May 2006 - Test - lists.nanog.org

Re: Are botnets relevant to NANOG?
by Fergie 26 May '06

26 May '06

I think the numbers speak for themselves. - ferg -- Rick Wesson <wessorh(a)ar.com> wrote: > Some people need whatever bandwidth they can get for ranting. > Of course routing reports, virus reports and botnet bgp statistics > take away a lot of valuable bandwidth that could otherwise be used > for nagging. On the other hand without Gadi's howling for the > wolves those wolves might be lost species and without the wolves > all the nagging and ranting would make less fun. lets see, should we be concerned? here are a few interesting tables, the cnt column is new IP addresses we have seen in the last 5 days. The first table is Tier-2 ASNs as classified by Fontas's ASN Taxonomy paper [1] The second table is Universities. The ASN concerned are just in the announced by orgs in USA as to imply that they should be on NANOG. Let me say it again the counts are NEW observations in the last 5 days. also note I'm not Gati, and I've got much more data on everyones networks. -rick New compromised unique IP addresses (last 5 days) Tier-2 ASN +-------+------------------------------------+-------+ | asnum | asname | cnt | +-------+------------------------------------+-------+ | 19262 | Verizon Internet Services | 35790 | | 20115 | Charter Communications | 4453 | | 8584 | Barak AS | 3930 | | 5668 | CenturyTel Internet Holdings, Inc. | 2633 | | 12271 | Road Runner | 2485 | | 22291 | Charter Communications | 2039 | | 8113 | VRIS Verizon Internet Services | 1664 | | 6197 | BellSouth Network Solutions, Inc | 1634 | | 6198 | BellSouth Network Solutions, Inc | 1531 | | 9325 | XTRA-AS Telecom XTRA, Auckland | 1415 | | 11351 | Road Runner | 1415 | | 6140 | ImpSat | 1051 | | 7021 | Verizon Internet Services | 961 | | 6350 | Verizon Internet Services | 945 | | 19444 | CHARTER COMMUNICATIONS | 845 | +-------+------------------------------------+-------+ Universities, new unique ip last 5 days +-------+--------------------------------+-----+ | asnum | left(asname,30) | cnt | +-------+--------------------------------+-----+ | 14 | Columbia University | 93 | | 3 | MIT-2 Massachusetts Institute | 45 | | 73 | University of Washington | 25 | | 7925 | West Virginia Network for Educ | 24 | | 4385 | RIT-3 Rochester Institute of T | 20 | | 23369 | SCOE-5 Sonoma County Office of | 19 | | 5078 | Oklahoma Network for Education | 18 | | 3388 | UNM University of New Mexico | 18 | | 55 | University of Pennsylvania | 13 | | 159 | The Ohio State University | 12 | | 104 | University of Colorado at Boul | 12 | | 4265 | CERFN California Education and | 11 | | 693 | University of Notre Dame | 10 | | 2900 | Arizona Tri University Network | 9 | | 2637 | Georgia Institute of Technolog | 9 | +-------+--------------------------------+-----+ [1] http://www.ece.gatech.edu/research/labs/MANIACS/as_taxonomy/ -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

AS12874 - FASTWEB
by Mikisa Richard 26 May '06

26 May '06

Anyone from FASTWEB please get back to me offline. -- Richard

6 5

BGP Update Report
by cidr-report＠potaroo.net 26 May '06

26 May '06

BGP Update Report Interval: 16-May-06 -to- 16-May-06 (0 days) Observation Point: BGP Peering with AS4637 TOP 20 Unstable Origin AS Rank ASN Upds % Upds/Pfx AS-Name 1 - AS855 25437 2.4% 44.7 -- CANET-ASN-4 - Aliant Telecom 2 - AS17430 21625 2.1% 655.3 -- GWBN-CHENGDU Great Wall Broadband Network Service Co.,Ltd 3 - AS9121 21139 2.0% 35.3 -- TTNET TTnet Autonomous System 4 - AS10139 10601 1.0% 76.3 -- MERIDIAN-PH-AP Meridian Telekoms 5 - AS11492 9701 0.9% 18.3 -- CABLEONE - CABLE ONE 6 - AS17974 9449 0.9% 27.2 -- TELKOMNET-AS2-AP PT TELEKOMUNIKASI INDONESIA 7 - AS9940 9425 0.9% 162.5 -- WOLCST-AS-AP World online AS, Cybersoft Technologies. 8 - AS2386 9108 0.9% 10.3 -- INS-AS - AT&T Data Communications Services 9 - AS15611 8893 0.8% 109.8 -- Iranian Research Organisation 10 - AS3475 8816 0.8% 629.7 -- LANT-AFLOAT - NCTAMS LANT DET HAMPTON ROADS 11 - AS4795 8760 0.8% 41.7 -- INDOSAT2-ID INDOSATNET-ASN 12 - AS17557 7661 0.7% 20.0 -- PKTELECOM-AS-AP Pakistan Telecom 13 - AS33766 7521 0.7% 358.1 -- NYALA-COMMUNICATIONS-PTY-LTD NYALA-COMMUNICATIONS-PTY-LTD 14 - AS5803 7007 0.7% 92.2 -- DDN-ASNBLK - DoD Network Information Center 15 - AS9425 6883 0.7% 112.8 -- CONCENTRIX-PH-AS-AP Concentrix Technologies, Inc 16 - AS7018 6760 0.7% 9.7 -- ATT-INTERNET4 - AT&T WorldNet Services 17 - AS702 6650 0.6% 27.1 -- AS702 MCI EMEA - Commercial IP service provider in Europe 18 - AS680 6438 0.6% 26.5 -- DFN-IP service G-WiN 19 - AS23918 6304 0.6% 49.6 -- CBB-BGP-IBARAKI Connexion By Boeing Ibaraki AS 20 - AS25233 5904 0.6% 79.8 -- AWALNET-ASN Autonomus System number for Awalnet TOP 20 Unstable Origin AS (Updates per announced prefix) Rank ASN Upds % Upds/Pfx AS-Name 1 - AS21027 3127 0.3% 3127.0 -- ASN-PARADORES PARADORES Autonomous System 2 - AS3043 2607 0.2% 2607.0 -- AMPHIB-AS - Amphibian Media Corporation 3 - AS19982 4923 0.5% 1230.8 -- TOWERSTREAM-PROV - Towerstream 4 - AS36877 2444 0.2% 1222.0 -- 5 - AS14410 5565 0.5% 1113.0 -- DALTON - MCM, Inc., DBA: Internet@Dalton 6 - AS34382 916 0.1% 916.0 -- ASSYRUS-SRL-AS Assyrus Srl Maintainer 7 - AS16705 1704 0.2% 852.0 -- STORAGEAPPS - Storage Apps Inc. 8 - AS22988 840 0.1% 840.0 -- CAMBARASN1 - Cameron and Barkley Company 9 - AS34378 836 0.1% 836.0 -- RUG-AS Razguliay-UKRROS Group 10 - AS36000 786 0.1% 786.0 -- NHA-ASN1 - Northern Health Authority 11 - AS23607 1973 0.2% 657.7 -- ITXPRESS-AS-AP itXpress Pty Ltd. Network AS ISP and DSL 12 - AS17430 21625 2.1% 655.3 -- GWBN-CHENGDU Great Wall Broadband Network Service Co.,Ltd 13 - AS35339 655 0.1% 655.0 -- CZ-AS Clemens Zauner 14 - AS3475 8816 0.8% 629.7 -- LANT-AFLOAT - NCTAMS LANT DET HAMPTON ROADS 15 - AS3319 3038 0.3% 607.6 -- KSNET KSNet 16 - AS33871 5823 0.6% 582.3 -- NORILSK-TELECOM-AS Norilsk-Telecom Ltd. 17 - AS7442 577 0.1% 577.0 -- FEDERATED-CA-ASN - Federated Insurance Company of Canada 18 - AS21944 1723 0.2% 574.3 -- DTSI-1 - Data Technology Services Inc. 19 - AS36715 571 0.1% 571.0 -- GSA-ASN - GLOBAL SECURITIES ADVISORS LLC 20 - AS18173 556 0.1% 556.0 -- AKU-AS-PK Aga Khan University TOP 20 Unstable Prefixes Rank Prefix Upds % Origin AS -- AS Name 1 - 211.162.88.0/21 5405 0.4% AS17430 -- GWBN-CHENGDU Great Wall Broadband Network Service Co.,Ltd 2 - 220.114.32.0/21 5395 0.4% AS17430 -- GWBN-CHENGDU Great Wall Broadband Network Service Co.,Ltd 3 - 81.212.141.0/24 3980 0.3% AS9121 -- TTNET TTnet Autonomous System 4 - 81.212.149.0/24 3848 0.3% AS9121 -- TTNET TTnet Autonomous System 5 - 152.74.0.0/16 3730 0.3% AS11340 -- Red Universitaria Nacional 6 - 220.114.40.0/22 3311 0.3% AS17430 -- GWBN-CHENGDU Great Wall Broadband Network Service Co.,Ltd 7 - 211.162.82.0/23 3309 0.3% AS17430 -- GWBN-CHENGDU Great Wall Broadband Network Service Co.,Ltd 8 - 211.162.84.0/22 3309 0.3% AS17430 -- GWBN-CHENGDU Great Wall Broadband Network Service Co.,Ltd 9 - 62.81.240.0/24 3127 0.2% AS21027 -- ASN-PARADORES PARADORES Autonomous System 10 - 61.0.0.0/8 2993 0.2% AS4678 -- FINE CANON NETWORK COMMUNICATIONS INC. 11 - 209.140.24.0/24 2607 0.2% AS3043 -- AMPHIB-AS - Amphibian Media Corporation 12 - 195.175.82.0/23 2333 0.2% AS9121 -- TTNET TTnet Autonomous System 13 - 209.160.56.0/22 1866 0.1% AS14361 -- HOPONE-DCA - HopOne Internet Corporation 14 - 61.8.114.0/24 1746 0.1% AS9476 -- INTRAPOWER-AS-AP Intrapower 15 - 81.212.197.0/24 1434 0.1% AS9121 -- TTNET TTnet Autonomous System 16 - 212.85.221.0/24 1251 0.1% AS30306 -- AFOL-SZ-AS Africa Online Swaziland 17 - 196.47.64.0/22 1243 0.1% AS36877 -- 18 - 64.17.232.0/21 1234 0.1% AS19982 -- TOWERSTREAM-PROV - Towerstream 19 - 64.17.240.0/21 1234 0.1% AS19982 -- TOWERSTREAM-PROV - Towerstream 20 - 64.17.224.0/21 1230 0.1% AS19982 -- TOWERSTREAM-PROV - Towerstream Details at http://bgpupdates.potaroo.net ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org ausnog(a)ausnog.net

1 0

The Cidr Report
by cidr-report＠potaroo.net 26 May '06

26 May '06

This report has been generated at Fri May 26 21:54:13 2006 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 19-05-06 184902 121903 20-05-06 185014 121753 21-05-06 184990 121700 22-05-06 184924 122087 23-05-06 185186 122046 24-05-06 185090 122143 25-05-06 185297 122155 26-05-06 185408 122244 AS Summary 22226 Number of ASes in routing system 9303 Number of ASes announcing only one prefix 1482 Largest number of prefixes announced by an AS AS7018 : ATT-INTERNET4 - AT&T WorldNet Services 91495424 Largest address span announced by an AS (/32s) AS721 : DLA-ASNBLOCK-AS - DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 26May06 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 185562 122279 63283 34.1% All ASes AS4323 1290 261 1029 79.8% TWTC - Time Warner Telecom, Inc. AS4134 1181 283 898 76.0% CHINANET-BACKBONE No.31,Jin-rong Street AS18566 940 158 782 83.2% COVAD - Covad Communications Co. AS721 1001 311 690 68.9% DLA-ASNBLOCK-AS - DoD Network Information Center AS22773 656 47 609 92.8% CCINET-2 - Cox Communications Inc. AS4755 857 319 538 62.8% VSNL-AS Videsh Sanchar Nigam Ltd. Autonomous System AS7018 1482 961 521 35.2% ATT-INTERNET4 - AT&T WorldNet Services AS6197 1005 486 519 51.6% BATI-ATL - BellSouth Network Solutions, Inc AS19916 563 65 498 88.5% ASTRUM-0001 - OLM LLC AS855 553 64 489 88.4% CANET-ASN-4 - Aliant Telecom AS17488 513 47 466 90.8% HATHWAY-NET-AP Hathway IP Over Cable Internet AS3602 539 110 429 79.6% AS3602-RTI - Rogers Telecom Inc. AS9498 566 149 417 73.7% BBIL-AP BHARTI BT INTERNET LTD. AS18101 411 28 383 93.2% RIL-IDC Reliance Infocom Ltd Internet Data Centre, AS15270 426 50 376 88.3% AS-PAETEC-NET - PaeTec.net -a division of PaeTecCommunications, Inc. AS17676 486 110 376 77.4% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS4766 655 307 348 53.1% KIXS-AS-KR Korea Telecom AS11492 611 269 342 56.0% CABLEONE - CABLE ONE AS22047 417 76 341 81.8% VTR BANDA ANCHA S.A. AS812 368 29 339 92.1% ROGERS-CABLE - Rogers Cable Inc. AS6467 385 52 333 86.5% ESPIRECOMM - Xspedius Communications Co. AS19262 660 355 305 46.2% VZGNI-TRANSIT - Verizon Internet Services Inc. AS16852 355 51 304 85.6% FOCAL-CHICAGO - Focal Data Communications of Illinois AS8151 705 406 299 42.4% Uninet S.A. de C.V. AS6167 343 64 279 81.3% CELLCO-PART - Cellco Partnership AS3352 308 30 278 90.3% TELEFONICA-DATA-ESPANA Internet Access Network of TDE AS14654 291 15 276 94.8% WAYPORT - Wayport AS5668 529 254 275 52.0% AS-5668 - CenturyTel Internet Holdings, Inc. AS16814 330 59 271 82.1% NSS S.A. AS6198 509 242 267 52.5% BATI-MIA - BellSouth Network Solutions, Inc Total 18935 5658 13277 70.1% Top 30 total Possible Bogus Routes 24.246.0.0/17 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 24.246.128.0/18 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 61.4.64.0/20 AS9929 CNCNET-CN China Netcom Corp. 64.17.32.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.33.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 64.17.37.0/24 AS13488 CBWU-13488 - Continental Broadband Florida, Inc DBA WebUnited 66.11.32.0/20 AS6261 VISINET - Visionary Systems, Inc. 66.37.96.0/20 AS3764 IA-HOU-AS - Internet America, Inc. 66.51.134.0/24 AS29876 LNTC - Latency LLC 66.96.0.0/20 AS3770 WORLDPATH-AS - WorldPath Internet Services 66.117.8.0/24 AS174 COGENT Cogent/PSI 66.163.96.0/20 AS25767 WAVEFORM - Waveform Technology, LLC 66.187.96.0/24 AS10026 ANC Asia Netcom Corporation 66.187.108.0/24 AS10026 ANC Asia Netcom Corporation 66.187.109.0/24 AS10026 ANC Asia Netcom Corporation 66.235.158.0/23 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 69.31.151.0/24 AS26627 AS-PILOSOFT - Pilosoft, Inc. 69.39.193.0/24 AS25973 MZIMA - Mzima Networks, Inc. 69.39.195.0/24 AS25973 MZIMA - Mzima Networks, Inc. 69.39.196.0/24 AS25973 MZIMA - Mzima Networks, Inc. 91.192.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 91.255.248.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS Project. 125.213.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 131.64.0.0/12 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 132.0.0.0/10 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 137.0.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 138.136.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 151.135.0.0/16 AS4763 TELSTRANZ-AS TelstraClear Ltd 158.0.0.0/13 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 163.142.0.0/16 AS2500 JPNIC-ASBLOCK-AP JPNIC 183.206.196.0/24 AS2188 FR-RENATER-ASTER Reseau Regional ASTER 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.40.105.0/24 AS12582 TSF-DATANET-NGD-AS TSF MPLS VPN Services 192.69.107.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.69.108.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.69.177.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.70.164.0/24 AS25689 NRCNET-AS - National Research Council of Canada 192.81.183.0/24 AS719 ELISA-AS Elisa Oyj 192.81.184.0/24 AS719 ELISA-AS Elisa Oyj 192.88.99.0/24 AS16150 PORT80-GLOBALTRANSIT Port80 AB, Sweden 192.96.36.0/24 AS5713 AFRINIC African Network Information Center 192.96.37.0/24 AS10474 AFRINIC African Network Information Center 192.96.135.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.136.0/23 AS2018 TENET - 1 - The Uninet Project 192.96.140.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.143.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.145.0/24 AS2018 TENET - 1 - The Uninet Project 192.96.177.0/24 AS6083 POSIX-AFRICA Posix Systems 192.96.250.0/24 AS2018 TENET - 1 - The Uninet Project 192.107.104.0/24 AS6458 GUATEL 192.122.212.0/24 AS209 ASN-QWEST - Qwest 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS10282 EQUANT-CEEUR EQUANT AS for Central and Eastern Europe region 192.153.144.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 192.168.255.255/32 AS4637 REACH Reach Network Border AS 192.172.0.0/19 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 192.188.208.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 193.36.1.0/24 AS8220 COLT COLT Telecommunications 193.37.69.0/24 AS2856 BT-UK-AS BTnet UK Regional network 193.110.77.0/24 AS3356 LEVEL3 Level 3 Communications 193.110.78.0/24 AS3356 LEVEL3 Level 3 Communications 193.110.79.0/24 AS3356 LEVEL3 Level 3 Communications 194.31.227.0/24 AS21461 TRANSFAIRNET Transfair-net GmbH Krefeld 194.59.176.0/20 AS1273 CW Cable & Wireless 194.153.156.0/24 AS24865 KMITCHELL-AS Keith Mitchell's Network 194.156.206.0/24 AS4589 EASYNET Easynet Group Plc 194.246.72.0/23 AS8893 ARTFILES-AS Artfiles New Media GmbH 195.246.216.0/22 AS15622 MEOCOM old meocom Autonomous System 198.23.26.0/24 AS4390 BELLATLANTIC-COM - Bell Atlantic, Inc. 198.54.82.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.92.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.222.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.249.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.250.0/24 AS2018 TENET - 1 - The Uninet Project 198.54.251.0/24 AS2018 TENET - 1 - The Uninet Project 198.97.72.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.80.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.96.0/19 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.97.240.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.101.4.0/22 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 198.136.32.0/20 AS19329 MCNET - Martin County Board of County Commissioners 198.161.87.0/24 AS6539 GT-BELL - Bell Canada 198.163.155.0/24 AS684 MTSAL-ASN - MTS Allstream Inc. 198.167.0.0/16 AS7456 INTERHOP - Interhop Network SERVICES Inc. 198.168.0.0/16 AS701 ALTERNET-AS - UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASKTEL - SaskTel 198.199.198.0/24 AS13671 VRIS-AS-BLOCK-13661-13675 - Verizon Internet Services Inc. 198.232.133.0/24 AS23075 SKOTOS-AS - Skotos Tech, Inc 199.9.128.0/17 AS668 ASN-ASNET-NET-AS - Defense Research and Engineering Network 199.10.0.0/16 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.60.0.0/20 AS271 BCNET-AS - University of British Columbia 199.114.0.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.128.0/18 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.130.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.132.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.134.0/24 AS3541 ITSDN-U4 - DISA/UNRRA 199.114.136.0/24 AS27044 DDN-ASNBLK1 - DoD Network Information Center 199.114.138.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.140.0/24 AS3544 ITSDN-U7 - DISA/UNRRA 199.114.142.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.144.0/24 AS27064 DDN-ASNBLK1 - DoD Network Information Center 199.114.148.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.150.0/24 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.114.152.0/24 AS27033 DDN-ASNBLK1 - DoD Network Information Center 199.114.153.0/24 AS27034 DDN-ASNBLK1 - DoD Network Information Center 199.114.154.0/24 AS3542 ITSDN-U5 - DISA/UNRRA 199.114.160.0/24 AS1733 CENTAF-SWA - AF DDN PMO 199.121.0.0/16 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.0.0/18 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.16.0/20 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.123.80.0/21 AS721 DLA-ASNBLOCK-AS - DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST-AS - IQuest Internet 199.202.0.0/16 AS701 ALTERNET-AS - UUNET Technologies, Inc. 199.246.116.0/24 AS813 UUNET-AS1 - UUNET Technologies, Inc. 202.9.64.0/19 AS9290 TPN-AS-AP Smart Global Network (M) Sdn Bhd 202.45.159.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.58.113.0/24 AS19161 INNOCOM-TELECOM - INNOCOM TELECOM 202.86.252.0/22 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.253.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.254.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.86.255.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications 202.90.33.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.40.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.41.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.42.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.43.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.90.44.0/24 AS9830 SWIFTONLINE-AS-AP SWIFT ONLINE BORDER AS 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.124.192.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.193.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.194.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.195.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.196.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.197.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.198.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.199.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.124.200.0/22 AS15412 FLAG-AS Flag Telecom Global Internet AS 202.124.204.0/24 AS15412 FLAG-AS Flag Telecom Global Internet AS 202.124.205.0/24 AS15412 FLAG-AS Flag Telecom Global Internet AS 202.124.206.0/24 AS15412 FLAG-AS Flag Telecom Global Internet AS 202.124.207.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 202.131.64.0/19 AS9381 NEWTT-IP-AP Wharf T&T Ltd. 202.148.32.0/20 AS17495 GATEWAY-AP BROADBAND WIRELESSS INTERNET SERVICE PROVIDER 202.164.100.0/24 AS18101 RIL-IDC Reliance Infocom Ltd Internet Data Centre, 203.13.171.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 203.62.0.0/17 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet) 203.78.48.0/20 AS9299 IPG-AS-AP Philippine Long Distance Telephone Company 203.89.134.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.139.0/24 AS17911 BRAINPK-AS-AP Brain Telecommunication Ltd. 203.89.143.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.144.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.147.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.148.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.149.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.150.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.151.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.153.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.158.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.89.159.0/24 AS17557 PKTELECOM-AS-AP Pakistan Telecom 203.99.142.0/24 AS9826 ILINK-HK-AP iLink.net Ltd 203.111.192.0/20 AS7473 SINGTEL-AS-AP Singapore Telecom 204.29.185.0/24 AS7268 ATHENET - Athenet Internet Services 204.48.118.0/23 AS29912 CITIZENS-PROPERTY-INSURANCE-CORPORATION - Citizens Property Insurance Corporation 204.48.119.0/24 AS29912 CITIZENS-PROPERTY-INSURANCE-CORPORATION - Citizens Property Insurance Corporation 204.154.125.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLABS-ASN - TELLABS Operations, Inc. 205.150.0.0/15 AS701 ALTERNET-AS - UUNET Technologies, Inc. 206.128.104.0/21 AS11709 VIC - VIRTUAL INTERACTIVE CENTER 206.167.57.0/24 AS376 RISQ-AS - Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 206.191.96.0/19 AS15290 ALLST-15290 - Allstream Corp. Corporation Allstream 207.231.96.0/19 AS11194 NUNETPA - NuNet Inc 208.111.0.0/16 AS4788 TMNET-AS-AP TM Net, Internet Service Provider 208.111.0.0/17 AS4788 TMNET-AS-AP TM Net, Internet Service Provider 208.111.0.0/18 AS4788 TMNET-AS-AP TM Net, Internet Service Provider 208.111.64.0/18 AS4788 TMNET-AS-AP TM Net, Internet Service Provider 208.111.128.0/17 AS4788 TMNET-AS-AP TM Net, Internet Service Provider 208.111.128.0/18 AS4788 TMNET-AS-AP TM Net, Internet Service Provider 208.111.192.0/18 AS4788 TMNET-AS-AP TM Net, Internet Service Provider 209.40.192.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.200.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.208.0/21 AS6487 CyberNet de Guatemala S.A. 209.40.216.0/21 AS6487 CyberNet de Guatemala S.A. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.234.0.0/18 AS3845 STATE-NET - CS&W, Inc. 216.37.110.0/23 AS4264 CERNET-ASN-BLOCK - California Education and Research Federation Network 216.71.224.0/20 AS23527 COTELLIGENCE - Cotelligence, Inc. 216.201.72.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.73.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.74.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.75.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.76.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.77.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.78.0/24 AS14709 Telefonica Moviles Panama S.A. 216.201.79.0/24 AS14709 Telefonica Moviles Panama S.A. 216.228.64.0/21 AS6295 WHIDBEY1 - Whidbey Internet Services 216.228.224.0/20 AS13674 VRIS-AS-BLOCK-13661-13675 - Verizon Internet Services Inc. 216.240.240.0/20 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 216.240.242.0/24 AS7018 ATT-INTERNET4 - AT&T WorldNet Services 222.240.0.0/13 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 222.240.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 222.241.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 222.242.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 222.243.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 222.244.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 222.245.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 222.246.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 222.247.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 222.248.0.0/16 AS17962 TOPWAY-NET ShenZhen Topway Video Communication Co. Ltd 222.248.192.0/18 AS17962 TOPWAY-NET ShenZhen Topway Video Communication Co. Ltd 222.249.0.0/16 AS9806 BJENET Beijing Educational Information Network Service Center Co., Ltd 222.250.0.0/16 AS9415 ETWEBS-AS1-AP ETWebs Taiwan Co. Ltd. 222.250.0.0/18 AS9415 ETWEBS-AS1-AP ETWebs Taiwan Co. Ltd. 222.250.64.0/18 AS9415 ETWEBS-AS1-AP ETWebs Taiwan Co. Ltd. 222.250.128.0/18 AS9415 ETWEBS-AS1-AP ETWebs Taiwan Co. Ltd. 222.250.192.0/18 AS9415 ETWEBS-AS1-AP ETWebs Taiwan Co. Ltd. 222.251.0.0/17 AS9415 ETWEBS-AS1-AP ETWebs Taiwan Co. Ltd. 222.251.0.0/18 AS9415 ETWEBS-AS1-AP ETWebs Taiwan Co. Ltd. 222.251.64.0/18 AS9415 ETWEBS-AS1-AP ETWebs Taiwan Co. Ltd. 222.251.128.0/17 AS23563 VITSSEN-SUWON-AS-KR Korea Cable Television Suwon Broadcating Corporati 222.251.160.0/19 AS23563 VITSSEN-SUWON-AS-KR Korea Cable Television Suwon Broadcating Corporati 222.251.224.0/19 AS23563 VITSSEN-SUWON-AS-KR Korea Cable Television Suwon Broadcating Corporati 222.252.0.0/19 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 222.252.32.0/19 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 222.252.64.0/19 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 222.252.96.0/19 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 222.252.128.0/19 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 222.252.160.0/19 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 222.252.192.0/19 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 222.252.224.0/19 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 222.253.0.0/19 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 222.253.32.0/19 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 222.253.64.0/19 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 222.253.96.0/19 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 222.253.128.0/19 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 222.253.160.0/19 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 222.253.192.0/19 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 222.253.224.0/19 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 222.255.0.0/19 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 222.255.32.0/19 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 222.255.64.0/19 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 222.255.96.0/19 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 222.255.128.0/19 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 222.255.160.0/19 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 222.255.192.0/19 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) 222.255.224.0/19 AS7643 VNN-AS-AP Vietnam Posts and Telecommunications (VNPT) Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org ausnog(a)ausnog.net

1 0

Switch and Data Vienna
by Rodney Joffe 25 May '06

25 May '06

I assume we're not the only ones to notice that Switch And Data in Vienna is dark? Anyone know more than that, specifically related to ETR?

1 0

pre-nanog dns-operations workshop
by brett watson 25 May '06

25 May '06

If anyone is interested in attending a 1-day pre-nanog (June 2) workshop for dns-operations, details can be found at the URL below. http://public.oarci.net/dns-operations/workshop-2006 -b

1 0

Re: Black Frog - the botnets keep coming
by Scott Weeks 25 May '06

25 May '06

----- Original Message Follows ----- From: Henry Linneweh <hrlinneweh(a)sbcglobal.net> > Personally as a manager I want to know the problem and > then the workable solution. I just don't see that many > bot nets happening anymore. You aren't looking close enough. Go to any university network, run NTop at the top of the network or Nessus scans and you'll find the drones communicating in surprising numbers. All you have to do is proactively look for them and you'll find them... scott

1 0

bgp question
by adrian kok 25 May '06

25 May '06

Hi all Thank you all for your answer to my previous question 'RFC1918 from ISP' I have another BGP question, and may be related to BGP dampening. We have a client whose IP is in the block X.X.0.0/19 which doesn't show in our router. However, our BGP log records that we have received this route from our peer isp. I reboot the router, seeing that the route was in our router only to disappear again after couple of minutes. I suspect that it may have been removed by the BGP dampening feature in our router. By disabling the feature, the route will stay in our router. Q1/ My only understanding of the benefit of this feature is to prevent 'unstable' route from flooding to our router, causing a CPU overflow. What's the risk of leaving this off? Q2/ What is the cause of these route that frequently send to our router as stated below? Once our other routes are in our BGP DB, then it will not be re-broadcast to us except withdraw from our peer isp > 2006/05/26 08:30:34 BGP: our-peer-isp rcvd x.x.0.0/19 > 2006/05/26 08:33:42 BGP: our-peer-isp rcvd x.x.0.0/19 > 2006/05/26 08:36:46 BGP: our-peer-isp rcvd x.x.0.0/19 > 2006/05/26 08:39:49 BGP: our-peer-isp rcvd x.x.0.0/19 > 2006/05/26 08:45:25 BGP: our-peer-isp rcvd x.x.0.0/19 > 2006/05/26 08:48:00 BGP: our-peer-isp rcvd x.x.0.0/19 > 2006/05/26 08:49:02 BGP: our-peer-isp rcvd x.x.0.0/19 > 2006/05/26 08:51:34 BGP: our-peer-isp rcvd x.x.0.0/19 > 2006/05/26 08:52:36 BGP: our-peer-isp rcvd x.x.0.0/19 Q3/ Do you know any good website to montior the routing network? I just heard this scoreboard.keynote.com from http://isc.sans.org/diary.php but it needs register Thank you very much

2 1

Re: private ip addresses from ISP
by Robert Bonomi 24 May '06

24 May '06

> Date: Tue, 23 May 2006 09:36:30 -0400 > To: nanog(a)nanog.org > From: Daniel Senie <dts(a)senie.com> > Subject: Re: private ip addresses from ISP > > > At 09:22 AM 5/23/2006, Robert Bonomi wrote: > > > > Date: Tue, 23 May 2006 03:33:34 -0400 > > > From: Richard A Steenbergen <ras(a)e-gerbil.net> > > > To: nanog(a)nanog.org > > > Subject: Re: private ip addresses from ISP > > > > > > > > > On Mon, May 22, 2006 at 04:30:37PM -0400, Andrew Kirch wrote: > > > > > > > > > 3) You are seeing packets with source IPs inside private space > > > > > arriving at > > > > > your interface from your ISP? > > > ... > > > > Sorry to dig this up from last week but I have to strongly disagree with > > > > point #3. > > > > >From RFC 1918 > > > > Because private addresses have no global meaning, routing information > > > > about private networks shall not be propagated on inter-enterprise > > > > links, and packets with private source or destination addresses > > > > should not be forwarded across such links. Routers in networks not > > > > using private address space, especially those of Internet service > > > > providers, are expected to be configured to reject (filter out) > > > > routing information about private networks. > > > > > > > > The ISP shouldn't be "leaving" anything to the end-user, these packets > > > > should be dropped as a matter of course, along with any routing > > > > advertisements for RFC 1918 space(From #1). ISP's who leak 1918 space > > > > into my network piss me off, and get irate phone calls for their > > > > trouble. > > > > > > The section you quoted from RFC1918 specifically addresses routes, not > > > packets. > > > >I quote, from the material cited above: > > " ..., and packets with private source or destination addresses > > should not be forwarded across such links. ... " > > > >There are some types of packets that can legitimately have RFC1918 source > >addresses -- 'TTL exceeded' for example -- that one should legitimately > >allow across network boundaries. > > Really? You really want TTL-E messages with RFC1918 source addr? Even > if they're used as part of a denial of service attack? Even though > you can't tell where they actually came from? "Can be" is not sufficient (in and of itself, that is) reason to block. _Anything_ "can be" used as part of a DOS attack. TTL-E messages _do_ have legitimate function in network management. TTL-E messages _can_ originate from RFC1918 space, addressed to 'public internet' addresses. Usefully, and meaningfully. Ever hear of 'traceroute'? Ever use it where packets went across a network using RFC1918 internally? Ever had a route die _between_ two RFC1918 addressed nodes on somebody elses network? If you don't like that example, substitute "host/network unreachable", or 'ICMP redirect'. Or packet-size limit exceeded for a 'DNF' packet. If you don't get those messages back, you can't communicate. > > > If you're receiving RFC1918 *routes* from anyone, you need to > > > thwack them over the head with a cluebat a couple of times until the cluey > > > filling oozes out. If you're receiving RFC1918 sourced packets, for the > > > most part you really shouldn't care. > > > >*I* care. > > > >When those packets contain 'malicious' content, for example. > > > >When the provider =cannot= tell me which of _their_own_customers_ originated > >that attack, for example. (This provider has inbound source-filtering on > >their Internet 'gateway' routers, but *not* on their customer-facing > >equipment > >(either inbound or outbound.) > > So you really don't want ANY packets with RFC 1918 source addresses > then, not even ICMP TTL-E messages, since they could be used in a > malicious fashion, and you would not be able to determine the true origin. You need to learn to read. I said "malicious content", not 'used in a malicious fashion'. Packets that could have legitimate meaning should be passed on. Packets that _cannot_ have legitimate meaning should not be. > >It's even more comical when the NSP uses RFC1918 space internally, and does > >*not* filter those source addresses from their customers. > > You mean like Comcast using Cisco routers in their head-ends and > having the 10/8 address show up in traceroutes and so forth? not at all. You're either ignorant of network architecture, or trying to pick fights. I was talking about a situation where a customer machine of a network that uses RFC1918 addresses internally starts sending malicious packets with a RFC1918 source address that _matches_ that of one of the *in*use* addresses on the service-provider network. AND the service-provider does not do ingress (from the customer) or egress (to the customer) filtering of RFC1918 address-space. Customer A's machine starts attacking Customer B, C, D, E, F ...; those ill-informed customers don't null-route outbound RFC1918 addresses; you get an 'inadvertent' smurf attack on the NSP resource. It's comical, because the ISP's 'bad practice' facilitated the attack on the ISP. "Traceroute", by the way, *is* one of those 'legitimate' cases for which RFC1918 source-address packets should be allowed across network boundaries. Proper "good net neighbor" egress filtering of RFC1918 source addresses takes a number of separate rules. Several 'allows', followed by a default 'deny'. > Not sure > to what degree it's the NSP's fault vs. the router vendors', but yes. Can't imagine why you think it might be the fault of the router vendor. Can't imagine why think it is somebody's "fault". > > > There are semi-legitimate reasons for > > > packets with those sources addresses to float around the Internet, and > > > they don't hurt anything. > > > >I guess you don't mind paying for transit of packets that _cannot_possibly_ > >have any legitimate purpose on your network. > > Along with this goes the usual flamewar over RFC 2827, ingress > filtering (of which URPF is a subset implementation). If everybody did _egress_ filtering of 'cannot possibly be legitimate' traffic, ingress filtering of that traffic would not be necessary. Unfortunately, not everybody does, so ingress filtering _is_ necessary. 'ingress' filtering is self-defense. 'egress' filtering is about 'being a good net neighbor'. > >Some of us, on the other hand, _do_ object. > > And some of us pay for bandwidth, care about getting congestion > problems from useless traffic, etc. Perhaps it makes the case a lot > clearer for selling "better than equal" service to the highest bidder > if your network is overrun with undesired traffic. > >

9 13

ISP compliance < LEAs - tech and logistics [was: snfc21 sniffer docs]
by Gadi Evron 24 May '06

24 May '06

> Wired posted what are suppossedly the docs Mark Klein wrote 'bout the > NSA sniffing project. Interesting read... > > http://blog.wired.com/27BStroke6/att_klein_wired.pdf > > John Indeed. To be honest, I am more interested in NANOG-related operational issues involved, which I am not sure many here will be able to discuss in case they had experience on the subject. So let us put privacy and legal issues aside for the purpose of this discussion. How does a service provider handle the requirement to meet a law enforcement agency with their wiretapping needs? The logistics and technology can be exerting, annoying and business-wise, even prohibiting. As I just mentioned somewhere else, I should probably point out that if I was a major ISP often asked to answer the call of law enforcement with legal wiretaps, this could be very annoying as well as technologically a killer to my network architecture. Just sticking some hub somewhere in my network may not cut it, and will certainly not cover all of the communication. What about different lines and locations? As a large provider, AT&T probably had to find better solutions to the call of the law, or reply on the law's technology to not kill their business. This indeed happened before. As some of you may remember, according to one NANOGer at the FBI's Carnivore presentation a few years ago, "sticking" just such a hub is what caused his network to break-down. Creating a centralized wiretapping point under strict security may be just the thing to both comply and save costs, not to mention staying on the air. I don't see how that _by_itself_ is wrong of AT&T. There are other issues here as well. The Internet Infrastructure in a significant way sits in the US. We all know that. Is it really a surprise to anyone that the NSA, which states it listens to the Internet, is using a local resource such as that on US soil? They would be crazy not to. They rivals and enemies in other countries certainly won't think twice. There is the issue of separating domestic communication from the rest, but that's just something they have to deal with and US citizens have to be paranoid about. This whole situation will probably result in better supervision/monitoring of activities rather than stopping any of them (i.e. simply more people in-the-know of what the NSA is up to). That said, I am not a US citizen nor up-to-date on the details of this ATT/NSA issue or the privacy implications, and I am sure enough of the US folks here are. Gadi.

10 15