August 2005 - Test - lists.nanog.org

Re: speaking of lynn...
by Robert Bonomi 13 Aug '05

13 Aug '05

> From owner-nanog(a)merit.edu Fri Aug 12 22:11:34 2005 > Date: Sat, 13 Aug 2005 06:08:22 +0200 > From: Gadi Evron <ge(a)linuxbox.org> > To: nanog list <nanog(a)merit.edu> > Subject: speaking of lynn... > > [[.. munch ..]] > > Cisco's lawyers are sending out cease-and-desist notices to Web sites > that have published a controversial presentation by ex-Internet Security > Systems (ISS) employee .... > > -- > > I guess that answers the question of the lgality of the matter? "Not exactly." <wry grin> That tells us what Cicso is 'claiming'. In *any* legal dispute, that which one party 'claims' to be true is not necessarily the same thing as the actual 'facts of the matter'.

1 0

Re: Cisco crapaganda (Modified by Jason Chambers)
by Jason Chambers 13 Aug '05

13 Aug '05

On Aug 10, 2005, at 05:53, Michael.Dillon(a)btradianz.com wrote: >> Also, what about DoD Orange Book certification? Can this kind of >> testing methodology be applied to routing systems as well, such as >> IOS? > > I don't claim to fully understand Orange Book but it seems to > me that one of the essences of Open Source is the process of > certification. <--snip--> > To learn more about the Orange book, look here > http://www.dynamoo.com/orange/ In relation to the Orange Book, There is a evaluation program available, named TPEP, links are below. Very interesting and intense. Yes, routing systems \ IOS applies. See 1.3 TPEP Process Overview at http://www.radium.ncsc.mil/tpep/process/procedures.html I chatted briefly with a fed @ Defcon about this program, specifically about work to make this achievement something [buzzword warning] "Critical Infrastructure" and the well known software manufacturers would look to engage in \ use. Maybe by way of public forums such as this is that accomplished. In labels we trust. http://www.radium.ncsc.mil/tpep/index.html http://www.radium.ncsc.mil/tpep/tpep.html http://www.radium.ncsc.mil/tpep/process/faq-sect6.html#Q8 -Jason

1 0

Re: botnet reporting by AS - what about you?
by Fergie (Paul Ferguson) 13 Aug '05

13 Aug '05

I can understand that -- right on. :-) One must understand that this whole thing is a moving target, and perhaps the reporting features are just now maturing (now Gadi, don't make a liar out of me). Insofar as as detection methodologies, I'll have to defer to Gadi to elaboarate (illustrate?) them for a wide audience. Cheers! - ferg p.s. For what it's worth, I got a bit bloody last month neutralizing a pertty large Pertibot infection in a client network -- it was, at that point, new and undetectable by most AV vendor ID mechanisms. Like I said, moving target, etc. "Hannigan, Martin" <hannigan(a)verisign.com> wrote: I was on it and unsubscribed. They wouldn't disclose the collection or validation process at that time. This made it useless for the most part as its hard to act on someones word without some idea of how they are getting their data and avoiding collateral damage. I'm not saying there aren't valid zombies on it, but my criteria for a list that identifies rogues includes trust. I have lists I felt were more trustworthy than DA. Things may have changed. Martin -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: botnet reporting by AS - what about you?
by Hannigan, Martin 13 Aug '05

13 Aug '05

I was on it and unsubscribed. They wouldn't disclose the collection or validation process at that time. This made it useless for the most part as its hard to act on someones word without some idea of how they are getting their data and avoiding collateral damage. I'm not saying there aren't valid zombies on it, but my criteria for a list that identifies rogues includes trust. I have lists I felt were more trustworthy than DA. Things may have changed. Martin -----Original Message----- From: Christopher L. Morrow [mailto:christopher.morrow@mci.com] Sent: Fri Aug 12 23:56:53 2005 To: Fergie (Paul Ferguson) Cc: nanog(a)merit.edu Subject: Re: botnet reporting by AS - what about you? On Sat, 13 Aug 2005, Fergie (Paul Ferguson) wrote: > Chris, > > I can assure you that the Drone Army project is not run that > way, and is quite useful, effective, etc. > > The folks behind the DA Project are certainly professionals... > ...and the infromation is quite useable, parse-able, and genuine. cool, among the 800k+ complaints we see a month (yes, 800k) there are quite a few completely useless ones :( Anything sent in as a complaint has to have complete and useful information, else it's hard/impossible to action properly. It'd help if the format it was sent in was also machine parseable :) With 800k+ complaints/month I'm not sure people want to spend time figuring each one out, a script/machine should be doing as much as possible. > > - ferg > > -- "Christopher L. Morrow" <christopher.morrow(a)mci.com> wrote: > > perhaps we could back up and ask: > > 1) why are you not using the arin/ripe/apnic/japnic/krnic/lacnic poc's for > these asn's? certainly some are not up to date, but there are a large > number that are... > 2) what is this for again? > 3) are you planning on sending something to these poc's? > 4) what are you planning on sending to them? > 5) how often should they expect to see something, and from 'whom'? > 6) looked at the INCH working group in IETF, thought about using some of > these evolving standards for your alerts/messags/missives? > 7) please don't send in bmp files of traceroutes (make the info you send > in complete and usable... 'I saw a bot on ip 12' is not useable, as an > fyi) > > -Chris > > -- > "Fergie", a.k.a. Paul Ferguson > Engineering Architecture for the Internet > fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net > ferg's tech blog: http://fergdawg.blogspot.com/ >

2 1

Re: botnet reporting by AS - what about you?
by Fergie (Paul Ferguson) 12 Aug '05

12 Aug '05

Chris, I can assure you that the Drone Army project is not run that way, and is quite useful, effective, etc. The folks behind the DA Project are certainly professionals... ...and the infromation is quite useable, parse-able, and genuine. - ferg -- "Christopher L. Morrow" <christopher.morrow(a)mci.com> wrote: perhaps we could back up and ask: 1) why are you not using the arin/ripe/apnic/japnic/krnic/lacnic poc's for these asn's? certainly some are not up to date, but there are a large number that are... 2) what is this for again? 3) are you planning on sending something to these poc's? 4) what are you planning on sending to them? 5) how often should they expect to see something, and from 'whom'? 6) looked at the INCH working group in IETF, thought about using some of these evolving standards for your alerts/messags/missives? 7) please don't send in bmp files of traceroutes (make the info you send in complete and usable... 'I saw a bot on ip 12' is not useable, as an fyi) -Chris -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Re: botnet reporting by AS - what about you?
by Hannigan, Martin 12 Aug '05

12 Aug '05

Translation: This isn't a contact list for hundreds of asn's. -----Original Message----- From: Gadi Evron [mailto:ge@linuxbox.org] Sent: Fri Aug 12 22:43:47 2005 To: Richard A Steenbergen Cc: nanog list Subject: Re: botnet reporting by AS - what about you? What happened to replies off-list? Anyway, good point about actual ASN's, so here goes. > Do you mean to tell me you can't find contact info for ANY of those ISPs > on your own (like those ALTERNET guys, they're hard to track down)? Are > you trying to start a service for notifing ISPs when they have drones > behind them or something? Surely you don't expect to obtain a > comprehensive list by posting a list of AS names and half chopped off > descriptions to NANOG, without even including the AS numbers? We have contacts and listing, but we are trying to re-build, update and cover everything. New list with AS numbers below, as requested. If your AS is not listed and you are interested, drop me a note. > I'd personally love more reporting services that will actually disclose > information to the ISPs who can actually take action to help straighten > out their customers. We have far too many people who sit around wringing > their hands about how horrible the botnets are, but who won't tell anyone > who can do anything about it out of a paranoid sense of "security". I'm > not sure this is the best way to go about that though. :) > We are open for suggestions and this is not the *only* course of action we take. :) Thanks, Gadi. 17 PURDUE - Purdue University 25 UCB - University of California 27 UMDNET - University of Marylan 81 CONCERT - MCNC Center of Commu 137 ASGARR GARR Italian academic a 174 COGENT Cogent/PSI 209 ASN-QWEST - Qwest 210 WEST-NET-WEST - Utah Education 217 UMN-AGS-NET-AS - University of 224 UNINETT UNINETT The Norwegian 237 MERIT-AS-14 - Merit Network In 239 UTORONTO-AS - University of To 286 KPN KPN Internet Backbone AS 376 RISQ-AS - Reseau Interordinate 553 BELWUE Landeshochschulnetz Bad 577 BACOM - Bell Advanced Communic 680 DFN-IP service G-WiN 701 ALTERNET-AS - UUNET Technologi 702 AS702 MCI EMEA - Commercial IP 721 DLA-ASNBLOCK-AS - DoD Network 766 REDIRIS RedIRIS Autonomous Sys 786 JANET The JANET IP Service 790 EUNETFI EUnet Finland 812 ROGERS-CABLE - Rogers Cable In 813 UUNET-AS1 - UUNET Technologies 852 ASN852 - Telus Advanced Commun 1109 University of Salzburg 1113 TUGNET Technische Universitaet 1221 ASN-TELSTRA Telstra Pty Ltd 1239 SPRINTLINK - Sprint 1249 FIVE-COLLEGES-AS - Five Colleg 1267 ASN-INFOSTRADA Infostrada S.p. 1653 SUNET SUNET Swedish University 1659 ERX-TANET-ASN1 Tiawan Academic 1668 AOL-ATDN - AOL Transit Data Ne 1680 NetVision Ltd. 1767 IHETSDATANET - Indiana Higher 1781 KAIST-DAEJEON-AS-KR Korea Adva 1784 GNAPS - Global NAPs Networks 1785 USLEC-ASN-1785 - USLEC Corp. 1955 HBONE-AS HUNGARNET 2042 ERX-JARING Malaysian institute 2108 CARNET-AS Croatian Academic an 2116 ASN-CATCHCOM Catch Communicati 2119 TELENOR-NEXTEL Telenor Interne 2259 FR-U-STRASBOURG FR 2381 WISCNET1-AS - University of Wi 2501 JPNIC-ASBLOCK-AP JPNIC 2514 JPNIC-ASBLOCK-AP JPNIC 2527 JPNIC-ASBLOCK-AP JPNIC 2614 ROEDUNET Romanian Education Ne 2637 GEORGIA-TECH - Georgia Institu 2764 AAPT AAPT Limited 2828 XO-AS15 - XO Communications 2852 CESNET2 Czech National Researc 2856 BT-UK-AS BTnet UK Regional net 2907 ERX-SINET-AS National Center f 2914 VERIO - Verio Inc. 3064 AFFINITY-FTL - Affinity Intern 3112 OARNET-AS-1 - OARnet 3212 TRIERA Triera Internet 3215 AS3215 France Telecom Transpac 3240 SEKTORNET Sektornet DK Minist 3246 TDCSONG TDC Song 3248 SIL-AT SILVER:SERVER GmbH 3257 TISCALI-BACKBONE Tiscali Intl 3265 XS4ALL-NL XS4ALL 3269 ASN-IBSNAZ TELECOM ITALIA 3292 TDC TDC Data Networks 3301 TELIANET-SWEDEN TeliaNet Swede 3304 SCARLET Scarlet Belgium 3307 BANETELE-NORWAY BaneTele AS (f 3313 INET-AS I.NET S.p.A. 3320 DTAG Deutsche Telekom AG 3323 NTUA National Technical Univer 3344 KEWLIO-DOT-NET Kewlio.net Limi 3352 TELEFONICA-DATA-ESPANA Interne 3356 LEVEL3 Level 3 Communications 3462 HINET Data Communication Busin 3491 BTN-ASN - Beyond The Network A 3561 SAVVIS - Savvis 3602 SPRINT-CA-AS - Sprint Canada I 3659 CLAREMONT - The Claremont Coll 3701 NERONET - Oregon Joint Graduat 3741 AFRINIC African Network Inform 3758 ERX-SINGNET SingNet 3786 ERX-DACOMNET DACOM Corporation 3801 MISNET - Mikrotec Internet Ser 4134 CHINANET-BACKBONE No.31 Jin-ro 4148 ACTCOM ACTCOM - Active Communi 4230 Embratel 4314 I-55-INTERNET-SERVICES-INC - I 4323 TWTC - Time Warner Telecom 4355 ERMS-EARTHLNK - EARTHLINK INC 4364 IGLOU - IgLou Internet Service 4436 AS-NLAYER - nLayer Communicati 4513 Globix Corporation 4589 EASYNET Easynet Group Plc 4618 INET-TH-AS Internet Thailand C 4628 ASN-PACIFIC-INTERNET-IX Pacifi 4637 REACH Reach Network Border AS 4645 ASN-HKNET-AP HKNet Co. Ltd 4670 HYUNDAI-KR Shinbiro 4685 ASAHI-NET Asahi Net 4713 OCN NTT Communications Corpora 4725 ODN JAPAN TELECOM CO. LTD. 4732 DION KDDI CORPORATION 4755 VSNL-AS Videsh Sanchar Nigam L 4760 HKTIMS-AP PCCW Limited 4766 KIXS-AS-KR Korea Telecom 4780 SEEDNET Digital United Inc. 4802 WANTREE-AS-AP Wantree Developm 4804 MPX-AS Microplex PTY LTD 4812 CHINANET-SH-AP China Telecom ( 4837 CHINA169-BACKBONE CNCGROUP Chi 5051 KOLNET-AS-KR Korea Telecom Hit 5089 NTL NTL Group Limited 5381 POWTECH-AS PowerTech Informati 5388 ENERGIS-AS Energis UK 5390 EURONET Wanadoo Nederland BV G 5417 DEMON-NL Demon Netherlands Th 5462 CABLEINET Telewest Broadband 5483 HTC-AS Hungarian Telecom 5486 Euronet Digital Communications 5522 OMNITEL PLC OMNITEL 5561 ELENDER-AS ELENDER-AS 5603 SIOL-NET SiOL Internet d.o.o. 5604 FREEDOMTOSURF Freedom To Surf 5617 TPNET Polish Telecom's commerc 5650 ELIX - Electric Lightwave Inc 5719 SUNYSB - SUNY at Stony Brook 5783 KCSOS-NET - Kern County Superi 6058 NWT-AS - Internet North 6079 RCN-AS - RCN Corporation 6128 CABLE-NET-1 - Cablevision Syst 6140 IMPSAT-USA - ImpSat 6181 FUSE-NET - Cincinnati Bell Tel 6197 BATI-ATL - BellSouth Network S 6198 BATI-MIA - BellSouth Network S 6295 WHIDBEY1 - Whidbey Internet Se 6327 SHAW - Shaw Communications Inc 6366 PDXNET - Portland State Univer 6380 BELLSOUTH-NET-BLK - BellSouth. 6383 BELLSOUTH-NET-BLK - BellSouth. 6385 BELLSOUTH-NET-BLK - BellSouth. 6388 BELLSOUTH-NET-BLK - BellSouth. 6412 KW Gulfnet International 6453 GLOBEINTERNET Teleglobe Americ 6461 MFNX MFN - Metromedia Fiber Ne 6467 ESPIRECOMM - e.spire Communica 6478 ATT-INTERNET3 - AT&T WorldNet 6522 LEHIGH - Lehigh University 6539 GROUPTLCOM - GT Group Telecom 6711 HUNGARNET-SZEGED Szeged Univer 6724 STRATO Strato AG 6728 NILDRAM NILDRAM UK Peering 6764 PERFTECH-SLOVENIA-AS Perftech 6785 CYBERCITY Cybercity A/S 6805 TDDE-ASN1 Telefonica Deutschla 6830 UPC UPC Distribution Services 6854 TCNET-AS Telecom Centre Joint 6871 PLUSNET Plusnet Technologies L 6939 HURRICANE - Hurricane Electric 6981 FDNCOM - FDN.com 7011 FRONTIER-AND-CITIZENS - Electr 7015 CCCH-AS2 - Comcast Cable Commu 7018 ATT-INTERNET4 - AT&T WorldNet 7065 SONOMA - Sonoma Interconnect 7132 SBIS-AS - SBC Internet Service 7138 CRAWFORD-ANS - Crawford Commun 7260 NORLIGHT - Norlight Telecommun 7303 Telecom Argentina S.A. 7482 APOL-AS Asia Pacific On-line S 7511 SYNAPSE Good Communications Co 7701 CAIRNSNET-AS-AP CairnsNet Pty 7738 Telecomunicacoes da Bahia S.A. 7757 CCCH-AS4 - Comcast Cable Commu 7796 ATMLINK - ATMLINK 7893 BELLSOUTH-NET-BLK2 - Bellsouth 7896 UNL-AS - University of Nebrask 7925 WVNET - West Virginia Network 8001 NET-ACCESS-CORP - Net Access C 8047 GCI - GCI Communications Inc. 8052 SCRR-8052 - Road Runner 8057 VISIONNET - Vision Net Inc. 8120 BESTWEB - BestWeb Corporation 8151 Uninet S.A. de C.V. 8167 TELESC - Telecomunicacoes de S 8176 NETSCAPE-ASN - Netscape 8220 COLT COLT Telecommunications 8326 PL-BYDMAN-EDU Educational User 8342 RTCOMM-AS RTComm.RU Autonomous 8362 NordNet Autonomous System 8404 CABLECOM Cablecom GmbH 8434 TELENOR-SE Telenor AB 8514 INODE inode Telekommunikations 8551 BEZEQ-INTERNATIONAL-AS Bezeqin 8560 SCHLUND-AS Schlund + Partner A 8585 INTERNET-CG Internet Crna Gora 8591 AMIS-NET AMIS.NET Autonomous S 8611 Athens University of Economics 8642 B2 B2 Bredband AB (publ) 8708 RDSNET Romania Data Systems S. 8732 COMCOR-AS AS for Moscow Teleco 8736 GNS Grapes Network Services 8752 ASVT-NETWORK RusSDO Autonomous 8807 TISCALIDK Tiscali Denmark Auto 8838 ALICE Alice Networks 8890 OCHOTA Ochota Campus Network 8943 JUMP Jump Networks Ltd. 8968 Albacom Autonomous System 8972 INTERGENIA-ASN intergenia auto 8992 TELERING-AT tele.ring Telekom 9044 SOLNET SolNet Internet Solutio 9105 TISCALI-UK Tiscali UK 9116 Goldenlines main autonomous sy 9121 TTNET TTnet Autonomous System 9143 ATHOME-BENELUX-BV AtHome Benel 9153 BURSTFIRE-EU Burstfire Network 9155 QualityNet AS number 9158 SONOFON_AS SONOFON (Autonomous 9269 CTIHK-AS-AP City Telecom (H.K. 9277 THRUNET-AS-KR THRUNET 9305 FHNET Beijing Feihua Communica 9316 DACOM-PUBNETPLUS-AS-KR DACOM P 9317 ITISNET-AS Inha University 9318 HANARO-AS HANARO Telecom 9394 CRNET CHINA RAILWAY Internet(C 9416 GIGAMEDIA-AS-AP Hoshin Gigamed 9443 INTERNETPRIMUS-AS-AP Primus Te 9459 ASKONKUK KONKUK UNIVERSITY 9700 KRNIC-AS-KR Korea Network Info 9701 KRLINE-AS KrLine Internet Serv 9768 PUBNET1-AS KT 9800 UNICOM CHINA UNICOM 9803 JINGXUN Beijing Jingxun Public 9806 BJENET Beijing Educational Inf 9811 BJGY srit corp. beijing. 9822 AMNET-AU-AP Amnet IT Services 9844 HANINTERNET-AS HaninterNetwork 9848 GNGAS GNG Networks 9911 CONNECTPLUS-AP Singapore Telec 9919 NCIC-TW New Century InfoComm T 9924 TFN-TW Taiwan Fixed Network T 9929 CNCNET-CN China Netcom Corp. 9957 KINX-AS KINX Inc. 10052 KNU-AS Kyungpook National Univ 10091 SCV-AS-AP SCV Broadband Access 10107 EASEFUL-HK Easeful Strategic L 10160 PRISM-AS Intellicenter 10212 GUANGTONGNET-AP China Guangzho 10242 USINTERNET - US Internet Corp 10316 ABACUS-NET-AS - Abacus America 10318 CABLEVISION S.A. 10430 WA-K20 - Washington State K-20 10439 CARI - California Regional Int 10464 TEAMTECH - Team Technologies 10481 Prima S.A. 10507 SPCS - Sprint Personal Communi 10532 RACKSPACE - Rackspace.com 10602 TDL - THE DIAMOND LANE 10620 TV Cable S.A. 10692 DLS-LITH - DLS Computer Servic 10790 INREACH-AS - InReach Internet 10913 INTERNAP-BLK - Internap Networ 10970 LH - Lighthouse Communications 10994 TAMPA2-TWC-5 - Time Warner Com 11172 Alestra 11178 AUGUST-ASN - August Associates 11191 ELITE-NET - Elite.Net 11290 RAPIDUS - COGECO Cable Canada 11305 INTERLAND-NET1 - Interland Inc 11351 RR-NYSREGION-ASN-01 - Road Run 11388 MAXIM - Interland 11426 SCRR-11426 - Road Runner 11427 SCRR-11427 - Road Runner 11456 NUVOX - NuVox Communications 11486 WAN - Worldcom Advance Network 11509 TIERZERO-AS11509 - Tierzero 11683 ELNK-CHARTER-CONN - Earthlink 11707 SCRR-11707 - Road Runner 11739 DIGITAL-FOREST-NW - digital.fo 11814 IGS-GTA - Information Gateway 12156 STSN-SLC-UT-US - STSN GENERAL 12179 INTERNAP-2BLK - Internap Netwo 12262 RR-CINCINNATI-ASN-01 - Road Ru 12271 SCRR-12271 - Road Runner 12312 TISCALI-DE Tiscali Business Gm 12322 PROXAD AS for Proxad ISP 12334 AS R Cable y Telecomunicacione 12352 WINEASY WinEasy Autonomous Sys 12363 DADA S.p.a. 12394 Enertel N.V. 12524 INDEX Autonomous System 12570 CBCZ CZECHBONE AS 12578 APOLLO-AS LATTELEKOM-APOLLO 12593 AS12593 ISP UkrCom 12597 GOTANET Gotanet-Leissner Swed 12634 SCARLET Autonomous System for 12695 DINET-AS Digital Network JSC 12721 LOMBARDIACOM Elitel Autonomous 12775 The JPCINET Autonomous System 12797 ASN-ATLANET Atlanet Autonomous 12832 LYCOS-EUROPE Lycos Europe GmbH 12843 TELEMAXX TelemaxX Telekommunik 12859 NL-BIT BIT BV 12867 ONLINE-BG BULGARIA ONLINE 12874 FASTWEB Fastweb Autonomous Sys 12880 DCI-AS DCI Autonomous System 12909 ASN-BNS Blixernetservices S.r. 12996 DOMENESHOP Domeneshop AS 13112 TISCALI-NO Tiscali Norway 13143 ARAGON DE CABLE 13189 LIDERO Lidero Network AB 13193 ASN-NERIM Nerim -- xDSL Intern 13213 UK2NET-AS UK-2 Ltd Autonomous 13237 LAMBDANET-AS European Backbone 13272 STARMAN Starman Internet AS 13301 UNITEDCOLO-AS Autonomous Syste 13343 SCRR-13343 - Road Runner 13571 VIDEOTRON-LTEE - Videotron lte 13601 ASN-INNERHOST - Interland 13609 CHOICEONECOM - Choice One Comm 13680 AS13680 Hostway Corporation Ta 13726 VISION-I-SYSTEMS-ASN - Vision 13749 EVERYONES-INTERNET - Everyones 13768 PEER1 - Peer 1 Network Inc. 13790 INTERNAP-BLK3 - Internap Netwo 13796 UCONN-ARIN - University of Con 13884 ASN-THEPLANET - ThePlanet.com 13911 TERA-BYTE - Tera-byte Online S 14280 NETNATION - NetNation Communic 14361 HOPONE-DCA - HopOne Internet C 14492 DATAPIPE - DataPipe 14501 CIHOST - C I Host 14562 SHAW-COMMUNICATIONS - Shaw Com 14742 INTERNAP-BLOCK-4 - Internap Ne 14744 INTERNAP-BLOCK-4 - Internap Ne 15083 INFOLINK-MIA-US - Infolink Inf 15149 EZZI-101-BGP - EZZI.net 15153 INTERSTARCOMM - InterStar Comm 15440 AS15440 MicroLink Lietuva Auto 15467 ENTERNET-LIBERCOM-AS Enternet 15535 VIRTUALXS-AS VirtualXS Interne 15542 ZEELANDNET ZeelandNet BV 15589 AS15589 Eutelia S.p.A. Backbon 15656 ANET Anet Iletisim A.S. 15694 ATMAN ATMAN Autonomous System 15703 TRUESERVER-AS TrueServer BV AS 15857 DIALOG-AS DIALOG-NET Autonomuo 16023 NETSONIC 16150 PORT80 Port80 AB Sweden 16237 NXS Nxs Internet BV 16238 COULOMB-AS AS for Coulomb 16265 LEASEWEB LEASEWEB AS 16276 OVH OVH 16422 NEWSKIES-NETWORKS - New Skies 16526 BIRCH-TELECOM - Birch Telecom 16557 RE-STAFFORD - R. E. Stafford I 16629 Compania de Telecomunicaciones 16787 CHARTER-16787 - Charter Commun 16805 FASTSERVERS - FastServers In 16814 NSS S.A. 17054 SLC-EXPEDIENT - e-xpedient 17055 UTAH - University of Utah 17184 ATL-CBEYOND - CBEYOND COMMUNIC 17252 VDI - Virtual Development INC 17444 NWT-AS-AP AS number for New Wo 17506 JPNIC-JP-ASN-BLOCK Japan Netwo 17557 PKTELECOM-AS-AP Pakistan Telec 17676 JPNIC-JP-ASN-BLOCK Japan Netwo 17712 NONAME 17716 NTU-TW National Taiwan Univers 17964 DXTNET Beijing Dian-Xin-Tong N 17974 TELKOMNET-AS2-AP PT TELEKOMUNI 18298 CNUNET-AS-KR Chungnam National 18302 SKG_NW-AS-KR SK Global co. Lt 18420 NCU-TW National Central Univer 18474 AENEAS-CWUS - Aeneas Internet 18565 FORTIX-WEST - FORTIX LLC 18566 COVAD - Covad Communications 18822 Manquehuenet 18847 NETFIRE - NetFire.com 18942 WEBHOSTPLUS-INC - WebHostPlus 19108 RUSTON - Cox Internet Services 19116 AIRBAND-PHOENIX - airBand Comm 19130 DOCKNET - dock.net 19262 VZGNI-TRANSIT - Verizon Intern 19406 TOWERSTREAM - Towerstream 19444 CHARTER-STL - CHARTER COMMUNIC 19548 ADELPHIA-AS2 - Adelphia 19864 O1COMM - O1 COMMUNICATIONS 19875 IPWORLDNET - IPWorld Networks 20001 ROADRUNNER-WEST - Road Runner 20013 CYRUSONE - CYRUS ONE 20115 CHARTER-NET-HKY-NC - Charter C 20141 EDELTACOM-SUW-300 - e^deltacom 20172 SUREWEST-20172 - SureWest Broa 20183 VERICENTER - VeriCenter Inc. 20473 NETTRANS - NetTransactions LL 20495 WEDARE We Dare BV Autonomous S 20580 Telecom Italia Network 20804 ASN-TELENERGO EXATEL S.A. Auto 20932 SIG SIG - IP-MAN.NET 21050 FAST-TELCO kw.fast-telco Autno 21195 DGCSYSTEMS DGC Systems AB Auto 21285 DKOM Telekom Austria Applicati 21502 ASN-NUMERICABLE NUMERICABLE is 21522 ROADRUNNER-MNPLS - Road Runner 21527 MOG-NET - Michigan Online Grou 21548 VDN 21698 NEBRIX-CA - Nebrix Communicati 21788 NOC - Network Operations Cente 21840 SAGONET-TPA - Sago Networks 21844 THEPLANET-AS - THE PLANET 21852 DISNW1 - State Of Arkansas De 21889 RAPIDSYSTEMS - Rapid Systems C 22047 VTR BANDA ANCHA S.A. 22659 LIQUIDIX - LIQUID COMMUNICATIO 22685 QUICKPACKET - Plusweb Communic 22773 CCINET-2 - Cox Communications 22822 LLNW - Limelight Networks LLC 22909 DNEO-OSP1 - Comcast Cable Comm 22927 Telefonica de Argentina 22935 WAYNE-BOCES - Wayne Finger-Lak 23183 SWIFTSYSTEMS - SWIFT SYSTEMS 23201 Telecel S.A. 23215 MEGAPATH-US - MegaPath Network 23352 SERVER-CENTRAL-CHI - Server Ce 23393 ISPRIME - ISPrime Inc. 23522 CIT-FOONET - CREATIVE INTERNET 23670 SECURE-AS Oz Servers Data Cen 23980 YOUNGNAM-UNIV-AS-AP YOUNGNAM U 24587 NL-IO Autonomous System for In 24607 LENET "Lietuvos energija" JSC 24679 SSERV-AS Server-Service GmbH 24730 ASN-NETHOLDING Autonomous Syst 24744 SINET-SK-AS SOFTITUS s.r.o. Po 24786 PSP-AS Autonomous System of Pr 24900 IPX-SERVER IPX Server GmbH 24953 ASN-CARRIER66 carrier66.net Ne 24961 FASTIT-AS fast IT GmbH Duesse 25078 SKYTURN-AS Groupe Ecritel Fran 25310 ASN-BDDSL Bulldog Communicatio 25369 ASN-FOUR-U 4u-Networks Limited 25504 CRONON-AS Cronon AG 25525 REASONNET-AS Reasonnet LTD 25653 PEGASUS - Pegasus Web Technolo 25700 SWIFTDESK - SWIFTDESK VENTURE 25761 STAMINUS-COMM - Staminus Commu 25897 SERVERBEACH - ServerBeach 25973 MZIMA - Mzima Networks Inc. 26053 DREAMNET-C-S-I - DreamNet Comm 26101 YAHOO-3 - Yahoo! 26116 INDRA - Indra's Net Inc. 26496 PAH-INC - Go Daddy Software I 27195 EPICA - EPIC Alliance Inc. 27276 ASN-LOUDPACKET - LoudPacket In 27357 RACKSPACE - Rackspace.com 27524 NETSENTRY - Net Sentry Corp 27595 ATRIVO-AS - Atrivo 27645 ASN-NA-MSG-01 - Managed Soluti 27699 TELECOMUNICACOES DE SAO PAULO 28677 AMEN AMEN Network 28716 EPLANET-AS ePLANET SPA 28753 NETDIRECT AS NETDIRECT Frankfu 28937 ENERGIT-AS ENERG.IT SpA 29055 PRODIGY-AS Prodigy ASN 29131 RAPIDSWITCH-AS RapidSwitch Ltd 29415 EUROWAN-ASN OVANET - EuroWan d 29444 REFLEX-AS Reflex Internet 29550 EUROCONNEX-AS Euroconnex Netwo 29686 PROBENETWORKS-AS Probe Network 29737 WOW-INTERNET - WideOpenWest LL 29748 CARPATHIA-HOSTING - Carpathia 29759 OXFORD-INDUSTRIES - Oxford Ind 29838 CRNC - CRNC 29854 WESTHOST - WestHost 29863 DATA393 - Data393 Inc. 30058 FDCSERVERS - FDCservers.net LL 30083 SERVER4YOU - Server4You Inc. 30099 SB-2 - ServerBeach 30315 EVERYONES-INTERNET2 - Everyone 30340 AS-LLIX - Liberty Lake Interne 30407 VELCOM - Rcp.net 30490 ETHRN - Ethr.Net LLC 30500 WOLFPAWSERVICES - Wolfpaw Serv 30736 EASYSPEEDY-NETWORK Easyspeedy 30776 CASEMAISP-AS N.V. Casema 30837 PERSONALNET-HU-AS Personalnet 30943 UTRANSIT-AS Utransit Internati 31034 ARUBA-ASN Aruba.it Network 31042 SERBIA-BROADBAND-AS Serbia Bro 31103 KEYWEB-AS Keyweb AG 31159 NETCATHOST-AS NetcatHosting 31216 BSOCOM BSO Communication Netwo 31400 AS31400 AS31400.NET BACKBONE 31669 ITSS-AS IT - SOLID SOLUTIONS 31800 DALNET - DALnet 31898 NAMEI - Name Intelligence Inc 31932 AFS-KC - American Fiber System 32097 WII-KC - WholeSale Internet 32244 LIQUID-WEB-INC - Liquid Web 32477 INTERNET-SOLUTIONS-GROUP - Int 32666 CWRU-AS-1 - Case Western Reser 32748 STEADFAST - NoZone Inc. 32751 NUCLEARFALLOUT-SEA - Nuclearfa 32788 XILOGIX-ASN - Xilogix LLC 33251 BOSTONDATA - Boston Data Cente 33287 DNEO-OSP4 - Comcast Cable Comm 33322 NDCHOST - Network Data Center 33438 EASYNEWS - Easynews Inc. 33569 ALLHOSTSHOP - ALLHOSTSHOP.COM 33597 INFORELAY - InfoRelay Online S 33626 OVERSEE-DOT-NET - Oversee.net 33657 DNEO-OSP7 - Comcast Cable Comm 34021 MULTI-VISP Multi-vISP Network 34081 INCUBATEC-AS incubatec GmbH - 34465 BENESOL-AS Belgian Network Sol 34549 LAXIN-AS Laxin IT-Services Gmb 35042 ISP4P ISP4P IT Services 35873 XLON-TECHNOLOGIES - XLON Techn 35891 NLB-ASN - Norwood Light Broadb 35921 IFCI-US - InternetFCI LLC

2 1

Re: UUNET connectivity in Minneapolis, MN
by Robert Bonomi 12 Aug '05

12 Aug '05

> Date: Thu, 11 Aug 2005 16:06:05 +0000 (GMT) > From: "Christopher L. Morrow" <christopher.morrow(a)mci.com> > Subject: Re: UUNET connectivity in Minneapolis, MN > > On Thu, 11 Aug 2005 interex(a)inetica.com wrote: > > > we had a loss of comercial power(coned) in the downers grove terminal. > > terminal is up on generator power now. > > > > that seems to map to the internal firedrill as well, anyone else hit by > this event? > Electric utility had a sub-station burn up. resulting in a medium-sized geographic area without power -- something like 17,000 residences according to news reports (no numbers on 'commercial' custeomrs provided). AT&T has a facility in the affected area, and were also without utility power. Rumor mill says that Sprint had a (moderately small) number of T-3 circuits affected, as well.

10 12

Re: Holy Grail
by J. Oquendo 12 Aug '05

12 Aug '05

Purpose for posting it was, after reading it, there is not enough in my opinion to warrant a nuclear lock down on this information. I did this to sort of prove a point to those in the industry: "Stop letting vendors sell you short." As an engineer they've (Cisco) shortchanged clients using their equipment. If it's IPv6 based only, and not that big of a threat, then they should see no problem with the information being released. Before anyone decides to send in legal hounds, take note this is searchable via Google... 5 minutes tops with over 100+ sites listing the PDF. Sorry Cisco. On Fri, 12 Aug 2005, Gadi Evron wrote: > J. Oquendo wrote: > > > > www.infiltrated.net/cisco/holygrail.pdf > > I find it rather funny, really. > > Back in defcon, everybody was trading the presentation quietly and eagerly. > > Then every kiddie started asking if anyone wants it. > > Then we all got URL's to download it from. > > Then there was another pass of "psst, want the Lynn presentation?" > > And eventually, there was a CD placed on every table at defcon with the > presentation. > > Seeing big-time secret-handshake groups take this with a whisper and a > "if I know you, email me and I might share it" was a bit silly. > > Once again every Bad Guy in town had it and the Good Guys didn't want to > share under different excuses, some good, some sad. > > I find that sharing the presentation openly on NANOG is a bit of a bad > move because of how some may perceive it and you, but it has become > completely silly not to do it. So I ask that people reserve judgment.. I > was very tempted to do it myself. > > Gadi. > =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x97B43D89 http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x97B43D89 To conquer the enemy without resorting to war is the most desirable. The highest form of generalship is to conquer the enemy by strategy." - Sun Tzu

4 4

Weekly Routing Table Report
by Routing Table Analysis 12 Aug '05

12 Aug '05

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 13 Aug, 2005 Analysis Summary ---------------- BGP routing table entries examined: 167995 Prefixes after maximum aggregation: 96653 Unique aggregates announced to Internet: 81488 Total ASes present in the Internet Routing Table: 20273 Origin-only ASes present in the Internet Routing Table: 17669 Origin ASes announcing only one prefix: 8344 Transit ASes present in the Internet Routing Table: 2604 Transit-only ASes present in the Internet Routing Table: 74 Average AS path length visible in the Internet Routing Table: 4.5 Max AS path length visible: 26 Prefixes from unregistered ASNs in the Routing Table: 23 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 13 Number of addresses announced to Internet: 1403683221 Equivalent to 83 /8s, 170 /16s and 129 /24s Percentage of available address space announced: 37.9 Percentage of allocated address space announced: 57.0 Percentage of available address space allocated: 66.4 Total number of prefixes smaller than registry allocations: 79603 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 34867 Total APNIC prefixes after maximum aggregation: 15760 Prefixes being announced from the APNIC address blocks: 32728 Unique aggregates announced from the APNIC address blocks: 16456 APNIC Region origin ASes present in the Internet Routing Table: 2330 APNIC Region origin ASes announcing only one prefix: 689 APNIC Region transit ASes present in the Internet Routing Table: 345 Average APNIC Region AS path length visible: 4.5 Max APNIC Region AS path length visible: 18 Number of APNIC addresses announced to Internet: 192817280 Equivalent to 11 /8s, 126 /16s and 40 /24s Percentage of available APNIC address space announced: 71.6 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911 APNIC Address Blocks 58/7, 60/7, 124/7, 126/8, 202/7, 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 89765 Total ARIN prefixes after maximum aggregation: 54780 Prefixes being announced from the ARIN address blocks: 70157 Unique aggregates announced from the ARIN address blocks: 26041 ARIN Region origin ASes present in the Internet Routing Table: 10138 ARIN Region origin ASes announcing only one prefix: 3737 ARIN Region transit ASes present in the Internet Routing Table: 940 Average ARIN Region AS path length visible: 4.3 Max ARIN Region AS path length visible: 20 Number of ARIN addresses announced to Internet: 257546005 Equivalent to 15 /8s, 89 /16s and 215 /24s Percentage of available ARIN address space announced: 64.0 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863 ARIN Address Blocks 24/8, 63/8, 64/6, 68/7, 70/6, 74/7, 76/8, 198/7, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 32477 Total RIPE prefixes after maximum aggregation: 22163 Prefixes being announced from the RIPE address blocks: 29468 Unique aggregates announced from the RIPE address blocks: 19819 RIPE Region origin ASes present in the Internet Routing Table: 6975 RIPE Region origin ASes announcing only one prefix: 3684 RIPE Region transit ASes present in the Internet Routing Table: 1147 Average RIPE Region AS path length visible: 5.2 Max RIPE Region AS path length visible: 26 Number of RIPE addresses announced to Internet: 214968064 Equivalent to 12 /8s, 208 /16s and 39 /24s Percentage of available RIPE address space announced: 64.1 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839 RIPE Address Blocks 62/8, 80/5, 88/6, 188/8, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 9205 Total LACNIC prefixes after maximum aggregation: 3166 Prefixes being announced from the LACNIC address blocks: 7562 Unique aggregates announced from the LACNIC address blocks: 4381 LACNIC Region origin ASes present in the Internet Routing Table: 631 LACNIC Region origin ASes announcing only one prefix: 196 LACNIC Region transit ASes present in the Internet Routing Table: 117 Average LACNIC Region AS path length visible: 5.2 Max LACNIC Region AS path length visible: 23 Number of LACNIC addresses announced to Internet: 20834560 Equivalent to 1 /8s, 61 /16s and 233 /24s Percentage of available LACNIC address space announced: 31.0 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 189/8, 190/8, 200/7 AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 1652 Total AfriNIC prefixes after maximum aggregation: 784 Prefixes being announced from the AfriNIC address blocks: 1012 Unique aggregates announced from the AfriNIC address blocks: 777 AfriNIC Region origin ASes present in the Internet Routing Table: 134 AfriNIC Region origin ASes announcing only one prefix: 38 AfriNIC Region transit ASes present in the Internet Routing Table: 16 Average AfriNIC Region AS path length visible: 4.5 Max AfriNIC Region AS path length visible: 12 Number of AfriNIC addresses announced to Internet: 2358272 Equivalent to 0 /8s, 35 /16s and 252 /24s Percentage of available AfriNIC address space announced: 7.0 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 957 5524 194 CHINANET-BACKBONE 1221 770 1327 528 Telstra Pty Ltd 9583 750 77 14 Sify Limited 4755 682 259 65 Videsh Sanchar Nigam Ltd. Aut 4766 593 3413 279 Korea Telecom (KIX) 7545 515 108 72 TPG Internet Pty Ltd 17676 464 6723 99 Softbank BB Corp. 9443 382 82 77 Primus Telecommunications 9498 339 83 61 BHARTI BT INTERNET LTD. 2907 337 1789 314 SINET Japan 9929 337 224 46 China Netcom Corp. 17557 327 23 153 Pakistan Telecom 7474 317 273 218 SingTel Optus Pty Ltd 17488 298 17 18 Hathway IP Over Cable Interne 4802 295 53 159 Wantree Development 18302 290 93 158 SK Global co., Ltd 9837 277 79 180 Powertel Ltd 17974 271 65 14 PT TELEKOMUNIKASI INDONESIA 703 255 262 207 UUNET - Commercial IP service 9800 250 390 64 CHINA UNICOM ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1510 6404 979 AT&T WorldNet Services 4323 1144 704 221 Time Warner Telecom 174 1126 5821 1036 Cogent Communications 721 1085 21795 314 DLA Systems Automation Center 701 1008 8155 857 UUNET Technologies, Inc. 6197 939 497 449 BellSouth Network Solutions, 2386 893 528 656 AT&T Data Communications Serv 1239 868 2863 627 Sprint 18566 834 224 7 Covad Communications 20115 653 502 325 Charter Communications 209 617 3470 488 Qwest 3356 581 10695 445 Level 3 Communications, LLC 27364 554 44 18 Armstrong Cable Services 3602 550 125 106 Sprint Canada, Inc. 3561 533 2385 422 Savvis 22773 514 1349 25 Cox Communications, Inc. 5668 501 115 23 CenturyTel Internet Holdings, 6198 468 396 224 BellSouth Network Solutions, 7132 452 4947 386 SBC Internet Services 852 445 1093 384 Telus Advanced Communications RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 591 1999 482 UUNET - Commercial IP service 3301 299 1081 285 TeliaNet Sweden 3320 291 3232 240 Deutsche Telekom AG 8220 263 474 259 COLT Telecommunications 680 245 2041 241 DFN-IP service G-WiN 3246 230 469 223 Song Networks 8708 228 262 214 Romania Data Systems S.A. 1257 197 712 175 SWIPnet Swedish IP Network 5515 181 778 127 Sonera Solution Autonomous Sy 6746 179 49 155 Dynamic Network Technologies, 5400 177 289 149 BT Ignite European Backbone 786 174 1794 174 The JANET IP Service 719 169 340 100 LANLINK autonomous system 3269 169 1518 71 TELECOM ITALIA 8866 163 20 7 Bulgarian Telecommunication C 9121 160 276 43 TTnet Autonomous System 3300 155 184 89 AUCS Communications Services 6830 155 665 32 UPC Distribution Services 25186 144 145 101 France Telecom Transpac's Tra 8551 139 120 20 Bezeq International LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 380 599 160 UniNet S.A. de C.V. 16814 265 16 7 NSS, S.A. 11172 242 99 59 Servicios Alestra S.A de C.V 6147 192 110 21 Telefonica Del Peru 11664 185 20 23 Keytech SA 14117 152 9 5 Telefonica del Sur S.A. 7303 145 69 16 Telecom Argentina Stet-France 19632 143 14 5 Metropolis Intercom S.A. 22047 143 112 7 VTR PUNTO NET S.A. 11556 131 64 3 Cable-Wireless Panama 6505 130 90 87 Global One Communicaoes Ltda 19169 120 8 26 Telconet 13999 113 52 9 Mega Cable S.A. de C.V. 18822 110 7 14 TELEFONICA MANQUEHUE 21826 102 13 19 INTERCABLE 5639 101 12 9 Telecommunications Services o 10481 101 40 7 Prima S.A. 6503 98 146 72 AVANTEL, S.A. 11311 97 8 14 Sinectis S.A. 23216 95 24 20 RAMtelecom Telecomunicaciones AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 263 621 221 The Internet Solution 5536 123 16 14 Internet Egypt Network 8452 103 32 7 TEDATA 2018 96 295 87 Tertiary Education Network 2905 76 266 68 The Internetworking Company o 20928 57 16 2 Noor Advanced Technologies AS 24835 57 34 6 RAYA Telecom - Egypt 6713 51 54 8 Itissalat Al-MAGHRIB 15475 47 84 4 Nile Online 9129 42 3 3 UUNET Kenya 5713 40 148 31 Telkom SA Ltd 12455 37 6 3 Jambonet Autonomous system 15706 31 8 3 Sudatel Internet Exchange Aut 8524 24 1 4 AUCEGYPT Autonomous System 16637 22 10 19 Johnnic e-Ventures 10798 21 1 12 Standard Bank of South Africa 23889 20 5 9 MAURITIUS TELECOM 12258 17 3 11 Vodacom Internet Company 15808 17 2 2 Communication Solutions Ltd i 21491 17 1 1 UTL On-line is RF broadband I Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 4323 1144 923 Time Warner Telecom 18566 834 827 Covad Communications 721 1085 771 DLA Systems Automation Center 4134 957 763 CHINANET-BACKBONE 9583 750 736 Sify Limited 4755 682 617 Videsh Sanchar Nigam Ltd. Aut 27364 554 536 Armstrong Cable Services 6197 939 490 BellSouth Network Solutions, 22773 514 489 Cox Communications, Inc. 5668 501 478 CenturyTel Internet Holdings, 3602 550 444 Sprint Canada, Inc. 7545 515 443 TPG Internet Pty Ltd 17676 464 365 Softbank BB Corp. 6467 436 363 E.Spire Communications, Inc. 20115 653 328 Charter Communications 19262 443 324 Verizon Global Networks 4766 593 314 Korea Telecom (KIX) 11492 315 309 Cable One 9443 382 305 Primus Telecommunications 6140 415 293 ImpSat List of Unregistered ASNs (Global) ---------------------------------- Bad AS Designation Network Transit AS Description 64826 PRIVATE 64.200.250.0/23 7911 Williams Communicati 65511 PRIVATE 65.77.145.0/24 16605 Aaro Broadband Wirel 65511 PRIVATE 65.77.146.0/24 16605 Aaro Broadband Wirel 65511 PRIVATE 65.77.147.0/24 16605 Aaro Broadband Wirel 65511 PRIVATE 65.77.151.0/24 16605 Aaro Broadband Wirel 65021 PRIVATE 128.216.1.0/24 619 Department of Navy 65021 PRIVATE 128.216.2.0/24 619 Department of Navy 65021 PRIVATE 128.216.3.0/24 619 Department of Navy 65021 PRIVATE 128.216.4.0/24 619 Department of Navy 65050 PRIVATE 168.96.148.0/24 6140 ImpSat 65535 PRIVATE 168.96.250.0/27 3597 Asociacion Civil Cie 65507 PRIVATE 200.0.64.0/24 27750 Cooperación Latino A 65004 PRIVATE 200.0.113.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.0.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.1.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.2.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.3.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.4.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.5.0/24 28477 Universidad Autonoma 65004 PRIVATE 200.4.6.0/24 28477 Universidad Autonoma 64943 PRIVATE 202.41.14.0/24 24110 Security Mail Pty Lt 64942 PRIVATE 202.41.15.0/24 24110 Security Mail Pty Lt 65005 PRIVATE 203.200.197.0/24 4755 Videsh Sanchar Nigam Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 172.32.0.0/24 7011 Citizens Utilities 192.43.230.0/24 7575 Australian Academic and Rease 192.44.0.0/24 5501 Fraunhofer Gesellschaft 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.84.205.0/24 719 LANLINK autonomous system 192.119.135.0/24 270 NASA 192.135.50.0/24 7018 AT&T WorldNet Services 192.172.0.0/19 721 DLA Systems Automation Center 192.200.100.0/24 7018 AT&T WorldNet Services Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:17 /9:3 /10:8 /11:16 /12:74 /13:169 /14:319 /15:607 /16:8472 /17:2682 /18:4561 /19:10588 /20:11590 /21:9648 /22:13037 /23:13916 /24:91250 /25:353 /26:314 /27:181 /28:50 /29:27 /30:77 /31:0 /32:36 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 818 834 Covad Communications 6197 766 939 BellSouth Network Solutions, 7018 713 1510 AT&T WorldNet Services 2386 602 893 AT&T Data Communications Serv 9583 567 750 Sify Limited 4323 545 1144 Time Warner Telecom 27364 545 554 Armstrong Cable Services 4766 411 593 Korea Telecom (KIX) 5668 405 501 CenturyTel Internet Holdings, 702 364 591 UUNET - Commercial IP service 19916 363 370 OLM LLC 1239 361 868 Sprint 6198 343 468 BellSouth Network Solutions, 7011 332 384 Citizens Utilities 11492 307 315 Cable One 6517 299 321 Yipes Communications, Inc. 15270 298 322 PaeTec.net -a division of Pae 6467 290 436 E.Spire Communications, Inc. 20115 283 653 Charter Communications 11456 276 314 Carolina Online, Inc. Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:7 8:23 11:1 12:1560 13:1 15:9 16:2 17:3 18:3 20:5 24:961 30:2 32:70 33:1 38:140 40:56 44:4 47:2 52:4 55:2 56:3 57:23 58:149 59:60 60:107 61:730 62:685 63:1887 64:2831 65:2075 66:2897 67:584 68:572 69:1129 70:158 71:13 72:313 80:601 81:556 82:450 83:290 84:229 85:295 86:78 87:25 128:153 129:168 130:88 131:299 132:38 133:1 134:144 135:42 136:149 137:69 138:161 139:61 140:402 141:105 142:144 143:140 144:194 145:34 146:292 147:110 148:292 149:177 150:107 151:62 152:108 153:89 154:5 155:141 156:76 157:99 158:167 159:166 160:82 161:72 162:219 163:96 164:189 165:183 166:154 167:245 168:436 169:145 170:314 171:8 172:1 190:1 192:5749 193:3244 194:2416 195:1584 196:654 198:3881 199:3284 200:4106 201:234 202:5983 203:6399 204:3787 205:2033 206:2457 207:2832 208:2055 209:3355 210:1643 211:745 212:1258 213:1305 214:287 215:35 216:3623 217:1113 218:213 219:167 220:422 221:237 222:125 End of report

1 0

Fwd: Re: Dst. ports 33438, 33437 (64.95.255.255) [data393]
by Fergie (Paul Ferguson) 12 Aug '05

12 Aug '05

The following is some dialogue that I posted to the DShield.org list last night, trying to figure out why I was seeing these odd traceroute probes in my firewall logs at home. I post it here for two reasons: [1] Does anyone have any experience with InterNAP's FCP-500 product? I was looking for some additional technical info beyond what is on their web site. Contact me off-list, of course. And, [2] Just thought some of you might be interested. :-) - ferg ---------- Forwarded Message ---------- Just as an FYI follow-up to last night's e-mails from me to on the list [subject line above], I received this from InterNAP this morning. Though I'd share... - feeg ---------- Forwarded Message ---------- We have received the following notice regarding trace route traffic originating from our network, so I thought I would give respond to give you a bit of piece of mind. The packets you are seeing are actually a very GOOD thing. Our datacenter employs a technology which tunes BGP routing tables for outbound traffic to provide the highest performing route path. On average, this shaves 35-40ms off the round-trip time for network performance. The device which performs these operations is called an Internap FCP-500. You can view more information at http://www.internap.com/products/route-optimization.htm Chances are, your public IP address was part of communication with our datacenter. Since over 10,000 web sites are hosted in our center, it is a very likely case that you accessed a web site, which then triggered the performance platform to probe round-trip times via traditional trace route and ping protocols. Once you communicate with the datacenter for the first time, the device will continue to probe the pathway for performance data periodically, and adjust routes accordingly. The end result is, a better performing experience since the packets take the best performing pathway through the Internet from the datacenter to the end user. Regards, Susan Cook ________________________________ Susan Cook | AUP Enforcement [contact info elided] -----Original Message----- From: abuse(a)internap.com [mailto:abuse@internap.com] Posted At: Wednesday, August 10, 2005 9:46 PM Posted To: Data393 Abuse Conversation: [ABUSE] Re: [Dshield] Dst. ports 33438, 33437 (64.95.255.255) [data393] Subject: [ABUSE] Re: [Dshield] Dst. ports 33438, 33437 (64.95.255.255) [data393] Internap has received an abuse complaint related to the possible distribution of unsolicited e-mail (spam) or a possible security violation from you or one of your customers. We are forwarding the complaint to you so that you may take appropriate measures to address the issue. The purpose of this message is to inform you of a complaint we have received as if you had received the complaint directly. We have not verified the accuracy of the complaint nor is this an accusation that the said incident has occurred. Internap will not embark upon any punitive action regarding spam or security complaints without explicitly and formally contacting you regarding a clear, verified complaint, or a pattern of abuse. Please refer to http://www.internap.com/about/policies.html for general questions regarding Internap's stance on spam or abuse. Please direct any questions regarding this specific issue to abuse(a)internap.com. ---------- Forwarded message ---------- From: "Fergie (Paul Ferguson)" <<removed>@netzero.net> Date: Thu, 11 Aug 2005 03:39:43 GMT To: list(a)lists.dshield.org Cc: abuse(a)internap.com Subject: Re: [Dshield] Dst. ports 33438, 33437 ...and, now I see an adjacent port as well: 2005-08-10 21:21:48 -05:00 87744681 1 64.94.45.10 14484 67.64.90.x 33436 udp 64.94.45.10 --> fcp-2.chg.pnap.net Hmmm. OrgName: Internap Network Services OrgID: PNAP Address: 250 Williams Street Address: Suite E100 City: Atlanta StateProv: GA PostalCode: 30303 Country: US NetRange: 64.94.0.0 - 64.95.255.255 CIDR: 64.94.0.0/15 NetName: PNAP-05-2000 NetHandle: NET-64-94-0-0-1 Parent: NET-64-0-0-0-0 NetType: Direct Allocation NameServer: NS1.PNAP.NET NameServer: NS2.PNAP.NET Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE RegDate: 2000-06-05 Updated: 2002-06-17 TechHandle: INO3-ARIN TechName: InterNap Network Operations Center TechPhone: +1-877-843-4662 TechEmail: noc(a)internap.com OrgAbuseHandle: IAC3-ARIN OrgAbuseName: Internap Abuse Contact OrgAbusePhone: +1-206-256-9500 OrgAbuseEmail: abuse(a)internap.com OrgTechHandle: INO3-ARIN OrgTechName: InterNap Network Operations Center OrgTechPhone: +1-877-843-4662 OrgTechEmail: noc(a)internap.com # ARIN WHOIS database, last updated 2005-08-10 19:10 # Enter ? for additional hints on searching ARIN's WHOIS database. Tracing to: 64.94.45.10 1 legacy26-0.default.csail.mit.edu (18.26.0.1) [AS3] 0 ms 0 ms 0 ms 2 kalgan.trantor.csail.mit.edu (128.30.0.245) [AS40] 0 ms 0 ms 0 ms 3 B24-RTR-2-CSAIL.MIT.EDU (18.4.7.1) [AS3] 90 ms 96 ms 2 ms 4 EXTERNAL-RTR-2-BACKBONE.MIT.EDU (18.168.0.27) [AS3] 0 ms 0 ms 0 ms 5 EXTERNAL-RTR-1-BACKBONE.MIT.EDU (18.168.0.18) [AS3] 1 ms 1 ms 1 ms 6 ge-6-23.car2.Boston1.Level3.net (4.79.2.1) [AS3356] 1 ms 1 ms 1 ms 7 ae-1-51.mp1.Boston1.Level3.net (4.68.100.1) [AS3356] 1 ms 1 ms 1 ms 8 so-3-1-0.bbr1.Chicago1.Level3.net (64.159.4.178) [AS3356] 21 ms ae-0-0.bbr2.Chicago1.Level3.net (64.159.1.34) [AS3356] 21 ms so-3-1-0.bbr1.Chicago1.Level3.net (64.159.4.178) [AS3356] 21 ms 9 ge-7-0.ipcolo1.Chicago1.Level3.net (4.68.101.42) [AS3356] 21 ms ge-7-1.ipcolo1.Chicago1.Level3.net (4.68.101.106) [AS3356] 21 ms ge-9-1.ipcolo1.Chicago1.Level3.net (4.68.101.74) [AS3356] 21 ms 10 unknown.Level3.net (209.247.34.166) [AS3356] 21 ms 21 ms 21 ms 11 border6.ge4-1-bbnet2.chg.pnap.net (64.94.32.75) [AS19024] 51 ms 21 ms 21 ms 12 fcp1.chg.pnap.net (64.94.45.96) [AS19024] 21 ms 21 ms 21 ms 13 * * * 14 * * * What's up with that? Very, very odd... - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/ -- "Fergie (Paul Ferguson)" <fergdawg(a)netzero.net> wrote: ..and a traceroute form MIT: Tracing to: 208.42.224.238 1 legacy26-0.default.csail.mit.edu (18.26.0.1) [AS3] 0 ms 0 ms 0 ms 2 kalgan.trantor.csail.mit.edu (128.30.0.245) [AS40] 0 ms 0 ms 0 ms 3 B24-RTR-2-CSAIL.MIT.EDU (18.4.7.1) [AS3] 0 ms 9 ms 1 ms 4 EXTERNAL-RTR-2-BACKBONE.MIT.EDU (18.168.0.27) [AS3] 68 ms 108 ms 9 ms 5 EXTERNAL-RTR-1-BACKBONE.MIT.EDU (18.168.0.18) [AS3] 1 ms 1 ms 1 ms 6 ge-6-23.car2.Boston1.Level3.net (4.79.2.1) [AS3356] 1 ms 1 ms 1 ms 7 ae-1-53.mp1.Boston1.Level3.net (4.68.100.65) [AS3356] 1 ms 1 ms 1 ms 8 as-0-0.bbr2.Denver1.Level3.net (64.159.4.226) [AS3356] 43 ms ae-0-0.bbr1.Denver1.Level3.net (64.159.1.113) [AS3356] 43 ms as-0-0.bbr2.Denver1.Level3.net (64.159.4.226) [AS3356] 43 ms 9 so-6-0.hsa1.Denver1.Level3.net (4.68.112.154) [AS3356] 44 ms 43 ms 4.68.113.54 (4.68.113.54) [AS3356] 43 ms 10 4.79.80.14 (4.79.80.14) [AS3356] 44 ms 44 ms 44 ms 11 core-b.v33.ge-4-5.Level3.edge3.data393.net (208.42.224.117) [AS29863] 44 ms 44 ms 44 ms * * * * * * - ferg -- "Fergie (Paul Ferguson)" <fergdawg(a)netzero.net> wrote: WHOIS info leaves me with everything EXCEPT the warm and fuzzies: OrgName: Data393 Inc. OrgID: DATA3 Address: 393 Inverness Parkway City: Englewood StateProv: CO PostalCode: 80112-5855 Country: US NetRange: 208.42.224.0 - 208.42.255.255 CIDR: 208.42.224.0/19 NetName: D393-DC-INVERNESS1 NetHandle: NET-208-42-224-0-1 Parent: NET-208-0-0-0-0 NetType: Direct Allocation NameServer: NS1.DATA393.NET NameServer: NS2.DATA393.NET Comment: RegDate: 2004-01-28 Updated: 2004-04-21 AbuseHandle: IPADM77-ARIN AbuseName: IP Administration AbusePhone: +1-303-268-1500 AbuseEmail: NOCHandle: IPADM77-ARIN NOCName: IP Administration NOCPhone: +1-303-268-1500 NOCEmail: ip-addr(a)data393.net TechHandle: IPADM77-ARIN TechName: IP Administration TechPhone: +1-303-268-1500 TechEmail: ip-addr(a)data393.net OrgTechHandle: IPADM77-ARIN OrgTechName: IP Administration OrgTechPhone: +1-303-268-1500 OrgTechEmail: ip-addr(a)data393.net # ARIN WHOIS database, last updated 2005-08-10 19:10 # Enter ? for additional hints on searching ARIN's WHOIS database. - ferg -- "Fergie (Paul Ferguson)" <fergdawg(a)netzero.net> wrote: I fired this e-mail off before I dug into it deeper... Duh. Late night, beer, etc. The reverse lookup on the source addres reveals: 208.42.224.238: performance-check-via-SAVVIS.THIS-IS_HARMLESS-It_is_a_Traceroute_or_Ping _packet.BGP-route-control.data393.net Now, the next question is why they're picking my home SBC DSL host address (which I NAT out of) for this excerise... - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

3 2