January 2005 - Test - lists.nanog.org

Registrar and registry backend processes.
by Michael Loftis 21 Jan '05

21 Jan '05

I think, briefly, that we need to force Verisign and the registrars to be FAR more public about the backend process for WHOIS data and for the TLD zone data. Especially with .com, .net, and probably .org, and this latest failure of 'the system' and the obvious lack of information on 'the system.' It's clearly broken, and needs to be put up for public review by 'the powers that be' so that it can be fixed. What's happening now feels close to a boiler room poker game, noone seems to know all the players, and even fewer know all the rules, so in the end everyone is a loser. I know this is adding fuel to the proverbial fire, but apparently we need to burn out this thing so we don't get scorched by yet another unexpected fire.

8 10

RE: Please Check Filters - BOGON Filtering IP Space 72.14.128.0/19
by Fergie (Paul Ferguson) 21 Jan '05

21 Jan '05

As someone who used to "do" a great deal of managed network services, I can certainly attest to that. - ferg -- "Christopher L. Morrow" <christopher.morrow(a)mci.com> wrote: On Thu, 20 Jan 2005, James Laszko wrote: > > Well, if the router CAN run BGP, the feed from Cymru is only about 84 > prefixes - not a lot of memory tied up there, is there? > my point was that not all managed routers, the majority actually, can't and don't run BGP. their code doesn't even support bgp... -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

2 1

The Cidr Report
by cidr-report＠potaroo.net 21 Jan '05

21 Jan '05

This report has been generated at Fri Jan 21 21:44:23 2005 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 14-01-05 149708 103062 15-01-05 149634 103087 16-01-05 149549 103118 17-01-05 149515 103257 18-01-05 149701 103146 19-01-05 149753 103186 20-01-05 149979 103368 21-01-05 150315 103512 AS Summary 18735 Number of ASes in routing system 7671 Number of ASes announcing only one prefix 1430 Largest number of prefixes announced by an AS AS7018 : ATTW AT&T WorldNet Services 90147072 Largest address span announced by an AS (/32s) AS721 : DNIC DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 21Jan05 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 151111 103498 47613 31.5% All ASes AS18566 765 7 758 99.1% CVAD Covad Communications AS4134 834 200 634 76.0% CHINANET-BACKBONE No.31,Jin-rong Street AS4323 825 232 593 71.9% TWTC Time Warner Telecom AS721 1100 595 505 45.9% DNIC DoD Network Information Center AS27364 460 34 426 92.6% ARMC Armstrong Cable Services AS22773 429 19 410 95.6% CXA Cox Communications Inc. AS6197 829 452 377 45.5% BNS-14 BellSouth Network Solutions, Inc AS7018 1430 1085 345 24.1% ATTW AT&T WorldNet Services AS6478 486 146 340 70.0% ATTW AT&T WorldNet Services AS9929 342 35 307 89.8% CNCNET-CN China Netcom Corp. AS1239 919 613 306 33.3% SPRN Sprint AS17676 391 89 302 77.2% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS22909 418 125 293 70.1% CMCS Comcast Cable Communications, Inc. AS4766 560 278 282 50.4% KIXS-AS-KR Korea Telecom AS21502 276 3 273 98.9% ASN-NUMERICABLE NUMERICABLE is a cabled network in France, AS14654 263 7 256 97.3% WAYPOR-3 Wayport AS9443 366 121 245 66.9% INTERNETPRIMUS-AS-AP Primus Telecommunications AS6140 377 134 243 64.5% IMPSA ImpSat AS4355 300 64 236 78.7% ERSD EARTHLINK, INC AS9583 572 340 232 40.6% SIFY-AS-IN Sify Limited AS25844 242 16 226 93.4% SASMFL-2 Skadden, Arps, Slate, Meagher & Flom LLP AS2386 848 626 222 26.2% ADCS-1 AT&T Data Communications Services AS6198 446 224 222 49.8% BNS-14 BellSouth Network Solutions, Inc AS15270 245 32 213 86.9% PDP-14 PaeTec.net -a division of PaeTecCommunications, Inc. AS3602 302 106 196 64.9% SPCA Sprint Canada Inc. AS5668 429 235 194 45.2% CIH-12 CenturyTel Internet Holdings, Inc. AS1580 197 13 184 93.4% DNIC DoD Network Information Center AS6517 304 121 183 60.2% YIPS Yipes Communications, Inc. AS19632 191 9 182 95.3% Metropolis Intercom AS9498 234 54 180 76.9% BBIL-AP BHARTI BT INTERNET LTD. Total 15380 6015 9365 60.9% Top 30 total Possible Bogus Routes 24.246.0.0/17 AS7018 ATTW AT&T WorldNet Services 24.246.38.0/24 AS25994 NPGCAB NPG Cable, INC 24.246.128.0/18 AS7018 ATTW AT&T WorldNet Services 64.17.32.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.17.33.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.17.37.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.46.27.0/24 AS8674 NETNOD-IX Netnod Internet Exchange Sverige AB 64.57.160.0/19 AS3561 SAVVI-3 Savvis 64.92.128.0/19 AS3561 SAVVI-3 Savvis 64.127.0.0/18 AS7018 ATTW AT&T WorldNet Services 64.209.192.0/18 AS3561 SAVVI-3 Savvis 69.26.32.0/19 AS17307 VIRTEL-15 Virtela Communications 132.0.0.0/10 AS721 DNIC DoD Network Information Center 137.0.0.0/13 AS721 DNIC DoD Network Information Center 138.136.0.0/13 AS721 DNIC DoD Network Information Center 158.0.0.0/13 AS721 DNIC DoD Network Information Center 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.30.127.0/24 AS719 ELISA-AS Elisa Oyj 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.44.0.0/19 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 192.70.164.0/24 AS25689 NRCC-2 National Research Council of Canada 192.81.182.0/24 AS719 ELISA-AS Elisa Oyj 192.81.183.0/24 AS719 ELISA-AS Elisa Oyj 192.81.184.0/24 AS719 ELISA-AS Elisa Oyj 192.119.135.0/24 AS270 NASA National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS4004 GLOBALONE-EQUANT-UK Equant UK & Greece Autonomous System 192.135.50.0/24 AS7018 ATTW AT&T WorldNet Services 192.153.144.0/21 AS721 DNIC DoD Network Information Center 192.172.0.0/19 AS721 DNIC DoD Network Information Center 192.188.208.0/20 AS721 DNIC DoD Network Information Center 192.200.100.0/24 AS7018 ATTW AT&T WorldNet Services 196.2.95.0/24 AS8668 TELONE-AS TelOne Zimbabwe P/L 198.23.26.0/24 AS4390 BELLAT-7 Bell Atlantic, Inc. 198.97.72.0/21 AS721 DNIC DoD Network Information Center 198.97.80.0/20 AS721 DNIC DoD Network Information Center 198.97.88.0/24 AS89 NUSC-1 Naval Underwater Systems Center 198.97.240.0/20 AS721 DNIC DoD Network Information Center 198.97.247.0/24 AS3475 DEPART-52 Department of the Navy 198.101.4.0/22 AS721 DNIC DoD Network Information Center 198.136.32.0/20 AS19329 MCBCC Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY CityNet, Inc. 198.161.87.0/24 AS6539 GTGR GT Group Telecom Services Corp. 198.163.155.0/24 AS684 MRN Manitoba Regional Network 198.167.0.0/16 AS7456 INS-51 Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 UU UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASK SaskTel 198.232.133.0/24 AS23075 SKOTOS Skotos Tech, Inc 199.10.0.0/16 AS721 DNIC DoD Network Information Center 199.60.0.0/20 AS271 UBC-3 University of British Columbia 199.96.44.0/23 AS19092 360NE-1 360Networks (USA) Inc. 199.96.46.0/24 AS19092 360NE-1 360Networks (USA) Inc. 199.114.0.0/18 AS568 DISOUN DISO-UNRRA 199.114.0.0/21 AS721 DNIC DoD Network Information Center 199.114.128.0/18 AS721 DNIC DoD Network Information Center 199.114.130.0/24 AS721 DNIC DoD Network Information Center 199.114.132.0/24 AS721 DNIC DoD Network Information Center 199.114.134.0/24 AS3541 DISAUN DISA/UNRRA 199.114.136.0/24 AS27044 DNIC DoD Network Information Center 199.114.138.0/24 AS721 DNIC DoD Network Information Center 199.114.140.0/24 AS3544 DISAUN DISA/UNRRA 199.114.142.0/24 AS721 DNIC DoD Network Information Center 199.114.144.0/24 AS721 DNIC DoD Network Information Center 199.114.148.0/24 AS721 DNIC DoD Network Information Center 199.114.150.0/24 AS721 DNIC DoD Network Information Center 199.114.152.0/24 AS27033 DNIC DoD Network Information Center 199.114.154.0/24 AS1733 ADP-41 AF DDN PMO 199.114.156.0/24 AS27034 DNIC DoD Network Information Center 199.114.160.0/24 AS1733 ADP-41 AF DDN PMO 199.120.32.0/19 AS16582 NXLI NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS721 DNIC DoD Network Information Center 199.123.0.0/18 AS721 DNIC DoD Network Information Center 199.123.16.0/20 AS721 DNIC DoD Network Information Center 199.123.80.0/21 AS721 DNIC DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST IQuest Internet 199.202.0.0/16 AS701 UU UUNET Technologies, Inc. 201.239.0.0/16 AS22047 VTR BANDA ANCHA S.A. 202.72.240.0/20 AS24320 RAILCOM Mongolian Railway Commercial Center Railcom 202.73.128.0/22 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.86.252.0/22 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.148.32.0/20 AS17495 GATEWAY-AP BROADBAND WIRELESSS INTERNET SERVICE PROVIDER 202.164.224.0/19 AS7599 IPXC-AS-AP IP Exchange 203.32.4.0/23 AS7617 TELEONE-HK TeleTeleOne (HK) Limited 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.99.0.0/19 AS17746 ORCONINTERNET-NZ-AP Orcon Internet 203.170.14.0/23 AS6648 ASN-SKYINTERNET Autonomous System Number peering of BAYANTEL 203.210.69.0/24 AS17536 PRODIGY-AS-AP Prodidgy Telecommunications 204.154.125.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBI Exobit Networks Inc. 205.150.0.0/15 AS701 UU UUNET Technologies, Inc. 206.29.168.0/21 AS10248 IPI Internet Partners, Inc. 206.128.104.0/21 AS11709 VIIN VIRTUAL INTERACTIVE CENTER 206.167.57.0/24 AS376 RISQR-3 Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 207.231.96.0/19 AS11194 NUNETI NuNet Inc 208.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 208.138.48.0/20 AS7955 SOURCE-48 SourceNet Corporation 209.27.51.0/24 AS14132 INTERN-582 Internet Gateway Inc. 209.172.0.0/18 AS7770 TRTI Triton Technologies, Inc. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.213.32.0/19 AS10629 INS-52 Inter-Pacific Network Services 209.213.48.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.49.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.251.0.0/19 AS11036 SISCOM-1 SISCOM, Inc 216.37.110.0/23 AS4264 CERFN California Education and Research Federation Network 216.96.128.0/18 AS7018 ATTW AT&T WorldNet Services 216.145.156.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.158.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.176.0/21 AS20304 JIS-32 JVLNET Internet Services 216.145.177.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.178.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.184.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.185.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.186.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.187.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.188.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.189.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.190.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.191.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.200.0/21 AS20304 JIS-32 JVLNET Internet Services 216.171.96.0/20 AS3356 LEVEL3 Level 3 Communications 216.186.151.0/24 AS3356 LEVEL3 Level 3 Communications 216.186.152.0/21 AS3356 LEVEL3 Level 3 Communications 216.186.160.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.164.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.192.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.198.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.248.0/23 AS3356 LEVEL3 Level 3 Communications Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org swinog(a)swinog.ch

1 0

RE: Please Check Filters - BOGON Filtering IP Space 72.14.128.0/19
by James Laszko 21 Jan '05

21 Jan '05

> Wash, rinse, repeat for the other 70,000 routers you manage for > customers... This is definitely NOT a half-rack in a colo fix. Just > contacting the customers is a feat. And I completely agree that it's a big pain to coordinate this. In the same hand, SBC and all other 'big' providers use BGP to dynamically update their routing tables. Their BOGON filtering should use the same sort of mechanism. If they're not going to use something like the Cymru BOGON BGP feed they should build their own and should have configured their managed routers to query that from the beginning. As more old-BOGON IP's come into play, more and more of the Internet is going to 'fall off' to these legacy route access list restricted routers. As much as I would have liked to coin the term 'network monkey', I read it in this thread by someone much more creative than I. :-) James Laszko Pipeline Communications, Inc. james(a)pcipros.com

4 3

RE: Regarding panix.com
by Bruce Tonkin 21 Jan '05

21 Jan '05

Hello All, I have had a few emails regarding a perception that we have limited support to deal with issues such as panix.com, so I will just set the record straight. We provide a standard first level retail customer service line 24 hours by 5.5 days. (which gives business hours service in all world time zones). We provide 24 hour by 7 day customer service for resellers (typically ISPs, web hosting companies etc). We provide 24 hour by 7 day second level technical operations support. Most major registrars and ICANN have direct contacts into the technical parts of Melbourne IT. I received notification from several parties via email (but I don't read email 24 hours a day). We are looking at our processes to ensure that incidents such as occurred with panix.com can be addressed more quickly within Melbourne IT, and also checking to ensure that an appropriate number of external people have access to the right contacts at Melbourne IT to fast track serious issues. Regards, Bruce Tonkin Chief Technology Officer Melbourne IT

3 4

Association of Trustworthy Roots?
by William Allen Simpson 21 Jan '05

21 Jan '05

While the Association of Trustworthy ISPs idea has some merit, we've not been too successful in self-organizing lately. ISP/C? At the moment, I'm concerned whether we have trustworthy TLD operators. It's been about 24 hours, it is well-known that the domain has been hijacked, we've heard directly from the domain owner and operator, but the TLD servers are still pointing to the hijacker. -- William Allen Simpson Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32

24 39

RE: improving the registrar transfer process
by Bruce Tonkin 21 Jan '05

21 Jan '05

Hello William, > 1. MIT receives transfer request from reseller 2. MIT sends > email confirmation to whois contact (which contact - tech, > admin?) Melbourne IT would collect the WHOIS information for the particular domain name. We would store the critical details. For .com names, we would send the email confirmation to the: Admin Contact email address The email confirmation uses this format: http://www.icann.org/transfers/foa-auth-12jul04.htm The standard form ensures that the registrant is giving explicit authorisation for the transfer and not something else (e.g a renewal). The email confirmation has a unique link (with unique code) to a Melbourne IT website. The web page again includes the authorisation information. (in the case of a name for an EPP registry, you would also be asked for the AUTH-INFO password) We would log the authorisation along with the IP address used to access the website. > 3. MIT sends email (or is it request through Verisign RRP?) > to Verisign MIT would send an RRP command to the Verisign registry. 4. The Verisign registry checks to see if the name is on Registrar LOCK. If the name is on LOCK, the RRP command will fail. 5. If the name is not on Registrar LOCK< the registry sends an email notification to both the losing and gaining registrar. I have already sent a copy of the notification used in the panix.com case. 6. MIT then waits for confirmation from the registry that the transfer is complete. This usually takes 5 days, although a losing reigstrar can explicitly confirm a transfer. > > I also would like to confirm who is responsible for denying > transfer request if LOCK is present. The registry does this. Regards, Bruce Tonkin

1 0

FW: Please Check Filters - BOGON Filtering IP Space 72.14.128.0/19
by James Laszko 21 Jan '05

21 Jan '05

We've had complaints from people at the other side of Broadwing connections -- anyone here from Broadwing? Looks like you may even be stripping 72.0.0.0/8 from BGP announcements. James Laszko Pipeline Communications, Inc. james(a)pcipros.com -----Original Message----- From: Christopher L. Morrow [mailto:christopher.morrow@mci.com] Sent: Thursday, January 20, 2005 9:55 PM To: James Laszko Cc: Rob Evans; Chris A. Epler; nanog(a)merit.edu Subject: RE: Please Check Filters - BOGON Filtering IP Space 72.14.128.0/19 On Thu, 20 Jan 2005, James Laszko wrote: > > Wash, rinse, repeat for the other 70,000 routers you manage for > > customers... This is definitely NOT a half-rack in a colo fix. Just > > contacting the customers is a feat. > > In the same hand, do you know how hard it was to get in touch with > someone at SBC/SBC-IS/PBI/PacBell that knew what the heck I was talking > about -- much less someone that might be able to do something about it? > Every group wanted to point their finger at some other group in the > company... Sure, start with the customer and convince them that there is a problem. SBC has, like sprint/att/mci/qwest/abovenet/blah-provider-of-managed-services 12 groups that do 'similar' things for 'managed customers'. Fighting their phone tree as a non-customer is a fruitless effort. Fighting the phone-tree for gov't agency #13 to let them know that some of their 'customers' aren't able to reach them might prove simpler. -Chris

1 0

RE: improving the registrar transfer process
by Bruce Tonkin 20 Jan '05

20 Jan '05

Hello William, > > We know how to do 3-way handshakes. Rather a fundamental of > the Internet. So quickly folks forget.... > > We knew in advance that the VRSN/NetSol/whatever protocol was > terrible, and that the ICANN policy change was not going to > be helpful. The ICANN policy change had no impact on this particular incident. As the incident has been documented so far, the transfer would have occurred under both the old and the new policy. With respect to the protocol. An IETF process was used to develop the EPP protocol as a replacement for RRP. With respect to notifications of transfers, the new protocol handles this by a message queue at the registry. (ie email is no longer the mechanism). It might be useful to consider reviewing the protocol to ensure that a transfer cannot proceed unless the losing registrar system confirms receipt of the transfer request. Regards, Bruce

2 1

RE: Please Check Filters - BOGON Filtering IP Space 72.14.128.0/19
by James Laszko 20 Jan '05

20 Jan '05

> Wash, rinse, repeat for the other 70,000 routers you manage for > customers... This is definitely NOT a half-rack in a colo fix. Just > contacting the customers is a feat. In the same hand, do you know how hard it was to get in touch with someone at SBC/SBC-IS/PBI/PacBell that knew what the heck I was talking about -- much less someone that might be able to do something about it? Every group wanted to point their finger at some other group in the company... James Laszko Pipeline Communications, Inc. james(a)pcipros.com

2 1