February 2006 - Test - lists.nanog.org

Re: DNS deluge for x.p.ctrc.cc
by Barrett Lyon 27 Feb '06

27 Feb '06

I thought I would chime in quickly, one of my customers has been one of the targets of this attack. The x.p.ctrc.cc DNS server was shut down on the 15th, the response itself had a 360000 TTL so that should be expired by now. On this end of it, the largest traffic spike we received was around 8 Gbps. The last time we saw this traffic was on the 21st around 2 GMT with traffic at about 2 Gbps, it has lost a lot of steam. If you see unusual DNS traffic to AS32787 or 72.52.0.0/18, chances are it is part of this attack or the attacker setup a new RR to query against. I've yet to see a copy of the malware that is doing the spoofed queries itself. If anyone has it, I would like to take a look. Thanks and I am really impressed with everyone's reaction to this attack. Especially Rob Thomas, he really has a grip on it. Cheers, -Barrett

2 1

Re: DNS deluge for x.p.ctrc.cc
by Rob Thomas 26 Feb '06

26 Feb '06

Hi, NANOGers. ] other cctld servers have seen what are effectively ddos. rob thomas ] seems to have the most clue on this, so i hope this troll will entice ] him to speak. Did someone say "troll?" :) Yes, this is a real problem. These attacks have exceeded several gigabits per second in size, and during one attack 122K DNS name servers were abused as amplifiers. Ouch! This abuse can be mitigated. Here are a few tips. Limit recursion to trusted netblocks and customers. Do not permit your name servers to provide recursion for the world. If you do, you will contribute to one of these attacks. Watch for queries to your name servers that ask for "ANY" related to a DNS RR outside of the zones for which you are authoritative. This DNS RR will be LARGE. Limit UDP queries to 512 bytes. This greatly decreases the amplification affect, though it doesn't stop it. Scan your IP space for name servers that permit recursive queries. It's amazing just how many of these name servers exist. Refer to the following guides for some excellent insight and suggestions. <http://www.us-cert.gov/reading_room/DNS-recursion121605.pdf> <http://cc.uoregon.edu/cnews/winter2006/recursive.htm> <http://dns.measurement-factory.com/surveys/sum1.html> Note we have our own Secure BIND Template which will help on the BIND side of life. <http://www.cymru.com/Documents/secure-bind-template.html> If you need assistance with any of this, have endured one of these attacks, or have any other questions, please don't hesitate to ping on us at team-cymru(a)cymru.com. We're here to assist! Thanks! Rob. -- Rob Thomas Team Cymru http://www.cymru.com/ ASSERT(coffee != empty);

13 17

Re: DNS deluge for x.p.ctrc.cc
by Paul Vixie 26 Feb '06

26 Feb '06

i'd writ: # > speaking of which, f-root has about 35 nodes world wide, and about a third # > to a half of them aren't reachable by udp/161, and the blockage is not in # > our immediate neighbors but rather on transit paths. this is due to the # > cisco snmp vulnerability five years or so ago. filtering in the core to # > protect vulnerable edges has to be done a LOT more carefully than that. # > (BCP38 is an example of how to do it well, but apparently impractically?) someone followed up anonymously: # Filtering UDP/161 and TCP/161 directed towards -one's own infrastructure- is # a BCP, irrespective of SNMP vulns, etc. It should of course be allowed to # transit for folks who insist on doing SNMP across 'the Internet', but in # reality, one ought not to be allowing this at all. A lot of folks didn't # understand or didn't take the time to incorporate this into organized iACL, # and so ended up blocking it for transit traffic, as well, unfortunately. "yum." (folks who control backbone router meshes without fully understanding the impact of changes they make or time to fully digest and incorporate BCPs.) # Yes, filtering ports is a losing proposition (how long until all 64K of TCP # and UDP are filtered, heh?), but in this case, there's a practical reason to # do so, at least for traffic ingressing towards one's own devices. i just don't agree that filtering ports on internal infrastructure access buys anything. the boyz who run ISC's network filter by source-IP. that means if somebody needs to SSH to one of our routers they have to be coming from some fairly nearby/trusted place. i believe this is also what UUNET does, and it's what we were doing at MFN as of the time i left. i thought THAT was a BCP? after all, the combination of not letting outsiders spoof your internal IP range, and not letting your customers spoof IP ranges not assigned to them, ought to make IP ACL's containing internal source addresses fairly dependable?

1 0

DKIM for ISPs
by Dave Crocker 24 Feb '06

24 Feb '06

Folks, Prior to the MAAWG meeting in San Francisco, next week, there is a breakfast planned for any ISP folk wishing to learn more about DKIM. It will be at 7:30-9am, 1 March. We are seeking to gain adoption and use sooner, rather than later. Please see: <http://www.dkim.org/breakfast.pdf> for details. Please pass this note to anyone you feel might be interested in hearing about it. Thanks. d/ -- Dave Crocker Brandenburg InternetWorking <http://bbiw.net>

1 0

Dallas meeting stats
by Susan Harris 24 Feb '06

24 Feb '06

NANOG 36 February 12-15, 2006 Dallas Host: Yahoo ---------------------- Total attendance 338 Women attendees 6% NAPs represented 11 (5 outside N. America) Univ./Colleges repr. 14 Non-US/Canada/Mexico attendees 41 Attendee occupation breakdown: Vegas Seattle LA Dallas ----- ------- --- ------ ISPs/NetOps 44% 50% 42% 45% Hardware vendors 20% 15% 13% 13% Software vendors 3% 4% 3% 4% R&E 11% 9% 10% 11% Government 4% 3% 3% 2% Consultant 4% 3% 3% 5% Content provider 3% 4% 4% 6% Other 11% 12% 22% 14% (IXPs, registries, misc.) Maximum RealMedia streaming participants: 72 Support: Meeting coordination: Merit Network Host: Yahoo Squid, DNS, DHCP: Measurement Factory Multicast, v6 feed: Merit Sponsors: Arbinet, Arbor, Cariden, Cisco, Foundry Juniper, Renesys, Tellabs PS - what else would you like to see in this report?

1 0

DNS deluge for x.p.ctrc.cc
by Estes, Paul 24 Feb '06

24 Feb '06

We have recently noticed a deluge of DNS requests for "ANY ANY" records of x.p.ctrc.cc. The requests are coming from thousands of sources, mostly our own customers. There are currently no records for x.p.ctrc.cc, or even for p.ctrc.cc. A google search for x.p.ctrc.cc comes up with only 2 hits. One is a DNS log showing references to this name. The other one shows that somebody else is seeing the same behavior as we are: http://weblog.barnet.com.au/edwin/cat_networking.html However, this site has the benefit or providing a history that p.ctrc.cc had (a week ago) delegated NS record pointing to 321blowjob.com. At that time, 321blowjob.com's nameserver was responding with a TXT record for x.p.ctrc.cc. It would appear that ctrc.cc was the victim of some DNS hijacking. Whatever malware is attempting to lookup this name, however, is doing so at a horrific rate. I have some addresses that have made >250000 requests for this name in a short period of time. I was thinking that I could simply put an authoritative zone for p.ctrc.cc in our nameservers and return something for the lookups, however based on the writeup on the above mentions blog, I am now not certain this will have any effect. As you'll note, that individual had only 2 machines hitting his name server, and even though a response was provided to the lookup, the hosts continued to hammer his access link. When the lookup flood occurs, every host starts at the same time, as can be seen on the graphs of traffic to and load of our nameservers. It's all or nothing - the flood is either on or off. There's no background trickle. Is anybody else seeing these events? --Paul

6 7

RE: DNS deluge for x.p.ctrc.cc
by Estes, Paul 24 Feb '06

24 Feb '06

Actually, what we are seeing does not appear to be an amplification attack. It appears to be a request flood from infected machines. We have anti-spoofing filters on our upstream connections as well as our subscriber's access lines. The source addresses are not spoofed. They are valid subscriber source IP's. Based on some cached entries I have found in other nameservers, CTRC.CC was apparently hacked and was delegating a number of subdomains to another nameserver that was issuing the 4K TXT record. The delegation has now been removed, and the nameserver they were delegated to appears to be offline. --Paul -----Original Message----- From: william(at)elan.net [mailto:william@elan.net] Sent: Friday, February 24, 2006 9:47 AM To: Estes, Paul Cc: nanog(a)merit.edu Subject: Re: DNS deluge for x.p.ctrc.cc On Fri, 24 Feb 2006, Estes, Paul wrote: > We have recently noticed a deluge of DNS requests for "ANY ANY" records They are trying to abuse similar holes that caused most of us add "no ip redirects" and "no ip directed broadcast" to routers, but this time its about dns > of x.p.ctrc.cc. The requests are coming from thousands of sources, > mostly our own customers. Why am I not surprised .... > There are currently no records for x.p.ctrc.cc, or even for p.ctrc.cc. http://www.completewhois.com/cgi-bin/whois.cgi?query=28242102&options=re trieve I don't think this is a hacker-setup domain, probably their dns servers were at some point hacked. They are associated with legacy ip block 192.238.16.0/21. It is also notable that CTRC.CC A record points to 192.168.202.72 > A google search for x.p.ctrc.cc > comes up with only 2 hits. One is a DNS log showing references to this > name. The other one shows that somebody else is seeing the same behavior > as we are: > > http://weblog.barnet.com.au/edwin/cat_networking.html > > However, this site has the benefit or providing a history that p.ctrc.cc > had (a week ago) delegated NS record pointing to 321blowjob.com. At that > time, 321blowjob.com's nameserver was responding with a TXT record for > x.p.ctrc.cc. > It would appear that ctrc.cc was the victim of some DNS hijacking. > Whatever malware is attempting to lookup this name, however, is doing so > at a horrific rate. I have some addresses that have made >250000 > requests for this name in a short period of time. > > I was thinking that I could simply put an authoritative zone for > p.ctrc.cc in our nameservers and return something for the lookups You might want to consider returning the same thing in lookups as ctrc.cc themselves have for direct A lookups... , [snip]

2 1

Weekly Routing Table Report
by Routing Table Analysis 24 Feb '06

24 Feb '06

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 25 Feb, 2006 Analysis Summary ---------------- BGP routing table entries examined: 182808 Prefixes after maximum aggregation: 101672 Unique aggregates announced to Internet: 88890 Total ASes present in the Internet Routing Table: 21618 Origin-only ASes present in the Internet Routing Table: 18788 Origin ASes announcing only one prefix: 8927 Transit ASes present in the Internet Routing Table: 2830 Transit-only ASes present in the Internet Routing Table: 71 Average AS path length visible in the Internet Routing Table: 4.5 Max AS path length visible: 25 Prefixes from unregistered ASNs in the Routing Table: 102 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 12 Number of addresses announced to Internet: 1501408992 Equivalent to 89 /8s, 125 /16s and 174 /24s Percentage of available address space announced: 40.5 Percentage of allocated address space announced: 59.8 Percentage of available address space allocated: 67.8 Total number of prefixes smaller than registry allocations: 89337 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 38342 Total APNIC prefixes after maximum aggregation: 16265 Prefixes being announced from the APNIC address blocks: 36143 Unique aggregates announced from the APNIC address blocks: 17648 APNIC Region origin ASes present in the Internet Routing Table: 2481 APNIC Region origin ASes announcing only one prefix: 692 APNIC Region transit ASes present in the Internet Routing Table: 390 Average APNIC Region AS path length visible: 4.5 Max APNIC Region AS path length visible: 21 Number of APNIC addresses announced to Internet: 214731744 Equivalent to 12 /8s, 204 /16s and 139 /24s Percentage of available APNIC address space announced: 67.1 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911 APNIC Address Blocks 58/7, 60/7, 121/8, 122/7, 124/7, 126/8, 202/7 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 96046 Total ARIN prefixes after maximum aggregation: 56720 Prefixes being announced from the ARIN address blocks: 75330 Unique aggregates announced from the ARIN address blocks: 28575 ARIN Region origin ASes present in the Internet Routing Table: 10550 ARIN Region origin ASes announcing only one prefix: 3946 ARIN Region transit ASes present in the Internet Routing Table: 961 Average ARIN Region AS path length visible: 4.3 Max ARIN Region AS path length visible: 17 Number of ARIN addresses announced to Internet: 288791296 Equivalent to 17 /8s, 54 /16s and 155 /24s Percentage of available ARIN address space announced: 71.7 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863 ARIN Address Blocks 24/8, 63/8, 64/6, 68/7, 70/6, 74/7, 76/8, 198/7, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 36127 Total RIPE prefixes after maximum aggregation: 24294 Prefixes being announced from the RIPE address blocks: 33136 Unique aggregates announced from the RIPE address blocks: 22319 RIPE Region origin ASes present in the Internet Routing Table: 7697 RIPE Region origin ASes announcing only one prefix: 4026 RIPE Region transit ASes present in the Internet Routing Table: 1290 Average RIPE Region AS path length visible: 5.0 Max RIPE Region AS path length visible: 19 Number of RIPE addresses announced to Internet: 237818752 Equivalent to 14 /8s, 44 /16s and 211 /24s Percentage of available RIPE address space announced: 70.9 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 RIPE Address Blocks 62/8, 80/5, 88/6, 188/8, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 10258 Total LACNIC prefixes after maximum aggregation: 3505 Prefixes being announced from the LACNIC address blocks: 8410 Unique aggregates announced from the LACNIC address blocks: 5101 LACNIC Region origin ASes present in the Internet Routing Table: 677 LACNIC Region origin ASes announcing only one prefix: 222 LACNIC Region transit ASes present in the Internet Routing Table: 122 Average LACNIC Region AS path length visible: 5.1 Max LACNIC Region AS path length visible: 25 Number of LACNIC addresses announced to Internet: 25587712 Equivalent to 1 /8s, 134 /16s and 112 /24s Percentage of available LACNIC address space announced: 38.1 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 189/8, 190/8, 200/7 AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 1936 Total AfriNIC prefixes after maximum aggregation: 888 Prefixes being announced from the AfriNIC address blocks: 1305 Unique aggregates announced from the AfriNIC address blocks: 896 AfriNIC Region origin ASes present in the Internet Routing Table: 147 AfriNIC Region origin ASes announcing only one prefix: 41 AfriNIC Region transit ASes present in the Internet Routing Table: 24 Average AfriNIC Region AS path length visible: 4.4 Max AfriNIC Region AS path length visible: 14 Number of AfriNIC addresses announced to Internet: 3790848 Equivalent to 0 /8s, 57 /16s and 216 /24s Percentage of available AfriNIC address space announced: 11.3 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 988 6768 206 CHINANET-BACKBONE 9583 854 109 15 Sify Limited 4766 703 3927 300 Korea Telecom (KIX) 4755 669 256 62 Videsh Sanchar Nigam Ltd. Aut 1221 656 1428 471 Telstra Pty Ltd 9498 534 212 73 BHARTI BT INTERNET LTD. 7545 516 108 69 TPG Internet Pty Ltd 17488 514 31 7 Hathway IP Over Cable Interne 17676 482 6981 106 Softbank BB Corp. 9443 411 94 85 Primus Telecommunications 4802 368 75 159 Wantree Development 2907 340 1747 317 SINET Japan 9929 330 216 51 China Netcom Corp. 18101 329 68 23 Reliance Infocom Ltd Internet 17557 319 25 165 Pakistan Telecom 17974 318 76 36 PT TELEKOMUNIKASI INDONESIA 17849 298 19 119 Telecommunications Technology 7474 297 211 230 SingTel Optus Pty Ltd 4780 281 226 16 Digital United Inc. 9837 272 78 168 Powertel Ltd ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1466 6262 946 AT&T WorldNet Services 4323 1221 712 235 Time Warner Telecom 721 1023 21954 307 DLA Systems Automation Center 6197 997 626 459 BellSouth Network Solutions, 174 982 5787 928 Cogent Communications 701 958 8065 792 UUNET Technologies, Inc. 18566 912 272 8 Covad Communications 2386 901 506 674 AT&T Data Communications Serv 1239 848 2774 603 Sprint 19029 771 152 113 New Edge Networks 209 693 3608 541 Qwest 20115 667 584 359 Charter Communications 22773 636 1480 40 Cox Communications, Inc. 19262 635 1866 147 Verizon Global Networks 11492 624 84 14 Cable One 6198 583 471 241 BellSouth Network Solutions, 852 576 1088 383 Telus Advanced Communications 855 570 244 64 Canadian Research Network 19916 563 49 54 OLM LLC 7011 528 183 349 Citizens Utilities RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 583 1952 459 UUNET - Commercial IP service 3301 308 1071 293 TeliaNet Sweden 3352 304 1516 30 Ibernet, Internet Access Netw 3320 280 3477 234 Deutsche Telekom AG 8220 274 474 268 COLT Telecommunications 680 243 2025 240 DFN-IP service G-WiN 6746 230 89 201 Dynamic Network Technologies, 3246 229 487 219 Song Networks 8708 214 274 197 Romania Data Systems S.A. 8551 213 181 25 Bezeq International 1257 204 712 173 SWIPnet Swedish IP Network 3269 186 1925 70 TELECOM ITALIA 3215 177 1470 85 France Telecom Transpac 5515 177 839 124 Sonera Solution Autonomous Sy 786 173 1794 173 The JANET IP Service 8866 171 37 12 Bulgarian Telecommunication C 24863 169 38 9 LINKdotNET AS number 3300 166 171 94 AUCS Communications Services 5400 166 328 135 BT Ignite European Backbone 6830 166 765 35 UPC Distribution Services LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 576 1067 220 UniNet S.A. de C.V. 22047 383 142 10 VTR PUNTO NET S.A. 11172 312 111 81 Servicios Alestra S.A de C.V 16814 294 18 7 NSS, S.A. 14117 184 11 6 Telefonica del Sur S.A. 7303 160 75 20 Telecom Argentina Stet-France 6147 154 126 22 Telefonica Del Peru 11556 130 64 3 Cable-Wireless Panama 19169 123 8 30 Telconet 10481 121 48 8 Prima S.A. 6503 119 148 77 AVANTEL, S.A. 21826 116 15 19 INTERCABLE 5639 113 12 9 Telecommunications Services o 6505 108 88 80 Global One Communicaoes Ltda 23216 100 20 7 RAMtelecom Telecomunicaciones 18822 99 8 10 TELEFONICA MANQUEHUE 7315 96 6 3 Grupo Rey Moreno 14522 96 12 8 SatNet S.A. 25620 96 6 3 COTAS LTDA 11311 95 8 23 Sinectis S.A. AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 278 819 234 The Internet Solution 8452 164 60 7 TEDATA 2018 121 298 103 Tertiary Education Network 5536 121 8 18 Internet Egypt Network 6713 105 103 12 Itissalat Al-MAGHRIB 15475 103 84 4 Nile Online 2905 74 155 67 The Internetworking Company o 24835 62 50 7 RAYA Telecom - Egypt 20928 58 16 2 Noor Advanced Technologies AS 5713 39 294 35 Telkom SA Ltd 15706 31 8 3 Sudatel Internet Exchange Aut 33774 30 7 21 AS Number for Telecom Algeria 12455 27 6 3 Jambonet Autonomous system 23889 26 8 11 MAURITIUS TELECOM 8524 24 1 4 AUCEGYPT Autonomous System 16637 23 10 21 Johnnic e-Ventures 10798 22 1 13 Standard Bank of South Africa 8346 21 14 18 SONATEL-AS Autonomous System 2561 19 6 2 Egyptian Universities Network 21280 19 4 4 Swift Global Kenya Ltd.Is an Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 4323 1221 986 Time Warner Telecom 18566 912 904 Covad Communications 9583 854 839 Sify Limited 4134 988 782 CHINANET-BACKBONE 721 1023 716 DLA Systems Automation Center 19029 771 658 New Edge Networks 11492 624 610 Cable One 4755 669 607 Videsh Sanchar Nigam Ltd. Aut 22773 636 596 Cox Communications, Inc. 6197 997 538 BellSouth Network Solutions, 19916 563 509 OLM LLC 17488 514 507 Hathway IP Over Cable Interne 855 570 506 Canadian Research Network 5668 516 491 CenturyTel Internet Holdings, 19262 635 488 Verizon Global Networks 9498 534 461 BHARTI BT INTERNET LTD. 7545 516 447 TPG Internet Pty Ltd 7757 466 447 AT&T Broadband 3602 523 417 Sprint Canada, Inc. 812 438 410 Rogers WAVE List of Unregistered ASNs (Global) ---------------------------------- Bad AS Designation Network Transit AS Description 2000 UNALLOCATED 47.16.0.0/14 8153 Nortel 2000 UNALLOCATED 47.46.0.0/15 8153 Nortel 2000 UNALLOCATED 47.140.0.0/14 8153 Nortel 2000 UNALLOCATED 47.184.0.0/14 8153 Nortel 2000 UNALLOCATED 47.234.0.0/16 8153 Nortel 65211 PRIVATE 61.139.76.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 61.139.77.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 61.188.9.0/27 4134 CHINANET-BACKBONE 65211 PRIVATE 61.188.176.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 61.188.177.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 61.188.178.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 61.188.179.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.0.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.1.0/27 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.2.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.3.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.12.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.13.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.14.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.15.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.25.0/25 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.25.128/25 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.30.0/23 4134 CHINANET-BACKBONE 65211 PRIVATE 125.64.32.0/21 4134 CHINANET-BACKBONE 2000 UNALLOCATED 132.245.128.0/17 8153 Nortel 65005 PRIVATE 159.153.148.0/22 24989 IX Europe Frankfurt 65500 PRIVATE 160.254.3.0/24 11911 The Bank of New York 65500 PRIVATE 160.254.40.0/23 11911 The Bank of New York 65500 PRIVATE 160.254.42.0/23 11911 The Bank of New York 65500 PRIVATE 160.254.46.0/23 11911 The Bank of New York 65500 PRIVATE 160.254.48.0/23 11911 The Bank of New York 65500 PRIVATE 160.254.50.0/24 11911 The Bank of New York 65500 PRIVATE 160.254.69.0/24 11911 The Bank of New York 65500 PRIVATE 160.254.78.0/23 11911 The Bank of New York 65500 PRIVATE 160.254.90.0/24 11911 The Bank of New York 65500 PRIVATE 160.254.91.0/24 11911 The Bank of New York 65500 PRIVATE 160.254.92.0/23 11911 The Bank of New York 65500 PRIVATE 160.254.94.0/24 11911 The Bank of New York 65000 PRIVATE 160.254.131.0/24 11911 The Bank of New York 65000 PRIVATE 160.254.132.0/24 11911 The Bank of New York 65500 PRIVATE 160.254.135.0/24 11911 The Bank of New York 65000 PRIVATE 160.254.140.0/24 11911 The Bank of New York 65500 PRIVATE 160.254.154.0/24 11911 The Bank of New York 65500 PRIVATE 160.254.155.0/24 11911 The Bank of New York 65500 PRIVATE 160.254.200.0/24 11911 The Bank of New York 2000 UNALLOCATED 192.32.0.0/16 8153 Nortel 2000 UNALLOCATED 199.242.36.0/22 8153 Nortel 2000 UNALLOCATED 199.242.40.0/22 8153 Nortel 65211 PRIVATE 202.98.123.0/24 4134 CHINANET-BACKBONE 65505 PRIVATE 206.252.200.192/27 8002 Stealth Communicatio 65518 PRIVATE 211.144.192.0/19 24421 * 65211 PRIVATE 218.6.168.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.169.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.170.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.171.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.172.0/25 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.172.128/25 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.173.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.174.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.175.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.196.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.197.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.6.198.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.89.166.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.89.167.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.89.168.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.89.169.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.89.170.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.89.171.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 218.89.172.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.0.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.1.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.2.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.3.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.4.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.5.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.6.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.7.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.8.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.9.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.10.0/27 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.11.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.12.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.13.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.14.0/23 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.17.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.18.0/23 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.20.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.21.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.22.0/25 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.22.128/26 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.22.192/26 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.23.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.24.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.25.0/25 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.25.128/25 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.26.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.27.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.28.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 221.236.29.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 222.211.63.0/24 4134 CHINANET-BACKBONE 65211 PRIVATE 222.213.0.0/24 4134 CHINANET-BACKBONE Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 192.43.230.0/24 7575 Australian Academic and Rease 192.44.0.0/24 5501 Fraunhofer Gesellschaft 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.72.0.0/18 4780 Digital United Inc. 192.72.0.0/16 4780 Digital United Inc. 192.84.205.0/24 719 LANLINK autonomous system 192.119.135.0/24 270 NASA 192.172.0.0/19 721 DLA Systems Automation Center Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:18 /9:9 /10:8 /11:23 /12:87 /13:199 /14:352 /15:695 /16:8727 /17:3089 /18:5123 /19:11321 /20:12650 /21:10899 /22:13957 /23:15172 /24:99519 /25:360 /26:240 /27:208 /28:58 /29:25 /30:33 /31:0 /32:36 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 895 912 Covad Communications 6197 791 997 BellSouth Network Solutions, 7018 754 1466 AT&T WorldNet Services 19029 699 771 New Edge Networks 9583 674 854 Sify Limited 2386 626 901 AT&T Data Communications Serv 11492 615 624 Cable One 4323 589 1221 Time Warner Telecom 19916 557 563 OLM LLC 4766 507 703 Korea Telecom (KIX) 7011 452 528 Citizens Utilities 7757 448 466 AT&T Broadband 855 444 570 Canadian Research Network 6198 444 583 BellSouth Network Solutions, 5668 401 516 CenturyTel Internet Holdings, 1239 374 848 Sprint 702 368 583 UUNET - Commercial IP service 15270 349 379 PaeTec.net -a division of Pae 6517 342 371 Yipes Communications, Inc. 22773 332 636 Cox Communications, Inc. Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:3 8:43 12:1646 13:1 15:12 16:3 17:3 18:4 20:44 24:852 25:1 30:2 32:67 38:203 40:54 44:3 47:3 52:4 55:1 56:3 57:33 58:111 59:160 60:184 61:805 62:763 63:1894 64:3041 65:2211 66:3084 67:597 68:711 69:1494 70:304 71:61 72:619 73:25 74:8 80:745 81:582 82:511 83:372 84:349 85:455 86:331 87:185 88:30 89:36 124:126 125:257 128:147 129:174 130:107 131:314 132:33 133:7 134:146 135:47 136:169 137:64 138:191 139:69 140:482 141:134 142:415 143:145 144:226 145:39 146:307 147:134 148:334 149:184 150:112 151:76 152:61 153:102 154:6 155:185 156:93 157:123 158:159 159:178 160:100 161:70 162:221 163:144 164:173 165:185 166:147 167:237 168:469 169:139 170:323 171:12 172:1 190:30 192:5763 193:3382 194:2512 195:1793 196:772 198:3897 199:3270 200:4188 201:610 202:6451 203:6801 204:3887 205:2099 206:2423 207:2913 208:1996 209:3740 210:1976 211:825 212:1325 213:1473 214:335 215:41 216:4055 217:1171 218:257 219:149 220:641 221:369 222:155 End of report

1 0

USG posts RFI re: IANAI
by Martin Hannigan 24 Feb '06

24 Feb '06

This was interesting, operationally. I don't know why the USG does RFI's on stuff like IANA: http://www.fbo.gov/spg/DOC/OS/OAM/Reference-Number-DOCNTIARFI0001/SynopsisR… -M< -- Martin Hannigan (c) 617-388-2663 Renesys Corporation (w) 617-395-8574 Member of Technical Staff Network Operations hannigan(a)renesys.com

3 2

phishing reporting by AS
by Gadi Evron 24 Feb '06

24 Feb '06

Hi guys, as of today we expand our AS based reporting system to report phishing sites in real time. If you would like this in a mailbox different to what you already use to get our botnet C&C reports by, please let us know. Thanks, Gadi. -- http://blogs.securiteam.com/ "Out of the box is where I live". -- Cara "Starbuck" Thrace, Battlestar Galactica.

1 0