November 2005 - Test - lists.nanog.org

IP Prefixes are allocated ..
by Glen Kent 28 Nov '05

28 Nov '05

to different Autonomous systems. Is there a central/distributed database somewhere that can tell me that this particular IP prefix (say x.y.z.w) has been given to foo AS number? I tried searching through all the WHOIS records for a domain name. I get the IP address but i dont get the AS number. Any clues on how i can get the AS number? Glen

11 15

Re: BGP Security and PKI Hierarchies
by Sandy Murphy 28 Nov '05

28 Nov '05

>Regardless of what the legacy space users think, if the >RIRs decided to sign certificates for use in BGP route >for a small fee to recover costs, and if those legacy >space holders wish to make use of this new service (like >a new version of Windows) then they have to sign up and >pay the fees. The fact that they once received a free >service does not entitle them to receive *ALL* services >for free *FOREVER*. (NOTE: I am speaking for others here, readers should be aware.) The/One difficulty is that signing up for this new service, for at least one registry, requires that you sign up for the same membership relationship as the non-legacy-holders. That means you submit to the registry authority over the address you were allocated for "free", and obligates you to paying the fee thereafter. And therefore risking having the address reclaimed if membership rules are not met. The question is whether the cert signing service is valuable enough to warrant the change in risk. If the cert signing service is put into use widely enough, then I hope people would see that as a value and buy in. (NOTE: I am not a registrar and any opinions here about registry behavior are hearsay and conclusions of the witness.) --Sandy

2 1

Re: BGP Security
by Sandy Murphy 28 Nov '05

28 Nov '05

>I am placing the module to test the >UPDATE message before the formation of Adj-RIB-out. So that the false / >malicious information wont go beyond my router >... >Would like to know ur views >about this approach. I think all the various published approaches have this goal in mind, so the approach is fine. The hard part comes in deciding how to test the UPDATE message to detect "false/malicious information". There's lots of debate about that. --Sandy

1 0

Re: BGP Security and PKI Hierarchies
by Sandy Murphy 28 Nov '05

28 Nov '05

> Do you suppose that if a Microsoft salesman had given me a free copy > of Windows back in 1990, I would have a right to use any version of > Windows for free forever? I don't think this analogy exactly fits. I'm pretty sure that the legacy space holders think of this as: a Microsoft salesman had given them a free copy of Windows back in 1990, and had returned many years later to say that MS had established a registry for all new recipients of Windows that charged a registration fee, and MS wanted them to start paying the fee for the free copy as well.

3 2

BGP Security
by Kaustubh Atrawalkar 27 Nov '05

27 Nov '05

I am working over BGP security. Trying to guard router itself rather than trying to find the attacker. I am placing the module to test the UPDATE message before the formation of Adj-RIB-out. So that the false / malicious information wont go beyond my router and so that my router and the next hops will be free from attack. Would like to know ur views about this approach.

2 1

Re: What do we mean when we say 'competition?'
by Frank Coluccio 26 Nov '05

26 Nov '05

In some areas VZ will leave the copper in place if you simply ask, and in some places you must forcefully "insist." I'm aware of a case in the Tampa area where a subscriber had to "insist." While he did wind up keeping his POTS lines intact, while adding a second feed in the way of fiber for Internet access (and video, if it ever gets/got there?), alone, he advised me that this involves maintaining two accounts with Verizon. And naturally, this means two monthly bills, as well. One bill will be for the FiOS service(s), which is(are) the Internet and TV service being offered by Verizon.net, and the other account (the subscriber's original account) for POTS. If you suspect that the telco in doing this is merely trying to keep its business functions separated along the lines of switched circuit vs. IP, and for all of the regulatory reasons having to do with positioning that that implies, then you'd be 100% correct. Frank A. Coluccio DTI Consulting Inc. 212-587-8150 Office 347-526-6788 Mobile --------------------------------------- > In (at least) the Long Island, NY market, Verizon FTTH/FIOS installers > physically cut and decommission the copper upon fiber install. > Bye-bye DSL competition. Since they won't bring back the copper > even you don't like the FIOS service, it's permanent. ISTR that > the fiber doesn't carry the same restrictions on Verizon as copper > did, which is a big incentive (for them) to roll out FIOS that way. My understanding is that there is a fairly small number of pots circuits (2?) that they can bring in over the B-PON, and that moreover ISDN BRI and hicap (eg. repeatered or HDSL DS1 service) are entirely incompatible. In Virginia, there's anecdotal evidence that suggests that they'll leave the copper upon request, and won't even try to remove it if you still need it for service. Guess you know what to do. :) ---rob

1 0

Re: BGP Security and PKI Hierarchies (was: Re: Wifi Security)
by Sandy Murphy 26 Nov '05

26 Nov '05

>Hierarchical relationships breed "reptiles" because of the inherent >asymmetric business relationship that results. >... >Frankly, I am quite impressed with the address registries. How would you feel about having the registries serve as the root of a hierarchical certificate system? >So an institution would have its "certificate" signed >by its upstream (or one of its upstream) providers. How is this relationship not a hierarchical, asymmetric business relationship? What happens in this paradigm in de-peering situations? Are you are intending to exclude peering relationships from this web of trust? >The providers could cross-certificate to build a "root free" (as in >"default free" zone) mesh (aka "Web of Trust."). I believe a web of trust can be operationally feasible only if the web is more like a forest - if there are several well known examples of "tops" to the web. Otherwise, you have to be storing a plethora of different signers' certificates to be able to validate all the institution's certificates that come in. After all, there are thousands of different providers out there. If every bgp speaker uses a different certificate in signing updates to provider A than in signing updates to provider B, then the validation can be quite complex. Any trust relationship model would have to deal with (a) Provider independent space (b) Multi-homed organizations, with and without AS's (c) Organizations that are mobile - they might change their attachment point frequently or abruptly. Authorities exist for some number resources - e.g., those registries hand out addresses - should that be validated by the web of trust? (The authority says the address is allocated to A but I've got an update showing the address originating from B validated by my best peer's three best peers' peers) (Sometimes authorities are needed - if you were buying a car from Joe Doe, would you prefer a title signed by the DMV or the testimony of your favorite body shops that Joe Doe has been their customer for this car for awhile now.) That authority extends downward through sub-allocations in a tree, not a mesh. (But the web of trust might be useful for those current special cases that don't devolve from the existing registries, aka legacy space, until that situation can be fixed.) --Sandy

12 23

Weekly Routing Table Report
by Routing Table Analysis 25 Nov '05

25 Nov '05

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 26 Nov, 2005 Analysis Summary ---------------- BGP routing table entries examined: 175412 Prefixes after maximum aggregation: 98989 Unique aggregates announced to Internet: 84958 Total ASes present in the Internet Routing Table: 20974 Origin-only ASes present in the Internet Routing Table: 18252 Origin ASes announcing only one prefix: 8628 Transit ASes present in the Internet Routing Table: 2722 Transit-only ASes present in the Internet Routing Table: 73 Average AS path length visible in the Internet Routing Table: 4.5 Max AS path length visible: 25 Prefixes from unregistered ASNs in the Routing Table: 2 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 12 Number of addresses announced to Internet: 1464975232 Equivalent to 87 /8s, 81 /16s and 191 /24s Percentage of available address space announced: 39.5 Percentage of allocated address space announced: 59.5 Percentage of available address space allocated: 66.4 Total number of prefixes smaller than registry allocations: 84231 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 36699 Total APNIC prefixes after maximum aggregation: 15833 Prefixes being announced from the APNIC address blocks: 34450 Unique aggregates announced from the APNIC address blocks: 16836 APNIC Region origin ASes present in the Internet Routing Table: 2408 APNIC Region origin ASes announcing only one prefix: 700 APNIC Region transit ASes present in the Internet Routing Table: 367 Average APNIC Region AS path length visible: 4.5 Max APNIC Region AS path length visible: 17 Number of APNIC addresses announced to Internet: 207770304 Equivalent to 12 /8s, 98 /16s and 82 /24s Percentage of available APNIC address space announced: 77.1 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911 APNIC Address Blocks 58/7, 60/7, 124/7, 126/8, 202/7, 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 92643 Total ARIN prefixes after maximum aggregation: 55837 Prefixes being announced from the ARIN address blocks: 72165 Unique aggregates announced from the ARIN address blocks: 27489 ARIN Region origin ASes present in the Internet Routing Table: 10369 ARIN Region origin ASes announcing only one prefix: 3846 ARIN Region transit ASes present in the Internet Routing Table: 963 Average ARIN Region AS path length visible: 4.3 Max ARIN Region AS path length visible: 17 Number of ARIN addresses announced to Internet: 276880896 Equivalent to 16 /8s, 128 /16s and 222 /24s Percentage of available ARIN address space announced: 68.8 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863 ARIN Address Blocks 24/8, 63/8, 64/6, 68/7, 70/6, 74/7, 76/8, 198/7, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 34319 Total RIPE prefixes after maximum aggregation: 23169 Prefixes being announced from the RIPE address blocks: 31276 Unique aggregates announced from the RIPE address blocks: 20972 RIPE Region origin ASes present in the Internet Routing Table: 7333 RIPE Region origin ASes announcing only one prefix: 3833 RIPE Region transit ASes present in the Internet Routing Table: 1210 Average RIPE Region AS path length visible: 5.0 Max RIPE Region AS path length visible: 20 Number of RIPE addresses announced to Internet: 224984832 Equivalent to 13 /8s, 104 /16s and 255 /24s Percentage of available RIPE address space announced: 67.1 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 RIPE Address Blocks 62/8, 80/5, 88/6, 188/8, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 9957 Total LACNIC prefixes after maximum aggregation: 3298 Prefixes being announced from the LACNIC address blocks: 8248 Unique aggregates announced from the LACNIC address blocks: 4765 LACNIC Region origin ASes present in the Internet Routing Table: 650 LACNIC Region origin ASes announcing only one prefix: 207 LACNIC Region transit ASes present in the Internet Routing Table: 122 Average LACNIC Region AS path length visible: 5.2 Max LACNIC Region AS path length visible: 25 Number of LACNIC addresses announced to Internet: 22922752 Equivalent to 1 /8s, 93 /16s and 198 /24s Percentage of available LACNIC address space announced: 34.2 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 189/8, 190/8, 200/7 AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 1787 Total AfriNIC prefixes after maximum aggregation: 852 Prefixes being announced from the AfriNIC address blocks: 1150 Unique aggregates announced from the AfriNIC address blocks: 833 AfriNIC Region origin ASes present in the Internet Routing Table: 141 AfriNIC Region origin ASes announcing only one prefix: 42 AfriNIC Region transit ASes present in the Internet Routing Table: 18 Average AfriNIC Region AS path length visible: 4.6 Max AfriNIC Region AS path length visible: 16 Number of AfriNIC addresses announced to Internet: 2862848 Equivalent to 0 /8s, 43 /16s and 175 /24s Percentage of available AfriNIC address space announced: 8.5 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 1017 6348 217 CHINANET-BACKBONE 9583 830 77 12 Sify Limited 4755 753 259 69 Videsh Sanchar Nigam Ltd. Aut 1221 742 1342 514 Telstra Pty Ltd 4766 651 3927 287 Korea Telecom (KIX) 7545 510 108 69 TPG Internet Pty Ltd 17676 470 6819 100 Softbank BB Corp. 9498 410 216 65 BHARTI BT INTERNET LTD. 9443 394 87 80 Primus Telecommunications 17488 370 22 10 Hathway IP Over Cable Interne 4802 348 74 160 Wantree Development 2907 340 1764 317 SINET Japan 17557 331 24 161 Pakistan Telecom 9929 330 217 48 China Netcom Corp. 7474 329 258 227 SingTel Optus Pty Ltd 18302 312 142 173 SK Global co., Ltd 17974 280 65 16 PT TELEKOMUNIKASI INDONESIA 9837 276 79 177 Powertel Ltd 18101 271 68 19 Reliance Infocom Ltd Internet 9800 257 410 67 CHINA UNICOM ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1477 6316 964 AT&T WorldNet Services 4323 1191 706 233 Time Warner Telecom 174 1069 5846 992 Cogent Communications 721 1066 21935 310 DLA Systems Automation Center 701 987 8135 832 UUNET Technologies, Inc. 6197 962 407 496 BellSouth Network Solutions, 2386 914 528 687 AT&T Data Communications Serv 18566 878 240 7 Covad Communications 1239 845 2801 599 Sprint 209 656 3607 520 Qwest 20115 655 532 345 Charter Communications 11492 629 81 10 Cable One 852 573 1093 381 Telus Advanced Communications 19262 563 1593 135 Verizon Global Networks 19916 563 49 54 OLM LLC 855 557 247 64 Canadian Research Network 22773 557 1468 25 Cox Communications, Inc. 3602 543 126 103 Sprint Canada, Inc. 3356 515 10633 402 Level 3 Communications, LLC 6478 495 1427 276 AT&T Worldnet Services RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 616 1960 484 UUNET - Commercial IP service 3301 304 1101 290 TeliaNet Sweden 3320 285 3230 240 Deutsche Telekom AG 8220 271 475 266 COLT Telecommunications 680 245 2040 239 DFN-IP service G-WiN 8708 233 274 219 Romania Data Systems S.A. 3246 230 477 223 Song Networks 6746 202 51 173 Dynamic Network Technologies, 1257 195 712 171 SWIPnet Swedish IP Network 3269 182 1829 68 TELECOM ITALIA 5515 182 840 128 Sonera Solution Autonomous Sy 786 174 1795 174 The JANET IP Service 5400 166 317 136 BT Ignite European Backbone 6830 161 669 33 UPC Distribution Services 3300 160 170 94 AUCS Communications Services 8866 159 37 9 Bulgarian Telecommunication C 3215 150 1275 81 France Telecom Transpac 24863 150 37 6 LINKdotNET AS number 12479 148 322 5 Uni2 Autonomous System 25186 148 211 104 France Telecom Transpac's Tra LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 397 709 170 UniNet S.A. de C.V. 16814 295 18 7 NSS, S.A. 11172 282 104 69 Servicios Alestra S.A de C.V 11664 222 22 14 Keytech SA 19632 196 14 5 Metropolis Intercom S.A. 14117 184 11 6 Telefonica del Sur S.A. 22047 180 128 8 VTR PUNTO NET S.A. 6147 158 118 21 Telefonica Del Peru 7303 152 72 19 Telecom Argentina Stet-France 13999 142 52 9 Mega Cable S.A. de C.V. 11556 130 64 3 Cable-Wireless Panama 19169 126 8 23 Telconet 10481 121 48 8 Prima S.A. 6503 113 148 74 AVANTEL, S.A. 6505 113 89 83 Global One Communicaoes Ltda 18822 113 7 10 TELEFONICA MANQUEHUE 21826 112 14 18 INTERCABLE 5639 111 12 9 Telecommunications Services o 11311 99 8 10 Sinectis S.A. 4270 92 17 9 Red de Interconexion Universi AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 268 708 228 The Internet Solution 8452 147 44 7 TEDATA 5536 122 8 16 Internet Egypt Network 2018 117 298 103 Tertiary Education Network 2905 78 211 71 The Internetworking Company o 20928 61 16 2 Noor Advanced Technologies AS 24835 59 34 6 RAYA Telecom - Egypt 6713 56 71 10 Itissalat Al-MAGHRIB 15475 56 84 4 Nile Online 5713 38 151 34 Telkom SA Ltd 12455 33 6 3 Jambonet Autonomous system 33774 33 4 24 AS Number for Telecom Algeria 15706 31 8 3 Sudatel Internet Exchange Aut 8524 23 1 4 AUCEGYPT Autonomous System 16637 23 10 21 Johnnic e-Ventures 23889 23 5 9 MAURITIUS TELECOM 10798 22 1 13 Standard Bank of South Africa 21280 21 4 4 Swift Global Kenya Ltd.Is an 12258 17 3 11 Vodacom Internet Company 15808 17 2 2 Communication Solutions Ltd i Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 4323 1191 958 Time Warner Telecom 18566 878 871 Covad Communications 9583 830 818 Sify Limited 4134 1017 800 CHINANET-BACKBONE 721 1066 756 DLA Systems Automation Center 4755 753 684 Videsh Sanchar Nigam Ltd. Aut 11492 629 619 Cable One 22773 557 532 Cox Communications, Inc. 19916 563 509 OLM LLC 855 557 493 Canadian Research Network 6197 962 466 BellSouth Network Solutions, 5668 476 450 CenturyTel Internet Holdings, 7545 510 441 TPG Internet Pty Ltd 3602 543 440 Sprint Canada, Inc. 19262 563 428 Verizon Global Networks 17676 470 370 Softbank BB Corp. 4766 651 364 Korea Telecom (KIX) 17488 370 360 Hathway IP Over Cable Interne 6467 403 355 E.Spire Communications, Inc. 9498 410 345 BHARTI BT INTERNET LTD. List of Unregistered ASNs (Global) ---------------------------------- Bad AS Designation Network Transit AS Description 65003 PRIVATE 57.250.244.0/24 13879 SITA-EQUANT 24413 UNALLOCATED 202.46.32.0/19 17623 China Netcom Corp. Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 192.43.230.0/24 7575 Australian Academic and Rease 192.44.0.0/24 5501 Fraunhofer Gesellschaft 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.72.0.0/18 4780 Digital United Inc. 192.72.0.0/16 4780 Digital United Inc. 192.84.205.0/24 719 LANLINK autonomous system 192.119.135.0/24 270 NASA 192.172.0.0/19 721 DLA Systems Automation Center Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:18 /9:5 /10:8 /11:17 /12:82 /13:188 /14:342 /15:666 /16:8606 /17:2895 /18:4883 /19:11042 /20:12165 /21:10216 /22:13506 /23:14613 /24:95210 /25:347 /26:291 /27:203 /28:26 /29:12 /30:37 /31:3 /32:31 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 862 878 Covad Communications 6197 784 962 BellSouth Network Solutions, 7018 728 1477 AT&T WorldNet Services 9583 653 830 Sify Limited 2386 641 914 AT&T Data Communications Serv 11492 621 629 Cable One 4323 569 1191 Time Warner Telecom 19916 557 563 OLM LLC 4766 456 651 Korea Telecom (KIX) 855 430 557 Canadian Research Network 702 395 616 UUNET - Commercial IP service 7011 381 432 Citizens Utilities 5668 376 476 CenturyTel Internet Holdings, 1239 365 845 Sprint 6198 355 493 BellSouth Network Solutions, 6517 318 343 Yipes Communications, Inc. 15270 317 344 PaeTec.net -a division of Pae 13609 298 340 Choice One Communications Inc 18302 296 312 SK Global co., Ltd 701 286 987 UUNET Technologies, Inc. Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:3 8:38 12:1621 13:1 15:11 16:3 17:3 18:3 20:42 24:680 30:2 32:64 38:182 40:54 44:3 47:3 52:4 55:1 56:3 57:35 58:94 59:95 60:153 61:803 62:791 63:1897 64:2909 65:2126 66:2895 67:636 68:685 69:1315 70:236 71:35 72:467 80:695 81:580 82:481 83:317 84:308 85:371 86:205 87:101 125:63 128:142 129:169 130:99 131:301 132:34 133:1 134:151 135:45 136:164 137:71 138:173 139:75 140:446 141:146 142:400 143:145 144:219 145:34 146:304 147:131 148:271 149:193 150:107 151:73 152:111 153:94 154:5 155:152 156:84 157:118 158:146 159:179 160:85 161:76 162:241 163:159 164:189 165:183 166:146 167:246 168:460 169:139 170:309 171:12 192:5749 193:3359 194:2437 195:1642 196:720 198:3910 199:3213 200:4288 201:455 202:6247 203:6586 204:3828 205:2040 206:2440 207:2886 208:2032 209:3454 210:1781 211:797 212:1219 213:1382 214:315 215:42 216:3842 217:1169 218:222 219:128 220:539 221:317 222:129 End of report

1 0

Re: BGP Security and PKI Hierarchies (was: Re: Wifi Security)
by Sandy Murphy 23 Nov '05

23 Nov '05

>My issue is that if ISPs a) only announce networks that they know >(for different values of know - but hopefully based on some kind of >trust in the RIR's data) they are authorized to announce, and b) took >responsibility for the behavior of the paths or prefixes they >announce, and the bits that are originated in those paths or >prefixes, and took action to stop the bad behavior, the issue of >trust paths might not be so critical. Problems with bad routing behavior have been around since the very earliest days of the Arpanet - I think we'd be mad to rely on that going away. (As long as everybody was honest, there'd be no need for fraud laws and law enforcement and courts.... lost cause, there.) One of the hoped for goals of the various security solutions is the ability to make your own check of what you are being told, so if someone along the way is less than correct and less than diligent in checking what they are propagating, you the diligent one can stop the problems. --Sandy

1 0

How to check the As path from internet
by Md. kamal Hossain 23 Nov '05

23 Nov '05

Dear all I am a newbie in bgp.Would any one describe the as path from the looking glass and would tell me some free looking glass url best of luck kamal -- This message has been scanned for viruses and dangerous content, and is believed to be clean.

2 1