January 2007 - Test - lists.nanog.org

Re: Comment spammers chewing blogger bandwidth like crazy
by Gregory Hicks 13 Jan '07

13 Jan '07

> Date: Sat, 13 Jan 2007 18:58:02 +0000 (GMT) > From: "Chris L. Morrow" <christopher.morrow(a)verizonbusiness.com> > Subject: Re: Comment spammers chewing blogger bandwidth like crazy > To: Thomas Leavitt <thomas(a)thomasleavitt.org> > Cc: nanog <nanog(a)merit.edu> > > > > On Sat, 13 Jan 2007, Thomas Leavitt wrote: > > > Why has 195.225.177.46, an IP in Ukraine, been eating a tremendous > > amount of bandwidth? What are they doing? > > this isn't in the ukraine, it's in NYC behind ISPrime. Phil is fairly > hhelpful, you might ask them to 'figure out what the heck is going on' > with that ip :) > > -Chris > (unless the ukraine got a whole lot closer to IAD than I thought: > 64 bytes from 195.225.177.46: icmp_seq=1 ttl=55 time=13.1 ms > 64 bytes from 195.225.177.46: icmp_seq=2 ttl=55 time=24.5 ms Um-m-m-m... % Information related to '195.225.176.0 - 195.225.179.255' inetnum: 195.225.176.0 - 195.225.179.255 netname: NETCATHOST descr: NetcatHosting country: UA admin-c: VS1142-RIPE tech-c: VS1142-RIPE status: ASSIGNED PI mnt-by: RIPE-NCC-HM-PI-MNT mnt-lower: RIPE-NCC-HM-PI-MNT mnt-by: NETCATHOST-MNT mnt-routes: NETCATHOST-MNT notify: vs(a)netcathost.com changed: hostmaster(a)ripe.net 20040304 source: RIPE remarks: *************************************** remarks: * Abuse contacts: abuse(a)netcathost.com * remarks: *************************************** person: Vsevolod Stetsinsky address: 01110, Ukraine, Kiev, 20Á, Solomenskaya street. room 206. phone: +38 050 6226676 e-mail: vs(a)netcathost.com nic-hdl: VS1142-RIPE changed: vs(a)netcathost.com 20040303 source: RIPE > ) --------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer Cadence Design Systems | Direct: 408.576.3609 555 River Oaks Pkwy M/S 9B1 San Jose, CA 95134 I am perfectly capable of learning from my mistakes. I will surely learn a great deal today. "A democracy is a sheep and two wolves deciding on what to have for lunch. Freedom is a well armed sheep contesting the results of the decision." - Benjamin Franklin "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

4 3

Re: Network end users to pull down 2 gigabytes a day, continuously?
by odlyzko＠dtc.umn.edu 13 Jan '07

13 Jan '07

Extensive evidence of the phenomenon Mike describes (inexpensive, frequently used things moving towards flat rate, expensive and rare ones towards sophisticated schemes a la "Saturday night stop-over fares") is presented in my paper "nternet pricing and the history of communications," Computer Networks 36 (2001), pp. 493-517, available at http://www.dtc.umn.edu/~odlyzko/doc/history.communications1b.pdf It also explains some of the mechanisms behind this tendency, drawn both from conventional economics (bundling, etc.) and behavioral economics (willingness to pay more for flat rates). This tendency can indeed reverse in cases of extreme asymmetry of usage. But one has to be careful there. Heavy users are often the most valuable. (In today's environment they are often the ones who provide the P2P material that attracts other uses to the network. And yes, there is a problem there, in that you don't need such heavy users to be on YOUR network for them to be an attraction in signing up new subscribers.) Andrew > On Sat Jan 13, Mike Leber wrote: On Sat, 13 Jan 2007, Sean Donelan wrote: > On Fri, 12 Jan 2007, Stephen Sprunk wrote: > > There is no technical challenge here; what the pirates are already doing > > works pretty well, and with a little UI work it'd even be ready for the mass > > market. The challenges are figuring out how to pay for the pipes needed to > > deliver all these bits at consumer rates, and how to collect revenue from all > > the viewers to fairly compensate the producers -- both business problems, > > though for different folks. > > Will the North American market change from using speed to volume for > pricing Internet connections? Web hosting and other markets around the > world already use GB/transferred packages instead of the port speed. The North American market started with charging per GB transfered and went away from it because the drop in cost per Mbps for both circuits and transit made costs low enough so that providers could statistically multiplex their user base and offer "unlimited" service (unlimited for marketing departments is being able to offer something to 99 percent of your customer base, which explains all residential service clauses that state unlimited doesn't really mean unlimited). You can see this repeatedly for all sorts of products as costs have come down in the long view. For example, consumer Internet dialup, long distance calling plans, local phone service plans, some aspects of cell phone service, it might be happening with online storage right now (i.e. google gmail/gfs and the browser plugins that let you store files in your gmail account). What might or might not be trending is a digression, the "unlimited" service is a marketing condition that seems to occur when 99 percent of your customer base uses less than the cost equal to the benefit of offering "unlimited" service. Mike. +----------------- H U R R I C A N E - E L E C T R I C -----------------+ | Mike Leber Direct Internet Connections Voice 510 580 4100 | | Hurricane Electric Web Hosting Colocation Fax 510 580 4151 | | mleber(a)he.net http://www.he.net | +-----------------------------------------------------------------------+

1 0

Re: Comment spammers chewing blogger bandwidth like crazy
by Alexander Harrowell 13 Jan '07

13 Jan '07

I was asked to join late in 2005. On 1/13/07, Eric Brunner-Williams in Portland Maine < brunner(a)abenaki.wabanaki.net> wrote: > > Do you operate fistfulofeuros? That's a good blog/community. > > I operate wampum and koufax, and draftgore2008, and we do see > persistant commerical ad inserts, and the occasional event for > which no commercial motive is self-evident. > > Eric >

1 0

Re: Comment spammers chewing blogger bandwidth like crazy
by Gregory Hicks 13 Jan '07

13 Jan '07

> Date: Sat, 13 Jan 2007 20:14:23 +0000 (GMT) > From: "Chris L. Morrow" <christopher.morrow(a)verizonbusiness.com> > > On Sat, 13 Jan 2007, Gregory Hicks wrote: > [...] > > > > > > this isn't in the ukraine, it's in NYC behind ISPrime. Phil is fairly > > > hhelpful, you might ask them to 'figure out what the heck is going on' > > > with that ip :) > > > > > > -Chris > > > (unless the ukraine got a whole lot closer to IAD than I thought: > > > 64 bytes from 195.225.177.46: icmp_seq=1 ttl=55 time=13.1 ms > > > 64 bytes from 195.225.177.46: icmp_seq=2 ttl=55 time=24.5 ms [...] > yes, but 'whois info' is not often 'correct' especially in this case, > traceroute to it, unless ISPrime has some time-space vortex that ip > (that one of the /22) is actually in NYC. speed-o-light don't often lie... Yup!. Should have looked further. Chris is right. (Learn from the master! - I *should* have known better...) Behind at least two levels of ISPrime... Thanks! --------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer Cadence Design Systems | Direct: 408.576.3609 555 River Oaks Pkwy M/S 9B1 San Jose, CA 95134 I am perfectly capable of learning from my mistakes. I will surely learn a great deal today. "A democracy is a sheep and two wolves deciding on what to have for lunch. Freedom is a well armed sheep contesting the results of the decision." - Benjamin Franklin "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

1 0

ISP Security BOF @NANOG 39
by Danny McPherson 13 Jan '07

13 Jan '07

Folks, For some crazy reason I've agreed again to chair the ISP Security BOF at NANOG 39 in Toronto. If you've got items you'd like to discuss, like to see discussed, or would prefer not be presented, please let me know ASAP. The two agenda items for the moment are meant to be, in the very spirit of a BOF, loose panel discussions on the following topics: The root of a log: Extracting Intelligence from the Woods Botnet C&C: Extirpate or Infiltrate? If you'd be interested in sharing your views, please let me know, although RSVP is not necessary. Slides are welcome but not required. Thanks in advance, see you in Toronto! -danny

2 1

Re: Network end users to pull down 2 gigabytes a day, continuously?
by odlyzko＠dtc.umn.edu 13 Jan '07

13 Jan '07

A remark and a question: 1. 2 GB/day per user would indeed require tossing everyone's CURRENT baseline network usage metrics out the window, IF IT WERE TO BE ACHIEVED INSTANTANEOUSLY. The key question is, how quickly and widely will this application spread? Back in 1997, when I first started collecting Internet usage statistics, there were concerns that pre-fetching applications like WebWhacker (anyone remember that?) would lead to a collapse of networks and business plans. With flat rate dial access, staying connected for 24 hours per day would have (i) exhausted the modem pools, which were built on a 5-10 oversubscription ratio, and (ii) broken the aggregation and backbone networks, generating about 240 MB/day or traffic per subscriber (on a 19.2 Kbps modem, about standard then). But the average user was online just 1 hour per day, and download traffic was about 2 Kbps during that hour, leading to about 1 MB/day of traffic, and the world did not come to a halt. (And yes, I am suppressing some details, such as ISPs TOSs forbidding applications like WebWhacker, and technical measures to keep them limited.) Today, download rates per broadband subscriber range (among the few industrialized countries for which I have data or at least decent estimates) from about 60 MB in Australia to 1 GB in Hong Kong. So 2 GB/day is not that far out of range for Hong Kong (or South Korea) even today. And in a few years (which is what you always have to allow for, even Napster and Skype did not take over the world in the proverbial "Internet time" of 8 months or less), other places might catch up. 2. The question I don't understand is, why stream? In these days, when a terabyte disk for consumer PCs is about to be introduced, why bother with streaming? It is so much simpler to download (at faster than real-time rates, if possible), and play it back. Andrew > On Sat, 6 Jan 2007, Marshall Eubanks wrote: Note that 220 MB per hour (ugly units) is 489 Kbps, slightly less =20 than our current usage. > The more popular the content is, the more sources it can be pulled =20 > from > and the less redundant data we send, and that number can be as low as > 220MB per hour viewed. (Actually, I find this a tough thing to explain > to people in general; it's really counterintuitive to see that more > peers =3D=3D less bandwidth - I'm still searching for a useful = user-facing > metaphor, anyone got any ideas?). Why not just say, the more peers, the more efficient it becomes as it =20= approaches the bandwidth floor set by the chosen streaming ? Regards Marshall On Jan 6, 2007, at 9:07 AM, Colm MacCarthaigh wrote: > > On Sat, Jan 06, 2007 at 03:18:03AM -0500, Robert Boyle wrote: >> At 01:52 AM 1/6/2007, Thomas Leavitt <thomas(a)thomasleavitt.org> =20 >> wrote: >>> If this application takes off, I have to presume that everyone's >>> baseline network usage metrics can be tossed out the window... > > That's a strong possibility :-) > > I'm currently the network person for The Venice Project, and busy > building out our network, but also involved in the design and planning > work and a bunch of other things. > > I'll try and answer any questions I can, I may be a little =20 > restricted in > revealing details of forthcoming developments and so on, so please > forgive me if there's later something I can't answer, but for now I'll > try and answer any of the technicalities. Our philosophy is to pretty > open about how we work and what we do. > > We're actually working on more general purpose explanations of all =20 > this, > which we'll be putting on-line soon. I'm not from our PR dept, or a > spokesperson, just a long-time NANOG reader and ocasional poster > answering technical stuff here, so please don't just post the archive > link to digg/slashdot or whatever. > > The Venice Project will affect network operators and we're working =20 > on a > range of different things which may help out there. We've designed =20= > our > traffic to be easily categorisable (I wish we could mark a DSCP, =20 > but the > levels of access needed on some platforms are just too restrictive) =20= > and > we know how the real internet works. Already we have aggregate per-AS > usage statistics, and have some primitive network proximity =20 > clustering. > AS-level clustering is planned. > > This will reduce transit costs, but there's not much we can do for =20 > other > infrastructural, L2 or last-mile costs. We're L3 and above only. > Additionally, we predict a healthy chunk of usage will go to our "Long > tail servers", which are explained a bit here; > > http://www.vipeers.com/vipeers/2007/01/venice_project_.html > > and in the next 6 months or so, we hope to turn up at IX's and arrange > private peerings to defray the transit cost of that traffic too. > Right now, our main transit provider is BT (AS5400) who are at some > well-known IX's. > >> Interesting. Why does it send so much data? > > It's full-screen TV-quality video :-) After adding all the overhead =20= > for > p2p protocol and stream resilience we still only use a maximum of =20 > 320MB > per viewing hour. > > The more popular the content is, the more sources it can be pulled =20 > from > and the less redundant data we send, and that number can be as low as > 220MB per hour viewed. (Actually, I find this a tough thing to explain > to people in general; it's really counterintuitive to see that more > peers =3D=3D less bandwidth - I'm still searching for a useful = user-facing > metaphor, anyone got any ideas?). > > To put that in context; a 45 minute episode grabbed from a file-=20 > sharing > network will generally eat 350MB on-disk, obviously slightly more is > used after you account for even the 2% TCP/IP overhead and p2p =20 > protocol > headers. And it will usually take longer than 45 minutes to get there. > > Compressed digital telivision works out at between 900MB and 3GB an =20= > hour > viewed (raw is in the tens of gigabytes). DVD is of the same order. > YouTube works out at about 80MB to 230MB per-hour, for a mini-screen > (though I'm open to correction on that, I've just multiplied the > bitrates out). > >> Is it a peer to peer type of system where it redistributes a portion >> of the stream as you are viewing it to other users? > > Yes, though not neccessarily as you are viewing it. A proportion of =20= > what > you have viewed previously is cached and can be made available to =20 > other > peers. > > --=20 > Colm MacC=E1rthaigh Public Key: colm=20 > +pgp(a)stdlib.net

22 45

Weekly Routing Table Report
by Routing Analysis Role Account 12 Jan '07

12 Jan '07

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.apnic.net. If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 13 Jan, 2007 Analysis Summary ---------------- BGP routing table entries examined: 207335 Prefixes after maximum aggregation: 112275 Deaggregation factor: 1.85 Unique aggregates announced to Internet: 101123 Total ASes present in the Internet Routing Table: 24109 Origin-only ASes present in the Internet Routing Table: 21004 Origin ASes announcing only one prefix: 10167 Transit ASes present in the Internet Routing Table: 3105 Transit-only ASes present in the Internet Routing Table: 79 Average AS path length visible in the Internet Routing Table: 3.6 Max AS path length visible: 32 Max AS path prepend of ASN (20858) 18 Prefixes from unregistered ASNs in the Routing Table: 1 Unregistered ASNs in the Routing Table: 4 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 9 Number of addresses announced to Internet: 1654125772 Equivalent to 98 /8s, 151 /16s and 244 /24s Percentage of available address space announced: 44.6 Percentage of allocated address space announced: 63.3 Percentage of available address space allocated: 70.5 Total number of prefixes smaller than registry allocations: 105540 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 46064 Total APNIC prefixes after maximum aggregation: 18654 APNIC Deaggregation factor: 2.47 Prefixes being announced from the APNIC address blocks: 43622 Unique aggregates announced from the APNIC address blocks: 19166 APNIC Region origin ASes present in the Internet Routing Table: 2819 APNIC Region origin ASes announcing only one prefix: 794 APNIC Region transit ASes present in the Internet Routing Table: 421 Average APNIC Region AS path length visible: 3.7 Max APNIC Region AS path length visible: 16 Number of APNIC addresses announced to Internet: 274913376 Equivalent to 16 /8s, 98 /16s and 216 /24s Percentage of available APNIC address space announced: 86.0 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911 APNIC Address Blocks 58/7, 60/7, 121/8, 122/7, 124/7, 126/8, 202/7 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 102243 Total ARIN prefixes after maximum aggregation: 60587 ARIN Deaggregation factor: 1.69 Prefixes being announced from the ARIN address blocks: 75424 Unique aggregates announced from the ARIN address blocks: 28773 ARIN Region origin ASes present in the Internet Routing Table: 11259 ARIN Region origin ASes announcing only one prefix: 4313 ARIN Region transit ASes present in the Internet Routing Table: 1040 Average ARIN Region AS path length visible: 3.4 Max ARIN Region AS path length visible: 21 Number of ARIN addresses announced to Internet: 312109696 Equivalent to 18 /8s, 154 /16s and 106 /24s Percentage of available ARIN address space announced: 68.9 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959 ARIN Address Blocks 24/8, 63/8, 64/5, 72/6, 76/8, 96/6, 199/8, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 42963 Total RIPE prefixes after maximum aggregation: 28092 RIPE Deaggregation factor: 1.53 Prefixes being announced from the RIPE address blocks: 39732 Unique aggregates announced from the RIPE address blocks: 26449 RIPE Region origin ASes present in the Internet Routing Table: 9024 RIPE Region origin ASes announcing only one prefix: 4756 RIPE Region transit ASes present in the Internet Routing Table: 1449 Average RIPE Region AS path length visible: 4.0 Max RIPE Region AS path length visible: 32 Number of RIPE addresses announced to Internet: 284066980 Equivalent to 16 /8s, 238 /16s and 132 /24s Percentage of available RIPE address space announced: 77.0 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-43007 RIPE Address Blocks 62/8, 77/8, 78/7, 80/5, 88/6, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 13538 Total LACNIC prefixes after maximum aggregation: 3991 LACNIC Deaggregation factor: 3.39 Prefixes being announced from the LACNIC address blocks: 11624 Unique aggregates announced from the LACNIC address blocks: 7166 LACNIC Region origin ASes present in the Internet Routing Table: 756 LACNIC Region origin ASes announcing only one prefix: 251 LACNIC Region transit ASes present in the Internet Routing Table: 132 Average LACNIC Region AS path length visible: 4.1 Max LACNIC Region AS path length visible: 20 Number of LACNIC addresses announced to Internet: 36115200 Equivalent to 2 /8s, 39 /16s and 19 /24s Percentage of available LACNIC address space announced: 53.8 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 189/8, 190/8, 200/7 AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 2526 Total AfriNIC prefixes after maximum aggregation: 951 AfriNIC Deaggregation factor: 2.66 Prefixes being announced from the AfriNIC address blocks: 1769 Unique aggregates announced from the AfriNIC address blocks: 1132 AfriNIC Region origin ASes present in the Internet Routing Table: 172 AfriNIC Region origin ASes announcing only one prefix: 53 AfriNIC Region transit ASes present in the Internet Routing Table: 31 Average AfriNIC Region AS path length visible: 3.6 Max AfriNIC Region AS path length visible: 15 Number of AfriNIC addresses announced to Internet: 5344768 Equivalent to 0 /8s, 81 /16s and 142 /24s Percentage of available AfriNIC address space announced: 15.9 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 1265 8645 264 CHINANET-BACKBONE 4755 1046 384 68 Videsh Sanchar Nigam Ltd. Aut 9583 1025 99 66 Sify Limited 9498 919 467 65 BHARTI BT INTERNET LTD. 23577 771 34 700 KRNIC 4766 761 4946 312 Korea Telecom (KIX) 1221 574 1698 445 Telstra Pty Ltd 17488 567 35 22 Hathway IP Over Cable Interne 7545 562 126 74 TPG Internet Pty Ltd 17676 503 10935 66 Softbank BB Corp. 18101 499 87 27 Reliance Infocom Ltd Internet 9443 442 111 74 Primus Telecommunications 4812 436 759 69 China Telecom (Shanghai) 9942 436 85 131 COMindico Australia 17974 365 129 12 PT TELEKOMUNIKASI INDONESIA 4802 360 86 150 Wantree Development 17557 355 35 169 Pakistan Telecom 17849 353 33 93 Telecommunications Technology 2907 332 1749 309 SINET Japan 4837 331 3943 144 chinanet IDC center beijing n ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1537 6161 998 AT&T WorldNet Services 2386 1106 585 733 AT&T Data Communications Serv 4323 1065 821 300 Time Warner Telecom 6197 1022 639 500 BellSouth Network Solutions, 18566 984 272 8 Covad Communications 701 935 6676 749 UUNET Technologies, Inc. 174 933 6789 865 Cogent Communications 11492 908 99 13 Cable One 1239 822 2730 572 Sprint 19262 804 2538 182 Verizon Global Networks 20115 776 678 415 Charter Communications 721 748 21837 290 DLA Systems Automation Center 209 721 3748 567 Qwest 22773 715 1744 41 Cox Communications, Inc. 7011 688 209 429 Citizens Utilities 852 607 1093 393 Telus Advanced Communications 5668 570 161 19 CenturyTel Internet Holdings, 19916 567 48 57 OLM LLC 6198 550 519 256 BellSouth Network Solutions, 855 536 250 73 Canadian Research Network RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 545 1912 424 UUNET - Commercial IP service 3301 305 1199 287 TeliaNet Sweden 3320 296 4993 247 Deutsche Telekom AG 24863 296 45 25 LINKdotNET AS number 8220 271 473 262 COLT Telecommunications 6746 265 93 243 Dynamic Network Technologies, 680 256 2042 250 DFN-IP service G-WiN 8708 234 283 221 Romania Data Systems S.A. 3215 233 2136 96 France Telecom Transpac 1257 215 1069 171 SWIPnet Swedish IP Network 3269 211 2375 74 TELECOM ITALIA 3246 209 354 196 Song Networks 30890 209 19 90 SC Kappa Invexim SRL 5416 206 13 9 BATELCO-BH 8551 196 197 24 Bezeq International 3352 176 1767 31 Ibernet, Internet Access Netw 3300 175 171 88 AUCS Communications Services 12479 175 578 6 Uni2 Autonomous System 20858 175 34 3 This AS will be used to conne 786 172 1795 172 The JANET IP Service LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 829 2015 204 UniNet S.A. de C.V. 11830 482 299 19 Instituto Costarricense de El 11172 385 104 78 Servicios Alestra S.A de C.V 16814 329 20 8 NSS, S.A. 22047 307 206 11 VTR PUNTO NET S.A. 14117 258 16 13 Telefonica del Sur S.A. 6471 256 74 31 ENTEL CHILE S.A. 7303 230 103 32 Telecom Argentina Stet-France 6147 225 182 20 Telefonica Del Peru 6503 216 170 93 AVANTEL, S.A. 11556 212 105 7 Cable-Wireless Panama 10481 181 72 8 Prima S.A. 21826 156 20 35 INTERCABLE 23216 146 19 43 RAMtelecom Telecomunicaciones 18822 145 9 10 TELEFONICA MANQUEHUE 7910 144 10 33 ANDINET ON LINE 19429 141 84 35 E.T.B. 19169 139 9 22 Telconet 14522 134 21 8 SatNet S.A. 7738 116 442 21 Telecomunicacoes da Bahia S.A AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 289 868 231 The Internet Solution 8452 230 60 6 TEDATA 15475 154 84 4 Nile Online 6713 144 135 11 Itissalat Al-MAGHRIB 2018 138 309 113 Tertiary Education Network 5536 123 8 15 Internet Egypt Network 33783 109 6 4 EEPAD TISP TELECOM & INTERNET 24835 85 48 6 RAYA Telecom - Egypt 2905 84 175 73 The Internetworking Company o 2561 60 6 2 Egyptian Universities Network 15706 55 12 4 Sudatel Internet Exchange Aut 23889 55 13 15 MAURITIUS TELECOM 5713 41 294 34 Telkom SA Ltd 12455 39 6 3 Jambonet Autonomous system 33774 38 12 22 AS Number for Telecom Algeria 16637 33 21 25 Johnnic e-Ventures 33766 33 2 1 Nyala Communications Pty Ltd 8524 30 2 6 AUCEGYPT Autonomous System 15804 27 2 1 AS of The Way Out Internet So 33776 27 2 5 Starcomms Nigeria Limited Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 4134 1265 1001 CHINANET-BACKBONE 4755 1046 978 Videsh Sanchar Nigam Ltd. Aut 18566 984 976 Covad Communications 9583 1025 959 Sify Limited 11492 908 895 Cable One 9498 919 854 BHARTI BT INTERNET LTD. 4323 1065 765 Time Warner Telecom 22773 715 674 Cox Communications, Inc. 8151 829 625 UniNet S.A. de C.V. 19262 804 622 Verizon Global Networks 5668 570 551 CenturyTel Internet Holdings, 17488 567 545 Hathway IP Over Cable Interne 6197 1022 522 BellSouth Network Solutions, 19916 567 510 OLM LLC 7545 562 488 TPG Internet Pty Ltd 18101 499 472 Reliance Infocom Ltd Internet 855 536 463 Canadian Research Network 15270 497 463 PaeTec.net -a division of Pae 11830 482 463 Instituto Costarricense de El 721 748 458 DLA Systems Automation Center List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 24409 UNALLOCATED 203.119.29.0/24 9808 Guangdong Mobile Com Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 172.33.1.0/24 7018 AT&T WorldNet Services 192.0.10.0/24 9498 BHARTI BT INTERNET LTD. 192.44.0.0/24 5501 Fraunhofer Gesellschaft 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.172.0.0/19 721 DLA Systems Automation Center Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:19 /9:10 /10:13 /11:30 /12:116 /13:228 /14:409 /15:804 /16:9100 /17:3636 /18:5933 /19:12911 /20:14500 /21:12941 /22:16483 /23:17922 /24:110644 /25:600 /26:454 /27:357 /28:72 /29:43 /30:86 /31:0 /32:24 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 967 984 Covad Communications 11492 894 908 Cable One 9583 854 1025 Sify Limited 7018 832 1537 AT&T WorldNet Services 2386 829 1106 AT&T Data Communications Serv 6197 795 1022 BellSouth Network Solutions, 23577 757 771 KRNIC 7011 593 688 Citizens Utilities 9498 579 919 BHARTI BT INTERNET LTD. 4766 569 761 Korea Telecom (KIX) 19916 562 567 OLM LLC 4755 486 1046 Videsh Sanchar Nigam Ltd. Aut 15270 465 497 PaeTec.net -a division of Pae 5668 440 570 CenturyTel Internet Holdings, 855 433 536 Canadian Research Network 18101 433 499 Reliance Infocom Ltd Internet 1239 408 822 Sprint 33588 400 422 Bresnan Communications, LLC. 17488 390 567 Hathway IP Over Cable Interne 6198 389 550 BellSouth Network Solutions, Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:9 8:62 9:1 12:1653 13:1 15:15 16:3 17:3 18:5 20:36 24:870 25:1 32:55 38:274 40:57 41:57 44:2 47:10 52:4 53:1 55:1 56:3 57:25 58:277 59:365 60:190 61:960 62:1060 63:1893 64:3178 65:2298 66:3085 67:693 68:642 69:1705 70:407 71:129 72:1124 74:125 75:58 76:20 80:819 81:788 82:640 83:349 84:487 85:776 86:435 87:451 88:259 89:732 90:2 91:130 97:1 121:123 122:55 123:24 124:520 125:760 128:315 129:219 130:126 131:315 132:49 133:9 134:183 135:44 136:181 137:114 138:189 139:54 140:520 141:135 142:348 143:212 144:265 145:67 146:320 147:138 148:362 149:187 150:112 151:117 152:90 153:119 154:5 155:245 156:156 157:152 158:167 159:140 160:99 161:94 162:226 163:159 164:237 165:237 166:243 167:280 168:479 169:121 170:365 171:13 172:1 189:49 190:340 192:5740 193:3622 194:2897 195:2194 196:914 198:3772 199:3280 200:4632 201:952 202:7074 203:7271 204:3954 205:2108 206:2429 207:2896 208:2380 209:3565 210:2292 211:865 212:1296 213:1423 214:388 215:39 216:4087 217:1202 218:340 219:257 220:837 221:371 222:261 End of report Report Website: http://thyme.apnic.net

1 0

i wanna be a kpn peer
by Randy Bush 12 Jan '07

12 Jan '07

route-views.oregon-ix.net>sh ip bg 203.10.63.0 BGP routing table entry for 0.0.0.0/, version 2 Paths: (1 available, best #1, table Default-IP-Routing-Table) Not advertised to any peer 286 134.222.85.45 from 134.222.85.45 (134.222.85.45) Origin IGP, localpref 100, valid, external, best Community: 286:286 286:3031 286:3809

7 8

Re: Web Honeynet Project: announcement, exploit URLs this Wednesday
by Gadi Evron 12 Jan '07

12 Jan '07

On Thu, 11 Jan 2007, Ken A wrote: > What about common tools that are already being used for this? Non are perfect (or close to) for this, but I am not discussing tools (yet), just the data. Gadi.

1 0

BGP Update Report
by cidr-report＠potaroo.net 12 Jan '07

12 Jan '07

BGP Update Report Interval: 29-Dec-06 -to- 11-Jan-07 (14 days) Observation Point: BGP Peering with AS4637 TOP 20 Unstable Origin AS Rank ASN Upds % Upds/Pfx AS-Name 1 - AS8220 69155 2.4% 247.0 -- COLT COLT Telecommunications 2 - AS28751 35645 1.2% 254.6 -- CAUCASUS-NET-AS Caucasus Network Tbilisi, Georgia 3 - AS701 35105 1.2% 36.7 -- UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 4 - AS2907 31361 1.1% 94.2 -- ERX-SINET-AS National Center for Science Information Systems 5 - AS702 28034 1.0% 38.8 -- AS702 MCI EMEA - Commercial IP service provider in Europe 6 - AS4804 23274 0.8% 78.4 -- MPX-AS Microplex PTY LTD 7 - AS3561 17058 0.6% 35.2 -- SAVVIS - Savvis 8 - AS306 14923 0.5% 82.0 -- DNIC - DoD Network Information Center 9 - AS5668 14082 0.5% 24.4 -- AS-5668 - CenturyTel Internet Holdings, Inc. 10 - AS705 13873 0.5% 39.8 -- UUNET - MCI Communications Services, Inc. d/b/a Verizon Business 11 - AS9051 12886 0.5% 90.1 -- IDM Autonomous System 12 - AS9583 12181 0.4% 11.4 -- SIFY-AS-IN Sify Limited 13 - AS11830 11686 0.4% 12.7 -- Instituto Costarricense de Electricidad y Telecom. 14 - AS3301 11248 0.4% 36.1 -- TELIANET-SWEDEN TeliaNet Sweden 15 - AS6471 11087 0.4% 43.1 -- ENTEL CHILE S.A. 16 - AS4725 10813 0.4% 152.3 -- ODN JAPAN TELECOM CO.,LTD. 17 - AS6461 10778 0.4% 61.6 -- MFNX MFN - Metromedia Fiber Network 18 - AS8151 10399 0.4% 12.5 -- Uninet S.A. de C.V. 19 - AS668 9885 0.3% 39.5 -- ASN-ASNET-NET-AS - Defense Research and Engineering Network 20 - AS11486 9818 0.3% 34.8 -- WAN - Worldcom Advance Networks TOP 20 Unstable Origin AS (Updates per announced prefix) Rank ASN Upds % Upds/Pfx AS-Name 1 - AS35489 3553 0.1% 3553.0 -- TOTO-TECH-AS Toto Ltd. 2 - AS4809 5390 0.2% 2695.0 -- CHINANET-CORE-WAN-CENTRAL CHINANET core WAN Central 3 - AS31594 1395 0.1% 1395.0 -- FORTESS-AS Fortess LLC Network 4 - AS9945 1063 0.0% 1063.0 -- KCACBACKUP-AS-KR Korea Information Security Agency 5 - AS10100 4024 0.1% 1006.0 -- ASN-AP-UBSW # AS-AP-UBSW CONVERTED TO ASN-AP-UBSW FOR RPSL COMPLIANCE UBS Warburg Autonomous System Asia-Pacific 6 - AS34378 947 0.0% 947.0 -- RUG-AS Razguliay-UKRROS Group 7 - AS39250 1890 0.1% 945.0 -- COLOPROVIDER-AS Colo Provider 8 - AS12922 662 0.0% 662.0 -- MULTITRADE-AS Bank Outsourcer 9 - AS3043 3286 0.1% 657.2 -- AMPHIB-AS - Amphibian Media Corporation 10 - AS14699 6122 0.2% 612.2 -- BTCBCI - Bloomingdale Communications Inc 11 - AS27407 604 0.0% 604.0 -- FRISCHS-INC - Frisch's Restaurants, Inc. 12 - AS4678 5817 0.2% 581.7 -- FINE CANON NETWORK COMMUNICATIONS INC. 13 - AS32937 1154 0.0% 577.0 -- CAC-FOR-THE-DEAF-AND-HARD-OF-HEARING - Communication Access Center for the Deaf and Hard of Hearing, Inc. 14 - AS21391 1680 0.1% 560.0 -- TDA-AS TDA AS Maintainer 15 - AS38197 1960 0.1% 490.0 -- SUNHK-DATA-AS-AP Sun Network (Hong Kong) Limited 16 - AS27731 473 0.0% 473.0 -- ACH Colombia 17 - AS33188 927 0.0% 463.5 -- SCS-NETWORK-1 - Sono Corporate Suites 18 - AS31414 458 0.0% 458.0 -- SEVENCS-AS SevenCs AG & Co.KG 19 - AS23734 857 0.0% 428.5 -- ONE-NORTH-AS-AP ONE-NORTH 20 - AS12497 2541 0.1% 423.5 -- SANET-GE SANET NETWORK (AS) TOP 20 Unstable Prefixes Rank Prefix Upds % Origin AS -- AS Name 1 - 61.0.0.0/8 4305 0.1% AS4678 -- FINE CANON NETWORK COMMUNICATIONS INC. 2 - 222.127.32.0/19 4064 0.1% AS4775 -- GLOBE-TELECOM-AS Telecom Carrier / ISP Plus + 3 - 147.60.0.0/16 4003 0.1% AS10100 -- ASN-AP-UBSW # AS-AP-UBSW CONVERTED TO ASN-AP-UBSW FOR RPSL COMPLIANCE UBS Warburg Autonomous System Asia-Pacific 4 - 62.213.176.0/23 3553 0.1% AS35489 -- TOTO-TECH-AS Toto Ltd. 5 - 209.140.24.0/24 3235 0.1% AS3043 -- AMPHIB-AS - Amphibian Media Corporation 6 - 59.37.2.0/23 2758 0.1% AS4809 -- CHINANET-CORE-WAN-CENTRAL CHINANET core WAN Central 7 - 58.49.108.0/24 2632 0.1% AS4809 -- CHINANET-CORE-WAN-CENTRAL CHINANET core WAN Central 8 - 170.210.128.0/21 2049 0.1% AS4270 -- Red de Interconexion Universitaria 9 - 216.32.206.0/24 1996 0.1% AS20473 -- AS-CHOOPA - Choopa, LLC 10 - 210.56.52.0/24 1854 0.1% AS38197 -- SUNHK-DATA-AS-AP Sun Network (Hong Kong) Limited 11 - 83.98.220.0/23 1823 0.1% AS39250 -- COLOPROVIDER-AS Colo Provider 12 - 194.242.124.0/22 1395 0.0% AS31594 -- FORTESS-AS Fortess LLC Network 13 - 138.187.128.0/18 1276 0.0% AS3303 -- SWISSCOM Swisscom Solutions Ltd 14 - 209.69.212.0/22 1275 0.0% AS11574 -- AVALONSYS - Avalon Systems, Inc. 15 - 143.81.0.0/21 1149 0.0% AS6034 -- DDN-ASNBLK - DoD Network Information Center 16 - 89.4.130.0/24 1086 0.0% AS24731 -- ASN-NESMA National Engineering Services and Marketing Company Ltd. (NESMA) 17 - 221.143.13.0/24 1063 0.0% AS9945 -- KCACBACKUP-AS-KR Korea Information Security Agency 18 - 146.222.45.0/24 1031 0.0% AS703 -- UNSPECIFIED UUNET 19 - 146.222.69.0/24 1028 0.0% AS703 -- UNSPECIFIED UUNET 20 - 194.42.208.0/20 987 0.0% AS705 -- UUNET - MCI Communications Services, Inc. d/b/a Verizon Business Details at http://bgpupdates.potaroo.net ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org ausnog(a)ausnog.net

1 0