February 2005 - Test - lists.nanog.org

Weekly Routing Table Report
by Routing Table Analysis 11 Feb '05

11 Feb '05

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 12 Feb, 2005 Analysis Summary ---------------- BGP routing table entries examined: 155599 Prefixes after maximum aggregation: 90769 Unique aggregates announced to Internet: 74551 Total ASes present in the Internet Routing Table: 18969 Origin-only ASes present in the Internet Routing Table: 16484 Origin ASes announcing only one prefix: 7738 Transit ASes present in the Internet Routing Table: 2485 Transit-only ASes present in the Internet Routing Table: 80 Average AS path length visible in the Internet Routing Table: 4.5 Max AS path length visible: 22 Prefixes from unregistered ASNs in the Routing Table: 18 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 22 Number of addresses announced to Internet: 1374625740 Equivalent to 81 /8s, 239 /16s and 31 /24s Percentage of available address space announced: 37.1 Percentage of allocated address space announced: 58.6 Percentage of available address space allocated: 63.2 Total number of prefixes smaller than registry allocations: 72464 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 30978 Total APNIC prefixes after maximum aggregation: 14936 Prefixes being announced from the APNIC address blocks: 29027 Unique aggregates announced from the APNIC address blocks: 14666 APNIC Region origin ASes present in the Internet Routing Table: 2204 APNIC Region origin ASes announcing only one prefix: 648 APNIC Region transit ASes present in the Internet Routing Table: 326 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 15 Number of APNIC addresses announced to Internet: 173936896 Equivalent to 10 /8s, 94 /16s and 17 /24s Percentage of available APNIC address space announced: 64.5 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 23552-24575 APNIC Address Blocks 58/7, 60/7, 124/7, 126/8, 202/7, 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 87104 Total ARIN prefixes after maximum aggregation: 52392 Prefixes being announced from the ARIN address blocks: 66324 Unique aggregates announced from the ARIN address blocks: 24080 ARIN Region origin ASes present in the Internet Routing Table: 9868 ARIN Region origin ASes announcing only one prefix: 3594 ARIN Region transit ASes present in the Internet Routing Table: 957 Average ARIN Region AS path length visible: 4.3 Max ARIN Region AS path length visible: 16 Number of ARIN addresses announced to Internet: 240880896 Equivalent to 14 /8s, 91 /16s and 141 /24s Percentage of available ARIN address space announced: 71.8 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 ARIN Address Blocks 24/8, 63/8, 64/6, 68/7, 70/7, 72/8, 198/7, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 29389 Total RIPE prefixes after maximum aggregation: 20318 Prefixes being announced from the RIPE address blocks: 26341 Unique aggregates announced from the RIPE address blocks: 17498 RIPE Region origin ASes present in the Internet Routing Table: 6307 RIPE Region origin ASes announcing only one prefix: 3344 RIPE Region transit ASes present in the Internet Routing Table: 1074 Average RIPE Region AS path length visible: 5.1 Max RIPE Region AS path length visible: 22 Number of RIPE addresses announced to Internet: 187806784 Equivalent to 11 /8s, 49 /16s and 180 /24s Percentage of available RIPE address space announced: 65.8 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-34815 RIPE Address Blocks 62/8, 80/5, 88/8, 188/8, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 6790 Total LACNIC prefixes after maximum aggregation: 2418 Prefixes being announced from the LACNIC address blocks: 6684 Unique aggregates announced from the LACNIC address blocks: 3972 LACNIC Region origin ASes present in the Internet Routing Table: 420 LACNIC Region origin ASes announcing only one prefix: 128 LACNIC Region transit ASes present in the Internet Routing Table: 82 Average LACNIC Region AS path length visible: 5.0 Max LACNIC Region AS path length visible: 16 Number of LACNIC addresses announced to Internet: 17393664 Equivalent to 1 /8s, 9 /16s and 104 /24s Percentage of available LACNIC address space announced: 51.8 LACNIC AS Blocks 26592-26623, 27648-28671 LACNIC Address Blocks 200/7 Emerging AfriNIC Region Analysis Summary ---------------------------------------- Prefixes being announced by AfriNIC Region ASes: 1320 Total AfriNIC prefixes after maximum aggregation: 705 Prefixes being announced from the AfriNIC address blocks: 890 Unique aggregates announced from the AfriNIC address blocks: 714 AfriNIC Region origin ASes present in the Internet Routing Table: 95 AfriNIC Region origin ASes announcing only one prefix: 24 AfriNIC Region transit ASes present in the Internet Routing Table: 13 Average AfriNIC Region AS path length visible: 4.5 Max AfriNIC Region AS path length visible: 12 Number of AfriNIC addresses announced to Internet: 2171136 Equivalent to 0 /8s, 33 /16s and 33 /24s Percentage of available AfriNIC address space announced: 12.9 AfriNIC AS Blocks <none> AfriNIC Address Blocks 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 883 4688 172 Data Communications Bureau 1221 786 1184 561 Telstra Pty Ltd 4766 586 3414 281 Korea Internet Exchange for " 9583 586 48 11 Satyam Infoway Ltd., 4755 456 241 101 Videsh Sanchar Nigam Ltd. Aut 7545 426 86 69 TPG Internet Pty Ltd 17676 396 5948 64 XTAGE CORPORATION 9443 371 77 79 Primus Telecommunications 9929 350 164 35 China Netcom Corp. 2907 347 1838 322 SINET Japan 17557 326 24 149 Pakistan Telecom 10036 294 27 270 C&M Communication Co. Ltd. 7474 286 299 208 Optus Communications Pty Ltd 2764 271 238 217 connect.com.au pty ltd 703 269 339 211 UUNET 9800 237 383 75 CHINA UNICOM 4808 236 170 128 CHINANET core WAN North 9498 234 81 54 BHARTI BT INTERNET LTD. 17974 231 63 12 PT TELEKOMUNIKASI INDONESIA 4802 230 28 139 Wantree Development ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1459 6602 974 AT&T WorldNet Services 721 1154 21851 317 DLA Systems Automation Center 701 1034 8309 881 UUNET Technologies, Inc. 4323 1032 672 221 Time Warner Telecom 1239 951 2880 627 Sprint 6197 860 378 402 BellSouth Network Solutions, 2386 827 511 608 AT&T Data Communications Serv 18566 770 208 6 Covad Communications 209 647 3467 498 Qwest 3356 596 10868 445 Level 3 Communications, LLC 3561 584 2370 416 Cable & Wireless USA 20115 578 481 304 Charter Communications 852 525 1126 399 Telus Advanced Communications 6478 496 822 97 AT&T Worldnet Services 3602 492 120 91 Sprint Canada, Inc. 22773 469 1090 24 Cox Communications, Inc. Atla 27364 468 44 18 Armstrong Cable Services 6198 458 472 204 BellSouth Network Solutions, 5668 441 87 17 Century Telephone 7132 441 8411 381 SBC Internet Services RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 614 2020 506 UUNET - Commercial IP service 3320 296 2992 230 Deutsche Telekom AG 3301 290 1112 278 TeliaNet Sweden 8220 277 466 271 COLT Internet - International 680 253 2041 239 DFN-IP service G-WiN 3246 224 475 219 Song Networks 13083 217 51 8 Mannesmann Datenverarbeitung 8708 216 120 196 Romania Data Systems S.A. 1257 205 708 171 SWIPnet Swedish IP Network 3215 200 1033 78 France Telecom Transpac 5515 187 842 135 Sonera Solution Autonomous Sy 6746 179 47 143 Dynamic Network Technologies, 786 176 1794 176 The JANET IP Service 8866 170 19 20 Bulgarian Telecommunication C 3300 168 184 84 AUCS Communications Services 719 163 322 105 LANLINK autonomous system 3269 163 1424 72 TELECOM ITALIA 25186 141 138 99 France Telecom Transpac's Tra 5400 140 219 124 BT Ignite European Backbone 9051 128 8 33 INCONET Autonomous System LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6140 361 140 70 ImpSat 8151 339 501 143 UniNet S.A. de C.V. 16814 233 14 6 NSS, S.A. 11172 219 101 54 Servicios Alestra S.A de C.V 6147 170 100 22 Telefonica Del Peru 7303 149 68 22 Telecom Argentina Stet-France 11664 149 19 24 Keytech SA 6505 134 90 91 Global One Communicaoes Ltda 14117 119 7 5 Telefonica del Sur S.A. 6503 116 146 79 AVANTEL, S.A. 11992 107 9 31 Integrated Systems 11556 97 48 3 Cable-Wireless Panama 13999 90 52 9 Mega Cable S.A. de C.V. 14420 87 6 42 ANDINATEL S.A. 11311 86 8 22 Sinectis S.A. 6535 85 7 23 Chilesat Servicios Empresari 10481 82 32 7 Prima S.A. 5639 81 8 8 Telecommunications Services o 4270 79 18 9 Red de Interconexion Universi 15311 78 25 37 Telefonica Empresas AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 268 636 226 The Internet Solution 5536 113 15 17 Internet Egypt Network 2018 90 295 87 Tertiary Education Network 2905 85 267 77 The Internetworking Company o 20928 84 16 2 Noor Advanced Technologies AS 24835 56 34 6 RAYA Telecom - Egypt 8452 38 20 5 TEDATA 6713 35 54 9 Itissalat Al-MAGHRIB 9129 33 3 2 UUNET Kenya 5713 27 141 24 Telkom SA Ltd 12455 27 7 4 Jambonet Autonomous system 8524 22 1 4 AUCEGYPT Autonomous System 16637 22 10 19 Johnnic e-Ventures 10798 18 1 12 Standard Bank of South Africa 12258 18 3 12 Vodacom Internet Company 21280 16 2 3 Swift Global Kenya Ltd.Is an 15706 15 4 2 Sudatel Internet Exchange Aut 21491 15 1 3 UTL On-line is RF broadband I 15808 14 1 1 Communication Solutions Ltd i 17148 13 1 7 First National Bank Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 721 1154 837 DLA Systems Automation Center 4323 1032 811 Time Warner Telecom 18566 770 764 Covad Communications 4134 883 711 Data Communications Bureau 9583 586 575 Satyam Infoway Ltd., 6197 860 458 BellSouth Network Solutions, 27364 468 450 Armstrong Cable Services 22773 469 445 Cox Communications, Inc. Atla 5668 441 424 Century Telephone 3602 492 401 Sprint Canada, Inc. 6478 496 399 AT&T Worldnet Services 7545 426 357 TPG Internet Pty Ltd 4755 456 355 Videsh Sanchar Nigam Ltd. Aut 22909 418 339 Comcast Cable Corporation 6467 365 334 E.Spire Communications, Inc. 17676 396 332 XTAGE CORPORATION 1239 951 324 Sprint 9929 350 315 China Netcom Corp. 4766 586 305 Korea Internet Exchange for " 9443 371 292 Primus Telecommunications List of Unregistered ASNs (Global) ---------------------------------- Bad AS Designation Network Transit AS Description 64826 PRIVATE 64.200.250.0/23 7911 Williams Communicati 40439 UNALLOCATED 66.194.101.0/24 30439 Memphis Daily News 64513 PRIVATE 149.117.96.0/24 577 Bell Advanced Commun 26422 UNALLOCATED 196.46.184.0/22 3741 The Internet Solutio 64512 PRIVATE 199.213.17.0/25 15296 Netera Alliance Inc. 64512 PRIVATE 199.213.17.128/25 15296 Netera Alliance Inc. 64512 PRIVATE 199.216.97.0/28 15296 Netera Alliance Inc. 64512 PRIVATE 199.216.148.0/28 15296 Netera Alliance Inc. 65004 PRIVATE 200.0.113.0/24 28477 * 65004 PRIVATE 200.4.0.0/24 28477 * 65004 PRIVATE 200.4.1.0/24 28477 * 65004 PRIVATE 200.4.2.0/24 28477 * 65004 PRIVATE 200.4.3.0/24 28477 * 65004 PRIVATE 200.4.4.0/24 28477 * 65004 PRIVATE 200.4.5.0/24 28477 * 65004 PRIVATE 200.4.6.0/24 28477 * 65529 PRIVATE 216.21.199.0/24 14697 VDot.Net 65529 PRIVATE 216.152.237.0/24 14697 VDot.Net Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 172.212.0.0/16 1668 GNN Hosting Service 172.213.0.0/16 1668 GNN Hosting Service 172.214.0.0/16 1668 GNN Hosting Service 172.215.0.0/16 1668 GNN Hosting Service 172.216.0.0/16 1668 GNN Hosting Service 192.44.0.0/24 5501 Fraunhofer Gesellschaft 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.83.16.0/20 5515 Sonera Solution Autonomous Sy 192.83.32.0/19 5515 Sonera Solution Autonomous Sy 192.83.96.0/22 5515 Sonera Solution Autonomous Sy 192.83.100.0/24 5515 Sonera Solution Autonomous Sy 192.84.205.0/24 719 LANLINK autonomous system 192.119.135.0/24 270 NASA 192.135.50.0/24 7018 AT&T WorldNet Services 192.136.79.0/24 719 LANLINK autonomous system 192.172.0.0/19 721 DLA Systems Automation Center 192.172.11.0/24 721 DLA Systems Automation Center 192.200.100.0/24 7018 AT&T WorldNet Services Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:3 /10:7 /11:14 /12:62 /13:146 /14:311 /15:566 /16:8304 /17:2405 /18:4090 /19:10079 /20:10700 /21:8446 /22:11718 /23:12917 /24:84952 /25:298 /26:256 /27:112 /28:49 /29:22 /30:82 /31:0 /32:41 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 755 770 Covad Communications 6197 705 860 BellSouth Network Solutions, 7018 630 1459 AT&T WorldNet Services 2386 591 827 AT&T Data Communications Serv 4323 478 1032 Time Warner Telecom 27364 453 468 Armstrong Cable Services 9583 412 586 Satyam Infoway Ltd., 4766 399 586 Korea Internet Exchange for " 5668 376 441 Century Telephone 702 373 614 UUNET - Commercial IP service 1239 369 951 Sprint 6198 331 458 BellSouth Network Solutions, 10036 294 294 C&M Communication Co. Ltd. 6517 285 307 Yipes Communications, Inc. 6467 275 365 E.Spire Communications, Inc. 9929 275 350 China Netcom Corp. 11456 263 310 Carolina Online, Inc. 13609 256 305 Choice One Communications Inc 25844 245 245 Skadden, Arps, Slate, Meagher 701 244 1034 UUNET Technologies, Inc. Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:4 8:9 12:1486 13:1 15:6 16:2 17:3 18:4 20:4 24:739 32:68 33:3 38:94 40:55 44:3 47:2 52:3 55:2 56:3 57:21 59:2 60:16 61:688 62:505 63:1865 64:2590 65:2084 66:2726 67:499 68:500 69:907 70:64 71:2 72:82 80:554 81:490 82:349 83:280 84:129 85:104 128:139 129:166 130:92 131:195 132:37 133:1 134:142 135:30 136:213 137:66 138:179 139:50 140:195 141:101 142:140 143:123 144:252 145:45 146:282 147:99 148:262 149:163 150:95 151:62 152:110 153:73 154:2 155:140 156:69 157:78 158:149 159:164 160:67 161:59 162:417 163:84 164:213 165:157 166:131 167:226 168:389 169:132 170:314 171:9 192:5687 193:3060 194:2257 195:1570 196:621 198:3858 199:3285 200:3932 201:53 202:5160 203:5979 204:3627 205:2021 206:2314 207:2667 208:2095 209:3096 210:1566 211:780 212:1148 213:1258 214:239 215:31 216:3670 217:1100 218:189 219:117 220:354 221:82 222:76 End of report

1 0

RE: The Cidr Report
by Malayter, Christopher 11 Feb '05

11 Feb '05

I noticed a large jump in prefixes from 4323 this week as well. -Chris -----Original Message----- From: Philip Smith [mailto:pfs@cisco.com] Sent: Friday, February 11, 2005 4:00 PM To: nanog(a)merit.edu Subject: Re: The Cidr Report Frotzler, Florian said the following on 11/02/2005 21:31: >>Recent Table History >> Date Prefixes CIDR Agg >> 04-02-05 151613 103143 >> 05-02-05 152142 103736 >> 06-02-05 152231 103721 >> 07-02-05 152353 103830 >> 08-02-05 152514 103966 >> 09-02-05 153855 104090 >> 10-02-05 154283 104246 >> 11-02-05 154341 104240 > > ~ +3000 routes in one week? Anyone else frightened by this? Yup. From my own Routing Report (due out in a couple of hours), a quick glance shows that the vast majority of the increase comes from ASNs assigned by ARIN (the ASNs from the other three registry regions show minimal increase in announcements). Most seem to come from AS4323. Today they are announcing 2606 prefixes, a week ago they were announcing 844 prefixes. philip --

1 0

The Cidr Report
by cidr-report＠potaroo.net 11 Feb '05

11 Feb '05

This report has been generated at Fri Feb 11 21:44:29 2005 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 04-02-05 151613 103143 05-02-05 152142 103736 06-02-05 152231 103721 07-02-05 152353 103830 08-02-05 152514 103966 09-02-05 153855 104090 10-02-05 154283 104246 11-02-05 154341 104240 AS Summary 18869 Number of ASes in routing system 7735 Number of ASes announcing only one prefix 1441 Largest number of prefixes announced by an AS AS7018 : ATTW AT&T WorldNet Services 90770688 Largest address span announced by an AS (/32s) AS721 : DNIC DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 11Feb05 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 151940 104250 47690 31.4% All ASes AS4323 1031 227 804 78.0% TWTC Time Warner Telecom AS18566 770 7 763 99.1% CVAD Covad Communications AS4134 868 203 665 76.6% CHINANET-BACKBONE No.31,Jin-rong Street AS721 1137 573 564 49.6% DNIC DoD Network Information Center AS22773 469 26 443 94.5% CXA Cox Communications Inc. AS7018 1441 1000 441 30.6% ATTW AT&T WorldNet Services AS27364 468 34 434 92.7% ARMC Armstrong Cable Services AS6197 852 454 398 46.7% BNS-14 BellSouth Network Solutions, Inc AS3602 492 136 356 72.4% SPCA Sprint Canada Inc. AS6478 496 156 340 68.5% ATTW AT&T WorldNet Services AS1239 946 632 314 33.2% SPRN Sprint AS9929 339 35 304 89.7% CNCNET-CN China Netcom Corp. AS4766 570 281 289 50.7% KIXS-AS-KR Korea Telecom AS17676 394 105 289 73.4% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS14654 259 6 253 97.7% WAYPOR-3 Wayport AS9443 375 124 251 66.9% INTERNETPRIMUS-AS-AP Primus Telecommunications AS22909 422 182 240 56.9% CMCS Comcast Cable Communications, Inc. AS4355 298 64 234 78.5% ERSD EARTHLINK, INC AS25844 244 15 229 93.9% SASMFL-2 Skadden, Arps, Slate, Meagher & Flom LLP AS6198 451 225 226 50.1% BNS-14 BellSouth Network Solutions, Inc AS6140 381 171 210 55.1% IMPSA ImpSat AS15270 248 41 207 83.5% PDP-14 PaeTec.net -a division of PaeTecCommunications, Inc. AS2386 826 625 201 24.3% ADCS-1 AT&T Data Communications Services AS7545 425 224 201 47.3% TPG-INTERNET-AP TPG Internet Pty Ltd AS5668 439 251 188 42.8% CIH-12 CenturyTel Internet Holdings, Inc. AS6517 305 120 185 60.7% YIPS Yipes Communications, Inc. AS19632 191 8 183 95.8% Metropolis Intercom AS6167 259 78 181 69.9% CELLCO Cellco Partnership AS9498 236 55 181 76.7% BBIL-AP BHARTI BT INTERNET LTD. AS16852 240 64 176 73.3% FDCI Focal Data Communications of Illinois Total 15872 6122 9750 61.4% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 AHSICHCL Andara High Speed Internet c/o Halifax Cable Ltd. 24.246.0.0/17 AS7018 ATTW AT&T WorldNet Services 24.246.38.0/24 AS25994 NPGCAB NPG Cable, INC 24.246.128.0/18 AS7018 ATTW AT&T WorldNet Services 64.17.32.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.17.33.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.17.37.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.46.27.0/24 AS8674 NETNOD-IX Netnod Internet Exchange Sverige AB 64.57.160.0/19 AS3561 SAVVI-3 Savvis 64.92.128.0/19 AS3561 SAVVI-3 Savvis 64.127.0.0/18 AS7018 ATTW AT&T WorldNet Services 64.209.192.0/18 AS3561 SAVVI-3 Savvis 69.26.32.0/19 AS17307 VIRTEL-15 Virtela Communications 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.30.127.0/24 AS719 ELISA-AS Elisa Oyj 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.44.0.0/19 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 192.44.0.0/24 AS5501 FRAUNHOFER-CLUSTER-BW Fraunhofer Gesellschaft 192.70.164.0/24 AS11814 IGST Information Gateway Services - Toronto 192.81.182.0/24 AS719 ELISA-AS Elisa Oyj 192.81.183.0/24 AS719 ELISA-AS Elisa Oyj 192.81.184.0/24 AS719 ELISA-AS Elisa Oyj 192.119.135.0/24 AS270 NASA National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS4004 GLOBALONE-EQUANT-UK Equant UK & Greece Autonomous System 192.135.50.0/24 AS7018 ATTW AT&T WorldNet Services 192.153.144.0/21 AS721 DNIC DoD Network Information Center 192.172.0.0/19 AS721 DNIC DoD Network Information Center 192.188.208.0/20 AS721 DNIC DoD Network Information Center 192.200.100.0/24 AS7018 ATTW AT&T WorldNet Services 196.2.95.0/24 AS8668 TELONE-AS TelOne Zimbabwe P/L 198.23.26.0/24 AS4390 BELLAT-7 Bell Atlantic, Inc. 198.97.72.0/21 AS721 DNIC DoD Network Information Center 198.97.80.0/20 AS721 DNIC DoD Network Information Center 198.97.88.0/24 AS89 NUSC-1 Naval Underwater Systems Center 198.97.240.0/20 AS721 DNIC DoD Network Information Center 198.97.247.0/24 AS3475 DEPART-52 Department of the Navy 198.101.4.0/22 AS721 DNIC DoD Network Information Center 198.136.32.0/20 AS19329 MCBCC Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY CityNet, Inc. 198.161.87.0/24 AS6539 GTGR GT Group Telecom Services Corp. 198.163.155.0/24 AS684 MRN Manitoba Regional Network 198.167.0.0/16 AS7456 INS-51 Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 UU UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASK SaskTel 198.232.133.0/24 AS23075 SKOTOS Skotos Tech, Inc 199.10.0.0/16 AS721 DNIC DoD Network Information Center 199.60.0.0/20 AS271 UBC-3 University of British Columbia 199.96.44.0/23 AS19092 360NE-1 360Networks (USA) Inc. 199.96.46.0/24 AS19092 360NE-1 360Networks (USA) Inc. 199.114.0.0/21 AS721 DNIC DoD Network Information Center 199.114.128.0/18 AS721 DNIC DoD Network Information Center 199.114.130.0/24 AS721 DNIC DoD Network Information Center 199.114.132.0/24 AS721 DNIC DoD Network Information Center 199.114.134.0/24 AS3541 DISAUN DISA/UNRRA 199.114.136.0/24 AS27044 DNIC DoD Network Information Center 199.114.138.0/24 AS721 DNIC DoD Network Information Center 199.114.140.0/24 AS3544 DISAUN DISA/UNRRA 199.114.142.0/24 AS721 DNIC DoD Network Information Center 199.114.144.0/24 AS721 DNIC DoD Network Information Center 199.114.148.0/24 AS721 DNIC DoD Network Information Center 199.114.150.0/24 AS721 DNIC DoD Network Information Center 199.114.152.0/24 AS27033 DNIC DoD Network Information Center 199.114.154.0/24 AS1733 ADP-41 AF DDN PMO 199.114.156.0/24 AS27034 DNIC DoD Network Information Center 199.114.160.0/24 AS1733 ADP-41 AF DDN PMO 199.120.32.0/19 AS16582 NXLI NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS721 DNIC DoD Network Information Center 199.123.0.0/18 AS721 DNIC DoD Network Information Center 199.123.16.0/20 AS721 DNIC DoD Network Information Center 199.123.80.0/21 AS721 DNIC DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST IQuest Internet 199.202.0.0/16 AS701 UU UUNET Technologies, Inc. 201.239.0.0/16 AS22047 VTR BANDA ANCHA S.A. 202.72.240.0/20 AS24320 RAILCOM Mongolian Railway Commercial Center Railcom 202.73.128.0/22 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.86.252.0/22 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.164.224.0/19 AS7599 IPXC-AS-AP IP Exchange 203.32.4.0/23 AS7617 TELEONE-HK TeleTeleOne (HK) Limited 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.99.0.0/19 AS17746 ORCONINTERNET-NZ-AP Orcon Internet 203.170.14.0/23 AS6648 ASN-SKYINTERNET Autonomous System Number peering of BAYANTEL 203.210.69.0/24 AS17536 PRODIGY-AS-AP Prodidgy Telecommunications 204.11.108.0/22 AS33419 TRIBAL-2 Tribal Fusion Inc. 204.154.125.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBI Exobit Networks Inc. 205.150.0.0/15 AS701 UU UUNET Technologies, Inc. 206.108.96.0/19 AS577 BAC-14 Bell Advanced Communications Inc. 206.128.104.0/21 AS11709 VIIN VIRTUAL INTERACTIVE CENTER 206.167.57.0/24 AS376 RISQR-3 Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 207.231.96.0/19 AS11194 NUNETI NuNet Inc 208.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 208.138.48.0/20 AS7955 SOURCE-48 SourceNet Corporation 209.27.51.0/24 AS14132 INTERN-582 Internet Gateway Inc. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.213.32.0/19 AS10629 INS-52 Inter-Pacific Network Services 209.213.48.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.49.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.251.0.0/19 AS11036 SISCOM-1 SISCOM, Inc 216.37.110.0/23 AS4264 CERFN California Education and Research Federation Network 216.96.128.0/18 AS7018 ATTW AT&T WorldNet Services 216.145.156.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.158.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.176.0/21 AS20304 JIS-32 JVLNET Internet Services 216.145.177.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.178.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.184.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.185.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.186.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.187.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.188.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.189.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.190.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.191.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.200.0/21 AS20304 JIS-32 JVLNET Internet Services 216.171.96.0/20 AS3356 LEVEL3 Level 3 Communications 216.186.151.0/24 AS3356 LEVEL3 Level 3 Communications 216.186.152.0/21 AS3356 LEVEL3 Level 3 Communications 216.186.160.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.164.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.192.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.198.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.248.0/23 AS3356 LEVEL3 Level 3 Communications Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org swinog(a)swinog.ch

1 0

Re: Symantec AV may execute viruses
by Jeff Wheeler 10 Feb '05

10 Feb '05

I would actually expect LiveUpdate for the home versions to get the update automatically. The corporate edition however does not update the software via LiveUpdate - they figure IT departments would rather control when the software gets updated themselves, but unfortunately in most companies that probably means almost never :\ Also, it doesn't appear that this issue effects the Mac software (at least, I didn't see the Mac products in the Symantec vulnerability list), only Windows products. -- Jeff Wheeler Postmaster, Network Admin US Institute of Peace On Feb 10, 2005, at 1:07 PM, Colin Johnston wrote: > Any ideas why Symantec have not released the updated code to > LiveUpdate for > Mac and LiveUpdate for PC ?? > > Colin Johnston > TTL > c.johnston(a)ngat.com > >

6 8

Community meeting RealMedia available
by Susan Harris 10 Feb '05

10 Feb '05

You'll find a RealMedia recording of our Sunday evening community meeting in Las Vegas here: http://www.nanog.org/mtg-0501/coordination.html

1 0

Speaking of viruses...
by Adam Maloney 10 Feb '05

10 Feb '05

I sent this to CERT this morning. They apparently were unaware of it, and as far as I can tell there's nothing on any of the A/V sites about it. As of 14:00 CST, these sites are still serving up the virus executable. I haven't heard anything back from CERT or UCLA. Am I the only one seeing this?! >From adam(a)whee.org Thu Feb 10 10:24:16 2005 Date: Thu, 10 Feb 2005 10:24:15 -0600 (CST) From: Adam Maloney <adam(a)whee.org> To: cert(a)cert.org Cc: abuse(a)ucla.edu Subject: Attn: Bob - Dust.exe CC'd to abuse(a)ucla.edu - UCLA, your option "2" for your abuse desk rings to an invalid number. On Monday morning a bunch of our Win2k PC's got infected with a virus. We are seeing the infected machines attempting to make FTP connections to various IP's - the one's I've seen so far are in UCLA and MIT address space. The client connects to the FTP server (all have been Serv-U running under Windows), logs in with username "1", password "1", and retrieves Dust.exe Some of the IP's I've seen connections to: 18.242.5.42 (MIT) 18.241.5.89 (MIT) 169.232.117.223 (UCLA) The Dust.exe process attempts to install infected files named Jah.exe and Gamma.exe Jah is detected by Trend as WORM_RBOT.alo Gamma is detected as "possible virus". Starting this morning Trend started detecting Dust as TROJ_SCNDTHOT.ab When the machine tried to download it from MIT, Trend caught it as above. When it tried to UCLA, Trend did not catch it, and the download succeeded. When this hit on Monday, we saw infected PC's trying to infect other machines over tcp/445. They were trying random IP's in the address space that the infected computer was configured in. We did not see any FTP connections Monday morning like these, however we weren't really looking for them. -- END -- After this was sent, I've found some more details. The Dust.exe file is also being served by IP's at ThePlanet and ncsd.edu. The file from UCLA is about 5K bigger than the files served by the other sites. This explains why Trend was catching it when served by MIT but not by UCLA. After some more investigation, it looks like an infected machine uses a tcp/445 vulnerability to infect others. Once the others are hit on 445, they are instructed to download the payload from these FTP sites. I've made copies of the files available to CERT. I'm waiting on Trend to react to our support request from this morning.

2 1

Re: Speaking of viruses...
by Adam Maloney 10 Feb '05

10 Feb '05

Sorry - my mailer did something stupid. Here's what was sent, and more comments at the bottom: > To: cert(a)cert.org > CC: abuse(a)ucla.edu Subject: Attn: Bob - Dust.exe CC'd to abuse(a)ucla.edu - UCLA, your option "2" for your abuse desk rings to an invalid number. On Monday morning a bunch of our Win2k PC's got infected with a virus. We are seeing the infected machines attempting to make FTP connections to various IP's - the one's I've seen so far are in UCLA and MIT address space. The client connects to the FTP server (all have been Serv-U running under Windows), logs in with username "1", password "1", and retrieves Dust.exe Some of the IP's I've seen connections to: 18.242.5.42 (MIT) 18.241.5.89 (MIT) 169.232.117.223 (UCLA) The Dust.exe process attempts to install infected files named Jah.exe and Gamma.exe Jah is detected by Trend as WORM_RBOT.alo Gamma is detected as "possible virus". Starting this morning Trend started detecting Dust as TROJ_SCNDTHOT.ab When the machine tried to download it from MIT, Trend caught it as above. When it tried to UCLA, Trend did not catch it, and the download succeeded. When this hit on Monday, we saw infected PC's trying to infect other machines over tcp/445. They were trying random IP's in the address space that the infected computer was configured in. We did not see any FTP connections Monday morning like these, however we weren't really looking for them. -- END -- After this was sent, I've found some more details. The Dust.exe file is also being served by IP's at ThePlanet and ncsd.edu. The file from UCLA is about 5K bigger than the files served by the other sites. This explains why Trend was catching it when served by MIT but not by UCLA. After some more investigation, it looks like an infected machine uses a tcp/445 vulnerability to infect others. Once the others are hit on 445, they are instructed to download the payload from these FTP sites. I've made copies of the files available to CERT. I'm waiting on Trend to react to our support request from this morning.

1 0

Symantec AV may execute viruses
by Jeff Wheeler 10 Feb '05

10 Feb '05

apparently a serious vulnerability that needs to be patched immediately - affects Symantec firewalls, anti-spam, retail, and enterprise products. from Slashdot... http://it.slashdot.org/it/05/02/10/1327220.shtml?tid=172&tid=128 original article from ZDNet... http://www.zdnet.com.au/news/security/0,2000061744,39180674,00.htm Not sure if this is technically 'operational' but I'm sure it affects most of the people on this list. -- Jeff Wheeler Postmaster, Network Admin US Institute of Peace

1 1

Re: IRC Bot list (cross posting)
by Bill Nash 10 Feb '05

10 Feb '05

[ Edited and resent, the first appears to have vanished in transit ] I concede the point that operational tracking of botnets doesn't belong here, and I offer apologies to Martin, and the list in general, for not counting to ten before replying to his email. However, simply suppressing discussion of the topics isn't a good way to foster a cooperative working environment. I'd like to thank those few folks who corrected me, today. I was wrong in what I felt was appropriate, and I shouldn't have gone off in the manner I did. Moving to a more productive stance for this thread: How many people have subbed in the past month? The past year? There's stuff in the FAQ about what's directly relevent to this particular list, but there are a million related sub-topics with low level chatter that would overwhelm a single list, like this one. Is there a helpful resource that references these lists, to give subscribers a better grasp on topic specific lists that other nanog users deem productive, clue packed and useful? - billn

6 5

Request for delegation info
by Eric Germann 10 Feb '05

10 Feb '05

Colleagues, I was wondering if anyone had the following allocation information for the following registries archived somewhere. I'm conducting a graduate project and am trying to complete a picture of IPv4, v6 and ASN allocations. The following dates were missing from various registry repositories. I'm just trying to verify they actually do not exist vs. deleted from that registry ftp server and its associated mirrors. All dates are for 2004. For RIPENCC: delegated-ripencc- Jan 17 Jan 18 Feb 7 Feb 8 Feb 9 Apr 30 May 1 May 2 Sep 11 Sep 12 Sep 23 Oct 9 Oct 10 For ARIN: delegated-arin- Mar 2 Apr 17 If anyone has these files and data available, please contact me off list. Thanks for the consideration. Eric Germann

1 0