August 2006 - Test - lists.nanog.org

Re: i am not a list moderator, but i do have a request
by Fergie 14 Aug '06

14 Aug '06

For what it's worth, there _is_ a botnet discussison list: General information about the mailing list is at: http://www.whitestar.linuxbox.org/mailman/listinfo/botnets - ferg -- Thomas Kuehling <thomas.kuehling(a)packetloss.biz> wrote: Dear all, On So, 2006-08-13 at 15:17 -0600, Danny McPherson wrote: > Interestingly enough, I lurk here 99.999% of the time. I comment > on this thread and folks ask to move it to a non-SP mailing list? > Perhaps > non-operational, but this certainly has direct implications on SPs and > I'm of the opinion it's quite relevant - well, certainly as relevant > as the > past recent threads: i waited to view, where this discussion will go, but that's exactly the point. In my opinion, it's really interesting and necessary to be informed about topics like botnets. It would be a failure, when this topics won't be discussed anylonger on this list. Also it isn't that a big problem, to filter topics for himself for relevance or of no relevance. Just my two cents. Regards Thomas Kuehling -- Thomas Kuehling - TK2325-RIPE Hoehestrasse 28 - 61348 Bad Homburg vor der Höhe - Hessen Jahnstrasse 6 - 26219 Boesel - Niedersachsen -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

6 5

New Laptop Polices
by Cullen, Michael 14 Aug '06

14 Aug '06

Greetings all, Given the new threats and the change in policy with the airlines and traveling in and around the UK, has anyone changed their laptop and portable computing device policy? We are being questioned about the safety of executives traveling with their laptops. Thank You, Michael Cullen Global Security, Universal Music Group 818 286-5473 (w) | 818 919-6974 (c) UMG GSO Michael (aim) | UMG.GSO.Michael (gtalk) | michael.cullen(a)umusic.com (msn) The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that it is strictly prohibited (a) to disseminate, distribute or copy this communication or any of the information contained in it, or (b) to take any action based on the information in it. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer.

22 33

Re: i am not a list moderator, but i do have a request
by Fergie 13 Aug '06

13 Aug '06

My personal opinion is that _some_ bitnet issues are indeed relevant to the NANOG list, but that's just me. :-) I mean, it _does_ affect network ops at times... - ferg -- Thomas Kuehling <thomas.kuehling(a)packetloss.biz> wrote: Dear Fergie, On So, 2006-08-13 at 21:49 +0000, Fergie wrote: > For what it's worth, there _is_ a botnet discussison list: > > General information about the mailing list is at: > > http://www.whitestar.linuxbox.org/mailman/listinfo/botnets thanks, didn't know about it. But isn't it still usefull, when urgent matters concerning botnets will still discussed on the nanog-list? Please let me disabussed to it, but it's just my opinion. Regards Thomas > - ferg > > > -- Thomas Kuehling <thomas.kuehling(a)packetloss.biz> wrote: > > Dear all, > > On So, 2006-08-13 at 15:17 -0600, Danny McPherson wrote: > > > Interestingly enough, I lurk here 99.999% of the time. I comment > > on this thread and folks ask to move it to a non-SP mailing list? > > Perhaps > > non-operational, but this certainly has direct implications on SPs and > > I'm of the opinion it's quite relevant - well, certainly as relevant > > as the > > past recent threads: > > i waited to view, where this discussion will go, but that's exactly the > point. In my opinion, it's really interesting and necessary to be > informed about topics like botnets. It would be a failure, when this > topics won't be discussed anylonger on this list. Also it isn't that a > big problem, to filter topics for himself for relevance or of no > relevance. > > Just my two cents. > > Regards > Thomas Kuehling > > > -- > Thomas Kuehling - TK2325-RIPE > Hoehestrasse 28 - 61348 Bad Homburg vor der Höhe - Hessen > Jahnstrasse 6 - 26219 Boesel - Niedersachsen > > -- > "Fergie", a.k.a. Paul Ferguson > Engineering Architecture for the Internet > fergdawg(at)netzero.net > ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: mitigating botnet C&Cs has become useless
by Arjan Hulsebos 13 Aug '06

13 Aug '06

On Tue, 08 Aug 2006 15:10:50 -0700, Rick Wesson wrote: >Last sunday at DEFCON I explained how one consumer ISP cost American >business $29M per month because of the existence of key-logging botnets. Maybe so, but that argument doesn't buy me more helpdesk folks. The same holds true for the bandwidth argument, especially now that bandwidth is dirt cheap. On the other hand, it shouldn't be too difficult to come up with a walled garden profile for subs that have infected PCs, basically allowing only access to a filtering proxy, so these subs can download their patches and antivirus updates through it. Gr, Arjan H

4 6

what can be done with botnet C&C's?
by Gadi Evron 12 Aug '06

12 Aug '06

In my last email message I addressed some of the issues related to botnet C&C's and their mitigation. As mentioned, I waited to see what other experiences told other people, as well as glimpse the opinion of others here. In this message I will try and address some of the questions asked, but once again limiting myself mostly to JUST networking rather than the whole realm of botnet fighting. "I work on this [C&C] for 30 days, only to find out one of you took it down." -- US Federal Agent, two days ago, ISOI (DA Workshop). And still, sticking to networking issues, as obviously we cannot yet depend on law enforcement to protect our networks for us, how do we handle C&C's? When we kill them (and by "kill" I naturally mean "report our suspicion to the responsible authority so they can investigate, confirm and proceed according to their AUP") we kill them, but only to our knowledge. They immediately move elsewhere we do not know about in our space or someone else's, maybe misplacing an extremely smallish percentage of their population while they are at it. Okay, say I am right... What *can* we do? We can take advantage: 1. QoS and traffic limiting tools. Many tools created in recent years, and used exstensively by many ISP's, regardless of any Net Neutrality legislation, are at our disposal and already implemented on our networks. Much like, for business reasons, many of us would limit P2P, how about limiting the traffic to compromised users? How, what and when is up to you. You can know who your compromised users are by watching flows to C&C's. 2. Blocking communication to C&C's. Watch the flows, block the users from communicating out to them. Watch these users and see where else they are communicating in comparison to other users, en-masse. It's a matter of doing the same thing, for a different purpose. 3. Walled garden and tech support costs. Obviously, if any of these users call you (and they VERY OFTEN do), you lose money on them for a long time to come.. only they will call again. A combination of quarantine, complete or partial, might work. Combine that with what some already do, such as sell users Anti Virus products, and you get a nice deal. Add to that a support company to lend help to users, unrelated to tech support, by subscription, and you may just have more business avenues to explore. 4. Stop internal network infections. It is unbelievable how the networks with the most bots are the networks that allow internal users to connect wherever they want within the network. All these come to show that although responsiveness to C&C's is important (rather than shutting them down), on the scale of the Internet, what will actually help the Internet is if you take care of it on your own network. You don't have to do any of these, or all of these. Just to wake up to the fact that killing C&C's will mostly not help anyone, and if anything, will do harm. Using them to deal with problematic users, even if only to block them from acessing that C&C is more to the point. You can choose how to handle these issues, but if you want to stop harming the Internet, stop your users from participating, DDoSing, etc. while not harming your business (no one can handle that tech support load). Monitor the C&C's running on your network - contact law enforcement. These are compromises that will keep happening, you are aware of, and cause millions of dollars in damages. "So, are we supposed to leave these compromised boxes up?" My answer is this, if you fail to remove a spy, as another would just take his place, wouldn't you rather know where that spy is and work to take him down for good? The answer to that is NO, as most of us won't and can't. That said, if you must kill the C&C, be aware, it is nothing more than sweeping the problem, localy on your network, as well as on your friends', under the rag. Do you know who your local fed is? See if he can help, he most likely can't and if he could, without a much wider cooperation between everybody, he or she would be extremely limited by looking just at your C&C's. That said, I doubt you would want that fed's attension. You can limit P2P traffic yet you won't limit scanning traffic? Outgoing email traffic from port 25 on dynamic hosts? Bandwidth to compromised users? Port 80, or sny, traffic not through your proxy? Consider what other tools are in your arsenal. My ideas may be completely wrong for you, yet that does not change the fact that killing the C&C will just mean you are kept in the dark. Some large carriers do many of these already, run honey-nets, and what not. Do you? I would like to hear some opinions on what networks can do, ecnomically, from people here. Please stick to network operations issues. Gadi. This is being X-posted to the botnets list.

1 0

RE: ISP wants to stop outgoing web based spam
by Hank Nussbacher 12 Aug '06

12 Aug '06

On Wed, 9 Aug 2006, Mills, Charles wrote: I guess I wasn't clear enough in my first posting. I am not interested in smtp (port 25 spam). We have that covered. I am only interested in blocking outgoing web based spam. A user sits and sends out spam via automated tools via Hotmail, Yahoo, Gmail, or whatever Webmail system where they have set up thousands of throwaway users. An antispam proxy (that I want to install and manage) has to be able to come between the user on his/her PC and the Hotmail system and scan the http posts and page templates for things like number of receipents and other tricks like keeping track of the number of http posts. It has to maintain a list of known free webmail systems that are abused. Based on my stats from Spamcop, 60% of all outgoing spam is http based rather than smtp based. Others may have slightly higher or lower numbers. So, is there any magic fu out there to solve this? Thanks, Hank Nussbacher http://www.interall.co.il > Seems like all mail would have to go through the same server at that > point or at least every server would have to run the software. Probably > not practical for an ISP if you have multiple customers with their own > mail servers? I assume you're looking for something that would sit on > your egress point to your upstream providers? I would think that the > Packeteer box would almost be there to do this if you could have it or a > box like it inspect all traffic destined for port 25. Compare it > against a database of known spammers, known spam keywords, etc.? > > > > > > Charles L. Mills > > Senior Network Engineer > > Access Data Corporation > > 90 Beta Drive > > Pittsburgh, PA 15238 > > (412) 968-4024 > > cmills(a)accessdc.com > > http://www.accessdc.com <http://www.accessdc.com/> > > Hosting, Colocation and Disaster Recovery > > ________________________________ > > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of > Michael K. Smith - Adhost > Sent: Wednesday, August 09, 2006 9:11 AM > To: Hank Nussbacher; Nanog > Subject: Re: ISP wants to stop outgoing web based spam > > > > Hello Hank: > > > On 8/9/06 3:28 AM, "Hank Nussbacher" <hank(a)efes.iucc.ac.il> wrote: > >> >> Back in 2002 I asked if anyone had a solution to block or rate limit >> outgoing web based spam. Nothing came about from that thread. I have > an >> ISP that *wants* to stop the outgoing spam on an automatic basis and > be >> a good netizen. I would have hoped that 4 years later there would be >> some technical solution from some hungry startup. Perhaps I have > missed >> it. What I have found so far is: >> >> Detecting Outgoing Spam and Mail Bombing >> http://www.brettglass.com/spam/paper.html >> SMTP based mitigation - thing on HTTP/HTTPS >> >> Stopping Outgoing Spam >> http://research.microsoft.com/~joshuago/outgoingspam-final-submit.pdf >> Research paper - nothing practical >> >> Throttling Outgoing SPAM for Webmail Services >> http://www.ceas.cc/papers-2005/164.pdf >> Research paper - nothing practical >> >> ISPs look inward to stop spam - Network World >> http://www.networkworld.com/news/2004/071204carrispspam.html >> Bottom line - no solution >> >> So I am trying once again. Hopefully someone has some magic dust >> this time around. >> >> Thanks, >> Hank Nussbacher >> http://www.interall.co.il >> > > My answer is based on the word "startup" so I'm assuming "no money" but > I > could be "wrong". :-) We use the standard SpamAssassin, ClamAV setup > both > on ingress and egress. On egress we set the detection levels and divert > and > save anything that is marked as Spam rather than sending it on with > headers > and subject modifications. > > We've found this to be very effective in reducing our scores with > Comcast > and AOL in particular and it's pretty much stopped our being blocked by > those services, even using a fairly loose setting for SpamAssassin. As > a > service provider that forwards tons of mail to addresses on those > networks > (previously un-scanned so we forwarded everything, including Spam) we've > found it essential to put these filters in place to guarantee (as much > as > anyone can) service for our email customers. > > Regards, > > Mike > > > > +++++++++++++++++++++++++++++++++++++++++++ > This Mail Was Scanned By Mail-seCure System > at the Tel-Aviv University CC.

14 30

mpls gear for outside plant?
by Christian Kuhtz 12 Aug '06

12 Aug '06

Anyone know of vendors who make low density MPLS edge (IPVPN, VPLS, VPWS) gear, which can survive in outside plant? There doesn't seem to be much out there that can, most stuff that is data center type tops out at 40C. I'm looking for 45C or higher operating temp. Please respond directly to me unless you think it's of interest to the rest of the list. ;-) Thanks in advance. Best regards, Christian

1 0

Re: SORBS Contact
by Michael Nicks 11 Aug '06

11 Aug '06

Don't forget racketeering. "A person who commits crimes such as extortion, loansharking, bribery, and obstruction of justice in furtherance of illegal business activities." I think most network operators have learned about the ultra-liberal listing activities of RBLs these days. -Michael -- Michael Nicks Network Engineer KanREN e: mtnicks(a)kanren.net o: +1-785-856-9800 x221 m: +1-913-378-6516 Dean Anderson wrote: > SORBS is a well-known abusive/defamatory blacklist. In the US, that > violates a number of state and federal laws: > > 1. defamation > 2. illegal group boycott in violation of antitrust act > 3. (usually) unauthorized blocking by ISP in violation of its > contract with its customer, which is a violation of the > electronic communications privacy act. > 4. There are frequently state laws that apply to electronic > communications that are even more broad. > > You _can_ make the US based ISP not use SORBS. Most ISPs know better, > already. > > --Dean > > > See also http://www.iadl.org. > > --Dean > > On Mon, 7 Aug 2006, Brian Boles wrote: >> Can someone from SORBS contact me offlist if they are on here.... > > On Tue, 8 Aug 2006, Stefan Hegger wrote: >> We have the same problem. We are blacklisted and I filled out the webform. I >> got an email regarding ticket number and account/password to track the >> ticket. But it seems that nobody is working on it. > >>> There has been extensive discussion on NANAE and NANABl newsgroups on >>> this issue. The bottom line: The SORBS ticket queue is handled by a >>> group of unpaid volunteers, and there is quite a backlog. >>> >>> That's why there is the automatic de-listing system in place, which >>> requires proper host names and longer time-to-live (TTL) values in >>> rDNS. >>> >>> Yes, it's a bit of work, but it beats waiting for someone to get around >>> to your ticket. >>> >>> No, I'm not associated in any way with SORBS, just an interested >>> observer and system administrator who has had to deal with listings myself. > > > > > On Tue, 8 Aug 2006, Michael Nicks wrote: >> Sad state of affairs when looney people dictate which IPs are "good" and >> "bad". > > > On Tue, 8 Aug 2006, S. Ryan wrote: > >> Even worse if your ISP uses it and demands you ask the 'offender' to get >> 'themselves' removed. > >

26 48

Fedex Contact?
by Dennis Dayman 11 Aug '06

11 Aug '06

Does anyone have a Fedex.com contact that can help troubleshoot an email issues?

1 0

Weekly Routing Table Report
by Routing Analysis Role Account 11 Aug '06

11 Aug '06

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.apnic.net. If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 12 Aug, 2006 Analysis Summary ---------------- BGP routing table entries examined: 194755 Prefixes after maximum aggregation: 107004 Unique aggregates announced to Internet: 95222 Total ASes present in the Internet Routing Table: 22854 Origin-only ASes present in the Internet Routing Table: 19885 Origin ASes announcing only one prefix: 9517 Transit ASes present in the Internet Routing Table: 2969 Transit-only ASes present in the Internet Routing Table: 68 Average AS path length visible in the Internet Routing Table: 3.5 Max AS path length visible: 24 Max AS path prepend of ASN (24076) 20 Prefixes from unregistered ASNs in the Routing Table: 22 Unregistered ASNs in the Routing Table: 2 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 9 Number of addresses announced to Internet: 1562847660 Equivalent to 93 /8s, 39 /16s and 41 /24s Percentage of available address space announced: 42.2 Percentage of allocated address space announced: 61.0 Percentage of available address space allocated: 69.1 Total number of prefixes smaller than registry allocations: 96812 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 42607 Total APNIC prefixes after maximum aggregation: 17466 Prefixes being announced from the APNIC address blocks: 40293 Unique aggregates announced from the APNIC address blocks: 18723 APNIC Region origin ASes present in the Internet Routing Table: 2669 APNIC Region origin ASes announcing only one prefix: 755 APNIC Region transit ASes present in the Internet Routing Table: 400 Average APNIC Region AS path length visible: 3.5 Max APNIC Region AS path length visible: 24 Number of APNIC addresses announced to Internet: 244848480 Equivalent to 14 /8s, 152 /16s and 23 /24s Percentage of available APNIC address space announced: 76.6 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911 APNIC Address Blocks 58/7, 60/7, 121/8, 122/7, 124/7, 126/8, 202/7 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 98560 Total ARIN prefixes after maximum aggregation: 58685 Prefixes being announced from the ARIN address blocks: 72285 Unique aggregates announced from the ARIN address blocks: 27310 ARIN Region origin ASes present in the Internet Routing Table: 10883 ARIN Region origin ASes announcing only one prefix: 4096 ARIN Region transit ASes present in the Internet Routing Table: 1012 Average ARIN Region AS path length visible: 3.3 Max ARIN Region AS path length visible: 18 Number of ARIN addresses announced to Internet: 299087360 Equivalent to 17 /8s, 211 /16s and 182 /24s Percentage of available ARIN address space announced: 77.5 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959 ARIN Address Blocks 24/8, 63/8, 64/5, 72/6, 76/8, 199/8, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 39164 Total RIPE prefixes after maximum aggregation: 26205 Prefixes being announced from the RIPE address blocks: 36138 Unique aggregates announced from the RIPE address blocks: 24344 RIPE Region origin ASes present in the Internet Routing Table: 8363 RIPE Region origin ASes announcing only one prefix: 4386 RIPE Region transit ASes present in the Internet Routing Table: 1372 Average RIPE Region AS path length visible: 3.9 Max RIPE Region AS path length visible: 18 Number of RIPE addresses announced to Internet: 261444932 Equivalent to 15 /8s, 149 /16s and 85 /24s Percentage of available RIPE address space announced: 82.0 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-41983 RIPE Address Blocks 62/8, 80/5, 88/6, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 12153 Total LACNIC prefixes after maximum aggregation: 3732 Prefixes being announced from the LACNIC address blocks: 10247 Unique aggregates announced from the LACNIC address blocks: 5896 LACNIC Region origin ASes present in the Internet Routing Table: 711 LACNIC Region origin ASes announcing only one prefix: 235 LACNIC Region transit ASes present in the Internet Routing Table: 131 Average LACNIC Region AS path length visible: 4.2 Max LACNIC Region AS path length visible: 24 Number of LACNIC addresses announced to Internet: 31927040 Equivalent to 1 /8s, 231 /16s and 43 /24s Percentage of available LACNIC address space announced: 47.6 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 189/8, 190/8, 200/7 AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 2249 Total AfriNIC prefixes after maximum aggregation: 916 Prefixes being announced from the AfriNIC address blocks: 1543 Unique aggregates announced from the AfriNIC address blocks: 976 AfriNIC Region origin ASes present in the Internet Routing Table: 160 AfriNIC Region origin ASes announcing only one prefix: 45 AfriNIC Region transit ASes present in the Internet Routing Table: 24 Average AfriNIC Region AS path length visible: 3.5 Max AfriNIC Region AS path length visible: 11 Number of AfriNIC addresses announced to Internet: 4202496 Equivalent to 0 /8s, 64 /16s and 32 /24s Percentage of available AfriNIC address space announced: 12.5 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 1290 7930 240 CHINANET-BACKBONE 4755 966 255 68 Videsh Sanchar Nigam Ltd. Aut 9583 936 109 15 Sify Limited 9498 779 211 70 BHARTI BT INTERNET LTD. 4766 702 4435 303 Korea Telecom (KIX) 1221 610 1779 467 Telstra Pty Ltd 7545 553 124 72 TPG Internet Pty Ltd 17488 522 32 18 Hathway IP Over Cable Interne 17676 491 7109 111 Softbank BB Corp. 9443 450 111 83 Primus Telecommunications 18101 436 85 22 Reliance Infocom Ltd Internet 4812 412 739 59 China Telecom (Shanghai) 17849 410 30 122 Telecommunications Technology 17974 377 129 12 PT TELEKOMUNIKASI INDONESIA 4802 370 81 158 Wantree Development 17557 358 29 169 Pakistan Telecom 2907 336 1733 311 SINET Japan 4837 307 3468 132 chinanet IDC center beijing n 7474 295 211 229 SingTel Optus Pty Ltd 10139 282 23 6 Meridian Telekoms ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1482 6259 956 AT&T WorldNet Services 6197 1016 635 477 BellSouth Network Solutions, 721 1002 21942 311 DLA Systems Automation Center 4323 980 747 278 Time Warner Telecom 701 963 6782 788 UUNET Technologies, Inc. 18566 954 272 8 Covad Communications 2386 940 559 710 AT&T Data Communications Serv 174 937 5769 887 Cogent Communications 1239 842 2797 595 Sprint 20115 730 651 380 Charter Communications 19262 726 2216 185 Verizon Global Networks 11492 723 90 16 Cable One 209 688 3661 542 Qwest 22773 685 1742 44 Cox Communications, Inc. 7011 676 221 431 Citizens Utilities 6198 595 554 236 BellSouth Network Solutions, 852 582 1068 382 Telus Advanced Communications 855 568 247 74 Canadian Research Network 19916 563 49 54 OLM LLC 5668 539 147 28 CenturyTel Internet Holdings, RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 560 1947 441 UUNET - Commercial IP service 3301 315 1186 300 TeliaNet Sweden 3320 295 5013 239 Deutsche Telekom AG 8220 280 471 266 COLT Telecommunications 24863 249 42 11 LINKdotNET AS number 680 247 2041 244 DFN-IP service G-WiN 6746 243 91 221 Dynamic Network Technologies, 3246 230 462 220 Song Networks 8708 215 278 203 Romania Data Systems S.A. 3215 204 1760 97 France Telecom Transpac 8551 202 182 27 Bezeq International 3269 201 2246 72 TELECOM ITALIA 30890 200 18 83 SC Kappa Invexim SRL 1257 195 742 167 SWIPnet Swedish IP Network 6830 195 879 43 UPC Distribution Services 8866 191 37 15 Bulgarian Telecommunication C 5416 180 12 11 BATELCO-BH 786 171 1778 171 The JANET IP Service 3300 171 171 98 AUCS Communications Services 9121 168 931 31 TTnet Autonomous System LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 784 1811 226 UniNet S.A. de C.V. 22047 458 206 11 VTR PUNTO NET S.A. 11172 359 112 86 Servicios Alestra S.A de C.V 16814 329 20 8 NSS, S.A. 6147 273 134 22 Telefonica Del Peru 6471 255 74 30 ENTEL CHILE S.A. 14117 217 13 7 Telefonica del Sur S.A. 6503 183 151 83 AVANTEL, S.A. 7303 182 85 29 Telecom Argentina Stet-France 10481 181 72 8 Prima S.A. 7910 136 9 22 ANDINET ON LINE 21826 134 17 23 INTERCABLE 11556 132 80 4 Cable-Wireless Panama 18822 129 8 10 TELEFONICA MANQUEHUE 19169 128 8 25 Telconet 19429 123 80 40 E.T.B. 14522 121 18 9 SatNet S.A. 7738 114 410 20 Telecomunicacoes da Bahia S.A 23216 113 21 9 RAMtelecom Telecomunicaciones 14259 112 10 15 GTD Internet S.A. AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 284 803 231 The Internet Solution 8452 169 60 7 TEDATA 6713 144 135 11 Itissalat Al-MAGHRIB 15475 140 84 4 Nile Online 2018 134 298 111 Tertiary Education Network 5536 121 8 18 Internet Egypt Network 24835 116 48 6 RAYA Telecom - Egypt 33783 106 6 2 EEPAD TISP TELECOM & INTERNET 2905 79 159 70 The Internetworking Company o 15706 44 8 3 Sudatel Internet Exchange Aut 5713 38 294 34 Telkom SA Ltd 33774 31 7 21 AS Number for Telecom Algeria 23889 25 8 11 MAURITIUS TELECOM 10798 23 1 14 Standard Bank of South Africa 16637 23 18 21 Johnnic e-Ventures 8524 22 1 5 AUCEGYPT Autonomous System 21280 21 4 4 Swift Global Kenya Ltd.Is an 33766 21 2 1 Nyala Communications Pty Ltd 21491 20 17 2 UTL On-line is RF broadband I 2561 19 6 2 Egyptian Universities Network Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 4134 1290 1050 CHINANET-BACKBONE 18566 954 946 Covad Communications 9583 936 921 Sify Limited 4755 966 898 Videsh Sanchar Nigam Ltd. Aut 9498 779 709 BHARTI BT INTERNET LTD. 11492 723 707 Cable One 4323 980 702 Time Warner Telecom 721 1002 691 DLA Systems Automation Center 22773 685 641 Cox Communications, Inc. 8151 784 558 UniNet S.A. de C.V. 19262 726 541 Verizon Global Networks 6197 1016 539 BellSouth Network Solutions, 5668 539 511 CenturyTel Internet Holdings, 19916 563 509 OLM LLC 17488 522 504 Hathway IP Over Cable Interne 855 568 494 Canadian Research Network 7545 553 481 TPG Internet Pty Ltd 22047 458 447 VTR PUNTO NET S.A. 3602 527 422 Sprint Canada, Inc. 15270 455 422 PaeTec.net -a division of Pae List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 65350 PRIVATE 124.236.0.0/19 17672 asn for Hebei Provin 65350 PRIVATE 124.236.240.0/20 17672 asn for Hebei Provin 24409 UNALLOCATED 203.119.29.0/24 9808 Guangdong Mobile Com 65350 PRIVATE 219.148.0.0/22 17672 asn for Hebei Provin 65350 PRIVATE 219.148.4.0/23 17672 asn for Hebei Provin 65350 PRIVATE 219.148.8.0/21 17672 asn for Hebei Provin 65350 PRIVATE 219.148.24.0/21 17672 asn for Hebei Provin 65350 PRIVATE 219.148.32.0/19 17672 asn for Hebei Provin 65350 PRIVATE 222.222.0.0/21 17672 asn for Hebei Provin 65350 PRIVATE 222.222.8.0/21 17672 asn for Hebei Provin 65350 PRIVATE 222.222.16.0/20 17672 asn for Hebei Provin 65350 PRIVATE 222.222.32.0/20 17672 asn for Hebei Provin 65350 PRIVATE 222.222.48.0/20 17672 asn for Hebei Provin 65350 PRIVATE 222.222.208.0/21 17672 asn for Hebei Provin 65350 PRIVATE 222.222.216.0/21 17672 asn for Hebei Provin 65350 PRIVATE 222.223.187.0/24 17672 asn for Hebei Provin 65350 PRIVATE 222.223.188.0/22 17672 asn for Hebei Provin 65350 PRIVATE 222.223.192.0/22 17672 asn for Hebei Provin 65350 PRIVATE 222.223.196.0/23 17672 asn for Hebei Provin 65350 PRIVATE 222.223.200.0/22 17672 asn for Hebei Provin 65350 PRIVATE 222.223.206.0/23 17672 asn for Hebei Provin 65350 PRIVATE 222.223.224.0/19 17672 asn for Hebei Provin Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 192.44.0.0/24 5501 Fraunhofer Gesellschaft 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.84.205.0/24 719 LANLINK autonomous system 192.172.0.0/19 721 DLA Systems Automation Center 192.249.0.0/20 3450 University of Tennessee, Knox Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:17 /9:9 /10:11 /11:28 /12:97 /13:205 /14:375 /15:733 /16:8950 /17:3412 /18:5563 /19:12087 /20:13638 /21:11960 /22:15121 /23:16321 /24:105108 /25:384 /26:308 /27:196 /28:66 /29:40 /30:80 /31:0 /32:46 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 937 954 Covad Communications 6197 796 1016 BellSouth Network Solutions, 7018 777 1482 AT&T WorldNet Services 9583 769 936 Sify Limited 11492 711 723 Cable One 2386 658 940 AT&T Data Communications Serv 7011 582 676 Citizens Utilities 19916 557 563 OLM LLC 4766 513 702 Korea Telecom (KIX) 9498 460 779 BHARTI BT INTERNET LTD. 855 442 568 Canadian Research Network 6198 441 595 BellSouth Network Solutions, 15270 424 455 PaeTec.net -a division of Pae 5668 421 539 CenturyTel Internet Holdings, 4755 402 966 Videsh Sanchar Nigam Ltd. Aut 1239 398 842 Sprint 17849 397 410 Telecommunications Technology 6517 383 416 Yipes Communications, Inc. 18101 371 436 Reliance Infocom Ltd Internet 22773 363 685 Cox Communications, Inc. Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:9 8:50 12:1613 13:1 15:15 16:3 17:3 18:4 20:41 24:811 25:1 32:61 38:239 40:52 41:9 44:3 45:12 47:6 52:4 55:1 56:3 57:26 58:211 59:248 60:185 61:932 62:830 63:1889 64:3091 65:2259 66:2991 67:638 68:676 69:1567 70:390 71:87 72:874 74:71 75:5 80:753 81:674 82:644 83:410 84:393 85:574 86:396 87:462 88:154 89:394 91:1 121:13 122:3 123:1 124:348 125:595 128:148 129:188 130:118 131:315 132:34 133:8 134:164 135:48 136:178 137:85 138:213 139:48 140:491 141:135 142:376 143:189 144:239 145:40 146:318 147:140 148:354 149:187 150:114 151:97 152:71 153:117 154:5 155:213 156:179 157:169 158:167 159:172 160:94 161:83 162:217 163:164 164:236 165:222 166:182 167:242 168:486 169:125 170:352 171:14 190:125 192:5732 193:3404 194:2701 195:2024 196:853 198:3901 199:3300 200:4633 201:1035 202:6781 203:7045 204:3900 205:2009 206:2425 207:2906 208:2218 209:3447 210:2174 211:836 212:1258 213:1444 214:367 215:41 216:4018 217:1158 218:324 219:235 220:744 221:379 222:228 End of report Report Website: http://thyme.apnic.net

1 0