April 2005 - Test - lists.nanog.org

Re: The power of default configurations
by Paul Vixie 08 Apr '05

08 Apr '05

> no to 1) prolong the pain, 2) beat a horsey.. BUT, why are 1918 ips > 'special' to any application? why are non-1918 ips 'special' in a > different way? i know this is hard to believe, but i was asked to review 1918 before it went to press, since i'd been vociferous in my comments about 1597. in the text (RFC 1918) we see the following: Because private addresses have no global meaning, routing information about private networks shall not be propagated on inter-enterprise links, and packets with private source or destination addresses should not be forwarded across such links. Routers in networks not using private address space, especially those of Internet service providers, are expected to be configured to reject (filter out) routing information about private networks. If such a router receives such information the rejection shall not be treated as a routing protocol error. well, so much for the importance of "shall not" in rfcspeak, huh? It is strongly recommended that routers which connect enterprises to external networks are set up with appropriate packet and routing filters at both ends of the link in order to prevent packet and routing information leakage. An enterprise should also filter any private networks from inbound routing information in order to protect itself from ambiguous routing situations which can occur if routes to the private address space point outside the enterprise. "blah, blah, blah, ginger, blah, blah." --what your dog hears (gary larson) If an enterprise uses the private address space, or a mix of private and public address spaces, then DNS clients outside of the enterprise should not see addresses in the private address space used by the enterprise, since these addresses would be ambiguous. One way to ensure this is to run two authority servers for each DNS zone containing both publically and privately addressed hosts. One server would be visible from the public address space and would contain only the subset of the enterprise's addresses which were reachable using public addresses. The other server would be reachable only from the private network and would contain the full set of data, including the private addresses and whatever public addresses are reachable the private network. In order to ensure consistency, both servers should be configured from the same data of which the publically visible zone only contains a filtered version. There is certain degree of additional complexity associated with providing these capabilities. yikes! i think i contributed some of that text. and i see now that it really does have to say something about dns forwarders. so i'll withdraw my suggestion that this thread be moved to bind-users@ -- it needs to go to dnsop(a)lists.uoregon.edu since it's not a BIND-specific issue at all.

8 8

Re: djbdns: An alternative to BIND
by W.D.McKinney 08 Apr '05

08 Apr '05

>-----Original Message----- >From: Vicky Rode [mailto:vickyr@socal.rr.com] >Sent: Friday, April 8, 2005 10:55 PM >To: nanog(a)merit.edu >Subject: djbdns: An alternative to BIND > > >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >http://software.newsforge.com/article.pl?sid=05/04/06/197203&from=rss > >Just wondering how many have transitioned to djbdns from bind and if so >any feedback. > We did that 2 years ago and it has been a nice move. Zones are much easier to transfer/build and it's a very solid DNS version. Cheers, Dee

1 0

Botted Hosts tracking, v0.01alpha
by Ejay Hire 08 Apr '05

08 Apr '05

Hello. I have an pre alpha version of the compromised host tracking system ready, and I need some guinea pigs. This is based on my earlier AOL scomp complaint work. If you would like to receive a daily html summary email of the "this is spam" complaints for your ip space, please reply. The report includes ip, subject, and timestamp of the complaint, and is intended to be used to identify obviously infected hosts, not to respond to individual complaints. I'll need to know your Ip block, and the address you'd like the report sent to. It takes aol a while to setup the feedback loops, so there may be more features by the time it actually starts working. -ejay

1 0

Weekly Routing Table Report
by Routing Table Analysis 08 Apr '05

08 Apr '05

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 09 Apr, 2005 Analysis Summary ---------------- BGP routing table entries examined: 139674 Prefixes after maximum aggregation: 83474 Unique aggregates announced to Internet: 67116 Total ASes present in the Internet Routing Table: 17729 Origin-only ASes present in the Internet Routing Table: 15381 Origin ASes announcing only one prefix: 7282 Transit ASes present in the Internet Routing Table: 2348 Transit-only ASes present in the Internet Routing Table: 194 Average AS path length visible in the Internet Routing Table: 4.5 Max AS path length visible: 23 Prefixes from unregistered ASNs in the Routing Table: 38 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 13 Number of addresses announced to Internet: 1212269440 Equivalent to 72 /8s, 65 /16s and 195 /24s Percentage of available address space announced: 32.7 Percentage of allocated address space announced: 51.3 Percentage of available address space allocated: 63.7 Total number of prefixes smaller than registry allocations: 61623 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 27665 Total APNIC prefixes after maximum aggregation: 13807 Prefixes being announced from the APNIC address blocks: 25625 Unique aggregates announced from the APNIC address blocks: 13601 APNIC Region origin ASes present in the Internet Routing Table: 2170 APNIC Region origin ASes announcing only one prefix: 672 APNIC Region transit ASes present in the Internet Routing Table: 331 Average APNIC Region AS path length visible: 4.5 Max APNIC Region AS path length visible: 15 Number of APNIC addresses announced to Internet: 100659328 Equivalent to 5 /8s, 255 /16s and 240 /24s Percentage of available APNIC address space announced: 37.4 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575 APNIC Address Blocks 58/7, 60/7, 124/7, 126/8, 202/7, 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 79734 Total ARIN prefixes after maximum aggregation: 49337 Prefixes being announced from the ARIN address blocks: 61099 Unique aggregates announced from the ARIN address blocks: 21894 ARIN Region origin ASes present in the Internet Routing Table: 9396 ARIN Region origin ASes announcing only one prefix: 3492 ARIN Region transit ASes present in the Internet Routing Table: 886 Average ARIN Region AS path length visible: 4.3 Max ARIN Region AS path length visible: 21 Number of ARIN addresses announced to Internet: 229050368 Equivalent to 13 /8s, 167 /16s and 8 /24s Percentage of available ARIN address space announced: 65.0 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 ARIN Address Blocks 24/8, 63/8, 64/6, 68/7, 70/6, 198/7, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 22768 Total RIPE prefixes after maximum aggregation: 16764 Prefixes being announced from the RIPE address blocks: 19187 Unique aggregates announced from the RIPE address blocks: 13327 RIPE Region origin ASes present in the Internet Routing Table: 5289 RIPE Region origin ASes announcing only one prefix: 2902 RIPE Region transit ASes present in the Internet Routing Table: 966 Average RIPE Region AS path length visible: 5.1 Max RIPE Region AS path length visible: 23 Number of RIPE addresses announced to Internet: 154207424 Equivalent to 9 /8s, 49 /16s and 4 /24s Percentage of available RIPE address space announced: 54.1 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839 RIPE Address Blocks 62/8, 80/5, 88/8, 188/8, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 8378 Total LACNIC prefixes after maximum aggregation: 2926 Prefixes being announced from the LACNIC address blocks: 6986 Unique aggregates announced from the LACNIC address blocks: 4018 LACNIC Region origin ASes present in the Internet Routing Table: 609 LACNIC Region origin ASes announcing only one prefix: 187 LACNIC Region transit ASes present in the Internet Routing Table: 111 Average LACNIC Region AS path length visible: 5.1 Max LACNIC Region AS path length visible: 19 Number of LACNIC addresses announced to Internet: 18041856 Equivalent to 1 /8s, 19 /16s and 76 /24s Percentage of available LACNIC address space announced: 53.8 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 200/7 Emerging AfriNIC Region Analysis Summary ---------------------------------------- Prefixes being announced by AfriNIC Region ASes: 1087 Total AfriNIC prefixes after maximum aggregation: 640 Prefixes being announced from the AfriNIC address blocks: 916 Unique aggregates announced from the AfriNIC address blocks: 732 AfriNIC Region origin ASes present in the Internet Routing Table: 84 AfriNIC Region origin ASes announcing only one prefix: 29 AfriNIC Region transit ASes present in the Internet Routing Table: 13 Average AfriNIC Region AS path length visible: 4.4 Max AfriNIC Region AS path length visible: 12 Number of AfriNIC addresses announced to Internet: 2198272 Equivalent to 0 /8s, 33 /16s and 139 /24s Percentage of available AfriNIC address space announced: 13.1 AfriNIC AS Blocks ERX transfers AfriNIC Address Blocks 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 1221 781 1193 555 Telstra Pty Ltd 9583 584 44 11 Sify Limited 4755 488 211 112 Videsh Sanchar Nigam Ltd. Aut 4134 430 1943 104 CHINANET-BACKBONE 9443 370 77 76 Primus Telecommunications 4766 366 1699 151 Korea Telecom (KIX) 7545 365 54 66 TPG Internet Pty Ltd 2907 348 1839 322 SINET Japan 17557 334 24 151 Pakistan Telecom 10036 308 28 281 C&M Communication Co. Ltd. 7474 296 268 214 SingTel Optus Pty Ltd 4802 282 47 166 Wantree Development 9498 261 82 53 BHARTI BT INTERNET LTD. 2764 251 238 200 AAPT Limited 703 250 273 205 UUNET - Commercial IP service 9929 246 94 19 China Netcom Corp. 4808 231 168 129 CNCGROUP IP network: China169 18302 218 34 128 SK Global co., Ltd 17488 213 15 11 Hathway IP Over Cable Interne 17974 193 47 11 PT TELEKOMUNIKASI INDONESIA ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1408 6477 922 AT&T WorldNet Services 174 1065 5544 905 Cogent Communications 721 1019 15619 312 DLA Systems Automation Center 701 966 8209 821 UUNET Technologies, Inc. 4323 961 635 212 Time Warner Telecom 1239 874 2864 627 Sprint 6197 838 365 384 BellSouth Network Solutions, 2386 817 528 616 AT&T Data Communications Serv 18566 788 224 7 Covad Communications 209 624 3372 479 Qwest 20115 599 495 310 Charter Communications 852 534 1069 393 Telus Advanced Communications 3356 524 10745 394 Level 3 Communications, LLC 3602 507 119 92 Sprint Canada, Inc. 3561 506 2199 384 Savvis 27364 504 43 18 Armstrong Cable Services 5668 482 115 25 CenturyTel Internet Holdings, 22773 471 1180 20 Cox Communications, Inc. 7132 427 8385 370 SBC Internet Services 6198 419 372 193 BellSouth Network Solutions, RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 524 1674 447 UUNET - Commercial IP service 3320 293 2057 229 Deutsche Telekom AG 3301 286 902 276 TeliaNet Sweden 680 252 2025 237 DFN-IP service G-WiN 8220 239 309 235 COLT Telecommunications 3246 206 388 201 Song Networks 8708 194 243 177 Romania Data Systems S.A. 786 174 1776 174 The JANET IP Service 5515 174 743 124 Sonera Solution Autonomous Sy 1257 172 587 163 SWIPnet Swedish IP Network 719 153 288 96 LANLINK autonomous system 3300 148 168 84 AUCS Communications Services 6746 139 44 121 Dynamic Network Technologies, 3269 138 1273 58 TELECOM ITALIA 25186 136 137 94 France Telecom Transpac's Tra 5400 126 236 112 BT Ignite European Backbone 2856 115 1948 104 BTnet UK Regional network 3215 114 963 68 France Telecom Transpac 3303 106 471 101 Swisscom Ltd 5511 106 157 76 France Telecom LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 349 527 145 UniNet S.A. de C.V. 16814 266 16 7 NSS, S.A. 11172 216 99 52 Servicios Alestra S.A de C.V 6147 204 100 22 Telefonica Del Peru 19632 190 14 7 Metropolis Intercom S.A. 7303 156 68 25 Telecom Argentina Stet-France 11664 155 19 23 Keytech SA 22047 122 96 6 VTR PUNTO NET S.A. 6503 106 146 75 AVANTEL, S.A. 6505 105 84 68 Global One Communicaoes Ltda 13999 103 52 9 Mega Cable S.A. de C.V. 18822 103 6 15 TELEFONICA MANQUEHUE 11556 99 49 5 Cable-Wireless Panama 19169 95 6 16 Telconet 14117 86 6 3 Telefonica del Sur S.A. 5639 84 12 9 Telecommunications Services o 10481 82 32 7 Prima S.A. 4270 79 18 9 Red de Interconexion Universi 22927 79 65 20 TELEFONICA DE ARGENTINA 23216 78 23 15 RAMtelecom Telecomunicaciones AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 268 635 225 The Internet Solution 2018 90 295 87 Tertiary Education Network 5536 85 13 16 Internet Egypt Network 2905 67 264 61 The Internetworking Company o 8452 54 16 3 TEDATA 24835 53 28 4 RAYA Telecom - Egypt 5713 35 141 28 Telkom SA Ltd 6713 29 46 8 Itissalat Al-MAGHRIB 9129 27 2 2 UUNET Kenya 12455 24 5 4 Jambonet Autonomous system 16637 22 10 19 Johnnic e-Ventures 10798 19 1 11 Standard Bank of South Africa 7460 17 3 4 LIA Internet Access 12258 17 3 11 Vodacom Internet Company 15808 16 1 1 Communication Solutions Ltd i 21491 14 1 1 UTL On-line is RF broadband I 17148 13 1 7 First National Bank 11845 12 9 11 Data Pro Business Online 17400 12 1 1 Pacomm-LDA 21280 12 1 2 Swift Global Kenya Ltd.Is an Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 0 0 65531 * 18566 788 781 Covad Communications 4323 961 749 Time Warner Telecom 721 1019 707 DLA Systems Automation Center 9583 584 573 Sify Limited 27364 504 486 Armstrong Cable Services 5668 482 457 CenturyTel Internet Holdings, 6197 838 454 BellSouth Network Solutions, 22773 471 451 Cox Communications, Inc. 3602 507 415 Sprint Canada, Inc. 4755 488 376 Videsh Sanchar Nigam Ltd. Aut 4134 430 326 CHINANET-BACKBONE 6140 395 324 ImpSat 6467 345 313 E.Spire Communications, Inc. 7545 365 299 TPG Internet Pty Ltd 9443 370 294 Primus Telecommunications 20115 599 289 Charter Communications 6478 378 288 AT&T Worldnet Services 376 391 276 Reseau Interordinateurs Scien 16814 266 259 NSS, S.A. List of Unregistered ASNs (Global) ---------------------------------- Bad AS Designation Network Transit AS Description 35864 UNALLOCATED 38.117.202.0/24 174 Cogent Communication 35884 UNALLOCATED 38.118.171.0/24 10912 InterNAP Network Ser 35894 UNALLOCATED 63.118.207.0/24 6128 Cablevision Systems 35884 UNALLOCATED 64.74.164.0/24 10912 InterNAP Network Ser 35884 UNALLOCATED 64.74.165.0/24 10912 InterNAP Network Ser 35884 UNALLOCATED 64.74.166.0/24 10912 InterNAP Network Ser 35892 UNALLOCATED 64.124.52.0/24 6461 AboveNet Communicati 35892 UNALLOCATED 64.125.105.0/24 6461 AboveNet Communicati 35892 UNALLOCATED 64.125.106.0/24 6461 AboveNet Communicati 35892 UNALLOCATED 64.125.110.0/24 6461 AboveNet Communicati 35890 UNALLOCATED 64.193.55.0/24 209 Qwest 35868 UNALLOCATED 65.88.163.192/26 6395 Broadwing Communicat 35871 UNALLOCATED 66.7.178.0/23 6517 Yipes Communications 35868 UNALLOCATED 68.143.179.64/26 6395 Broadwing Communicat 33507 UNALLOCATED 70.183.41.0/24 15218 COX Communications 35895 UNALLOCATED 72.5.143.0/24 10910 InterNAP Network Ser 64500 RESERVED 85.114.96.0/21 1680 NetVision Ltd. 65503 PRIVATE 193.125.183.0/24 3217 SIMBIRSK 35857 UNALLOCATED 199.107.188.0/24 4323 Time Warner Telecom 65004 PRIVATE 200.0.113.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.0.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.1.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.2.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.3.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.4.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.5.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.6.0/24 28477 Universidad Autonoma 35875 UNALLOCATED 204.117.76.0/24 1239 Sprint 35892 UNALLOCATED 208.184.1.0/24 6461 AboveNet Communicati 35850 UNALLOCATED 209.139.6.0/24 3356 Level 3 Communicatio 35850 UNALLOCATED 209.139.22.0/23 3356 Level 3 Communicatio 35850 UNALLOCATED 209.139.56.0/22 3356 Level 3 Communicatio 35850 UNALLOCATED 209.139.108.0/23 3356 Level 3 Communicatio 35850 UNALLOCATED 209.139.110.0/24 3356 Level 3 Communicatio 35850 UNALLOCATED 209.139.180.0/24 3356 Level 3 Communicatio 35892 UNALLOCATED 209.249.93.0/24 6461 AboveNet Communicati 35892 UNALLOCATED 209.249.94.0/24 6461 AboveNet Communicati 35892 UNALLOCATED 209.249.95.0/24 6461 AboveNet Communicati Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 172.32.0.0/24 7011 Citizens Utilities 192.43.230.0/24 7575 Australian Academic and Rease 192.44.0.0/24 5501 Fraunhofer Gesellschaft 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.84.205.0/24 719 LANLINK autonomous system 192.119.135.0/24 270 NASA 192.135.50.0/24 7018 AT&T WorldNet Services 192.172.0.0/19 721 DLA Systems Automation Center 192.200.100.0/24 7018 AT&T WorldNet Services Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:17 /9:2 /10:8 /11:13 /12:60 /13:127 /14:260 /15:472 /16:7497 /17:2028 /18:3414 /19:7717 /20:8814 /21:7649 /22:10537 /23:11751 /24:78503 /25:252 /26:228 /27:130 /28:68 /29:37 /30:61 /31:0 /32:29 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 772 788 Covad Communications 6197 683 838 BellSouth Network Solutions, 7018 610 1408 AT&T WorldNet Services 2386 572 817 AT&T Data Communications Serv 27364 491 504 Armstrong Cable Services 9583 406 584 Sify Limited 4323 402 961 Time Warner Telecom 5668 402 482 CenturyTel Internet Holdings, 1239 348 874 Sprint 702 327 524 UUNET - Commercial IP service 10036 308 308 C&M Communication Co. Ltd. 6198 300 419 BellSouth Network Solutions, 6517 288 311 Yipes Communications, Inc. 7011 270 318 Citizens Utilities 15270 251 269 PaeTec.net -a division of Pae 3320 245 293 Deutsche Telekom AG 20115 244 599 Charter Communications 23126 239 250 KMC Telecom, Inc 22773 236 471 Cox Communications, Inc. 11456 228 268 Carolina Online, Inc. Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:4 8:11 10:6 12:1516 13:1 15:9 16:2 17:3 18:4 20:4 24:794 28:2 31:1 32:64 33:4 38:104 40:53 44:7 47:2 50:1 52:11 54:1 55:3 56:3 57:23 58:37 59:22 60:17 61:738 62:574 63:1879 64:2648 65:2079 66:2734 67:519 68:508 69:961 70:83 71:6 72:128 80:535 81:528 82:369 83:225 84:137 85:160 128:141 129:160 130:89 131:281 132:33 133:1 134:145 135:41 136:191 137:67 138:164 139:56 140:193 141:103 142:137 143:130 144:172 145:32 146:272 147:102 148:293 149:169 150:97 151:63 152:107 153:87 154:4 155:144 156:69 157:89 158:167 159:172 160:73 161:60 162:199 163:83 164:203 165:159 166:154 167:228 168:416 169:137 170:311 171:8 172:1 192:5674 193:3146 194:2326 195:1536 196:638 198:3934 199:3268 200:4010 201:113 202:5443 203:6136 204:3818 205:2006 206:2439 207:2731 208:2075 209:3278 210:1675 211:759 End of report

1 0

Re: AS prepending
by Philip Lavine 08 Apr '05

08 Apr '05

Update 2: More info. When I have tested the failover by pulling the plug on the preferred ISP, I do not see my network in looking glass. Secondly, the backup provider has told me the the route is not in the (rib). Philip --- Mark Kasten <mark.kasten(a)savvis.net> wrote: > <offlist> > > fwiw, it's in the routing table (rib), not their > forwarding table (fib). > if they look on their side of the session, they > will have the prefix > in "show ip bgp" or "show route", but it will not > propogate beyond that > router because their network prefers the other path > with the short AS. > a router doesn't forward all rib entries, only fib > entries. > > > for example: > > dcr4.nyr> show route 141.77.0.0/16 > 141.77.0.0/16 *[BGP/170] 3w4d 01:53:30, MED 98, > localpref 100, from > 206.24.194.105 > AS path: 1273 ? > > via so-0/0/0.1510 > via so-1/1/0.10 > [BGP/170] 9w3d 12:26:09, MED > 128, localpref 80 > AS path: 3356 1273 I > > to 4.68.127.205 via > so-6/1/0.0 > [BGP/170] 21:32:50, MED 128, > localpref 80 > AS path: 1239 1273 ? > > to 144.232.9.117 via > so-3/1/0.0 > > > on a router, one hop away: > > > kar1.nyr> show route 141.77.0.0/16 > > inet.0: 173067 destinations, 345433 routes (172951 > active, 0 holddown, > 547 hidden) > Restart Complete > + = Active Route, - = Last Active, * = Both > > 141.77.0.0/16 *[BGP/170] 3w4d 01:53:59, MED 98, > localpref 100, from > 206.24.194.105 > AS path: 1273 ? > > to 208.174.228.1 via ae0.0 > > > > no evidence of the 3356_1273 or the 1239_1273 path. > if i lose the > direct 1273 path, then one of those paths would then > be propogated as > the preferred path. > > > hth's. > > mark > > > Philip Lavine wrote: > > > Update: > > > > I am prepending my AS 3 times to the un-preferred > ISP. > > Both ISP's are my peers. The un-preferred ISP > claims > > the see my advertisement yet they do not add it to > > their routing table (suggests filtering??). They > claim > > all the filtering they are doing is based on the > > networks I told them over the phone that I was > using > > with that AS. > > > > Philip > > > > --- Jon Lewis <jlewis(a)lewis.org> wrote: > > > >>On Fri, 8 Apr 2005, Philip Lavine wrote: > >> > >> > >>>I am using AS prepending to favor one ISP over > >>>another, in a BGP multihomed/multiISP scenario. > >> > >>Why > >> > >>>does the ISP receiving the prepends fail to add > my > >>>network into their routing table? Is this a > >> > >>"feature" > >> > >>>of BGP, or have I gone too far with 3 prepend > >>>statements. > >> > >>Who's ASN are you prepending on your advertised > >>routes? > >> > >> > > > > > ---------------------------------------------------------------------- > > > >> Jon Lewis | I route > >> Senior Network Engineer | therefore you are > >> Atlantic Net | > >>_________ http://www.lewis.org/~jlewis/pgp for PGP > >>public key_________ > >> > > > > > > __________________________________________________ > > Do You Yahoo!? > > Tired of spam? Yahoo! Mail has the best spam > protection around > > http://mail.yahoo.com > __________________________________ Do you Yahoo!? Yahoo! Mail - 250MB free storage. Do more. Manage less. http://info.mail.yahoo.com/mail_250

3 2

Re: AS prepending
by Philip Lavine 08 Apr '05

08 Apr '05

Update: I am prepending my AS 3 times to the un-preferred ISP. Both ISP's are my peers. The un-preferred ISP claims the see my advertisement yet they do not add it to their routing table (suggests filtering??). They claim all the filtering they are doing is based on the networks I told them over the phone that I was using with that AS. Philip --- Jon Lewis <jlewis(a)lewis.org> wrote: > On Fri, 8 Apr 2005, Philip Lavine wrote: > > > I am using AS prepending to favor one ISP over > > another, in a BGP multihomed/multiISP scenario. > Why > > does the ISP receiving the prepends fail to add my > > network into their routing table? Is this a > "feature" > > of BGP, or have I gone too far with 3 prepend > > statements. > > Who's ASN are you prepending on your advertised > routes? > > ---------------------------------------------------------------------- > Jon Lewis | I route > Senior Network Engineer | therefore you are > Atlantic Net | > _________ http://www.lewis.org/~jlewis/pgp for PGP > public key_________ > __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

4 3

Re: AS prepending
by christian.macnevin＠uk.bnpparibas.com 08 Apr '05

08 Apr '05

Do they not have your routes present in their table *at all* or do they just not point them to you? If they have them but via another route, it may be that the shorter path for them is via the ISP you're not prepending. Though unless they've got free transit it would seem pretty dense not to use their own network to reach their own customer. Prepending 3 ASes isn't too much, you should be fine with that, I think. Internet source_route@yahoo.com@merit.edu - 08/04/2005 15:28 Sent by: owner-nanog(a)merit.edu To: nanog cc: Subject: AS prepending To all, I am using AS prepending to favor one ISP over another, in a BGP multihomed/multiISP scenario. Why does the ISP receiving the prepends fail to add my network into their routing table? Is this a "feature" of BGP, or have I gone too far with 3 prepend statements. Thx Philip __________________________________ Yahoo! Messenger Show us what our next emoticon should look like. Join the fun. http://www.advision.webevents.yahoo.com/emoticontest This message and any attachments (the "message") is intended solely for the addressees and is confidential. If you receive this message in error, please delete it and immediately notify the sender. Any use not in accord with its purpose, any dissemination or disclosure, either whole or partial, is prohibited except formal approval. The internet can not guarantee the integrity of this message. BNP PARIBAS (and its subsidiaries) shall (will) not therefore be liable for the message if modified. ********************************************************************************************** BNP Paribas Private Bank London Branch is authorised by CECEI & AMF and is regulated by the Financial Services Authority for the conduct of its investment business in the United Kingdom. BNP Paribas Securities Services London Branch is authorised by CECEI & AMF and is regulated by the Financial Services Authority for the conduct of its investment business in the United Kingdom. BNP Paribas Fund Services UK Limited is authorised and regulated by the Financial Services Authority.

1 0

RE: Spam (un)blocking
by Howard, W. Lee 08 Apr '05

08 Apr '05

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Daniel Senie > Sent: Wednesday, April 06, 2005 6:43 PM > To: JP Velders; Adam Jacob Muller > Cc: nanog(a)merit.edu > Subject: Re: Spam (un)blocking > > At 06:10 PM 4/6/2005, JP Velders wrote: > > >Over here in "RIPE land" so to speak, several ISP's (most > notably FIRST > >members) have put a lot of effort in getting 'IRT' objects in the > >RipeDB. > > And this is MUCH appreciated. When trying to figure out where > to send spam > complaints, a network that's taken the time to put their > abuse address in > their records certainly appears to at least care, and so gets > better treatment. "Better" != "good." In past experience, - Since the Abuse POC was "abuse@" instead of "Lee.Howard@" it wasn't acceptable. - Because "abuse@" went to a 24x7 team, with an auto-responder, and (on advice of counsel and for scalability reasons) we did not reply to every complaint with a description of the action taken, it was assumed no action was taken. There's no pleasing some people, and it's a shame that not everyone can take the time to understand what filtering policies they're importing. YMMV Lee

2 1

The Cidr Report
by cidr-report＠potaroo.net 08 Apr '05

08 Apr '05

This report has been generated at Fri Apr 8 21:44:57 2005 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 01-04-05 155627 106634 02-04-05 155490 106620 03-04-05 155470 106596 04-04-05 155479 106765 05-04-05 155734 106188 06-04-05 155419 106297 07-04-05 155608 106264 08-04-05 155649 106385 AS Summary 19246 Number of ASes in routing system 7854 Number of ASes announcing only one prefix 1461 Largest number of prefixes announced by an AS AS7018 : ATT-INTERNET4 - AT&T WorldNet Services 90489856 Largest address span announced by an AS (/32s) AS721 : DLA-ASNBLOCK-AS - DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 08Apr05 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 155786 106324 49462 31.7% All ASes AS4323 1089 225 864 79.3% TWTC - Time Warner Telecom AS18566 788 8 780 99.0% COVAD - Covad Communications AS4134 885 213 672 75.9% CHINANET-BACKBONE No.31,Jin-rong Street AS721 1119 564 555 49.6% DLA-ASNBLOCK-AS - DoD Network Information Center AS7018 1461 954 507 34.7% ATT-INTERNET4 - AT&T WorldNet Services AS27364 504 22 482 95.6% ACS-INTERNET - Armstrong Cable Services AS22773 474 23 451 95.1% CCINET-2 - Cox Communications Inc. AS6197 882 469 413 46.8% BATI-ATL - BellSouth Network Solutions, Inc AS3602 508 142 366 72.0% SPRINT-CA-AS - Sprint Canada Inc. AS17676 427 77 350 82.0% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS9929 347 45 302 87.0% CNCNET-CN China Netcom Corp. AS4766 572 277 295 51.6% KIXS-AS-KR Korea Telecom AS6478 378 90 288 76.2% ATT-INTERNET3 - AT&T WorldNet Services AS9583 684 420 264 38.6% SIFY-AS-IN Sify Limited AS14654 263 6 257 97.7% WAYPORT - Wayport AS9443 374 123 251 67.1% INTERNETPRIMUS-AS-AP Primus Telecommunications AS1239 911 662 249 27.3% SPRINTLINK - Sprint AS6140 383 138 245 64.0% IMPSAT-USA - ImpSat AS4755 481 238 243 50.5% VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System AS23126 251 13 238 94.8% KMCTELCOM-DIA - KMC Telecom, Inc. AS7545 479 246 233 48.6% TPG-INTERNET-AP TPG Internet Pty Ltd AS15270 263 35 228 86.7% AS-PAETEC-NET - PaeTec.net -a division of PaeTecCommunications, Inc. AS6198 457 232 225 49.2% BATI-MIA - BellSouth Network Solutions, Inc AS2386 842 624 218 25.9% INS-AS - AT&T Data Communications Services AS5668 482 267 215 44.6% AS-5668 - CenturyTel Internet Holdings, Inc. AS11456 311 106 205 65.9% NUVOX - NuVox Communications, Inc. AS9498 263 60 203 77.2% BBIL-AP BHARTI BT INTERNET LTD. AS22909 345 150 195 56.5% DNEO-OSP1 - Comcast Cable Communications, Inc. AS6167 272 78 194 71.3% CELLCO-PART - Cellco Partnership AS6517 311 122 189 60.8% YIPESCOM - Yipes Communications, Inc. Total 16806 6629 10177 60.6% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 ANDARA-HSI - Andara High Speed Internet c/o Halifax Cable Ltd. 24.246.0.0/17 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 24.246.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 64.17.32.0/24 AS5024 BRIDGE - BridgeNet, LC 64.17.33.0/24 AS5024 BRIDGE - BridgeNet, LC 64.17.37.0/24 AS5024 BRIDGE - BridgeNet, LC 64.20.32.0/20 AS21698 NEBRIX-CA - Nebrix Communications Inc. 64.57.160.0/19 AS3561 SAVVIS - Savvis 64.127.0.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 64.209.192.0/19 AS3561 SAVVIS - Savvis 66.37.96.0/20 AS3764 IA-HOU-AS - Internet America, Inc. 66.164.232.0/24 AS6197 BATI-ATL - BellSouth Network Solutions, Inc 67.47.0.0/17 AS4765 WORLDNET-AS World Net & Services Co., Ltd. 67.47.0.0/18 AS4765 WORLDNET-AS World Net & Services Co., Ltd. 67.47.64.0/18 AS4765 WORLDNET-AS World Net & Services Co., Ltd. 172.32.0.0/24 AS7011 CITLINK - Citizens Utilities 172.122.28.0/24 AS210 WEST-NET-WEST - Utah Education Network 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.44.0.0/19 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 192.44.0.0/24 AS5501 FRAUNHOFER-CLUSTER-BW Fraunhofer Gesellschaft 192.70.164.0/24 AS25689 NRCNET-AS - National Research Council of Canada 192.81.182.0/24 AS719 ELISA-AS Elisa Oyj 192.81.183.0/24 AS719 ELISA-AS Elisa Oyj 192.81.184.0/24 AS719 ELISA-AS Elisa Oyj 192.119.135.0/24 AS270 PSCNI-AS - National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS4004 GLOBALONE-EQUANT-UK Equant UK & Greece Autonomous System 192.135.50.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 192.136.53.0/24 AS8346 SONATEL-AS Autonomous System 192.153.144.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 192.172.0.0/19 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 192.188.208.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 192.200.100.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 196.2.95.0/24 AS8668 TELONE-AS TelOne Zimbabwe P/L 196.192.0.0/20 AS23889 MAURITIUS-TELECOM-AS-AP MAURITIUS TELECOM 196.192.12.0/22 AS23889 MAURITIUS-TELECOM-AS-AP MAURITIUS TELECOM 196.192.32.0/24 AS5511 OPENTRANSIT France Telecom 196.192.33.0/24 AS5511 OPENTRANSIT France Telecom 196.192.34.0/24 AS5511 OPENTRANSIT France Telecom 196.192.35.0/24 AS5511 OPENTRANSIT France Telecom 196.192.36.0/24 AS5511 OPENTRANSIT France Telecom 196.192.37.0/24 AS5511 OPENTRANSIT France Telecom 196.192.38.0/24 AS5511 OPENTRANSIT France Telecom 196.192.39.0/24 AS5511 OPENTRANSIT France Telecom 196.192.40.0/24 AS5511 OPENTRANSIT France Telecom 196.192.45.0/24 AS5511 OPENTRANSIT France Telecom 196.192.46.0/24 AS5511 OPENTRANSIT France Telecom 196.192.47.0/24 AS5511 OPENTRANSIT France Telecom 196.192.64.0/21 AS23889 MAURITIUS-TELECOM-AS-AP MAURITIUS TELECOM 196.192.96.0/20 AS23889 MAURITIUS-TELECOM-AS-AP MAURITIUS TELECOM 198.23.26.0/24 AS4390 BELLATLANTIC-COM - Bell Atlantic, Inc. 198.97.72.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.80.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.88.0/24 AS89 NUSC-CSTLNET-AS - Naval Underwater Systems Center 198.97.240.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.247.0/24 AS3475 LANT-AFLOAT - Department of the Navy 198.101.4.0/22 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.136.32.0/20 AS19329 MCNET - Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY-NET - CityNet, Inc. 198.160.171.0/24 AS7046 UUNET-CUSTOMER - UUNET Technologies, Inc. 198.161.87.0/24 AS6539 GROUPTLCOM - GT Group Telecom Services Corp. 198.163.155.0/24 AS684 MBNET-AS - Manitoba Regional Network 198.167.0.0/16 AS7456 INTERHOP - Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 ALTERNET-AS - UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASKTEL - SaskTel 198.232.133.0/24 AS23075 SKOTOS-AS - Skotos Tech, Inc 199.10.0.0/16 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.60.0.0/20 AS271 BCNET-AS - University of British Columbia 199.96.44.0/23 AS19092 360NETWORKS-US - 360Networks (USA) Inc. 199.96.46.0/24 AS19092 360NETWORKS-US - 360Networks (USA) Inc. 199.114.0.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.128.0/18 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.130.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.132.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.134.0/24 AS3541 ITSDN-U4 - DISA/UNRRA 199.114.136.0/24 AS27044 DDN-ASNBLK1 - DoD Network Information Center 199.114.138.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.140.0/24 AS3544 ITSDN-U7 - DISA/UNRRA 199.114.142.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.144.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.148.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.150.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.152.0/24 AS27033 DDN-ASNBLK1 - DoD Network Information Center 199.114.154.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.114.156.0/24 AS27034 DDN-ASNBLK1 - DoD Network Information Center 199.114.160.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.120.32.0/19 AS16582 NEXTLEVELINTERNET - NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.0.0/18 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.16.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.80.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST-AS - IQuest Internet 199.202.0.0/16 AS701 ALTERNET-AS - UUNET Technologies, Inc. 202.72.240.0/20 AS24320 RAILCOM Mongolian Railway Commercial Center Railcom 202.86.252.0/22 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.123.0.0/19 AS23889 MAURITIUS-TELECOM-AS-AP MAURITIUS TELECOM 202.123.2.0/24 AS23889 MAURITIUS-TELECOM-AS-AP MAURITIUS TELECOM 202.123.8.0/22 AS23889 MAURITIUS-TELECOM-AS-AP MAURITIUS TELECOM 202.123.16.0/20 AS23889 MAURITIUS-TELECOM-AS-AP MAURITIUS TELECOM 202.164.224.0/19 AS7599 IPXC-AS-AP IP Exchange 203.32.4.0/23 AS7617 TELEONE-HK TeleTeleOne (HK) Limited 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.99.0.0/19 AS17746 ORCONINTERNET-NZ-AP Orcon Internet 203.210.69.0/24 AS17536 PRODIGY-AS-AP Prodidgy Telecommunications 204.48.119.0/24 AS29912 CITIZENS-PROPERTY-INSURANCE-CORPORATION - Citizens Property Insurance Corporation 204.154.125.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBIT - Exobit Networks Inc. 205.150.0.0/15 AS701 ALTERNET-AS - UUNET Technologies, Inc. 206.108.96.0/19 AS577 BACOM - Bell Advanced Communications Inc. 206.128.104.0/21 AS11709 VIC - VIRTUAL INTERACTIVE CENTER 206.167.57.0/24 AS376 RISQ-AS - Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 206.191.96.0/19 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 207.231.96.0/19 AS11194 NUNETPA - NuNet Inc 208.138.48.0/20 AS6971 ATG-1 - Advanced Telcom Group, Inc 209.27.51.0/24 AS14132 INTERNETGATEWAY - Internet Gateway Inc. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.213.32.0/19 AS10629 INTERPAC - Inter-Pacific Network Services 209.213.48.0/24 AS10629 INTERPAC - Inter-Pacific Network Services 209.213.49.0/24 AS10629 INTERPAC - Inter-Pacific Network Services 209.222.137.0/24 AS27429 TIL - Telesat International Ltd. 209.251.0.0/19 AS11036 SISCOM - SISCOM, Inc 216.37.110.0/23 AS4264 CERNET-ASN-BLOCK - California Education and Research Federation Network 216.96.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.145.200.0/21 AS20304 JVLNET - JVLNET Internet Services 216.171.96.0/20 AS3356 LEVEL3 Level 3 Communications Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org swinog(a)swinog.ch

1 0

new operational mailing list - snort signatures for ISP's
by Gadi Evron 08 Apr '05

08 Apr '05

Hi. We see the need for a mailing list, where we can send snort signatures that are not for public release, and have the ISP's and other responsible parties run these sigs and come back with results. This will be a sub-list of the drone armies research and mitigation mailing list, as well as for the malicious websites and phishing list. Example: Specific signatures for detecting botnets, that if released become useless. Any ISP (or others with a tube who want to run these snort sigs && REPORT back) are invited to email me and get added if they can be vetted. There will be a kick policy for leechers. Gadi.

1 0