet: 17316608 Equivalent to 1 /8s, 8 /16s and 59 /24s Percentage of available LACNIC address space announced: 51.6 LACNIC AS Blocks 26592-26623, 27648-28671 LACNIC Address Blocks 200/7 Emerging AfriNIC Region Analysis Summary ---------------------------------------- Prefixes being announced by AfriNIC Region ASes: 1330 Total AfriNIC prefixes after maximum aggregation: 700 Prefixes being announced from the AfriNIC address blocks: 873 Unique aggregates announced from the AfriNIC address blocks: 692 AfriNIC Region origin ASes present in the Internet Routing Table: 96 AfriNIC Region origin ASes announcing only one prefix: 24 AfriNIC Region transit ASes present in the Internet Routing Table: 13 Average AfriNIC Region AS path length visible: 4.6 Max AfriNIC Region AS path length visible: 12 Number of AfriNIC addresses announced to Internet: 2107648 Equivalent to 0 /8s, 32 /16s and 41 /24s Percentage of available AfriNIC address space announced: 12.6 AfriNIC AS Blocks <none> AfriNIC Address Blocks 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 886 4624 173 Data Communications Bureau 1221 785 1183 560 Telstra Pty Ltd 4766 582 3414 279 Korea Internet Exchange for " 9583 569 48 11 Satyam Infoway Ltd., 4755 460 178 101 Videsh Sanchar Nigam Ltd. Aut 17676 393 5900 61 XTAGE CORPORATION 9443 362 71 77 Primus Telecommunications 2907 353 1856 326 SINET Japan 9929 350 164 35 China Netcom Corp. 17557 303 22 149 Pakistan Telecom 10036 294 27 270 C&M Communication Co. Ltd. 7545 279 86 67 TPG Internet Pty Ltd 7474 277 296 207 Optus Communications Pty Ltd 2764 273 254 220 connect.com.au pty ltd 703 271 340 212 UUNET 9800 238 383 76 CHINA UNICOM 4808 235 172 129 CHINANET core WAN North 9498 234 81 53 BHARTI BT INTERNET LTD. 4802 231 28 140 Wantree Development 7563 225 48 159 Korea Internet Infrastructure ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1457 6607 976 AT&T WorldNet Services 721 1122 21787 314 DLA Systems Automation Center 701 1063 8335 911 UUNET Technologies, Inc. 1239 926 2880 616 Sprint 6197 838 378 400 BellSouth Network Solutions, 4323 837 672 218 Time Warner Telecom 2386 813 505 601 AT&T Data Communications Serv 18566 766 208 6 Covad Communications 209 664 3404 503 Qwest 7015 596 212 22 AT&T Broadband 3356 591 10867 436 Level 3 Communications, LLC 20115 569 474 303 Charter Communications 3561 560 2370 415 Cable & Wireless USA 852 525 1126 399 Telus Advanced Communications 6478 501 819 96 AT&T Worldnet Services 3602 492 120 94 Sprint Canada, Inc. 27364 460 44 19 Armstrong Cable Services 6198 456 488 200 BellSouth Network Solutions, 7132 452 8395 381 SBC Internet Services 22773 436 1085 19 Cox Communications, Inc. Atla RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 619 2023 511 UUNET - Commercial IP service 3320 291 2992 227 Deutsche Telekom AG 3301 287 1112 275 TeliaNet Sweden 8220 275 466 268 COLT Internet - International 680 253 2041 239 DFN-IP service G-WiN 3246 225 471 220 Song Networks 13083 217 51 8 Mannesmann Datenverarbeitung 8708 210 119 191 Romania Data Systems S.A. 1257 205 708 171 SWIPnet Swedish IP Network 5515 187 842 135 Sonera Solution Autonomous Sy 3215 186 1022 79 France Telecom Transpac 786 176 1794 176 The JANET IP Service 6746 176 47 140 Dynamic Network Technologies, 8866 166 19 23 Bulgarian Telecommunication C 3269 161 1392 71 TELECOM ITALIA 3300 161 165 81 AUCS Communications Services 719 158 322 104 LANLINK autonomous system 5400 141 219 124 BT Ignite European Backbone 25186 140 122 99 France Telecom Transpac's Tra 3303 130 577 125 Swisscom Ltd LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6140 357 140 69 ImpSat 8151 335 489 142 UniNet S.A. de C.V. 16814 234 14 6 NSS, S.A. 11172 212 99 54 Servicios Alestra S.A de C.V 6147 189 102 20 Telefonica Del Peru 11664 158 19 24 Keytech SA 7303 149 68 22 Telecom Argentina Stet-France 6505 133 90 90 Global One Communicaoes Ltda 6503 116 147 81 AVANTEL, S.A. 14117 114 7 5 Telefonica del Sur S.A. 11992 107 9 31 Integrated Systems 11556 97 48 3 Cable-Wireless Panama 13999 89 52 9 Mega Cable S.A. de C.V. 14420 87 6 42 ANDINATEL S.A. 11311 86 8 22 Sinectis S.A. 6535 85 7 23 Chilesat Servicios Empresari 10481 83 32 7 Prima S.A. 4270 81 18 9 Red de Interconexion Universi 5639 81 8 8 Telecommunications Services o 15311 78 25 37 Telefonica Empresas AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 268 636 226 The Internet Solution 5536 113 16 4 Internet Egypt Network 2018 102 297 98 Tertiary Education Network 20928 84 16 2 Noor Advanced Technologies AS 2905 77 272 70 The Internetworking Company o 24835 56 34 6 RAYA Telecom - Egypt 8452 46 20 5 TEDATA 6713 34 38 9 Itissalat Al-MAGHRIB 9129 33 3 2 UUNET Kenya 12455 28 7 4 Jambonet Autonomous system 5713 27 141 24 Telkom SA Ltd 8524 23 1 4 AUCEGYPT Autonomous System 16637 22 10 19 Johnnic e-Ventures 10798 18 1 12 Standard Bank of South Africa 12258 18 3 12 Vodacom Internet Company 21280 18 2 3 Swift Global Kenya Ltd.Is an 15706 15 4 2 Sudatel Internet Exchange Aut 21491 15 1 3 UTL On-line is RF broadband I 8346 14 7 14 SONATEL-AS Autonomous System 15808 13 1 2 Communication Solutions Ltd i Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 721 1122 808 DLA Systems Automation Center 18566 766 760 Covad Communications 4134 886 713 Data Communications Bureau 4323 837 619 Time Warner Telecom 7015 596 574 AT&T Broadband 9583 569 558 Satyam Infoway Ltd., 27364 460 441 Armstrong Cable Services 6197 838 438 BellSouth Network Solutions, 22773 436 417 Cox Communications, Inc. Atla 5668 431 414 Century Telephone 6478 501 405 AT&T Worldnet Services 3602 492 398 Sprint Canada, Inc. 4755 460 359 Videsh Sanchar Nigam Ltd. Aut 22909 423 358 Comcast Cable Corporation 6467 366 335 E.Spire Communications, Inc. 17676 393 332 XTAGE CORPORATION 9929 350 315 China Netcom Corp. 1239 926 310 Sprint 4766 582 303 Korea Internet Exchange for " 13609 335 300 Choice One Communications Inc List of Unregistered ASNs (Global) ---------------------------------- Bad AS Designation Network Transit AS Description 64826 PRIVATE 64.200.250.0/23 7911 Williams Communicati 64513 PRIVATE 149.117.96.0/24 577 Bell Advanced Commun 26422 UNALLOCATED 196.46.184.0/22 3741 The Internet Solutio 65002 PRIVATE 208.179.184.0/24 11509 The Pajo Group 65529 PRIVATE 216.21.199.0/24 14697 VDot.Net 65529 PRIVATE 216.152.237.0/24 14697 VDot.Net Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 172.212.0.0/16 1668 GNN Hosting Service 172.213.0.0/16 1668 GNN Hosting Service 172.214.0.0/16 1668 GNN Hosting Service 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.83.16.0/20 5515 Sonera Solution Autonomous Sy 192.83.32.0/19 5515 Sonera Solution Autonomous Sy 192.83.96.0/22 5515 Sonera Solution Autonomous Sy 192.83.100.0/24 5515 Sonera Solution Autonomous Sy 192.84.205.0/24 719 LANLINK autonomous system 192.119.135.0/24 270 NASA 192.135.50.0/24 7018 AT&T WorldNet Services 192.136.79.0/24 719 LANLINK autonomous system 192.172.0.0/19 721 DLA Systems Automation Center 192.172.11.0/24 721 DLA Systems Automation Center 192.200.100.0/24 7018 AT&T WorldNet Services Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:3 /10:7 /11:14 /12:61 /13:143 /14:314 /15:574 /16:8279 /17:2384 /18:4070 /19:10046 /20:10613 /21:8393 /22:11673 /23:12907 /24:84525 /25:296 /26:266 /27:128 /28:63 /29:33 /30:127 /31:0 /32:46 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 751 766 Covad Communications 6197 683 838 BellSouth Network Solutions, 7018 621 1457 AT&T WorldNet Services 2386 586 813 AT&T Data Communications Serv 7015 564 596 AT&T Broadband 27364 445 460 Armstrong Cable Services 4766 398 582 Korea Internet Exchange for " 9583 398 569 Satyam Infoway Ltd., 702 377 619 UUNET - Commercial IP service 5668 371 431 Century Telephone 1239 367 926 Sprint 6198 328 456 BellSouth Network Solutions, 10036 294 294 C&M Communication Co. Ltd. 13609 292 335 Choice One Communications Inc 4323 282 837 Time Warner Telecom 6517 281 303 Yipes Communications, Inc. 6467 277 366 E.Spire Communications, Inc. 9929 275 350 China Netcom Corp. 701 263 1063 UUNET Technologies, Inc. 11456 263 308 Carolina Online, Inc. Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:4 8:9 12:1487 13:1 15:6 16:2 17:3 18:4 20:4 24:1006 32:68 33:3 38:90 40:55 44:3 47:2 52:3 55:2 56:3 57:22 59:2 60:12 61:632 62:511 63:1836 64:2561 65:2098 66:2587 67:484 68:495 69:892 70:54 71:2 72:47 80:557 81:501 82:362 83:232 84:101 85:81 128:126 129:167 130:89 131:194 132:37 134:144 135:30 136:208 137:76 138:181 139:47 140:191 141:102 142:139 143:121 144:248 145:45 146:281 147:97 148:262 149:161 150:94 151:62 152:111 153:71 154:2 155:136 156:70 157:75 158:149 159:163 160:67 161:61 162:413 163:84 164:212 165:157 166:127 167:223 168:382 169:131 170:316 171:8 192:5646 193:3072 194:2252 195:1574 196:602 198:3850 199:3229 200:3941 201:43 202:5205 203:5887 204:3596 205:2009 206:2315 207:2648 208:2104 209:3060 210:1555 211:767 212:1146 213:1270 214:239 215:31 216:3703 217:1088 218:187 219:125 220:341 221:79 222:77 End of report

1 0

Announce: BGP::Inspect
by Manish Karir 28 Jan '05

28 Jan '05

All, Merit Network and the University of Maryland would like to announce the beta release of a BGP update messages research tool that might be of use to the NANOG community. The tool is called BGP::Inspect. The goal is to make the vast quantities of Routeviews data easily accesible to the network operator and research community. This involves not just allowing people to query and obtain the update messages, but also providing some simple analysis and statistics on the data which can help in locating anomalies and problems. At this point we feel that we could really benefit from some feedback from the community. A beta release of our prototype is available at: http://weasel.merit.edu:9191/ This version has been initialized with a limited amount of data. It currently provides information regarding 5 of the 40 routeview peers, and only contains data for the time period from Dec 20 - Jan 6. The basic interface has been kept simple. There are 2 types of queries that can be run "Summary Queries" and "Raw Data Analysis". The summary queries allow users to quickly focus on potential trouble spots(as observed at the routeview peers). Basic queries include things like most active ASes, most active prefixes, as well as prefixes that exhibited the most number of changes in their OriginAS. The second type of queries, "Raw Data Analysis" can be used to obtain information regarding specific ASes or prefixes for a given time range. A query for a specific AS will return not only the various prefixes announced by that AS, the times, paths, and communities, but also summary stats including total number of announcements in that time period and the number of unique prefixes announced in that time period. A 7 day summary graph is also returned which summarized the most recent activity as seen originating from that AS. A similar query for a specific prefix will return times, types(announce/withdraw), aspaths and communities from update messages as well as summary statistics that indicate the min/max/avg AS path length as seen over the query time interval, the number of originAS changes as well as the number of unique ASes that announced that prefix. A summary graph indicating the activity of that prefix over the last 7 days is also displayed. In a lot of ways this tool complements the Search by AS/Prefix tools from RIPE, BGP Monitor from MIT, and LinkRank from UCLA. The more views from different vantage points the better. In addition there is a real effort with BGP::Inspect to provide not simply access to the raw data, but some simple analysis and summary statistics as well. The hope is that people no longer need to write custom parsers to be able to extract the information they need. We would appreciate any and all feedback from the NANOG community. In particular, it would be instructive to us to learn what are some other "typical" queries that we could add, in addition to the the "Top 20 most active ASes/Prefixes" and "Top 20 prefixes which have most number of origin AS changes." What are some other basic questions that researchers and network operators ask when attempting to analyze problems. Please send feedback offlist to: mkarir(a)merit.edu thanks manish karir --------------------------------------------

1 0

beware of the unknown packets
by Petri Helenius 28 Jan '05

28 Jan '05

http://www.kb.cert.org/vuls/id/409555 Pete

2 2

The Cidr Report
by cidr-report＠potaroo.net 28 Jan '05

28 Jan '05

This report has been generated at Fri Jan 28 21:49:25 2005 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 21-01-05 150315 103500 22-01-05 151119 103502 23-01-05 150437 103475 24-01-05 150434 103516 25-01-05 150622 103724 26-01-05 150792 103854 27-01-05 150792 103116 28-01-05 150969 103172 AS Summary 18774 Number of ASes in routing system 7698 Number of ASes announcing only one prefix 1435 Largest number of prefixes announced by an AS AS7018 : ATTW AT&T WorldNet Services 90486528 Largest address span announced by an AS (/32s) AS721 : DNIC DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 28Jan05 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 151027 103215 47812 31.7% All ASes AS18566 766 7 759 99.1% CVAD Covad Communications AS4134 839 206 633 75.4% CHINANET-BACKBONE No.31,Jin-rong Street AS4323 833 224 609 73.1% TWTC Time Warner Telecom AS721 1118 573 545 48.7% DNIC DoD Network Information Center AS7015 596 77 519 87.1% CCCH-3 Comcast Cable Communications Holdings, Inc AS7018 1435 973 462 32.2% ATTW AT&T WorldNet Services AS22773 436 19 417 95.6% CXA Cox Communications Inc. AS27364 460 46 414 90.0% ARMC Armstrong Cable Services AS6197 834 448 386 46.3% BNS-14 BellSouth Network Solutions, Inc AS6478 501 118 383 76.4% ATTW AT&T WorldNet Services AS3602 513 148 365 71.2% SPCA Sprint Canada Inc. AS22909 423 74 349 82.5% CMCS Comcast Cable Communications, Inc. AS1239 923 615 308 33.4% SPRN Sprint AS9929 340 35 305 89.7% CNCNET-CN China Netcom Corp. AS4766 568 279 289 50.9% KIXS-AS-KR Korea Telecom AS17676 391 103 288 73.7% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS14654 263 7 256 97.3% WAYPOR-3 Wayport AS9443 366 121 245 66.9% INTERNETPRIMUS-AS-AP Primus Telecommunications AS6140 378 141 237 62.7% IMPSA ImpSat AS4355 300 64 236 78.7% ERSD EARTHLINK, INC AS9583 576 343 233 40.5% SIFY-AS-IN Sify Limited AS25844 244 16 228 93.4% SASMFL-2 Skadden, Arps, Slate, Meagher & Flom LLP AS6198 447 225 222 49.7% BNS-14 BellSouth Network Solutions, Inc AS15270 245 32 213 86.9% PDP-14 PaeTec.net -a division of PaeTecCommunications, Inc. AS2386 812 609 203 25.0% ADCS-1 AT&T Data Communications Services AS23126 210 18 192 91.4% KTEL KMC Telecom, Inc. AS5668 426 241 185 43.4% CIH-12 CenturyTel Internet Holdings, Inc. AS19632 191 8 183 95.8% Metropolis Intercom AS6517 301 119 182 60.5% YIPS Yipes Communications, Inc. AS9498 235 54 181 77.0% BBIL-AP BHARTI BT INTERNET LTD. Total 15970 5943 10027 62.8% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 AHSICHCL Andara High Speed Internet c/o Halifax Cable Ltd. 24.246.0.0/17 AS7018 ATTW AT&T WorldNet Services 24.246.38.0/24 AS25994 NPGCAB NPG Cable, INC 24.246.128.0/18 AS7018 ATTW AT&T WorldNet Services 64.17.32.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.17.33.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.17.37.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.46.27.0/24 AS8674 NETNOD-IX Netnod Internet Exchange Sverige AB 64.57.160.0/19 AS3561 SAVVI-3 Savvis 64.92.128.0/19 AS3561 SAVVI-3 Savvis 64.127.0.0/18 AS7018 ATTW AT&T WorldNet Services 64.209.192.0/18 AS3561 SAVVI-3 Savvis 69.26.32.0/19 AS17307 VIRTEL-15 Virtela Communications 132.0.0.0/10 AS721 DNIC DoD Network Information Center 137.0.0.0/13 AS721 DNIC DoD Network Information Center 138.136.0.0/13 AS721 DNIC DoD Network Information Center 158.0.0.0/13 AS721 DNIC DoD Network Information Center 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.30.127.0/24 AS719 ELISA-AS Elisa Oyj 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.44.0.0/19 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 192.70.164.0/24 AS11814 IGST Information Gateway Services - Toronto 192.81.182.0/24 AS719 ELISA-AS Elisa Oyj 192.81.183.0/24 AS719 ELISA-AS Elisa Oyj 192.81.184.0/24 AS719 ELISA-AS Elisa Oyj 192.119.135.0/24 AS270 NASA National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS4004 GLOBALONE-EQUANT-UK Equant UK & Greece Autonomous System 192.135.50.0/24 AS7018 ATTW AT&T WorldNet Services 192.153.144.0/21 AS721 DNIC DoD Network Information Center 192.172.0.0/19 AS721 DNIC DoD Network Information Center 192.188.208.0/20 AS721 DNIC DoD Network Information Center 192.200.100.0/24 AS7018 ATTW AT&T WorldNet Services 196.2.95.0/24 AS8668 TELONE-AS TelOne Zimbabwe P/L 198.23.26.0/24 AS4390 BELLAT-7 Bell Atlantic, Inc. 198.97.72.0/21 AS721 DNIC DoD Network Information Center 198.97.80.0/20 AS721 DNIC DoD Network Information Center 198.97.88.0/24 AS89 NUSC-1 Naval Underwater Systems Center 198.97.240.0/20 AS721 DNIC DoD Network Information Center 198.97.247.0/24 AS3475 DEPART-52 Department of the Navy 198.101.4.0/22 AS721 DNIC DoD Network Information Center 198.136.32.0/20 AS19329 MCBCC Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY CityNet, Inc. 198.161.87.0/24 AS6539 GTGR GT Group Telecom Services Corp. 198.163.155.0/24 AS684 MRN Manitoba Regional Network 198.167.0.0/16 AS7456 INS-51 Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 UU UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASK SaskTel 198.232.133.0/24 AS23075 SKOTOS Skotos Tech, Inc 199.10.0.0/16 AS721 DNIC DoD Network Information Center 199.60.0.0/20 AS271 UBC-3 University of British Columbia 199.96.44.0/23 AS19092 360NE-1 360Networks (USA) Inc. 199.96.46.0/24 AS19092 360NE-1 360Networks (USA) Inc. 199.114.0.0/21 AS721 DNIC DoD Network Information Center 199.114.128.0/18 AS721 DNIC DoD Network Information Center 199.114.130.0/24 AS721 DNIC DoD Network Information Center 199.114.132.0/24 AS721 DNIC DoD Network Information Center 199.114.134.0/24 AS3541 DISAUN DISA/UNRRA 199.114.136.0/24 AS27044 DNIC DoD Network Information Center 199.114.138.0/24 AS721 DNIC DoD Network Information Center 199.114.140.0/24 AS3544 DISAUN DISA/UNRRA 199.114.142.0/24 AS721 DNIC DoD Network Information Center 199.114.144.0/24 AS721 DNIC DoD Network Information Center 199.114.148.0/24 AS721 DNIC DoD Network Information Center 199.114.150.0/24 AS721 DNIC DoD Network Information Center 199.114.152.0/24 AS27033 DNIC DoD Network Information Center 199.114.154.0/24 AS1733 ADP-41 AF DDN PMO 199.114.156.0/24 AS27034 DNIC DoD Network Information Center 199.114.160.0/24 AS1733 ADP-41 AF DDN PMO 199.120.32.0/19 AS16582 NXLI NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS721 DNIC DoD Network Information Center 199.123.0.0/18 AS721 DNIC DoD Network Information Center 199.123.16.0/20 AS721 DNIC DoD Network Information Center 199.123.80.0/21 AS721 DNIC DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST IQuest Internet 199.202.0.0/16 AS701 UU UUNET Technologies, Inc. 201.239.0.0/16 AS22047 VTR BANDA ANCHA S.A. 202.72.240.0/20 AS24320 RAILCOM Mongolian Railway Commercial Center Railcom 202.73.128.0/22 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.86.252.0/22 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.164.224.0/19 AS7599 IPXC-AS-AP IP Exchange 203.32.4.0/23 AS7617 TELEONE-HK TeleTeleOne (HK) Limited 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.99.0.0/19 AS17746 ORCONINTERNET-NZ-AP Orcon Internet 203.170.14.0/23 AS6648 ASN-SKYINTERNET Autonomous System Number peering of BAYANTEL 203.210.69.0/24 AS17536 PRODIGY-AS-AP Prodidgy Telecommunications 204.154.125.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBI Exobit Networks Inc. 205.150.0.0/15 AS701 UU UUNET Technologies, Inc. 206.29.168.0/21 AS10248 IPI Internet Partners, Inc. 206.128.104.0/21 AS11709 VIIN VIRTUAL INTERACTIVE CENTER 206.167.57.0/24 AS376 RISQR-3 Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 207.231.96.0/19 AS11194 NUNETI NuNet Inc 208.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 208.138.48.0/20 AS7955 SOURCE-48 SourceNet Corporation 209.27.51.0/24 AS14132 INTERN-582 Internet Gateway Inc. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.213.32.0/19 AS10629 INS-52 Inter-Pacific Network Services 209.213.48.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.49.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.251.0.0/19 AS11036 SISCOM-1 SISCOM, Inc 216.37.110.0/23 AS4264 CERFN California Education and Research Federation Network 216.96.128.0/18 AS7018 ATTW AT&T WorldNet Services 216.145.156.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.158.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.176.0/21 AS20304 JIS-32 JVLNET Internet Services 216.145.177.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.178.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.184.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.185.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.186.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.187.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.188.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.189.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.190.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.191.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.200.0/21 AS20304 JIS-32 JVLNET Internet Services 216.171.96.0/20 AS3356 LEVEL3 Level 3 Communications 216.186.151.0/24 AS3356 LEVEL3 Level 3 Communications 216.186.152.0/21 AS3356 LEVEL3 Level 3 Communications 216.186.160.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.164.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.192.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.198.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.248.0/23 AS3356 LEVEL3 Level 3 Communications Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org swinog(a)swinog.ch

1 0